CVE-2026-3627 - IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send special

CVE-2026-22056 - StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration

CVE-2026-19295 - IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operatin

CVE-2026-19294 - IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and rea

CVE-2026-19286 - IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to

CVE-2026-18904 - IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information

CVE-2026-18899 - IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to p

CVE-2026-18891 - IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and a

CVE-2026-18729 - IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitra

CVE-2026-18545 - IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may

CVE-2026-18527 - IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow

CVE-2026-17203 - IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain

CVE-2026-16821 - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg

CVE-2026-13735 - Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packe

CVE-2026-13734 - Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wiregu

CVE-2025-64649 - IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using

CVE-2025-36290 - IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates T

CVE-2025-36271 - IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic alg

CVE-2026-82343 - A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file,

CVE-2026-82329 - JFrog Artifactory contains an authentication weakness that, under default configuration, may allow a

CVE-2026-82306 - StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoi

CVE-2026-82291 - HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing creden

CVE-2026-82290 - Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints.

CVE-2026-82289 - Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host w

CVE-2026-82288 - Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v

CVE-2026-82287 - Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass o

CVE-2026-82286 - gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint

CVE-2026-82285 - bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/

CVE-2026-82284 - Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, D

CVE-2026-82283 - VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing a

CVE-2026-82282 - Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticat

CVE-2026-82281 - Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_con

CVE-2026-82280 - Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users

CVE-2026-82279 - HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, all

CVE-2026-82278 - BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoin

CVE-2026-82277 - Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operatio

CVE-2026-82276 - StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classe

CVE-2026-82275 - Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails

CVE-2026-82274 - Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propa

CVE-2026-82273 - Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread owner

CVE-2026-82272 - Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked throug

CVE-2026-82271 - R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handl

CVE-2026-82270 - Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/pr

CVE-2026-82269 - Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API

CVE-2026-82268 - Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsi

CVE-2026-82267 - Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before perform

CVE-2026-82266 - Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting t

CVE-2026-82265 - Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authenti

CVE-2026-82264 - Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails t

CVE-2026-82263 - Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector

CVE-2026-82262 - Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id

CVE-2026-82021 - Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog

CVE-2026-82020 - Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows

CVE-2026-81849 - Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in ama

CVE-2026-77939 - Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows

CVE-2026-77586 - In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are pla

CVE-2026-77218 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow vu

CVE-2026-77217 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains authenticated stack buffer overflow an

CVE-2026-77184 - In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorpo

CVE-2026-76798 - The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log f

CVE-2026-76797 - The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV r

CVE-2026-76794 - MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including i

CVE-2026-75486 - Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker wh

CVE-2026-75126 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains multiple authenticated stack buffer ov

CVE-2026-75125 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated null pointer derefere

CVE-2026-75124 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption

CVE-2026-75123 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection

CVE-2026-75122 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection

CVE-2026-75121 - PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains an authenticated OS command injection

CVE-2026-72984 - Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all

CVE-2026-70331 - Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthor

CVE-2026-70309 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass

CVE-2026-66798 - Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ov

CVE-2026-66324 - External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized atta

CVE-2026-66323 - Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows a

CVE-2026-62904 - Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo

CVE-2026-58616 - Concurrent execution using shared resource with improper synchronization ('race condition') in Copil

CVE-2026-56100 - SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnera

CVE-2026-55834 - Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. Fro

CVE-2026-55673 - PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to 7.2.2

CVE-2026-55634 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026

CVE-2026-55584 - phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_AL

CVE-2026-55569 - aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/arc

CVE-2026-55566 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlle

CVE-2026-55565 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getV

CVE-2026-55559 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from PO

CVE-2026-55552 - Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves

CVE-2026-55549 - Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect

CVE-2026-55547 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.Contro

CVE-2026-55545 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handl

CVE-2026-55521 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks i

CVE-2026-55520 - Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, prot

CVE-2026-55511 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPri

CVE-2026-55509 - WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBro

CVE-2026-55485 - Piccolo Admin is an admin interface and content management system for Python, built on top of Piccol

CVE-2026-55484 - ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking

CVE-2026-55425 - Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the Sy

CVE-2026-55378 - JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Bra

CVE-2026-55248 - plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior t

CVE-2026-55247 - plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iC

CVE-2026-55245 - Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the is

CVE-2026-55220 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026

CVE-2026-55215 - MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL

CVE-2026-55108 - KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until

CVE-2026-55068 - free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF Regis

CVE-2026-55067 - Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/project

CVE-2026-55066 - Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/project

CVE-2026-55065 - Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api

CVE-2026-55064 - Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with

CVE-2026-54788 - dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, da

CVE-2026-54766 - Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project

CVE-2026-54755 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty

CVE-2026-54754 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace s

CVE-2026-54746 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-54745 - Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows.

CVE-2026-51660 - Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 a

CVE-2026-51659 - Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51658 - Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51657 - Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51656 - Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51655 - Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51654 - Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51653 - Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51652 - Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51651 - Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51650 - Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51649 - Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51648 - Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51647 - Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51646 - Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51645 - Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51644 - Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51643 - Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51642 - Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 al

CVE-2026-51641 - Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51640 - Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 a

CVE-2026-51639 - Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51638 - Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51637 - Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51636 - Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51635 - Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51634 - Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51633 - Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 al

CVE-2026-51632 - Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51631 - Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51630 - Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51629 - Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51628 - Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015

CVE-2026-51627 - Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51626 - Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51625 - Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51624 - Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allo

CVE-2026-51623 - Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51622 - Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51621 - Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unau

CVE-2026-51620 - Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51619 - Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51618 - Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51617 - Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows

CVE-2026-51616 - Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows una

CVE-2026-51615 - Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut

CVE-2026-51614 - Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 all

CVE-2026-51613 - Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows u

CVE-2026-51611 - Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allow

CVE-2026-51610 - Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un

CVE-2026-51376 - An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an una

CVE-2026-50980 - Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.

CVE-2026-39071 - WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Ti

CVE-2026-39070 - WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Act

CVE-2026-82330 - A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file,

CVE-2026-82328 - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file,

CVE-2026-82327 - A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such

CVE-2026-82324 - A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/

CVE-2026-82227 - Contributor SQL Injection in WPBulky <= 1.2.2 versions.

CVE-2026-82220 - Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

CVE-2026-82181 - Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Un

CVE-2026-82112 - A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown func

CVE-2026-82078 - An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCu

CVE-2026-81767 - Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

CVE-2026-81761 - Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.

CVE-2026-81760 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-81759 - Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

CVE-2026-81757 - Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.

CVE-2026-81578 - An improper access control vulnerability exists in the web management interface of PaperCut MF and P

CVE-2026-81341 - wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the

CVE-2026-81299 - Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.

CVE-2026-81285 - Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versio

CVE-2026-81284 - Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

CVE-2026-81020 - wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is s

CVE-2026-81019 - wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is

CVE-2026-75758 - Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls

CVE-2026-6176 - The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti

CVE-2026-5953 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-5934 - The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a

CVE-2026-5800 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-5096 - The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions

CVE-2026-58107 - CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, B

CVE-2026-58106 - CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r  was fixed by replacing unchecked s

CVE-2026-56854 - The source-address critical option in the Permissions returned by an authentication callback was onl

CVE-2026-50979 - A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.

CVE-2026-4378 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-3423 - The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery

CVE-2026-38725 - xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject ar

CVE-2026-38638 - An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to caus

CVE-2026-38636 - An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to caus

CVE-2026-38093 - file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to pa

CVE-2026-37751 - An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23bl

CVE-2026-37736 - An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers t

CVE-2026-37710 - Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary

CVE-2026-37237 - vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exha

CVE-2026-37236 - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP

CVE-2026-19412 - This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP D

CVE-2026-15603 - morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal h

CVE-2026-14942 - Rejected reason: This CVE ID was assigned to a reported vulnerability in the Customer Reviews for Wo

CVE-2026-13761 - Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that ar

CVE-2026-82261 - SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form

CVE-2026-82260 - SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experim

CVE-2026-82259 - SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion

CVE-2026-82258 - SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows con

CVE-2026-82257 - SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form function

CVE-2026-82256 - SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing atta

CVE-2026-82255 - gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transp

CVE-2026-82254 - gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocatio

CVE-2026-82253 - gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerabil

CVE-2026-82252 - gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attacke

CVE-2026-82251 - gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing pa

CVE-2026-82250 - gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implemen

CVE-2026-82249 - gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credenti

CVE-2026-82248 - gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Win

CVE-2026-82247 - gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not tr

CVE-2026-82246 - Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query impo

CVE-2026-82245 - Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, al

CVE-2026-82244 - Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling tha

CVE-2026-82243 - Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource

CVE-2026-82242 - Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resou

CVE-2026-82241 - Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address

CVE-2026-82240 - Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user crea

CVE-2026-82239 - Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/que

CVE-2026-82238 - filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows auth

CVE-2026-82237 - filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deleti

CVE-2026-82236 - File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privile

CVE-2026-82235 - filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download h

CVE-2026-82234 - SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_reques

CVE-2026-82233 - SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accep

CVE-2026-82222 - Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injec

CVE-2026-82111 - A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the functio

CVE-2026-81777 - Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows

CVE-2026-81733 - WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vul

CVE-2026-81732 - WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4

CVE-2026-78073 - Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user suppli