CVEs published August 14, 2026
201 CVEs were published on August 14, 2026: 19 critical, 85 high. Browse them by severity, product and exploitation status.
- Published
- 201
- Critical
- 19
- High
- 85
- Medium
- 89
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 119
Most affected products
- IBM Db2 Mirror for i
- 18
- Tenable Security Center
- 11
- getgrav grav
- 9
- TOTOLINK A800R
- 9
- Red Hat OpenShift Update Service · Red Hat Quay
- 7
- Dell Wyse Management Suite
- 6
- filebrowser
- 5
- siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- 5
- Webkul Bagisto
- 5
- icagenda.com iCagenda extension for Joomla
- 4
Critical 19
- CVE-2026-67365Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11icagenda.com iCagenda extension for Joomla
- CVE-2026-17186IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17184IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17182IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17181IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-50027mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Deletedoobidoo mcp-memory-service · mcp-memory-service
- CVE-2026-73678MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()MindsDB Minds Platform
- CVE-2026-49457QUIC has Broken TLS verificationbenoitc erlang_quic · quic
- CVE-2026-19188Haiwell IoT Cloud HMI Gateway OS Command InjectionHaiwell IoT Cloud HMI Gateway
- CVE-2026-48528Metacat has an unauthenticated SQL injection vulnerabilityNCEAS metacat
- CVE-2026-19682Command InjectionTenable Security Center
- CVE-2026-19681Command InjectionTenable Security Center
- CVE-2026-73849emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.emlog
- CVE-2026-19626Remote Code ExecutionTenable Security Center
- CVE-2026-19871Use of hard-coded credentials in Prospero Flow CRM employee onboardingRoskus Prospero Flow CRM
- CVE-2026-72836FileBrowser before 2.63.19 Case Sensitivity Authentication Bypassfilebrowser
- CVE-2026-72811SiYuan before v3.7.4 SQL Injection via backlink searchsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-72810SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocketsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-12949Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' ParameterWishlist Member
High 85
- CVE-2026-69414Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2026-73683Laravel Socialite Facebook Provider Authentication Bypass via Nonce ReplayLaravel Socialite
- CVE-2026-50523Microsoft PowerShell Remote Code Execution VulnerabilityMicrosoft PowerShell · powershell
- CVE-2026-71571Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11icagenda.com iCagenda extension for Joomla
- CVE-2026-19910PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution VulnerabilityPAX Technology Q80
- CVE-2026-19908PAX Technology Q80 XCB Daemon Missing Authentication VulnerabilityPAX Technology Q80
- CVE-2026-19909PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution VulnerabilityPAX Technology Q80
- CVE-2026-73680Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg FilenameCockpit HQ Cockpit CMS
- CVE-2026-34492Airwall - Arbitrary file readJohnson Controls Airwall
- CVE-2026-64887Airwall - Hardcoded SecretsJohnson Controls Airwall
- CVE-2026-18554IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17179IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17177IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17175IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17081IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-16915IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-16879IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-16708IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-45699Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()netatalk
- CVE-2026-73679ImpressCMS Authenticated RCE via PHP Custom Tag eval()ImpressCMS
- CVE-2026-72970Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-12366Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposalzephyrproject zephyr
- CVE-2026-12364Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of servicezephyrproject zephyr
- CVE-2026-73850Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Functionemlog
- CVE-2026-19680SQL InjectionTenable Security Center
Show all 85 entriesShow fewer entries
- CVE-2026-19679Improper Input ValidationTenable Security Center
- CVE-2026-19847TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflowTOTOLINK A800R
- CVE-2026-19846TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflowTOTOLINK A800R
- CVE-2026-19635Local Privilege EscalationTenable Security Center
- CVE-2026-19629Privilege EscalationTenable Security Center
- CVE-2026-63361LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popupLimeSurvey
- CVE-2026-19845TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflowTOTOLINK A800R
- CVE-2026-19628Remote Code ExecutionTenable Security Center
- CVE-2026-19844TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflowTOTOLINK A800R
- CVE-2026-46603Excessive memory allocation during VP8L decoding in golang.org/x/imagegolang.org/x/image/vp8l · golang.org/x/image
- CVE-2026-49989CrateDB's Blob HTTP handler bypasses authorizationcrate · io.crate:crate
- CVE-2026-49986Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`cdeust Cortex · neuro-cortex-memory
- CVE-2026-46439compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)oscal-compass compliance-trestle · compliance-trestle
- CVE-2026-63700Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability.Dell Wyse Management Suite
- CVE-2026-66271Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability.Dell Wyse Management Suite
- CVE-2026-66270Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability.Dell Wyse Management Suite
- CVE-2026-19884In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to…Eclipse Foundation Eclipse Theia
- CVE-2026-53970ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rblucasgelfond ZeroBrew
- CVE-2026-16772CVE-2026-16772Akaunting
- CVE-2026-13197Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControlKUNBUS piControl
- CVE-2026-13196Out-of-bounds Write in KUNBUS piControlKUNBUS piControl
- CVE-2026-69101Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpointdatavane tis
- CVE-2026-73633Apache Struts: Unbounded read of a JSON request bodyApache Software Foundation org.apache.struts:struts2-json-p…
- CVE-2026-19768Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier…Devolutions PowerShell Universal
- CVE-2026-19824Tenda W20E addIpMacBind ipMacBindListStore stack-based overflowTenda W20E
- CVE-2026-73673Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware AuthenticationNetis Systems Co. Netis NC63 Wireless AC1200 Router
- CVE-2026-19823Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflowTenda W20E
- CVE-2026-19870IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creationRoskus Prospero Flow CRM
- CVE-2026-72859Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URLbudibase server · @budibase/server
- CVE-2026-72838FileBrowser before 2.63.19 Disk Exhaustion via TUS Uploadfilebrowser
- CVE-2026-72837File Browser before 2.63.20 Privilege Escalation via Proxy Authenticationfilebrowser
- CVE-2026-72835filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalizationfilebrowser
- CVE-2026-72833Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keysgetgrav grav-plugin-api
- CVE-2026-72831Grav through 2.0.11 Authentication Bypass via Flex Objectsgetgrav grav · trilbymedia grav-plugin-flex-objects
- CVE-2026-72830Grav API Plugin before 1.0.13 RCE via ConfigController scope bypassgetgrav grav
- CVE-2026-72829Grav before 1.0.13 API Key Scope Bypass via UsersControllergetgrav grav
- CVE-2026-72828Grav before 1.0.13 API Key Scope Bypass via InvitationsControllergetgrav grav
- CVE-2026-72827Grav CMS before 2.0.13 Remote Code Execution via Twiggetgrav grav
- CVE-2026-72826Grav API Plugin before 1.0.13 Scope Bypass via createApiKeygetgrav grav-plugin-api
- CVE-2026-72825Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsControllergetgrav grav-plugin-api
- CVE-2026-72824Grav before 1.0.13 API Key Scope Bypass via PagesControllergetgrav grav
- CVE-2026-72822Grav before 1.0.13 Authentication Bypass via disable2fagetgrav grav
- CVE-2026-72819Grav CMS before 2.0.13 Remote Code Execution via ZIP Uploadgetgrav grav · getgrav/grav
- CVE-2026-19822Tenda W20E QoS Edit editQos lstAdd stack-based overflowTenda W20E
- CVE-2026-19821Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflowTenda AC12
- CVE-2026-19815TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflowTOTOLINK A800R
- CVE-2026-19814TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflowTOTOLINK A800R
- CVE-2026-19813TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflowTOTOLINK A800R
- CVE-2026-19794WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scriptinggamerz WP-Stats
- CVE-2026-19812TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflowTOTOLINK A800R
- CVE-2026-19811TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflowTOTOLINK A800R
- CVE-2026-18039Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass AssignmentEssential Addons for Elementor
- CVE-2026-15205Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel LookupPaymob for WooCommerce
- CVE-2026-19792Tenda G0 httpd web management interface module setPortMapping buffer overflowTenda G0
- CVE-2026-19791Tenda G0 httpd web management interface module addStaticRoute stack-based overflowTenda G0
- CVE-2026-19790Tenda G0 httpd Web Management module formSetPortMirror stack-based overflowTenda G0
- CVE-2026-19789Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflowTenda AC1206
- CVE-2026-19788Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflowTenda AC1206
- CVE-2026-18109W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Nameboldgrid W3 Total Cache
- CVE-2026-19771Baicells EG3661M LuCI Web luci os command injectionBaicells EG3661M
Medium, low and unrated 97
- CVE-2026-74250In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing…OpenStack Ironic
- CVE-2026-74247Quay: ssrf via build archive_url in quay build apiRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-74245Quay: unauthenticated exported logs download in quayRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-74244Quay: stripe webhook accepts forged events without signature verification in quayRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-74243Quay: unauthenticated secscan notification endpoint in quay when psk is unsetRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-74242Quay: repository notification uuid idor in quay apiRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-74241Quay: ldap referral filter injection in quay external ldap authenticationRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-74240Quay: jwt claim validation bypasses in quay federated robot and sso authenticationRed Hat OpenShift Update Service · Red Hat Quay
- CVE-2026-63650OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509…OpenVPN
- CVE-2026-63649The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass…OpenVPN
- CVE-2026-74248OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization.OpenStack Octavia
- CVE-2026-67366Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11icagenda.com iCagenda extension for Joomla
- CVE-2026-71570Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11icagenda.com iCagenda extension for Joomla
- CVE-2026-18178IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17227IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17209IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-27871TL280Johnson Controls TL280
- CVE-2026-17173IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-17079IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-16905IBM Db2 Mirror for i is affected by multiple vulnerabilitiesIBM Db2 Mirror for i
- CVE-2026-50029js-toml has silent type confusion via falsy-primitive duplicate-key bypasssunnyadn js-toml · js-toml
- CVE-2025-7639AVEVA Enterprise SCADA Deserialization of Untrusted DataAVEVA Enterprise SCADA · AVEVA Pipeline Operations for G… +3
- CVE-2026-18403LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDBLimeSurvey
- CVE-2026-12365Use-after-free in Zephyr delayable work-queue cancellation under SMP timing racezephyrproject zephyr
- CVE-2026-12363Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0zephyrproject zephyr
Show all 97 entriesShow fewer entries
- CVE-2026-49263Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronizationcapstone-engine capstone
- CVE-2026-49282Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashescapstone-engine capstone
- CVE-2026-73847Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeoveremlog
- CVE-2026-19639Improper Access ControlTenable Security Center
- CVE-2026-19636Insuffucient Protections Lead to Brute ForceTenable Security Center
- CVE-2026-19631SQL InjectionTenable Security Center
- CVE-2026-73846CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningondata ckan-mcp-server · @aborruso/ckan-mcp-server
- CVE-2026-73845CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)ondata ckan-mcp-server · @aborruso/ckan-mcp-server
- CVE-2026-73844CKAN MCP Server: Information disclosure via verbose error reflectionondata ckan-mcp-server · @aborruso/ckan-mcp-server
- CVE-2026-47192kas's late signature validation may allow unnoticed repository manipulationssiemens kas · kas
- CVE-2026-47191kas checks out SHA-like git branches as valid commitssiemens kas · kas
- CVE-2026-19841TRENDNET TEW-813DRU vsftpd vsftpd.conf default permissionTRENDNET TEW-813DRU
- CVE-2026-49826Concourse login flow has an open redirect issueconcourse · github.com/concourse/concourse
- CVE-2026-47766crun follows rootfs /dev symlink while creating default devicescontainers crun
- CVE-2026-19839SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted uploadSourceCodester Simple Doctors Appointment System
- CVE-2026-46380compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystemoscal-compass compliance-trestle · compliance-trestle
- CVE-2026-19838Webkul Bagisto Backend Reporting Endpoint sales authorizationWebkul Bagisto
- CVE-2026-19837Webkul Bagisto Customer Search search information disclosureWebkul Bagisto
- CVE-2026-66272Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability.Dell Wyse Management Suite
- CVE-2026-63701Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability.Dell Wyse Management Suite
- CVE-2026-19836Webkul Bagisto Backend Customer Detail Feature view authorizationWebkul Bagisto
- CVE-2026-63702Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability.Dell Wyse Management Suite
- CVE-2026-19835Webkul Bagisto Customer Item Deletion Endpoint access controlWebkul Bagisto
- CVE-2026-57472Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoadKUNBUS RevPiPyLoad
- CVE-2026-57471Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoadKUNBUS RevPiPyLoad
- CVE-2026-57469Cross-Site Request Forgery (CSRF) in KUNBUS PiCtoryKUNBUS PiCtory
- CVE-2026-13198Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControlKUNBUS piControl
- CVE-2026-13002Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsingRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-19834Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationWebkul Bagisto
- CVE-2026-19879Io.undertow/undertow: undertow: http response header integrity issue due to character truncationRed Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-58224Samba: ctdb fails to do integrity checking of received packetsRed Hat Ceph Storage · Red Hat Enterprise Linux +1
- CVE-2026-19880Incomplete protection against CVE-2025-11226QOS.CH Sarl Logback-classic
- CVE-2026-1621Register Bypass in Universal Sotware's E-MunicipalityUniversal Software E-Municipality
- CVE-2026-53472Migration-planner: credentialurl validator accepts javascript: urlsmigration-planner
- CVE-2026-19830TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resourcesTRENDnet TEW-816DRM
- CVE-2026-19829648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal648540858 wvp-GB28181-pro
- CVE-2026-19828648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal648540858 wvp-GB28181-pro
- CVE-2026-19827alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversalalldatacenter alldata
- CVE-2026-19826alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserializationalldatacenter alldata
- CVE-2026-19825SourceCodester Simple Client Management System Master.php save_service sql injectionSourceCodester Simple Client Management System
- CVE-2026-73630SiYuan before v3.7.4 Information Disclosure via authFilePublishAccesssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73051actix-http before 3.12.1 HTTP Request Smuggling via CL.TEactix-http
- CVE-2026-73049SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinkssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73048SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationIDsiyuan-note siyuan
- CVE-2026-72834filebrowser before 2.63.19 Permission Bypass via checksumfilebrowser
- CVE-2026-72832Grav before 2.0.13 Stored XSS via quoted-attribute bypassgetgrav grav · getgrav/grav
- CVE-2026-72823Grav before 1.0.13 API-key scope cap bypass via DemoControllergetgrav grav
- CVE-2026-72821Grav Form Plugin before 9.1.15 Stored XSS via Radio Togglegetgrav grav
- CVE-2026-72820Grav 2.0.11 Path Traversal via Backup Profile Configurationgetgrav grav
- CVE-2026-72817go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-Forgo-chi chi · github.com/go-chi/chi/middleware +5
- CVE-2026-72816go-chi chi before 5.3.0 IP Spoofing via RealIP Middlewarego-chi chi · github.com/go-chi/chi/middleware +5
- CVE-2026-72815go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Headergo-chi chi · github.com/go-chi/chi/v5/middleware +1
- CVE-2026-72814actix-files before 0.6.10 Information Disclosure via Filesactix-files
- CVE-2026-72813actix-files before 0.6.10 Denial of Service via empty Range headeractix-files
- CVE-2026-72812SiYuan before v3.7.4 Missing Authorization via refreshBacklinksiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2025-71405go-chi chi before v5.2.2 Open Redirect via RedirectSlashesgo-chi chi · github.com/go-chi/chi/v5
- CVE-2026-16739Epeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation ForgeryEpeken All Kurir for Woocommerce
- CVE-2026-14290Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode AttributeEmbed Google Photos album
- CVE-2026-19617Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parserRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-12743affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parametercservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2026-16810Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameterbitpressadmin Bit Form – Contact Form, Payment Forms, Multi…
- CVE-2025-10308Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Resetalian Astro Booking Engine
- CVE-2026-19787SourceCodester Air Cargo Management System Master.php save_cargo_type sql injectionSourceCodester Air Cargo Management System
- CVE-2026-19786francoisjacquet RosarioSIS Modules.php cross-site request forgeryfrancoisjacquet RosarioSIS
- CVE-2026-19785francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injectionfrancoisjacquet RosarioSIS
- CVE-2026-19784francoisjacquet RosarioSIS Referrals.php DBUpdate authorizationfrancoisjacquet RosarioSIS
- CVE-2026-19770feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgeryfeedmob fm-mcp-servers
- CVE-2026-19767itsourcecode Hospital Management System viewdoctortimings.php sql injectionitsourcecode Hospital Management System
- CVE-2026-19765eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgeryeyaushev swagger-testcase-mcp
- CVE-2026-19764Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injectionRaisecom Communication Command and Dispatch Management Plat…
- CVE-2026-19763DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversalDTStack Taier
- CVE-2026-19762DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversalDTStack Taier