CVE-2026-110868 - Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to ma

CVE-2026-110689 - A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shou

CVE-2026-103535 - Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation edit

CVE-2026-19736 - The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte cou

CVE-2026-108839 - thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1

CVE-2026-62035 - Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

CVE-2026-108096 - Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in

CVE-2026-108156 - LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the

CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might al

CVE-2026-107608 - Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib

CVE-2026-107322 - An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin befo

CVE-2026-107332 - Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4

CVE-2026-87682 - Multiple OS Command Injection vulnerabilities exist in the management interface and session processi

CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed a

CVE-2026-62251 - Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQue

CVE-2026-106493 - Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalo

CVE-2026-106032 - Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Am

CVE-2026-105811 - Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sam

CVE-2026-103958 - Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

CVE-2026-103957 - Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allo

CVE-2026-103956 - Missing authentication for critical function in the authentication dependency in Loom for AWS before

CVE-2026-104002 - A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Pytho

CVE-2026-97662 - An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before versi

CVE-2026-103505 - Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Drive

CVE-2026-12241 - The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable

CVE-2026-93853 - Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup

CVE-2026-81862 - Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements.

CVE-2026-55160 - Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-S

CVE-2026-82935 - mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v

CVE-2026-100856 - AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field d

CVE-2026-88389 - Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString(

CVE-2026-97902 - In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for su

CVE-2026-95699 - Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users acce

CVE-2026-96883 - pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2

CVE-2026-61604 - The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8

CVE-2026-94384 - Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principa

CVE-2026-79916 - MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace me

CVE-2026-76898 - draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/ma

CVE-2026-61681 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-55563 - Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflo

CVE-2026-54634 - Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unau

CVE-2026-92943 - Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS

CVE-2026-92758 - If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs m

CVE-2026-90224 - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion

CVE-2026-81829 - A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON W

CVE-2026-86831 - Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network P

CVE-2026-92359 - A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the funct

CVE-2026-89915 - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR

CVE-2026-92184 - A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.r

CVE-2026-91936 - Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflo

CVE-2026-58196 - ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (

CVE-2026-91836 - A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file

CVE-2026-91835 - A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function

CVE-2026-14805 - The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and incl

CVE-2026-12944 - IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root

CVE-2026-86830 - Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity C

CVE-2026-90534 - Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3,

CVE-2026-89090 - An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2

CVE-2026-18061 - Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced

CVE-2026-89049 - A server-side request forgery issue due to improper validation of equivalent address representations

CVE-2026-87913 - A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version

CVE-2026-87912 - A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for

CVE-2026-87911 - An OS command injection weakness in the read-only enforcement of the SQL validation component in Ama

CVE-2026-54694 - SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code fl

CVE-2026-85788 - Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-m

CVE-2026-86516 - A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected eleme

CVE-2026-86441 - Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that di

CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-m

CVE-2026-85654 - Improper neutralization of special elements used in a template engine in the CDK generator in Amazon

CVE-2026-85028 - Creation of a temporary file in a directory with insecure permissions in the FPGA management tool in

CVE-2026-3851 - The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content fe

CVE-2026-84366 - Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/co

CVE-2026-83551 - Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in

CVE-2026-82856 - @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition ope

CVE-2026-81849 - Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in ama

CVE-2026-54330 - Ceph is an open-source distributed storage platform providing object, block, and file storage. In ve

CVE-2026-81838 - A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac)

CVE-2026-59300 - Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0

CVE-2026-19889 - GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of t

CVE-2026-48786 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, th

CVE-2026-80551 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDA

CVE-2026-80192 - @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7

CVE-2026-79787 - Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configurat

CVE-2026-79782 - rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes sche

CVE-2026-21752 - HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker una

CVE-2026-77810 - In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain ac

CVE-2026-75910 - Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Fede

CVE-2026-50173 - Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps

CVE-2026-74240 - A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and

CVE-2026-73658 - Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4

CVE-2026-63299 - An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level di

CVE-2026-19643 - An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some pla

CVE-2026-19642 - An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow

CVE-2026-10579 - A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged

CVE-2026-68872 - The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon prov

CVE-2026-19359 - A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this is

CVE-2026-11976 - The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) wa

CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server be

CVE-2026-18953 - Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awsla

CVE-2026-70447 - Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Over

CVE-2026-17578 - Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reachin

CVE-2026-49004 - The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command

CVE-2026-18830 - Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remot

CVE-2026-58139 - The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any

CVE-2026-18655 - Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ

CVE-2026-18654 - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1

CVE-2026-18248 - @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and re

CVE-2026-67322 - GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The

CVE-2026-18536 - Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data:

CVE-2026-18481 - Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might a

CVE-2026-18245 - Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allo

CVE-2026-18140 - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62

CVE-2026-58222 - A security flaw combining LDAP filter injection and improper authorization checks was found in Samba

CVE-2026-63239 - A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared m

CVE-2026-59931 - PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th

CVE-2026-48035 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-16796 - Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent

CVE-2026-16756 - Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the de

CVE-2026-16584 - Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 migh

CVE-2026-47695 - CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game.

CVE-2026-15957 - Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers fr

CVE-2026-47394 - PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw /

CVE-2026-46412 - @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with Op

CVE-2026-47871 - VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation

CVE-2026-56741 - JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3

CVE-2026-50163 - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/u

CVE-2026-15415 - AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow en

CVE-2026-12283 - Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amaz