CVEs published June 24, 2026
521 CVEs were published on June 24, 2026: 56 critical, 210 high. Browse them by severity, product and exploitation status.
- Published
- 521
- Critical
- 56
- High
- 210
- Medium
- 128
- Low
- 12
- Unrated
- 115
- Now in CISA KEV
- 0
- Fix available
- 359
Most affected products
- Linux
- 218
- gogs · gogs.io/gogs
- 23
- Google Chrome
- 18
- Frappe Framework
- 12
- RocketChat Rocket.Chat
- 12
- cacti
- 10
- Capgo
- 10
- Quest NetVault Backup
- 10
- warpdotdev warp
- 10
- GeoVision GV-I/O Box
- 8
Critical 56
- CVE-2026-39948Cacti has SQL Injection via rfilter parameter in RLIKE clausescacti
- CVE-2026-39955Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.phpcacti
- CVE-2026-39938Cacti: Unauthenticated RCE on Graph Imagecacti
- CVE-2026-39893Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.phpcacti
- CVE-2026-55454Appsmith: Caddy admin API exposed without authenticationappsmithorg appsmith
- CVE-2026-55570SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)siyuan-note siyuan
- CVE-2026-50551SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Contentsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-54158SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-54069SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlistsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-54067SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-55666Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuthRocketChat Rocket.Chat
- CVE-2026-33543FOSSBilling: Authentication bypass allows unauthenticated administrator creationFOSSBilling
- CVE-2026-46423Rocket.Chat: SAML signature validation skipped when IdP certificate field is emptyRocketChat Rocket.Chat
- CVE-2026-45689Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATORocketChat Rocket.Chat
- CVE-2026-45688Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session HijackRocketChat Rocket.Chat
- CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooksgogs · gogs.io/gogs
- CVE-2026-52811Gogs: UploadRepoFiles writes outside repo working tree via committed parent symgogs · gogs.io/gogs
- CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request mergegogs · gogs.io/gogs
- CVE-2026-13032Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox…Google Chrome
- CVE-2026-13028Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox…Google Chrome
- CVE-2026-53943Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headerTryGhost Ghost · ghost
- CVE-2026-49980Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixrclone · github.com/rclone/rclone +1
- CVE-2026-53088net: bcmgenet: fix off-by-one in bcmgenet_put_txcbLinux
- CVE-2026-53086net: bcmgenet: fix racing timeout handlerLinux
- CVE-2026-53055crypto: hisilicon/sec2 - prevent req used-after-free for secLinux
Show all 56 entriesShow fewer entries
- CVE-2026-53049gfs2: add some missing log lockingLinux
- CVE-2026-53046ksmbd: fix use-after-free from async crypto on Qualcomm crypto engineLinux
- CVE-2026-53045memory: tegra124-emc: Fix dll_change checkLinux
- CVE-2026-53043ocfs2/dlm: validate qr_numregions in dlm_match_regions()Linux
- CVE-2026-53010ksmbd: fix use-after-free in smb2_open during durable reconnectLinux
- CVE-2026-53006ipv6: fix possible UAF in icmpv6_rcv()Linux
- CVE-2026-53002netfilter: conntrack: remove sprintf usageLinux
- CVE-2026-52999netfilter: nfnetlink_osf: fix out-of-bounds read on option matchingLinux
- CVE-2026-52993tipc: fix double-free in tipc_buf_append()Linux · :linux_kernel:
- CVE-2026-52989nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersLinux
- CVE-2026-52986netfilter: nf_conntrack_sip: don't use simple_strtoulLinux
- CVE-2026-52982net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()Linux
- CVE-2026-52958libceph: Fix potential out-of-bounds access in osdmap_decode()Linux
- CVE-2026-52955libceph: Fix potential out-of-bounds access in crush_decode()Linux
- CVE-2026-56121Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserializationfeast-dev feast · feast
- CVE-2026-12537Unauthenticated Remote Code Execution in Gemini CLI CI/CD WorkflowsGoogle Cloud Gemini CLI · Google Cloud run-gemini-cli Gi… +2
- CVE-2026-56237Capgo - Unauthenticated API Key Generation via Client-Side Parameter ManipulationCapgo
- CVE-2026-56223Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-userCapgo
- CVE-2026-52931batman-adv: tp_meter: avoid use of uninit sender varsLinux
- CVE-2026-52924sctp: purge outqueue on stale COOKIE-ECHO handlingLinux
- CVE-2026-52914batman-adv: fix fragment reassembly length accountingLinux
- CVE-2026-12416Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameterpravel Invoice Generator
- CVE-2026-12417SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to…pravel SignUp & SignIn
- CVE-2026-12851GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGeoVision GV-I/O Box
- CVE-2026-12850GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGeoVision GV-I/O Box
- CVE-2026-12849GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGeoVision GV-I/O Box
- CVE-2026-12486GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerabilityGeoVision GV-I/O Box
- CVE-2026-12848GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET commandGeoVision GV-I/O Box
- CVE-2026-12847GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET commandGeoVision GV-I/O Box
- CVE-2026-12846GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET commandGeoVision GV-I/O Box
- CVE-2026-12485GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET commandGeoVision GV-I/O Box
High 210
- CVE-2026-40079Cacti: Command Injection via escape_command() no-op in RRDtool executioncacti
- CVE-2026-7569Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass VulnerabilityQuest NetVault Backup
- CVE-2026-9787Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-9786Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-9785Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-9784Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-9783Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-39951Cacti: Stored SQL Injection via graph_name_regexp in Reports featurecacti
- CVE-2026-9782Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-9781Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-9780Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass VulnerabilityQuest NetVault Backup
- CVE-2026-7570Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution VulnerabilityQuest NetVault Backup
- CVE-2026-2050GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-9779ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution VulnerabilityATEN Unizon
- CVE-2026-9778ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution VulnerabilityATEN Unizon
- CVE-2026-9777ATEN Unizon restoreDB Directory Traversal Remote Code Execution VulnerabilityATEN Unizon
- CVE-2026-9776ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure VulnerabilityATEN Unizon
- CVE-2026-10043MosaicML Composer Deserialization of Untrusted Data Remote Code Execution VulnerabilityMosaicML Composer
- CVE-2026-9773Unraid Web Server ToggleState Command Injection Remote Code Execution VulnerabilityUnraid
- CVE-2026-9772Unraid Web Server FileUpload Command Injection Remote Code Execution VulnerabilityUnraid
- CVE-2026-50189Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Routeappsmithorg appsmith
- CVE-2026-52794Sentry: Inefficient Regular Expression Complexity in sentrygetsentry sentry
- CVE-2026-54759SiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron…siyuan-note siyuan
- CVE-2026-47110Tiptap for PHP < 2.1.1 DoS via Malformed href Attributeueberdosis tiptap-php · ueberdosis/tiptap-php
- CVE-2026-54070SiYuan: Stored XSS in Bazaar marketplace via package README event handlerssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
Show all 210 entriesShow fewer entries
- CVE-2026-54066SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-55762Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint`…RocketChat Rocket.Chat
- CVE-2026-55759Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replayRocketChat Rocket.Chat
- CVE-2026-45687Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessageRocketChat Rocket.Chat
- CVE-2026-45677Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoSRocketChat Rocket.Chat
- CVE-2026-33235AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating featuresSignificant-Gravitas AutoGPT
- CVE-2026-13201Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionRed Hat Container Native Virtualization
- CVE-2026-52797Gogs: Overwriting critical files results in a denial of servicegogs · gogs.io/gogs
- CVE-2026-52812Gogs: LFS dedupe path leaks private repo content across tenantsgogs · gogs.io/gogs
- CVE-2026-52810Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusiongogs · gogs.io/gogs
- CVE-2026-11998AngularJS XSS via SCE resource URL sanitization bypassGoogle angular · angular
- CVE-2026-52808Gogs: Write-level collaborators can mutate admin-only repository settings via APIgogs · gogs.io/gogs
- CVE-2026-52805Gogs: Migration Redirect Bypass Leads to Internal Repository Theftgogs · gogs.io/gogs
- CVE-2026-52799Gogs: Missing Authorization in Attachment Downloadgogs · gogs.io/gogs
- CVE-2026-52801Gogs: Ability to import local repositories via Mirror Settingsgogs · gogs.io/gogs
- CVE-2026-52800Gogs: CSRF Leading to Organization Owner Takeovergogs · gogs.io/gogs
- CVE-2026-52798Gogs: Stored XSS in `.ipynb` Previewgogs · gogs.io/gogs
- CVE-2026-47267Gogs: SSRF in webhook deliveriesgogs · gogs.io/gogs
- CVE-2026-25119Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headersgogs · gogs.io/gogs
- CVE-2026-50129Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMERmastodon
- CVE-2026-1840Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web InterfaceHubbell Aclara Metrum Cellular Web Interface
- CVE-2026-7539HP Dock Accessory WMI Provider Installer Security UpdateHP Dock Accessory
- CVE-2026-47389Mastodon: SSRF protection bypass on older Ruby versionsmastodon
- CVE-2026-46348Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)mastodon
- CVE-2026-27708FOSSBilling: IDOR in Servicecustom Client API allows cross-client data accessFOSSBilling
- CVE-2026-55583Twenty: Cross-workspace IDOR in AgentTurnResolvertwentyhq twenty
- CVE-2026-23879py7zr: Arbitrary File Write Vulnerabilitymiurahr py7zr · py7zr
- CVE-2026-13037Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a…Google Chrome
- CVE-2026-13036Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via…Google Chrome
- CVE-2026-13035Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a…Google Chrome
- CVE-2026-13031Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via…Google Chrome
- CVE-2026-13029Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a…Google Chrome
- CVE-2026-13027Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2026-13026Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit…Google Chrome
- CVE-2026-13025Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2026-13038Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a…Google Chrome
- CVE-2026-13033Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute…Google Chrome
- CVE-2026-48793Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file pathjellyfin
- CVE-2026-49247Jellyfin: Potential Authenticated path traversal in /ClientLog/Documentjellyfin
- CVE-2026-12760Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200TP-Link Systems Tapo C200
- CVE-2026-53950@tryghost/activitypub: XSS in Ghost's ActivityPub clientTryGhost Ghost · @tryghost/activitypub
- CVE-2026-44017Docling: Unsafe Zip Extraction in EasyOCR Model Downloaddocling-project docling · docling
- CVE-2026-44020Docling: Unsafe XML Entity Expansion in USPTO Patent Backenddocling-project docling · docling
- CVE-2026-44016Docling: Unsafe Playwright-based HTML Renderingdocling-project docling · docling
- CVE-2026-48704Warp Markdown notebook links may open executable local fileswarpdotdev warp
- CVE-2026-48719Warp branch selector command injection via Git branch nameswarpdotdev warp
- CVE-2026-48720Warp: SSH remote output can lead to local file overwrite and persistencewarpdotdev warp
- CVE-2026-48721Warp: Env-var prefixes can lead to denylisted command autoexecutionwarpdotdev warp
- CVE-2026-48731Warp: Linux external editor command injectionwarpdotdev warp
- CVE-2026-48732Warp: Remote SSH cwd can lead to unauthorized remote command executionwarpdotdev warp
- CVE-2026-54699Warp: OS command injection when opening terminal links from WSLwarpdotdev warp
- CVE-2026-48703Warp: Command Injection via Warp code search tool argumentswarpdotdev warp
- CVE-2026-48725Warp may allow terminal output to access the local clipboard through OSC 52warpdotdev warp
- CVE-2026-49851Mistune: Potential DoS via quadratic-time parsing in parse_link_textlepture mistune · mistune
- CVE-2026-53130fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_STARTLinux
- CVE-2026-53110s390/bpf: Zero-extend bpf prog return values and kfunc argumentsLinux
- CVE-2026-53096bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB pathLinux
- CVE-2026-53094bpf: Fix stale offload->prog pointer after constant blindingLinux
- CVE-2026-53092bpf: Fix linked reg delta tracking when src_reg == dst_regLinux
- CVE-2026-53091net: pull headers in qdisc_pkt_len_segs_init()Linux
- CVE-2026-53090bpf: Fix ld_{abs,ind} failure path analysis in subprogsLinux
- CVE-2026-53087net: bcmgenet: fix leaking free_bdsLinux
- CVE-2026-53085bpf: fix mm lifecycle in open-coded task_vma iteratorLinux
- CVE-2026-53081bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalarsLinux
- CVE-2026-53078bpf: Fix same-register dst/src OOB read and pointer leak in sock_opsLinux
- CVE-2026-53077net/rds: Restrict use of RDS/IB to the initial network namespaceLinux
- CVE-2026-53076bpf: Fix OOB in pcpu_init_valueLinux
- CVE-2026-53075ppp: require CAP_NET_ADMIN in target netns for unattached ioctlsLinux
- CVE-2026-53072Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFERLinux
- CVE-2026-53071Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rspLinux
- CVE-2026-53070sctp: disable BH before calling udp_tunnel_xmit_skb()Linux
- CVE-2026-53069net, bpf: fix null-ptr-deref in xdp_master_redirect() for down masterLinux
- CVE-2026-53068drm/komeda: fix integer overflow in AFBC framebuffer size checkLinux
- CVE-2026-53062dm cache policy smq: fix missing locks in invalidating cache blocksLinux
- CVE-2026-53057iommu/riscv: Add IOTINVAL after updating DDT/PDT entriesLinux
- CVE-2026-53054drm/msm: Fix VM_BIND UNMAP lockingLinux
- CVE-2026-53053iommu/amd: Fix clone_alias() to use the original device's devidLinux
- CVE-2026-53050quota: Fix race of dquot_scan_active() with quota deactivationLinux
- CVE-2026-53044soc/tegra: cbb: Fix incorrect ARRAY_SIZE in fabric lookup tablesLinux
- CVE-2026-53041ocfs2: fix listxattr handling when the buffer is fullLinux
- CVE-2026-53040ocfs2: validate bg_bits during freefrag scanLinux
- CVE-2026-53036bpf, arm64: Fix off-by-one in check_imm signed range checkLinux
- CVE-2026-53033bpf, sockmap: Take state lock for af_unix iterLinux
- CVE-2026-53031bpf: Validate node_id in arena_alloc_pages()Linux
- CVE-2026-53026NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdelegLinux
- CVE-2026-53025greybus: raw: fix use-after-free on cdev closeLinux
- CVE-2026-53024greybus: raw: fix use-after-free if write is called after disconnectLinux
- CVE-2026-53020um: Fix potential race condition in TLB syncLinux
- CVE-2026-53016crypto: ccp - copy IV using skcipher ivsizeLinux
- CVE-2026-53011net/sched: taprio: fix use-after-free in advance_sched() on schedule switchLinux
- CVE-2026-53009ice: fix double-free of tx_buf skbLinux
- CVE-2026-53005af_unix: Drop all SCM attributes for SOCKMAP.Linux
- CVE-2026-53003pppoe: drop PFC framesLinux
- CVE-2026-53000netfilter: nat: use kfree_rcu to release opsLinux
- CVE-2026-52998netfilter: nfnetlink_osf: fix potential NULL dereference in ttl checkLinux
- CVE-2026-52991sched/psi: fix race between file release and pressure writeLinux
- CVE-2026-52988netfilter: nf_tables: join hook list via splice_list_rcu() in commit phaseLinux
- CVE-2026-52987drm/amdgpu: avoid double drm_exec_fini() in userq validateLinux
- CVE-2026-52983net: airoha: fix BQL imbalance in TX pathLinux
- CVE-2026-52981neigh: let neigh_xmit take skb ownershipLinux
- CVE-2026-52976drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()Linux
- CVE-2026-52975bonding: 3ad: implement proper RCU rules for port->aggregatorLinux
- CVE-2026-52974net: tls: fix strparser anchor skb leak on offload RX setup failureLinux
- CVE-2026-52973futex: Drop CLONE_THREAD requirement for private default hash allocLinux
- CVE-2026-52972crypto: af_alg - Cap AEAD AD length to 0x80000000Linux
- CVE-2026-52971net: ena: PHC: Fix potential use-after-free in get_timestampLinux
- CVE-2026-52969KVM: Reject wrapped offset in kvm_reset_dirty_gfn()Linux
- CVE-2026-52968KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmeticLinux
- CVE-2026-52967smb/client: fix possible infinite loop and oob read in symlink_data()Linux
- CVE-2026-52960ceph: put folios not suitable for writebackLinux
- CVE-2026-52959virt: sev-guest: Do not use host-controlled page order in cleanup pathLinux
- CVE-2026-52957libceph: Fix potential null-ptr-deref in decode_choose_args()Linux
- CVE-2026-52956libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()Linux
- CVE-2026-52954libceph: handle rbtree insertion error in decode_choose_args()Linux
- CVE-2026-52953iommu/vt-d: Fix oops due to out of scope accessLinux
- CVE-2026-52952iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to resetLinux
- CVE-2026-52951drm/xe/dma-buf: handle empty bo and UAF racesLinux
- CVE-2026-52950drm/xe/dma-buf: fix UAF with retry loopLinux
- CVE-2026-52947net: qrtr: fix refcount saturation and potential UAF in qrtr_port_removeLinux
- CVE-2026-52946fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signalingLinux
- CVE-2026-52945Revert "wireguard: device: enable threaded NAPI"Linux
- CVE-2026-54297Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameterslostisland faraday · faraday
- CVE-2026-54904concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`ruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-13164Unauthenticated self-registration in MailerUp allows access to stored email dataMailerup
- CVE-2026-55488motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Readmotioneye-project motioneye · motioneye
- CVE-2026-56111Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code HandlerMarlinFirmware Marlin
- CVE-2026-12986A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows…Payara Server · fish.payara.distributions:payara
- CVE-2026-11878Reflected Cross-Site Scripting vulnerability in OpenText Access ManagerOpenText Access Manager
- CVE-2026-35025ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFRProFTPD Project ProFTPD
- CVE-2026-57303Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers…Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…
- CVE-2026-57301Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing…Jenkins Project Jenkins OWASP ZAP Plugin · org.jenkins-ci.p…
- CVE-2026-57296Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided…Jenkins Project Jenkins External Workspace Manager Plugin ·…
- CVE-2026-42450OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parserAcademySoftwareFoundation OpenColorIO
- CVE-2026-57281Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions…Jenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2026-57280Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed…Jenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2026-12242AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attributeadegans AdRotate Banner Manager
- CVE-2026-56270Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod EndpointFlowise
- CVE-2026-56257Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST UpdateCapgo
- CVE-2026-56256Capgo - Two-Factor Authentication Bypass via Organization Management APICapgo
- CVE-2026-56245Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPCCap-go capgo
- CVE-2026-56244Capgo - Webhook Signing Secret Disclosure via Non-Admin API KeyCapgo
- CVE-2026-56232Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id HeaderCapgo
- CVE-2026-56231Capgo - Broken Object Level Authorization in Build Job Control via jobId ParameterCapgo
- CVE-2025-71361picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tippicklescan
- CVE-2025-71354picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetTextpicklescan
- CVE-2025-71332Flowise - SQL Injection in importChatflows API via chatflow.id ParameterFlowise
- CVE-2026-52943net: skbuff: fix missing zerocopy reference in pskb_carve helpersLinux
- CVE-2026-10745Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log…upKeeper Solutions upKeeper Instant Privilege Access
- CVE-2026-56052WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerabilityFunnel Builder by FunnelKit
- CVE-2026-52942netfilter: nf_log: validate MAC header was set before dumping itLinux
- CVE-2026-52935xfrm: espintcp: do not reuse an in-progress partial sendLinux
- CVE-2026-52934batman-adv: tvlv: reject oversized TVLV packetsLinux
- CVE-2026-52933io_uring/poll: fix signed comparison in io_poll_get_ownership()Linux
- CVE-2026-52932xfrm: ipcomp: Free destination pages on acomp errorsLinux
- CVE-2026-52929sctp: stream: fully roll back denied add-stream stateLinux
- CVE-2026-52927netfilter: ebtables: fix OOB read in compat_mtw_from_userLinux
- CVE-2026-52923ipc: limit next_id allocation to the valid ID rangeLinux
- CVE-2026-52922batman-adv: dat: handle forward allocation errorLinux
- CVE-2026-52920netfilter: xt_policy: fix strict mode inbound policy matchingLinux
- CVE-2026-52919batman-adv: fix tp_meter counter underflow during shutdownLinux
- CVE-2026-52918Bluetooth: serialize accept_q accessLinux
- CVE-2026-52917sctp: diag: reject stale associations in dump_one pathLinux
- CVE-2026-52915netfilter: ip6t_hbh: reject oversized option listsLinux
- CVE-2026-52912netfilter: nf_queue: hold bridge skb->dev while queuedLinux
- CVE-2026-7761Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosureultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-9710Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash DisclosureCornerstone
- CVE-2026-9709Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta DisclosureCornerstone
- CVE-2026-10749Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaDataPost Duplicator
- CVE-2026-10735ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Serversmart-post-show-pro · Real Testimonials Pro +1
- CVE-2026-13006Incomplete protection against CVE-2025-11226QOS.CH Sarl Logback-core
- CVE-2026-9178WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpointhancock11 WP Forms Connector
- CVE-2026-9643WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Loggingjoomunited WP Meta SEO
- CVE-2026-8705ClearSale Total <= 3.4.2 - Unauthenticated SQL InjectionClearSale Total
- CVE-2026-12095Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameterbytuncay Kargo Takip
- CVE-2026-4297Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption'…newscred Welcome Software Publishing
- CVE-2026-10092Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Commentsnicashmu Cincopa video and media plug-in
- CVE-2026-9179WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameterhancock11 WP Forms Connector
- CVE-2026-10091Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scriptingcgarvey Email JavaScript Cloak
- CVE-2026-12100URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameterabhisheksaha11 URL Preview
- CVE-2026-3652ARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' ParameterARforms
- CVE-2026-12681Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation.Google go-attestation · github.com/google/go-attestation
- CVE-2026-54639Style Dictionary - Prototype Pollution in convertTokenData utility functionstyle-dictionary
- CVE-2025-60467A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allow
- CVE-2025-60474A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to…
- CVE-2026-49269Apple M1 GPUs retain register file data between compute shader dispatches from different processes.
Medium, low and unrated 255
- CVE-2026-8663OS Command Injection in Rapid7 InsightConnect RPM PluginRapid7 InsightConnect RPM Plugin
- CVE-2026-39900Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript contextcacti
- CVE-2026-39899Cacti: Path Traversal via filename parameter in package_import.phpcacti
- CVE-2026-39897Cacti has a Reflected XSS Vulnerability via html_auth_footercacti
- CVE-2026-39894Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formattingcacti
- CVE-2026-49979Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filterappsmithorg appsmith
- CVE-2026-9775ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion VulnerabilityATEN Unizon
- CVE-2026-9774ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion VulnerabilityATEN Unizon
- CVE-2026-55455Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylistappsmithorg appsmith
- CVE-2026-10642Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow controlzephyrproject zephyr
- CVE-2026-53765chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directoryChromeDevTools chrome-devtools-mcp · chrome-devtools-mcp
- CVE-2026-53766chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing rootsChromeDevTools chrome-devtools-mcp · chrome-devtools-mcp
- CVE-2026-54068SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIconsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-49278Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor ImpersonationRocketChat Rocket.Chat
- CVE-2026-49277Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivationRocketChat Rocket.Chat
- CVE-2026-45757Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokensRocketChat Rocket.Chat
- CVE-2026-47733Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown imagesRocketChat Rocket.Chat
- CVE-2026-32315motionEye: World-Readable Configuration File Exposes Admin Password Hashmotioneye-project motioneye · motioneye
- CVE-2026-13208Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request bodyRed Hat OpenShift Virtualization
- CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESgogs · gogs.io/gogs
- CVE-2026-31978motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpointmotioneye-project motioneye · motioneye
- CVE-2026-52816Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSgogs · gogs.io/gogs
- CVE-2026-52807Gogs: DOM-based XSS via Milestone Name on New Issue Pagegogs · gogs.io/gogs
- CVE-2026-52804Gogs: Privilege Escalation via Collaboration Access Mode Validationgogs · gogs.io/gogs
- CVE-2026-52802Gogs: Open Redirect via redirect_to in Gogsgogs · gogs.io/gogs
Show all 255 entriesShow fewer entries
- CVE-2026-52814Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)gogs · gogs.io/gogs
- CVE-2026-52796Gogs: DoS in rendering issue index patterngogs · gogs.io/gogs
- CVE-2026-52795Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activitygogs
- CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pagesgogs · gogs.io/gogs
- CVE-2026-52815Gogs: Unauthenticated Organization Teams Information Disclosure via APIgogs · gogs.io/gogs
- CVE-2026-50128Mastodon: Spoofing of attribution domainsmastodon
- CVE-2026-48028Mastodon: Removal of integrity-protected JSON entries from signed activitiesmastodon
- CVE-2026-46349Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuringmastodon
- CVE-2026-13034Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2026-13030Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive…Google Chrome
- CVE-2026-13024Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had…Google Chrome
- CVE-2026-13023Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2026-13022Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2026-13021Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass…Google Chrome
- CVE-2026-49220Jellyfin: Potential XSS in user managementjellyfin
- CVE-2026-49246Jellyfin: Potential MKV attachment filename path traversal to RCEjellyfin
- CVE-2026-53944Ghost: Private IP filtering bypass to make server-side requests to internal servicesTryGhost Ghost · ghost
- CVE-2026-53945Ghost: Server-side request forgery via DNS rebinding in external request handlingTryGhost Ghost · ghost
- CVE-2026-53946Ghost: Mobiledoc image-size fetch SSRFTryGhost Ghost · ghost
- CVE-2026-53947Ghost: Member existence leak via magic link sign-in responseTryGhost Ghost · ghost
- CVE-2026-53948Ghost: File Upload Content-Type SpoofingTryGhost Ghost · ghost
- CVE-2026-53949Ghost Content API filter bypass reveals private fieldsTryGhost Ghost · ghost
- CVE-2026-44022Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commandsdocling-project docling · docling
- CVE-2026-54686Warp: DCS lifecycle hook spoofing can alter terminal session metadatawarpdotdev warp
- CVE-2026-55611AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)Mintplex-Labs anything-llm
- CVE-2026-48789AnythingLLM: Windows path containment bypass in document folder routeMintplex-Labs anything-llm
- CVE-2026-53129fs/mbcache: cancel shrink work before destroying the cacheLinux
- CVE-2026-53128drbd: Balance RCU calls in drbd_adm_dump_devices()Linux
- CVE-2026-53127block: fix zones_cond memory leak on zone revalidation error pathsLinux
- CVE-2026-53126blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()Linux
- CVE-2026-53125md: fix array_state=clear sysfs deadlockLinux
- CVE-2026-53124ublk: reset per-IO canceled flag on each fetchLinux
- CVE-2026-53123md: wake raid456 reshape waiters before suspendLinux
- CVE-2026-53122btrfs: fix deadlock between reflink and transaction commit when using flushoncommitLinux
- CVE-2026-53121amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init()Linux
- CVE-2026-53120PCI: use generic driver_override infrastructureLinux
- CVE-2026-53119platform/wmi: use generic driver_override infrastructureLinux
- CVE-2026-53118vdpa: use generic driver_override infrastructureLinux
- CVE-2026-53117s390/cio: use generic driver_override infrastructureLinux
- CVE-2026-53116s390/ap: use generic driver_override infrastructureLinux
- CVE-2026-53115bus: fsl-mc: use generic driver_override infrastructureLinux
- CVE-2026-53114perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handlerLinux
- CVE-2026-53113wifi: ath11k: fix memory leaks in beacon template setupLinux
- CVE-2026-53112wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_taskletLinux
- CVE-2026-53111bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encapLinux
- CVE-2026-53109powerpc/pgtable-frag: Fix bad page state in pte_frag_destroyLinux
- CVE-2026-53108powerpc/64s: Fix unmap race with PMD migration entriesLinux
- CVE-2026-53107wifi: libertas: don't kill URBs in interrupt contextLinux
- CVE-2026-53106bpf: Do not allow deleting local storage in NMILinux
- CVE-2026-53105wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwiLinux
- CVE-2026-53104wifi: mt76: Fix memory leak destroying deviceLinux
- CVE-2026-53103wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_syncLinux
- CVE-2026-53102wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()Linux
- CVE-2026-53101wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_syncLinux
- CVE-2026-53100wifi: mt76: fix deadlock in remain-on-channelLinux
- CVE-2026-53099bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFILinux
- CVE-2026-53098wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()Linux
- CVE-2026-53097wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()Linux
- CVE-2026-53095bpf: Fix abuse of kprobe_write_ctx via freplaceLinux
- CVE-2026-53093wifi: brcmfmac: Fix error pointer dereferenceLinux
- CVE-2026-53089bpf: Fix use-after-free in offloaded map/prog info fillLinux
- CVE-2026-53084bpf: return VMA snapshot from task_vma iteratorLinux
- CVE-2026-53083bpf: Fix RCU stall in bpf_fd_array_map_clear()Linux
- CVE-2026-53082net: hamradio: 6pack: fix uninit-value in sixpack_receive_bufLinux
- CVE-2026-53080net/sched: cls_fw: fix NULL dereference of "old" filters before change()Linux
- CVE-2026-53079net_sched: fix skb memory leak in deferred qdisc dropsLinux
- CVE-2026-53074bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skbLinux
- CVE-2026-53073Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on errorLinux
- CVE-2026-53067PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double allocLinux
- CVE-2026-53066drm/sun4i: backend: fix error pointer dereferenceLinux
- CVE-2026-53065ASoC: sti: use managed regmap_field allocationsLinux
- CVE-2026-53064dm cache: fix null-deref with concurrent writes in passthrough modeLinux
- CVE-2026-53063dm cache: fix write hang in passthrough modeLinux
- CVE-2026-53061dm cache: fix dirty mapping checking in passthrough mode switchingLinux
- CVE-2026-53060dm cache metadata: fix memory leak on metadata abort retryLinux
- CVE-2026-53059dm log: fix out-of-bounds write due to region_count overflowLinux
- CVE-2026-53058drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()Linux
- CVE-2026-53056drm/msm/dpu: fix mismatch between power and frequencyLinux
- CVE-2026-53052ASoC: qcom: qdsp6: topology: check widget type before accessing dataLinux
- CVE-2026-53051PCI: tegra194: Fix CBB timeout caused by DBI access before core power-onLinux
- CVE-2026-53048gfs2: prevent NULL pointer dereference during unmountLinux
- CVE-2026-53047efi/capsule-loader: fix incorrect sizeof in phys array reallocationLinux
- CVE-2026-53042fwctl: Fix class init ordering to avoid NULL pointer dereference on device removalLinux
- CVE-2026-53039ocfs2: validate group add input before cachingLinux
- CVE-2026-53038ima_fs: Correctly create securityfs files for unsupported hash algosLinux
- CVE-2026-53037HID: usbhid: fix deadlock in hid_post_reset()Linux
- CVE-2026-53035bpf, sockmap: Fix af_unix iter deadlockLinux
- CVE-2026-53034bpf, sockmap: Fix af_unix null-ptr-deref in proto updateLinux
- CVE-2026-53032bpf: Fix NULL deref in map_kptr_match_type for scalar regsLinux
- CVE-2026-53030i3c: master: renesas: Fix memory leak in renesas_i3c_i3c_xfers()Linux
- CVE-2026-53029fs/ntfs3: prevent uninitialized lcn caused by zero lenLinux
- CVE-2026-53028usb: typec: Fix error pointer dereferenceLinux
- CVE-2026-53027fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()Linux
- CVE-2026-53023fs/ntfs3: terminate the cached volume label after UTF-8 conversionLinux
- CVE-2026-53022platform/x86: dell-wmi-sysman: bound enumeration string aggregationLinux
- CVE-2026-53021scsi: target: core: Fix integer overflow in UNMAP bounds checkLinux
- CVE-2026-53019clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()Linux
- CVE-2026-53018f2fs: avoid reading already updated pages during GCLinux
- CVE-2026-53017f2fs: fix data loss caused by incorrect use of nat_entry flagLinux
- CVE-2026-53015erofs: unify lcn as u64 for 32-bit platformsLinux
- CVE-2026-53014net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redirLinux
- CVE-2026-53013macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFFLinux
- CVE-2026-53012nexthop: fix IPv6 route referencing IPv4 nexthopLinux
- CVE-2026-53008ice: fix race condition in TX timestamp ring cleanupLinux
- CVE-2026-53007ice: fix potential NULL pointer deref in error path of ice_set_ringparam()Linux
- CVE-2026-53004sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunksLinux
- CVE-2026-53001netfilter: xtables: restrict several matches to inet familyLinux
- CVE-2026-52997net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()Linux
- CVE-2026-52996ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 openLinux
- CVE-2026-52995net/rds: zero per-item info buffer before handing it to visitorsLinux
- CVE-2026-52994vsock/virtio: fix MSG_ZEROCOPY pinned-pages accountingLinux
- CVE-2026-52992fs/adfs: validate nzones in adfs_validate_bblk()Linux
- CVE-2026-52990fsnotify: fix inode reference leak in fsnotify_recalc_mask()Linux
- CVE-2026-52985netdevsim: zero initialize struct iphdr in dummy sk_buffLinux
- CVE-2026-52984net/sched: netem: fix queue limit check to include reordered packetsLinux
- CVE-2026-52980sched/fair: Clear rel_deadline when initializing forked entitiesLinux
- CVE-2026-52979net: psp: check for device unregister when creating assocLinux
- CVE-2026-52978net: psp: require admin permission for dev-set and key-rotateLinux
- CVE-2026-52977futex: Prevent lockup in requeue-PI during signal/ timeout wakeupLinux
- CVE-2026-52970netfilter: nft_ct: fix missing expect put in obj evalLinux
- CVE-2026-52966drm: Replace old pointer to new idrLinux
- CVE-2026-52965drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failureLinux
- CVE-2026-52964ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scansLinux
- CVE-2026-52963ALSA: usb-audio: Bound MIDI endpoint descriptor scansLinux
- CVE-2026-52962ceph: fix a buffer leak in __ceph_setxattr()Linux
- CVE-2026-52961ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob sizeLinux
- CVE-2026-52949drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failureLinux
- CVE-2026-52948i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctlLinux
- CVE-2026-54906concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-54905concurrent-ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivityruby-concurrency concurrent-ruby · concurrent-ruby
- CVE-2026-50712Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label renderingFrappe Framework
- CVE-2026-50711Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields renderingFrappe Framework
- CVE-2026-50710Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configFrappe Framework
- CVE-2026-50709Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color renderingFrappe Framework
- CVE-2026-50708Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result renderingFrappe Framework
- CVE-2026-50705Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingFrappe Framework
- CVE-2026-50704Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs renderingFrappe Framework
- CVE-2026-50703Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label renderingFrappe Framework
- CVE-2026-50701Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb renderingFrappe Framework
- CVE-2026-50700Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image renderingFrappe Framework
- CVE-2026-50699Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule renderingFrappe Framework
- CVE-2026-50698Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template renderingFrappe Framework
- CVE-2026-11877Missing Authorization Vulnerability in OpenText Access ManagerOpenText Access Manager
- CVE-2026-57307A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read…Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…
- CVE-2026-57306A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to…Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…
- CVE-2026-57305A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an…Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…
- CVE-2026-57304A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an…Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…
- CVE-2026-57302Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be…Jenkins Project Jenkins FitNesse Plugin · org.jenkins-ci.pl…
- CVE-2026-57300A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to…Jenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…
- CVE-2026-57299Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read…Jenkins Project Jenkins Contrast Continuous Application Sec…
- CVE-2026-57298A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows…Jenkins Project Jenkins Contrast Continuous Application Sec…
- CVE-2026-57297A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read…Jenkins Project Jenkins Contrast Continuous Application Sec…
- CVE-2026-57295A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers to…Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…
- CVE-2026-57294A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission…Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…
- CVE-2026-57293An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure…Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…
- CVE-2026-57292A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers to connect to…Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…
- CVE-2026-57291Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to…Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…
- CVE-2026-57290A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_84449 and earlier allows attackers to…Jenkins Project Jenkins Priority Sorter Plugin · org.jenkin…
- CVE-2026-57289Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for…Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…
- CVE-2026-57288Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows…Jenkins Project Jenkins Active Directory Plugin · org.jenki…
- CVE-2026-57287Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying…Jenkins Project Jenkins Job Configuration History Plugin ·…
- CVE-2026-57286A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to…Jenkins Project Jenkins Git Parameter Plugin · org.jenkins-…
- CVE-2026-57285A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read…Jenkins Project Jenkins GitHub Branch Source Plugin · org.j…
- CVE-2026-57284Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline…Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…
- CVE-2026-57283A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to…Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…
- CVE-2026-57282Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated…Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2026-13163Lack of input validation in Mailerup input parameter leads to Open RedirectMailerup
- CVE-2026-56761hono - HTML Injection via Improper JSX Attribute Name Handling in SSRhono
- CVE-2026-56370ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components ArtifactImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56368ImageMagick - Memory Leak in Raw Pixel Data CodersImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-56358n8n - Stored Cross-Site Scripting in Form Trigger Noden8n
- CVE-2026-56351n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodesn8n
- CVE-2026-56338Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp EndpointCapgo
- CVE-2026-56337Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2Capgo
- CVE-2026-56310Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope BypassCap-go capgo
- CVE-2026-56302Capgo - Unsecured Supabase Images Bucket via Missing Row Level SecurityCapgo
- CVE-2026-56272Flowise - Insufficient Password Salt Rounds in Bcrypt HashingFlowise
- CVE-2026-56269Flowise - Weak Default Token Hash Secret in JWT Token EncryptionFlowise
- CVE-2026-56262Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API ServerCrawl4AI
- CVE-2026-13140Stored Cross-Site Scripting in Canarytokens.orgThinkst Applied Research Canarytokens
- CVE-2026-13150SSRF in Pentestify PDF generation endpoint via Host headerPentestify
- CVE-2026-52944ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSELinux
- CVE-2026-11968Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in TortoiseGitTortoiseGit team TortoiseGit
- CVE-2026-52941net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepointLinux
- CVE-2026-52940tun: zero the whole vnet header in tun_put_user()Linux
- CVE-2026-52939net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completionLinux
- CVE-2026-52938bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag pathsLinux
- CVE-2026-52937tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDRLinux
- CVE-2026-52936crypto: jitterentropy - replace long-held spinlock with mutexLinux
- CVE-2026-52930ipc/shm: serialize orphan cleanup with shm_nattch updatesLinux
- CVE-2026-52928af_unix: Reject SIOCATMARK on non-stream socketsLinux
- CVE-2026-52926batman-adv: clear current gateway during teardownLinux
- CVE-2026-52925vrf: Fix a potential NPD when removing a port from a VRFLinux
- CVE-2026-52921netfilter: ipset: stop hash: range iteration at endLinux
- CVE-2026-52916batman-adv: frag: disallow unicast fragment in fragmentLinux
- CVE-2026-52913batman-adv: v: stop OGMv2 on disabled interfaceLinux
- CVE-2026-10753Site Kit by Google < 1.176.0 - Editor+ Email Reporting Settings UpdateSite Kit by Google
- CVE-2026-10531AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode AttributeAI Share & Summarize
- CVE-2026-8690RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request…RentMy Real-Time Rental Management Plugin
- CVE-2026-11997Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Updateseo_tools Bulk SEO Image
- CVE-2026-8622Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variablepixelwelt Image Sizes on Demand
- CVE-2026-9612WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLsyapacdev WhatsOrder – Instant Checkout for WooCommerce
- CVE-2026-8688Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data…krishaweb Advance Nav Menu Manager
- CVE-2026-9620WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attributejoomunited WP Latest Posts
- CVE-2026-8865Avalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesparadigmatools Avalon23 Products Filter for WooCommerce
- CVE-2026-8896MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesmirsoftware MIR blocks and shortcodes
- CVE-2026-918324liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization24liveblog – live blog tool
- CVE-2026-9172Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpointajitdas Devs Accounting – Simple Accounting and Invoicing S…
- CVE-2026-6292MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Updatemanuelpadillac MP Customize Login Page
- CVE-2026-9616Generate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX…verenigingvanregistrars Generate Security.txt
- CVE-2026-8617SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token &…ailchev SearchPlus
- CVE-2026-918424liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action24liveblog – live blog tool
- CVE-2026-8628EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameterowencutajar EntreDroppers
- CVE-2026-10552Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameterjotis Blue Captcha
- CVE-2026-8614Assistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via…assistioai Assistio
- CVE-2026-7617Secufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX ActionSecufor_OAuth
- CVE-2026-9619Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Actionberfect Reviews and Rating – Docplanner
- CVE-2026-9724MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings UpdateMotorDesk
- CVE-2026-12094Advanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id'…iamranit Advanced Contact Form 7 – Compact DB
- CVE-2026-11370WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameterjoomunited WP Meta SEO
- CVE-2026-9175Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameterajitdas Devs Accounting – Simple Accounting and Invoicing S…
- CVE-2026-9721Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Updatechuhpl Book a Room Event Calendar
- CVE-2026-8905Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameterosiris8 Osiris Signature Banner
- CVE-2026-9539libslirp TCP URG OOB Read Information Leakfreedesktop.org libslirp
- CVE-2026-12488GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerabilityGeoVision
- CVE-2026-11614Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple WidgetsXpro Addons — 140+ Widgets for Elementor
- CVE-2025-60466A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows…
- CVE-2025-60468GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow.
- CVE-2025-60471A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0…
- CVE-2025-60473A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0…