CVEs published August 21, 2026
258 CVEs were published on August 21, 2026: 41 critical, 104 high. Browse them by severity, product and exploitation status.
- Published
- 258
- Critical
- 41
- High
- 104
- Medium
- 96
- Low
- 17
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 175
Most affected products
- Apache Software Foundation Apache CloudStack
- 20
- Combodo iTop
- 18
- Esri Portal for ArcGIS
- 13
- lxc incus · canonical lxd +4
- 7
- j2commerce.com J2Store extension for Joomla
- 6
- lxc incus
- 6
- Datiphy Data Management Center
- 4
- FreeRTOS-Kernel
- 4
- Linux
- 4
- misp-stix
- 4
Critical 41
- CVE-2026-49849xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution4xmen xshop
- CVE-2026-77415JSONata: Arbitrary Code Execution via crafted JSONata expressionsjsonata-js jsonata · jsonata
- CVE-2026-77414JSONata: Arbitrary Code Execution via crafted JSONata expressionsjsonata-js jsonata · jsonata
- CVE-2026-77413JSONata: Arbitrary Code Execution via crafted JSONata expressionsjsonata-js jsonata · jsonata
- CVE-2026-61539Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsingxorbitsai inference · xinference
- CVE-2026-59989Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)cphalcon · phalcon/cphalcon
- CVE-2026-62283Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checknezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-76904GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layersgeotools · org.geotools.jdbc:gt-jdbc-postgis
- CVE-2026-77810Code Injection via Gremlin Query Passthrough in Amazon Athena Neptune ConnectorAWS Athena Federated Query Neptune Connector
- CVE-2026-62674Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCEomnigent-ai omnigent · omnigent
- CVE-2026-74581net: ipv6: clear suppressed fib6 rule resultLinux
- CVE-2026-75932Jet Admin tenant isolation failureJet Admin
- CVE-2026-69502Azure SQL Database Elevation of Privilege VulnerabilityMicrosoft Azure SQL Database
- CVE-2026-77087Paperclip before 0.3.1 Remote Code Execution via DNS Rebindingpaperclipai paperclip
- CVE-2026-63343Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as rootlxc incus
- CVE-2026-63125Incus vulnerable to root RCE via image backup.yaml symlinklxc incus
- CVE-2026-62941Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config mergelxc incus
- CVE-2026-62940Incus has a project restriction bypass via instance migration config overridelxc incus
- CVE-2026-62867Incus has an argument injection in storage volume block.create_options that leads to arbitrary command executionlxc incus
- CVE-2026-48769Incus has an arbitrary file write on its client due to trusted image hashlxc incus · canonical lxd +4
- CVE-2026-48755Incus has an argument injection in backup compression algorithm leading to AFW and ACElxc incus · canonical lxd +4
- CVE-2026-48753Incus has an arbitrary file write via path traversal in S3 multipart uploadlxc incus · github.com/lxc/incus/v7/cmd/incusd +3
- CVE-2026-48752Incus has arbitrary file read+write on host via templates/ symlink in malicious imagelxc incus · canonical lxd +4
- CVE-2026-48751Incus has a restricted project bypass leading to arbitrary command executionlxc incus · canonical lxd +4
- CVE-2026-48750Incus has an arbitrary file write on host via `exec-output` symlink in crafted imagelxc incus · canonical lxd +4
Show all 41 entriesShow fewer entries
- CVE-2026-48749Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious imagelxc incus · canonical lxd +4
- CVE-2026-77812Cleartext Exposure of DJI Drone Wi-Fi Credentials via BLEDJI Neo · DJI Flip +4
- CVE-2026-77806SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.SPIP
- CVE-2026-77776Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated IdentityHeadroom Labs headroom-ai
- CVE-2026-77086SiYuan before v3.7.4 Path Traversal via packageNamesiyuan-note siyuan
- CVE-2026-77683Comfast CF-N1-S mbox-config system command injectionComfast CF-N1-S
- CVE-2026-59085Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook moduleApache Software Foundation Apache CloudStack
- CVE-2026-61398Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UIApache Software Foundation Apache CloudStack
- CVE-2026-62440Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulationApache Software Foundation Apache CloudStack
- CVE-2026-77264Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure101gen Automation Web Platform – Notifications and OTP for…
- CVE-2026-76158Datiphy Data Management Center - External Control of File Name or PathDatiphy Data Management Center
- CVE-2026-76156Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS CommandDatiphy Data Management Center
- CVE-2026-76155Datiphy Data Management Center - Use of Default CredentialsDatiphy Data Management Center
- CVE-2026-77651The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a…droundy arrayref
- CVE-2026-77650The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it…droundy append-only-vec
- CVE-2026-77649The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a…droundy internment
High 104
- CVE-2026-77781Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keysTie-Hash-Regex
- CVE-2026-49360Recce server has unauthenticated SQL execution that allows local file read/write through DuckDBDataRecce recce · recce
- CVE-2026-48106Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any…Basekick-Labs arc
- CVE-2026-48105Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm…Basekick-Labs arc
- CVE-2026-47735Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checksBasekick-Labs arc · github.com/basekick-labs/arc
- CVE-2026-48050Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoSBasekick-Labs arc · github.com/basekick-labs/arc
- CVE-2026-53499FORT-validator Vulnerable to RRDP Shared Snapshot Cache PoisoningNICMx FORT-validator
- CVE-2026-34948Combodo iTop: Access control bypass via OQL joinsCombodo iTop
- CVE-2026-53525WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authenticationweechat
- CVE-2026-34741Combodo iTop: Authentication bypass in exec.php allows PHP file executionCombodo iTop
- CVE-2026-53530ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)erweixin RaTeX · ratex-parser
- CVE-2026-53528FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameterperber leafwiki
- CVE-2026-53527LeafWiki Vulnerable to Privilege Escalation via User Self-Service Updateperber leafwiki
- CVE-2026-33240Combodo iTop: Reflected XSS in foreign key search criteriaCombodo iTop
- CVE-2026-31936Combodo iTop: Unauthorized access to object information via search operationCombodo iTop
- CVE-2026-50538libvncclient Tight decoder has an attacker-controlled heap out-of-bounds writelibvncserver
- CVE-2026-31880Combodo iTop: Reflected XSS in universal searchCombodo iTop
- CVE-2026-77220PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formattingmichaelrsweet pdfio
- CVE-2026-31803Combodo iTop: Reflected XSS in tag adminCombodo iTop
- CVE-2026-77354kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decodinggetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-76905kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoSgetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2026-63135YOURLS: Stored XSS in referrer statistics chart via crafted Referer headerYOURLS · yourls/yourls
- CVE-2026-30890Combodo iTop: Reflected XSS in synchro/synchro_import.phpCombodo iTop
- CVE-2026-30865Combodo iTop: Reflected XSS in dashboard saveCombodo iTop
- CVE-2026-54457TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpointtensorzero
Show all 104 entriesShow fewer entries
- CVE-2026-64679Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creationrunatlantis atlantis · github.com/runatlantis/atlantis
- CVE-2026-62316Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Executionmicrosoft UFO
- CVE-2026-30826Combodo iTop: Reflected XSS in run_query.phpCombodo iTop
- CVE-2026-63421Keystone: `graphql.maxTake` bypass with negative `take`keystonejs keystone · @keystone-6/core
- CVE-2026-61824Defuddle: XSS via unescaped attribute interpolation in site extractorskepano defuddle · defuddle
- CVE-2026-68508Hydra: hydra.utils.instantiate with untrusted config can lead to code executionfacebookresearch hydra · hydra-core
- CVE-2026-77811Stored Cross-Site Scripting via Integration Template Asset in OpenSearch DashboardsAWS Amazon OpenSearch Service · OpenSearch Dashboards dashb…
- CVE-2026-30819Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameterCombodo iTop
- CVE-2026-62960Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windowsgit-for-windows git
- CVE-2026-27490Combodo iTop: Weak secret generation for inline imageCombodo iTop
- CVE-2026-27462Combodo iTop: User enumeration via password resetCombodo iTop
- CVE-2026-76876Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings APIpuemos craftplan
- CVE-2026-30866Combodo iTop: Insecured access to uploaded images via sniffed urlCombodo iTop
- CVE-2026-50288@asymmetric-effort/specifyjs: URL parse failure silently allows requestasymmetric-effort specifyjs · @asymmetric-effort/specifyjs
- CVE-2026-74252Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5j2commerce.com J2Store extension for Joomla
- CVE-2026-67359Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5j2commerce.com J2Store extension for Joomla
- CVE-2026-54071BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.pyfunstory-ai BabelDOC · babeldoc
- CVE-2026-54682DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabledTyrrrz DiscordChatExporter
- CVE-2026-54134OctoPrint: File exfiltration possible via query parameters on upload endpointsOctoPrint
- CVE-2026-63462Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatterunleash · unleash-server
- CVE-2026-71862Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabledbluewave-labs Checkmate
- CVE-2026-55241Checkmate: Pre-auth Denial of Service via File Upload on Registrationbluewave-labs Checkmate
- CVE-2026-62675Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Toolsomnigent-ai omnigent · omnigent
- CVE-2026-77236Missing size validation in SecureContext_AllocateContext in FreeRTOS-KernelFreeRTOS-Kernel
- CVE-2026-62677Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACEomnigent-ai omnigent · omnigent
- CVE-2026-62676Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.pyomnigent-ai omnigent · omnigent
- CVE-2026-77235Missing privilege check in SecureContext_FreeContext in FreeRTOS-KernelFreeRTOS-Kernel
- CVE-2026-77234Improper input validation in FreeRTOS-Kernel timer command handlingFreeRTOS-Kernel
- CVE-2026-41451UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.shtclahr uac
- CVE-2026-41450UAC < 3.3.0 Command Injection via command_collector.shtclahr uac
- CVE-2026-41449UAC < 3.3.0 Command Injection via run_command.shtclahr uac
- CVE-2026-17252Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management…TP-Link Systems TL-MR6400
- CVE-2026-17251Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request ParsingTP-Link Systems TL-MR6400
- CVE-2026-17250Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update HandlingTP-Link Systems TL-MR6400
- CVE-2026-74583net/sched: cls_route: fix fastmap use-after-free on filterLinux
- CVE-2026-74582packet: use consistent hard_header_len in non-ring send pathsLinux
- CVE-2026-74580vhost: reset the vring metadata cache on vring reconfigurationLinux
- CVE-2026-54789mod_auth_openidc has out-of-bounds read and write in state cookie parsingmod_auth_openidc
- CVE-2026-22681OpenViking < 0.3.4 SSRF via /api/v1/resourcesVolcengine OpenViking
- CVE-2026-75933Jet Admin Stored XSSJet Admin
- CVE-2026-49114ONNX symlink-following and path-traversal arbitrary file writeONNX
- CVE-2026-77815Infinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directorieszanllp infinite-image-browsing
- CVE-2026-77814Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separatorzanllp infinite-image-browsing
- CVE-2026-55622Incus has a project restriction bypass in instance copy across projectslxc incus · canonical lxd +4
- CVE-2026-55621Incus has a project restriction bypass for custom volume copy across projectslxc incus · canonical lxd +3
- CVE-2026-75946OMEN Gaming Hub – Potential Escalation of Privilege & Information DisclosureHP OMEN Gaming Hub
- CVE-2026-76612Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66yootheme.com Zoo extension for Joomla
- CVE-2026-75115Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40yootheme.com YOOtheme Pro extension for Joomla
- CVE-2026-76613Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40yootheme.com YOOtheme Pro extension for Joomla
- CVE-2026-59279Unbounded persistent session allocation via repeated initialize requestsSpring AI
- CVE-2026-77759IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial recordsRoskus Prospero Flow CRM
- CVE-2026-77775Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address ValidationHeadroom Labs headroom-ai
- CVE-2026-77767Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authenticationreconmap
- CVE-2026-14208Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0Remote Utilities Pte. Remote Utilities Host
- CVE-2026-77755Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix librarymisp-stix
- CVE-2026-77751Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix librarymisp-stix
- CVE-2026-47827CVE-2026-47827 – BOSH CLI Powershell InjectionCloud Foundry Foundation BOSH CLI
- CVE-2026-63046Apache InLong: Agent Installer — Command Injection to RCE via Default CredentialsApache Software Foundation Apache InLong
- CVE-2026-47359Apache CloudStack: OS Command Injection due to unsanitized mount commandApache Software Foundation Apache CloudStack
- CVE-2026-50112Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templatesApache Software Foundation Apache CloudStack
- CVE-2026-50222Apache CloudStack: Improper access control in Userdata reference APIsApache Software Foundation Apache CloudStack
- CVE-2026-59655Apache CloudStack: Unauthenticated OAuth provider client-secret disclosureApache Software Foundation Apache CloudStack
- CVE-2026-59657Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJobApache Software Foundation Apache CloudStack
- CVE-2026-59780Apache CloudStack: LDAP provider configuration disclosureApache Software Foundation Apache CloudStack
- CVE-2026-59799Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable FlowApache Software Foundation Apache CloudStack
- CVE-2026-61397Apache CloudStack: OAuth2 Token Cross-Request LeakApache Software Foundation Apache CloudStack
- CVE-2026-61400Apache CloudStack: Get and Run Diagnostics Command InjectionApache Software Foundation Apache CloudStack
- CVE-2026-66722Apache CloudStack: ProjectRole & ProjectRolePermission authorization issueApache Software Foundation Apache CloudStack
- CVE-2026-68745Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdPApache Software Foundation Apache CloudStack
- CVE-2026-16323Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management PanelFuyaWeb Internet and Informatics Services ArchitectPanel We…
- CVE-2026-75796AI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User ToolsAI Engine
- CVE-2026-18781Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename BypassDrag and Drop Multiple File Upload for Contact Form
- CVE-2026-16576Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST APIDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-45201GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memoryImagination Technologies Graphics DDK
- CVE-2026-18409WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field ValuesWPForms Pro
- CVE-2026-45199GPU DDK - rgxfw_to_ptr() does not reject FW private data pointersImagination Technologies Graphics DDK
- CVE-2026-65644Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST…Rocket.Chat
- CVE-2026-73267Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkRed Hat multicluster engine for Kubernetes
- CVE-2026-76157Datiphy Data Management Center - Missing Authentication for Critical FunctionDatiphy Data Management Center
Medium, low and unrated 113
- CVE-2026-53541OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input FilteringOliveTin · github.com/OliveTin/OliveTin
- CVE-2026-34949Combodo iTop: Unauthenticated user can delete .readonly fileCombodo iTop
- CVE-2026-53524WeeChat has a Decompression Bomb in Relay WebSocket (DoS)weechat
- CVE-2026-34836Combodo iTop: Improper access control in ajax.render.php and ajax.document.phpCombodo iTop
- CVE-2026-33333Combodo iTop: Information disclosure in ajax.render.phpCombodo iTop
- CVE-2026-53487Kite has an authenticated cluster RBAC bypass in /api/v1/overviewkite-org kite · github.com/zxh326/kite
- CVE-2026-53531ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)erweixin RaTeX · ratex-parser
- CVE-2026-53529LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)perber leafwiki
- CVE-2026-33047Combodo iTop: Object can be locked by a user without write permissionsCombodo iTop
- CVE-2026-53509@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)ondata ckan-mcp-server · @aborruso/ckan-mcp-server
- CVE-2026-53497CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)cenodude CrossWatch
- CVE-2026-43980Malla: Stored XSS via Meshtastic node names in multiple frontend pageszenitraM malla · malla
- CVE-2026-53468Typemill has Stored HTML Attribute Injection in Metadata Fieldstypemill
- CVE-2026-45271picotls has infinite recursion in the minicrypto ASN.1 decoderh2o picotls
- CVE-2026-69233stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69234reflected cross site scripting vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69235stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69236stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69237HTML injection vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69232stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69231stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69230stored cross site scripting issue in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69229HTML injection vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69228missing authentication vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69225information disclosure vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
Show all 113 entriesShow fewer entries
- CVE-2026-69238HTML injection vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-69224information disclosure vulnerability in Esri Portal for ArcGISEsri Portal for ArcGIS
- CVE-2026-53656FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server datavoxel51 fiftyone · fiftyone
- CVE-2026-55168Runtipi: Authenticated arbitrary file write via backup restore symlink plantingruntipi
- CVE-2026-44517Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archivecontainers buildah · github.com/containers/buildah
- CVE-2026-77219GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image LoaderGNU Emacs
- CVE-2026-55185Miniflux 2: Open Redirect Bypassminiflux · miniflux.app/v2 +1
- CVE-2026-53572KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escapingkedacore keda · github.com/kedacore/keda/v2 +1
- CVE-2026-45099Terragrunt: Arbitrary File Deletion via Malicious Module Manifestgruntwork-io terragrunt · github.com/gruntwork-io/terragrunt
- CVE-2026-27463Combodo iTop: Version disclosure via login page logoCombodo iTop
- CVE-2026-50290@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToStringasymmetric-effort specifyjs · @asymmetric-effort/specifyjs
- CVE-2026-67361Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20…j2commerce.com J2Store extension for Joomla
- CVE-2026-67358Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5j2commerce.com J2Store extension for Joomla
- CVE-2026-67362Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5j2commerce.com J2Store extension for Joomla
- CVE-2026-67360Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5j2commerce.com J2Store extension for Joomla
- CVE-2026-54073VeraCrypt: Hidden volume quick format weakens plausible deniabilityVeraCrypt
- CVE-2026-53762VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)VeraCrypt
- CVE-2026-54681DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML exportTyrrrz DiscordChatExporter
- CVE-2026-55850Element Web: A malicious homeserver can inject HTML in Element Web using its homepageelement-hq element-web
- CVE-2026-77795Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorizationDromara RuoYi-Vue-Plus
- CVE-2026-35163OctoPrint: XSS in Suppressed Command NotificationsOctoPrint
- CVE-2026-63466Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernameunleash · unleash-server
- CVE-2026-63004Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata…unleash · unleash-server
- CVE-2026-70656Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matchingbluewave-labs Checkmate
- CVE-2026-27875Simplex Incident Manager Clear TestJohnson Controls Simplex Incident Manager / Autocall Fire A…
- CVE-2026-71493Infracost: Arbitrary file read via config-template readFile symlink traversalinfracost · github.com/infracost/infracost
- CVE-2026-77237Missing type validation in xQueueAddToSet in FreeRTOS-KernelFreeRTOS-Kernel
- CVE-2026-71494Infracost: Terraform Cloud and registry token disclosure via unvalidated hostnameinfracost · github.com/infracost/infracost
- CVE-2026-75928Brushfire unauthenticated information disclosureBrushfire Online Experience
- CVE-2026-50278iccDEV: CIccEmbedIO::Read8() size_t underflowInternationalColorConsortium iccDEV
- CVE-2026-62313Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`lxc incus
- CVE-2026-48754Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}lxc incus · github.com/lxc/incus/v7/cmd/incusd +3
- CVE-2026-47753Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)lxc incus · github.com/lxc/incus +2
- CVE-2026-48756Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)lxc incus · github.com/lxc/incus/v7/cmd/incusd +3
- CVE-2026-15580PassPortal browser extension: vault token disclosure via unvalidated postMessageN-able PassPortal
- CVE-2026-59654Apache CloudStack: DoS caused by database connections leakApache Software Foundation Apache CloudStack
- CVE-2026-76611Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66yootheme.com Zoo extension for Joomla
- CVE-2026-77028Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66yootheme.com Zoo extension for Joomla
- CVE-2026-77780Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking…Roskus Prospero Flow CRM
- CVE-2026-77029Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66yootheme.com Zoo extension for Joomla
- CVE-2026-59318DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt InjectionSpring AI
- CVE-2026-59308Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 TruncationSpring AI
- CVE-2026-19848ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display NameProfilePress
- CVE-2026-18356Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account EmailLimit Login Attempts Security
- CVE-2026-17559Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist BypassPassster
- CVE-2026-16650Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature BypassCharitable
- CVE-2026-15150myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCREDmyCred
- CVE-2026-15046LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRFLitExtension
- CVE-2026-13176Eventin < 4.1.21 - Contributor+ Server-Side Request ForgeryEventin
- CVE-2026-15576Agent receiver accepts mTLS requests without a client certificateCheckmk
- CVE-2026-77769OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization BoundariesOpenpanel-dev openpanel
- CVE-2026-77768OpenPanel report.get Returns Any Report by Identifier Without Checking Project AccessOpenpanel-dev openpanel
- CVE-2026-77763JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the…github.com/juicedata/juicefs
- CVE-2026-77686Dolibarr Account card.php improper authorizationDolibarr
- CVE-2026-59296Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerabilitySpring Micrometer
- CVE-2026-77761Cross-Document Parser State Contamination in misp-stixmisp-stix
- CVE-2026-59323Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerabilitySpring Micrometer Tracing
- CVE-2026-47079Round-trip Corruption via Improper Entity Escaping in xml_builderjoshnuss xml_builder · xml_builder
- CVE-2026-48590Element and Attribute Names Injected Verbatim into XML Output in xml_builderjoshnuss xml_builder · xml_builder
- CVE-2026-47080CDATA Section Breakout via Unsanitised ]]> in xml_builderjoshnuss xml_builder · xml_builder
- CVE-2026-77681CodeAstro Online Job Portal update-profile.php unrestricted uploadCodeAstro Online Job Portal
- CVE-2026-77710STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix librarymisp-stix
- CVE-2026-61399Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UIApache Software Foundation Apache CloudStack
- CVE-2026-61422Apache CloudStack: Authenticated pre-validation SSRF in registerTemplateApache Software Foundation Apache CloudStack
- CVE-2026-65613Apache CloudStack: Webhook Deliveries Incorrect AccessApache Software Foundation Apache CloudStack
- CVE-2026-66721Apache CloudStack: Authorization issue with listHostTags for domain adminsApache Software Foundation Apache CloudStack
- CVE-2026-66797Apache CloudStack: Unauthorised comment creation and disclosureApache Software Foundation Apache CloudStack
- CVE-2026-74866@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name@fastify/busboy
- CVE-2026-19441Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's RushIKAS Technology Rush
- CVE-2026-73537Cross-site scripting vulnerability exists in Miraikan Assist App.Japan Science and Technology Agency (JST) Miraikan Assist A…
- CVE-2026-19435Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password DisclosureDuplicate Post
- CVE-2026-19085Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content DisclosureDuplicate Post
- CVE-2026-16959Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connectorMedia Library Assistant
- CVE-2026-16577Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied AmountDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-16575Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST EndpointDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-14601Link Whisper < 0.9.7 - Editor+ SQL Injection via domain ParameterLink Whisper Free
- CVE-2026-14325Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag SettingDrag and Drop Multiple File Upload for Contact Form
- CVE-2025-15671Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid ParameterWelcart e-Commerce
- CVE-2026-16962Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status ManipulationTamara Checkout
- CVE-2026-13736NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST APINewPath WildApricotPress Add-on
- CVE-2026-45202GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast`Imagination Technologies Graphics DDK
- CVE-2026-65645Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6.Rocket.Chat
- CVE-2026-76137Missing authentication for critical function vulnerability exists in VOCALOID6.Yamaha VOCALOID6
- CVE-2026-76131Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and…Yamaha VOCALOID6
- CVE-2026-77392SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injectionSourceCodester Dynamic Input Field Generator Using HTML, CS…
- CVE-2026-77391SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgerySourceCodester Dynamic Input Field Generator Using HTML, CS…
- CVE-2026-43679This issue was addressed with improved permissions checking.Apple watchOS
- CVE-2026-20679The issue was addressed with improved checks.Apple macOS