CVEs published September 11, 2026
700 CVEs were published on September 11, 2026: 109 critical, 291 high.
- Published
- 700
- Critical
- 109
- High
- 291
- Medium
- 137
- Low
- 11
- Unrated
- 152
- Now in CISA KEV
- 0
- Fix available
- 552
Most affected products
- Linux
- 428
- WWBN AVideo
- 20
- CISA Malcolm
- 15
- Concrete CMS
- 15
- strongSwan
- 11
- mistralai mistral-vibe
- 6
- moxi624 MoguBlog
- 6
- PCRE2
- 6
- TUBITAK BILGEM Software Technologies Research Institute Par…
- 5
- Howyar WeenyGenius
- 4
Critical 109
- CVE-2026-90456Use of default credentials in MalcolmCISA Malcolm
- CVE-2026-89713NFSD: check truncate permission under inode lockLinux
- CVE-2026-89712NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lockLinux
- CVE-2026-89708nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardownLinux
- CVE-2026-89703nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegationsLinux
- CVE-2026-89702nfsd: size fh_verify server sockaddr slot by xpt_locallenLinux
- CVE-2026-89697nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()Linux
- CVE-2026-89689nfsd: don't free session slots that are still in useLinux
- CVE-2026-89688nfsd: drop the stateid, not the stateowner, on seqid_op replay retryLinux
- CVE-2026-89686nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revokeLinux
- CVE-2026-89681nfsd: fix layout fence worker double-reference raceLinux
- CVE-2026-89677nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()Linux
- CVE-2026-89676nfsd: fix stale s2s_cp_stateids IDR entry for async COPYLinux
- CVE-2026-89675nfsd: fix UAF in async copy cancel and shutdownLinux
- CVE-2026-89674nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutgetLinux
- CVE-2026-89672nfsd: gate nfs2 setacl by argp->maskLinux
- CVE-2026-89671nfsd: gate nfs3 setacl by argp->maskLinux
- CVE-2026-89669nfsd: initialize copy-notify stateid before publishing itLinux
- CVE-2026-89662NFSD: Prevent lock owner use-after-free during client teardownLinux
- CVE-2026-89660NFSD: Prevent client use-after-free during admin state revocationLinux
- CVE-2026-89659NFSD: Prevent client use-after-free during delegation revokeLinux
- CVE-2026-89658NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanupLinux
- CVE-2026-89656libceph: reject buckets with mismatched CRUSH idsLinux
- CVE-2026-89655ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlockLinux
- CVE-2026-89654ceph: fix UAF in check_new_map() on session freed during unlockLinux
Show all 109 entriesShow fewer entries
- CVE-2026-89653ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decodeLinux
- CVE-2026-89652ceph: bound copied dentry name length in NFS export get_nameLinux
- CVE-2026-89651ceph: bound MDSCapAuth path and fs_name decode in handle_session()Linux
- CVE-2026-89650ceph: bound num_export_targets array for mds info v2/v3Linux
- CVE-2026-89649ceph: bound xattr value length in __build_xattrs()Linux
- CVE-2026-89643audit: avoid dropping live tree ref on fsnotify rule autoremoveLinux
- CVE-2026-89637smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2Linux
- CVE-2026-89636smb: client: clear ce->tgthint in free_tgts()Linux
- CVE-2026-89635ksmbd: only rebind the reopened file's own oplock on durable reconnectLinux
- CVE-2026-89634smb: client: fix ALIGN() overflow in symlink_data() error context loopLinux
- CVE-2026-89633smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()Linux
- CVE-2026-89631smb: client: reject a tree connect response whose byte count is too smallLinux
- CVE-2026-89630smb: client: restore the data_offset bound in is_valid_oplock_break()Linux
- CVE-2026-89614ntfs: bound the free-cluster bitmap scan to the volumeLinux
- CVE-2026-89613ntfs: reject invalid empty mapping pairsLinux
- CVE-2026-89612ntfs: reject invalid MFT LCNs from boot sectorLinux
- CVE-2026-89611ntfs: validate non-resident attribute offsetsLinux
- CVE-2026-89610ntfs: verify run length exceeding volume boundaryLinux
- CVE-2026-89558md/raid10: fix still_degraded being inverted in raid10_sync_request()Linux
- CVE-2026-89555mpls: reload header after pskb_may_pull()Linux
- CVE-2026-89551SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflowLinux
- CVE-2026-89550SUNRPC: svcauth_gss: enforce krb5 token minimum lengthLinux
- CVE-2026-89546SUNRPC: close backchannel before destroying callback serviceLinux
- CVE-2026-89542SUNRPC: harden gss_krb5_unwrap_v2 against short tokensLinux
- CVE-2026-89541SUNRPC: harden gss_unwrap_resp_priv length checksLinux
- CVE-2026-89538SUNRPC: Reject krb5 v2 wrap tokens with oversized ec fieldLinux
- CVE-2026-89537SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2Linux
- CVE-2026-89536SUNRPC: wait for in-flight client TLS handshake callbackLinux
- CVE-2026-89533svcrdma: Fix offset arithmetic in read_chunk_rangeLinux
- CVE-2026-89532svcrdma: Fix pcl_for_each_segment for empty chunksLinux
- CVE-2026-89530svcrdma: Reject inline replies that overflow the pull-up bufferLinux
- CVE-2026-89526svcrdma: Validate Read chunk positions before reconstructionLinux
- CVE-2026-89495ocfs2: bound namelen in dlm_migrate_request_handlerLinux
- CVE-2026-89494ocfs2: validate lengths in dlm_mig_lockres_handlerLinux
- CVE-2026-89492ocfs2: validate directory-index entry counts when reading metadataLinux
- CVE-2026-89485lockd: pin next file across nlm_inspect_file lock-dropLinux
- CVE-2026-89482nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() aloneLinux
- CVE-2026-89479sctp: stop processing a packet once its association is deletedLinux
- CVE-2026-89478sctp: drop a chunk if its transport was removedLinux
- CVE-2026-89448iommu/vt-d: Force requesting ACS when tboot is enabledLinux
- CVE-2026-81002xdp: fix zero-copy frame layoutLinux
- CVE-2026-80986net/smc: bound the peer rkey counts in SMC-Rv2 LLC messagesLinux
- CVE-2026-80981net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()Linux
- CVE-2026-80980net/smc: stop killed, freed and out_of_sync sharing a byteLinux
- CVE-2026-80976seg6: reset IP6CB after IPv6 decapsulationLinux
- CVE-2026-80945crypto: iaa - unmap dst before software fallback on decompressLinux
- CVE-2026-80926ksmbd: fix use-after-free in oplock break notificationLinux
- CVE-2026-53952GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic FlawGetSimpleCMS-CE · GetSimpleCMS
- CVE-2026-54072Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URLauthorizerdev authorizer · github.com/authorizerdev/authori…
- CVE-2026-62105WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerabilityThemeREX Addons
- CVE-2026-62103WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerabilitywpeverest Everest Forms
- CVE-2026-82617Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsApache Software Foundation org.apache.opennlp:opennlp-core…
- CVE-2026-72710SPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionSPIP
- CVE-2026-72709SPIP < 4.4.18 Missing Authorization via ecrire/action/SPIP
- CVE-2026-54047Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration ManipulationLaciSynchroni server
- CVE-2026-3869CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity…Schneider Electric Modicon M580
- CVE-2026-89010WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_serverWAVLINK Technology WN535M1 · WAVLINK Technology WN535M3
- CVE-2026-87988An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as…mistralai mistral-vibe
- CVE-2026-87987An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment…mistralai mistral-vibe
- CVE-2026-87986An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs…mistralai mistral-vibe
- CVE-2026-87985An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted…mistralai mistral-vibe
- CVE-2026-87984An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files…mistralai mistral-vibe
- CVE-2026-87983An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions…mistralai mistral-vibe
- CVE-2026-89212XML External Entity in Akana API PlatformPerforce Akana
- CVE-2026-80462Privilege Escalation in Progress Chef AutomateProgress Software Chef Automate
- CVE-2026-84390A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight…Fortinet FortiMonitorOnSight
- CVE-2026-86793CVE-2026-86793SGLang
- CVE-2026-89259Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSSgohugoio hugo
- CVE-2026-89258Hugo before v0.165.0 Symlink Confinement Bypass via resources.Getgohugoio hugo
- CVE-2026-89256AVideo Bookmark Plugin Stored XSS via Chapter NamesWWBN AVideo
- CVE-2026-89255AVideo LoginControl Stored XSS via PGP Public KeyWWBN AVideo
- CVE-2026-89254AVideo CustomizeUser Stored XSS via field_name ParameterWWBN AVideo
- CVE-2026-89253AVideo Stored XSS via donationLink in watch page buttonWWBN AVideo
- CVE-2026-89249AVideo YPTWallet Stored XSS via CryptoWallet ConfigurationWWBN AVideo
- CVE-2026-89243WWBN AVideo Stored XSS via UserGroups setGroup_nameWWBN AVideo
- CVE-2026-47839Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.adminCloud Foundry Foundation UAA · Cloud Foundry Foundation cf-…
- CVE-2026-14563Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeoveradvanced-customized-prompts
- CVE-2026-14560Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Uploadteddy-bear-customize-addon
- CVE-2026-14559Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeoverteddy-bear-customize-addon
- CVE-2026-8778MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Uploadmulika MIPL Grouped Checkout Fields for WooCommerce. Custom…
- CVE-2026-52630SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and…
- CVE-2026-71644An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe…
- CVE-2026-79395An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in…
- CVE-2026-79396Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account…
High 291
- CVE-2026-89266stb_vorbis through 1.22 heap buffer overflow via codebook multiplicandsnothings stb_vorbis
- CVE-2026-90451Use of Default Credentials in MalcolmCISA Malcolm
- CVE-2026-90448Missing Authorization in MalcolmCISA Malcolm
- CVE-2026-90447Authentication Bypass by Spoofing in MalcolmCISA Malcolm
- CVE-2026-90445Path Traversal in MalcolmCISA Malcolm
- CVE-2026-90444OS Command Injection in MalcolmCISA Malcolm
- CVE-2026-50013Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeSpectoLabs hoverfly · github.com/SpectoLabs/hoverfly
- CVE-2026-49846libks has path traversal in kws HTTP parser via URI segment overflowsignalwire libks
- CVE-2026-90460An issue was discovered in OpenStack Keystone before 29.0.3.OpenStack Keystone
- CVE-2026-54241libde265: SAO sequential filter heap buffer overflow via signed integer overflowstrukturag libde265
- CVE-2026-54240libde265: Pixel accessor signed integer overflow causes heap OOB read/writestrukturag libde265
- CVE-2026-44715OpenMRS has Broken Access Control in HL7 Configurationorg.openmrs.module:legacyui-api
- CVE-2026-54166Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation BypassShelf-nu shelf.nu
- CVE-2026-54174melange: Incomplete package integrity verification allows data section substitutionchainguard-dev melange · chainguard-dev apko +2
- CVE-2026-47773ArduinoBLE: Memory corruption via malformed ATT write requestarduino-libraries ArduinoBLE
- CVE-2026-49464NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taaknl-portal-backend-libraries · nl.nl-portal:taak
- CVE-2026-89771ring-buffer: Fix subbuf resize race with ring buffer readersLinux
- CVE-2026-89769clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error pathLinux
- CVE-2026-89767ovl: fix double end_creating() on the casefold-mismatch pathLinux
- CVE-2026-89764rust: devres: fix race between concurrent revokersLinux
- CVE-2026-89763KEYS: trusted: Fix TPM teardown orderingLinux
- CVE-2026-89762apparmor: fix cred UAF caused by begin_current_label_crit_section()Linux
- CVE-2026-89761apparmor: fix out-of-bounds write when null terminating a label vecLinux
- CVE-2026-89760mm, swap: don't free a hibernation slot that is in the swap cacheLinux
- CVE-2026-89758mm/mempolicy: skip non-present PMDs when queueing foliosLinux
Show all 291 entriesShow fewer entries
- CVE-2026-89755mm/migrate_device: clear stale mapping after freeing swapcacheLinux
- CVE-2026-89754mm/pagewalk: fix stale walk->action escaping walk_pmd_range()Linux
- CVE-2026-89750tracing/user_events: Clear copied tracing state before fork duplicationLinux
- CVE-2026-89748tracing: Fix retry exhaustion in simple ring buffer reader swapLinux
- CVE-2026-89747tracing: Fix use-after-free in trace_pipe read on sub-buffer order changeLinux
- CVE-2026-89746tracing: Fix use-after-free with same-name named triggersLinux
- CVE-2026-89744device property: fix infinite loop in fwnode_for_each_child_node()Linux
- CVE-2026-89743misc: nsm: bound the device-reported response lengthLinux
- CVE-2026-89742rapidio: mport_cdev: fix use-after-free in dma_req_free()Linux
- CVE-2026-89741Revert "media: v4l2-dev: fix error handling in __video_register_device()"Linux
- CVE-2026-89738usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freedLinux
- CVE-2026-89736usb: gadget: u_audio: Fix use-after-free on sound card disconnectLinux
- CVE-2026-89733usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()Linux
- CVE-2026-89731cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register readLinux
- CVE-2026-89729HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_featureLinux
- CVE-2026-89725media: cec: stm32: prevent out-of-bounds write on RX overflowLinux
- CVE-2026-89724media: vicodec: fix out-of-bounds write in FWHT encoderLinux
- CVE-2026-89723nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncationLinux
- CVE-2026-89720ubifs: fix out-of-bounds read in signature length checkLinux
- CVE-2026-89711NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_checkLinux
- CVE-2026-89709lockd, nfsd: RCU-protect nlmsvc_ops dispatchLinux
- CVE-2026-89707nfsd: release path refs on follow_down() errorLinux
- CVE-2026-89706nfsd: Reset write verifier when async COPY writeback failsLinux
- CVE-2026-89705nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit pathsLinux
- CVE-2026-89704nfsd: sample writeback error cursor before async COPY loopLinux
- CVE-2026-89699nfsd: validate symlink target length in NFSv4 CREATELinux
- CVE-2026-89696nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL derefLinux
- CVE-2026-89695nfsd: cap decoded POSIX ACL count to bound sort costLinux
- CVE-2026-89692nfsd: clear CALLBACK_RUNNING on failed delegation recall queueLinux
- CVE-2026-89691nfsd: clear opcnt on compound arg release to prevent OOB readLinux
- CVE-2026-89690nfsd: defer vfree of compound ops to fix rpc_status UAFLinux
- CVE-2026-89687nfsd: ensure nfsd_file_do_acquire() does not use a non-opened fileLinux
- CVE-2026-89685nfsd: fix clock domain mismatch in clients_still_reclaiming()Linux
- CVE-2026-89684nfsd: fix cpntf publish race in nfs4_init_cp_stateLinux
- CVE-2026-89682nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_netLinux
- CVE-2026-89680nfsd: fix nfsd_file leak on inter-server COPY setup failureLinux
- CVE-2026-89679nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrsLinux
- CVE-2026-89678nfsd: fix partial-write detection in nfsd_direct_writeLinux
- CVE-2026-89670nfsd: hold rcu across localio cmpxchg retryLinux
- CVE-2026-89668nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()Linux
- CVE-2026-89667nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecacheLinux
- CVE-2026-89665nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATELinux
- CVE-2026-89664nfsd: release OPEN-decoded posix ACLs via op_releaseLinux
- CVE-2026-89663nfsd: revoke copy-notify stateids before dropping their referenceLinux
- CVE-2026-89657libceph: validate OSD extent maps before cursor advanceLinux
- CVE-2026-89648ceph: cap delegated inode count in ceph_parse_deleg_inos()Linux
- CVE-2026-89647ceph: do not repeat ceph_trim_dentries() if no progress possibleLinux
- CVE-2026-89646ceph: fix leaked inode reference on writeback abort at umountLinux
- CVE-2026-89641cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()Linux
- CVE-2026-89640cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0Linux
- CVE-2026-89639cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNCLinux
- CVE-2026-89638smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensionsLinux
- CVE-2026-89632smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()Linux
- CVE-2026-89626HID: sensor: custom: Fix field sysfs group cleanup on failureLinux
- CVE-2026-89624HID: universal-pidff: stop the device when force-feedback init failsLinux
- CVE-2026-89622HID: mcp2221: clear rxbuf after I2C/SMBus transfer completesLinux
- CVE-2026-89620HID: intel-thc-hid: intel-quickspi: validate report size before copyLinux
- CVE-2026-89619HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller bufferLinux
- CVE-2026-89617fs/ntfs3: validate dirty page table on log replayLinux
- CVE-2026-89616fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()Linux
- CVE-2026-89615fs/ntfs3: bound page_lcns[] index by the log recordLinux
- CVE-2026-89609ecryptfs: hold msg ctx list lock when cleaning daemon queueLinux
- CVE-2026-89608ecryptfs: pass packet set buffer size to parserLinux
- CVE-2026-89607ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packetLinux
- CVE-2026-89606ecryptfs: reject too-small tag 70 packetsLinux
- CVE-2026-89605ecryptfs: release message context on send failureLinux
- CVE-2026-89602erofs: skip sufficiently large global buffers when resizingLinux
- CVE-2026-89601ext2: Fix lost inode updates for IS_SYNC inodesLinux
- CVE-2026-89600fanotify: fix use-after-free of file range infoLinux
- CVE-2026-89599fbdev: omapfb: panel-dsi-cm: initialize lock before registering displayLinux
- CVE-2026-89597fbdev: uvesafb: unregister connector callback on init failureLinux
- CVE-2026-89596forcedeth: fix off-by-one when saving/restoring non-PCI config spaceLinux
- CVE-2026-89594hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller deviceLinux
- CVE-2026-89593hugetlb: only adjust reservation during unmapping if mapcount is 0Linux
- CVE-2026-89588ACPI: APEI: GHES: fix ARM section length accounting after headerLinux
- CVE-2026-89587ACPI: pfr_update: fix stack buffer overflow in query_capability()Linux
- CVE-2026-89586ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytesLinux
- CVE-2026-89585auxdisplay: charlcd: cancel backlight work on registration failureLinux
- CVE-2026-89584block: validate user space vectors during extractionLinux
- CVE-2026-89583Bluetooth: eir: Fix OOB read in eir_get_service_data()Linux
- CVE-2026-89581bpf, x86: Fix per-CPU address resolution into an extended registerLinux
- CVE-2026-89580bpf: Disable preemption in __bpf_get_stackLinux
- CVE-2026-89579bpf: Harden bloom filter sizing and indexing on 32-bit kernelsLinux
- CVE-2026-89574dm array: validate array block headers on readLinux
- CVE-2026-89573dm array: reject an array block whose value size is not the caller'sLinux
- CVE-2026-89571cxl/features: bound fwctl command payload to the input bufferLinux
- CVE-2026-54135AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP ServerSimulPiscator AirSane
- CVE-2026-89570cxl/mce: Make the MCE notifier per-regionLinux
- CVE-2026-89569Bluetooth: RFCOMM: serialize security confirmation handlingLinux
- CVE-2026-89564ip: orphan prefetched skbs before multicast forwardingLinux
- CVE-2026-89563ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()Linux
- CVE-2026-89562ip6_gre: fix hardware header length for NBMA tunnelsLinux
- CVE-2026-89561ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()Linux
- CVE-2026-89560landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creationLinux
- CVE-2026-89559libnvdimm/labels: Prevent integer overflow in __nd_label_validate()Linux
- CVE-2026-89557md: do overflow check for sb->bblog_shift in super_1_load()Linux
- CVE-2026-89554mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstructionLinux
- CVE-2026-89553nouveau/gem: reserve the bo in the info ioctl around the vma lookupLinux
- CVE-2026-89549sunrpc: route to a populated pool in svc_pool_for_cpu()Linux
- CVE-2026-89548SUNRPC: always drain cache_cleaner before destroying a cache_detailLinux
- CVE-2026-89547SUNRPC: Check svc pool percpu counter allocationLinux
- CVE-2026-89545sunrpc: defer rq_argp and rq_resp free until after RCU grace periodLinux
- CVE-2026-89544SUNRPC: fix gssx_dec_option_array error path bugsLinux
- CVE-2026-89540sunrpc: init gssp_lock before publishing proc entryLinux
- CVE-2026-89535svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_idLinux
- CVE-2026-89534svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement failsLinux
- CVE-2026-89528svcrdma: Reject Read lists that exceed the page budgetLinux
- CVE-2026-89524wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsetsLinux
- CVE-2026-89523wifi: mt76: mt7925: cancel pending mlo_pm_workLinux
- CVE-2026-89522media: staging/ipu7: fix async notifier UAF on probe error pathLinux
- CVE-2026-89521sched/core: Handle pick_task() releasing the rq lockLinux
- CVE-2026-89520sched/core: Make core-sched flips wait for in-flight selectionsLinux
- CVE-2026-89513RISC-V: KVM: Fix PMU event info array size overflowLinux
- CVE-2026-89511qede: Fix NULL pointer dereference in TPA fragment processingLinux
- CVE-2026-89510RDMA/cxgb4: Cancel reg_work before freeing device on removeLinux
- CVE-2026-89508RDMA/ucma: Lock the handler in ucma_set_ib_path()Linux
- CVE-2026-89507RDMA/ucma: Lock the handler in ucma_write_cm_event()Linux
- CVE-2026-89504regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointerLinux
- CVE-2026-89503ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()Linux
- CVE-2026-89501ring-buffer: Hold cpu_buffer::lock when resizing a subbufLinux
- CVE-2026-89500ring-buffer: Make cpu_buffer::free_page a buffer_data_read_pageLinux
- CVE-2026-89499ring-buffer: Stop remote reader update when page swap failsLinux
- CVE-2026-89497orangefs: skip leading spaces before parsing client debug masksLinux
- CVE-2026-89493ocfs2: validate rl_used against rl_count in refcount block validatorLinux
- CVE-2026-89489openrisc: fix arbitrary kernel memory access via or1k_atomic syscallLinux
- CVE-2026-89488openvswitch: Fix CT limit teardown use-after-freeLinux
- CVE-2026-89487openvswitch: only skb_tx_error() a packet we are about to dropLinux
- CVE-2026-89486ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()Linux
- CVE-2026-89483nvme: zero the discard fallback pageLinux
- CVE-2026-89481nvme-tcp: fix host memory disclosure on R2T for a read commandLinux
- CVE-2026-89480nvme-tcp: reject a read that transferred too few bytesLinux
- CVE-2026-89477sctp: fix NULL deref on untransmitted RECONF completionLinux
- CVE-2026-89476sctp: fix stream->outcnt underflow on duplicate RECONF responsesLinux
- CVE-2026-89472power: supply: charger-manager: register regulators before exposing sysfsLinux
- CVE-2026-89471power: supply: cros_usbpd-charger: bound the EC-reported port countLinux
- CVE-2026-89470power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTSLinux
- CVE-2026-89469power: supply: lp8727: fix use-after-free in lp8727_release_irq()Linux
- CVE-2026-89466power: supply: qcom_battmgr: terminate the strings from firmwareLinux
- CVE-2026-89465power: supply: rt9455: quiesce delayed work before teardownLinux
- CVE-2026-89459s390/percpu: Fix MVIY_PERCPU() with older binutilsLinux
- CVE-2026-89456s390/dasd: Propagate partial completion length across ERP recoveryLinux
- CVE-2026-89452iommu/msm: Unwind probe state on registration failureLinux
- CVE-2026-89450iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH fieldLinux
- CVE-2026-89445iommufd: Fix UAF in selftest IOPF reportingLinux
- CVE-2026-89443platform/x86: ISST: Validate level in perf mask ioctlsLinux
- CVE-2026-89442platform/x86: ISST: Validate socket ID in clos_assoc ioctlLinux
- CVE-2026-89441mmc: via-sdmmc: cancel card-detect work on removeLinux
- CVE-2026-89440mmc: via-sdmmc: stop card-detect handling on probe failureLinux
- CVE-2026-89436platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]Linux
- CVE-2026-81017platform/chrome: sensorhub: Bound the EC-reported sensor numberLinux
- CVE-2026-81016platform/x86/amd/pmc: Propagate SMU errors and validate S2D addressLinux
- CVE-2026-81015platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init failsLinux
- CVE-2026-81012platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()Linux
- CVE-2026-81011platform/x86: hp-bioscfg: pass validated element count to package parsersLinux
- CVE-2026-81008interconnect: Fix use after free in icc_get() and of_icc_get_by_index()Linux
- CVE-2026-81007ipmi: ipmb: validate write message lengthLinux
- CVE-2026-81006ipmi: Remove all sysfs files on registration failureLinux
- CVE-2026-81004ipmi:msghandler: Cancel work cleanly on an errorLinux
- CVE-2026-81003net/iucv: filter frames in afiucv_hs_rcv() by ingress deviceLinux
- CVE-2026-81001slip: fix use-after-free in sl_sync()Linux
- CVE-2026-81000net: tun: bound receive headroomLinux
- CVE-2026-80998net: bnxt: ring the doorbell when SW USO exits earlyLinux
- CVE-2026-80997net: ipa: fix stalled modem TX queue after runtime resumeLinux
- CVE-2026-80995net: mctp: hold a reference to the route device in mctp_route_lookup()Linux
- CVE-2026-80994net: openvswitch: fix flow mask use-after-free on flow deletionLinux
- CVE-2026-80992net: ravb: avoid dereferencing an invalid PTP clockLinux
- CVE-2026-80991net: ravb: serialize PTP clock teardownLinux
- CVE-2026-80989net: thunderbolt: Mark the connection down when bringing it up failsLinux
- CVE-2026-80987NTB: ntb_transport: Reject oversized TX buffersLinux
- CVE-2026-80985net/smc: carry oversized SMC-Rv2 LLC messages in the queue entryLinux
- CVE-2026-80982net/smc: fix use-after-free in smc_rx_pipe_buf_release()Linux
- CVE-2026-80979net/smc: unregister the connection before draining the rx taskletLinux
- CVE-2026-80978net: cap advertised IP tunnel headroomLinux
- CVE-2026-80977net: skbuff: don't touch shared zerocopy state in skb_tx_error()Linux
- CVE-2026-80975mfd: qnap-mcu: keep the reply buffer alive past a command timeoutLinux
- CVE-2026-80971ALSA: bcd2000: clear the URB pointers on disconnectLinux
- CVE-2026-80967ALSA: pcxhr: initialize mutexes before requesting threaded IRQLinux
- CVE-2026-80962dm-pcache: validate geometry fields from on-disk cache_infoLinux
- CVE-2026-80961dm-pcache: validate kset key_num and intra-segment boundsLinux
- CVE-2026-80959dm-pcache: bound the persisted tail-position offsetLinux
- CVE-2026-80958dm-pcache: clamp the tail kset read to the segment data regionLinux
- CVE-2026-80955dm-pcache: fix use-after-free and invalid seg operations in kset_replay()Linux
- CVE-2026-80954i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode()Linux
- CVE-2026-80953i3c: master: adi: initialize the lock before enabling interruptsLinux
- CVE-2026-80952i3c: master: Fix info leak and UAF in device unregister pathLinux
- CVE-2026-80950i3c: renesas: Check that the transfer is valid before accessing itLinux
- CVE-2026-80947wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stopLinux
- CVE-2026-80944wifi: mwifiex: Detach sync cmd buffer on interrupted waitLinux
- CVE-2026-80943wifi: rtlwifi: rtl8192du: check QoS TID before indexing tidsLinux
- CVE-2026-80937wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copyLinux
- CVE-2026-80936wifi: mt76: mt7925: cancel mlo_pm_work on stopLinux
- CVE-2026-80935wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copyLinux
- CVE-2026-80933wifi: mt76: mt7996: validate default EEPROM firmware sizeLinux
- CVE-2026-80932vsock/virtio: flush works in dependency orderLinux
- CVE-2026-80931w1: ds28e17: reject an oversize length on an I2C block readLinux
- CVE-2026-80929sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]Linux
- CVE-2026-80928smack: fix cred UAF in smack_file_send_sigiotask()Linux
- CVE-2026-62089WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerabilityPixar Labs Master Addons for Elementor
- CVE-2026-62112WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerabilityMelograno Venture Studio Amelia
- CVE-2026-62109WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerabilitywowDevs Sky Addons for Elementor
- CVE-2026-62107WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerabilityMasteriyo - LMS
- CVE-2026-62106WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-62102WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerabilityGato GraphQL
- CVE-2026-67211Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializerApache Software Foundation org.apache.opennlp:opennlp-symsp…
- CVE-2026-89099Race Condition in MongoDB Server Document Value Layer Leads to Memory CorruptionMongoDB Server
- CVE-2026-72708SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.htmlSPIP
- CVE-2026-89066OS command injection in the task synthesis component in projenAWS projen
- CVE-2026-89065Relative path traversal in the generated file manifest cleanup component in projenAWS projen
- CVE-2026-7863OS Command Injection in TUBITAK BILGEM's Pardus SoftwareTUBITAK BILGEM Software Technologies Research Institute Par…
- CVE-2026-89013Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.phpDolibarr
- CVE-2026-70341Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-68497jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of servicecom.fasterxml.jackson.core:jackson-databind · FasterXML… +1
- CVE-2026-89012Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterDolibarr
- CVE-2026-89262MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Checkmoxi624 MoguBlog
- CVE-2026-89260MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpointmoxi624 MoguBlog
- CVE-2026-89009WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_serverWAVLINK Technology WN535M1 · WAVLINK Technology WN535M3
- CVE-2026-38056ST Engineering iDirect iQ-Series Terminals Missing AuthorizationST Engineering iDirect Evolution iQ‑Series terminals · S… +1
- CVE-2026-38058ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control SphereST Engineering iDirect Evolution iQ‑Series terminals · S… +1
- CVE-2026-8301OS Command Injection in TUBITAK BILGEM's Pardus-boot-repairTUBITAK BILGEM Software Technologies Research Institute Par…
- CVE-2026-85979Command Injection in Puppet EnterprisePerforce Software Puppet Enterprise
- CVE-2026-82578NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity ReferenceNextGen Healthcare Mirth Connect
- CVE-2026-78224NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity ReferenceNextGen Healthcare Mirth Connect
- CVE-2026-82583NextGen Healthcare Mirth Connect SQL InjectionNextGen Healthcare Mirth Connect
- CVE-2026-8303Privilege Escalation in TUBITAK BILGEM's Pardus-softwareTUBITAK BILGEM Software Technologies Research Institute Par…
- CVE-2026-87020Orthanc DICOM Server Integer Overflow or WraparoundOrthanc DICOM Server
- CVE-2026-57842NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlenThe NetBSD Foundation NetBSD
- CVE-2026-71416Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)headroomlabs-ai headroom · headroom-ai
- CVE-2026-87776compression vulnerable to Denial of Service via memory leak on premature response closecompression
- CVE-2026-89252AVideo Missing Authorization in addLiveLink.php LiveLink UpdateWWBN AVideo
- CVE-2026-89251AVideo Missing Authorization via AD_Server log.php Wallet CreditWWBN AVideo
- CVE-2026-89250WWBN AVideo Unauthenticated File Read via getRecordedFile.phpWWBN AVideo
- CVE-2026-89245WWBN AVideo Cross-Site Request Forgery via playlistRemove.phpWWBN AVideo
- CVE-2026-89147Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX ReadNet-SNMP
- CVE-2026-89146libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responseslibp2p-rendezvous
- CVE-2026-17037Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-80469CVE-2026-80469SICK AG Sentio Creator Extension 'Device Manager'
- CVE-2026-19486SSRF in Gemini Enterprise Agent Platform App BuilderGoogle Cloud Gemini Enterprise Agent Platform App Builder
- CVE-2025-15679BMC root account active without password on BullSequana XH3406 and XH3515BullSequana XH3406 · BullSequana XH3515
- CVE-2026-89178Howyar｜WeenyGenius - Origin Validation ErrorHowyar WeenyGenius
- CVE-2026-89177Howyar｜WeenyGenius - Use of Insecure ProtocolHowyar WeenyGenius
- CVE-2026-89176Howyar｜WeenyGenius - Missing AuthenticationHowyar WeenyGenius
- CVE-2026-89174Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force ProtectionKingdom Communication Associated EH3040 · Kingdom Commun… +2
- CVE-2026-73785HPE IceWall Federation Agent and Proxy, Denial of Service vulnerabilityHewlett Packard Enterprise HPE IceWall products
- CVE-2026-87908multiparty vulnerable to Denial of Service via unbounded part-header accumulationmultiparty
- CVE-2026-73784HPE IceWall products, Remote Bypass of Security RestrictionsHewlett Packard Enterprise HPE IceWall products
- CVE-2026-85677Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment ContentGutenverse News
- CVE-2026-74925MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to AdministratorMultiVendorX
- CVE-2026-89060Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated…multicluster-observability-addon · Red Hat Advanced Cluster…
- CVE-2026-89161In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context.PCRE2
- CVE-2026-19991UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletionstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-81754Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scriptingfernandot Vigilant – 100% Free Security Suite: Firewall, 2F…
- CVE-2026-18561Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injectionunitecms Unlimited Elements For Elementor
- CVE-2026-81825Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scriptingspecialk Simple Ajax Chat – Add a Fast, Secure Chat Box
- CVE-2026-15462Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injectiongingerplugins Sticky Chat Widget – Floating Chat Icons, Con…
- CVE-2026-18579WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scriptingopajaap WP Photo Album Plus
- CVE-2026-88260Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in…Brainzcompany Zenius EMS
- CVE-2026-78134strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or…strongSwan
- CVE-2026-78133libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.strongSwan
- CVE-2026-78132strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.strongSwan
- CVE-2026-78130strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.strongSwan
- CVE-2026-71641An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a…
- CVE-2026-71646An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a…
- CVE-2026-78807An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA…
- CVE-2026-79362Certain Woltlab products are affected by RCE via Cache Poisoning.
- CVE-2026-79393A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP…
- CVE-2026-79394An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware…
Medium, low and unrated 300
- CVE-2026-90457The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, aCISA Malcolm
- CVE-2026-90455Dependency on vulnerable third-party component in MalcolmCISA Malcolm
- CVE-2026-90454Missing authorization in MalcolmCISA Malcolm
- CVE-2026-90453Open Redirect in MalcolmCISA Malcolm
- CVE-2026-90452Improper certificate validation in MalcolmCISA Malcolm
- CVE-2026-90450Incorrect Authorization in MalcolmCISA Malcolm
- CVE-2026-90449Missing Authentication for Critical Function in MalcolmCISA Malcolm
- CVE-2026-90446Server-Side Request Forgery in MalcolmCISA Malcolm
- CVE-2026-90443Cross-site Scripting in MalcolmCISA Malcolm
- CVE-2026-90461OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) BOpenStack Ironic
- CVE-2026-54258Cross-monitor event media authorization bypass in direct event media endpointszoneminder
- CVE-2026-49992Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changeskimai · kimai/kimai
- CVE-2026-50018Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsSpectoLabs hoverfly · github.com/SpectoLabs/hoverfly
- CVE-2026-54248Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configurationkimdre doco-cd
- CVE-2026-48496opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentopen-telemetry opentelemetry-ebpf-profiler · go.opentelemet…
- CVE-2026-45056Matrix Rust SDK: Sender-binding gaps in to-device and room-key attributionmatrix-org matrix-rust-sdk · matrix-sdk-crypto
- CVE-2026-45057matrix-sdk-ui: Incomplete edit validationmatrix-org matrix-sdk-ui · matrix-sdk-ui
- CVE-2026-49865Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLskimai · kimai/kimai
- CVE-2026-48490ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handlerArduinoCore-avr
- CVE-2026-54165Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)smgdkngt dobase
- CVE-2026-49439OpenRemote read-only asset users can write predicted datapointsopenremote · io.openremote:openremote-manager
- CVE-2026-50025Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie statet-mart mousehole
- CVE-2026-81907Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all…Concrete CMS
- CVE-2026-81918Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockConcrete CMS
- CVE-2026-81917Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tagsConcrete CMS
Show all 300 entriesShow fewer entries
- CVE-2026-68535Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor…Concrete CMS
- CVE-2026-81916Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized ObjectConcrete CMS
- CVE-2026-49462nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by defaultnl.nl-portal:app
- CVE-2026-89773drm/amd/display: Skip Update HDCP Config In Transition StateLinux
- CVE-2026-89772btrfs: write-protect folios during data writebackLinux
- CVE-2026-89770iomap: don't free integrity payload that doesn't existLinux
- CVE-2026-89768fs: fix user path of nested backing filesLinux
- CVE-2026-89766pidfd: hold exec_update_lock around namespace ioctlLinux
- CVE-2026-89765timers/itimer: Zero-init old itimerval before copy to userspaceLinux
- CVE-2026-89759mm/kmemleak: avoid soft lockup when scanning task stacksLinux
- CVE-2026-89757mm/mglru: fix and remove redundant unevictable folio handlingLinux
- CVE-2026-89756mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()Linux
- CVE-2026-89753mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()Linux
- CVE-2026-89752mm: memcg: stop reclaim when a limit update is supersededLinux
- CVE-2026-89751x86/tdx: Fix off-by-one in port I/O handlingLinux
- CVE-2026-89749tracing: Fix crash passing ERR_PTR to kthread_stop()Linux
- CVE-2026-89745debugfs: Fix lockdown check for mmap_prepareLinux
- CVE-2026-89740serial: imx: serialize imx_uart_ports[] lifetimeLinux
- CVE-2026-89739usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race conditionLinux
- CVE-2026-89737usb: typec: thunderbolt: Disable work before freeing tbt on removeLinux
- CVE-2026-89735usb: gadget: midi2: remove default configfs groups on teardownLinux
- CVE-2026-89734usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()Linux
- CVE-2026-89732usb: gadget: f_fs: Prevent deadlock during ep0 read loopLinux
- CVE-2026-89730fpga: altera-cvp: Avoid out-of-bounds read in trailing byte writeLinux
- CVE-2026-89728i3c: renesas: Fix out-of-bounds access for newdevs maskLinux
- CVE-2026-89727KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTIDLinux
- CVE-2026-89726lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()Linux
- CVE-2026-89722PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()Linux
- CVE-2026-89721phy: rockchip-samsung-dcphy: fix out-of-range max_registerLinux
- CVE-2026-89719zram: fix out-of-bounds access in read_block_state()Linux
- CVE-2026-89718zram: fix out-of-bounds access in writeback_store()Linux
- CVE-2026-89717zram: set default primary compressor in zram_destroy_comps()Linux
- CVE-2026-89716zram: validate deflate paramsLinux
- CVE-2026-89715NFS/localio: fix ref leak on nfs_uuid_add_file failureLinux
- CVE-2026-89714NFS: fix delegation_hash_table leak when nfs4_server_common_setup() failsLinux
- CVE-2026-89710NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget pathLinux
- CVE-2026-89701nfsd: validate nseconds in TIME_DELEG decode pathsLinux
- CVE-2026-89700nfsd: validate sockaddr length per family in listener_setLinux
- CVE-2026-89698nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storageLinux
- CVE-2026-89694nfsd: check client ownership when cancelling a copy-notify stateidLinux
- CVE-2026-89693nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()Linux
- CVE-2026-89683nfsd: fix dentry ref leak on V4ROOT export filehandle lookupLinux
- CVE-2026-89673nfsd: fix XDR padding calculation in ff_encode_getdeviceinfoLinux
- CVE-2026-89666nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create opsLinux
- CVE-2026-89661NFSD: Prevent post-shutdown use-after-free in unlock_filesystemLinux
- CVE-2026-89645btrfs: drop recovered reloc root refs on recovery failureLinux
- CVE-2026-89644btrfs: fix extent map leak in NOCOW direct I/O writeLinux
- CVE-2026-89642cifs: call pagecache_isize_extended() in cifs_setsize() when extendingLinux
- CVE-2026-89629HID: corsair-void: Check size of status and firmware events before reading themLinux
- CVE-2026-89628HID: picolcd: clamp eeprom debugfs read to bytes actually receivedLinux
- CVE-2026-89627HID: roccat: free buffered reports when destroying deviceLinux
- CVE-2026-89625HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbindLinux
- CVE-2026-89623HID: mcp2221: stop device IO before hid_hw_stopLinux
- CVE-2026-89621HID: mcp2221: validate report size in mcp2221_raw_event()Linux
- CVE-2026-89618eventfs: Initialize ei->children and ei->list in init_ei()Linux
- CVE-2026-89604efivarfs: Rate limit statfs() handlerLinux
- CVE-2026-89598fbdev: ssd1307fb: defer I2C transfers from damage callbacksLinux
- CVE-2026-89595fsnotify: Fix stale object mask after concurrent mark updatesLinux
- CVE-2026-89592accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()Linux
- CVE-2026-89591accel/rocket: initialize job domain before cleanup pathsLinux
- CVE-2026-89590accel/rocket: Fix error path handling in rocket_job_run()Linux
- CVE-2026-89589acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locksLinux
- CVE-2026-89582bnx2x: fix double free in bnx2x_init_firmware() error pathLinux
- CVE-2026-89578dm-io: clone the source bio instead of copying its biovecLinux
- CVE-2026-89577dm-io: report non-retryable errors separatedlyLinux
- CVE-2026-89576dm-era: fix shadowed superblock leak on take-snap failureLinux
- CVE-2026-89575dm raid1: reserve space for NUL-terminator in build_constructor_string()Linux
- CVE-2026-89572cpufreq: apple-soc: Fix OPP table cleanupLinux
- CVE-2026-89568kho: fix size calculation in kho_preserved_memory_reserve()Linux
- CVE-2026-89567jbd2: bound shrinker scans by examined checkpoint buffersLinux
- CVE-2026-89566jbd2: check need_resched() when skipping busy checkpoint buffersLinux
- CVE-2026-89565ipip: fix skb leak in collect_md mode when metadata_dst allocation failsLinux
- CVE-2026-89556module: validate string table section typesLinux
- CVE-2026-89552params: fix charp corruption on allocation failureLinux
- CVE-2026-89543sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedirLinux
- CVE-2026-89539SUNRPC: reject duplicate CREDS_VALUE optionsLinux
- CVE-2026-89531svcrdma: Reject connection when transport allocation failsLinux
- CVE-2026-89529svcrdma: Reject oversized Read segments at decode timeLinux
- CVE-2026-89527svcrdma: Use svc_xprt_put to free listener on create failureLinux
- CVE-2026-89525udf: reject VAT indexes equal to the entry countLinux
- CVE-2026-89519sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict returnLinux
- CVE-2026-89518sched_ext: Fix this_rq() assumptions in dispatch kfuncsLinux
- CVE-2026-89517sched_ext: Fix rq->core_pick corruption under core schedulingLinux
- CVE-2026-89516sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_usersLinux
- CVE-2026-89515scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()Linux
- CVE-2026-89514scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlockLinux
- CVE-2026-89512remoteproc: scp: Fix device reference leak on failed lookupLinux
- CVE-2026-89509RDMA/ionic: Embed counter driver data in rdma_counter allocationLinux
- CVE-2026-89506RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MRLinux
- CVE-2026-89505RDMA/uverbs: Guard legacy bundles without method_elmLinux
- CVE-2026-89502ring-buffer: Free cpu_buffer::free_page with subbuf_orderLinux
- CVE-2026-89498orangefs: fix double-free of trailer_buf on readdir copy failureLinux
- CVE-2026-89496ocfs2: always run deallocs on copy-on-write completionLinux
- CVE-2026-89491ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()Linux
- CVE-2026-89490ocfs2: fix readdir position truncation on 32-bit kernelsLinux
- CVE-2026-89484lockd: fix NULL dereference on lockowner allocation failureLinux
- CVE-2026-89475power: supply: bq24257: fix use-after-free on removeLinux
- CVE-2026-89474power: supply: bq256xx: drain usb_work before freeing the chargerLinux
- CVE-2026-89473power: supply: bq25890: Fix power_supply reference leakLinux
- CVE-2026-89468power: supply: lp8788-charger: fix use-after-free on removeLinux
- CVE-2026-89467power: supply: qcom_battmgr: fix use-after-freeLinux
- CVE-2026-89464power: supply: twl4030_charger: cancel workers via devmLinux
- CVE-2026-89463power: supply: ucs1002: fix use-after-free on removeLinux
- CVE-2026-89462power: supply: max17040: propagate register read errorsLinux
- CVE-2026-89461power: supply: max17040: synchronize work cancellation on suspendLinux
- CVE-2026-89460s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacksLinux
- CVE-2026-89458s390/dasd: Do not complete a failed ESE read as successfulLinux
- CVE-2026-89457s390/dasd: Guard sysfs discipline callbacks against unallocated private dataLinux
- CVE-2026-89455PCI: plda: Fix use-after-free of event IRQs during teardownLinux
- CVE-2026-89454PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()Linux
- CVE-2026-89453iommu/amd: Put PCI device after handling PPR faultsLinux
- CVE-2026-89451iommu/sva: Set handle->dev before the SVA handle is visibleLinux
- CVE-2026-89449iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_addLinux
- CVE-2026-89447iommufd: Avoid locking internal accesses during unmapLinux
- CVE-2026-89446iommufd: Release current IOAS on xa_store() failureLinux
- CVE-2026-89444platform/x86: dell-wmi-sysman: Don't hex dump attribute security bufferLinux
- CVE-2026-89439platform/x86: ISST: Add a NULL check for sst_inst[]Linux
- CVE-2026-89438platform/x86: ISST: Validate logical CPU id and clos idLinux
- CVE-2026-89437platform/x86: int1092: Fix potential memory leak in sar_probe()Linux
- CVE-2026-81018platform/x86: think-lmi: Free system certificate signaturesLinux
- CVE-2026-81014platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()Linux
- CVE-2026-81013platform/x86: hp-bioscfg: fix heap OOB read on empty password writeLinux
- CVE-2026-81005ipmi: si: Fix NULL pointer dereference after failed registrationLinux
- CVE-2026-80999net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIOLinux
- CVE-2026-80996net: l2tp: do not propagate multicast notification errorsLinux
- CVE-2026-80993net: phylink: correctly validate returned PCS in phylink_inband_capsLinux
- CVE-2026-80990net: thunderbolt: Release the Rx HopID that was handed out on mismatchLinux
- CVE-2026-80988NTB: ntb_transport: Fail TX enqueue when the QP link is downLinux
- CVE-2026-80984net/smc: do not dereference an unset send buffer on the SMC-D teardown pathLinux
- CVE-2026-80983net/smc: fix socket refcount leak in smc_switch_conns()Linux
- CVE-2026-80974mfd: sm501: Fix potential memory leaks during removeLinux
- CVE-2026-80973ALSA: 6fire: bound the MIDI event length from the deviceLinux
- CVE-2026-80972ALSA: aloop: Check card index validity at probeLinux
- CVE-2026-80970ALSA: FCP: do not copy out an uninitialised init responseLinux
- CVE-2026-80969ALSA: mpu401: Check card index validity at probeLinux
- CVE-2026-80968ALSA: mts64: Check card index validity at probeLinux
- CVE-2026-80966ALSA: portman2x4: Check card index validity at probeLinux
- CVE-2026-80965ALSA: serial-u16550: Check card index validity at probeLinux
- CVE-2026-80964ALSA: virmidi: Check card index validity at probeLinux
- CVE-2026-80963dm-stats: fix a crash if allocation of per-cpu data failsLinux
- CVE-2026-80960dm-pcache: validate on-media seg_num against the cache device sizeLinux
- CVE-2026-80957dm-pcache: detect a cycle in the last-kset chain during replayLinux
- CVE-2026-80956dm-pcache: only hand out initialized cache segmentsLinux
- CVE-2026-80951i3c: master: svc: bound IBI payload to the requested max_payload_lenLinux
- CVE-2026-80949wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()Linux
- CVE-2026-80948wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()Linux
- CVE-2026-80946fuse: copy request headers via a stack buffer for io-uringLinux
- CVE-2026-80942wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars()Linux
- CVE-2026-80941wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()Linux
- CVE-2026-80940wifi: rtw88: pci: fix resource leak on failed NAPI setupLinux
- CVE-2026-80939wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on rebootLinux
- CVE-2026-80938wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutexLinux
- CVE-2026-80934wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req framesLinux
- CVE-2026-80930tpm: tpm_i2c_nuvoton: disable IRQ on wait timeoutLinux
- CVE-2026-80927timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex()Linux
- CVE-2026-81915In Concrete CMS below 9.5.3, Page Type update omits object-level authorizationConcrete CMS
- CVE-2026-77490Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-68526Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controllerConcrete CMS
- CVE-2026-81913Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.Concrete CMS
- CVE-2026-49463NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-librariesnl.nl-portal:besluiten · nl.nl-portal:documenten-api
- CVE-2026-81912Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups featureConcrete CMS
- CVE-2026-81911Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary DescriptionConcrete CMS
- CVE-2026-78546Out-of-Bounds ReadCitirx Workspace app for Windows
- CVE-2026-78547Out-of-Bounds WriteCitrix Workspace app for Windows
- CVE-2026-89332Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationAWS Kiro IDE
- CVE-2026-89329Device-mapper-multipath: local denial of service via blocking ipc send operationsRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-62088WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability10up ElasticPress
- CVE-2026-81910Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style ValuesConcrete CMS
- CVE-2026-62139WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerabilitySite Kit by Google
- CVE-2026-62138WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerabilityVisual Composer Website Builder
- CVE-2026-62137WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerabilityJohn James Jacoby bbPress
- CVE-2026-62136WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerabilitywpdesk Flexible Quantity – Measurement Price Calculator for…
- CVE-2026-62135WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerabilityArraytics Booktics
- CVE-2026-62134WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerabilityBrainstorm Force Starter Templates
- CVE-2026-62133WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityrometheme RTMKit
- CVE-2026-62132WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerabilityMasteriyo - LMS
- CVE-2026-62114WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerabilityWP Chill Passster
- CVE-2026-62113WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerabilityAnh Tran Slim SEO
- CVE-2026-62111WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityIdo Kobelkowsky Simple Payment
- CVE-2026-62110WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
- CVE-2026-27378WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerabilitymagepeopleteam Deposits and Partial Payments for WooCommerce
- CVE-2026-62140WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2026-81909Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to…Concrete CMS
- CVE-2026-18495Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthroughRed Hat Hardened Images · Red Hat Ceph Storage +1
- CVE-2026-68528Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item titleConcrete CMS
- CVE-2026-7298Reflected XSS in IdeaSoft's Smart E-CommerceIdeaSoft Software Industry and Trade Smart E-Commerce
- CVE-2026-87910tarfile hardlink fallback ignores custom extraction filter rejection via NonePython Software Foundation CPython · libpython +2
- CVE-2026-18122Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing AuthorizationConcrete CMS
- CVE-2026-81908Missing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All GroupsConcrete CMS
- CVE-2026-82535Chamilo LMS Stored XSS via Survey Answer Submission in reporting.phpchamilo-lms
- CVE-2026-9160CSTI in Arma Digital's Website TemplateArma Digital Media Website Template
- CVE-2026-89090Denial of service in the event stream header decoder in AWS SDK for Go v2AWS SDK for Go · github.com/aws/aws-sdk-go-v2/aws/proto… +11
- CVE-2026-18061Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePluginAWS Advanced JDBC Wrapper
- CVE-2026-8304Information Disclosure in TUBITAK BILGEM's Pardus AboutTUBITAK BILGEM Software Technologies Research Institute Par…
- CVE-2026-15439GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injectionrubengc GamiPress – Gamification plugin to reward points, b…
- CVE-2026-89265MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpointmoxi624 MoguBlog
- CVE-2026-89264MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identitymoxi624 MoguBlog
- CVE-2026-89263MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpointmoxi624 MoguBlog
- CVE-2026-89261MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpointsmoxi624 MoguBlog
- CVE-2026-81861CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized…Schneider Electric SCADAPack
- CVE-2026-85083CareCam Pro IP Cameras Use of Hard-coded CredentialsCareCam ANJIA AJL33PC0801 Firmware
- CVE-2026-15710Netskope Client Endpoint DLP Kernel Driver Information LeakageNetskope Endpoint DLP
- CVE-2026-57843NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information DisclosureThe NetBSD Foundation NetBSD
- CVE-2026-89298Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration getRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-11765Argument Injection in TUBITAK BILGEM's Pardus PenTUBITAK BILGEM Software Technologies Research Institute Par…
- CVE-2024-12145BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications DeletionBuddyPress
- CVE-2026-89257AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership CheckWWBN AVideo
- CVE-2026-89248AVideo WebRTC Plugin Information Disclosure via status.json.phpWWBN AVideo
- CVE-2026-89247WWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpWWBN AVideo
- CVE-2026-89246WWBN AVideo CSV Formula Injection via myComments.download.phpWWBN AVideo
- CVE-2026-89244WWBN AVideo Reflected XSS via Gallery Category getBackURLWWBN AVideo
- CVE-2026-89242WWBN AVideo Unauthenticated SSRF via login.json.phpWWBN AVideo
- CVE-2026-89241WWBN AVideo Reflected XSS via confirmLivePassword.phpWWBN AVideo
- CVE-2026-89240WWBN AVideo Reflected XSS via confirmLivePassword.phpWWBN AVideo
- CVE-2026-89239WWBN AVideo Reflected XSS via Referer Header Comment BreakoutWWBN AVideo
- CVE-2026-89148AVideo Open Redirect via playlistSort.php Referer HeaderWWBN AVideo
- CVE-2026-86813MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-ToMetForm
- CVE-2026-86809Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority BypassPersian Elementor
- CVE-2026-85116Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field…Simple CAPTCHA with Cloudflare Turnstile
- CVE-2026-82215WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified WebhookPayment Gateway PayPay for WooCommerce
- CVE-2026-82213Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDORNexi XPay Build
- CVE-2026-77159Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlinkRed Hat Enterprise Linux
- CVE-2026-87123hbs vulnerable to Denial of Service via unhandled exception in async helper output escapinghbs
- CVE-2026-87859morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsmorgan
- CVE-2026-87727a-blog cms Ver.appleple a-blog cms
- CVE-2026-6640Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameterdglingren Media Library Assistant
- CVE-2026-6642Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Importdglingren Media Library Assistant
- CVE-2026-6641Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameterdglingren Media Library Assistant
- CVE-2026-89179Howyar｜WeenyGenius - Missing Support for Integrity CheckHowyar WeenyGenius
- CVE-2026-89175Kingdom Communication Associated｜Smart Video Intercom System - Client-Side AuthenticationKingdom Communication Associated EH3040 · Kingdom Commun… +2
- CVE-2026-89173Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data ExposureKingdom Communication Associated EH3040 · Kingdom Commun… +2
- CVE-2026-13326Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC moduleqt
- CVE-2026-86815BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST RoutesBackWPup
- CVE-2026-86812WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST APIWPCafe
- CVE-2026-86782Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDORVisualizer
- CVE-2026-86781SSL Zen < 4.7.40 - Subscriber+ TLS Private Key DisclosureSSL Zen — SSL Certificate Installer & HTTPS Redirects
- CVE-2026-86780Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt TextFeatured Image with URL
- CVE-2026-86779Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChartVisualizer
- CVE-2026-85678AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScriptAI Builder
- CVE-2026-82305YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_titleYITH WooCommerce Wishlist
- CVE-2026-14566Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tamperingadvanced-customized-prompts
- CVE-2026-14565Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configurationadvanced-customized-prompts
- CVE-2026-14562Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosureteddy-bear-customize-addon
- CVE-2025-15695GTranslate < 3.0.10 - Admin+ Stored XSSTranslate WordPress with GTranslate
- CVE-2026-83546CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class AttributeCoolClock
- CVE-2026-83545CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSONCoolClock
- CVE-2026-89169live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.Debian live-boot
- CVE-2026-89162In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access…PCRE2
- CVE-2026-89160PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.PCRE2
- CVE-2026-89158PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.PCRE2
- CVE-2026-89157PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.PCRE2
- CVE-2026-89156PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.PCRE2
- CVE-2026-78172Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scriptingthemifyme Themify – WooCommerce Product Filter
- CVE-2026-7438Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesboldthemes Bold Timeline Lite
- CVE-2026-18562HUSKY <= 1.4.3 - Reflected Cross-Site Scriptingrealmag777 HUSKY – Products Filter for WooCommerce Professi…
- CVE-2026-19985Relevanssi <= 4.28.1 - Reflected Cross-Site Scriptingcomesio Relevanssi – A Better Search
- CVE-2026-11446Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorizationarraytics Booktics – Appointment Booking Calendar for Servi…
- CVE-2026-84960WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scriptingcbutlerjr WP-Members Membership Plugin
- CVE-2026-18964Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site…premio Floating Chat Widget: Contact Chat Icons, Telegram C…
- CVE-2026-11496Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosureedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2026-12215OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Forcexootix OTP Login & Register Woocommerce
- CVE-2026-77150Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scriptingunitecms Unlimited Elements For Elementor
- CVE-2026-89151Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.Forgejo
- CVE-2026-78135libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine.strongSwan
- CVE-2026-88914Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parserRed Hat Enterprise Linux
- CVE-2026-78131strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate…strongSwan
- CVE-2026-78129strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.strongSwan
- CVE-2026-78127libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.strongSwan
- CVE-2026-78126strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.strongSwan
- CVE-2026-78124strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after…strongSwan
- CVE-2026-78123strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.strongSwan
- CVE-2026-89092Stack overflow in nscd due to unbounded alloca useThe GNU C Library glibc
- CVE-2026-89145Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directoryflextype
- CVE-2025-69904Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by…
- CVE-2026-79035A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers…