CVEs
Browse the synced catalog, newest first.
- CVE-2026-109469Entra Device Registration Elevation of Privilege VulnerabilityMicrosoft Entra Device Registration
- CVE-2026-118786NXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer FunctionsNXP MCUXpresso SDK
- CVE-2026-118785NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer FunctionsNXP MCUXpresso SDK
- CVE-2026-27356WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerabilityibericode MC4WP
- CVE-2026-120845WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Smush Image Compression and Optimization
- CVE-2026-123471WordPress myCred plugin <= 4.0.2 - Content Injection vulnerabilitymyCred
- CVE-2026-120851WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerabilityPublishPress Revisions
- CVE-2026-119519WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerabilityWProyal Royal Elementor Addons
- CVE-2026-122670WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerabilityWP SYNTEX Polylang
- CVE-2026-50240Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution…pipelines-as-code · Builds for Red Hat OpenShift +4
- CVE-2026-123791OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injectionOpenBMB Internet of Agents
- CVE-2026-59104UgCS server HCI authentication bypass with empty credentialsSPH Engineering UgCS
- CVE-2026-103022Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)urwid
- CVE-2026-94619FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary filesfilegator · filegator/filegator
- CVE-2026-94618FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archivefilegator · filegator/filegator
- CVE-2026-119800Ryot: Cross-tenant collection read via `collectionContents`IgnisDa ryot
- CVE-2026-77442Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite…IgnisDa ryot
- CVE-2026-104267Botan: scrypt V-buffer heap overflow on 32-bit from constructor-accepted parametersrandombit botan
- CVE-2026-48057Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dnrandombit botan
- CVE-2026-47738liboqs: Uninitialized function-pointer dereference in OQS_KEM_encaps_derand for NTRU KEMsopen-quantum-safe liboqs
- CVE-2026-44519liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others)open-quantum-safe liboqs
- CVE-2026-104254liboqs: Heap out-of-bounds read in LMS/HSS signature verification via unvalidated signature length (hss_verify_inc.c:215)open-quantum-safe liboqs
- CVE-2026-69128Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier +…chartbrew
- CVE-2026-68935Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connectionschartbrew
- CVE-2026-123788chenyme grok2api STT Billing voice_ws_handler.go behavioral workflowchenyme grok2api
- CVE-2026-68933Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storagechartbrew
- CVE-2026-86005Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrewchartbrew
- CVE-2026-85736Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH pathschartbrew
- CVE-2026-85726Chartbrew: Blind NoSQL injection via date variable in embedded chartchartbrew
- CVE-2026-85712Chartbrew: Cross-tenant project takeover via body.team_id in /project routeschartbrew