CVE-2026-66357 - httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Ev

CVE-2026-5480 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-59696 - Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remot

CVE-2026-58569 - Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability.

CVE-2026-55951 - The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers rece

CVE-2026-18780 - Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft

CVE-2026-18771 - Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co

CVE-2026-18630 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-9637 - A denial-of-service security issue exists in the affected Logix platforms listed in the table above.

CVE-2026-9634 - A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary

CVE-2026-9633 - A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binar

CVE-2026-9625 - A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an overs

CVE-2026-9624 - A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the

CVE-2026-9622 - A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the

CVE-2026-9621 - A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from impr

CVE-2026-84218 - A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-co

CVE-2026-84109 - A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the f

CVE-2026-80047 - A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files

CVE-2026-79684 - Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with li

CVE-2026-58572 - Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileg

CVE-2026-58571 - Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited p

CVE-2026-51766 - Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51765 - Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 a

CVE-2026-51764 - Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211

CVE-2026-51763 - Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51762 - Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51761 - Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows una

CVE-2026-51760 - Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51757 - Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51756 - Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51754 - Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51752 - Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51751 - Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51750 - Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51748 - Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015

CVE-2026-19513 - The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,

CVE-2026-18808 - Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electr

CVE-2026-18210 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-16675 - A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security is

CVE-2026-13348 - CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could a

CVE-2026-13337 - CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious

CVE-2026-13336 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v

CVE-2026-12663 - A security issue exists within ControlFLASH™, where the installer grants write permissions to the "E

CVE-2026-12661 - A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition.  A network

CVE-2025-12768 - A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level au

CVE-2024-14047 - A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a dir

CVE-2024-10085 - CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause 

CVE-2026-84235 - A denial-of-service security issue exists in the affected product. The security issue stems from a c

CVE-2026-84149 - This vulnerability exists in the ERP system due to exposure of repository information through a publ

CVE-2026-84148 - This vulnerability exists in the ERP system due to improper authentication and authorization control

CVE-2026-84147 - This vulnerability exists in the ERP system due to improper authentication controls and inadequate f

CVE-2026-84145 - Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

CVE-2026-84144 - Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showe

CVE-2026-84143 - Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14.

CVE-2026-84142 - Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corru

CVE-2026-84141 - Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, F

CVE-2026-84140 - Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155,

CVE-2026-84139 - Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefo

CVE-2026-84138 - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thund

CVE-2026-84137 - Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firef

CVE-2026-84136 - Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox E

CVE-2026-84135 - Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.

CVE-2026-84134 - Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ES

CVE-2026-84133 - Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firef

CVE-2026-84132 - Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 15

CVE-2026-84131 - Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed

CVE-2026-84130 - Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 15

CVE-2026-84129 - Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155,

CVE-2026-84128 - Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 an

CVE-2026-84127 - Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was

CVE-2026-84126 - Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox

CVE-2026-84125 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firef

CVE-2026-84124 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firef

CVE-2026-84123 - Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was

CVE-2026-84122 - Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ES

CVE-2026-84121 - Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in

CVE-2026-84120 - Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ES

CVE-2026-84119 - Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed

CVE-2026-84118 - Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox

CVE-2026-84117 - Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

CVE-2026-84061 - A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerabil

CVE-2026-7877 - The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th

CVE-2026-79683 - Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with li

CVE-2026-58575 - Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attack

CVE-2026-53682 - An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDom

CVE-2026-51747 - Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51745 - Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51744 - Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 al

CVE-2026-51743 - Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51742 - Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows una

CVE-2026-51741 - Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-19472 - A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from impro

CVE-2026-19471 - Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs

CVE-2026-18765 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-84200 - Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in e

CVE-2026-84199 - Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall fea

CVE-2026-84196 - Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url th

CVE-2026-84195 - Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outb

CVE-2026-84194 - LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command inje

CVE-2026-84193 - LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template

CVE-2026-84192 - LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates

CVE-2026-84191 - LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages whe

CVE-2026-84190 - LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController

CVE-2026-84189 - LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by th

CVE-2026-84188 - LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<

CVE-2026-84187 - AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows una

CVE-2026-83595 - AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows at

CVE-2026-77194 - The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Adminis

CVE-2026-76111 - Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with lo

CVE-2026-18550 - The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Accoun

CVE-2026-11873 - An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 5

CVE-2026-10420 - Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulatio

CVE-2025-15613 - Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call func

CVE-2023-54356 - Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_

CVE-2026-84165 - A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting

CVE-2026-84059 - A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the fun

CVE-2026-82927 - Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulatio

CVE-2026-82926 - NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. T

CVE-2026-4813 - A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows au

CVE-2026-59681 - A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Dir

CVE-2026-59680 - An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settin

CVE-2026-25706 - Improper neutralization of special elements used in an OS command in yast2-samba-client allows an at

CVE-2026-19914 - The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cu

CVE-2026-16788 - The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cros

CVE-2026-16786 - The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cros

CVE-2026-15101 - The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

CVE-2026-78363 - The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values fr

CVE-2026-74916 - The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query

CVE-2026-13611 - The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST

CVE-2026-78319 - A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) r

CVE-2026-83772 - A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. Thi

CVE-2026-77189 - The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising

CVE-2026-75980 - The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPres

CVE-2026-75964 - The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi

CVE-2026-18488 - The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName

CVE-2026-83744 - A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnera

CVE-2026-83743 - A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown

CVE-2026-82747 - Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy

CVE-2026-77823 - The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of th

CVE-2026-76006 - The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQ

CVE-2026-75965 - The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi

CVE-2026-75921 - The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widge

CVE-2026-19952 - The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due t

CVE-2026-19948 - The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates

CVE-2026-19806 - The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin

CVE-2026-19796 - The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul

CVE-2026-19573 - The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-18752 - The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id

CVE-2026-17589 - The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via

CVE-2026-16787 - The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cros

CVE-2026-13203 - The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cros

CVE-2026-12747 - The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

CVE-2026-82749 - Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping

CVE-2026-82748 - Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read acti

CVE-2026-82746 - Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden b

CVE-2026-82745 - Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing

CVE-2026-82744 - Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change whe

CVE-2026-82743 - Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spi

CVE-2026-82742 - Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node mem

CVE-2026-82741 - Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker con

CVE-2026-82740 - Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constrai

CVE-2026-82739 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash disclo

CVE-2026-82738 - Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny r

CVE-2026-82737 - Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored ve

CVE-2026-82736 - Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an atta

CVE-2026-82735 - Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an ex

CVE-2026-82734 - Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attack

CVE-2026-19032 - jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without res

CVE-2026-82733 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typesc

CVE-2026-82732 - Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to su

CVE-2026-82731 - URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allo

CVE-2026-82730 - Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC calle

CVE-2026-77950 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typesc

CVE-2026-77856 - Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript all

CVE-2026-75865 - The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode pl

CVE-2026-74837 - Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript all

CVE-2026-67395 - A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due

CVE-2026-67394 - A critical local privilege escalation via OS command injection vulnerability has been discovered in

CVE-2026-65643 - Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitra

CVE-2026-48932 - A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding pro

CVE-2026-18743 - A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configu

CVE-2026-19820 - A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creat

CVE-2026-83524 - A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optim

CVE-2026-82971 - A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown par

CVE-2026-4560 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-82957 - A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the fu

CVE-2026-82954 - A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikCo

CVE-2026-82922 - A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects

CVE-2026-82921 - A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_typ

CVE-2026-82882 - Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webho

CVE-2026-82398 - pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PD

CVE-2026-82397 - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parse

CVE-2026-82396 - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versio

CVE-2026-82395 - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versio

CVE-2026-82394 - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versio

CVE-2026-82393 - pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a t

CVE-2026-77353 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallo

CVE-2026-77352 - Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before

CVE-2026-77351 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallo

CVE-2026-77348 - Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the f

CVE-2026-83596 - A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to i

CVE-2026-82919 - A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the func

CVE-2026-82914 - A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability

CVE-2026-82909 - A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is s

CVE-2026-82908 - A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is th

CVE-2026-82906 - A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the fi

CVE-2026-82852 - Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.

CVE-2026-82392 - pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package n

CVE-2026-82346 - A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.

CVE-2026-82229 - Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

CVE-2026-82228 - Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

CVE-2026-82226 - Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

CVE-2026-82225 - Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

CVE-2026-82224 - Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

CVE-2026-82221 - Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

CVE-2026-81892 - EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 an

CVE-2026-81891 - elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1

CVE-2026-81890 - elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1

CVE-2026-81889 - elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1

CVE-2026-81888 - @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in so

CVE-2026-81887 - Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-not

CVE-2026-81780 - Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

CVE-2026-81779 - Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows

CVE-2026-81778 - Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

CVE-2026-81768 - Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

CVE-2026-81765 - Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

CVE-2026-81764 - Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

CVE-2026-81763 - Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

CVE-2026-81762 - Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

CVE-2026-81758 - Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

CVE-2026-81756 - Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

CVE-2026-81298 - Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

CVE-2026-81297 - Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

CVE-2026-81296 - Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

CVE-2026-81293 - Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

CVE-2026-81291 - Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

CVE-2026-81290 - Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

CVE-2026-81287 - Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

CVE-2026-81280 - Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4

CVE-2026-81278 - Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured

CVE-2026-79483 - FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api

CVE-2026-79408 - An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary comma

CVE-2026-79407 - A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbi

CVE-2026-75594 - Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the releas

CVE-2026-75592 - Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the releas

CVE-2026-75460 - XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-en

CVE-2026-75458 - The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <=

CVE-2026-71415 - Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk up

CVE-2026-62993 - Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from app

CVE-2026-61641 - Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before