CVEs published August 10, 2026
671 CVEs were published on August 10, 2026: 85 critical, 250 high. 1 is now in CISA KEV.
- Published
- 671
- Critical
- 85
- High
- 250
- Medium
- 136
- Low
- 13
- Unrated
- 187
- Now in CISA KEV
- 1
- Fix available
- 388
Most affected products
- Linux
- 344
- dokploy
- 35
- Red Hat OpenShift AI
- 16
- Samsung Mobile Devices
- 16
- discourse
- 13
- Apache Software Foundation Apache Ranger
- 9
- ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- 8
- frappe erpnext
- 6
- TBEA TLogger
- 6
- Red Hat Enterprise Linux
- 5
Critical 85
- CVE-2026-48161react18-use was vulnerable to malicious code execution via compromised commitsdai-shi react18-use
- CVE-2026-48160react-tracked was vulnerable to malicious code execution via compromised commitsdai-shi react-tracked
- CVE-2026-72911ERPNext: Possibility of server-side template injection due to missing validationfrappe erpnext
- CVE-2026-18948Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry serverRed Hat OpenShift AI · feast
- CVE-2026-14450Maas-billing: maas api: privilege escalation via forged http headers due to missing authenticationRed Hat OpenShift AI
- CVE-2026-72904Firecrawl: Arbitrary file read via JSON Schema $ref expansionfirecrawl
- CVE-2026-72902Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryByIddokploy
- CVE-2026-72901Dokploy: Remote Code Execution via volume-backupdokploy
- CVE-2026-72886Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of…dokploy
- CVE-2025-15681Insufficient Webserver AuthenticationTBEA TLogger
- CVE-2026-72882Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed serversdokploy
- CVE-2025-13294Unauthenticated SQL InjectionTBEA TLogger
- CVE-2025-13293Backdoor / default root credentialsTBEA TLogger
- CVE-2026-72880Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`dokploy
- CVE-2026-72879Dokploy: Command Injection via Registry Credentials in Swarm Uploaddokploy
- CVE-2026-72878Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell argumentsdokploy
- CVE-2026-72877Dokploy: Command Injection via dockerImage in buildRemoteDockerdokploy
- CVE-2026-72876Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.dokploy
- CVE-2026-72872Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone`dokploy
- CVE-2026-72869Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCEdokploy
- CVE-2026-72868Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injectiondokploy
- CVE-2026-72867Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side…dokploy
- CVE-2026-72865Dokploy: OS Command Injection via compose `composePath`dokploy
- CVE-2026-72864Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)dokploy
- CVE-2026-72863Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker hostdokploy
Show all 85 entriesShow fewer entries
- CVE-2026-16626JasperReports Server: XXE Injection Vulnerability (Unauthenticated)Jaspersoft JasperReports Server
- CVE-2026-72862Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCEdokploy
- CVE-2026-72899Metabase SQL injection via public card or dashboardMetabase
- CVE-2026-72898Metabase SQL injection via password reset endpointMetabase
- CVE-2026-72740Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan`dokploy
- CVE-2026-48159use-reducer-async was vulnerable to malicious code execution via compromised commitsdai-shi use-reducer-async
- CVE-2026-72738Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameterdokploy
- CVE-2026-72737Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backupsdokploy
- CVE-2026-72736Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCEdokploy
- CVE-2026-72735Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote executiondokploy
- CVE-2026-72733Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restoredokploy
- CVE-2026-48158use-context-selector was vulnerable to malicious code execution via compromised commitsdai-shi use-context-selector
- CVE-2026-47754unauthenticated path traversal in Metacat 2.xNCEAS metacat
- CVE-2026-18412The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerabilityOpenCart
- CVE-2026-63106ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.phpRazinsoft Ready eCommerce
- CVE-2026-13206Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command InjectionZyxel Networks WAH7601
- CVE-2026-68426xfrm: fix stale skb->prev after async crypto steals a GSO segmentLinux
- CVE-2026-68388smb/client: handle overlapping allocated ranges in fallocateLinux
- CVE-2026-68385s390/checksum: Fix csum_partial() without vector facilityLinux
- CVE-2026-68381ksmbd: pin conn during async oplock break notificationLinux
- CVE-2026-68343smb: client: validate DFS referral PathConsumedLinux
- CVE-2026-68302amt: re-read skb header pointers after every pullLinux
- CVE-2026-68300sctp: auth: verify auth requirement when auth_chunk is NULLLinux
- CVE-2026-68170mptcp: fix stale skb->sk reference on subflow closeLinux
- CVE-2026-68161sctp: close UDP tunnel sockets during netns teardownLinux
- CVE-2026-68160ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()Linux
- CVE-2026-68159libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZELinux
- CVE-2026-68158libceph: Fix multiplication overflow in decode_new_up_state_weight()Linux
- CVE-2026-68156libceph: refresh auth->authorizer_buf{,_len} after authorizer updateLinux
- CVE-2026-68154libceph: reject zero bucket types in crush_decodeLinux
- CVE-2026-68144phonet: pep: fix use-after-free in pep_get_sb()Linux
- CVE-2026-68137net/x25: fix use-after-free in x25_kill_by_neigh()Linux
- CVE-2026-68136net: gro: fix double aggregation of flush-marked skbsLinux
- CVE-2026-68127ila: reload IPv6 header after pskb_may_pull in checksum adjustLinux
- CVE-2026-68124mctp: serial: handle zero-length frames to prevent rx buffer overflowLinux
- CVE-2026-68123openvswitch: fix GSO userspace truncation underflowLinux
- CVE-2026-68117tipc: clear sock->sk on the failed-insert path in tipc_sk_create()Linux
- CVE-2026-68083ksmbd: fix path resolution in ksmbd_vfs_kern_path_createLinux
- CVE-2026-72593dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Accessdulldusk phpfm
- CVE-2026-72592dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Uploaddulldusk phpfm
- CVE-2026-72590alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameteralseambusher crontab-ui
- CVE-2026-72589alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Fieldalseambusher crontab-ui
- CVE-2026-72580duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpointsduhow xiaoai-patch
- CVE-2026-72577NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command InjectionNASA fprime-gds
- CVE-2026-72575daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objectsdaptin
- CVE-2026-72569cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletioncube-root directory-serve
- CVE-2026-72567deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and DeleteAsyncFuncAI deepwiki-open
- CVE-2026-72565Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form BypassTencent APIJSON
- CVE-2026-72564fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authenticationfosrl Pangolin
- CVE-2026-28672Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilderApache Software Foundation Apache Ranger · org.apache.range…
- CVE-2026-32227Apache Ranger: SQL Injection vulnerability in lookup functionalityApache Software Foundation Apache Ranger
- CVE-2026-40920Apache Ranger: Privilege Escalation via URL ParameterApache Software Foundation Apache Ranger
- CVE-2026-42537Apache Ranger: Remote Code Execution via JDBC URL InjectionApache Software Foundation Apache Ranger
- CVE-2026-44416Apache Ranger: Remote Code Execution via Arbitrary Class InstantiationApache Software Foundation Apache Ranger
- CVE-2026-55799Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreatorApache Software Foundation Apache Ranger
- CVE-2026-66915Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2fabrikar.com Fabrik extension for Joomla
- CVE-2026-19089Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File UploadProduct Input Fields for WooCommerce
- CVE-2026-19053ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' ParameterProSolution WP Client
- CVE-2026-16299Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password ResetSingle Sign On For TNG
- CVE-2026-16298FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password ResetFoodBoxBooker
High 250
- CVE-2026-8718Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLSzephyrproject zephyr
- CVE-2025-30241OS Command Injection in Web Interface in Multiple TP-Link Aginet DevicesTP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +29
- CVE-2025-30239Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet DevicesTP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +62
- CVE-2025-30238Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet DevicesTP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +56
- CVE-2025-30237Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet DevicesTP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +53
- CVE-2026-72915Mastodon: Personally-identifying information disclosure due to incorrect access control validationmastodon
- CVE-2026-72914Mastodon: Exhausting data by an unauthenticated request to the admin retention APImastodon
- CVE-2026-72913Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequenceskovidgoyal kitty
- CVE-2026-72910ERPNext: Unauthorised modification of master data due to missing validationfrappe erpnext
- CVE-2026-72909ERPNext: Broken Access Control on certain endpointsfrappe erpnext
- CVE-2026-18620Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputyRed Hat OpenShift AI
- CVE-2026-18618Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listenerRed Hat OpenShift AI
- CVE-2026-18611Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentialsRed Hat OpenShift AI
- CVE-2026-63622Libvirt: swtpm privilege escalation via symlink followingRed Hat Enterprise Linux
- CVE-2026-18982Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterrolesRed Hat OpenShift AI
- CVE-2026-18951Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterroleRed Hat OpenShift AI
- CVE-2026-18950Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationRed Hat OpenShift AI
- CVE-2026-18949Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resourcesRed Hat OpenShift AI
- CVE-2026-18947Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materializationRed Hat OpenShift AI
- CVE-2026-18941Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authenticationRed Hat OpenShift AI
- CVE-2026-18621Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardeningRed Hat OpenShift AI · Red Hat AI Inference Server
- CVE-2026-18617Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from…Red Hat OpenShift AI
- CVE-2026-18608Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org /, and clusterrole/binding crud cluster-wideRed Hat OpenShift AI
- CVE-2026-15581Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wideRed Hat OpenShift AI
- CVE-2026-15467Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering…Red Hat OpenShift AI
Show all 250 entriesShow fewer entries
- CVE-2026-13717Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)llm-d · Red Hat OpenShift AI
- CVE-2026-72903Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directoryEugeny tabby
- CVE-2026-11810NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)zephyrproject zephyr
- CVE-2026-73033Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.phpsucuri-wordpress-plugin
- CVE-2026-73030unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escapefrostming unearth
- CVE-2026-69118Cachet 2.4.1 Authenticated Server-Side Template Injection RCEcachethq cachet
- CVE-2025-15683Multiple Unauthenticated Denial-of-Service ConditionsTBEA TLogger
- CVE-2025-15682Unauthenticated Resource ExhaustionTBEA TLogger
- CVE-2026-72884Dokploy: Command Injection via Compose Custom Commanddokploy
- CVE-2026-69114Spacebar Server Cross-Channel Message Deletion via Permission Check BypassSpacebar Server
- CVE-2026-72883Dokploy: WebSocket Terminal Missing Service-Level Access Controldokploy
- CVE-2026-72875Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFiledokploy
- CVE-2026-72874Dokploy: Command Injection via Unescaped Git URL in Clone Commandsdokploy
- CVE-2026-14886Vault Enterprise vulnerable to cross-namespace entity deletionHashiCorp Vault Enterprise
- CVE-2026-71966CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransferusmannasir cyberpanel
- CVE-2026-71965CyberPanel 2.4.3 Authenticated RCE via Remote Backup Featureusmannasir cyberpanel
- CVE-2026-71964CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Uploadusmannasir cyberpanel
- CVE-2026-59091Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image filegimp · Red Hat Enterprise Linux
- CVE-2026-72871Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callbackdokploy
- CVE-2026-72870Dokploy: Command Injection via Docker Credentials in buildRemoteDockerdokploy
- CVE-2026-72866WebSocket Terminal Auth Bypassdokploy
- CVE-2026-71962Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/downloadFlowiseAI Flowise
- CVE-2026-71969OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt OperationsOP-TEE optee_os
- CVE-2026-71968OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA_FLAG_CONCURRENTOP-TEE optee_os
- CVE-2026-10754Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker…Pegasystems Pega Infinity
- CVE-2026-70622tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()composefs tar-rs
- CVE-2026-72734Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registrationdokploy
- CVE-2026-71576Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlersRed Hat Multicluster Global Hub
- CVE-2026-72731Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorerdiscourse
- CVE-2026-72730Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editordiscourse
- CVE-2026-48048XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requestsxwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…
- CVE-2026-66738SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLiteSPIP
- CVE-2026-72718goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitoraaif-goose goose
- CVE-2026-19433Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard exportRoskus Prospero Flow CRM
- CVE-2026-12984Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601Zyxel Networks WAH7601
- CVE-2026-6374Hardcoded Credentials in Zyxel WAH7601 RouterZyxel Networks WAH7601
- CVE-2026-59233Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalationRoskus Prospero Flow CRM
- CVE-2026-59090Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflowgimp · Red Hat Enterprise Linux
- CVE-2026-68427gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappingsLinux
- CVE-2026-68425IB/mad: Drop unmatched RMPP responses before reassemblyLinux
- CVE-2026-68420xfrm: reject optional IPTFS templates in outbound policiesLinux
- CVE-2026-68419RDMA/irdma: Prevent rereg_mr for non-mem regionsLinux
- CVE-2026-68417RDMA/siw: publish QP after initializationLinux
- CVE-2026-68415xfrm: clear mode callbacks after failed mode setupLinux
- CVE-2026-68414wifi: cfg80211: cancel sched scan results work on unregisterLinux
- CVE-2026-68409wifi: mac80211: defer link RX stats percpu free to RCULinux
- CVE-2026-68404wifi: cfg80211: use wiphy work for socket owner autodisconnectLinux
- CVE-2026-68402wifi: cfg80211: bound element ID read when checking non-inheritanceLinux
- CVE-2026-68401firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()Linux
- CVE-2026-68400firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculationLinux
- CVE-2026-68399bpf: Fix UAF in sock clone early bailoutsLinux
- CVE-2026-68398ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAFLinux
- CVE-2026-68397net/iucv: take a reference on the socket found in afiucv_hs_rcv()Linux
- CVE-2026-68394Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued updateLinux
- CVE-2026-68393Bluetooth: hci_sync: extend conn_hash lookup critical sectionsLinux
- CVE-2026-68392Bluetooth: mgmt: fix locking in unpair_device/disconnect_syncLinux
- CVE-2026-68391Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmdsLinux
- CVE-2026-68390Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookupsLinux
- CVE-2026-68389Bluetooth: hci_qca: Clear memdump state on invalid dump sizeLinux
- CVE-2026-68387can: raw: add locking for raw flags bitfieldLinux
- CVE-2026-68384drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO movesLinux
- CVE-2026-68383drm/xe/guc: Keep scheduler timeline name aliveLinux
- CVE-2026-68382drm/xe/guc: Hold device ref until queue teardown completesLinux
- CVE-2026-68380accel/amdxdna: Fix use-after-free of mm_struct in job schedulerLinux
- CVE-2026-68379tcp: fix TIME_WAIT socket reference leak on PSP policy failureLinux
- CVE-2026-68377net/sched: act_tunnel_key: Defer dst_release to RCU callbackLinux
- CVE-2026-68376sctp: fix auth_hmacs array size in struct sctp_cookieLinux
- CVE-2026-68374usb: core: sysfs: add lock to bos_descriptors_read()Linux
- CVE-2026-68373wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()Linux
- CVE-2026-68371usb: musb: omap2430: Do not put borrowed of_node in probeLinux
- CVE-2026-68370usb: gadget: dummy_hcd: prevent fifo_req reuse during givebackLinux
- CVE-2026-68354firewire: net: Fix fragmented datagram reassemblyLinux
- CVE-2026-68353wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handlerLinux
- CVE-2026-68352wifi: ath6kl: fix OOB read from firmware IE lengths in connect eventLinux
- CVE-2026-68348ASoC: tas2781: bound firmware description string parsingLinux
- CVE-2026-68341ovpn: fix use after free in unlock_ovpn()Linux
- CVE-2026-68340hwmon: occ: validate poll response sensor blocksLinux
- CVE-2026-68338net/packet: avoid fanout hook re-registration after unregisterLinux
- CVE-2026-68335rds: drop incoming messages that cross network namespace boundariesLinux
- CVE-2026-68330net: airoha: Fix DMA direction for NPU mailbox bufferLinux
- CVE-2026-68329iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()Linux
- CVE-2026-68326wifi: mwifiex: bound uAP association event IEs to the event bufferLinux
- CVE-2026-68323tipc: serialize udp bearer replicast list updatesLinux
- CVE-2026-68320sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkidLinux
- CVE-2026-68316accel: ethosu: Fix element size accounting for cmd stream validationLinux
- CVE-2026-68315sctp: validate stream count in sctp_process_strreset_inreq()Linux
- CVE-2026-68314net: mctp i3c: clean up notifier and buses if driver register failsLinux
- CVE-2026-68305drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffersLinux
- CVE-2026-68299vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packetsLinux
- CVE-2026-68298drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()Linux
- CVE-2026-68297tipc: fix u16 MTU truncation in media and bearer MTU validationLinux
- CVE-2026-68295LoongArch: BPF: Zero-extend signed ALU32 div/mod resultsLinux
- CVE-2026-68294net: qrtr: restrict socket creation to the initial network namespaceLinux
- CVE-2026-68293net/mlx5: Fix MCIA register buffer overflow on 32 dword readsLinux
- CVE-2026-68290rds: tcp: unregister sysctl before tearing down listen socketLinux
- CVE-2026-68287drop_monitor: fix size calculations for 64-bit attributesLinux
- CVE-2026-68284bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()Linux
- CVE-2026-68283tracing: Fix use-after-free freeing trigger private dataLinux
- CVE-2026-68274drm/xe/guc: Fix buffer overflow in steered register list allocationLinux
- CVE-2026-68273drm/amdgpu: Fix context pstate override handlingLinux
- CVE-2026-68266drm/xe: Hold a dma-buf reference for imported BOsLinux
- CVE-2026-68265drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCLinux
- CVE-2026-68264drm/xe/pt: Reset current_op in xe_pt_update_ops_init()Linux
- CVE-2026-68263drm/imagination: Fix double call to drm_sched_entity_fini()Linux
- CVE-2026-68262drm/imagination: Fix user array stride in pvr_set_uobj_array()Linux
- CVE-2026-68260drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VMLinux
- CVE-2026-68258drm/amdkfd: Check bounds on CRIU restore queue type and mqd sizeLinux
- CVE-2026-68257drm/amdkfd: fix 32-bit overflow in CWSR total size calculationLinux
- CVE-2026-68255drm/virtio: bound EDID block reads to the response bufferLinux
- CVE-2026-68253drm/i915/hdcp: check streams[] bounds before overflowLinux
- CVE-2026-68245drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()Linux
- CVE-2026-68240drm/gpusvm: publish dpagemap early to avoid device mapping leak on errorLinux
- CVE-2026-68236drm/amd/display: set new_stream to NULL after releaseLinux
- CVE-2026-68230media: amlogic-c3: Add validations for ae and awb configLinux
- CVE-2026-68229media: cedrus: skip invalid H.264 reference list entriesLinux
- CVE-2026-68228media: chips-media: wave5: Move src_buf Removal to finish_encodeLinux
- CVE-2026-68222media: msi2500: Return queued buffers on start_streaming() failureLinux
- CVE-2026-68219media: nxp: imx8-isi: Fix potential out-of-bounds issuesLinux
- CVE-2026-68216media: pwc: Return queued buffers on start_streaming() failureLinux
- CVE-2026-68213media: rtl2832_sdr: Return queued buffers on start_streaming() failureLinux
- CVE-2026-68210media: stm32: dcmi: unregister notifier on probe failureLinux
- CVE-2026-68209media: sun4i-csi: Return queued buffers on start_streaming() failureLinux
- CVE-2026-68206media: v4l2-ctrls: validate HEVC active reference countsLinux
- CVE-2026-68204media: vivid: check for vb2_is_busy() when toggling capsLinux
- CVE-2026-68202ALSA: seq: close a re-opened queue timer in the destructorLinux
- CVE-2026-68201ALSA: timer: drain a slave's callback before its master detaches itLinux
- CVE-2026-68200ALSA: timer: don't re-enter an instance callback that is still runningLinux
- CVE-2026-68199wifi: ath6kl: fix OOB access from firmware ADDBA window sizeLinux
- CVE-2026-68198wifi: ath6kl: fix use-after-free in aggr_reset_state()Linux
- CVE-2026-68196wifi: wilc1000: validate assoc response length before subtracting headerLinux
- CVE-2026-68192wifi: brcmfmac: make release_scratchbuffers idempotentLinux
- CVE-2026-68189Bluetooth: hci_sync: Protect UUID list traversalLinux
- CVE-2026-68179misc: nsm: only unlock nsm_dev on post-lock error pathsLinux
- CVE-2026-68178misc: nsm: pin the module while the device is openLinux
- CVE-2026-68177tracing: Delay module ref count for "enable_event" triggerLinux
- CVE-2026-68173ublk: wait on ublk_dev_ready() instead of ub->completionLinux
- CVE-2026-68172arm64: make huge_ptep_get handled unaligned addressesLinux
- CVE-2026-68163mm/page_vma_mapped: fix device-private PMD handlingLinux
- CVE-2026-68162sctp: avoid auth_enable sysctl UAF during netns teardownLinux
- CVE-2026-68157libceph: guard missing CRUSH type name lookupLinux
- CVE-2026-68155libceph: Reject monmaps advertising zero monitorsLinux
- CVE-2026-68153libceph: remove debugfs files before client teardownLinux
- CVE-2026-68152amt: fix use-after-free in AMT delayed worksLinux
- CVE-2026-72692OpenSignLabs opensignserver - Missing AuthorizationOpenSignLabs opensignserver
- CVE-2026-68149fs: preserve ACL_DONT_CACHE state in forget_cached_acl()Linux
- CVE-2026-68148fscrypt: Add missing superblock check in find_or_insert_direct_key()Linux
- CVE-2026-68147fscrypt: Avoid dynamic allocation in fscrypt_get_devices()Linux
- CVE-2026-72691OpenSignLabs opensignserver - Authentication BypassOpenSignLabs opensignserver
- CVE-2026-68145iomap: fix out-of-bounds bitmap_set() with zero-length rangeLinux
- CVE-2026-68143net: slip: serialize receive against buffer reallocationLinux
- CVE-2026-68142geneve: require CAP_NET_ADMIN in the device netns for changelinkLinux
- CVE-2026-72689OpenSignLabs opensignserver - Broken Object Level AuthorizationOpenSignLabs opensignserver
- CVE-2026-68141net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()Linux
- CVE-2026-68140net/iucv: fix use-after-free of a severed iucv_pathLinux
- CVE-2026-72688OpenSignLabs opensignserver - Missing Authentication for Critical FunctionOpenSignLabs opensignserver
- CVE-2026-68138net/sched: serialize qdisc_rtab_list against concurrent get/putLinux
- CVE-2026-68134ptp: ptp_s390: Add missing facility checkLinux
- CVE-2026-68131rbd: Reset positive result codes to zero in object map update pathLinux
- CVE-2026-68129gve: fix Rx queue stall on alloc failureLinux
- CVE-2026-68128ice: reject out-of-range ptype in ice_parser_profile_initLinux
- CVE-2026-68125mac802154: llsec: reject frames shorter than the authentication tagLinux
- CVE-2026-68121pppoe: reload header pointer after dev_hard_header()Linux
- CVE-2026-68120rtase: Workaround for TX hang caused by hardware packet parsingLinux
- CVE-2026-68119tcp: initialize standalone TCP-AO response paddingLinux
- CVE-2026-68118tcp: challenge ACK for non-exact RST in SYN-RECEIVEDLinux
- CVE-2026-68116vxlan: mdb: Fix source list corruption on a failed replaceLinux
- CVE-2026-68108drm/amdgpu/vce: fix integer overflow in image sizeLinux
- CVE-2026-68107drm/amdgpu/vcn4: avoid rereading IB param lengthLinux
- CVE-2026-68106drm/amdgpu: fix division by zero with invalid uvd dimensionsLinux
- CVE-2026-68104drm/amdgpu: invoke pm_genpd_remove() before freeing genpdLinux
- CVE-2026-68103drm/amdgpu: reject mapping a reserved doorbell to a new queueLinux
- CVE-2026-68100ksmbd: validate num_subauth when copying ACE in set_ntacl_daclLinux
- CVE-2026-68098ksmbd: bound DACL dedup walk to copied ACEsLinux
- CVE-2026-68097ksmbd: validate ACE size against SID sub-authoritiesLinux
- CVE-2026-68096audit: fix recursive locking deadlock in audit_dupe_exe()Linux
- CVE-2026-68091HID: wacom: stop hardware after post-start probe failuresLinux
- CVE-2026-68085Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceledLinux
- CVE-2026-59087Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocationgimp · Red Hat Enterprise Linux
- CVE-2026-72594lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Uploadlobehub lobe-chat
- CVE-2026-72591Koito - Authenticated Server-Side Request Forgery via Album Image URL Parametergabehf Koito
- CVE-2026-72586frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handlerfrangoteam FUXA
- CVE-2026-72584fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recoveryfastschema
- CVE-2026-72582fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpointfastschema
- CVE-2026-72581duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpointduhow xiaoai-patch
- CVE-2026-72579NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data ServerNASA HyperCP
- CVE-2026-72578FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax DispatcherFreePBX Framework
- CVE-2026-725734xmen pm2panel - Authenticated OS Command Injection via id Query Parameter4xmen pm2panel
- CVE-2026-72572o1lab xmysql - Unauthenticated Path Traversal via name Query Parametero1lab xmysql
- CVE-2026-72571mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parametermustafaakin cast-localvideo
- CVE-2026-72566automatisch - Server-Side Request Forgery via HTTP Request Custom Actionautomatisch
- CVE-2026-61899Apache Tapestry: Possible classpath file download through URL manipulationApache Software Foundation org.apache.tapestry:tapestry-core
- CVE-2026-55814Apache Ranger: Download APIs expose plugin data without authenticationApache Software Foundation Apache Ranger
- CVE-2026-65942Apache Ranger: Clients accept TLS certificates issued for other hostnamesApache Software Foundation Apache Ranger
- CVE-2026-65948Apache Ranger: UnixAuth lacks brute-force protectionApache Software Foundation Apache Ranger
- CVE-2026-44630Apache IoTDB: RPC service denial of service via unchecked Thrift string lengthApache Software Foundation Apache IoTDB
- CVE-2026-66407DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-66405DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-66403DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-21079Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.Samsung Mobile Smart Switch
- CVE-2026-21074Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.Samsung Mobile Bixby
- CVE-2026-21068Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2026-21064Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability.Samsung Mobile Devices
- CVE-2026-64940Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may…Nishishi Factory Tegalog -Fumy Otegaru Memo Logger-
- CVE-2026-18786CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication BypassCheckView
- CVE-2026-14293Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS EditorAutopay
- CVE-2026-14237Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalationvitepos
- CVE-2026-17022Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking WizardSalon Booking System
- CVE-2026-19049ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' CookieProSolution WP Client
- CVE-2026-18946Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable FilenameContact Form to Any API
- CVE-2026-16985Squeeze < 1.7.12 - Author+ Arbitrary File UploadSqueeze
- CVE-2026-14206HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data DisclosureHT Contact Form
- CVE-2026-13600AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync CronAutoNetTV Relay
- CVE-2026-13170Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template SettingEventin
- CVE-2026-18470Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password ResponseLogin & Register Forms
- CVE-2026-18469Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute ForceLogin & Register Forms
- CVE-2026-18468Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address…Login & Register Forms
- CVE-2026-13133A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a…LY LINE for Windows
- CVE-2026-16257Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-JugglingArvow AI SEO Writer
- CVE-2026-18030Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro FormsBricksForge
- CVE-2026-17542Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connectorFile Manager
- CVE-2026-17541Bit File Manager < 6.9.1 - Unauthenticated File Activity Log DisclosureFile Manager
- CVE-2026-17540Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchFile Manager
- CVE-2026-19389Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds readRed Hat Enterprise Linux
- CVE-2026-19387Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoderRed Hat Enterprise Linux
- CVE-2026-19381Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges managementKingston FURY CTRL RGB Control Software
Medium, low and unrated 336
- CVE-2026-11812UpdateHub: race condition on shared context causes out-of-bounds write and DoSzephyrproject zephyr
- CVE-2026-11811Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoSzephyrproject zephyr
- CVE-2025-30240Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet DevicesTP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +30
- CVE-2025-32736PingFederate Administrative Console CSRF weaknessesPing Identity PingFederate
- CVE-2026-72919Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into TeamsRocketChat Rocket.Chat
- CVE-2026-72918Rocket.Chat: Insecure implementation of websocket notificationsRocketChat Rocket.Chat
- CVE-2026-72917AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalizationMintplex-Labs anything-llm
- CVE-2026-6426Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds accessRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-72916Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addressesmastodon
- CVE-2026-72912CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URLgchq CyberChef
- CVE-2026-72908ERPNext: Possibility of SQL injection due to missing validationfrappe erpnext
- CVE-2026-72907ERPNext: Broken Access Control on certain endpointfrappe erpnext
- CVE-2026-72906ERPNext: Unauthorised triggering of automated emails due to missing validationfrappe erpnext
- CVE-2026-19411Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns nullRed Hat Enterprise Linux
- CVE-2026-18942Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalationRed Hat OpenShift AI
- CVE-2026-16456Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputyRed Hat OpenShift AI
- CVE-2026-11809UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadatazephyrproject zephyr
- CVE-2026-73035npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequencesraineorshine npm-check-updates
- CVE-2026-72743SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-htmldataease SQLBot
- CVE-2026-69116FlyEnv < 4.18.0 Cross-Site Scripting via v-htmlxpf0000 FlyEnv
- CVE-2026-72885Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builderdokploy
- CVE-2026-44401Typemill CMS 2.x Persistent XSS via Markdown javascript URITypemill
- CVE-2025-15680Information Disclosure via UARTTBEA TLogger
- CVE-2026-72881Dokploy: Command Injection via database credentials in backup/restore commandsdokploy
- CVE-2026-69112Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_maphuggingface accelerate · accelerate
Show all 336 entriesShow fewer entries
- CVE-2026-72873Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one`dokploy
- CVE-2026-6791Potential stack-based buffer clash during tilde expansion in wordexpThe GNU C Library glibc
- CVE-2026-6368wordexp with WRDE_APPEND can return or use invalid memoryglibc
- CVE-2026-68872Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or…Apache Software Foundation apache-airflow-providers-amazon…
- CVE-2026-12339Authenticated Arbitrary File Write Vulnerability in multiple devicesTP-Link Systems TL-MR6400 · TP-Link Systems Archer MR600 +3
- CVE-2026-68871Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or VariableApache Software Foundation apache-airflow-providers-yandex…
- CVE-2026-71967OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open_sessionOP-TEE optee_os
- CVE-2026-68870Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or…Apache Software Foundation apache-airflow-providers-microso…
- CVE-2026-72900Metabase information exposureMetabase
- CVE-2026-72739Dokploy: Command Injection via Compose Shell Executiondokploy
- CVE-2026-72732Discourse: Templates endpoint exposes hidden tag namesdiscourse
- CVE-2026-12624Vault vulnerable to LIST authorization bypass via trailing-slash stripHashiCorp Vault
- CVE-2026-71577Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migrationRed Hat Multicluster Global Hub
- CVE-2026-63623Libvirt: information disclosure via world-readable storage volume images during clone/convertRed Hat Enterprise Linux
- CVE-2026-72729Discourse: Stored XSS in discourse-local-dates plugindiscourse
- CVE-2026-56619HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)HCLSoftware HCL BigFix Mobile
- CVE-2026-72728Discourse: Onebox iframe origin allowlist enforces URL authority boundarydiscourse
- CVE-2026-72727Discourse: Stored XSS in the moderation review queuediscourse
- CVE-2026-72726Discourse: Unauthorized eavesdropping on private AI bot conversations.discourse
- CVE-2026-72725Discourse: Stored XSS in staff action logs injects staff UIdiscourse
- CVE-2026-72724Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatchdiscourse
- CVE-2026-56620HCL BigFix Mobile is vulnerable to information disclosureHCLSoftware HCL BigFix Mobile
- CVE-2026-72723Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tagsdiscourse
- CVE-2026-72722Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLsdiscourse
- CVE-2026-72721Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparisondiscourse
- CVE-2026-72720Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsingdiscourse
- CVE-2026-72719Chatwoot: Cross-Account Resource Transfer via `account_id` Parameterchatwoot
- CVE-2026-72761Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookupvulnerability-lookup
- CVE-2026-72760cti-transmute Following List Exposes User Email Addresses to Authenticated UsersMISP cti-transmute
- CVE-2026-72759cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletionmisp cti-transmute
- CVE-2026-72751Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Contentmisp cti-transmute
- CVE-2026-59112Signature validation vulnerability affecting DigiDoc applicationsEstonian Information System Authority (RIA) libdigidocpp… +1
- CVE-2026-71959Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collectbitwarden server
- CVE-2026-18503Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()Python Software Foundation CPython · libpython +2
- CVE-2026-63105ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket SystemsRazinsoft Ready eCommerce
- CVE-2026-15060systemd-machined: unprivileged users can terminate arbitrary processessystemd-machined
- CVE-2026-16742systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate pathsystemd-homed
- CVE-2026-15059systemd-oomd: unprivileged users can terminate arbitrary processessystemd-oomd
- CVE-2026-18478Stored XSS in Magnolia CMSMagnolia DXP Magnolia CMS
- CVE-2026-18370Heap-based buffer overflow in entreradman entr
- CVE-2026-6373Sensitive Data Exposure in Zyxel WAH7601 RouterZyxel Networks WAH7601
- CVE-2026-19278Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappingsRed Hat Advanced Cluster Security
- CVE-2026-68428KVM: x86/mmu: Fix use-after-free on vendor module reloadLinux
- CVE-2026-68424mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()Linux
- CVE-2026-68423mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()Linux
- CVE-2026-68422btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()Linux
- CVE-2026-68421sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()Linux
- CVE-2026-68418RDMA/irdma: Prevent user-triggered null deref on QP createLinux
- CVE-2026-68416mtd: fix double free and WARN_ON in add_mtd_device() error pathsLinux
- CVE-2026-68413wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()Linux
- CVE-2026-68412wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()Linux
- CVE-2026-68411wifi: mac80211_hwsim: clamp virtio RX length before skb_putLinux
- CVE-2026-68410wifi: libertas: fix memory leak in helper_firmware_cb()Linux
- CVE-2026-68408wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlockLinux
- CVE-2026-68407wifi: nl80211: free RNR data on MBSSID mismatchLinux
- CVE-2026-68406wifi: cfg80211: validate PMSR FTM preamble rangeLinux
- CVE-2026-68405wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lockLinux
- CVE-2026-68403wifi: brcmfmac: initialize SDIO data work before cleanupLinux
- CVE-2026-68396scsi: core: wake eh reliably when using scsi_schedule_ehLinux
- CVE-2026-68395ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registeredLinux
- CVE-2026-68386bpf, sockmap: Reject unhashed UDP sockets on sockmap updateLinux
- CVE-2026-68378dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()Linux
- CVE-2026-68375bnxt_en: Handle partially initialized auxiliary devicesLinux
- CVE-2026-68372usb: core: port: Deattach Type-C connector on component unbindLinux
- CVE-2026-68369usb: gadget: printer: fix infinite loop in printer_read()Linux
- CVE-2026-68368usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()Linux
- CVE-2026-68367usb: gadget: f_tcm: synchronize delayed set_alt with teardownLinux
- CVE-2026-68366usb: gadget: uvc: clamp SEND_RESPONSE length to the response bufferLinux
- CVE-2026-68365USB: serial: io_edgeport: cap received transmit creditsLinux
- CVE-2026-68364drm/amd/display: Fix ISM dc_lock deadlock during suspendLinux
- CVE-2026-68363wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware requestLinux
- CVE-2026-68362wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_beginLinux
- CVE-2026-68361hwmon: (corsair-psu) Stop device IO before calling hid_hw_stopLinux
- CVE-2026-68360hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stopLinux
- CVE-2026-68359hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stopLinux
- CVE-2026-68358hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stopLinux
- CVE-2026-68357watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()Linux
- CVE-2026-68356watchdog: airoha: Prevent division by zero when clock frequency is zeroLinux
- CVE-2026-68355wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()Linux
- CVE-2026-68351wifi: carl9170: bound memcpy length in cmd callback to prevent OOB readLinux
- CVE-2026-68350wifi: carl9170: fix OOB read from off-by-two in TX status handlerLinux
- CVE-2026-68349wifi: carl9170: fix buffer overflow in rx_stream failover pathLinux
- CVE-2026-68347iommu/amd: Fix IRQ unsafe locking in gdom allocationLinux
- CVE-2026-68346ALSA: hda: cs35l41: validate and free ACPI mute objectLinux
- CVE-2026-68345arm_mpam: guard MBWU state before adding it to garbageLinux
- CVE-2026-68344usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnectLinux
- CVE-2026-68342ovpn: avoid putting unrelated P2P peer on socket releaseLinux
- CVE-2026-68339Bluetooth: btusb: validate Realtek vendor event lengthLinux
- CVE-2026-68337bpf: Reject redirect helpers without a bpf_net_contextLinux
- CVE-2026-68336bonding: fix devconf_all NULL dereference when IPv6 is disabledLinux
- CVE-2026-68334rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()Linux
- CVE-2026-68333dpaa2-switch: put MAC endpoint device on disconnectLinux
- CVE-2026-68332net: airoha: Fix potential use-after-free in airoha_ppe_deinit()Linux
- CVE-2026-68331dpaa2-eth: put MAC endpoint device on disconnectLinux
- CVE-2026-68328nfp: Check resource mutex allocationLinux
- CVE-2026-68327wan: wanxl: Only reset hardware after BAR mappingLinux
- CVE-2026-68325iommu/amd: Bound the early ACPI HID mapLinux
- CVE-2026-68324iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()Linux
- CVE-2026-68322rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabledLinux
- CVE-2026-68321net: txgbe: fix FDIR filter leak on removeLinux
- CVE-2026-68319pds_core: fix deadlock between reset thread and removeLinux
- CVE-2026-68318pds_core: fix use-after-free on workqueue during removeLinux
- CVE-2026-68317pds_core: fix auxiliary device add/del racesLinux
- CVE-2026-68313tipc: fix infinite loop in __tipc_nl_compat_dumpitLinux
- CVE-2026-68312cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain pathsLinux
- CVE-2026-68311wifi: mt76: mt7925: guard link STA in decap offloadLinux
- CVE-2026-68310wifi: mt76: mt7915: guard HE capability lookupsLinux
- CVE-2026-68309wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()Linux
- CVE-2026-68308wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()Linux
- CVE-2026-68307wifi: mt76: mt7925: fix crash in reset link replayLinux
- CVE-2026-68306wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()Linux
- CVE-2026-68304wifi: brcmfmac: fix 802.1X-SHA256 call trace warningLinux
- CVE-2026-68303drm/vc4: hvs/v3d: Fix null dereference in unbindLinux
- CVE-2026-68301net: hsr: fix memory leak on slave unregistration by removing synced VLANsLinux
- CVE-2026-68296net: gre: fix lltx regression for GRE tunnels with SEQ/CSUMLinux
- CVE-2026-68292ice: prevent tstamp ring allocation for non-PF VSI typesLinux
- CVE-2026-68291idpf: fix max_vport related crash on allocation error during initLinux
- CVE-2026-68289tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()Linux
- CVE-2026-68288net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOADLinux
- CVE-2026-68286drop_monitor: perform u64_stats updates under IRQ-disabled sectionLinux
- CVE-2026-68285LoongArch: BPF: Fix memory leak in bpf_jit_free()Linux
- CVE-2026-68282drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()Linux
- CVE-2026-68281drm/imagination: Count paired job fence as dependency in prepare_job()Linux
- CVE-2026-68280drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()Linux
- CVE-2026-68279drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsersLinux
- CVE-2026-68278drm/dp/mst: fix buffer overflows in sideband chunk accumulationLinux
- CVE-2026-68277drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsersLinux
- CVE-2026-68276drm/amdgpu/gfx: fix cleaner shader IB buffer overflowLinux
- CVE-2026-68275drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFOLinux
- CVE-2026-68272drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1Linux
- CVE-2026-68271drm/nouveau: fix reversed error cleanup order in ucopy functionsLinux
- CVE-2026-68270drm/sysfb: Avoid possible truncation with calculating visible sizeLinux
- CVE-2026-68269drm/i915/gem: Add missing nospec on parallel submit slotLinux
- CVE-2026-68268drm/xe: Return error on non-migratable faults requiring devmemLinux
- CVE-2026-68267drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelistsLinux
- CVE-2026-68261drm/imagination: fix error checking of pvr_vm_context_lookup()Linux
- CVE-2026-68259drm/amdkfd: Check bounds in allocate_event_notification_slotLinux
- CVE-2026-68256drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink referenceLinux
- CVE-2026-68254drm/i915/vrr: require valid min/max vfreq for VRRLinux
- CVE-2026-68252drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68251drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68250drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68249drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68248drm/i915: Return NULL on error in active_instanceLinux
- CVE-2026-68247drm/i915/bios: range check LFP Data Block panel_type2Linux
- CVE-2026-68246drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68244drm/i915/gem: Do not leak siblings[] on proto context errorLinux
- CVE-2026-68243drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEULinux
- CVE-2026-68242drm/i915/gt: Fix NULL deref on sched_engine alloc failureLinux
- CVE-2026-68241drm/i915/mst: limit DP MST ESI service loopLinux
- CVE-2026-68239drm/ttm: Account for NULL and handle pages in ttm_pool_backupLinux
- CVE-2026-68238drm/amdgpu: Release VFCT ACPI table referenceLinux
- CVE-2026-68237drm/amdgpu/userq: fix indefinite fence wait during GPU resetLinux
- CVE-2026-68235drm/amd/display: dce100: skip non-DP stream encoders for DP MSTLinux
- CVE-2026-68234drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reservedLinux
- CVE-2026-68233drm/vc4: Shut down BO cache timer before teardownLinux
- CVE-2026-68232drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evictLinux
- CVE-2026-68231media: airspy: Return queued buffers on start_streaming() failureLinux
- CVE-2026-68227media: cx231xx: fix devres lifetimeLinux
- CVE-2026-68226media: cx23885: add ioremap return check and cleanupLinux
- CVE-2026-68225media: i2c: alvium: fix critical pointer access in alvium_ctrl_initLinux
- CVE-2026-68224media: mali-c55: Fix possible ERR_PTR in enable_streamsLinux
- CVE-2026-68223media: meson: vdec: Fix memory leak in error path of vdec_openLinux
- CVE-2026-68221media: nuvoton: npcm-video: fix memory leaks in probe and removeLinux
- CVE-2026-68220media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipeLinux
- CVE-2026-68218media: pci: dm1105: Free allocated workqueueLinux
- CVE-2026-68217media: pwc: Drain fill_buf on start_streaming() failureLinux
- CVE-2026-68215media: radio-si476x: Unregister v4l2_device on probe failureLinux
- CVE-2026-68214media: rtl2832: fix use-after-free in rtl2832_remove()Linux
- CVE-2026-68212media: saa7134: Fix a possible memory leak in saa7134_video_init1Linux
- CVE-2026-68211media: stm32-dcmipp: Return queued buffers on start_streaming() failureLinux
- CVE-2026-68208media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()Linux
- CVE-2026-68207media: ti: vpe: unwind v4l2 device registration on probe errorLinux
- CVE-2026-68205media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()Linux
- CVE-2026-68203media: vivid: fix cleanup bugs in vivid_init()Linux
- CVE-2026-68197wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-operLinux
- CVE-2026-68195wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio busesLinux
- CVE-2026-68194wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio busesLinux
- CVE-2026-68193wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio busesLinux
- CVE-2026-68191wifi: ath12k: fix NULL pointer dereference in rhash table destroyLinux
- CVE-2026-68190staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()Linux
- CVE-2026-68188Bluetooth: RFCOMM: Fix session UAF in set_termiosLinux
- CVE-2026-68187exec: fix unsigned loop counter wrap in transfer_args_to_stack()Linux
- CVE-2026-68186binfmt_misc: set have_execfd only once the interpreter is openedLinux
- CVE-2026-68185LoongArch: Move jump_label_init() before parse_early_param()Linux
- CVE-2026-68184cdrom: fix stack out-of-bounds read in CDROMVOLCTRLLinux
- CVE-2026-68183firmware: stratix10-svc: fix memory leaks and list corruption bugsLinux
- CVE-2026-68182comedi: comedi_parport: deal with premature interruptLinux
- CVE-2026-68181mei: bus: access mei_device under device_lock on cleanupLinux
- CVE-2026-68180intel_th: fix MSC output device reference leakLinux
- CVE-2026-68176tracing: Fix mmiotrace possible NULL dereferencing of hiter->devLinux
- CVE-2026-68175tracing: Fix resource leak on mmiotrace trace_pipe closeLinux
- CVE-2026-68174tracing: Fix union collision of module and refcnt for dynamic eventsLinux
- CVE-2026-68169mptcp: pm: userspace: fix use-after-free in get_local_idLinux
- CVE-2026-68168afs: Fix afs_edit_dir_remove() to get, not find, block 0Linux
- CVE-2026-68167btrfs: do not try compression for data reloc inodesLinux
- CVE-2026-68166userfaultfd: prevent registration of special VMAsLinux
- CVE-2026-68165mm/damon/core: validate ranges in damon_set_regions()Linux
- CVE-2026-68164mm/damon/core: disallow overlapping input ranges for damon_set_regions()Linux
- CVE-2026-68151binfmt_elf_fdpic: only honour the first PT_INTERPLinux
- CVE-2026-68150fs/super: fix emergency thaw double-unlock of s_umountLinux
- CVE-2026-68146ftrace: Add global mutex to serialize trace_parser accessLinux
- CVE-2026-72690Attendize Attendize - Cross-Tenant Authorization BypassAttendize
- CVE-2026-68139net/mlx5e: Use sender devcom for MPV master-upLinux
- CVE-2026-68135net: hip04: fix RX buffer leak on build_skb failureLinux
- CVE-2026-68133ice: fix PTP Call Trace during PTP releaseLinux
- CVE-2026-68132super: fix emergency thaw deadlock on frozen block devicesLinux
- CVE-2026-68130ksmbd: defer destroy_previous_session() until after NTLM authenticationLinux
- CVE-2026-68126mac802154: hold an interface reference across the scan workerLinux
- CVE-2026-68122ovpn: fix peer refcount leak in TCP error pathsLinux
- CVE-2026-68115drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68114drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68113drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68112drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68111drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68110drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68109drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()Linux
- CVE-2026-68105drm/amdgpu: Fix kernel panic during driver load failureLinux
- CVE-2026-68102drm/amdgpu: fix aperture mapping leakLinux
- CVE-2026-68099ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACLLinux
- CVE-2026-68095fuse-uring: fix race between registration and connection abortionLinux
- CVE-2026-68094sched_ext: Preserve rq tracking across local DSQ dispatchLinux
- CVE-2026-68093KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplugLinux
- CVE-2026-68092time/jiffies: Register jiffies clocksource before usageLinux
- CVE-2026-68090debugobjects: Plug race against a concurrent OOM disableLinux
- CVE-2026-68089iio: core: fix uninitialized data in debugfsLinux
- CVE-2026-68088usb: gadget: function: rndis: add length check to response queryLinux
- CVE-2026-68087HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()Linux
- CVE-2026-68086mm/khugepaged: write all dirty file folios when collapsingLinux
- CVE-2026-68084staging: vme_user: fix location monitor leak in tsi148 bridgeLinux
- CVE-2026-64941Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CRphoenixframework phoenix_live_view · phoenix_live_view
- CVE-2026-59088Gimp: gimp: denial of service via signed integer overflow in fli file processinggimp · Red Hat Enterprise Linux
- CVE-2026-72588bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recoverybluewave-labs Checkmate
- CVE-2026-72587Instatic - Cache Poisoning via Unauthenticated Server Island EndpointCoreBunch Instatic
- CVE-2026-72583fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Uploadfastschema
- CVE-2026-72576Bludit - Stored Cross-Site Scripting via Malicious SVG Logo UploadBludit
- CVE-2026-72574picocms Pico - Host Header Injection Enables Script Source Hijackingpicocms Pico
- CVE-2026-72570cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filenamecube-root directory-serve
- CVE-2026-66486Improper Output Encoding in GNU cpioGNU cpio
- CVE-2026-66485Uncontrolled Memory Allocation in GNU cpioGNU cpio
- CVE-2026-66484Path Traversal in GNU cpioGNU cpio
- CVE-2026-71394Heap Use of Uninitialized Memory in GNU Emacs for AndroidGNU Emacs
- CVE-2026-71393Heap Buffer Overflow in GNU Emacs for AndroidGNU Emacs
- CVE-2026-71392Integer Overflow in GNU Emacs for AndroidGNU Emacs
- CVE-2026-71391Off-by-One Error in GNU Emacs for AndroidGNU Emacs
- CVE-2026-65945Apache Ranger: Logs contain replayable JWT bearer tokensApache Software Foundation Apache Ranger
- CVE-2026-66642WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerabilityWP Umbrella
- CVE-2026-19404389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenanceRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-66411DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-66410Android and iOS apps ECOVACS PRO App improperly validate server certificates.ECOVACS ROBOTICS Android App "ECOVACS PRO" · ECOVACS ROBOTI…
- CVE-2026-66409DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-66408The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-66406DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-66404DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications.ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…
- CVE-2026-21084Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.Samsung Mobile SmartThings
- CVE-2026-21083Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.Samsung Mobile Smart Switch
- CVE-2026-21082Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.Samsung Mobile Samsung Health
- CVE-2026-21081Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access…Samsung Mobile SamsungPassAutofill
- CVE-2026-21080Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.Samsung Mobile Smart Switch
- CVE-2026-21078Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers…Samsung Mobile Smart Switch
- CVE-2026-21077Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.Samsung Mobile Samsung Health
- CVE-2026-21076Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.Samsung Mobile Samsung Health
- CVE-2026-21075Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive…Samsung Mobile My Galaxy
- CVE-2026-21073Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.Samsung Mobile Devices
- CVE-2026-21072Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21071Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds…Samsung Mobile Devices
- CVE-2026-21070Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.Samsung Mobile Devices
- CVE-2026-21069Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write…Samsung Mobile Devices
- CVE-2026-21067Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21066Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21065Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21063Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock…Samsung Mobile Devices
- CVE-2026-21062Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.Samsung Mobile Devices
- CVE-2026-21061Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions.Samsung Mobile Devices
- CVE-2026-21060Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple…Samsung Mobile Devices
- CVE-2026-21059Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete…Samsung Mobile Devices
- CVE-2026-21058Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts'…Samsung Mobile Devices
- CVE-2026-57279Cybozu Garoon contains a cross-site scripting vulnerability.Cybozu Garoon
- CVE-2026-12570Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keraskeras-team/keras · keras
- CVE-2026-19077Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level AuthorizationDuplicate Post
- CVE-2026-19075All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' ParameterAll-in-One Video Gallery
- CVE-2026-19074Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field DisclosureAdvanced Classifieds & Directory Pro
- CVE-2026-18200FoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile UpdateFoodBoxBooker
- CVE-2026-15047s2Member < 260805 - Contributor+ Stored XSS via Shortcodes2Member
- CVE-2026-14238Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-reportvitepos
- CVE-2026-14211Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDORBooking for Appointments and Events Calendar
- CVE-2026-17023Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth CallbackSalon Booking System
- CVE-2026-17021Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total TamperingSalon Booking System
- CVE-2026-17020Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII DisclosureSalon Booking System
- CVE-2026-15229Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price ManipulationPinpoint Booking System
- CVE-2026-18960Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application PasswordsBlock User Account
- CVE-2026-18934RSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post DeletionRSS Aggregator by Feedzy
- CVE-2026-16949Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookupTerm Pages
- CVE-2026-15238Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDORMotoPress Hotel Booking
- CVE-2026-15237Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST EndpointMotoPress Hotel Booking
- CVE-2026-14941Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX ActionsCustomer Reviews for WooCommerce
- CVE-2026-14860Podcast Player < 8.3.1 - Unauthenticated Server-Side Request ForgeryPodcast Player
- CVE-2026-13701Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis SettingAdvanced Excerpt
- CVE-2026-12971LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_featureLearnPress
- CVE-2026-17018CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDORCubeWP Framework
- CVE-2026-17010Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post MetaSaitama Addon Pack
- CVE-2026-17016Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT UnderpaymentAccept PayPal & Stripe with Subscriptions for WooCommerce
- CVE-2026-17012Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_emailAccept PayPal & Stripe with Subscriptions for WooCommerce
- CVE-2026-18666Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter ValueLibrary Management System
- CVE-2026-17019JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)JetEngine
- CVE-2026-72522libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates…libexpat project libexpat
- CVE-2026-19384SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injectionSourceCodester Simple Doctors Appointment System
- CVE-2026-19383saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted uploadsaithink SaiAdmin · saigroup SaiAdmin
- CVE-2026-19382Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leakAlmico Speedfan
- CVE-2026-19380Mullvad wireguard.sys IOCTL AdapterState reference countMullvad wireguard.sys
- CVE-2026-19379EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injectionEFM ipTIME AX8004M