CVEs
Browse the synced catalog, newest first.
- CVE-2026-123492SiYuan before 3.8.9 Nil Pointer Dereference DoS via MCP resources/readsiyuan-note siyuan
- CVE-2026-123491Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Selectcraftcms cms
- CVE-2026-123490Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypasscraftcms cms
- CVE-2026-123489Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteriacraftcms cms
- CVE-2026-123488Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpointcraftcms cms
- CVE-2026-123487Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regexparse-community parse-server
- CVE-2026-123486WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.phpWWBN AVideo
- CVE-2026-123485Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sourcessgoudelis ground-station
- CVE-2026-112341Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_paramswazuh
- CVE-2026-112340Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/requestwazuh-dashboard-plugins
- CVE-2026-112339Wazuh 3.9.0 before 4.14.9 Missing TLS Hostname Verification in fluent-forward Modulewazuh
- CVE-2026-112338Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Paginationwazuh
- CVE-2026-112337Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Paginationwazuh
- CVE-2026-112336Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoderwazuh
- CVE-2026-112335Wazuh Agent 1.0.0 before 4.14.9 Stack Buffer Overflow via read_snortfullwazuh
- CVE-2026-112334Wazuh 1.0.0 before 4.14.9 Out-of-Bounds Write in wazuh-execd via ar.confwazuh
- CVE-2026-53980Charmbracelet Wish 2.0.5 Path Traversal via git Middlewarecharmbracelet wish
- CVE-2026-119170Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10Python Software Foundation CPython
- CVE-2026-123665kubescape Output printresults.go GetWriter permissionkubescape
- CVE-2026-123339Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Requestsensiolabs symfony/http-kernel
- CVE-2026-87045NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION framezephyrproject zephyr
- CVE-2026-123664nasa-gcn gcn.nasa.gov Email Notification email improper authorizationnasa-gcn gcn.nasa.gov
- CVE-2026-106019Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating…Johnson Controls C-CURE 9000, Victor
- CVE-2026-113618Improper Server Certificate Validation in ZSIRep Client LibraryKAMSOFT ZSIRep Client Library
- CVE-2026-64894Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows…Johnson Controls EasyIO Neo IOManager and Tools Installer
- CVE-2026-118514Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewallssymfony/http-foundation
- CVE-2026-59105Universal sysadmin credential vulnerability in JumisJumis Pro SIA Jumis
- CVE-2026-106022Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows…Johnson Controls EasyIO Neo IOManager and Tools Installer
- CVE-2026-106020Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows…Johnson Controls EasyIO Neo IO Manager and Tools Installer
- CVE-2026-21850HCL AION is affected by multiple security vulnerabilities.HCL Software HCL AION