CVEs published September 25, 2026
680 CVEs were published on September 25, 2026: 23 critical, 172 high. Browse them by severity, product and exploitation status.
- Published
- 680
- Critical
- 23
- High
- 172
- Medium
- 172
- Low
- 15
- Unrated
- 298
- Now in CISA KEV
- 0
- Fix available
- 565
Most affected products
- Linux
- 371
- zammad
- 30
- rabbitmq-server · rabbitmq
- 28
- glpi-project glpi
- 13
- InvoicePlane
- 13
- PHP Group PHP
- 10
- Novadigits technologies StockAgile
- 7
- ail project ail framework
- 6
- Apache Software Foundation Apache Qpid Broker-J
- 6
- IBM Guardium Data Protection
- 6
Critical 23
- CVE-2026-100382Unauthenticated remote code execution through wikitext in ExternalDataWikimedia Foundation Mediawiki - ExternalData Extension
- CVE-2026-100390Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6tobychui zoraxy
- CVE-2026-100389GestSup before 3.2.62 Remote Code Execution via IMAP AttachmentGestSup
- CVE-2026-48482GLPI: RCE via Form importglpi-project glpi
- CVE-2026-84458Zammad: Account takeover via unverified email matching during SSO auto-linkzammad
- CVE-2026-97064X-SpringBoot through 6.0 Authentication Bypass via Static Master Codeyzcheng90 X-SpringBoot
- CVE-2026-97063X-SpringBoot through 6.0 Authentication Bypass via Login Codeyzcheng90 X-SpringBoot
- CVE-2026-92161FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerFriendsOfFlarum oauth · fof/oauth
- CVE-2026-42322Piwigo: Authenticated RCE via File Upload in Logo Upload FeaturePiwigo
- CVE-2026-62262Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`Piwigo
- CVE-2026-39353InvoicePlane: Remote Code Execution via Writable Templates DirectoryInvoicePlane
- CVE-2026-93647Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From AddressZimbra Collaboration Suite
- CVE-2026-93643Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas RequestZimbra Collaboration Suite
- CVE-2026-93642Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share InvitationZimbra Collaboration Suite
- CVE-2026-93641Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share InvitationZimbra Collaboration Suite
- CVE-2026-100075RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind countersLinux
- CVE-2026-95832Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shellKovid Goyal kitty
- CVE-2026-92609Apache Qpid Broker-J: Missing HTTP-session renewal after successful authenticationApache Software Foundation Apache Qpid Broker-J
- CVE-2026-14281Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter101gen Automation Web Platform – Notifications and OTP for…
- CVE-2026-93399Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameterladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-89055Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameterivole Customer Reviews for WooCommerce
- CVE-2026-92289Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secretLemonldap-NG-Portal
- CVE-2026-92288Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying PartyLemonldap-NG-Portal
High 172
- CVE-2026-96795Horilla: Authenticated RCE in Horilla List-View Exporthorilla-hr
- CVE-2026-57449Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Tokenactualbudget actual · @actual-app/sync-server
- CVE-2026-100501Flame through 2.4.0 Brute-Force Attack via Login Endpointpawelmalak flame
- CVE-2026-100419gitoxide gix-fs before 0.23.0 Worktree Escape via SymlinkGitoxideLabs gitoxide
- CVE-2026-71483Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter Viewhorilla-hr
- CVE-2026-88003InvoicePlane: Failure to Revoke Administrative Privileges After Role DowngradeInvoicePlane
- CVE-2026-10758Esri Lerc has a security vulnerabilityEsri Lerc
- CVE-2026-57443SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digestsissdandavis SCBE-AETHERMOORE · scbe-aethermoore
- CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodePHP Group PHP
- CVE-2026-100369CliInvoke: Argument Injection in Extensibility Runner Factoryalastairlundy CliInvoke · AlastairLundy.CliInvoke +1
- CVE-2026-100391MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validationmhdzumair mediaflow-proxy
- CVE-2026-100387pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserializationpgpointcloud pointcloud
- CVE-2026-100368CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappersalastairlundy CliInvoke.Specializations · CliInvoke.Spec… +1
- CVE-2026-100208Microsoft Office Outlook Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2026-100372ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.phpMacWarrior clipbucket-v5
- CVE-2026-100310GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIXGNU libextractor
- CVE-2026-5267Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCSCiena Navigator NCS
- CVE-2026-53629GLPI: SQL injection in history tabglpi-project glpi
- CVE-2026-53626GLPI: Arbitrary Document Read via Form Context Authorization Bypassglpi-project glpi
- CVE-2026-53625GLPI: Privilege Escalation via authtype API manipulationglpi-project glpi
- CVE-2026-53610GLPI: Reflected XSS in dashboardsglpi-project glpi
- CVE-2026-47679GLPI: arbitrary file deletionglpi-project glpi
- CVE-2026-55214GLPI: Stored XSS in suppliersglpi-project glpi
- CVE-2026-49470GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Forceglpi-project glpi
- CVE-2026-84465Zammad: S/MIME signature verification allows forged sender impersonationzammad
Show all 172 entriesShow fewer entries
- CVE-2026-84464Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization datazammad
- CVE-2026-97060X-SpringBoot through 6.0 Authorization Bypass via User Managementyzcheng90 X-SpringBoot
- CVE-2026-91841Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injectionGNOME NetworkManager-vpnc
- CVE-2026-91840Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn usernameGNOME NetworkManager-vpnc
- CVE-2026-91839Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentialsGNOME NetworkManager-fortisslvpn
- CVE-2026-91838Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fieldsGNOME NetworkManager-sstp
- CVE-2026-84462Zammad: AI Agent template sanitizer bypass leads to remote code executionzammad
- CVE-2026-61525Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controllerzammad
- CVE-2026-56725Zammad: Denial of Service via OTRS Import Controllerzammad
- CVE-2026-56733Zammad: Incorrect Authorization and Improper Privilege Managementzammad
- CVE-2026-56731Zammad: Cross-Site Scripting in Ticket Notificationszammad
- CVE-2026-56727Zammad: PGP signature spoofing via unvalidated verification returnzammad
- CVE-2026-93365Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX EndpointBludit CMS
- CVE-2026-56723Zammad: Missing authorization on ticket attachment downloadzammad
- CVE-2026-56724Zammad: Incorrect implementation of permission checks in the knowledge base modulezammad
- CVE-2026-94445Malicious user input may lead to RCE in golang.org/x/playgroundgolang.org/x/playground
- CVE-2026-67419RabbitMQ: Consecutive topic wildcards cause combinatorial routing workrabbitmq-server · rabbitmq
- CVE-2026-67408RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Servicerabbitmq-server · rabbitmq
- CVE-2026-67410RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpointrabbitmq-server · rabbitmq
- CVE-2026-67409RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoSrabbitmq-server · rabbitmq
- CVE-2026-91837Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injectionGNOME NetworkManager-iodine
- CVE-2026-67239RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UIrabbitmq-server · rabbitmq
- CVE-2026-100248The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.Rattadan Cosmowarp Contract
- CVE-2026-67237RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpointrabbitmq-server · rabbitmq
- CVE-2026-89032BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache LayerBerriAI litellm
- CVE-2026-67236RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /loginrabbitmq-server · rabbitmq
- CVE-2026-42324Piwigo: Second-Order SQL InjectionPiwigo
- CVE-2026-44642Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)Piwigo
- CVE-2026-42323Piwigo: SQL Injection in Batch ManagerPiwigo
- CVE-2026-49850InvoicePlane: Missing CSRF Protection on State-Changing delete ActionsInvoicePlane
- CVE-2026-50547InvoicePlane permits local file inclusion through the e-invoice XML configuration identifierInvoicePlane
- CVE-2026-33639InvoicePlane permits DDL injection through tax_rate_decimal_placesInvoicePlane
- CVE-2026-96812Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSEGoogle gVisor
- CVE-2026-93306This Power System update is being released to addressIBM Server Firmware
- CVE-2026-84862IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84882IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84884IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84893IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-85029IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-85542IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-85750Piwigo arbitrary file read and remote code execution via insecure image processingPiwigo
- CVE-2026-93834Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escapeRed Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2026-100176Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltipail project ail framework
- CVE-2026-100172Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributesail project ail framework
- CVE-2026-97875DNS rebinding vulnerability in rojo serve HTTP APIrojo-rbx rojo · rojo
- CVE-2026-98156drm/virtio: use the DMA API for resource backing on XenLinux
- CVE-2026-98154nvme-rdma: fix -EIO cleanup order in queue_rqLinux
- CVE-2026-98150bpf: Fix BPF_F_CPU validation for sparse CPU IDsLinux
- CVE-2026-98143accel: ethosu: Don't read the U65 rounding mode as a storage modeLinux
- CVE-2026-98130sctp: fix a TOCTOU race in SCTP_CMD_TIMER_STARTLinux
- CVE-2026-98122vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()Linux
- CVE-2026-98116ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAFLinux
- CVE-2026-98115ksmbd: safely drain sessions during logoffLinux
- CVE-2026-98112ksmbd: fix listener task lifetime on netdev eventsLinux
- CVE-2026-98108Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchanLinux
- CVE-2026-98096ipv6: sr: restore network header before routing and forwardingLinux
- CVE-2026-98093ASoC: fsl_micfil: balance mclk enable/disableLinux
- CVE-2026-98083btrfs: fix transaction use-after-free in raid stripe insertionLinux
- CVE-2026-98073net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().Linux
- CVE-2026-98070net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()Linux
- CVE-2026-98069net/rds: acquire the fastpath locks in rds_conn_shutdown()Linux
- CVE-2026-98056nvme: remove stale namespaces by NSID range during scanLinux
- CVE-2026-98052net: bcmasp: clear txcb->last before writing each descriptorLinux
- CVE-2026-98050mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue contextLinux
- CVE-2026-98041bpf: Don't predict JMP32 pointer vs zero comparisonsLinux
- CVE-2026-98030net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer sizeLinux
- CVE-2026-98029eth: nfp: bound the ntuple rule dump by the caller's buffer sizeLinux
- CVE-2026-98027net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer sizeLinux
- CVE-2026-98023vxlan: reject dynamic fdb entries that reference a nexthop idLinux
- CVE-2026-98017net/sched: defer qdisc freeing after failed creationLinux
- CVE-2026-98002iommu/amd: Fix ineffective error check in nested domain allocationLinux
- CVE-2026-97991vdpa_sim_blk: reject out-of-range sector startsLinux
- CVE-2026-97990vdpa_sim_net: check TX pull result before RX copyLinux
- CVE-2026-97971nstree: check listing permission before taking a namespace referenceLinux
- CVE-2026-97957net: hinic: fix mailbox segment buffer overflowLinux
- CVE-2026-97953net: stmmac: fix TX descriptor availability check for TSO trafficLinux
- CVE-2026-97941mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid raceLinux
- CVE-2026-97940ipv6: fix fib6 walker UAF on seq stopLinux
- CVE-2026-97937ftrace: fork: Initialize function graph state before copy_exec_state()Linux
- CVE-2026-97931ALSA: us122l: Prevent write upgrades for read mappingsLinux
- CVE-2026-97926ufs: validate cylinder group metadata before caching itLinux
- CVE-2026-97911accel: ethosu: Ensure SRAM region size matches jobLinux
- CVE-2026-97910ASoC: sprd: validate compress buffer sizes against fixed allocationsLinux
- CVE-2026-97903exit: hold a reference to thread_pid across proc_flush_pidLinux
- CVE-2026-97612net: mpls: clear inner_protocol when the last label is poppedLinux
- CVE-2026-97611net: openvswitch: fix use-after-free of the flow table mask arrayLinux
- CVE-2026-97609netfilter: cttimeout: prevent UAF during module unloadLinux
- CVE-2026-97608netfilter: nf_log: unregister loggers before per-net teardownLinux
- CVE-2026-97602inet: frags: invalidate queues before flushing themLinux
- CVE-2026-97595mac802154: fix use-after-free of sdata via queued RX framesLinux
- CVE-2026-97594landlock: Fix use-after-free of the source's parent directoryLinux
- CVE-2026-97589s390/crypto: Fix wrong return code to engine in asynch callbacksLinux
- CVE-2026-97584afs: Fix incorrect free in candidate cleanup in afs_lookup_server()Linux
- CVE-2026-97583afs: Clear stale peer app data after address list changesLinux
- CVE-2026-97580media: rkvdec: bound HEVC tile loops and PPS id to the array capacityLinux
- CVE-2026-97579media: mediatek: vcodec: bound AV1 tile-start copy to the array capacityLinux
- CVE-2026-97578media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile bufferLinux
- CVE-2026-97577media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacityLinux
- CVE-2026-97576media: v4l2-ctrls: validate HEVC tile countsLinux
- CVE-2026-97575media: v4l2-ctrls: validate AV1 tile countsLinux
- CVE-2026-97573bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()Linux
- CVE-2026-97570bnxt_en: Bound SW TPA IDs to prevent crashesLinux
- CVE-2026-97562smb: client: pin DFS superblock in iterator callbackLinux
- CVE-2026-97557smb: client: avoid leaking refcount in cifs_queue_oplock_break()Linux
- CVE-2026-97555smb: client: fix heap overflow in DACL owner/group rewriteLinux
- CVE-2026-97548xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functionsLinux
- CVE-2026-97536scsi: qla2xxx: Fix use-after-free of qpair work on queue teardownLinux
- CVE-2026-97531scsi: qla2xxx: Skip vport under deletion in report ID acquisitionLinux
- CVE-2026-97528scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject errorLinux
- CVE-2026-97527scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lockLinux
- CVE-2026-97525x86/mm/pat: Allocate split page tables as kernel page tablesLinux
- CVE-2026-97524mptcp: avoid unneeded actions on subflow resetLinux
- CVE-2026-97523mptcp: close race between scheduler and state changeLinux
- CVE-2026-97898Broken authorization in Akia keyless entry lets an authenticated guest unlock other roomsakia
- CVE-2026-92550Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoderApache Software Foundation Apache Qpid Broker-J
- CVE-2026-92560Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoderApache Software Foundation Apache Qpid Broker-J
- CVE-2026-92564Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processingApache Software Foundation Apache Qpid Broker-J
- CVE-2026-92608Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10Apache Software Foundation Apache Qpid Broker-J
- CVE-2026-95864Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameterthemifyme Themify Builder
- CVE-2026-89426Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Fieldknitpay Knit Pay – Cashfree, Instamojo, Razorpay, PayPal an…
- CVE-2026-94573Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Valueaddonsorg Repeater Fields for Elementor Forms
- CVE-2026-19804s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Returnclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2026-84280Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameterradykal Fancy Product Designer
- CVE-2026-89406Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameterswpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-93901Optima Express IDX <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignmentihomefinder Optima Express IDX
- CVE-2026-95866User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Fieldcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-96568Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameterjetmonsters Restaurant Menu and Food Ordering
- CVE-2026-13456WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameterflippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, S…
- CVE-2026-93654Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parametercodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2026-92713Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameterwpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-96752Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integrationbmarshall511 Zero Spam for WordPress
- CVE-2026-96039BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameterbookingalgorithms BA Book Everything
- CVE-2026-93303HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resumehtplugins HT Contact Form – Drag & Drop Form Builder for Wo…
- CVE-2026-84279Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Jobradykal Fancy Product Designer
- CVE-2026-84281Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Metaradykal Fancy Product Designer
- CVE-2026-83591AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformationmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2026-62062WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityElementor Website Builder
- CVE-2026-97818phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.phpIPAM
- CVE-2026-97737In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeovemuety Wakapi
- CVE-2026-97735ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive overITFlow
- CVE-2026-97731MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeadersMinIO
- CVE-2026-97730In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) wiNetgate pfSense Plus · Netgate pfSense CE
- CVE-2025-51457D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpo
- CVE-2026-51773An issue in the VMware datastore driver of OpenStack glance_store.
- CVE-2026-52622An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows
- CVE-2026-79153Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that al
- CVE-2026-88421Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie
Medium, low and unrated 485
- CVE-2026-86066Horilla attendance approval endpoint is vulnerable to cross-site request forgeryhorilla-hr
- CVE-2026-100502Flame through 2.4.0 Admin Token Insufficient Session Expirationpawelmalak flame
- CVE-2026-100418Flame through 2.4.0 Information Exposure via GET /api/configpawelmalak flame
- CVE-2026-63432Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadatahorilla-hr
- CVE-2026-63431Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)horilla-hr
- CVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NULPHP Group PHP
- CVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)PHP Group PHP
- CVE-2026-100383Stored i18n XSS in WikiLambda's VisualEditor integrationWikimedia Foundation Mediawiki - WikiLambda Extension
- CVE-2026-100381UploadWizard Flickr collection and set titles allow DOM XSSWikimedia Foundation Mediawiki - UploadWizard Extension
- CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN MismatchPHP Group PHP
- CVE-2026-100380Reflected XSS in Wikibase Special:SetLabel language validationWikimedia Foundation Mediawiki - Wikibase Extension
- CVE-2026-100379Cross-request disclosure of CentralAuth cookies in Wikipedia Android AppWikimedia Foundation Wikipedia Android App
- CVE-2026-91767Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CNPHP Group PHP
- CVE-2026-100378Missing permission check in the Translate sandbox doRemind actionWikimedia Foundation Mediawiki - Translate Extension
- CVE-2026-100376TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefixWikimedia Foundation Mediawiki - TemplateSandbox Extension
- CVE-2025-1218Various packet overreads in mysqlnd_writeprotocol.cPHP Group PHP
- CVE-2026-100377Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstractWikimedia Foundation Mediawiki - WikiLambda Extension
- CVE-2026-91766Cross-origin credential leak in HTTP stream wrapper redirectsPHP Group PHP
- CVE-2025-14181Integer overflow to buffer overflow in soap HTTP parsingPHP Group PHP
- CVE-2026-100417RustDesk before 1.5.0 One-Way File Transfer Bypassrustdesk
- CVE-2026-17545PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoSPHP Group PHP
- CVE-2026-100388RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messagesrustdesk
- CVE-2026-96879"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"The Wikimedia Foundation Mediawiki - FlaggedRevs extension
- CVE-2026-6103Phar TAR phar_tar_number() Integer Overflow - Archive Entry InjectionPHP Group PHP · libphp +2
- CVE-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerPHP Group PHP
Show all 485 entriesShow fewer entries
- CVE-2026-96878Cargo Exhibit field alias allows stored XSSThe Wikimedia Foundation Mediawiki - Cargo extension
- CVE-2026-96877Reflected XSS through Cargo Drilldown full-text searchThe Wikimedia Foundation Mediawiki - Cargo extension
- CVE-2026-100373OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypassopen-metadata OpenMetadata
- CVE-2026-96876Anonymous reflected XSS in CargoExport invalid-alias errorsThe Wikimedia Foundation Mediawiki - Cargo extension
- CVE-2026-96875Reflected XSS in Cargo Drilldown hierarchy filtersThe Wikimedia Foundation Mediawiki - Cargo extension
- CVE-2026-100306TDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementTDuckCloud tduck-survey-form
- CVE-2026-100305TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission EndpointTDuckCloud tduck-survey-form
- CVE-2026-100304TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckTDuckCloud tduck-survey-form
- CVE-2026-100303TDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsTDuckCloud tduck-survey-form
- CVE-2026-97897Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scriptingKrayin laravel-crm
- CVE-2026-97896krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scriptingkrayin laravel-crm
- CVE-2026-55217GLPI: Unallowed modfication of knowbase items comments and translationsglpi-project glpi
- CVE-2026-53628GLPI: Unallowed authentication method update by administratorglpi-project glpi
- CVE-2026-45801GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)glpi-project glpi
- CVE-2026-53627GLPI: Unexpected access to update operations through the APIglpi-project glpi
- CVE-2026-49469GLPI: LDAP filter injection in user import featureglpi-project glpi
- CVE-2026-63208Zammad: Microsoft Graph error logs expose partially masked OAuth access tokenszammad
- CVE-2026-63006Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcsetzammad
- CVE-2026-63204Zammad: Authenticated agents can read AI summary error messages from inaccessible ticketszammad
- CVE-2026-61855Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mailzammad
- CVE-2026-84461Zammad: Missing rate limiting allows password brute-forcing during two-factor loginzammad
- CVE-2026-63207Zammad: Sensitive Information Exposure in Integration Administration APIzammad
- CVE-2026-84463Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributezammad
- CVE-2026-63216Zammad: Stored XSS via unescaped option labels in the object attribute options context UIzammad
- CVE-2026-97895krayin laravel-crm User Management UserController.php privileges managementkrayin laravel-crm
- CVE-2026-84460Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumerationzammad
- CVE-2026-63206Zammad: Remote image tracking bypass via shortened URL schemezammad
- CVE-2026-63205Zammad: Channel admins can read unauthorized attachments via signature rich-text bodyzammad
- CVE-2026-100192X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpointyzcheng90 X-SpringBoot
- CVE-2026-97886mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-97885mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-97884mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-65828Zammad: Pending upload deletion bypass via legacy attachment endpointzammad
- CVE-2026-97883mathurvishal CloudClassroom-PHP-Project updatequery.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-56728Zammad: Cross-User Taskbar Item Access Control Vulnerabilityzammad
- CVE-2026-56732Zammad: Malicious input in Ticket Body Enables Session Terminationzammad
- CVE-2026-56730Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answerszammad
- CVE-2026-56735Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammadzammad
- CVE-2026-56734Zammad: Avatar Image URL Server-Side Request Forwardingzammad
- CVE-2026-56726Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leakzammad
- CVE-2026-93366Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX EndpointsBludit CMS
- CVE-2026-97882mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-56729Zammad: Titles of knowledge base answers will be shown across all categories via the global searchzammad
- CVE-2026-93364Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()Bludit CMS
- CVE-2026-93363Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Routepayloadcms payload · @payloadcms/storage-vercel-blob
- CVE-2026-100237Stored i18n XSS in the Flow integration of ThanksThe Wikimedia Foundation Mediawiki - Thanks Extension
- CVE-2026-97879zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authenticationzhistaredu StarTraining
- CVE-2026-67420RabbitMQ OAuth credential refresh retains revoked runtime tagsrabbitmq-server · rabbitmq
- CVE-2026-67421RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handlingrabbitmq-server · rabbitmq
- CVE-2026-67406RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_statusrabbitmq-server · rabbitmq
- CVE-2026-95835Missing ownership check on the shared memory object named by the kitty askpass escape codeKovid Goyal kitty
- CVE-2026-67227RabbitMQ: Atom exhaustion: to_atom on global-parameter :namerabbitmq-server · rabbitmq
- CVE-2026-67407RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypassrabbitmq-server · rabbitmq
- CVE-2026-97878zhistaredu StarTraining Druid Console index.html anonymous missing authenticationzhistaredu StarTraining
- CVE-2026-67226RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags listrabbitmq-server · rabbitmq
- CVE-2026-95834Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transferKovid Goyal kitty
- CVE-2026-18311CVE-2026-18311Readwise Reader
- CVE-2026-18320CVE-2026-18320Readwise Reader
- CVE-2026-18312CVE-2026-18312Readwise Reader
- CVE-2026-67411RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypassrabbitmq-server · rabbitmq
- CVE-2026-67413RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expressionrabbitmq-server · rabbitmq
- CVE-2026-61837RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checksrabbitmq-server · rabbitmq
- CVE-2026-80432Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a dropKovid Goyal kitty
- CVE-2026-67415RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Servicerabbitmq-server · rabbitmq
- CVE-2026-67412RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message accessrabbitmq-server · rabbitmq
- CVE-2026-67242RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exprabbitmq-server · rabbitmq
- CVE-2026-97877zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded passwordzhistaredu StarTraining
- CVE-2026-67223RabbitMQ: LDAP DN injection via unescaped substitutionrabbitmq-server · rabbitmq
- CVE-2026-67241RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission checkrabbitmq-server · rabbitmq
- CVE-2026-66071RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope valuesrabbitmq-server · rabbitmq
- CVE-2026-66078RabbitMQ: protected tag bypass via bulk-deleterabbitmq-server · rabbitmq
- CVE-2026-66073RabbitMQ: Atom table exhaustion via management API node fieldrabbitmq-server · rabbitmq
- CVE-2026-67234RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preferencerabbitmq-server · rabbitmq
- CVE-2026-67225RabbitMQ: Stream-protocol frame length never validated against frame_maxrabbitmq-server · rabbitmq
- CVE-2026-67230RabbitMQ: Web-STOMP unbounded pre-auth accumulationrabbitmq-server · rabbitmq
- CVE-2026-67222RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_clientrabbitmq-server · rabbitmq
- CVE-2026-97871Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injectionZhonglun CloudPos
- CVE-2026-97469PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLinkDALIBO PostgreSQL Anonymizer
- CVE-2026-100230Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versinput-leap Input Leap
- CVE-2026-85293InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer FormsInvoicePlane
- CVE-2026-85291InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization CheckInvoicePlane
- CVE-2026-85289InvoicePlane: Missing CSRF Token Validation on Multiple Delete EndpointsInvoicePlane
- CVE-2026-85292InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)InvoicePlane
- CVE-2026-85274InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF ProtectionInvoicePlane
- CVE-2026-85290InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error LoggingInvoicePlane
- CVE-2026-39372InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in AttachmentsInvoicePlane
- CVE-2026-54790InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields moduleInvoicePlane
- CVE-2026-97869langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserializationlangchain4j
- CVE-2026-97868sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scriptingsheshbabu zen
- CVE-2026-96874Stored XSS in Cargo Drilldown tab namesThe Wikimedia Foundation Mediawiki - Cargo extension
- CVE-2026-97866Zhonglun CloudPOS Automatic Update Program.cs channel accessibleZhonglun CloudPOS
- CVE-2026-93030FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.IBM Financial Transaction Manager (FTM) for Redhat OpenShift
- CVE-2026-100190Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Pageail project ail framework
- CVE-2026-97222Gnumeric: gnumeric: heap use-after-free when opening a malformed workbookGNOME Gnumeric
- CVE-2026-100187AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validationail project ail framework
- CVE-2026-100177Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachmentail project ail framework
- CVE-2026-97865Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserializationOpen-Web-Analytics
- CVE-2026-80431Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal processKovid Goyal kitty
- CVE-2026-100174Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Namesail project ail framework
- CVE-2026-80430Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directoryKovid Goyal kitty
- CVE-2026-98162smb/server: fix tree connection leak in smb2_tree_connect()Linux
- CVE-2026-98161nvdimm: pmem: keep PREFLUSH before data writesLinux
- CVE-2026-98160staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()Linux
- CVE-2026-100079usb: typec: ucsi: unregister debugfs entries on teardownLinux
- CVE-2026-100078wifi: iwlwifi: mei: pass correct argument to functionLinux
- CVE-2026-100077drm/msm: Recover HW before retire hung submitLinux
- CVE-2026-100076staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error pathsLinux
- CVE-2026-100074bpf: Mark bpf_refcount field as uniqueLinux
- CVE-2026-100073ext4: fix transaction overflow during writebackLinux
- CVE-2026-100072ACPI: platform: Use acpi_bus_get_primary_device()Linux
- CVE-2026-100071net: hsr: free learned nodes on device setup failureLinux
- CVE-2026-100070netfilter: nf_nat_sip: rewind offset when NAT shrinks the packetLinux
- CVE-2026-97864GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authenticationGibbonEdu Gibbon
- CVE-2026-98159wifi: mt76: mt7921: validate CLC firmware recordsLinux
- CVE-2026-98158ppp_async: drop the errored frame instead of resetting its headroomLinux
- CVE-2026-98157EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncationLinux
- CVE-2026-98155accel/qaic: Address potential out-of-bounds read in resp_worker()Linux
- CVE-2026-98153nvme: fix racy access to FDP placement id arrayLinux
- CVE-2026-98152nvmet-rdma: fix queue leak when connect backlog is exceededLinux
- CVE-2026-98151bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmeticLinux
- CVE-2026-98149bpf: Fix percpu map update indexing with sparse CPU IDsLinux
- CVE-2026-98148drm/gud: validate GUD_ROTATION_0 is present in supported rotationsLinux
- CVE-2026-98147printk: Don't WARN on kthread_run failure.Linux
- CVE-2026-98146accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chainLinux
- CVE-2026-98145accel/amdxdna: reject a command chain that carries no commandsLinux
- CVE-2026-98144accel/amdxdna: put the chained BO when its mapping failsLinux
- CVE-2026-98142drm/cirrus-qemu: Validate BAR0 size during probeLinux
- CVE-2026-98141ntfs: propagate reparse index insertion failureLinux
- CVE-2026-98140ntfs: fix kmap_local leak in write_mft_record_nolock() error pathsLinux
- CVE-2026-98139ntfs: only count successfully cleared runs when freeing clustersLinux
- CVE-2026-98138ntfs: do not mark the volume clean in sync_fs when errors were recordedLinux
- CVE-2026-98137ntfs: treat any nonzero dio zero-range return as an errorLinux
- CVE-2026-98136ntfs: bound $AttrDef table walk to the loaded table sizeLinux
- CVE-2026-98135ntfs: reject invalid sectors_per_cluster in the boot sectorLinux
- CVE-2026-98134bpf: check_cond_jmp_op(): properly infer if register is nullLinux
- CVE-2026-98133ntfs: leave HasEA flag untouched on setxattr failureLinux
- CVE-2026-98132bpf: don't downgrade half-dead scalar zero spills to STACK_ZEROLinux
- CVE-2026-98131net: stmmac: fix dma mapping leak in stmmac_tso_xmit()Linux
- CVE-2026-98129scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()Linux
- CVE-2026-98128scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()Linux
- CVE-2026-98127smb/client: validate new EOF for insert rangeLinux
- CVE-2026-98126smb/client: validate new EOF for zero rangeLinux
- CVE-2026-98125smb/client: fix stale page cache in insert/collapse rangeLinux
- CVE-2026-98124smb/client: invalidate fscache for fallocate range operationsLinux
- CVE-2026-98123sctp: fix soft lockup from unpadded ASCONF-ACK parameter iterationLinux
- CVE-2026-98121watchdog: msc313e: Fix NULL pointer dereference in PM callbacksLinux
- CVE-2026-98120netfs: Fix subreq ref leakLinux
- CVE-2026-98119netfs: break unbuffered write when netfs_alloc_subrequest() failsLinux
- CVE-2026-98118netfs: Fix readahead synchronisation issues by loading all folios upfrontLinux
- CVE-2026-98117cachefiles: Fix potential UAF/KASAN warningLinux
- CVE-2026-98114ksmbd: propagate DACL parsing errorsLinux
- CVE-2026-98113ksmbd: rate limit unmapped SID errorsLinux
- CVE-2026-98111Bluetooth: btintel: validate version TLV value lengthsLinux
- CVE-2026-98110Bluetooth: btintel: bound firmware ID by TLV lengthLinux
- CVE-2026-98109Bluetooth: hci_core: Fix race condition during device registrationLinux
- CVE-2026-98107Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connectLinux
- CVE-2026-98106drm/pagemap: Prevent double migration of device pagesLinux
- CVE-2026-98105net: ethernet: oa_tc6: Improve the error recoveryLinux
- CVE-2026-98104net/sched: cls_u32: fix duplicate handle when node ID pool is exhaustedLinux
- CVE-2026-98103igmp: convert struct ip_sf_list to RCULinux
- CVE-2026-98102ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()Linux
- CVE-2026-98101ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()Linux
- CVE-2026-27867CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDATTeldat Regesta Smart HD-PLC - TLDPH16D2
- CVE-2026-97228Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status LookupRapid7 Platform
- CVE-2026-98099ipv6: mcast: use rcu_assign_pointer() for __rcu list updatesLinux
- CVE-2026-98098tipc: fix NULL deref in tipc_named_node_up() on empty publication listLinux
- CVE-2026-98097tipc: Dont send random pad bytes in RESET/ACTIVATE messagesLinux
- CVE-2026-98095af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().Linux
- CVE-2026-98094staging: fbtft: make dirty_lock IRQ-safeLinux
- CVE-2026-98092ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()Linux
- CVE-2026-98091btrfs: detach failed sprout device from transaction update listLinux
- CVE-2026-98090btrfs: restore active device pointers after failed sproutLinux
- CVE-2026-98089bonding: alb: fix uninitialized transport header access in alb_determine_nd()Linux
- CVE-2026-98088scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()Linux
- CVE-2026-98087sched/rt,dl: Skip migrate-disabled tasks when picking a push candidateLinux
- CVE-2026-98086ALSA: ump: do not touch legacy_rmidi before it existsLinux
- CVE-2026-98085bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edgeLinux
- CVE-2026-98084bpf: backtracking shouldn't clear outer frame R1-R5 for callbacksLinux
- CVE-2026-98082btrfs: fix the possible bioc_list memory leak during errorLinux
- CVE-2026-98081btrfs: zoned: finish active block group cleanup if call_zone_finish() failsLinux
- CVE-2026-98080btrfs: do not force reloc root creation during qgroup_account_snapshot()Linux
- CVE-2026-98079btrfs: zstd: fix lost wakeup when waiting for a workspaceLinux
- CVE-2026-98078ipvs: fix reversed sequence option serializationLinux
- CVE-2026-98077netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()Linux
- CVE-2026-98076tracing/probes: Fix use-after-free on field name/type of events with multiple probesLinux
- CVE-2026-98075bpf: reject BPF_PSEUDO_FUNC reference to the main programLinux
- CVE-2026-98074bonding: do not clear curr_active_slave prematurely when releasing all slavesLinux
- CVE-2026-98072net/rds: use wq_has_sleeper() in release_in_xmit()Linux
- CVE-2026-98071net/rds: clear cp_flags bits individually in rds_conn_path_reset()Linux
- CVE-2026-98068net/rds: don't let rds_conn_shutdown() consume a concurrent dropLinux
- CVE-2026-98067erofs: disable LZ4 rolling decompression for nowLinux
- CVE-2026-98066ALSA: caiaq: Fix potential double-free at error pathLinux
- CVE-2026-98065bpf: Reject key-less BTF for hash mapsLinux
- CVE-2026-98064bpf: Fix NULL-ptr-deref when showing a void BTF typeLinux
- CVE-2026-98063bpf: Fix NULL-ptr-deref in btf_var_show()Linux
- CVE-2026-98062bpf: Mark signal tracepoint siginfo arguments as scalarLinux
- CVE-2026-98061bpf: Reject tail calls directly from callback framesLinux
- CVE-2026-98060bpf: Reject resilient lock operations in rbtree callbacksLinux
- CVE-2026-98059bpf: Mark sched_process_wait argument as nullableLinux
- CVE-2026-98058bpf: Mark syscall helpers as sleepableLinux
- CVE-2026-98057ring-buffer: Add checking nr_subbufs to persistent ring buffer validationLinux
- CVE-2026-98055ASoC: Intel: avs: Clean up the bus when fetching ML caps failsLinux
- CVE-2026-98054ASoC: Intel: avs: Fix unbalanced module reference countLinux
- CVE-2026-98053ASoC: Intel: avs: Refactor and fix init_config accessLinux
- CVE-2026-98051net: bcmasp: fix tx_spb_ring_full() checking same slot cnt timesLinux
- CVE-2026-98049bpf: zero extend the result of an arena 32-bit cmpxchgLinux
- CVE-2026-98048bpf: don't rewrite bpf_fastcall patterns entered by a jumpLinux
- CVE-2026-98047bpf: Check ancestor frames for rbtree callbacksLinux
- CVE-2026-98046bpf: Mark bpf_btf_find_by_name_kind() as sleepableLinux
- CVE-2026-98045bpf: Mark faultable stack helpers as sleepableLinux
- CVE-2026-98044bpf: Reject legacy packet loads from callbacksLinux
- CVE-2026-98043bpf: Don't infer non-NULL from a pointer with an unbounded offsetLinux
- CVE-2026-98042bpf: Don't resurrect a scalar id dropped by collect_linked_regs()Linux
- CVE-2026-98040bpf: Mark the zero register precise for a register-form NULL checkLinux
- CVE-2026-98039bpf: Require MEM_PERCPU for percpu kptr storesLinux
- CVE-2026-98038bpf: Keep refcount_acquire nullable for borrowed RCU kptrsLinux
- CVE-2026-98037bpf: Reject untrusted allocated-object pointersLinux
- CVE-2026-98036bpf: Preserve special fields in recycled rhtab elementsLinux
- CVE-2026-98035bpf: Cancel special fields when recycling rhtab elementsLinux
- CVE-2026-98034bpf: Mark NULL kptr stores preciseLinux
- CVE-2026-98033bpf: Preserve inner map identity in callback framesLinux
- CVE-2026-98032tracing: Fix subbuf resize races with trace_pipe_raw readersLinux
- CVE-2026-98031nexthop: Initialize extack in remove_nh_grp_entry()Linux
- CVE-2026-98028eth: nfp: drop the replaced rule from the list when reprogramming failsLinux
- CVE-2026-98026net: bridge: mcast: properly convert mglist to rcuLinux
- CVE-2026-98025net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflowLinux
- CVE-2026-98024s390/ism: folio_put() after errorLinux
- CVE-2026-98022net: cap tx_queue_len at S16_MAX to prevent oversized ring allocationsLinux
- CVE-2026-98021net: reject oversized tx_queue_len at netlink parse timeLinux
- CVE-2026-98020pds_core: fix cmd_regs access racing BAR unmap on resetLinux
- CVE-2026-98019bpf: mark a NULL call argument preciseLinux
- CVE-2026-98018net: mctp: i3c: serialize probe with bus removalLinux
- CVE-2026-98016net/mlx5e: Fix use-after-free race in sample_restore_put()Linux
- CVE-2026-98015net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_putLinux
- CVE-2026-98014net/mlx5: E-Switch, prevent mc_list repopulation during vport disableLinux
- CVE-2026-98013net/sched: fq_pie: clamp quantum in change pathLinux
- CVE-2026-98012net/sched: sfq: clamp quantum in change pathLinux
- CVE-2026-98011net/sched: hhf: clamp quantum in change and init pathsLinux
- CVE-2026-98010net/sched: drr: clamp quantum in change classLinux
- CVE-2026-98009net/sched: ets: clamp quantum in parse and fallback pathsLinux
- CVE-2026-98008net: macb: fix NULL pointer dereference on unbind with fixed-linkLinux
- CVE-2026-98007bpf: Reject non-scalar bpf_loop iteration countsLinux
- CVE-2026-98006ALSA: caiaq: Decoupling ep1_in_urb in caiaq devLinux
- CVE-2026-98005erofs: delimit inode_share cache key componentsLinux
- CVE-2026-98004iommu/riscv: Serialize command queue publishingLinux
- CVE-2026-98003iommu/amd: Do not reallocate GA log buffers on resumeLinux
- CVE-2026-98001hwmon: (ltc4282) Make sure clk_init_data is fully initializedLinux
- CVE-2026-98000hwmon: Fix potential UAF in pec_storeLinux
- CVE-2026-97998netfilter: nfnetlink_log: cope with concurrent instance destructionLinux
- CVE-2026-97997virtio_ring: fix stale descriptor flags after a failed packed addLinux
- CVE-2026-97996virtio: fix use-after-free in unregister_virtio_device()Linux
- CVE-2026-97995virtio_console: do not free control-out buffers on removeLinux
- CVE-2026-97994vhost/vdpa: reject VRING_NUM larger than device maxLinux
- CVE-2026-97993vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctxLinux
- CVE-2026-97992vhost-vdpa: protect config_ctx from being freed under the config callbackLinux
- CVE-2026-97989vduse: validate virtqueue alignmentLinux
- CVE-2026-97988vhost: invalidate vring access on IOTLB transitionsLinux
- CVE-2026-97987virtio_input: reset device if input_register_device() failsLinux
- CVE-2026-97986virtio_input: stop callbacks before unregistering input deviceLinux
- CVE-2026-97985af_unix: Update last skb marker in manage_oob().Linux
- CVE-2026-97984net: ipv6: Fix UDP length overflow with PMTU discover and big MTULinux
- CVE-2026-97983vduse: return compat ioctl results directlyLinux
- CVE-2026-97982net: ethernet: cortina: Fix budget accountingLinux
- CVE-2026-97981net: ethernet: cortina: Count dropped frames as NAPI workLinux
- CVE-2026-97980s390/debug: Fix NULL pointer dereference in debug_set_level()Linux
- CVE-2026-97979ice: add missing xa_destroy for sched_node_idsLinux
- CVE-2026-97978eth: ice: don't dereference pointers from TP_printk()Linux
- CVE-2026-97977Bluetooth: btusb: Fix UAF of btusb_data by rx_workLinux
- CVE-2026-97976Bluetooth: btintel_pcie: validate packet_len before skb_put_dataLinux
- CVE-2026-97975Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()Linux
- CVE-2026-97974ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()Linux
- CVE-2026-97973net: macb: destroy the phylink instance on the probe error pathLinux
- CVE-2026-97972net: macb: put the "mdio" child node reference on successLinux
- CVE-2026-97970watchdog: msc313e: Avoid division by zeroLinux
- CVE-2026-97969watchdog: msc313e: Fix clock leak and spurious timer in settimeout()Linux
- CVE-2026-97968hwmon: (corsair-cpro) Create debugfs entries after hwmon registrationLinux
- CVE-2026-97967hwmon: (corsair-cpro) Remove debugfs entries when probe failsLinux
- CVE-2026-97966octeontx2-pf: reset HTB scheduler topology before freeing queuesLinux
- CVE-2026-97965vxlan: initialize _md in vxlan_xmit_one()Linux
- CVE-2026-97964ppp_synctty: ensure a writeable skb headerLinux
- CVE-2026-97963net: stmmac: initialize ptp_lock at probe timeLinux
- CVE-2026-97962net/mlx5e: Move representor vnic reporter to eswitch devlink portLinux
- CVE-2026-97961perf/core: Allow list_del during perf_event_overflow()Linux
- CVE-2026-97960perf/x86/intel: Prevent drain_pebs() reentryLinux
- CVE-2026-97959net/sched: cls_route: free emptied bucket on filter moveLinux
- CVE-2026-97958net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().Linux
- CVE-2026-97956net: net_failover: Fix the deadlock in net_failover_slave_name_change()Linux
- CVE-2026-97955net: mana: restore the XDP program pointer when pre-allocation failsLinux
- CVE-2026-97954net/rds: fix tcp stream corruption with large pagesLinux
- CVE-2026-97952sunvdc: unmap LDC cookies when the descriptor send failsLinux
- CVE-2026-97951scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commandsLinux
- CVE-2026-97950configfs: pin the symlink target's dirent instead of chasing ->ci_dentryLinux
- CVE-2026-97949configfs: unhash the dentry before dropping the item in rmdirLinux
- CVE-2026-97948powerpc/eeh: Fix recursive locking on devices without EEH sensitive driverLinux
- CVE-2026-97947x86/amd_node: Fix potential NULL pointer dereferenceLinux
- CVE-2026-97946x86/amd_node: Fix PCI device reference counting in amd_smn_init()Linux
- CVE-2026-97945x86/mm: Fix user-space data loss with MADV_FREE and THPLinux
- CVE-2026-97944x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()Linux
- CVE-2026-97943x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAFLinux
- CVE-2026-97942x86/alternatives: Exclude text poking against change_page_attr()Linux
- CVE-2026-97939ipmr: account multicast table and route memoryLinux
- CVE-2026-97938reboot: fix cad_pid use-after-free raceLinux
- CVE-2026-97936tracing: Fix memory corruption from the histogram stacktrace modifierLinux
- CVE-2026-97935tracing: Set the trace clock before registering the histogram triggerLinux
- CVE-2026-97934tracing: Fix memory corruption from a "STACKTRACE" histogram keyLinux
- CVE-2026-97933tracing: Take trace_array reference when opening a tracer options fileLinux
- CVE-2026-97932tracing: Don't dereference trace_event_file in deferred trigger freeLinux
- CVE-2026-97930ALSA: usbusx2y: fix in04_last array size mismatch with in04_bufLinux
- CVE-2026-97929ALSA: usbusx2y: validate URB actual_length in interrupt callbackLinux
- CVE-2026-97928drm/amdgpu: skip the VMID 0 flush for VRAMLinux
- CVE-2026-97927ufs: create the root dentry after loading cylinder metadataLinux
- CVE-2026-97925tick/broadcast: Plug clockevents replacement raceLinux
- CVE-2026-97924tracing/user_events: Don't destroy fields when event removal failsLinux
- CVE-2026-97923tracing: Free histogram the var ref when its initialization failsLinux
- CVE-2026-97922tracing: Free histogram var refs regardless of how often they are referencedLinux
- CVE-2026-97921tracing: Free histogram the field rejected for a bad modifierLinux
- CVE-2026-97920tracing: Keep the entry count when the histogram stats allocation failsLinux
- CVE-2026-97919tracing: Take the reference before publishing the named histogram triggerLinux
- CVE-2026-97918tracing: Undo the registration when enabling the histogram trigger failsLinux
- CVE-2026-97917accel/ivpu: Validate full buffer range in ivpu_to_cpu_addrLinux
- CVE-2026-97916accel/ivpu: Validate firmware log buffer metadataLinux
- CVE-2026-97915accel/ivpu: Limit firmware log name prints to field sizeLinux
- CVE-2026-97914accel: ethosu: Fix ethosu_job_open() return valueLinux
- CVE-2026-97913accel: ethosu: Ensure cmd stream ends with a stop opLinux
- CVE-2026-97912accel: ethosu: Ensure SRAM size is 0 on mapping failureLinux
- CVE-2026-97909ASoC: sti: initialize IRQ lock before requesting IRQLinux
- CVE-2026-97908Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_devLinux
- CVE-2026-97907Bluetooth: btrtl: Don't leak return code when parsing firmware format v2Linux
- CVE-2026-97906bootconfig: Fix integer overflow in initrd size checkLinux
- CVE-2026-97905cpufreq: zero-initialize policy cpumask before sysfs publicationLinux
- CVE-2026-97904cpufreq: initialize policy rwsem before sysfs publicationLinux
- CVE-2026-97902fs: don't return -EINVAL for successful nested thawLinux
- CVE-2026-97901genetlink: pin family module during policy dumpLinux
- CVE-2026-97900drm/drm_exec: fix up contended obj when num_objects is 0Linux
- CVE-2026-97899drm/i915: Fix memory leak in query_perf_config_list()Linux
- CVE-2026-97621drm/rockchip: analogix_dp: fix unchecked bound endpoint name lengthLinux
- CVE-2026-97620drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batchesLinux
- CVE-2026-97619io_uring/rw: end write accounting from ->ki_completeLinux
- CVE-2026-97617ring-buffer: Check resize_disabled before publishing the new subbuf orderLinux
- CVE-2026-97616net/sched: act_api: release all action references on NEWACTION failureLinux
- CVE-2026-97615net: bridge: use option bits for CFM/MRP frame handlersLinux
- CVE-2026-97614net: dsa: tag_brcm: legacy FCS: request needed tailroomLinux
- CVE-2026-97613net: mana: Reserve extra CQ slot for the fence completion CQELinux
- CVE-2026-97610netfs: Fix uninitialized return value in netfs_unbuffered_write()Linux
- CVE-2026-97607vdpa: ifcvf: Put device on unsupported feature errorLinux
- CVE-2026-97606fs: autofs: fix memory leak in autofs_fill_super()Linux
- CVE-2026-97605erofs: preserve LZMA decoders on resize failureLinux
- CVE-2026-97604fbdev: vfb: defer cleanup until the last referenceLinux
- CVE-2026-97603idpf: disable DIM work before freeing q_vectorsLinux
- CVE-2026-97601ieee802154: 6lowpan: fix NULL dereference in lowpan_newlinkLinux
- CVE-2026-97600ieee802154: cc2520: fix FIFOP work use-after-freeLinux
- CVE-2026-97599ieee802154: hwsim: serialize pib updates to fix double-freeLinux
- CVE-2026-97598ipv4: fib: bound automatic table ID allocationLinux
- CVE-2026-97597ipv6: flowlabel: cap duplicate leases per socketLinux
- CVE-2026-97596ipvs: reject invalid states in connection template sync recordsLinux
- CVE-2026-97593iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFXLinux
- CVE-2026-97592s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithmLinux
- CVE-2026-97591s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engineLinux
- CVE-2026-97590s390/crypto: Fix missing scrub of temp buffers with PAES algorithmLinux
- CVE-2026-97588s390/crypto: Map EBUSY to EIO when key conversion fails repeatedlyLinux
- CVE-2026-97587perf: RISC-V: store available counter mask as bitmapLinux
- CVE-2026-97586afs: Fix missing kunmap in afs_dir_search_bucket()Linux
- CVE-2026-97585afs: Fix double-unmap of directory blockLinux
- CVE-2026-97582hwmon: (gpio-fan) Fix use-after-free in alarm workLinux
- CVE-2026-97581media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacityLinux
- CVE-2026-97574bnxt_en: Don't free the live ring's TPA state on queue restart failureLinux
- CVE-2026-97572bnxt_en: Propagate RX ring init failures in bnxt_init_nic()Linux
- CVE-2026-97571bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()Linux
- CVE-2026-97569bnxt_en: Prevent queue stop with deferred completionsLinux
- CVE-2026-97568mptcp: syncookies: remember the request backup flagLinux
- CVE-2026-97567mptcp: prevent race between disconnect() and rtxLinux
- CVE-2026-97566mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0Linux
- CVE-2026-97565smb: client: reject short READ responses in CIFSSMBRead()Linux
- CVE-2026-97564smb: client: reject userspace cifs.idmap descriptionsLinux
- CVE-2026-97563smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()Linux
- CVE-2026-97561smb: client: honor forceuid/forcegid when mapping SIDs to uid/gidLinux
- CVE-2026-97560smb: client: fix one-byte OOB read in smb2_parse_native_symlink()Linux
- CVE-2026-97559smb: client: fail DACL rewrite when the new DACL exceeds 64KLinux
- CVE-2026-97558smb: client: fix cifsFileInfo reference leak in deferred closeLinux
- CVE-2026-97556smb: client: avoid leaking refcount when cifs_sb_tlink() failsLinux
- CVE-2026-97554smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()Linux
- CVE-2026-97553xfs: lock the healthmon when inserting unmount eventLinux
- CVE-2026-97552xfs: initialise error in xfs_defer_finish_one()Linux
- CVE-2026-97551xfs: initialise args->total for parent pointer updatesLinux
- CVE-2026-97550xfs: fix unit conversions in per_binval computationLinux
- CVE-2026-97549xfs: fix under-reservation of blocks when repairing sf directoriesLinux
- CVE-2026-97547xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTENLinux
- CVE-2026-97546xfs: don't spin forever on zero-length dirents when salvaging themLinux
- CVE-2026-97545xfs: don't leak new_bp if xfs_btree_bload_drop_buf failsLinux
- CVE-2026-97544xfs: don't leak dqacct if rhashtable insertion failsLinux
- CVE-2026-97543xfs: destroy seen inode bitmap when we fail to add a dirpathLinux
- CVE-2026-97542xfs: bail out on bitmap errors in xrep_agfl_fillLinux
- CVE-2026-97541wifi: ath9k_htc: don't store usb_device_idLinux
- CVE-2026-97540net: usb: pegasus: don't rely on id table pointer arithmeticLinux
- CVE-2026-97539usb: xusbatm: don't rely on id table pointer arithmeticLinux
- CVE-2026-97538hwmon: (asus_rog_ryujin) Validate HID report lengthsLinux
- CVE-2026-97537scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap lockingLinux
- CVE-2026-97535scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap sizeLinux
- CVE-2026-97534f2fs: accurately adjust free_sections during free_segment_rangeLinux
- CVE-2026-97533x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAFLinux
- CVE-2026-97532scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error pathLinux
- CVE-2026-97530scsi: qla2xxx: Fix soft lockup polling continuation IOCB signatureLinux
- CVE-2026-97529scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]Linux
- CVE-2026-97526s390/pai: Support CPU hotplug for PMU PAILinux
- CVE-2026-97522mptcp: fix bad accounting in __mptcp_subflow_push_pending()Linux
- CVE-2026-92106lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSSdashbitco lazy_html · lazy_html
- CVE-2026-88848MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction BypassMasterStudy LMS
- CVE-2026-80514wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit BypasswpForo Forum
- CVE-2026-6088Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-6087Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-6086Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-6085Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-86837Bookly < 28.3 - Unauthenticated Customer PII Update via Verification BypassBookly
- CVE-2026-6084Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-6083Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-6082Stored Cross-Site Scripting in StockAgile by Novadigits technologiesNovadigits technologies StockAgile
- CVE-2026-92573Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON renderingApache Software Foundation Apache Qpid Broker-J
- CVE-2026-97863misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Valuesmisp-modules
- CVE-2026-12037Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parametergabelivan Asset CleanUp: Page Speed Booster
- CVE-2026-13179WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameterflippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, S…
- CVE-2026-17602SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parametersslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
- CVE-2026-93656User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Fieldcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-17577SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parametersslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
- CVE-2026-93747wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Fieldtomdever wpForo Forum
- CVE-2026-88996WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parametersmub WPForms – AI Form Builder for WordPress – Contact Form…
- CVE-2026-96448Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalationRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-93477Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ashash-project ash · ash
- CVE-2026-94376Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Namewordplus Better Messages – Chat Rooms, Group Chat, Private…
- CVE-2026-92746Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attributejegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…
- CVE-2026-92799Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_dataladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-92829Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlerspr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2026-96766GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameterpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-19775OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpointallterraindeveloper OpenStation: Desktop Windows, Dock & Vi…
- CVE-2026-93899Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameterwordplus Better Messages – Chat Rooms, Group Chat, Private…
- CVE-2026-92212JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Fieldjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-93897GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')paoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-75553Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a Tohoku Electric Power Company, Incorporated Tohoku Electric…
- CVE-2026-97846Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key bindingRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-78397Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link ValidationLink Library
- CVE-2026-78394Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' ParameterLink Library
- CVE-2026-78393Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb LinksLink Library
- CVE-2026-97721Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorizationSanluan PublicCMS
- CVE-2026-97764django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attackerdjango-allauth
- CVE-2026-97736tinyauth before 5.1.3 allows rule bypass by appending an allowed route string.tinyauth
- CVE-2025-14814CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcodewipeoutmedia CSS & JavaScript Toolbox
- CVE-2026-97732IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and IRONMACE Ironshield
- CVE-2026-97650ningzichun student-management-system addLog.php echo cross site scriptingningzichun student-management-system
- CVE-2026-97724A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing swmansion React Native Reanimated
- CVE-2026-97723madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering functionality.madpsy ka9q_ubersdr
- CVE-2026-97649ningzichun student-management-system example_lite.sql default credentialsningzichun student-management-system
- CVE-2026-95811Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict itLemonldap-NG-Handler
- CVE-2026-97648ningzichun student-management-system cross-site request forgeryningzichun student-management-system
- CVE-2026-97647ningzichun student-management-system editLog.php authorizationningzichun student-management-system
- CVE-2026-97646ningzichun student-management-system getStudent.php authorizationningzichun student-management-system
- CVE-2026-53493Containerd has image-pull DoS via crafted OCI index graph amplificationcontainerd · github.com/containerd/containerd/v2 +1
- CVE-2026-85417Incomplete property masking in the SANnav logging subsystemBrocade SANnav
- CVE-2026-51772A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance.
- CVE-2026-78902Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG packa
- CVE-2026-88389Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c.
- CVE-2026-88420A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authen