CVEs
Browse the synced catalog, newest first.
- CVE-2026-19877Brute-forceable image-share link password in INFINITT ULiteINFINITT Healthcare INFINITT ULite
- CVE-2026-19876Reflected XSS in INFINITT ULite login error page (pre-auth)INFINITT Healthcare INFINITT ULite
- CVE-2026-108018BigFix Mobile is affected by sensitive information disclosureHCLSoftware BigFix MCM & Mobile
- CVE-2026-119516WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerabilityMamunur Rashid Radius Booking — Booking Calendar for Appoin…
- CVE-2026-119472WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerabilityDavid Anderson Redux Framework
- CVE-2026-120844WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerabilityminiOrange OAuth Single Sign On – SSO
- CVE-2026-39744WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerabilityWC Lovers WCFM Membership
- CVE-2026-119488WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerabilityShamim Rajani Pie Register
- CVE-2026-119499WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerabilityBAKKBONE Australia FloristPress
- CVE-2026-65022BigFix Mobile is affected by a Cross-site scripting vulnerabilityHCLSoftware BigFix MCM & Mobile
- CVE-2026-121006HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic timeHTTP-Body
- CVE-2026-121824A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive…LY Armeria
- CVE-2026-121823A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow…LY Armeria
- CVE-2026-121822A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored…LY Armeria
- CVE-2026-121821A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured…LY Armeria
- CVE-2026-121820A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses…LY Armeria
- CVE-2026-121819A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment…LY Armeria
- CVE-2026-121636Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' ParameterQuick Event Manager
- CVE-2026-121633Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN ListenerOrder Tracking
- CVE-2026-118166MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content TagMC4WP: Mailchimp for WordPress
- CVE-2026-118423WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File UploadWP Libre Form
- CVE-2026-88801MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role CreationMDJM Event Management · Mobile Events Manager
- CVE-2026-88800MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role DeletionMDJM Event Management · Mobile Events Manager
- CVE-2026-88799MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDORMDJM Event Management · Mobile Events Manager
- CVE-2026-120749Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored busRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-83494Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)Red Hat OpenShift AI
- CVE-2026-83493Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@masterRed Hat OpenShift AI
- CVE-2026-9797Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administratorRed Hat Build of Keycloak
- CVE-2026-73473Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of serviceGStreamer gst-plugins-good
- CVE-2026-73472Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds readGStreamer gst-plugins-good