CVE-2026-40463 - WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log File

CVE-2026-82621 - A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4c

CVE-2026-82620 - A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af40

CVE-2026-82619 - A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function m

CVE-2026-82618 - A vulnerability was determined in Systerel S2OPC up to 1.7.3. The affected element is the function s

CVE-2026-82616 - A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUpl

CVE-2026-82615 - A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affec

CVE-2026-82614 - A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affect

CVE-2026-82727 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoeni

CVE-2026-82726 - Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select t

CVE-2026-82725 - Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an at

CVE-2026-82724 - Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authoriza

CVE-2026-82613 - A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the f

CVE-2026-82612 - A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affe

CVE-2026-82611 - A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this

CVE-2026-82610 - A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is

CVE-2026-82609 - A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unkno

CVE-2026-82722 - Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any

CVE-2026-82681 - Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who

CVE-2026-82673 - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-pr

CVE-2026-82608 - A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes o

CVE-2026-82607 - A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impact

CVE-2026-82605 - A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown

CVE-2026-81853 - Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a reco

CVE-2026-81852 - Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, public

CVE-2026-77850 - Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record

CVE-2026-75757 - Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin

CVE-2026-82604 - A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the compo

CVE-2026-82603 - A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the

CVE-2026-82602 - A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown

CVE-2026-82601 - A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.p

CVE-2026-82600 - A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown fun

CVE-2026-82580 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai dis

CVE-2026-82579 - Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an a

CVE-2026-82564 - Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller

CVE-2026-75760 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai dis

CVE-2026-82599 - A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function

CVE-2026-82598 - A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file se

CVE-2026-82597 - A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function

CVE-2026-81315 - Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass th

CVE-2026-77956 - Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a

CVE-2026-82596 - A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function L

CVE-2026-82595 - A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function s

CVE-2026-82594 - A vulnerability has been found in LogNet grpc-spring-boot-starter up to 5.2.0. Affected is an unknow

CVE-2026-82593 - A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /bo

CVE-2026-82592 - A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the f

CVE-2026-82591 - A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impa

CVE-2026-82590 - A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm

CVE-2026-82589 - A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_h

CVE-2026-82588 - A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of

CVE-2026-56718 - AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in

CVE-2026-64844 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64843 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64842 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64841 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64840 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64839 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-56716 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-82587 - A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_n

CVE-2026-82367 - Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one s

CVE-2026-81643 - Incorrect Authorization vulnerability in ash-project ash_graphql delivers GraphQL subscription paylo

CVE-2026-81636 - Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows

CVE-2026-81633 - Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client

CVE-2026-80223 - Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber

CVE-2026-78693 - Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphq

CVE-2026-56715 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-56713 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-82556 - A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of t

CVE-2026-82555 - A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects

CVE-2026-82554 - A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of

CVE-2026-81322 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak al

CVE-2026-81319 - Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can

CVE-2026-82553 - A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb

CVE-2026-82552 - A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnera

CVE-2026-82551 - A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of t

CVE-2026-82550 - A security flaw has been discovered in Linux Foundation Magma 1.9.0. This impacts an unknown functio

CVE-2026-82549 - A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of

CVE-2026-78699 - Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenan

CVE-2026-82658 - Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php

CVE-2026-82657 - Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for foru

CVE-2026-82656 - Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowin

CVE-2026-82655 - Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list paramet

CVE-2026-82654 - SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink,

CVE-2026-82653 - SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where u

CVE-2026-82652 - SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view ke

CVE-2026-82651 - SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34)

CVE-2026-82650 - SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate

CVE-2026-82649 - SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled

CVE-2026-82648 - WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL

CVE-2026-82647 - WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows au

CVE-2026-82646 - WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embe

CVE-2026-82645 - AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/vie

CVE-2026-82644 - WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRa

CVE-2026-82643 - WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preau

CVE-2026-82548 - A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown f

CVE-2026-82547 - A vulnerability was found in Linux Foundation Magma 1.9.0. The affected element is an unknown functi

CVE-2026-82545 - A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknow

CVE-2026-82642 - Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter H

CVE-2026-82641 - Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to a

CVE-2026-82640 - browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext w

CVE-2026-82639 - NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the

CVE-2026-82638 - jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthe

CVE-2026-82637 - browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent

CVE-2026-82636 - Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm cal

CVE-2026-82544 - A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset

CVE-2026-82635 - Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto t

CVE-2026-82634 - Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpo

CVE-2026-82633 - Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users:

CVE-2026-82543 - A vulnerability was detected in vastsa FileCodeBox up to 2.3. This vulnerability affects the functio

CVE-2026-82542 - A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formI

CVE-2026-82541 - A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this

CVE-2026-82540 - A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknow

CVE-2026-81318 - Incorrect Authorization vulnerability in ash-project ash_sql allows a caller in a schema-based multi

CVE-2026-81316 - Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate

CVE-2026-80227 - Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with t

CVE-2026-78691 - Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql

CVE-2026-78228 - Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's

CVE-2026-78038 - Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-

CVE-2026-77454 - Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or

CVE-2026-82539 - A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function se

CVE-2026-82488 - A vulnerability was identified in Beetel 450TC3 01.00.00_01. This vulnerability affects unknown code

CVE-2026-82487 - A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing

CVE-2026-82486 - A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown function

CVE-2026-82485 - A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vuln

CVE-2026-82484 - A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown functio

CVE-2026-82483 - A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impac

CVE-2026-82482 - A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.

CVE-2026-81766 - The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to

CVE-2026-81660 - The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not

CVE-2026-78364 - The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings

CVE-2026-76585 - The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape th

CVE-2026-19722 - The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the dest

CVE-2026-14835 - The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise

CVE-2026-14307 - The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters be

CVE-2026-82480 - A security flaw has been discovered in NASA cFS up to 7.0.1. The affected element is the function CF

CVE-2026-82479 - A vulnerability was identified in NASA cFS up to 7.0.1. Impacted is the function OS_read of the file

CVE-2026-82478 - A vulnerability was determined in NASA Trick 19.6.0. This issue affects the function JSONVariableSer

CVE-2026-15980 - The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, a

CVE-2026-77846 - Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql

CVE-2026-75759 - Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthentica

CVE-2026-82562 - ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comm

CVE-2026-77970 - Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an at

CVE-2026-77831 - Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who ca

CVE-2026-75847 - Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an at

CVE-2026-82417 - ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `construct

CVE-2026-82424 - A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulner

CVE-2026-82423 - A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown fu

CVE-2026-82422 - A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an u

CVE-2026-82421 - A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects so

CVE-2026-15369 - The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege

CVE-2026-75807 - The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in v

CVE-2026-82476 - Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in

CVE-2026-82475 - iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow en

CVE-2026-82474 - Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-b

CVE-2026-82473 - KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authe

CVE-2026-82472 - Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requi

CVE-2026-82470 - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature

CVE-2026-82469 - Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that

CVE-2026-82468 - Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the J

CVE-2026-82467 - Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login

CVE-2026-82466 - Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route th

CVE-2026-82465 - pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML

CVE-2026-82464 - pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that

CVE-2026-82463 - pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorize

CVE-2026-82462 - pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization c

CVE-2026-82461 - pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when

CVE-2026-82460 - Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation a

CVE-2026-82481 - The cohttp package before 6.3.0 for OCaml allows directory traversal.

CVE-2026-82477 - In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to

CVE-2026-82457 - su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before a

CVE-2026-82456 - argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions withou

CVE-2026-82455 - Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior du

CVE-2026-82454 - The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass i

CVE-2026-82453 - rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the

CVE-2026-82452 - rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most

CVE-2026-82451 - Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that r

CVE-2026-82450 - BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import f

CVE-2026-82449 - Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint d

CVE-2026-82448 - Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that al

CVE-2026-82447 - Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompt

CVE-2026-14494 - The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up t

CVE-2026-82364 - A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown f

CVE-2026-80725 - In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG

CVE-2026-81346 - The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check

CVE-2026-81342 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect pa

CVE-2026-81200 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict acc

CVE-2026-81026 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, rec

CVE-2026-80488 - The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape impo

CVE-2026-80311 - The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscr

CVE-2026-77786 - The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automa

CVE-2026-77704 - The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that

CVE-2026-77012 - The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its

CVE-2026-77010 - The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perfo

CVE-2026-77008 - The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have

CVE-2026-77007 - The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perfo

CVE-2026-76586 - The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does no

CVE-2026-76548 - The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end fil

CVE-2026-76547 - The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being des

CVE-2026-76546 - The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its opt

CVE-2026-19430 - The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its RES

CVE-2026-18234 - The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet

CVE-2026-18233 - The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its

CVE-2026-17522 - The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when sav

CVE-2026-17520 - The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently rand

CVE-2026-16947 - The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a

CVE-2026-16600 - The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJ

CVE-2026-16259 - The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified th

CVE-2026-16061 - The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from th

CVE-2026-10522 - The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied

CVE-2026-41012 - Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between

CVE-2026-55867 - Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the D

CVE-2026-55860 - MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4

CVE-2026-55859 - MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4

CVE-2026-55858 - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

CVE-2026-55857 - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

CVE-2026-55856 - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

CVE-2026-55855 - MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL

CVE-2026-55854 - MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL

CVE-2026-55848 - mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30,

CVE-2026-55841 - Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7,

CVE-2026-55785 - free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component

CVE-2026-55784 - free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the A

CVE-2026-55779 - Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::g

CVE-2026-55764 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go all

CVE-2026-82333 - multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with t

CVE-2026-82018 - IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vu

CVE-2026-82017 - IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection

CVE-2026-81533 - An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a

CVE-2026-81532 - A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can

CVE-2026-81520 - A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authen

CVE-2026-81518 - When mongosqld is configured with a client certificate authority file, the listener requests a clien

CVE-2026-81517 - An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance m

CVE-2026-81490 - A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause

CVE-2026-77078 - multer is a middleware for handling multipart/form-data in Node.js. A small multipart request contai

CVE-2026-77063 - multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asyn

CVE-2026-77037 - multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-ba

CVE-2026-76651 - A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing

CVE-2026-76650 - A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing

CVE-2026-76649 - A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing

CVE-2026-75118 - A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt funct

CVE-2026-55891 - PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5,

CVE-2026-55763 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercen

CVE-2026-55696 - PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5,

CVE-2026-55678 - Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enter

CVE-2026-51665 - Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51664 - Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51663 - Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51662 - Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015

CVE-2026-51661 - Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 al

CVE-2026-3686 - IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service