CVEs published August 13, 2026
606 CVEs were published on August 13, 2026: 76 critical, 270 high. 1 is now in CISA KEV.
- Published
- 606
- Critical
- 76
- High
- 270
- Medium
- 238
- Low
- 22
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 352
Most affected products
- IBM i
- 62
- RsyncProject rsync
- 33
- Elastic Kibana
- 30
- PostgreSQL
- 28
- Gitea Open Source Git Server · gitea.dev +1
- 21
- Elasticsearch
- 14
- Gitea Open Source Git Server · code.gitea.io/gitea +1
- 13
- Portal Generator addon to Priority ERP
- 8
- Gitea Open Source Git Server · gitea.dev
- 7
- gitpython-developers GitPython · gitpython
- 7
Critical 76
- CVE-2026-73302Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiedbudibase · @budibase/server
- CVE-2026-73421NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)nextauthjs next-auth · next-auth
- CVE-2026-73420NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassnextauthjs next-auth · @auth core +2
- CVE-2026-73843OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsopenchoreo · github.com/openchoreo/openchoreo
- CVE-2026-73842OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and…openchoreo · github.com/openchoreo/openchoreo
- CVE-2026-72851Budibase before 3.40.0 SQL Injection via Unauthenticated Webhookbudibase server
- CVE-2026-72850Budibase before 3.40.0 Arbitrary File Write via Path Traversalbudibase server
- CVE-2026-72842OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypassopenwrt luci
- CVE-2026-72841luci-app-openvpn Path Traversal RCE via instance_name2openwrt luci
- CVE-2026-72839filebrowser through 2.63.16 Privilege Escalation via Signupfilebrowser
- CVE-2026-73665FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injectionFreePBX ucp
- CVE-2026-19750Tenda CH/CP/TX3 SSH hard-coded passwordTenda CH · Tenda CP +1
- CVE-2026-73663FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeoverFreePBX missedcall
- CVE-2026-72776AgenticSeek Unauthenticated RCE via /query API EndpointFosowl AgenticSeek
- CVE-2026-19297Insufficient Authentication Brute Force Protection on Login EndpointIBM Langflow OSS
- CVE-2026-17482IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionIBM Documentation Offline
- CVE-2026-8715Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPathHashiCorp Tooling
- CVE-2026-73656Trigger.dev: Cross-project deployment worker registration can modify another project's deployment statetriggerdotdev trigger.dev
- CVE-2026-19747Tenda CH7 ATE Module Kylin HandleCmd command injectionTenda CH7 · Tenda CH7G +7
- CVE-2026-14525IBM WebSphere Application Server Liberty is affected by an authenication bypassIBM WebSphere Application Server - Liberty
- CVE-2026-73653Vitest: Browser Mode provider commands bypass the file-access permission gatevitest-dev vitest · @vitest/browser
- CVE-2026-73649Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)shepherdwind velocity.js · velocityjs
- CVE-2026-73644OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI…OpenIdentityPlatform OpenDJ · org.openidentityplatform.open…
- CVE-2026-73567sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clockJuneAndGreen sm-crypto · sm-crypto
- CVE-2026-67614CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminalusmannasir cyberpanel
Show all 76 entriesShow fewer entries
- CVE-2026-58508Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)Gitea Open Source Git Server
- CVE-2026-58443Public-only repository tokens can update private PR head branchesGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58433Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization settingGitea Open Source Git Server
- CVE-2026-56750Gitea Remember-Me Token Theft Not Invalidating Attacker SessionGitea Open Source Git Server · gitea.dev +1
- CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in APIGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-56443Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118Gitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-55982OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-13051Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource…Form-Processor
- CVE-2022-4993HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions…HTML-FormHandler
- CVE-2026-73532Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin BuildWPManageNinja Fluent Forms Pro
- CVE-2026-73533Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin BuildWPManageNinja Ninja Tables Pro
- CVE-2026-70452rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution FailureRsyncProject rsync
- CVE-2026-70460rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir SymlinkRsyncProject rsync
- CVE-2026-53793rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot ModeRsyncProject rsync
- CVE-2026-53791rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol HeaderRsyncProject rsync
- CVE-2026-53790rsync < 3.5.0 Command Injection via Multiple Code PathsRsyncProject rsync
- CVE-2026-66691WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerabilityscriptsbundle Nokri
- CVE-2026-66478WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerabilityandy_moyle Church Admin
- CVE-2026-66472WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerabilityeverestthemes Everest Backup
- CVE-2026-66465WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerabilityAgniHD Cartify
- CVE-2026-66458WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerabilityThimPress RealPress
- CVE-2026-66453WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerabilityDimitri Grassi Salon booking system
- CVE-2026-66446WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerabilityIf-So Dynamic Content Personalization
- CVE-2026-66436WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerabilityRealMag777 Active Products Tables for WooCommerce
- CVE-2026-66424WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-61969WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerabilityWebilia Listdom
- CVE-2026-61967WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerabilityminiorange otp verification
- CVE-2026-61966WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerabilitydenishua WPJAM Basic
- CVE-2026-61962WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerabilityHakan Ozevin WP BASE Booking
- CVE-2026-28185WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerabilityrtCamp Log in with Google
- CVE-2026-28149WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerabilityminiOrange Headless Single Sign On
- CVE-2026-28148WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerabilityminiOrange Headless Single Sign On
- CVE-2026-28142WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerabilityShamalli Web Directory Free
- CVE-2026-28008WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerabilityminiOrange OAuth Single Sign On – SSO
- CVE-2026-28001WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityWPDirectoryKit WP Directory Kit
- CVE-2026-27544WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerabilityQuarkA QA Analytics
- CVE-2026-49827WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)SMEWebify WebErpMesv2
- CVE-2026-73608SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTargetsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73602Flowise before 3.1.3 Sandbox Escape to RCEFlowiseAI Flowise
- CVE-2026-73601Flowise before 3.1.3 Remote Code Execution via Custom MCPFlowiseAI Flowise
- CVE-2026-73487Flowise before 3.1.3 Prompt Injection RCE via CSV AgentFlowiseAI Flowise · flowise +1
- CVE-2026-73486Flowise before 3.1.3 Code Injection via CSV Agent customReadCSVFlowiseAI Flowise
- CVE-2026-73485Flowise before 3.1.3 Remote Code Execution via Airtable AgentFlowiseAI Flowise
- CVE-2026-73483Flowise before 3.1.3 Sandbox Escape via PuppeteerFlowiseAI Flowise · flowise +1
- CVE-2026-59507Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper…Portal Generator addon to Priority ERP
- CVE-2026-59506Priority – CWE-306: Missing Authentication for Critical FunctionPortal Generator addon to Priority ERP
- CVE-2026-59504Priority – CWE-602: Client-Side Enforcement of Server-Side SecurityPortal Generator addon to Priority ERP
- CVE-2026-59503Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an…Portal Generator addon to Priority ERP
- CVE-2026-59500Priority - CWE-287: Improper AuthenticationPortal Generator addon to Priority ERP
- CVE-2026-15413Link Factory - BackdoorLink Factory
- CVE-2026-14182Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication BypassCustomer Email Verification for WooCommerce
High 270
- CVE-2026-73305Budibase: Privilege escalation via public role assignment API missing app-level authorizationbudibase · @budibase/server
- CVE-2026-73408Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connectorbudibase · @budibase/server
- CVE-2026-73417JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)jupyterlab
- CVE-2026-56864Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbGo toolchain cmd/go · golang.org/x/mod/sumdb +2
- CVE-2026-56865Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogGo toolchain cmd/go · golang.org/x/mod/sumdb/tlog +2
- CVE-2026-56862Limit handshake messages we are willing to accept post-handshake in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2026-56853Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpGo standard library net/http · stdlib
- CVE-2026-56859Add recursion depth guard during decode in encoding/xmlGo standard library encoding/xml · stdlib
- CVE-2026-33818Enforce maximum recursion depth in encoding/asn1Go standard library encoding/asn1
- CVE-2026-73841OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsopenchoreo · github.com/openchoreo/openchoreo
- CVE-2026-72857Budibase before 3.40.0 Credential Exposure via STRING Fieldsbudibase
- CVE-2026-72856Budibase before 3.40.0 Authentication Bypass via Tenant Owner Emailbudibase
- CVE-2026-72855Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RESTbudibase server · @budibase/server
- CVE-2026-72853Budibase before 3.40.0 SQL Injection via Oracle connectorbudibase
- CVE-2026-72849Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRFbudibase server · @budibase/server
- CVE-2026-72840OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Writeopenwrt luci
- CVE-2026-73667OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged podsopenchoreo · github.com/openchoreo/openchoreo
- CVE-2026-73666OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated…openchoreo backstage-plugins
- CVE-2026-73664FreePBX: Authenticated Arbitrary SSH Key Injection via Backup ModuleFreePBX backup
- CVE-2026-73662Authenticated FreePBX Music RCE via mpg123 and Asterisk Call FilesFreePBX music
- CVE-2026-73661FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted BackupFreePBX framework
- CVE-2026-73660FreePBX: Authenticated TTS AGI Command Injection Through TTS NameFreePBX tts
- CVE-2026-73659Trigger.dev: Cross-tenant object read/write via path traversal in packet presign APItriggerdotdev trigger.dev
- CVE-2026-73658Trigger.dev: Cross-tenant object store read and write via URL path traversaltriggerdotdev trigger.dev
- CVE-2026-19483The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or…IBM Storage Scale
Show all 270 entriesShow fewer entries
- CVE-2026-18511IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets ExtensionIBM i
- CVE-2026-18509IBM i is Affected By A Prvilege Escalation Vulnerability []IBM i
- CVE-2026-18249IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java RuntimeIBM i
- CVE-2026-18193IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java RuntimeIBM i
- CVE-2026-18101IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyIBM i
- CVE-2026-18077IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer ProtocolIBM i
- CVE-2026-17502IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-17481IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionIBM Documentation Offline
- CVE-2026-17473IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionIBM Documentation Offline
- CVE-2026-17272IBM i is Affected By a Denial of Service in HTTP Server []IBM i
- CVE-2026-17101IBM i is Affected By Multiple Vulnerabilities in Navigator for iIBM i
- CVE-2026-17099IBM i is Affected By Multiple Vulnerabilities in Navigator for iIBM i
- CVE-2026-17069IBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerIBM i
- CVE-2026-17045IBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerIBM i
- CVE-2026-17029IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets ExtensionIBM i
- CVE-2026-16987IBM i is Affected By An Improper Validation Vulnerability in PASE []IBM i
- CVE-2026-16975IBM i is Affected By A Remote Code Execution Vulnerability []IBM i
- CVE-2026-73655Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Logintriggerdotdev trigger.dev
- CVE-2026-16967IBM i is Affected By Multiple SQL Vulnerabilities [, ]IBM i
- CVE-2026-16961IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []IBM i
- CVE-2026-16908IBM i is Affected By Multiple SQL Vulnerabilities [, ]IBM i
- CVE-2026-16898IBM i is Affected By Multiple Vulnerabilities in Network Authentication ServiceIBM i
- CVE-2026-16896IBM i is Affected By Multiple Vulnerabilities in Network Authentication ServiceIBM i
- CVE-2026-16887IBM i is Affected By A Denial of Service Vulnerability DST/SST []IBM i
- CVE-2026-16868IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16867IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16815IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer ProtocolIBM i
- CVE-2026-16722IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []IBM i
- CVE-2026-16674IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyIBM i
- CVE-2026-14875IBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesIBM i Access Client Solutions
- CVE-2026-13460The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or…IBM Storage Scale
- CVE-2026-13365IBM Planning Analytics Local is affected by security vulnerabilitiesIBM Planning Analytics
- CVE-2026-73654Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoStriggerdotdev trigger.dev · @trigger.dev/core
- CVE-2026-45725compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversaloscal-compass compliance-trestle · compliance-trestle
- CVE-2026-48099WsgiDAV encoded dot segments can escape filesystem share rootsmar10 wsgidav · wsgidav
- CVE-2026-72632Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API KeysElastic Kibana
- CVE-2026-72630Incorrect Authorization in Kibana Fleet Leading to Privilege EscalationElastic Kibana
- CVE-2026-72629Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained ModelsElastic Kibana
- CVE-2026-72643Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private AgentsElastic Kibana
- CVE-2026-72642Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference ProcessElasticsearch
- CVE-2026-18164Flow Neuroscience FL-100 Use of Hard-coded CredentialsFlow Neuroscience FL-100 · Halo Neuroscience FL-100
- CVE-2026-72658Cross-Site Request Forgery in Kibana Leading to Privilege EscalationElastic Kibana
- CVE-2026-72665Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response ActionsElastic Kibana
- CVE-2026-72677Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other ResourcesElastic Kibana
- CVE-2026-72675Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data ModificationElastic Kibana
- CVE-2026-72672Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event DataElastic Kibana
- CVE-2026-72670Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy CredentialsElastic Kibana
- CVE-2026-72669Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data TamperingElastic Kibana
- CVE-2026-59714Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)open-webui
- CVE-2026-49864wetty vulnerable to DOM XSS via file-download filenamebutlerx wetty · wetty
- CVE-2026-18846IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17223IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17206IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17004IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17199IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17229IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-16982IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17220IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-17197IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-73482phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.phpphplist3
- CVE-2026-18071IBM i is Affected By An Improper Management Vulnerability in HTTP Server []IBM i
- CVE-2026-72777Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-urlDayuanJiang next-ai-draw-io
- CVE-2026-73652vantage6: Algorithm developer can edit another developer's algorithm that is pending / under reviewvantage6
- CVE-2026-73650SVGO: removeScripts plugin leaves some executable scripts intactsvgo
- CVE-2026-72741Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Accessgoodrain rainbond
- CVE-2026-73643js-yaml: Exponential parsing time in the flow collections leads to denial of servicenodeca js-yaml · js-yaml
- CVE-2026-73569fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsNaturalIntelligence fast-xml-parser · fast-xml-parser
- CVE-2026-73568py-libp2p: yamux connection DoS via oversized data framepy-libp2p · libp2p
- CVE-2026-73566node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionisaacs node-tar · tar
- CVE-2026-73564frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflowfatedier frp · github.com/fatedier/frp
- CVE-2026-18428SQL Query Validation Bypass in OpenSearch Direct QueryAWS Opensearch · Github Opensearch
- CVE-2026-73561Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustionanephenix hub · @anephenix/hub
- CVE-2019-25765ASP-CMS SQL Injection via commentList.asp id ParameterASP-CMS Project ASP-CMS
- CVE-2024-58374Hongjing e-HR Unauthenticated SQL Injection via getSdutyTreeHongjing Century e-HR
- CVE-2026-24791Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-59765SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud MetadataGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58439Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2026-58438Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessGitea Open Source Git Server · gitea.dev
- CVE-2026-58437Repository Visibility Manipulation via Git Push OptionsGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58436ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58434Private Repository Metadata Remains Accessible After Access RevocationGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58427Private org member list leaked via /members API endpoint — incomplete fix for PR #38145Gitea Open Source Git Server · gitea.dev
- CVE-2026-58417REST API exposes organization membership of private organizations to publicGitea Open Source Git Server · gitea.dev
- CVE-2026-58416Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)Gitea Open Source Git Server · gitea.dev
- CVE-2026-58314Two SSRF findings in Gitea 1.26.2Gitea Open Source Git Server · gitea.dev +1
- CVE-2026-57894Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationGitea Open Source Git Server · gitea.dev +1
- CVE-2026-55987OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)Gitea Open Source Git Server · gitea.dev +1
- CVE-2026-54481Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)Gitea Open Source Git Server · gitea.dev +1
- CVE-2026-59109Zalktis: SQL injection via partner-controlled fields in imported e-invoicesZalktis Programmas (SIA "Zalktis Programmas") Zalktis
- CVE-2026-73266Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset joinRed Hat multicluster engine for Kubernetes
- CVE-2026-13048Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because…Data-MuForm
- CVE-2026-55402CVE-2026-55402 is an out of bounds read vulnerability in Secure Access servers prior to version 14.57.Absolute Security Secure Access
- CVE-2026-73515PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf BufferPostGIS
- CVE-2026-73514PostGIS address_standardizer Out-of-Bounds Write via standardize_address()PostGIS address_standardizer
- CVE-2026-73670CMS Admin SQL Injection via db_data.php table_name ParameterSaurus CMS Community Edition
- CVE-2026-73570A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installedZimbra Collaboration
- CVE-2026-15994During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial…Lenovo Commercial Vantage · Lenovo Vantage
- CVE-2026-63423During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise…Lenovo Accessories and Display Manager
- CVE-2026-63424During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local…Lenovo Dock Manager
- CVE-2026-63425During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could…Lenovo Dock Manager
- CVE-2026-6387A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to…Lenovo System Update
- CVE-2026-49857auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopbackymw0407 auth-fetch-mcp · auth-fetch-mcp
- CVE-2026-70453rsync < 3.5.0 Algorithmic Complexity DoS via hash_search()RsyncProject rsync
- CVE-2026-70454rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL ModeRsyncProject rsync
- CVE-2026-70455rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread ExhaustionRsyncProject rsync
- CVE-2026-70456rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args()RsyncProject rsync
- CVE-2026-70457rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()RsyncProject rsync
- CVE-2026-70458rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED HandlingRsyncProject rsync
- CVE-2026-70461rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from EntryRsyncProject rsync
- CVE-2026-70462rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUTRsyncProject rsync
- CVE-2026-70463rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive ParsingRsyncProject rsync
- CVE-2026-70464rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake StallRsyncProject rsync
- CVE-2026-53801rsync < 3.5.0 Symlink Race Condition Directory TraversalRsyncProject rsync
- CVE-2026-53799rsync < 3.5.0 Symlink Race Condition via ACL/xattr ApplicationRsyncProject rsync
- CVE-2026-53795rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-destRsyncProject rsync
- CVE-2026-53792rsync < 3.5.0 Out-of-Bounds Read via Zero-Length Checksum BlockRsyncProject rsync
- CVE-2026-53789rsync < 3.5.0 Arbitrary File Deletion via Malicious File ListRsyncProject rsync
- CVE-2026-53784rsync < 3.5.0 Path Traversal via Symlink Module RootRsyncProject rsync
- CVE-2026-53783rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsyncRsyncProject rsync
- CVE-2026-53803rsync < 3.5.0 Symlink Following Arbitrary File OverwriteRsyncProject rsync
- CVE-2026-53802rsync < 3.5.0 Arbitrary File Read via Symlink FollowingRsyncProject rsync
- CVE-2026-73509OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversalOpenListTeam OpenList · github.com/OpenListTeam/OpenList… +2
- CVE-2026-28154WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerabilitysnstheme Samex - Clean, Minimal Shop WooCommerce WordPress…
- CVE-2026-73507Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustionnetty · io.netty:netty-codec-xml
- CVE-2026-65935Bypassing passkey entry in legacy pairingsilabs.com WiseConnect
- CVE-2026-65934BT122 plaintext pause encryption request causes DOSsilabs.com BT122
- CVE-2026-73505Oh My Posh: Arbitrary command execution via template injection in the path segmentJanDeDobbeleer oh-my-posh · github.com/jandedobbeleer/oh-my…
- CVE-2026-19293SMP security requestsilabs.com WiseConnect
- CVE-2026-19292Bluetooth re-pairing with legitimate device can use lower security levelsilabs.com WiseConnect
- CVE-2026-19291Bluetooth re-pairing can use a lower security level than previoussilabs.com WiseConnect
- CVE-2026-16101forced re-pairing with already bonded devicesilabs.com WiseConnect
- CVE-2026-19734IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijackingRoskus Prospero Flow CRM
- CVE-2026-68454KVM: s390: pci: Fix handling of AIF enable without AISBLinux
- CVE-2026-68453s390/zcrypt: Fix buffer over-read in cca_cipher2protkeyLinux
- CVE-2026-68452s390/zcrypt: Validate length for CCA AES cipher key requestsLinux
- CVE-2026-68451s390/zcrypt: Validate length for CCA ECC private key requestsLinux
- CVE-2026-14456Unbounded Memory Growth in QUIC Server Incoming Channel QueueOpenSSL
- CVE-2026-66256Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)Apache Software Foundation org.apache.shindig:shindig-commo…
- CVE-2026-28002WordPress Booktics plugin 1.0.22 - SQL Injection vulnerabilityArraytics Booktics
- CVE-2026-73346WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerabilityMailChimp For WooCommerce
- CVE-2026-66704WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerabilityJegstudio Gutenverse Companion
- CVE-2026-66700WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityZAYTECH Smart Online Order for Clover
- CVE-2026-66698WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force SureDash
- CVE-2026-66697WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerabilityColissimo Officiel : Méthodes de livraison pour WooCommerce
- CVE-2026-66661WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerabilityOnokazu Directories Pro
- CVE-2026-66658WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerabilityMVPThemes Reviewer
- CVE-2026-66657WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerabilityMikado-Themes Biagiotti Core
- CVE-2026-66656WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerabilityMikado-Themes Foton Core
- CVE-2026-66655WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerabilityMultiParcels Shipping For WooCommerce
- CVE-2026-66653WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerabilityEdge-Themes Barista
- CVE-2026-66469WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerabilityAfonso Matos Arvow AI SEO Writer
- CVE-2026-66468WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilitypowerfulwp Local Delivery Drivers for WooCommerce
- CVE-2026-66466WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1…weDevs StoreGrowth: Smart Sales Booster for WooCommerce | B…
- CVE-2026-66463WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerabilityHassan Fakih iCARRY
- CVE-2026-66462WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerabilityBookingWP WooCommerce Appointments
- CVE-2026-66461WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerabilitySMEPay: UPI Gateway for WooCommerce
- CVE-2026-66450WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-66449WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-66443WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerabilityPete Nelson REST API Log
- CVE-2026-66441WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerabilityMultiVendorX
- CVE-2026-66432WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerabilitydenishua WPJAM Basic
- CVE-2026-66431WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerabilityWoompaLoompa Bitcoin Lightning Payment Gateway for WooComme…
- CVE-2026-66430WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerabilityCODEPRESS Visitor Traffic Real Time Statistics Pro
- CVE-2026-66429WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting (XSS) vulnerabilityCODEPRESS Visitor Traffic Real Time Statistics Pro
- CVE-2026-66426WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerabilityLester Chan WP-Stats
- CVE-2026-65582WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerabilityLiquidThemes AI Hub
- CVE-2026-65580WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybracketweb Agrion
- CVE-2026-61984WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerabilityAmauri WPMobile.App
- CVE-2026-61980WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerabilityDaan.dev OMGF Pro
- CVE-2026-61979WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerabilityminiOrange SAML SP Single Sign On
- CVE-2026-61974WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityKitae Park Mang Board WP
- CVE-2026-61965WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityahmadgb GeekyBot
- CVE-2026-61960WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerabilityThemeisle WP Full Stripe Free
- CVE-2026-28189WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerabilityRoland Barker Participants Database
- CVE-2026-28188WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerabilitythemefic Hydra Booking
- CVE-2026-28187WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerabilityechoplugins Knowledge Base for Documentation, FAQs with AI…
- CVE-2026-28186WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerabilitythemefic Travelfic Toolkit
- CVE-2026-28176WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerabilityBooking Activities Team Booking Activities
- CVE-2026-28175WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerabilitywp-buy Visitors Traffic Real Time Statistics
- CVE-2026-28173WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerabilityArraytics WP Event SOlution
- CVE-2026-28170WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability1meril Blog Floating Button
- CVE-2026-28168WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerabilityImran Tauqeer CubeWP
- CVE-2026-28161WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerabilityAonetheme Service Finder Booking
- CVE-2026-28158WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerabilityLasso Analytics Do Lasso
- CVE-2026-28157WordPress Do Lasso plugin <= 358 - Path Traversal vulnerabilityLasso Analytics Do Lasso
- CVE-2026-28156WordPress Do Lasso plugin <= 358 - SQL Injection vulnerabilityLasso Analytics Do Lasso
- CVE-2026-28004WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerabilityStrategy11 Team Business Directory
- CVE-2026-28003WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerabilityyonifre Maspik – Spam blacklist
- CVE-2026-27543WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerabilityFluxBuilder MStore API
- CVE-2026-27539WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerabilityWelcart e-Commerce
- CVE-2026-27538WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityWPDirectoryKit WP Directory Kit
- CVE-2026-27536WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerabilityPluginOps MailChimp Subscribe Forms
- CVE-2026-27535WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerabilitysolacewp Solace Extra
- CVE-2026-27380WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerabilitymagepeopleteam Car Rental Manager
- CVE-2026-27345WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerabilitymagepeopleteam Taxi Booking Manager for WooCommerce
- CVE-2026-48702Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logicsigstore rekor · github.com/sigstore/rekor
- CVE-2026-49478Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account…sigstore fulcio · github.com/sigstore/fulcio
- CVE-2026-14671PostgreSQL refint plan cache type confusion executes arbitrary codePostgreSQL
- CVE-2026-6471PostgreSQL logical decoding can dlopen arbitrary filePostgreSQL
- CVE-2026-6464PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commandsPostgreSQL
- CVE-2026-19385PostgreSQL pg_dump heap buffer overflow executes arbitrary codePostgreSQL
- CVE-2026-18408PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql clientPostgreSQL
- CVE-2026-16239PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary codePostgreSQL
- CVE-2026-16238PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary codePostgreSQL
- CVE-2026-15742PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparoundPostgreSQL
- CVE-2026-15741PostgreSQL expression deparse allows SQL injection via EXTRACT argumentPostgreSQL
- CVE-2026-14680PostgreSQL type confusion via "internal" argumentsPostgreSQL
- CVE-2026-14679PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memoryPostgreSQL
- CVE-2026-14677PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparoundPostgreSQL
- CVE-2026-14676PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary codePostgreSQL
- CVE-2026-14670PostgreSQL plperl tied object heap buffer overflow executes arbitrary codePostgreSQL
- CVE-2026-14669PostgreSQL to_char heap buffer overflow executes arbitrary codePostgreSQL
- CVE-2026-14668PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary readPostgreSQL
- CVE-2026-14664PostgreSQL regexp heap buffer overflow executes arbitrary codePostgreSQL
- CVE-2026-14662PostgreSQL tsvector and tsquery undersize allocations, via integer wraparoundPostgreSQL
- CVE-2026-73629Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addressess9y Serendipity
- CVE-2026-73626JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManagerjupyterlab
- CVE-2026-73625GitPython before 3.1.54 Remote Code Execution via kwarg value smugglinggitpython-developers GitPython · gitpython
- CVE-2026-73624GitPython before 3.1.54 Arbitrary File Overwrite via diffgitpython-developers GitPython · gitpython
- CVE-2026-73623GitPython before 3.1.54 Remote Code Execution via --templategitpython-developers GitPython · gitpython
- CVE-2026-73622GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()gitpython-developers GitPython · gitpython
- CVE-2026-73620GitPython before 3.1.57 Arbitrary File Overwrite and Readgitpython-developers GitPython · gitpython
- CVE-2026-73619GitPython before 3.1.57 Arbitrary File Read via Repo.archive()gitpython-developers GitPython · gitpython
- CVE-2026-73618Budibase Server before 3.40.0 NoSQL Injection via JSON Parameterbudibase server · @budibase/server
- CVE-2026-73617Budibase before 3.40.0 NoSQL Injection via MongoDB datasourcebudibase server · @budibase/server
- CVE-2026-73616OpenRemote Notification Delete Cross-Realm Insecure Direct Object Referenceopenremote
- CVE-2026-73615Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchJovancoding Network-AI
- CVE-2026-73614Network-AI ClaudeHookBridge Deny Pattern Bypass via TruncationJovancoding Network-AI
- CVE-2026-73613filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlinkfilebrowser
- CVE-2026-73612File Browser before v2.63.22 Authorization Bypass via Recursive Operationsfilebrowser
- CVE-2026-73611File Browser 2.50.0 through 2.63.21 JWT Expiration Bypassfilebrowser
- CVE-2026-73604Flowise before 3.1.3 Credential Exposure via APIFlowiseAI Flowise · flowise
- CVE-2026-73484Flowise before 3.1.3 Sandbox Escape via Pandas MethodsFlowiseAI Flowise
- CVE-2026-12263Authentication BypassZohocorp ManageEngine Password Manager Pro · Zohocorp Manag…
- CVE-2026-59505Priority - CWE-284: Improper Access ControlPortal Generator addon to Priority ERP
- CVE-2026-59501Priority – CWE-284: Improper Access ControlPortal Generator addon to Priority ERP
- CVE-2026-59499Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorPortal Generator addon to Priority ERP (developed by Soft S…
- CVE-2026-19484@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary@fastify/busboy
- CVE-2026-19481@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header@fastify/busboy
- CVE-2026-11840SQL InjectionZohocorp ManageEngine Password Manager Pro · Zohocorp Manag…
- CVE-2026-18146Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Valueswpmanageninja Fluent Forms – Customizable Contact Forms, Su…
- CVE-2026-18945WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key ValidationWP Helper Premium
- CVE-2026-13610KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via RegistrationKiviCare
- CVE-2026-67986amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in…
- CVE-2026-67991crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service…
Medium, low and unrated 260
- CVE-2026-19761DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversalDTStack Taier
- CVE-2026-19758dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversaldromara lamp-cloud
- CVE-2026-19757Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversalDromara lamp-cloud
- CVE-2026-19756Dromara lamp-cloud Code Generator DefGenProjectController.java path traversalDromara lamp-cloud
- CVE-2026-19753Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgeryModel Context Protocol mcp-rdf-explorer
- CVE-2026-73304Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Usersbudibase · @budibase/server
- CVE-2026-73489Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsEugeny russh · russh
- CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypassjupyterlab
- CVE-2026-73428Trix: Stored XSS via HTMLParser attribute injection on pastebasecamp trix · trix +1
- CVE-2026-19752EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgeryEnzoVezzaro mcp-dominican-layer
- CVE-2026-56860Avoid quadratic complexity in resolvePath in net/urlGo standard library net/url · stdlib
- CVE-2026-56858Fix Javascript regexp context tracking in html/templateGo standard library html/template · stdlib
- CVE-2026-73840OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)openchoreo · github.com/openchoreo/openchoreo
- CVE-2026-19751EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgeryEnzoVezzaro mcp-dominican-layer
- CVE-2026-73039streama Insecure Direct Object Reference via ViewingStatusControllerstreamaserver streama
- CVE-2026-73479dua-cli Terminal Escape Sequence Injection via Marked PathsByron dua-cli
- CVE-2026-73657Trigger.dev: Cross-tenant payload poisoning via packet write + replaytriggerdotdev trigger.dev
- CVE-2026-73480gdu Terminal Injection via Unstripped Escape Sequencesdundee gdu
- CVE-2026-18715IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyIBM i
- CVE-2026-18671IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-19749Tenda CH7 RTSP/ONVIF missing authenticationTenda CH7 · Tenda CH7G +7
- CVE-2026-18741Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description FieldsFroiden Worksuite SaaS
- CVE-2026-18086IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets ExtensionIBM i
- CVE-2026-18068IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets ExtensionIBM i
- CVE-2026-18020IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
Show all 260 entriesShow fewer entries
- CVE-2026-17649IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-17476IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java RuntimeIBM i
- CVE-2026-17438IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP []IBM i
- CVE-2026-17468IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionIBM Documentation Offline
- CVE-2026-17075IBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerIBM i
- CVE-2026-17226IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-17216IBM i is Affected By Multiple Vulnerabilities in DRDA / DDMIBM i
- CVE-2026-17212IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-17088IBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerIBM i
- CVE-2026-17078IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM []IBM i
- CVE-2026-17077IBM i is Affected By Multiple Vulnerabilities in DRDA / DDMIBM i
- CVE-2026-17076IBM i is Affected By Multiple Vulnerabilities in DRDA / DDMIBM i
- CVE-2026-17074IBM i is Affected By Multiple Vulnerabilities in DRDA / DDMIBM i
- CVE-2026-17071IBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerIBM i
- CVE-2026-19748Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyTenda CH7 · Tenda CH7G +7
- CVE-2026-17043IBM i is Affected By Multiple Vulnerabilities in Digital Certificate ManagerIBM i
- CVE-2026-16878IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16871IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16861IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16859IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16853IBM i is Affected By Multiple Vulnerabilities in NetServerIBM i
- CVE-2026-16713IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code executionIBM Documentation Offline
- CVE-2026-16692IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer ProtocolIBM i
- CVE-2026-10571IBM WebSphere Application Server Liberty is affected by a denial of serviceIBM WebSphere Application Server - Liberty
- CVE-2026-45774compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversaloscal-compass compliance-trestle · compliance-trestle
- CVE-2026-19746Calix GigaSpire traceroute.cmd denial of serviceCalix GigaSpire
- CVE-2026-49096Uncaught Exception in Kibana Cases Leading to Denial of ServiceElastic Kibana
- CVE-2026-72636Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of ServiceElasticsearch
- CVE-2026-72631Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API KeysElastic Kibana
- CVE-2026-72640Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret DisclosureElastic Eck Operator
- CVE-2026-72639Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of ServiceElasticsearch
- CVE-2026-72638Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72647Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72645Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72648Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information DisclosureElastic Eck Operator
- CVE-2026-72657Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information DisclosureElastic Fleet Server
- CVE-2026-72656Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72655Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data ModificationElastic Kibana
- CVE-2026-72653Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72651Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72650Authorization Bypass Through User-Controlled Key in Kibana Leading to Information DisclosureElastic Kibana
- CVE-2026-72663Inefficient Algorithmic Complexity in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72661Missing Authorization in Kibana Leading to Information DisclosureElastic Kibana
- CVE-2026-72660Uncaught Exception in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72659Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72667Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72666Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed HostsElastic Kibana
- CVE-2026-72664Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response ActionsElastic Kibana
- CVE-2026-72676Improper Control of Generation of Code in Fleet Server Leading to Code InjectionElastic Fleet Server
- CVE-2026-72674Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-72673Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private LocationsElastic Kibana
- CVE-2026-72671Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space AssignmentsElastic Kibana
- CVE-2026-72681Missing Authorization in Kibana Leading to Privilege Escalation and Information DisclosureElastic Kibana
- CVE-2026-72680Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data ModificationElastic Kibana
- CVE-2026-72679Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72678Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72687Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72686Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72685Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72684Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-72683Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-49089Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-73531django-helpdesk < 2.3.3 Stored XSS via HTML Attachmentsdjango-helpdesk
- CVE-2026-73530Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()flytohub flyto-core
- CVE-2026-19745Calix GigaSpire Web Management utilities_configurationsave.cgi denial of serviceCalix GigaSpire
- CVE-2026-73669Signify Philips Hue Bridge Pro MQTT broker missing authenticationSignify Philips Hue Bridge Pro
- CVE-2026-16929IBM i is Affected By Multiple Vulnerabilities in Host ServersIBM i
- CVE-2026-73481phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rulesphplist3
- CVE-2026-73038NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.nameNodeBB
- CVE-2026-73037Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameterDayuanJiang next-ai-draw-io
- CVE-2026-73651TypeORM: migration:generate template-literal code injectiontypeorm
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurationsrails-html-sanitizer
- CVE-2026-73647Quasar Framework: Prototype pollution in Quasar extend() utilityquasarframework quasar · quasar
- CVE-2026-73645OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in…openzeppelin-confidential-contracts · @openzeppelin/confide…
- CVE-2026-19730Podman: podman: quadlet install --replace non-truncating write retains removed host-access directivesRed Hat Enterprise Linux · Red Hat Ansible Automation P… +10
- CVE-2026-73565@hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshakehonojs node-server · @hono/node-server
- CVE-2026-73563Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`backstage · @backstage/plugin-auth-backend
- CVE-2026-73562Mongoose: Prototype pollution in the update casting via proto-prefixed dotted path (Schema._getSchema/path getter)Automattic mongoose · mongoose
- CVE-2026-12236Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data lengthzephyrproject zephyr
- CVE-2026-67613CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReportusmannasir cyberpanel
- CVE-2026-24059Gitea runner registration-token GET endpoint performs a write under a read-only token scopeGitea Open Source Git Server
- CVE-2026-59763Unbounded Arch package file metadata can cause resource amplification in Gitea package uploadsGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58511Webhook Authorization Header Returned in Plaintext via APIGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58510GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58507Private Repository Existence Disclosure via go-get Meta EndpointGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58445Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58444Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contentsGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58442Repository migration SSRF via multi-answer DNS allow-list bypassGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58441SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURLGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-58440Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content…Gitea Open Source Git Server · gitea.dev
- CVE-2026-58435Gitea LFS Deploy-Key Privilege EscalationGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58432Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and…Gitea Open Source Git Server · gitea.dev +1
- CVE-2026-58431Public-only API token restriction is not enforced on team API routesGitea Open Source Git Server · gitea.dev
- CVE-2026-58429Public-Only Personal access tokens scope bypass in Organization and Permission EndpointsGitea Open Source Git Server · gitea.dev +1
- CVE-2026-58428Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)Gitea Open Source Git Server · gitea.dev +1
- CVE-2026-58425OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)Gitea Open Source Git Server · gitea.dev +1
- CVE-2026-58420Local File Inclusion via file:// URI in Migration RestoreGitea Open Source Git Server · gitea.dev
- CVE-2026-57897Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIsGitea Open Source Git Server · gitea.dev +1
- CVE-2026-57886Cross-repository issue/comment attachment re-linking can expose private attachment contentGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-56755Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadGitea Open Source Git Server · gitea.dev +1
- CVE-2026-56657Gitea SSH Key Parser Denial of ServiceGitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-55986Email Management API Bypasses ManageCredentials Feature RestrictionsGitea Open Source Git Server
- CVE-2026-55984Null Pointer Dereference in AddTime API Causes Authenticated Denial of ServiceGitea Open Source Git Server · gitea.dev +1
- CVE-2026-50105RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)Gitea Open Source Git Server · code.gitea.io/gitea +1
- CVE-2026-42931Denial of Service via Unbounded io.ReadAll in NPM Package Tag EndpointGitea Open Source Git Server · gitea.dev +1
- CVE-2026-23603Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimGitea Open Source Git Server · gitea.dev +1
- CVE-2026-55401CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57.Absolute Security Secure Access
- CVE-2026-55400CVE-2026-55400 is an integer underflow in Secure Access servers prior to version 14.57.Absolute Security Secure Access
- CVE-2026-73671Saurus CMS Unauthenticated Open Redirect via logout url parameterSaurus CMS Community Edition
- CVE-2026-19487Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick…perl
- CVE-2026-19744Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotesmaalfer Pentestify
- CVE-2026-73576In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration.Zimbra Collaboration
- CVE-2026-73575In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS)…Zimbra Collaboration
- CVE-2026-73574In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper…Zimbra Collaboration
- CVE-2026-73573In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality…Zimbra Collaboration
- CVE-2026-73572In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client…Zimbra Collaboration
- CVE-2026-73571An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in…Zimbra Collaboration
- CVE-2026-19710SourceCodester Simple Student Information System view_department.php sql injectionSourceCodester Simple Student Information System
- CVE-2026-73559vLLM: Completion prompt lists fan out into unbounded engine requestsvllm-project vllm · vllm
- CVE-2026-73558vLLM: Cross-User Data Leak Vulnerabilityvllm-project vllm · vllm
- CVE-2026-49856@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorizationvmoranv jshookmcp · @jshookmcp/jshook
- CVE-2026-73557vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt partsvllm-project vllm · vllm
- CVE-2026-73556vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574vllm-project vllm · vllm
- CVE-2026-14256ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a…Lenovo E16 Gen 2 (Type 21M5, 21M6) Laptops (ThinkPad)… +259
- CVE-2026-63426During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated…Lenovo Dock Manager
- CVE-2026-12036An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could…Lenovo Vantage
- CVE-2026-73555vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messagesvllm-project vllm · vllm
- CVE-2026-70459rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List EntryRsyncProject rsync
- CVE-2026-53800rsync < 3.5.0 Symlink Race Condition via --remove-source-filesRsyncProject rsync
- CVE-2026-53797rsync < 3.5.0 Symlink Race Condition Information DisclosureRsyncProject rsync
- CVE-2026-53796rsync < 3.5.0 TOCTOU Race Condition via Destination Directory HandlingRsyncProject rsync
- CVE-2026-53794rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic ErrorRsyncProject rsync
- CVE-2026-53788rsync < 3.5.0 Newline Injection via name-converter uid/gid mappingRsyncProject rsync
- CVE-2026-49820Probo has an open redirect bypass via path normalizationgetprobo probo · go.probo.inc/probo
- CVE-2026-53798rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mappingRsyncProject rsync
- CVE-2026-53786rsync < 3.5.0 Filter Rule Bypass via --filter Merge DirectiveRsyncProject rsync
- CVE-2026-53785rsync < 3.5.0 Path Traversal Write Escape via --relative ModeRsyncProject rsync
- CVE-2026-73508Netty: Memory Leak in DNS Record Decoder via Malformed Domain Namesnetty · io.netty:netty-codec-dns
- CVE-2026-65936RS9116W/SiWx917 malformed packet with increased length field causes memory leaksilabs.com WiseConnect
- CVE-2026-73506Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment dataJanDeDobbeleer oh-my-posh · github.com/jandedobbeleer/oh-my…
- CVE-2026-65933BT122 malformed packet with increased length field causes memory leaksilabs.com BT122
- CVE-2026-65932BT122 stops advertisingsilabs.com BT122
- CVE-2026-73403WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerabilitywpeverest User Registration
- CVE-2026-73401WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerabilityInstaWP Connect
- CVE-2026-73357WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerabilityNexcess GiveWP
- CVE-2026-73353WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerabilityrevolutbusiness Revolut Gateway for WooCommerce
- CVE-2026-73349WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerabilityNexcess GiveWP
- CVE-2026-73344WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-73340WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerabilityfifu.app Featured Image from URL
- CVE-2026-66693WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerabilityStylemix Motors
- CVE-2026-66689WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerabilityAcyMailing Newsletter Team Anti Spam and list cleaner ̵…
- CVE-2026-66687WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilitymagepeopleteam WpBookingly
- CVE-2026-66660WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerabilityScott Paterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2026-66654WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerabilityTangibleWP Vehica Core
- CVE-2026-66471WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityThemepoints Accordion
- CVE-2026-66467WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja FluentCommunity
- CVE-2026-66464WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerabilityToast Plugins Internal Link Optimiser
- CVE-2026-66460WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerabilityAfterShip & Automizely AfterShip Tracking
- CVE-2026-66459WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerabilitySpace Codes AI for SEO
- CVE-2026-66456WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityProfile Extra Fields by BestWebSoft
- CVE-2026-66455WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerabilityrockiger ReactPress
- CVE-2026-66454WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerabilityMaruti Mohanty WP Social Avatar
- CVE-2026-66444WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerabilitykendysond Payment Forms for Paystack
- CVE-2026-61978WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerabilitywebhosting4ugr Secure Card Gateway for ePay Paycenter
- CVE-2026-28182WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2026-28181WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2026-28174WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerabilityArraytics WP Event SOlution
- CVE-2026-28159WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerabilityAonetheme Service Finder Booking
- CVE-2026-28155WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerabilityLasso Analytics Do Lasso
- CVE-2026-27999WordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerabilitythemefic Tourfic
- CVE-2026-27537WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerabilityPopup by Supsystic
- CVE-2026-19716Stored Cross-site Scripting in Pentestify user account deletion via unescaped usernamemaalfer Pentestify
- CVE-2026-21832HCL AION is affected by multiple security vulnerabilities.HCL Software AION
- CVE-2025-62315HCL AION is affected by multiple security vulnerabilities.HCL Software AION
- CVE-2025-62318HCL AION is affected by multiple security vulnerabilities.HCL Software AION
- CVE-2025-62314HCL AION is affected by multiple security vulnerabilities.HCL Software AION
- CVE-2025-52640HCL AION is affected by multiple security vulnerabilities.HCL Software AION
- CVE-2026-6470PostgreSQL fails to check type USAGE privilegePostgreSQL
- CVE-2026-6469PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownershipPostgreSQL
- CVE-2026-18024PostgreSQL ascii() function reads past end of bufferPostgreSQL
- CVE-2026-16241PostgreSQL ECPG integer underflow can crash the clientPostgreSQL
- CVE-2026-14681PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSLPostgreSQL
- CVE-2026-14678PostgreSQL pg_trgm picksplit reads past end of bufferPostgreSQL
- CVE-2026-14673PostgreSQL amcheck does not clear untrusted search pathPostgreSQL
- CVE-2026-14672PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oraclePostgreSQL
- CVE-2026-14666PostgreSQL row security caching disregards role modificationsPostgreSQL
- CVE-2026-14663PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartextPostgreSQL
- CVE-2026-73584Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handlingRed Hat Enterprise Linux
- CVE-2026-73583Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdrRed Hat Enterprise Linux
- CVE-2026-73585Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attackRed Hat Enterprise Linux
- CVE-2026-73628Serendipity 2.3.5 Reflected XSS via search clean-URL routes9y Serendipity
- CVE-2026-73627JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypassjupyterlab
- CVE-2026-73621GitPython before 3.1.56 Arbitrary File Truncation via Commit.countgitpython-developers GitPython · gitpython
- CVE-2026-73610SiYuan before v3.7.4 Information Disclosure via Local Storagesiyuan-note siyuan
- CVE-2026-73609SiYuan before v3.7.4 Information Disclosure via getBookmarkLabelssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73607SiYuan before v3.7.4 Information Disclosure via getOutlineStoragesiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73606SiYuan before v3.7.4 Information Disclosure via getRefIDssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73605SiYuan before v3.7.4 Path Traversal via getUniqueFilenamesiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73603Flowise before 3.1.4 Credential Abuse via Text-to-SpeechFlowiseAI Flowise · flowise
- CVE-2026-73488Flowise before 3.1.3 IDOR via customer-default-source endpointFlowiseAI Flowise · flowise
- CVE-2026-45819baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can…web-platform-dx baseline-browser-mapping · baseline-browser…
- CVE-2026-18368Heap buffer overflow in ModbusgwdTeltonika Networks RUTOS
- CVE-2026-16455Local privilege escalation via improper input sanitization in execl() callTeltonika Networks RUTOS · Teltonika Networks TSWOS
- CVE-2026-11970This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in…Forcepoint F1E mac
- CVE-2026-59502Priority - CWE-203: Observable DiscrepancyPortal Generator addon to Priority ERP
- CVE-2026-16458Timing side-channel in RSA PKCS#1 v1.5 decryption in ocryptoOberon microsystems AG ocrypto
- CVE-2026-16459Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA CryptoOberon microsystems AG Oberon PSA Crypto
- CVE-2026-14332Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' ActionEcwid by Lightspeed Ecommerce Shopping Cart
- CVE-2026-19694Heap-based Buffer Overflow in WiresharkWireshark Foundation Wireshark
- CVE-2026-19695Stack-based Buffer Overflow in WiresharkWireshark Foundation Wireshark
- CVE-2026-19696Out-of-bounds Write in WiresharkWireshark Foundation Wireshark
- CVE-2026-14298Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in MattermostMattermost
- CVE-2026-3639PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesbuildwps PPWP – Password Protect Pages
- CVE-2026-18622Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as validFoxit Software Foxit PDF Editor · Foxit Software Foxit PDF…
- CVE-2026-19088ShopEngine < 4.9.3 - Customer PII Disclosure via Forced AuthenticationShopEngine Elementor WooCommerce Builder Addon
- CVE-2026-14213Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDORBooking for Appointments and Events Calendar
- CVE-2026-13328TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status ModificationFood Menu
- CVE-2026-3835Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Accessbuildwps Prevent Direct Access – Protect WordPress Files
- CVE-2026-19182OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-onlyThe OpenNMS Group Meridian · The OpenNMS Group Horizon
- CVE-2026-19135OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classesThe OpenNMS Group Meridian · The OpenNMS Group Horizon
- CVE-2026-72506VoiceTra provided by National Institute of Information and Communications Technology (NICT) contains an incorrectly specified destination…National Institute of Information and Communications Techno…
- CVE-2026-18728Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsingRed Hat Enterprise Linux
- CVE-2026-0301PAN-OS: Information Disclosure Vulnerability in URL FilteringPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2026-0299GlobalProtect App: Local Privilege Escalation VulnerabilitiesPalo Alto Networks GlobalProtect App
- CVE-2026-0298GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)Palo Alto Networks GlobalProtect App
- CVE-2026-0297GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel HandshakePalo Alto Networks GlobalProtect App
- CVE-2026-0296GlobalProtect App: Improper Certificate Validation Bypass VulnerabilityPalo Alto Networks GlobalProtect App
- CVE-2026-0295GlobalProtect App: Local Privilege Escalation via Race Condition on macOSPalo Alto Networks GlobalProtect App
- CVE-2026-0294Prisma Access Agent: Local Privilege EscalationPalo Alto Networks Prisma Access Agent
- CVE-2026-0293Prisma Access Agent: Anti-Tamper Protection Bypass on WindowsPalo Alto Networks Prisma Access Agent
- CVE-2026-0292Prisma Access Agent: Local Security Inspection Bypass Vulnerability on WindowsPalo Alto Networks Prisma Access Agent
- CVE-2026-0291Prisma Access Agent: Authenticated Limited File Deletion on LinuxPalo Alto Networks Prisma Access Agent
- CVE-2026-0290Prisma Browser: Sensitive Information Disclosure VulnerabilityPalo Alto Networks Prisma Browser
- CVE-2026-0289Prisma Browser: Inappropriate Implementation in Account ProtectionPalo Alto Networks Prisma Browser
- CVE-2026-67990basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus…