CVE-2026-17525 - Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26

CVE-2026-109695 - Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-c

CVE-2026-109694 - Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Priv

CVE-2026-108498 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-108497 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-108491 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-53882 - An improper link resolution before file access ('link following') vulnerability has been reported to

CVE-2026-50619 - A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability c

CVE-2026-50612 - An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a re

CVE-2026-47790 - A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote at

CVE-2026-47786 - An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited,

CVE-2026-44084 - An authorization bypass through user-controlled key vulnerability has been reported to affect Video

CVE-2026-41545 - A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker ga

CVE-2026-41541 - An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. I

CVE-2026-39997 - A missing authentication for critical function vulnerability has been reported to affect HybridDesk

CVE-2026-39991 - A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote

CVE-2026-39989 - A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If

CVE-2026-34015 - A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains

CVE-2026-34014 - An incorrect permission assignment for critical resource vulnerability has been reported to affect D

CVE-2026-34009 - An improper isolation or compartmentalization vulnerability has been reported to affect Notes Statio

CVE-2026-34008 - An incorrect permission assignment for critical resource vulnerability has been reported to affect N

CVE-2026-34007 - An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the

CVE-2026-34006 - A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP

CVE-2026-26245 - A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains

CVE-2026-26244 - A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains

CVE-2026-26243 - A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains

CVE-2026-19864 - Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object.

CVE-2026-19863 - An unauthenticated client may access certain protected resources when using EthereumAuthenticator if

CVE-2026-18662 - In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more

CVE-2026-18660 - In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/b

CVE-2026-18659 - In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-

CVE-2026-96614 - "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom

CVE-2026-77711 - When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply w

CVE-2026-76184 - In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ```

CVE-2026-76182 - In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to te

CVE-2026-75559 - The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which

CVE-2026-72528 - "Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability.

CVE-2026-63315 - WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.

CVE-2026-63314 - WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_js

CVE-2026-35088 - Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcode

CVE-2026-18661 - In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the J

CVE-2026-16438 - Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and p

CVE-2026-16437 - Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS

CVE-2026-16436 - Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS

CVE-2026-109855 - undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSoc

CVE-2026-105271 - "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive informatio

CVE-2026-104618 - On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. Th

CVE-2026-104617 - There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak th

CVE-2026-102477 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a g

CVE-2026-102469 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the

CVE-2026-102464 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the

CVE-2026-102462 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the

CVE-2026-102461 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the

CVE-2026-101290 - A remote attacker may send a specially crafted network packet that causes the affected application t

CVE-2026-101287 - Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie n

CVE-2025-23390 - A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a

CVE-2024-22031 - A vulnerability has been identified within Rancher where a user with the ability to create a project

CVE-2023-32198 - A vulnerability has been identified in Steve where by default it was using an insecure option that d

CVE-2026-102475 - In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provide

CVE-2026-102467 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the

CVE-2026-101311 - The framebuffer device model's maximum resolution constants were duplicated between the framebuffer

CVE-2026-101310 - The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when s

CVE-2026-101309 - The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. T

CVE-2026-58100 - kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descrip

CVE-2026-58099 - When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker

CVE-2026-58098 - When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Up

CVE-2026-41544 - A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a u

CVE-2026-39993 - A relative path traversal vulnerability has been reported to affect Download Station. If a remote at

CVE-2026-24723 - A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote att

CVE-2026-24722 - A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote att

CVE-2026-24721 - A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote att

CVE-2026-24718 - A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains

CVE-2026-24715 - An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, t

CVE-2026-22896 - A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If

CVE-2026-19377 - Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle at

CVE-2026-101308 - When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is no

CVE-2026-101307 - When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeat

CVE-2026-101306 - SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transfe

CVE-2026-101305 - renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could r

CVE-2026-101304 - When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descript

CVE-2026-101303 - The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback

CVE-2026-101302 - TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally

CVE-2025-68404 - A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRout

CVE-2025-68403 - An external control of system or configuration setting vulnerability has been reported to affect QuR

CVE-2025-66275 - A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains

CVE-2025-66272 - A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains

CVE-2025-29897 - A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central

CVE-2025-29896 - A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote atta

CVE-2025-29895 - A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote atta

CVE-2026-110926 - A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share o

CVE-2026-110925 - A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a n

CVE-2026-110923 - A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a sla

CVE-2026-93484 - Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplie

CVE-2026-93483 - In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthori

CVE-2026-110912 - In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (s

CVE-2026-110909 - Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP reques

CVE-2026-110907 - Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a smal

CVE-2026-77931 - MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute

CVE-2026-76066 - IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates

CVE-2026-110904 - ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated

CVE-2026-109430 - Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerabilit

CVE-2026-110810 - A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_

CVE-2026-0993 - SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allow

CVE-2026-110809 - A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issu

CVE-2026-110873 - Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared col

CVE-2026-110872 - Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability

CVE-2026-110871 - Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.par

CVE-2026-110870 - Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its addr

CVE-2026-110869 - Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._action

CVE-2026-110867 - Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set r

CVE-2026-110866 - Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumRele

CVE-2026-110865 - Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to e

CVE-2026-110864 - Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the O

CVE-2026-110863 - Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerab

CVE-2026-110862 - Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that all

CVE-2026-110860 - GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which chec

CVE-2026-110859 - GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows r

CVE-2026-110858 - GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() w

CVE-2026-110857 - GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run c

CVE-2026-110856 - GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_acto

CVE-2026-110855 - GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious reposi

CVE-2026-110854 - Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sendi

CVE-2026-110853 - n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members

CVE-2026-110852 - n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass b

CVE-2026-110851 - n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create end

CVE-2026-110850 - n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node par

CVE-2026-110849 - n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the

CVE-2026-110848 - n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vuln

CVE-2026-110847 - n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site script

CVE-2026-110846 - n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoi

CVE-2026-110845 - n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerabi

CVE-2026-110844 - n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow edito

CVE-2026-110843 - n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerabili

CVE-2026-110842 - n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP w

CVE-2026-110841 - n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, whi

CVE-2026-110839 - FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-boun

CVE-2026-110838 - FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state

CVE-2026-110837 - FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based

CVE-2026-110836 - FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() tha

CVE-2026-110835 - FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the targe

CVE-2026-110833 - FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reas

CVE-2026-110832 - FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data

CVE-2026-110831 - FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create,

CVE-2026-110830 - FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a m

CVE-2026-110829 - FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel w

CVE-2026-110807 - A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is

CVE-2026-107795 - Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce a

CVE-2026-106485 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-106068 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-106006 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-105627 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-110816 - ### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object t

CVE-2026-110698 - A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_m

CVE-2026-110696 - A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999b

CVE-2026-110695 - A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get

CVE-2026-108337 - An administrator could retrieve the password reset code for any user and take over the account. T

CVE-2026-108336 - When the default self-signed certificate is used, an attacker could gain administrative access to th

CVE-2026-108335 - When the password reset functionality is enabled, and email is configured, an attacker could take ov

CVE-2026-102298 - In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permissio

CVE-2026-96540 - An improper access control vulnerability has been identified in the SonicWall Network Security Manag

CVE-2026-77427 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-71854 - OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber advers

CVE-2026-69194 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-69193 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-69191 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-64856 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-62664 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-61844 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-61843 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-57493 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-57492 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-57491 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-57490 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-57489 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-110694 - A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function

CVE-2026-110679 - A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function r

CVE-2026-110670 - A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of

CVE-2026-104110 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-104109 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-104108 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-104107 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-104106 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-104105 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-103988 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-103977 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-100232 - Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command I

CVE-2026-55684 - WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc

CVE-2026-55683 - WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/soc

CVE-2026-55682 - WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/segu

CVE-2026-55681 - WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with acces

CVE-2026-55498 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-55387 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-55386 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-55385 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-55384 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-55383 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-55382 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-55381 - InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe

CVE-2026-54703 - Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, t

CVE-2026-54702 - Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, t

CVE-2026-54701 - Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, M

CVE-2026-54566 - Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, M

CVE-2026-110669 - A security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function delet

CVE-2026-110668 - A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function inde

CVE-2026-102986 - Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the pu

CVE-2026-102985 - Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_

CVE-2026-102980 - Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/pla

CVE-2026-85714 - Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P

CVE-2026-82402 - Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can

CVE-2026-73261 - Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack ena

CVE-2026-73260 - Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate

CVE-2026-73252 - Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack select

CVE-2026-55787 - Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_

CVE-2026-55786 - Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4,

CVE-2026-55167 - LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)

CVE-2026-54525 - Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, M

CVE-2026-53999 - Radius is a cloud-native, portable application platform that makes app development easier for teams

CVE-2026-110775 - Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows

CVE-2026-110774 - Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allo

CVE-2026-110773 - GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler th

CVE-2026-110772 - Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::Bul

CVE-2026-110771 - Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated cust

CVE-2026-110769 - holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connecto

CVE-2026-110768 - holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Tele

CVE-2026-110767 - Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob

CVE-2026-110766 - Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated user

CVE-2026-110765 - FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook

CVE-2026-110764 - AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-s

CVE-2026-110763 - lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerabi

CVE-2026-110762 - bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated v

CVE-2026-110761 - ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authent

CVE-2026-110667 - A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an u

CVE-2026-110666 - A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the fi

CVE-2026-110248 - Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMake

CVE-2026-104143 - DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated use

CVE-2026-104142 - DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated use

CVE-2026-104141 - DataEase is an open source data visualization and analysis tool. Authenticated users with datasource

CVE-2026-103974 - lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d

CVE-2026-103930 - cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream i

CVE-2026-102944 - cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() remov

CVE-2026-102899 - Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML

CVE-2026-102756 - DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated use

CVE-2026-102755 - DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated use

CVE-2026-102748 - Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers admini

CVE-2026-102682 - Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa

CVE-2026-102479 - In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x de

CVE-2026-102471 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the

CVE-2026-102460 - In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a s

CVE-2026-100406 - dbt enables data analysts and engineers to transform their data using the same practices that softwa

CVE-2026-92160 - F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedde