CVE-2026-85592 - phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoi

CVE-2026-85591 - phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control pa

CVE-2026-85590 - phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authenticati

CVE-2026-85589 - phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard

CVE-2026-85588 - phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export

CVE-2026-85587 - phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-p

CVE-2026-85586 - phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in

CVE-2026-85585 - SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurr

CVE-2026-85584 - SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic

CVE-2026-85583 - SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-r

CVE-2026-85582 - SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-ser

CVE-2026-85581 - SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/u

CVE-2026-85580 - SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handl

CVE-2026-85579 - SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2)

CVE-2026-85578 - SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoin

CVE-2026-85577 - AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin

CVE-2026-19080 - Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account

CVE-2026-19051 - Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retriev

CVE-2026-19043 - Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functio

CVE-2026-18957 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-85534 - A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input st

CVE-2026-85512 - A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vu

CVE-2026-84428 - fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowerca

CVE-2026-84045 - The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a cli

CVE-2026-79707 - A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) v

CVE-2026-4644 - A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versi

CVE-2026-27347 - Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured

CVE-2026-85547 - A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF prote

CVE-2026-85546 - MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit func

CVE-2026-85541 - DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated

CVE-2026-85540 - DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers

CVE-2026-85184 - @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by m

CVE-2026-84504 - fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the

CVE-2026-84469 - fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthi

CVE-2026-84044 - The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal p

CVE-2026-84043 - The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify th

CVE-2026-82923 - The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or n

CVE-2026-81666 - An integer overflow was found in Corosync's handling of membership commit token messages. The length

CVE-2026-76169 - fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix t

CVE-2026-27086 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-13148 - Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resourc

CVE-2026-85538 - An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes fr

CVE-2026-85533 - An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without ver

CVE-2026-85528 - Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver vers

CVE-2026-85525 - Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a r

CVE-2026-85311 - Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Config

CVE-2026-81665 - A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembl

CVE-2026-81302 - PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a loc

CVE-2026-57777 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-32480 - Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Confi

CVE-2026-27432 - Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allow

CVE-2026-15937 - Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the

CVE-2026-85229 - ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-

CVE-2026-85197 - A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can ex

CVE-2026-80190 - Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.

CVE-2026-6217 - Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online

CVE-2026-85094 - The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin ru

CVE-2026-85085 - The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView

CVE-2026-84146 - The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capa

CVE-2026-84066 - The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.

CVE-2026-82194 - The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user s

CVE-2026-82193 - The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user s

CVE-2026-82186 - The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination param

CVE-2026-81347 - The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-c

CVE-2026-81270 - Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: t

CVE-2026-80438 - The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrato

CVE-2026-80181 - Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affect

CVE-2026-80180 - Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from

CVE-2026-79632 - The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in o

CVE-2026-79631 - The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to

CVE-2026-79630 - The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a c

CVE-2026-74853 - The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may r

CVE-2026-71216 - PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves

CVE-2026-70403 - XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the

CVE-2026-69657 - XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the cr

CVE-2026-66840 - XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sp

CVE-2026-62928 - XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injec

CVE-2026-19224 - The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting

CVE-2026-17517 - The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view

CVE-2026-16281 - The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can ed

CVE-2026-15354 - The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,

CVE-2025-15691 - The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on

CVE-2026-85509 - FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-f

CVE-2026-85508 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc

CVE-2026-85507 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc

CVE-2026-85506 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_

CVE-2026-85505 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_en

CVE-2026-85504 - FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long

CVE-2026-85409 - A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the funct

CVE-2026-85408 - A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function o

CVE-2026-85407 - A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown proces

CVE-2026-11613 - The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up t

CVE-2026-85406 - A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknow

CVE-2026-85405 - A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the f

CVE-2026-85403 - A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknow

CVE-2026-85402 - A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affe

CVE-2026-85401 - A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is som

CVE-2026-85399 - A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by th

CVE-2026-85398 - A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the fun

CVE-2026-85149 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-85148 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-85147 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-85146 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-75754 - Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-co

CVE-2026-85397 - A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the fu

CVE-2026-85383 - A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unk

CVE-2026-85382 - A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601ef

CVE-2026-45200 - Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to c

CVE-2026-45197 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-85381 - A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d

CVE-2026-85380 - A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601

CVE-2026-85379 - A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf4

CVE-2026-67402 - An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs t

CVE-2026-67398 - Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8

CVE-2026-67397 - Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to ex

CVE-2026-49509 - Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue

CVE-2026-85456 - MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the S

CVE-2026-85455 - MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four

CVE-2026-85454 - MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegr

CVE-2026-85453 - MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, al

CVE-2026-85452 - MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeG

CVE-2026-85451 - MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSle

CVE-2026-85450 - MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server t

CVE-2026-85449 - MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE

CVE-2026-85448 - MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in p

CVE-2026-85447 - MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validat

CVE-2026-85446 - MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where

CVE-2026-85445 - MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() fu

CVE-2026-85444 - MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isC

CVE-2026-85443 - MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLo

CVE-2026-85442 - MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesW

CVE-2026-85441 - MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in C

CVE-2026-85440 - MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommP

CVE-2026-85439 - MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::

CVE-2026-85438 - MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dime

CVE-2026-85437 - MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string dec

CVE-2026-85436 - MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPkt

CVE-2026-85435 - MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on th

CVE-2026-85434 - MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbo

CVE-2026-85433 - MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing

CVE-2026-85432 - MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowi

CVE-2026-85431 - MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerab

CVE-2026-85430 - MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that ac

CVE-2026-85429 - MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather t

CVE-2026-85428 - MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB

CVE-2026-85427 - MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allow

CVE-2026-85426 - MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names w

CVE-2026-85425 - MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable

CVE-2026-85424 - MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated cl

CVE-2026-85378 - A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601

CVE-2026-85241 - A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the fun

CVE-2026-85225 - A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability af

CVE-2026-83711 - Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an u

CVE-2026-80098 - Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker t

CVE-2026-70352 - Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to

CVE-2026-70178 - Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a

CVE-2026-69857 - Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to

CVE-2026-65818 - Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privil

CVE-2026-62916 - Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorize

CVE-2026-62906 - Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows

CVE-2026-18330 - A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A L

CVE-2026-18167 - A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4.

CVE-2026-85224 - A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part o

CVE-2026-85223 - A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functio

CVE-2026-64200 - There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64199 - There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64198 - There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64197 - There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64196 - There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64195 - There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-su

CVE-2026-9745 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without vali

CVE-2026-9744 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS

CVE-2026-9736 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject dat

CVE-2026-9036 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS

CVE-2026-8862 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the appl

CVE-2026-85458 - Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.

CVE-2026-85222 - A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unkn

CVE-2026-85208 - A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affecte

CVE-2026-85063 - node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prio

CVE-2026-85062 - Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior t

CVE-2026-85061 - MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanit

CVE-2026-84185 - A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing a

CVE-2026-82521 - parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from

CVE-2026-82520 - parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no li

CVE-2026-77465 - toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.

CVE-2026-71429 - stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal mem

CVE-2026-63376 - toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler

CVE-2026-85207 - A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an u

CVE-2026-85053 - Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote

CVE-2026-85052 - Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attack

CVE-2026-85051 - Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to e

CVE-2026-85050 - Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote

CVE-2026-85049 - Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute

CVE-2026-85048 - Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who

CVE-2026-85047 - Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82

CVE-2026-85046 - Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute ar

CVE-2026-85045 - Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute ar

CVE-2026-85044 - Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a r

CVE-2026-85043 - Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to b

CVE-2026-85042 - Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to exec

CVE-2026-82527 - R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to in

CVE-2026-53728 - Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6,

CVE-2026-44506 - Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1

CVE-2026-19795 - Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during dese

CVE-2026-85396 - rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fail

CVE-2026-85395 - UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL

CVE-2026-85394 - python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepti

CVE-2026-85393 - node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during

CVE-2026-85392 - Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user

CVE-2026-85391 - Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows u

CVE-2026-85390 - Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notificati

CVE-2026-85389 - Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API

CVE-2026-85388 - Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helpe

CVE-2026-85205 - A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affec

CVE-2026-85028 - Creation of a temporary file in a directory with insecure permissions in the FPGA management tool in

CVE-2026-82526 - R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attacke

CVE-2026-82302 - Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via

CVE-2026-82299 - Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorr

CVE-2026-82298 - Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly

CVE-2026-78596 - Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization

CVE-2026-78595 - Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862)

CVE-2026-78593 - An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticate

CVE-2026-78583 - Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipula

CVE-2026-49456 - Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper e

CVE-2026-49455 - Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher in

CVE-2026-33630 - c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-

CVE-2026-15431 - A potential security vulnerability has been identified in the HP Support Assistant for versions pri

CVE-2026-85187 - A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affe

CVE-2026-85012 - Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthe

CVE-2026-84968 - An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthen

CVE-2026-83959 - Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in

CVE-2026-82024 - LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that a

CVE-2026-82023 - LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability

CVE-2026-63219 - GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.

CVE-2026-58400 - GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.

CVE-2026-85309 - Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorr

CVE-2026-85308 - Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows

CVE-2026-85307 - Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allow

CVE-2026-85306 - Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress

CVE-2026-85305 - Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. Th

CVE-2026-85304 - Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Wid

CVE-2026-85303 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-85302 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-85242 - PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retriev

CVE-2026-85186 - A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this

CVE-2026-84849 - Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

CVE-2026-84848 - Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

CVE-2026-84847 - Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

CVE-2026-84836 - Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

CVE-2026-84834 - Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.