CVEs published October 22, 2026
485 CVEs were published on October 22, 2026: 66 critical, 162 high. 2 are now in CISA KEV.
- Published
- 485
- Critical
- 66
- High
- 162
- Medium
- 207
- Low
- 46
- Unrated
- 4
- Now in CISA KEV
- 2
- Fix available
- 305
Most affected products
- Hewlett Packard Enterprise (HPE) ArubaOS
- 71
- Drupal Webform · drupal/webform
- 20
- Roundcube Webmail
- 19
- openbao
- 12
- Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- 11
- MongoDB C# Driver
- 10
- Kiloview E3 Firmware
- 9
- lxc incus
- 9
- traefik
- 9
- bytecodealliance wasmtime · wasmtime
- 8
Critical 66
- CVE-2026-110243Kiloview E3 NDI Encoder OS Command InjectionKiloview E3 Firmware
- CVE-2026-107861Kiloview E3 NDI Encoder OS Command InjectionKiloview E3 Firmware
- CVE-2026-109122Kiloview E3 NDI Encoder OS Command InjectionKiloview E3 Firmware
- CVE-2026-110063VM Inspector for Azure Virtual Machines Elevation of Privilege VulnerabilityMicrosoft VM Inspector for Azure Virtual Machines
- CVE-2026-83938Azure Kubernetes Configuration Service Elevation of Privilege VulnerabilityMicrosoft Azure Kubernetes Configuration Service
- CVE-2026-97785AAD App Proxy Elevation of Privilege VulnerabilityMicrosoft Entra application proxy
- CVE-2026-105014Azure Pipelines Remote Code Execution VulnerabilityMicrosoft Azure Pipelines
- CVE-2026-114625Security Advisory 0199Arista Networks VeloCloud Orchestrator
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowbytecodealliance wasmtime · wasmtime
- CVE-2026-115377Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Streamlxc incus
- CVE-2026-115375Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumeslxc incus
- CVE-2026-115372Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_optionslxc incus
- CVE-2026-115353Mistune before 3.3.0 Path Traversal via include Directivelepture mistune
- CVE-2022-51026Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Loginbytebase · github.com/bytebase/bytebase
- CVE-2026-79876Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame ProcessingHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79875Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative AccessHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79874Authentication Bypass in the API allows Administrative Access of AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79873Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative AccessHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79872Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79871Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79870Authentication Bypass leads to Unauthorized Access in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79869Authentication Bypass Leading to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79868Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79867Authentication Bypass Leading to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79866Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
Show all 66 entriesShow fewer entries
- CVE-2026-79865Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79864Unauthenticated Adjacent Command Injection Vulnerability in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79863Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code ExecutionHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79862Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code ExecutionHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79861Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79860Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79859Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79858Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79857Unauthenticated Command Injection Vulnerability in AOS-8 PAPI ProtocolHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79856Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79855Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System CompromiseHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79854Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79853Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79852Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79851Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79850Authentication Bypass Leading to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79849Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79848Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79847Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79846Unauthenticated Command Injection Vulnerabilities in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79844Authentication Bypass Leading to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-114612LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeyBerriAI litellm · litellm
- CVE-2026-114611OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijackschorschii OCO-Server
- CVE-2026-114607better-auth: OAuth state can be used as a Magic Link to sign in as another userbetter-auth
- CVE-2026-97631Pre-boot RCE in EDK II PXE driverTianoCore EDK2
- CVE-2026-111497Out-of-Bounds Write in Google Brotli DecoderGoogle Brotli · node +7
- CVE-2026-102785Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52yootheme.com YOOtheme Pro extension for Joomla
- CVE-2026-112832WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerabilityCozyThemes Rootblox
- CVE-2026-115324mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Storemem0ai mem0 · mem0ai
- CVE-2021-48016DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.phpDedeCMS
- CVE-2021-48014FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServerFanRuan FineReport
- CVE-2026-112241WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerabilityBrainstorm Force SureCart
- CVE-2026-112327WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerabilityTMS Amelia
- CVE-2026-114220NewType Infortech｜NT OneAPP - Improper Certificate ValidationNewType Infortech NT OneAPP
- CVE-2026-114219NewType Infortech｜NT OneAPP - Hard-coded CredentialsNewType Infortech NT OneAPP
- CVE-2026-114661OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsopenremote
- CVE-2026-96355Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175Drupal Webform · drupal/webform
- CVE-2026-114575TOTOLINK A950RG product.so UploadCustomModule command injectionTOTOLINK A950RG
- CVE-2026-110264Integer Overflow or Wraparound in GitLabGitLab
- CVE-2025-65200An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL
- CVE-2026-78846Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.
High 162
- CVE-2026-110825Kiloview E3 NDI Encoder Missing Authentication for Critical FunctionKiloview E3 Firmware
- CVE-2026-92450Kiloview E3 NDI Encoder Use of Hard-coded CredentialsKiloview E3 Firmware
- CVE-2026-110491Kiloview E3 NDI Encoder NULL Pointer DereferenceKiloview E3 Firmware
- CVE-2026-96185Microsoft Exchange Online Remote Code Execution VulnerabilityMicrosoft Exchange Online
- CVE-2026-108456Azure AI Foundry Elevation of Privilege VulnerabilityMicrosoft Azure AI Foundry
- CVE-2026-111594InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive InformationInterSystems IRIS for Health
- CVE-2026-114616Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)authlib
- CVE-2026-114615Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysauthlib
- CVE-2026-115417Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttaws-c-mqtt
- CVE-2026-115419Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS strands-agents · AWS strands-agents/sdk +2
- CVE-2026-112332Motor.NET < 0.19.0 Denial of Service via JsonNet DeserializationGDATASoftwareAG motornet
- CVE-2026-112331Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent MappingGDATASoftwareAG motornet
- CVE-2026-112330Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents HeadersGDATASoftwareAG motornet
- CVE-2026-115508Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fieldsunclecode crawl4ai
- CVE-2026-115506libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delaylibexpat
- CVE-2026-115505libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnumsahlberg libsmb2
- CVE-2026-115504CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.cHEASARC cfitsio
- CVE-2026-115392Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashesbytecodealliance wasmtime · wasmtime
- CVE-2026-114653Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builderMongoDB C# Driver
- CVE-2026-114652Update operator injection via single-element list rewriting in the update builderMongoDB C# Driver
- CVE-2026-114649Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cacheMongoDB C# Driver
- CVE-2026-114648NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keysMongoDB C# Driver
- CVE-2026-114644Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserializationMongoDB C# Driver
- CVE-2026-115376Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copylxc incus
- CVE-2026-115374Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLslxc incus
Show all 162 entriesShow fewer entries
- CVE-2026-115373Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}lxc incus
- CVE-2026-115371LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpointslxc incus
- CVE-2026-115365OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversalopenbao
- CVE-2026-115355Mistune before 3.3.0 Path Traversal and XSS via Include Directivelepture mistune · mistune
- CVE-2026-114519Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accountsRoskus Prospero Flow CRM
- CVE-2026-115354Mistune before 3.3.0 Arbitrary Local File Read via Include Directivelepture mistune
- CVE-2026-115352Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parserlepture mistune
- CVE-2026-115349Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsinglepture mistune
- CVE-2026-115348Mistune before 3.3.0 Quadratic-Time DoS via parse_link_textlepture mistune
- CVE-2026-115347Mistune before 3.3.0 Quadratic Denial of Service via parse_link_textlepture mistune
- CVE-2026-95713Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95712Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI ProtocolHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95711Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95710Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95709Authenticated Command Injection Vulnerabilities in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95708Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95707Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95706Authenticated Command Injection Vulnerabilities in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95705Authenticated Command Injection Vulnerabilities in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95704Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79956Improper Sanitization leads to Command Injection in AOS-8 Web InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79955Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79895Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79894Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79893Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79892Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79891Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79890Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79889Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code ExecutionHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79888Unauthenticated Buffer Overflow allows Remote Code Execution in web interfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79887Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79886Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79885Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79884Authentication Bypass leads to Sensitive Information Disclosure in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79883Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79882Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79881Authentication Bypass Leading to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79880Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79879Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79878Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-79877Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-115414OS command injection in the Terraform hook in AWS SAM CLIaws-sam-cli
- CVE-2026-114613MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failuremsgpack-python · msgpack
- CVE-2026-113874SmileCDR HAPI FHIR trusted tenant partition overrideSmileCDR HAPI FHIR
- CVE-2026-113873SmileCDR HAPI FHIR improper data decompressionSmileCDR HAPI FHIR
- CVE-2026-97635Agent Zero Web UI XSSAgent Zero
- CVE-2026-108357PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServicePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-13599ABB Ability Edgenius | Missing Authentication in Edgenius AuthDBABB Ability Edgenius
- CVE-2026-108359PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-93336Missing authorization in the unit resources download route in Juju controllersCanonical Juju
- CVE-2026-108358PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServicePHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-115416Incorrect authorization checks in Amazon Athena engine version 3 query processingAWS Amazon Athena
- CVE-2026-104068JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup RestoreJetBackup
- CVE-2026-114605dnspython dns.name.from_wire_parser() excessive CPU userthalley dnspython · dnspython
- CVE-2026-75507GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rulegraphql-python graphql-core · graphql-core
- CVE-2026-75508GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitgraphql-python graphql-core · graphql-core
- CVE-2026-94482Next.js: Denial of Service in App Router using Server Actionsvercel next.js · next
- CVE-2026-115453Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queriesMarcosCamara01 Ecommerce Template
- CVE-2026-115450Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifierMarcosCamara01 Ecommerce Template
- CVE-2026-115482In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not lilitespeedtech lsquic
- CVE-2026-61791OCO-Server: Stored XSS through agent hostnames in command buttonsschorschii OCO-Server
- CVE-2026-16477Insecure Deserialization of .cleanshot Files in CleanShot XMTW CleanShot X
- CVE-2026-114510Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from…stevereiner flexible-graphrag · flexible-graphrag
- CVE-2026-111181body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parser
- CVE-2026-113872multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulter
- CVE-2026-85079Out-of-bounds write in Zigbee Simple_Desc_req handlingSilicon Labs EmberZNet
- CVE-2026-94502Out-of-bounds write in Zigbee Publish Price Matrix handlingSilicon Labs EmberZNet
- CVE-2026-66279Dis-connect vulnerability in Connect StackSilicon Labs Connect SDK
- CVE-2026-92709Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCErsyslog
- CVE-2026-113582Apache Abdera: XML external entity expansion in Atom document parsingApache Software Foundation Apache Abdera
- CVE-2026-112822WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerabilityAmentoTech Workreap Core
- CVE-2026-115334Lotus through 0.10.2 Authorization Bypass via switch_organization Endpointuselotus lotus
- CVE-2026-115333Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefixuselotus lotus
- CVE-2026-115332Lotus through 0.10.2 SQL Injection via Subscription Filter Keysuselotus lotus
- CVE-2026-115331Lotus through 0.10.2 SQL Injection via Metric Property Names and Filtersuselotus lotus
- CVE-2026-115330Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metricsuselotus lotus
- CVE-2026-115328JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead APIriclolsen json-scada
- CVE-2026-115325Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookupgravitl netmaker
- CVE-2026-114665Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileComparezhenorzz goploy · github.com/zhenorzz/goploy
- CVE-2025-71434Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/listWeaver Network Co. E-cology
- CVE-2024-58396YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileIdYouDataSum CPAS Audit Management System
- CVE-2024-58393i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.phpi-Netsolution Readymade Unilevel Ecommerce MLM
- CVE-2022-51025Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transferPenta Security Systems WAPPLES
- CVE-2022-51024Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload EndpointKareadita Kavita
- CVE-2022-51023PHPOK < 5.4.081 SQL Injection via api.php sort ParameterPHPOK
- CVE-2022-51022YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpointliukuo362573 YiShaAdmin
- CVE-2022-51021NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpointWPDeveloper NotificationX
- CVE-2021-48017OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgiOrbiTeam BSCW Server
- CVE-2021-48015JeeWMS Path Traversal via showOrDownByurl.doerzhongxmu JeeWMS
- CVE-2021-48013Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownloadWeaver Network Co. E-cology
- CVE-2019-25779WooThemes Diarise 1.5.9 Local File Disclosure via download.phpWooThemes Diarise
- CVE-2019-25778SeaCMS 8.7 SQL Injection via comment/api/index.php rlist ParameterSeaCMS
- CVE-2018-25439MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir ParameterMetInfo
- CVE-2018-25438Intermesh Group-Office < 3.5.5 Path Traversal via compress.phpIntermesh Group-Office
- CVE-2017-20289Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameterBroadstreet Ad Widget
- CVE-2017-20287Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn ParameterJavo Themes Javo Spot
- CVE-2026-111079Goose: goose: shell history and environment leak via terminal integrationRed Hat Enterprise Linux
- CVE-2026-112313WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerabilityACF Extended
- CVE-2026-112820WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerabilityElated-Themes Academist Core
- CVE-2026-112085webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradeswebpack-dev-server
- CVE-2026-115253WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log TamperingWatchGuard Agent
- CVE-2026-111851WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerabilityWProyal Royal Elementor Addons
- CVE-2026-112312WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerabilityACF Extended
- CVE-2026-111830WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerabilityWP Mailster
- CVE-2026-112242WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerabilityCozmoslabs Profile Builder
- CVE-2026-112379WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerabilityCodepeople Contact Form Email
- CVE-2026-93471Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-86696Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionhandnot2 esaml · arekinath esaml +2
- CVE-2026-105270Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath esaml · handnot2 esaml +2
- CVE-2026-114177WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerabilityXpro Elementor Addons
- CVE-2026-97328WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML ParserWebP Express
- CVE-2026-111958Royal MCP < 1.5.7 - Authentication Bypass via Preview Link TokenRoyal MCP
- CVE-2026-109987PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via CookiePixelYourSite
- CVE-2026-109927CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_roleHIPAA Forms
- CVE-2026-110353HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncateHAProxy
- CVE-2026-110354HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via aHAProxy
- CVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.Roundcube Webmail
- CVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.Roundcube Webmail
- CVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().Roundcube Webmail
- CVE-2026-114664Frappe before 16.33.0 Blind SQL Injection via get_eventsfrappe
- CVE-2026-114663Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Argumentsvyperlang vyper
- CVE-2026-114662Obot before 0.26.0 API Key Theft via CLI Login Token Requestobot-platform obot
- CVE-2026-114660Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directivesgetgrav grav
- CVE-2026-114659Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routesgetgrav grav-plugin-flex-objects
- CVE-2026-114658Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invitegetgrav grav-plugin-login
- CVE-2026-114642Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Trippertraefik
- CVE-2026-114640Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Routertraefik
- CVE-2026-114639Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pooltraefik
- CVE-2026-114638Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collisiontraefik
- CVE-2026-114637Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leaktraefik
- CVE-2026-114636Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Routertraefik
- CVE-2026-114635Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Schemetraefik
- CVE-2026-114633WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.phpWWBN AVideo
- CVE-2026-114720Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.Roundcube Webmail
- CVE-2026-96365Webform - Less critical - Denial of service - SA-CONTRIB-2026-170Drupal Webform · drupal/webform
- CVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.Roundcube Webmail
- CVE-2026-51954An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL…
Medium, low and unrated 257
- CVE-2026-115534gedelumbung HospitalManagement Contact Form contact.php kirim cross site scriptinggedelumbung HospitalManagement
- CVE-2026-105265Kiloview E3 NDI Encoder Path TraversalKiloview E3 Firmware
- CVE-2026-96616Kiloview E3 NDI Encoder Insufficient Session ExpirationKiloview E3 Firmware
- CVE-2026-111100Kiloview E3 NDI Encoder Missing Authentication for Critical FunctionKiloview E3 Firmware
- CVE-2026-114620Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFauthlib
- CVE-2026-114619Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensauthlib
- CVE-2026-114618Authlib: Default JWT bearer grant accepts assertions for the wrong audienceauthlib
- CVE-2026-114617Authlib: ID token can disable its own nonce validation via the nonce_supported claimauthlib
- CVE-2026-115449Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guestRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-115221Ipa: freeipa: freeipa uses subject cn as proof of certificate ownershipRed Hat Enterprise Linux
- CVE-2026-115424Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destinationRed Hat OpenShift Container Platform
- CVE-2026-114614Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsauthlib
- CVE-2026-114583tar filter allows writing outside destination via empty-named symlinkPython Software Foundation CPython · libpython +2
- CVE-2026-115509Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state APIjitsucom jitsu
- CVE-2026-115507Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Headergo-vikunja vikunja
- CVE-2026-115503Ghidra before 12.2 Denial of Service via Compressed Extension ArchiveNationalSecurityAgency ghidra
- CVE-2026-115398Ghidra before 12.2 Denial of Service via TAR and ZIP File System MountNationalSecurityAgency ghidra
- CVE-2026-115397Ghidra before 12.2 Denial of Service via Extension Archive InstallNationalSecurityAgency ghidra
- CVE-2026-115396Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme ArchiveNationalSecurityAgency ghidra
- CVE-2026-115395Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()NationalSecurityAgency ghidra
- CVE-2026-114655KMS request injection via unsanitized key vault and provider values in libmongocryptMongoDB libmongocrypt
- CVE-2026-115394Ghidra through 12.2 Denial of Service via BinaryField Memory AllocationNationalSecurityAgency ghidra
- CVE-2026-114654BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guardsMongoDB C# Driver
- CVE-2026-115393Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusionbytecodealliance wasmtime · wasmtime
- CVE-2026-115391Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamsbytecodealliance wasmtime · wasmtime
Show all 257 entriesShow fewer entries
- CVE-2026-114651Cross-document data leak via malformed BSON array parsing in reused thread bufferMongoDB C# Driver
- CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoSbytecodealliance wasmtime · wasmtime
- CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIbytecodealliance wasmtime · wasmtime
- CVE-2026-114650Plaintext exposure of encrypted fields via ANSI code-page corruption of database nameMongoDB C# Driver · MongoDB.Libmongocrypt NuGet package
- CVE-2026-115388Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Writebytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-115387Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflowbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdirbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115385Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestampsbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-114647NoSQL operator injection via unvalidated replacement document in findOneAndReplaceMongoDB C# Driver
- CVE-2026-114646NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wireMongoDB C# Driver
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importsbytecodealliance wasmtime · wasmtime
- CVE-2026-115382Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoSbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-114645Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrappingMongoDB C Driver
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroesbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115380Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-114643Duplicate geometry fields via unvalidated GeoJSON extra membersMongoDB C# Driver
- CVE-2026-115379Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_callbytecodealliance wasmtime · wasmtime
- CVE-2026-115378Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pulllxc incus
- CVE-2026-115370Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refreshlxc incus
- CVE-2026-115369OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANsopenbao
- CVE-2026-115366OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIsopenbao
- CVE-2026-115364OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpointsopenbao
- CVE-2026-115363OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configurationopenbao
- CVE-2026-115362OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypassopenbao
- CVE-2026-115361OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denialopenbao
- CVE-2026-115360OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UIopenbao
- CVE-2026-115359OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsingopenbao
- CVE-2026-115358OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parametersopenbao
- CVE-2026-115357OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responsesopenbao
- CVE-2026-115356OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocationopenbao
- CVE-2026-115351Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Optionlepture mistune
- CVE-2026-115350Mistune before 3.3.0 Stored XSS via Include Directive HTML Fileslepture mistune
- CVE-2026-95721Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95720Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95719Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95718Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95717Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95716Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration ChangesHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95715Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-95714Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10Hewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-115519Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business HubKNIME Business Hub
- CVE-2026-115517Unrestricted network access between execution contexts in KNIME Business HubKNIME Business Hub
- CVE-2026-113876SmileCDR HAPI FHIR unauthorized readSmileCDR HAPI FHIR
- CVE-2026-113875SmileCDR HAPI FHIR unauthorized read via subscriptionSmileCDR HAPI FHIR
- CVE-2026-77157ast-cli: Auto-update downloads are not verified against a checksum before executiongithub.com/checkmarx/ast-cli
- CVE-2026-77156ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directorygithub.com/checkmarx/ast-cli
- CVE-2026-108360PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-54238Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorizationsupabase realtime
- CVE-2026-114610fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'py-pdf fpdf2 · fpdf2
- CVE-2026-114609fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled contentpy-pdf fpdf2 · fpdf2
- CVE-2026-54532CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theftCloudPirates-io helm-charts
- CVE-2026-115513OpenCATS before 0.12.0 Stored XSS via MRU Navigation PanelOpenCATS
- CVE-2026-114608Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOMEpylint-dev pylint · pylint
- CVE-2026-114606draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)jgraph drawio-desktop
- CVE-2026-115502DataApp links without login expose job information to other user in KNIME Business HubKNIME Business Hub
- CVE-2026-115496Workflow names may be leaked to unauthenticated users in KNIME Business HubKNIME Business Hub
- CVE-2026-114487Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and…Devolutions Server
- CVE-2026-115494CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business HubKNIME Business Hub
- CVE-2026-114486Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated…Devolutions Server
- CVE-2026-114485Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an…Devolutions Server
- CVE-2026-114603OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiopen-telemetry opentelemetry-python · opentelemetry-api
- CVE-2026-115454Large tables in data apps can bring down execution services in KNIME HubKNIME Business Hub
- CVE-2026-114515OCO-Server: Self-Service Portal uninstall-job authorization bypassschorschii OCO-Server
- CVE-2026-89410Out-of-bounds read in Z-Wave NCP SPI HandlerSilicon Labs Z-Wave SDK
- CVE-2026-89409Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End NodesSilicon Labs Z-Wave SDK
- CVE-2026-115249subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validationsubhajitkhan online-clinic-management-system
- CVE-2026-66282Authenticated Denial-of-Service in Zigbee Publish Billing PeriodSilicon Labs EmberZNet
- CVE-2026-66281Authenticated Denial-of-Service in Zigbee Discover Attributes HandlingSilicon Labs EmberZNet
- CVE-2026-85080Authenticated Denial-of-Service in Zigbee GetGroupMembership HandlingSilicon Labs EmberZNet
- EEF-CVE-2026-111497Out-of-bounds write in the Brotli decoder bundled with erl-brotlibrotli
- CVE-2026-115248subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflowsubhajitkhan online-clinic-management-system
- CVE-2026-115400crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokenscrawlseo
- CVE-2026-115411crawlseo before 0.2.4 Server-Side Request Forgery via Crawlercrawlseo
- CVE-2026-115247subhajitkhan online-clinic-management-system patientregistration.php missing encryptionsubhajitkhan online-clinic-management-system
- CVE-2026-115246subhajitkhan online-clinic-management-system patdocmsg.php cross site scriptingsubhajitkhan online-clinic-management-system
- RUSTSEC-2026-0407SSRF and local file disclosure via unvalidated URLswebpage
- RUSTSEC-2026-0411Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`dahl-salso
- RUSTSEC-2026-0457OAuth client SSRF filter checks host strings, not resolved addressesrmcp
- CVE-2026-112842WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-115329Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSetuselotus lotus
- CVE-2026-115327libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC ParserCESNET libyang
- CVE-2026-115326QloApps through 1.7.0 IDOR via OrderDetailController Refund RequestWebkul QloApps
- CVE-2026-115323EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address APIevershopcommerce evershop
- CVE-2026-115322Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlersbytebase
- CVE-2026-115321Bytebase before 3.16.0 Authorization Bypass via UpdateIssueCommentbytebase
- CVE-2026-115319fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContentsjunegunn fzf
- CVE-2024-58394Retool < 3.88.0 XSS via /api/imageProxy SVG ProxyingRetool
- CVE-2023-54413WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_langOnTheGoSystems WPML Multilingual CMS
- CVE-2020-37284Sickbeard build-507 Reflected XSS via testNaming pattern Parametermidgetspy Sickbeard
- CVE-2017-20290Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedDiscourse
- CVE-2017-20288QCubed 3.1.1 Reflected XSS via installer step_2.phpQCubed
- CVE-2026-13411Null condition in Playbooks import crashes the pluginMattermost
- CVE-2026-115207Patch: filename validation bypass in reversal fallback allows file creation outside the working directoryRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-114348webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpointwebpack-dev-server
- CVE-2026-106017Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage rOpenVPN 3 Core Library
- CVE-2026-21812Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)HCL Software AppScan Integration with Azure Boards for ASoC…
- CVE-2026-21811Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)HCL Software AppScan Integration with Azure Boards for ASoC…
- CVE-2026-114703WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerabilityhupe13 Extensions for Leaflet Map
- CVE-2026-114702WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerabilitynicdark ND Shortcodes For Visual Composer
- CVE-2026-114701WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerabilityxootix Waitlist Woocommerce
- CVE-2026-114700WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityGloriafood Restaurant Menu – Food Ordering System – Table R…
- CVE-2026-114699WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerabilityyoomoney ЮKassa для WooCommerce
- CVE-2026-110974Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-jsonvaadin android-json
- CVE-2026-114195WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerabilityWP Desk ShopMagic
- CVE-2026-112218WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerabilityAhmad Majestic Support
- CVE-2026-114696WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerabilityminiOrange Page Restriction WordPress
- CVE-2026-111842WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerabilityWP Sunshine Sunshine Photo Cart
- CVE-2026-96293Endpoint Security Cleartext Storage of FileVault Recovery Key in Log FileWatchGuard Agent
- CVE-2026-112311WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerabilityACF Extended
- CVE-2026-112845WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerabilityJory Hogeveen Off-Canvas Sidebars & Menus
- CVE-2026-110893WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerabilityBrainstorm Force SureDash
- CVE-2026-110894WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerabilityBrainstorm Force SureDash
- CVE-2026-114698WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerabilitymyCred
- CVE-2026-114182WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerabilityIdeaBox Creations PowerPack Addons for Elementor
- CVE-2026-112843WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerabilityWP Chill Strong Testimonials
- CVE-2026-112826WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerabilityeLightUp Falcon – WordPress Optimizations & Tweaks
- CVE-2026-114180WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerabilityWpmet Metform
- CVE-2026-111847WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerabilityKings Plugins MarketKing
- CVE-2026-114175WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerabilityDigitalME eRoom
- CVE-2026-112867WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerabilityH5P
- CVE-2026-114184WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerabilityWPVibes Elementor Addon Elements
- CVE-2026-103634Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketchApache Software Foundation Apache DataSketches
- CVE-2026-114460Mod_qos: query truncation during json body merging permits security-rule bypasspbuchbinder mod_qos
- CVE-2026-114459Mod_qos: out-of-bounds reads in response-body substring matchingpbuchbinder mod_qos
- CVE-2026-114458Mod_qos: undersized connection-monitor scratch array permits heap buffer overflowpbuchbinder mod_qos
- CVE-2026-114457Mod_qos: missing nul termination in json value escaping permits out-of-bounds readspbuchbinder mod_qos
- CVE-2026-88849MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student EnrollmentMasterStudy LMS WordPress Plugin
- CVE-2026-78392Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' ParameterLink Library
- CVE-2026-111972Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDORPhoto Engine
- CVE-2026-111971Photo Engine < 6.5.8 - Author+ Stored XSS via Collection NamePhoto Engine
- CVE-2026-110011MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via ExportMB Custom Post Types & Custom Taxonomies
- CVE-2026-110010MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' ParameterMB Custom Post Types & Custom Taxonomies
- CVE-2026-109931Infility Global < 2.16.25 - Unauthenticated Google Translate API Key UpdateInfility Global
- CVE-2026-103234WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer EmailWP Ultimate Review
- CVE-2026-100142FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDORFluentCart A New Era of eCommerce
- CVE-2026-114570WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick EditWordPress Foundation WordPress
- CVE-2026-114223NewType Infortech｜NT OneAPP - Exposure of Sensitive InformationNewType Infortech NT OneAPP
- CVE-2026-114222NewType Infortech｜NT OneAPP - Authentication BypassNewType Infortech NT OneAPP
- CVE-2026-114221NewType Infortech｜NT OneAPP - Credential DisclosureNewType Infortech NT OneAPP
- CVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations.Roundcube Webmail
- CVE-2026-114731Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy…Roundcube Webmail
- CVE-2026-114729Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass.Roundcube Webmail
- CVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributesRoundcube Webmail
- CVE-2026-114577oretnom23 php-travel-agency-system Insertion insert.php sql injectionoretnom23 php-travel-agency-system
- CVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action.Roundcube Webmail
- CVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.Roundcube Webmail
- CVE-2026-114723Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation.Roundcube Webmail
- CVE-2026-114657Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Urigetgrav grav
- CVE-2026-114656Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matchertraefik
- CVE-2026-114641Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Trippertraefik
- CVE-2026-114634WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL RedirectWWBN AVideo
- CVE-2026-114722Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages.Roundcube Webmail
- CVE-2026-114721Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed.Roundcube Webmail
- CVE-2026-114576Linksys RE6250 Web Management strcmp random valuesLinksys RE6250
- CVE-2026-114719Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the…Roundcube Webmail
- CVE-2026-114718Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin.Roundcube Webmail
- CVE-2026-84910Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118Drupal Advanced Search · drupal/advanced_search
- CVE-2026-84911AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119Drupal AI · drupal/ai
- CVE-2026-84912AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120Drupal AI · drupal/ai
- CVE-2026-84913AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121Drupal AI Translate · drupal/ai_translate
- CVE-2026-84914Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122Drupal Calculate Working Days · drupal/calculate_working_da…
- CVE-2026-84915Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123Drupal Component blocks · drupal/component_blocks
- CVE-2026-84923Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124Drupal Email Verification / SMS Verification / OTP Verifica…
- CVE-2026-84924Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125Drupal Email Verification / SMS Verification / OTP Verifica…
- CVE-2026-84916Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126Drupal Islandora · drupal/islandora
- CVE-2026-84917Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127Drupal Jsonapi Role Access · drupal/jsonapi_role_access
- CVE-2026-16648Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128Drupal Mailer Plus Log · drupal/symfony_mailer_log
- CVE-2026-81163Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129Drupal Media Library Importer · drupal/media_library_import…
- CVE-2026-84918Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130Drupal Monobank payment API · drupal/monobank
- CVE-2026-84919PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131Drupal PhotoSwipe - Responsive JavaScript Modal Image Galle…
- CVE-2026-84920Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132Drupal Unpublished Node Permissions
- CVE-2026-84921Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133Drupal Webform Submissions Delete
- CVE-2026-87936amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134Drupal amazee.ai Private AI Provider · drupal/ai_provider_a…
- CVE-2026-87937Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135Drupal Central Authentication System (CAS) Server · drupal/…
- CVE-2026-87938CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136Drupal CSP log · drupal/csp_log
- CVE-2026-87939Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137Drupal Feed Block · drupal/feed_block
- CVE-2026-87940Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138Drupal Key auth · drupal/key_auth
- CVE-2026-87941Patreon - Critical - Unsupported - SA-CONTRIB-2026-139Drupal Patreon
- CVE-2026-87942SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140Drupal SafeDelete · drupal/safedelete
- CVE-2026-87943SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87944SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87945SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87946SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87947SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87948SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87949SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87950SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87951SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87952SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87953SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-87954Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152Drupal Taxonomy Term Glossary · drupal/term_glossary
- CVE-2026-87955Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153Drupal Ultimate Table Field · drupal/ultimate_table_field
- CVE-2026-96360Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154Drupal Webform · drupal/webform
- CVE-2026-96361Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155Drupal Webform · drupal/webform
- CVE-2026-96358Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158Drupal Webform · drupal/webform
- CVE-2026-96359Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159Drupal Webform · drupal/webform
- CVE-2026-96362Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160Drupal Webform · drupal/webform
- CVE-2026-96363Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161Drupal Webform · drupal/webform
- CVE-2026-96367Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162Drupal Webform · drupal/webform
- CVE-2026-96368Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163Drupal Webform · drupal/webform
- CVE-2026-96370Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164Drupal Webform · drupal/webform
- CVE-2026-96369Webform - Less critical - Access bypass - SA-CONTRIB-2026-165Drupal Webform · drupal/webform
- CVE-2026-96371Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166Drupal Webform · drupal/webform
- CVE-2026-96372Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167Drupal Webform · drupal/webform
- CVE-2026-96373Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168Drupal Webform · drupal/webform
- CVE-2026-96366Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169Drupal Webform · drupal/webform
- CVE-2026-96364Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171Drupal Webform · drupal/webform
- CVE-2026-96357Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172Drupal Webform · drupal/webform
- CVE-2026-96398Webform - Less critical - Access bypass - SA-CONTRIB-2026-173Drupal Webform · drupal/webform
- CVE-2026-96356Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174Drupal Webform · drupal/webform
- CVE-2026-96375Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176Drupal Cloud · drupal/cloud
- CVE-2026-96376Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177Drupal Cloud · drupal/cloud
- CVE-2026-96374Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178Drupal Project Browser · drupal/project_browser
- CVE-2026-96378Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179Drupal Commerce Decoupled Checkout
- CVE-2026-96384Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180Drupal Mermaid Diagram Field · drupal/mermaid_diagram_field
- CVE-2026-96379CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181Drupal CookieCuttr · drupal/cookiecuttr
- CVE-2026-96385REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182REST & JSON API Authentication for Drupal · drupal/rest_api…
- CVE-2026-96387Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183Drupal Stop administrator login
- CVE-2026-96388Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184Drupal Tawk.to - Live chat application · drupal/tawk_to
- CVE-2026-96390Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185Drupal Editoria11y Accessibility Checker · drupal/editoria1…
- CVE-2026-96391Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186Drupal Webform REST · drupal/webform_rest
- CVE-2026-96392AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187Drupal AI CKEditor · drupal/ai_ckeditor
- CVE-2026-96377Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188Drupal Combined image style · drupal/combined_image_style
- CVE-2026-96380CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189Drupal CSS Usage Analyzer · drupal/css_usage_analyzer
- CVE-2026-96386Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190Drupal Smart Content · drupal/smart_content
- CVE-2026-96382Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191Drupal Diba carousel slider · drupal/diba_carousel
- CVE-2026-114717Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as…Roundcube Webmail
- CVE-2026-114715Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of…Roundcube Webmail
- CVE-2026-114714Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin.Roundcube Webmail
- CVE-2025-69723A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of
- CVE-2026-107079An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the…
- CVE-2026-78801An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitiv