CVEs
Browse the synced catalog, newest first.
- CVE-2026-123497Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discoverygo-vikunja vikunja
- CVE-2026-123496Vikunja veans before 2.7.1 Symlink Following in veans initgo-vikunja vikunja
- CVE-2026-123495Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callbackgo-vikunja vikunja
- CVE-2026-123494Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacksgo-vikunja vikunja
- CVE-2026-123493Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokensgo-vikunja vikunja
- CVE-2026-120531Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameterwedevs Subscribe2 – Form, Email Subscribers & Newsletters
- CVE-2026-99284net: skbuff: propagate shared-frag marker in skb_zerocopy()Linux
- CVE-2026-124060TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflowTOTOLINK CA300-PoE
- CVE-2026-99283netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packetsLinux
- CVE-2026-124059TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-124058TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-124057TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123472WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerabilityeLightUp Meta Box – WordPress Custom Fields Framework
- CVE-2026-119522WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-123461WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerabilityPluginUs.Net FOX
- CVE-2026-120836WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerabilityeLightUp Meta Box – WordPress Custom Fields Framework
- CVE-2026-124258WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-123992DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scriptingDataEase
- CVE-2026-123991DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted uploadDataEase
- CVE-2026-123990DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injectionDataEase
- CVE-2026-123989ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permissionESEngine DeepSeek-Reasonix
- CVE-2026-124318Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fieldstreeio
- CVE-2026-124317libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16libexpat
- CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requestsfrappe erpnext
- CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_itemsfrappe erpnext
- CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activitiesfrappe erpnext
- CVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_docfrappe erpnext
- CVE-2026-124312Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfofraunhoferhhi vvdec
- CVE-2026-124311Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlkfraunhoferhhi vvdec
- CVE-2026-124310Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPicfraunhoferhhi vvdec