CVEs published November 3, 2026
778 CVEs were published on November 3, 2026: 69 critical, 305 high. 1 is now in CISA KEV. 11 early warnings were posted.
- Published
- 778
- Critical
- 69
- High
- 305
- Medium
- 351
- Low
- 34
- Unrated
- 19
- Now in CISA KEV
- 1
- Fix available
- 526
- Early warnings
- 11
Most affected products
- Google Chrome
- 214
- Hewlett Packard Enterprise (HPE) Fabric Composer
- 46
- FreeRDP
- 27
- CGI
- 20
- Linux
- 19
- Quest Foglight for Databases
- 16
- AM System ALO Suite
- 15
- Hewlett Packard Enterprise (HPE) Virtual Intranet Access
- 9
- NVIDIA Slurm
- 8
- surrealdb
- 8
Early warnings 11
- SZB-b191afc8dbWorkOS says attacker accessed contact records and customer communication summariesWorkOS · internal sales app
- SZB-6f72a161a5Xsolis reports phishing-linked breach affecting nine health systemsXsolis
- SZB-49acf98068Chainstack reports unauthorized access to parts of its infrastructureChainstack
- SZB-cd29ee2e79DreamHost says hackers accessed its systems and customer session data for three monthsDreamHost · File Manager
- SZB-626b3ee2d0CISA advisory reports SQL command flaws in Subnet Solutions PowerSYSTEM CenterSubnet Solutions · PowerSYSTEM Center
- SZB-61849a44e4OPSSHIELD says attacker hijacked cPGuard update channel to backdoor Linux serversOPSSHIELD · cPGuard
- SZB-1ac4bc8960Barracuda warns customers to patch two flaws enabling root command executionBarracuda · Web Security Gateway, WAF Control Center, Web Application Firewall
- SZB-f01d9b6350Frontline Education data breach reportedly affects over 1.3 million peopleFrontline Education
- SZB-9dcda68ffbESET reports Gorbag hackers exploit WinRAR flaw to deploy info-stealing malwareRARLAB · WinRAR
- SZB-b9ba4e436fSiemens IoT2050 Advanced flaw CVE-2026-58115 reportedly exploited in the wildSiemens · SIMATIC IoT2050 Advanced
- SZB-d80473442cAttackers reportedly target unpatched CryptoPayment Gateway plugin flaw CVE-2026-81648CryptoPayment Gateway · WordPress plugin
Critical 69
- CVE-2026-92189Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92188Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92190Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-114549NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution VulnerabilityNoMachine
- CVE-2026-120647CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment…CGI
- CVE-2026-120644CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires valuesCGI
- CVE-2026-120642CGI versions before 5.00 for Perl return request-derived values untainted under taint modeCGI
- CVE-2026-120637CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHODCGI
- CVE-2022-29966Emerson Ovation Missing Authentication for Critical FunctionalityEmerson Ovation
- CVE-2026-22058CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)NETAPP StorageGRID
- CVE-2026-120931Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code…Google Chrome
- CVE-2026-112354Etrel INCH AC Charging Station Hard-coded Default CredentialsEtrel d.o.o. Etrel INCH
- CVE-2026-82158Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation…Dell Wyse Management Suite
- CVE-2026-121073Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…Google Chrome
- CVE-2026-121189Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…Google Chrome
- CVE-2026-121157Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access…Google Chrome
- CVE-2026-121077Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially…Google Chrome
- CVE-2026-121257Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…Google Chrome
- CVE-2026-121202Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially…Google Chrome
- CVE-2026-121030Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121200Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…Google Chrome
- CVE-2026-121234Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute…Google Chrome
- CVE-2026-121076Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute…Google Chrome
- CVE-2026-121060Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121034Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
Show all 69 entriesShow fewer entries
- CVE-2026-121104Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121241Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute…Google Chrome
- CVE-2026-121249Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…Google Chrome
- CVE-2026-121214Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code…Google Chrome
- CVE-2026-121114Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…Google Chrome
- CVE-2026-121250Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121089Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…Google Chrome
- CVE-2026-121148Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…Google Chrome
- CVE-2026-121131Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute…Google Chrome
- CVE-2026-121086Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox…Google Chrome
- CVE-2026-121037Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute…Google Chrome
- CVE-2026-121185Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121071Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121074Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…Google Chrome
- CVE-2026-121126Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the…Google Chrome
- CVE-2026-121247Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…Google Chrome
- CVE-2026-121035Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the…Google Chrome
- CVE-2026-121246Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary…Google Chrome
- CVE-2026-121229Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute…Google Chrome
- CVE-2026-121156Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…Google Chrome
- CVE-2026-115731Report Deserialization Code ExecutionPerforce Puppet Enterprise
- CVE-2026-115732Certificate Name Authorization BypassPerforce Puppet Enterprise
- CVE-2026-95860node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissionsnode-opcua · node-opcua-address-space +1
- CVE-2026-95733Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code ExecutionHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95732Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code ExecutionHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95731Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized…Hewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-63471fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decoratorkoxudaxi fastapi-code-generator · fastapi-code-generator
- CVE-2026-63469fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dictkoxudaxi fastapi-code-generator · fastapi-code-generator
- CVE-2026-63470fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringkoxudaxi fastapi-code-generator · fastapi-code-generator
- CVE-2026-112917Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallDocker Desktop
- CVE-2026-44267Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitterenspirit elo · @enspirit/elo
- CVE-2026-44266Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsenspirit elo · @enspirit/elo
- CVE-2026-109593An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files…SonicWall Global Management System
- CVE-2026-28336SolarWinds Dameware Command Injection VulnerabilitySolarWinds Dameware
- CVE-2026-121260Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injectionZiroom ZHOME A0101
- CVE-2026-121392FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificateFreeRDP
- CVE-2026-89292Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEclipse Foundation Eclipse Mnestix
- CVE-2026-92610Improper limitation of paths in py-aspect-model-loaderEclipse Foundation Eclipse Semantic Modeling Framework
- CVE-2026-4052Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)WSO2 API Manager · WSO2 API Control Plane +1
- CVE-2026-13594Improper Access Control vulnerabilityZohocorp Log360 · Zohocorp EventLog Analyzer
- CVE-2026-120534Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field TypeACF Extended Advanced Custom Fields: Extended PRO
- CVE-2026-120518BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handlerkalengi BuddyPress XProfile Custom Image Field
- CVE-2026-38595An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted…
- CVE-2026-38600A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via…
High 305
- CVE-2026-92196Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92200Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation VulnerabilityQuest Foglight for Databases
- CVE-2026-92198Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure VulnerabilityQuest Foglight for Databases
- CVE-2026-92199Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation VulnerabilityQuest Foglight for Databases
- CVE-2026-92185Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure VulnerabilityQuest Foglight for Databases
- CVE-2026-92197Quest Foglight for Databases unzipFile Directory Traversal Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92191Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92186Quest Foglight for Databases paFnUploadFileAndCreateInfo Directory Traversal Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92194Quest Foglight for Databases loadManageServerLicense Directory Traversal Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92195Quest Foglight for Databases loadEvolveLicense Directory Traversal Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92192Quest Foglight for Databases installLicense Directory Traversal Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92187Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution VulnerabilityQuest Foglight for Databases
- CVE-2026-92211Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution VulnerabilityPixar Animation Studio OpenUSD
- CVE-2026-114550libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerabilitylibwebsockets
- CVE-2026-118628MLflow get-artifacts Server-Side Request Forgery Information Disclosure VulnerabilityMLflow
- CVE-2026-118627MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityMLflow
- CVE-2026-118623MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityMLflow
- CVE-2026-120651CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setCGI
- CVE-2026-120646CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoCGI
- CVE-2026-120645CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listCGI
- CVE-2026-120641CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows pathsCGI
- CVE-2026-120639CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values…CGI
- CVE-2026-120635CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCsCGI
- CVE-2026-120631CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parseCGI
- CVE-2022-30267Emerson Ovation Insufficient Verification of Data AuthenticityEmerson Ovation
Show all 305 entriesShow fewer entries
- CVE-2026-121731RosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Reportfrancoisjacquet RosarioSIS
- CVE-2026-121730emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint0xdps emailflare
- CVE-2026-121729emailflare before commit cf31f33 Missing Authorization via /api/keys Routes0xdps emailflare
- CVE-2026-121727Kore before 4.3.0 Integer Underflow Memory Exhaustion via http_header_recv()jorisvink kore
- CVE-2026-104608Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git serviceGitHub Enterprise Server
- CVE-2026-116650Tanium addressed an unauthorized code execution vulnerability in Threat Response.Tanium Threat Response
- CVE-2026-120775Tanium addressed a heap-based buffer overflow vulnerability in Deploy.Tanium Deploy
- CVE-2026-121565Tanium addressed an improper certificate validation vulnerability in multiple productsTanium TanOS · Tanium Asset +11
- CVE-2026-116651Tanium addressed an unauthorized code execution vulnerability in Threat Response.Tanium Threat Response
- CVE-2026-115541HumHub 1.19.0 - Stored cross-site scripting in friendship confirmationHumHub Community Edition
- CVE-2026-118865Authenticated OS Command Injection in Archer AX3000 v2 Offline Download ComponentTP-Link Systems Archer AX3000
- CVE-2026-121614Docker Sandboxes host Git executes repository-controlled programsDocker Sandboxes
- CVE-2026-119084Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection ParametersAWS amazon-redshift-jdbc-driver
- CVE-2026-121621Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy…argocd-image-updater · Red Hat OpenShift GitOps
- CVE-2026-111751Angular: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)angular · @angular/router
- CVE-2026-111752Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)angular · @angular/router
- CVE-2026-82159Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation…Dell Wyse Management Suite
- CVE-2026-121195Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via…Google Chrome
- CVE-2026-121064Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary…Google Chrome
- CVE-2026-121069Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via…Google Chrome
- CVE-2026-121230Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside…Google Chrome
- CVE-2026-121092Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code…Google Chrome
- CVE-2026-121054Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121198Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web…Google Chrome
- CVE-2026-121050Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121205Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass…Google Chrome
- CVE-2026-121204Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted…Google Chrome
- CVE-2026-121251Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted…Google Chrome
- CVE-2026-121236Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121168Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121252Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121222Incorrect authorization in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121109Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin…Google Chrome
- CVE-2026-121217Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the…Google Chrome
- CVE-2026-121134Information loss in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121135Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted…Google Chrome
- CVE-2026-121167Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121238Use after free in Source in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121128Use after free in Scheduling in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the…Google Chrome
- CVE-2026-121218Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121070Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121048Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121212Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121184Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside…Google Chrome
- CVE-2026-121171Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web…Google Chrome
- CVE-2026-121065Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121163Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121170Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121220Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121040Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121183Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121219Integer overflow in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2026-121256Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121196Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access…Google Chrome
- CVE-2026-121108Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin…Google Chrome
- CVE-2026-121063Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121062Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121120Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121102Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via…Google Chrome
- CVE-2026-121119Use after free in Controls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121221Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the…Google Chrome
- CVE-2026-121078Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the…Google Chrome
- CVE-2026-121211Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121129Use after free in WebRTC in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121208Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside…Google Chrome
- CVE-2026-121036Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121160Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a…Google Chrome
- CVE-2026-121137Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute…Google Chrome
- CVE-2026-121068Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121226Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the…Google Chrome
- CVE-2026-121227Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121061Use after free in Modularization in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the…Google Chrome
- CVE-2026-121182Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121123Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121117Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via…Google Chrome
- CVE-2026-121224Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121133Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised…Google Chrome
- CVE-2026-121097Use after free in Printing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121143Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121079Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121094Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121084Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2026-121201Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121057Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121210Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121127Use after free in WebAudio in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121032Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a…Google Chrome
- CVE-2026-121100Use after free in DOM in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121178Use after free in Aura in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2026-121087Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121052Use after free in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121090Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had…Google Chrome
- CVE-2026-121044Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121228Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121181Use after free in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121180Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121179Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121083Use after free in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the…Google Chrome
- CVE-2026-121082Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121113Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121188Use after free in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the…Google Chrome
- CVE-2026-121118Use after free in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a…Google Chrome
- CVE-2026-121124Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…Google Chrome
- CVE-2026-121047Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121166Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-121207Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the…Google Chrome
- CVE-2026-121095Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a…Google Chrome
- CVE-2026-121140Out of bounds read in Internals in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…Google Chrome
- CVE-2026-121233Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the…Google Chrome
- CVE-2026-121173Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a…Google Chrome
- CVE-2026-121098Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121174Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via…Google Chrome
- CVE-2026-121112Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121197Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox…Google Chrome
- CVE-2026-121107Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy…Google Chrome
- CVE-2026-121203Use after free in Geometry in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox…Google Chrome
- CVE-2026-119636Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through…Devolutions Server
- CVE-2026-120715Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an…Devolutions Server
- CVE-2026-120733Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with…Devolutions Server
- CVE-2026-82155Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability.Dell OS Recovery tool
- CVE-2026-121580Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated…Devolutions Server
- CVE-2026-115878Stanza: RCE via pickle deserialization in the lemmatizerstanfordnlp stanza · stanza
- CVE-2026-61495TinyUSB 0.21.0 Out-of-Bounds Write via mtp_container_get_string()hathach TinyUSB
- CVE-2026-88968Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspaceanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-88066Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executableanthropics claude-code
- CVE-2026-95728Local Privilege Escalation in Virtual Intranet Access (VIA) Client for LinuxHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95727Authenticated Command Injection Vulnerability in HPE Networking VIAHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95726Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIAHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95725Authenticated Local Command Injection Vulnerability in the VIA Client for LinuxHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95724Unauthenticated Improper Certificate Validation leads to Authentication Bypass in HPE Networking Virtual Intranet Access (VIA)Hewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95723Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in Virtual Intranet Access (VIA) ClientHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95722Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) ClientHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-54161upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD executionnetworkupstools nut
- CVE-2026-45146Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificatedchamilo-lms
- CVE-2026-95753Privilege Escalation in HPE Networking Fabric Composer APIHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95752Local Privilege Escalation in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95751Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95750Unauthenticated Improper Certificate Validation in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95749Unauthenticated Missing Integrity Verification in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95748Unauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95747Privilege Escalation in the SSH Interface of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95746Authentication Bypass in the API Endpoint of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95745Unauthenticated Remote Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95744Authenticated Adjacent Sensitive Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95743Local Privilege Escalation Vulnerabilities in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95742Authenticated Local Arbitrary File Write Vulnerability in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95741Authenticated Missing Integrity Verification in API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95740Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95739Unauthenticated Improper Restriction of Excessive Authentication Attempts in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95738Authentication Bypass in the Affected Interface of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95737Local Privilege Escalation in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95736Unauthenticated Adjacent Improper Certificate Validation Vulnerabilities in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95735Improper Certificate Validation in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95734Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer APIHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-63395isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)isomorphic-git
- CVE-2026-105822Server-Side Request Forgery in Tapo Cloud MQTT ProxyTP-Link Systems Tapo Cloud Service
- CVE-2026-105821Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT ProxyTP-Link Systems Tapo Cloud Service
- CVE-2026-63500Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive exportyeti-platform yeti
- CVE-2026-63502Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and writeyeti-platform yeti
- CVE-2026-93325Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker BuildxDocker Buildx
- CVE-2026-63482Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Datayeti-platform yeti
- CVE-2026-63489Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parametersyeti-platform yeti
- CVE-2026-63501ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass)Agamnentzar ag-psd · ag-psd
- CVE-2026-39379GeoNetwork: Reflected XSS through client-side template injectioncore-geonetwork
- CVE-2026-121382Netcore NBR100V2 auto_ac msg_aes_dec integer overflowNetcore NBR100V2
- CVE-2026-46487GeoNetwork: ACL bypass on Elasticsearch search when request body omits query fieldcore-geonetwork · org.geonetwork-opensource:geonetwork
- CVE-2026-120955MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataMongoDB C Driver
- CVE-2026-120956remote abort and memory disclosure from a malformed cursor.nsMongoDB C Driver
- CVE-2026-120678MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)MongoDB C Driver
- CVE-2026-63198traQ: Privilege escalation by OAuth prompt=none requesttraPtitech traQ · github.com/traPtitech/traQ
- CVE-2026-82976Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster…Red Hat OpenShift Container Platform
- CVE-2026-63197traQ: XSS in the User Uploaded File Retrieval APItraPtitech traQ · github.com/traPtitech/traQ
- CVE-2026-63417Logging Redactor: PII data in str/repr of non primitive objects was not being redactedarmurox loggingredactor · loggingredactor
- CVE-2026-57154OPNsense: Configuration line injection via multiple GUI text fieldsopnsense core
- CVE-2026-119922Babelfish for PostgreSQL Privilege EscalationAWS babelfish-for-postgresql · Amazon Aurora PostgreSQL wit…
- CVE-2026-63418Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binarymonitoring-plugins
- CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fieldsenspirit elo · @enspirit/elo
- GHSA-P3JP-9V83-76W9Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityMicrosoft.DotNet.ILCompiler · Microsoft.NETCore.App.Run… +75
- CVE-2026-121624Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationNanosystems Supremo
- CVE-2026-115714Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS ConnectionsElastic Docker images
- CVE-2026-115294Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource DeletionElastic Kibana
- CVE-2026-115290Uncontrolled Recursion in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-121603Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handlersolanum-ircd solanum
- CVE-2026-121602Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOINsolanum-ircd solanum
- CVE-2026-28335SolarWinds Dameware Buffer Overflow VulnerabilitySolarWinds Dameware
- CVE-2026-28327SolarWinds Dameware DLL Hijacking VulnerabilitySolarWinds Dameware
- CVE-2026-103916Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directoryDocker Sandboxes
- CVE-2026-119215AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountteam-alembic ash_authentication · ash_authentication
- CVE-2026-65168NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.NVIDIA Slurm
- CVE-2026-118487Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParserEclipse Foundation Eclipse Vert.x
- CVE-2026-119741rsync < 3.5.2 Denial of Service via hash_search() Checksum CollisionsRsyncProject rsync
- CVE-2026-73328Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/volmarg personal-management-system
- CVE-2026-121560LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/postslogchimp
- CVE-2026-121559GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloningglpi-project GLPI
- CVE-2026-121557WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootwppconnect-server
- CVE-2026-121556FastBee through 2.1.0 IDOR via /iot/product By-ID Endpointsbeecue FastBee
- CVE-2026-121555Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbDrizzleTime Foxel
- CVE-2026-121554cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirectssilkimen cordova-plugin-advanced-http
- CVE-2026-121548nnn through 5.3 OS Command Injection via togglex Pluginjarun nnn
- CVE-2026-121543smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalationa466350665 smart-sso
- CVE-2026-121452bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Servicemlogclub bbs-go
- CVE-2026-121451AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFamir1376 ab-download-manager
- CVE-2026-121450CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUIDPAICNI CFNext
- CVE-2026-118489CachingWebClient shares user-specific HTTP responses across users via the shared cache tierEclipse Foundation Eclipse Vert.x
- CVE-2026-121449Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookFinsys dockhand
- CVE-2026-121448Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesFinsys dockhand
- CVE-2026-121445svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Strippingdarylldoyle svg-sanitizer
- CVE-2026-121444svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graphdarylldoyle svg-sanitizer
- CVE-2026-121437Mistune 3.3.0 before 3.3.4 Quadratic-Time DoS via _process_emphasis_delimiterslepture mistune
- CVE-2026-121436Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpfroxlor
- CVE-2026-121429AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()AzuraCast
- CVE-2026-121428AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in TimezoneAzuraCast
- CVE-2026-121427AzuraCast through 0.23.8 Config Injection via frontend_config.custom_configAzuraCast
- CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparsernodemailer
- CVE-2026-121425Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsingnodemailer
- CVE-2026-121424Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Commentsnodemailer
- CVE-2026-121423SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serializationsurrealdb
- CVE-2026-121419SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collisionsurrealdb
- CVE-2026-121417SurrealDB before 3.3.0 Use-After-Free via affinitypool spawn_local in KV Backendssurrealdb
- CVE-2026-121416SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocationssurrealdb
- CVE-2026-121414Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Updateparse-community parse-server
- CVE-2026-121412FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC ReassemblyFreeRDP
- CVE-2026-121409FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing TokenFreeRDP
- CVE-2026-121407FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk ChannelFreeRDP
- CVE-2026-121404FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATAFreeRDP
- CVE-2026-121402FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphicsFreeRDP
- CVE-2026-121400FreeRDP before 3.32.2 CPU Exhaustion via RDG Control PacketFreeRDP
- CVE-2026-121398FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump ModuleFreeRDP
- CVE-2026-121395FreeRDP 3.17.0 before 3.32.2 Denial of Service via RemoteFX DecoderFreeRDP
- CVE-2026-121394FreeRDP before 3.32.2 Denial of Service via RemoteFX RLGR decoderFreeRDP
- CVE-2026-121393FreeRDP 3.0.0 before 3.32.2 Denial of Service via RemoteFX Region AssertionFreeRDP
- CVE-2026-121388FreeRDP 3.0.0 before 3.32.2 Uncapped Memory Allocation via DRDYNVC DATA_FIRSTFreeRDP
- CVE-2026-121386FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image ReadersFreeRDP
- CVE-2026-121513Out-of-bounds Write in µD3TNµD3TN
- CVE-2026-121512Missing Release of Memory after Effective Lifetime in µD3TNµD3TN
- CVE-2026-121511Out-of-bounds Read in µD3TNµD3TN
- CVE-2026-121510Out-of-bounds Write in µD3TNµD3TN
- CVE-2026-121506Out-of-bounds Write in NTPsecNTPsec
- CVE-2026-120572Incorrect boundary conditions in the Layout: Block and Inline componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-119742Nagios XI < 2026R2 OS Command Injection via mibs.phpNagios Enterprises Nagios XI
- CVE-2026-85035Use-after-free via dynamically allocated message queue retained by the CAN RX filterzephyrproject zephyr
- CVE-2026-119179MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's dataMongoDB Node.js Driver
- CVE-2026-89295Unauthenticated memory-exhaustion denial of service in Eclipse Mnestix AAS Generator unbounded count parameterEclipse Foundation Eclipse Mnestix
- CVE-2026-121458Instatic before 0.0.21 Authorization Bypass via MCP Content Read ToolsCoreBunch Instatic
- CVE-2026-99270tcp: Fix potential UAF in reqsk_timer_handler().Linux
- CVE-2026-76124BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback EndpointBuddyBoss App
- CVE-2026-108047Inadequate authorization vulnerability in Alosuite’s user invitation functionalityAM System ALO Suite
- CVE-2026-99269sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQsLinux
- CVE-2026-99246tipc: protect node reset trace dump with node lockLinux
- CVE-2026-120330Broken Access Control in extension "Mail" (mail)TYPO3 mediaessenz/mail
- CVE-2026-120333Broken Access Control in extension "Frontend User Registration" (sf_register)TYPO3 evoweb/sf-register
- CVE-2026-77691Command injection vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-77778Improper access control vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-119724Apache JClouds: XML External Entity (XXE) in provider-response parsingApache Software Foundation org.apache.jclouds:jclouds-core
- CVE-2026-89293Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tamperingEclipse Foundation Eclipse Mnestix
- CVE-2026-77777Improper access control vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-105982Command Injection in IPsec VPNWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105981Command Injection in Digital I/OWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105980Command Injection in WireGuard VPNWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105979Command Injection in ZeroTier VPNWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-105978Command Injection in Management Control FunctionsWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-121022Default Administrator Password Change Not Enforced in Axxon One Web ClientAxxonSoft Axxon One
- CVE-2026-113421ThreadX Modules invokes trace-full callbacks after module unloadEclipse Foundation Eclipse ThreadX
- CVE-2026-115231User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilegeEclipse Foundation Eclipse ThreadX
- CVE-2026-74846Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the…Catalyst-Plugin-Authentication
- CVE-2026-16900Authentication BypassZohocorp Log360 · Zohocorp EventLog Analyzer
- CVE-2026-120987Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.NAVER Whale browser
- CVE-2026-77800Authentication bypass vulnerabilityZohocorp ManageEngine Key Manager Plus
- CVE-2026-77799Two-factor authentication bypassZohocorp ManageEngine Key Manager Plus
- CVE-2026-120538Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding…smub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2026-120577FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameterwpmanageninja FluentCart A New Era of eCommerce – Faster, L…
- CVE-2026-120574SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5…SureCart – Ecommerce Made Easy For Selling Physical Product…
- CVE-2026-120559Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversalsatindersingh Contact Form Extender for Divi – Submissions…
- CVE-2026-120558Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameterzorem Advanced Shipment Tracking for WooCommerce
- CVE-2026-76955A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based…Zyxel NWA110AX firmware
- CVE-2026-107441An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an…Zyxel GS1900-24E firmware · Zyxel GS1900-8 firmware +8
- CVE-2026-120833labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-DispatchNIST labbench
- CVE-2026-120830Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosureRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-106991hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.
- CVE-2026-38601A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect…
Medium, low and unrated 404
- CVE-2026-92193Quest Foglight for Databases FileServlet External Control of File Path Information Disclosure VulnerabilityQuest Foglight for Databases
- CVE-2026-114552MailEnable parseObjectResponse XML External Entity Processing Information Disclosure VulnerabilityMailEnable
- CVE-2026-114551MailEnable Auth Cleartext Storage Information Disclosure VulnerabilityMailEnable
- CVE-2026-118626MLflow Tracking Server Issues Missing Authorization Privilege Escalation VulnerabilityMLflow
- CVE-2026-118625MLflow Tracking Server Missing Authorization Privilege Escalation VulnerabilityMLflow
- CVE-2026-118624MLflow Tracking Server Jobs Missing Authorization Information Disclosure VulnerabilityMLflow
- CVE-2026-121589spatie url-signer URL Validation AbstractUrlSigner.php validate type conversionspatie url-signer
- CVE-2026-120650CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limitsCGI
- CVE-2026-120648CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentCGI
- CVE-2026-120643CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_urlCGI
- CVE-2026-120640CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or…CGI
- CVE-2026-120638CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirectCGI
- CVE-2026-120636CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formCGI
- CVE-2026-120634CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser bufferCGI
- CVE-2026-120633CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_portCGI
- CVE-2026-120632CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-TypeCGI
- CVE-2026-121585InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorizationInfiniFlow RAGFlow
- CVE-2026-121583Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorizationSanluan PublicCMS
- CVE-2026-121582Umami Record API Endpoint route.ts authorizationUmami
- CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 Unauthenticated OAuth Authorization Code Creationnocodb
- CVE-2026-121735blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokensblueprintue-self-hosted-edition
- CVE-2026-121734ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIViewzane-ops
- CVE-2026-121733Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment UploadWebkul Bagisto
- CVE-2026-121732RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignmentfrancoisjacquet RosarioSIS
- CVE-2026-121728SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2SourceHut meta.sr.ht
Show all 404 entriesShow fewer entries
- CVE-2026-109836The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which may allow physical…ALCPU Core Temp
- CVE-2026-118237Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git serviceGitHub Enterprise Server
- CVE-2026-110288Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the…GitHub Enterprise Server
- CVE-2026-121581ArcReel Provider Test-Connection Endpoint test server-side request forgeryArcReel
- CVE-2026-121539miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access controlmiroslavpejic85 MiroTalk P2P
- CVE-2026-116661Tanium addressed an improper access controls vulnerability in Enforce.Tanium Enforce
- CVE-2026-116668Tanium addressed an uncontrolled resource consumption vulnerability in Discover.Tanium Discover
- CVE-2026-116666Tanium addressed an information disclosure vulnerability in Discover.Tanium Discover
- CVE-2026-116667Tanium addressed an improper access controls vulnerability in Discover.Tanium Discover
- CVE-2026-116664Tanium addressed an improper access controls vulnerability in Discover.Tanium Discover
- CVE-2026-116663Tanium addressed an improper access controls vulnerability in Enforce.Tanium Enforce
- CVE-2026-116648Tanium addressed an improper output sanitization vulnerability in Discover.Tanium Discover
- CVE-2026-116665Tanium addressed an information disclosure vulnerability in Discover.Tanium Discover
- CVE-2026-108327Tanium addressed a path traversal vulnerability in Tanium Data Service.Tanium Data Service · Tanium Interact
- CVE-2026-116654Tanium addressed an improper input validation vulnerability in Threat Response.Tanium Threat Response
- CVE-2026-116653Tanium addressed an improper input validation vulnerability in Threat Response.Tanium Threat Response
- CVE-2026-116652Tanium addressed a business logic error in Threat Response.Tanium Threat Response
- CVE-2026-121535miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authenticationmiroslavpejic85 MiroTalk P2P
- CVE-2026-116669Tanium addressed an improper access controls vulnerability in Discover.Tanium Discover
- CVE-2026-108324Tanium addressed a denial of service vulnerability in Tanium Client.Tanium Client
- CVE-2026-116646Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.Tanium Threat Response
- CVE-2026-121520Malicious client could set xattr value outside of BuildKit state directoryMoby BuildKit
- CVE-2026-121522Possible panic from Git source resolvermoby BuildKit
- CVE-2026-121541Bake filesystem path entitlements approval can be skipped in some multi-target buildsDocker Buildx
- CVE-2026-121542Bake filesystem path entitlements approval can be skipped for path using basename prefixDocker Buildx
- CVE-2026-22060CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)NETAPP StorageGRID
- CVE-2026-121531Umami 2FA Policy route.ts single-factor authenticationUmami
- CVE-2026-121524sumiie24 School-Management-System Public Search Feature parent_Login.php sql injectionsumiie24 School-Management-System
- CVE-2026-120930Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a…Google Chrome
- CVE-2026-121517IrfanView TIFF Wang Annotation heap-based overflowIrfanView
- CVE-2026-82160Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation…Dell Wyse Management Suite
- CVE-2026-111754Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)angular
- CVE-2026-82161Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation…Dell Wyse Management Suite
- CVE-2026-55186Silverstripe MFA: Can bypass MFA during password reset flowsilverstripe-mfa · silverstripe/mfa
- CVE-2026-121514EasySoft ZenTao PMS User model.php checkGroupChange privileges managementEasySoft ZenTao PMS
- CVE-2026-64672Terragrunt catalog predictable temp symlink clobbergruntwork-io terragrunt · github.com/gruntwork-io/terragrunt
- CVE-2026-121141Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121169Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121142Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121232Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain…Google Chrome
- CVE-2026-121041Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a…Google Chrome
- CVE-2026-121093Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the…Google Chrome
- CVE-2026-121175Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted…Google Chrome
- CVE-2026-121029Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted…Google Chrome
- CVE-2026-121045UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…Google Chrome
- CVE-2026-121162UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social…Google Chrome
- CVE-2026-121225Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121240Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access…Google Chrome
- CVE-2026-121081UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121159Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121085Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions…Google Chrome
- CVE-2026-121130Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a…Google Chrome
- CVE-2026-121121UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML…Google Chrome
- CVE-2026-121206UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof…Google Chrome
- CVE-2026-121172Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted…Google Chrome
- CVE-2026-121253Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121165UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social…Google Chrome
- CVE-2026-121055Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via…Google Chrome
- CVE-2026-121138Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted…Google Chrome
- CVE-2026-121111Incorrect authorization in HID in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via…Google Chrome
- CVE-2026-121043UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof…Google Chrome
- CVE-2026-121235Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted…Google Chrome
- CVE-2026-121046Incorrect authorization in WebAppInstalls in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…Google Chrome
- CVE-2026-121125Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121190UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121053UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging…Google Chrome
- CVE-2026-121243Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted…Google Chrome
- CVE-2026-121209UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML…Google Chrome
- CVE-2026-121091Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121049Out of bounds read in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a crafted file.Google Chrome
- CVE-2026-121245Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information…Google Chrome
- CVE-2026-121042Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system…Google Chrome
- CVE-2026-121110UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via…Google Chrome
- CVE-2026-121158Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted…Google Chrome
- CVE-2026-121216UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI…Google Chrome
- CVE-2026-121176Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a…Google Chrome
- CVE-2026-121186UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social…Google Chrome
- CVE-2026-121223Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted…Google Chrome
- CVE-2026-121164Incorrect authorization in Views in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…Google Chrome
- CVE-2026-121194Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer…Google Chrome
- CVE-2026-121215UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted…Google Chrome
- CVE-2026-121096Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program.Google Chrome
- CVE-2026-121067UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…Google Chrome
- CVE-2026-121132Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML…Google Chrome
- CVE-2026-121187Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a…Google Chrome
- CVE-2026-121239Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML…Google Chrome
- CVE-2026-121116Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2026-121254Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted…Google Chrome
- CVE-2026-121033Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the…Google Chrome
- CVE-2026-121088Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via…Google Chrome
- CVE-2026-121059Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML…Google Chrome
- CVE-2026-121075Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121136Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121103Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a…Google Chrome
- CVE-2026-121072Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted…Google Chrome
- CVE-2026-121231Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions…Google Chrome
- CVE-2026-121255Incorrect authorization in Autofill AI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a…Google Chrome
- CVE-2026-121122UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof…Google Chrome
- CVE-2026-121039Incorrect authorization in Proxy Auth in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to obtain sensitive information…Google Chrome
- CVE-2026-121106Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information…Google Chrome
- CVE-2026-121248Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via…Google Chrome
- CVE-2026-121193Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access…Google Chrome
- CVE-2026-121177UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a…Google Chrome
- CVE-2026-121115Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access…Google Chrome
- CVE-2026-121066Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121099Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a…Google Chrome
- CVE-2026-121199Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive…Google Chrome
- CVE-2026-121031Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a…Google Chrome
- CVE-2026-121161Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a…Google Chrome
- CVE-2026-121237Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google Chrome
- CVE-2026-121105Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted…Google Chrome
- CVE-2026-121242Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy…Google Chrome
- CVE-2026-121244UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof…Google Chrome
- CVE-2026-121213Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a…Google Chrome
- CVE-2026-121038Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a…Google Chrome
- CVE-2026-121051UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a…Google Chrome
- CVE-2026-121080Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted…Google Chrome
- CVE-2026-120716Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and…Devolutions Server
- CVE-2026-115779Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()Effect-TS effect · @effect platform +2
- CVE-2026-120734Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an…Devolutions Server
- CVE-2026-76894CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)ondata ckan-mcp-server · @aborruso/ckan-mcp-server
- CVE-2026-82154Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability.Dell OS Recovery tool
- CVE-2026-121509Headless CMS Plugin REST API post get_required_post_data information disclosureHeadless CMS Plugin
- CVE-2026-61497TinyUSB < 0.21.0 Integer Underflow via HID Report Descriptor Parserhathach TinyUSB
- CVE-2026-120959MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-array stride, causing out-of-bounds writesMongoDB Atlas SQL
- CVE-2026-120952MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID target, causing a 32-byte out-of-bounds writeMongoDB Atlas SQL ODBC Driver
- CVE-2026-121502mathurvishal CloudClassroom-PHP-Project facultydetails.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-95730Authenticated Buffer Overflow Vulnerability Leads to Denial-of-Service in HPE Networking VIAHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-95729Authenticated Sensitive Information Disclosure in VIAHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2026-121577Unescaped header separators in whatstk build a regular expression that backtracks exponentiallylucasrodes whatstk
- CVE-2026-63433MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Valuefranklioxygen MyTube
- CVE-2026-95777Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer Management InterfaceHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95776Authenticated Path Traversal Vulnerability in HPE Networking Fabric Composer API Allows for Limited File ReadHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95775Authenticated Local Information Disclosure Vulnerability in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95774Unauthenticated Sensitive Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95773Authenticated Local Denial-of-Service Vulnerability in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95772Authenticated Race Condition in API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95771Authenticated Information Disclosure in HPE Networking Fabric Composer API EndpointHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95770Authenticated Local Sensitive Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95769Unauthenticated Audit Log Spoofing in API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95768Privilege Escalation Leading to Information Disclosure in HPE Networking Fabric Composer APIHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95767Unauthenticated Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95766Authenticated Sensitive Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95765Unauthenticated Sensitive Information Disclosure in Web-Based Management Interface of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95764Unauthenticated Adjacent Improper Certificate Validation in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95763Unauthenticated Improper Certificate Validation allows Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95762Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95761Authenticated Improper Certificate Validation leads to Information Disclosure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95760Privilege Escalation Vulnerability in HPE Networking Fabric Composer APIHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95759Authenticated Audit Log Bypass in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95758Authenticated Authorization Bypass in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95757Authentication Bypass Vulnerability in HPE Networking Fabric Composer APIHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95756Authenticated Command Injection Vulnerability in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-95755Unauthenticated Adjacent Improper Certificate Validation allows Interception of Management Traffic in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) Fabric Composer
- CVE-2026-63434MyTube: Visitor-Role Statistics Event Forgery Allows Analytics Data Poisoningfranklioxygen MyTube
- CVE-2025-71452Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgpVembu Technologies BDRSuite
- CVE-2025-71451Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgpVembu Technologies BDRSuite
- CVE-2026-63475isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)isomorphic-git
- CVE-2026-63476isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)isomorphic-git
- CVE-2026-63478isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkoutisomorphic-git
- CVE-2026-120567EF Core provider: pipeline-form ExecuteUpdate evaluates a user string setter as a $-field referenceMongoDB Entity Framework Core Provider
- CVE-2026-110826AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeteam-alembic ash_authentication · ash_authentication
- CVE-2026-121501mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiationmathurvishal CloudClassroom-PHP-Project
- CVE-2026-120953Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handlerMongoDB Atlas SQL JDBC Driver
- CVE-2026-120954Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector viewsMongoDB C Driver
- CVE-2026-121652Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingAWS maplibre-gl-js-amplify
- CVE-2026-120684MongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordMongoDB C Driver
- CVE-2026-120673Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the commandMongoDB Rust Driver
- CVE-2026-63499zt-zip: ZipUtil.unpack can change file permissions of output directoryzeroturnaround zt-zip · org.zeroturnaround:zt-zip
- CVE-2026-63436zt-zip: Path traversal in fluent API unpackzeroturnaround zt-zip · org.zeroturnaround:zt-zip
- CVE-2026-116845NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateViewnetbox-community netbox
- CVE-2026-121263phpMyAdmin MoTranslator Loader.php getTranslator path traversalphpMyAdmin MoTranslator
- CVE-2026-121628Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accountingbagisto
- CVE-2026-121627buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URLjarun buku
- CVE-2026-121626GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handlerwillamowius gnugk
- CVE-2026-121625GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsingwillamowius gnugk
- CVE-2026-121631Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpointslightdash
- CVE-2026-119509WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerabilityeranfl ClickCease Click Fraud Protection
- CVE-2026-97072WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-114187WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-121262phpMyAdmin SQL-Parser ExplainStatement.php parse type conversionphpMyAdmin SQL-Parser
- CVE-2026-103077WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-114185WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-119485WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs Dokan
- CVE-2026-39777WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-119487WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs Dokan
- CVE-2026-120843WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerabilityBarn2 Plugins Posts Table with Search & Sort
- CVE-2026-114183WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityWPVibes AnyWhere Elementor
- GHSA-9PPR-WFW9-XVR2Netfoil doesn't decrement TTLgithub.com/tinfoil-factory/netfoil
- CVE-2026-116859WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerabilityWPMU DEV Forminator
- CVE-2026-116858WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerabilityWPMU DEV Forminator
- CVE-2026-39743WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-120846WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerabilityUncanny Owl Uncanny Automator
- CVE-2026-115716Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of ServiceElastic APM Server
- CVE-2026-115715Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-115710Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information DisclosureElasticsearch
- CVE-2026-115298Incorrect Authorization in Elasticsearch Leading to Information DisclosureElasticsearch
- CVE-2026-115297NULL Pointer Dereference in Packetbeat Leading to Denial of ServiceElastic Packetbeat
- CVE-2026-115295Authorization Bypass Through User-Controlled Key in Kibana Leading to Information DisclosureElastic Kibana
- CVE-2026-115293Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential DisclosureElastic Kibana
- CVE-2026-115292Authorization Bypass Through User-Controlled Key in Kibana Leading to Information DisclosureElastic Kibana
- CVE-2026-115289Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information DisclosureElastic APM Server
- CVE-2026-119521WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-119495WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerabilityWebberZone Better Search
- CVE-2026-121261phpMyAdmin ShapeFile SHP File loadFromFile infinite loopphpMyAdmin ShapeFile
- CVE-2026-121259Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimatorRed Hat Enterprise Linux
- GHSA-M3QR-FVP4-78XJArc has unauthenticated application log disclosure via `/api/v1/logs`github.com/basekick-labs/arc
- CVE-2026-109594Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified…SonicWall Global Management System
- CVE-2026-121604wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.cwlroots
- CVE-2026-121588TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Importtexlyre
- CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpointscoollabsio coolify
- CVE-2026-119674mongorestore may restore encoded collection names into an unintended collectionMongoDB Database Tools
- CVE-2026-119673mongofiles may write outside the working directory through a symlinkMongoDB Database Tools
- CVE-2026-119672mongofiles may disclose GridFS content to standard output through a stored filenameMongoDB Database Tools
- CVE-2026-119675mongorestore may bypass collection guards through a system.buckets prefixMongoDB Database Tools
- CVE-2026-118505AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceteam-alembic ash_authentication · ash_authentication
- CVE-2026-114582Server-side request forgery via SpatialReference string inputdjangoproject django
- CVE-2026-113733Password hash disclosure to "view only" admin users with custom user modelsdjangoproject django
- CVE-2026-113593Potential exposure of private data via empty and missing Vary headersdjangoproject django
- CVE-2026-111362Server-side request forgery via crs member of GeoJSON geometriesdjangoproject django
- CVE-2026-111211Potential log injection via unescaped geometry form valuesdjangoproject django
- CVE-2026-108147Potential memory exhaustion in MultiPartParser via base64-encoded file uploaddjangoproject django
- CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted FileThe HDF Group HDF5
- CVE-2026-65165NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary…NVIDIA Slurm
- CVE-2026-65140NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained…NVIDIA Slurm
- CVE-2026-65139NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.NVIDIA Slurm
- CVE-2026-120757Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverseThe HDF Group HDF5
- CVE-2026-65138NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate…NVIDIA Slurm
- CVE-2026-65109NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside…NVIDIA Slurm
- CVE-2026-121578CVE-2026-121578Amidaware Tactical RMM
- CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserializeThe HDF Group HDF5
- CVE-2026-120755Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip FilterThe HDF Group Szip Filter
- CVE-2026-121564Silent loss of messages when merging overlapping chat exports in whatstklucasrodes whatstk
- CVE-2026-120754Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset FilterThe HDF Group Scale-Offset Filter
- CVE-2026-97350Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for WindowsSecurepoint SSL VPN Client
- CVE-2026-65108NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with…NVIDIA Slurm
- CVE-2026-65107NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write…NVIDIA Slurm
- CVE-2026-121562CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams EndpointCTFd
- CVE-2026-121561Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export DownloadsHumanSignal label-studio · HumanSignal label-studio-sdk
- CVE-2026-121558AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_idRicky-7-Yan intelligent-audit-system
- CVE-2026-121553Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())cotonti
- CVE-2026-121552domain-admin before 1.6.79 Missing Authorization via getGroupUserListdromara domain-admin
- CVE-2026-121551PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Descriptionpostfixadmin
- CVE-2026-121550nnn through 5.3 Symlink-Following Write via NNN_FIFO Handlingjarun nnn
- CVE-2026-121549nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Pluginsjarun nnn
- CVE-2026-121547dysk before 3.8.2 Terminal Escape Sequence Injection via Mount MetadataCanop dysk
- CVE-2026-121546ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink FollowingNovik ruTorrent
- CVE-2026-121545Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handlerrobiningelbrecht dreeve
- CVE-2026-121544Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlerskoodo-reader
- CVE-2026-121455DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/savedbgate
- CVE-2026-121454Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requestspadloc
- CVE-2026-121453SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpointdataease SQLBot
- CVE-2026-118488Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis clientEclipse Foundation Eclipse Vert.x
- CVE-2026-100493An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an…AMD Compressionator SDK
- CVE-2026-40652An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted…AMD Compressionator SDK
- CVE-2026-40661An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially…AMD Compressionator SDK
- CVE-2026-40660A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local access to read…AMD Compressionator SDK
- CVE-2026-40659An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a specially crafted…AMD Compressionator SDK
- CVE-2026-43603A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of service.AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +38
- CVE-2026-110265runZero search SQL injectionrunZero Platform
- CVE-2026-118527Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to…Ivanti Connect Secure
- CVE-2026-121447svg-sanitizer before 1.1.0 XSS via animateTransform on Safaridarylldoyle svg-sanitizer
- CVE-2026-121446svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributesdarylldoyle svg-sanitizer
- CVE-2026-121443svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tagdarylldoyle svg-sanitizer
- CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances APIfrappe hrms
- CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-httpbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121438Mistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsinglepture mistune
- CVE-2026-121435Froxlor before 2.3.15 Authorization Bypass via Mysqls.add APIfroxlor
- CVE-2026-121434Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update APIfroxlor
- CVE-2026-121433AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media ExportAzuraCast
- CVE-2026-121432AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS PlaylistAzuraCast
- CVE-2026-121431AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook ConnectorsAzuraCast
- CVE-2026-121430AzuraCast before 0.24.0 Missing Authorization via Station Waveform EndpointsAzuraCast
- CVE-2026-121422SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypasssurrealdb
- CVE-2026-121421SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypasssurrealdb
- CVE-2026-121420SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addressessurrealdb
- CVE-2026-121418SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Plannersurrealdb
- CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Keyparse-community parse-server
- CVE-2026-121413Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSessionparse-community parse-server
- CVE-2026-121411FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output GeometryFreeRDP
- CVE-2026-121410FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2FreeRDP
- CVE-2026-121408FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control ChannelFreeRDP
- CVE-2026-121406FreeRDP before 3.32.2 Client Denial of Service via Zero-Output ZGFX PayloadFreeRDP
- CVE-2026-121405FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device ControlFreeRDP
- CVE-2026-121403FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRPFreeRDP
- CVE-2026-121401FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packetFreeRDP
- CVE-2026-121399FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet LengthFreeRDP
- CVE-2026-121397FreeRDP before 3.32.2 Heap Over-Read via WinPR save_png_to_buffer()FreeRDP
- CVE-2026-121396FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertionFreeRDP
- CVE-2026-121391FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATEFreeRDP
- CVE-2026-121390FreeRDP before 3.32.2 Null Pointer Crash via ARM Gateway ResponseFreeRDP
- CVE-2026-121389FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement LoggingFreeRDP
- CVE-2026-121387FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 DecoderFreeRDP
- CVE-2026-121508Use After Free in µD3TNµD3TN
- CVE-2026-121507Double Free in µD3TNµD3TN
- CVE-2026-121505Out-of-bounds Read in NTPsecNTPsec
- CVE-2026-85034Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscriberszephyrproject zephyr
- CVE-2026-85033Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next…zephyrproject zephyr
- CVE-2026-85032Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progresszephyrproject zephyr
- CVE-2026-65160NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero.NVIDIA CUDA Toolkit · NVIDIA NVJPEG
- CVE-2026-108060Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108059Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108058Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108057Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108056Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108055Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108054Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108053Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108052Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108051Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108050Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.AM System ALO Suite
- CVE-2026-108049Clickjacking vulnerability in the Alosuite web application.AM System ALO Suite
- CVE-2026-108048Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.AM System ALO Suite
- CVE-2026-108046Direct Object Reference (IDOR) vulnerability in AlosuiteAM System ALO Suite
- RUSTSEC-2026-0440`astral-tokio-tar` is unmaintainedastral-tokio-tar
- RUSTSEC-2026-0452Out-of-bounds read when decoding internal keys shorter than 16 bytessurrealkv
- RUSTSEC-2026-0454Data race and double free via unsound `Send`/`Sync` in `reblessive`surrealdb-core
- CVE-2026-99261drm/amdgpu: correct reservation fence slots for userq per-vm BOs evictionLinux
- CVE-2026-99260ntfs: fix resident conversion in ntfs_new_attr_flagsLinux
- CVE-2026-99259soc/tegra: pmc: Fix uninitialised clock rateLinux
- CVE-2026-99258x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()Linux
- CVE-2026-99257gpio: shared: gracefully handle no-device lookup of shared GPIOsLinux
- CVE-2026-99256dm cache: fix issue with background work lockingLinux
- CVE-2026-99255io_uring/io-wq: don't hide a link from cancellationsLinux
- CVE-2026-99254io_uring: don't flood a cancelling task with task_workLinux
- CVE-2026-99253io_uring/cancel: rearm local work wake up before sleepLinux
- CVE-2026-99251Drivers: hv: Avoid infinite retry loop in init_vp_index()Linux
- CVE-2026-99250printk: Postpone kthread startupLinux
- CVE-2026-99249pid_namespace: make zap_pid_ns_processes() freezableLinux
- CVE-2026-99248i2c: xiic: restore non-managed runtime PM to fix clk WARN floodLinux
- CVE-2026-99247tracing: Do not initialize tracefs work if tracing is disabledLinux
- CVE-2026-99245KEYS: Fix key_reject_and_link() race with keyring restrictionLinux
- CVE-2026-99244pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaperLinux
- CVE-2026-114442Apache HertzBeat: incomplete XPath expression validation in aliasFieldsApache Software Foundation Apache HertzBeat
- CVE-2026-120327Open Redirection in extension "Mail" (mail)TYPO3 mediaessenz/mail
- CVE-2026-120328Information Disclosure in extension "Mail" (mail)TYPO3 mediaessenz/mail
- CVE-2026-120329Broken Access Control in extension "Mail" (mail)TYPO3 mediaessenz/mail
- CVE-2026-120331Server-Side Request Forgery in extension "Mail" (mail)TYPO3 mediaessenz/mail
- CVE-2026-120332Cross-Site Scripting in extension "Mail" (mail)TYPO3 mediaessenz/mail
- CVE-2026-89229Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot…vivo BlueLM Copilot
- CVE-2026-119843Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tagsRed Hat Enterprise Linux · GStreamer project gst-plugins-go…
- CVE-2026-119641Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownershipApache Software Foundation org.apache.oozie:oozie-main
- CVE-2026-118448Uninitialized output buffer returned after nd_to_text failure in pybddisasmBitdefender pybddisasm
- CVE-2026-118447Uninitialized INSTRUX contents returned after decoding failure in pybddisasmBitdefender pybddisasm
- CVE-2026-118446Use-after-free in INSTRUX array members in pybddisasmBitdefender pybddisasm
- CVE-2026-118445Use-after-free in INSTRUX structure members in pybddisasmBitdefender pybddisasm
- CVE-2026-118444Out-of-bounds reads during instruction decoding in pybddisasmBitdefender pybddisasm
- CVE-2026-109161Buffer Overflow in Digital I/OWelotec TK100 · Welotec TK500-v2 +1
- CVE-2026-121024Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNetAxxonSoft AxxonNet
- CVE-2026-121023LDAP Bind Password Exposure in AxxonNet ARP Agent LogsAxxonSoft AxxonNet ARP Agent
- CVE-2026-121021Plaintext Storage of LDAP Password in Axxon One Shared ConfigurationAxxonSoft Axxon One
- CVE-2026-121020User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration APIAxxonSoft Axxon One
- CVE-2026-91075Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation BypassEupago Gateway For Woocommerce
- CVE-2026-103327CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook SecretCryptoCloud
- CVE-2026-103653Out-of-bounds read vulnerability in CoAP message parsing impacts Qt CoAPQt
- CVE-2026-120988billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend…NAVER billboard.js
- CVE-2025-5769Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationWSO2 API Control Plane · WSO2 API Manager +1
- CVE-2025-1397Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled…WSO2 Universal Gateway · WSO2 Traffic Manager +7
- CVE-2026-104647weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()weMail
- CVE-2026-104648weMail <= 2.1.6 - Editor+ API Key DisclosureweMail
- CVE-2026-103379WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API TokenWATI Chat and Notification
- CVE-2026-105967Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url ParameterGallery for Social Photo
- CVE-2026-106004DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion RevocationDT LMS
- CVE-2026-105993DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings UpdateDT Directory Lite Addon
- CVE-2026-115205AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_itemAZEXO Store Locator
- CVE-2026-120578AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parametermigkapa AI Alt Text Generator
- CVE-2026-120575Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Nametigroumeow Photo Engine
- CVE-2026-120563WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Fieldamirhelzer WPML Multilingual & Multicurrency for WooCommerce
- CVE-2026-120561JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modificationjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-120524News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Actionblazethemes News Kit Addons For Elementor
- CVE-2026-120552SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in…tigroumeow SEO Engine – Smart SEO with AI, Schema & Redirec…
- CVE-2026-120551WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey'…aresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2026-120544Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Routekodezen Academy LMS – AI Course Builder, Quizzes, Certifica…
- CVE-2026-120971Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responsesRed Hat build of Apache Camel 4 for Quarkus · Red Hat bu… +6
- CVE-2026-111464WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Responseemrevona WP Fastest Cache – WordPress Cache Plugin
- CVE-2026-120831Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of serviceRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-105770Octo STS discloses trust policy contents to unauthorized callers via Exchange error messagesgithub.com/octo-sts/app