CVEs
Browse the synced catalog, newest first.
- CVE-2026-111453Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable DagApache Software Foundation apache-airflow-core
- CVE-2026-111454Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot readApache Software Foundation apache-airflow · Apache Software…
- CVE-2026-111455Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commitApache Software Foundation apache-airflow-core
- CVE-2026-124585Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injectionChengdu Feiyuxing Technology VW2100 · Chengdu Feiyuxing Tec…
- CVE-2026-123870[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when…Eclipse Foundation otterdog
- CVE-2026-116337Uncontrolled resource consumption vulnerability in HTTP response handling of Qt Network impacts Qt FrameworkQt Framework
- CVE-2026-124584wummel patool Gzip Extraction fileutil.py extract_gzip symlinkwummel patool
- CVE-2026-92606TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputerTÜBİTAK BİLGEM Software Technologies Research Institute Par…
- CVE-2026-124582WebTorrent File Path torrent.js getFileModtimes path traversalWebTorrent
- CVE-2026-94249Missing Authorization in TÜBİTAK BİLGEM's LiderahenkTÜBİTAK BİLGEM Software Technologies Research Institute Lid…
- CVE-2026-124581itsourcecode Airline Reservation System manage_flight.php sql injectionitsourcecode Airline Reservation System
- CVE-2026-124580Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injectionChengdu Feiyuxing Technology VW2100 · Chengdu Feiyuxing Tec…
- CVE-2026-113437Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd.DOS Co. SS1 · Rococo Co. rocoeyes
- CVE-2026-109582Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd.DOS Co. SS1
- CVE-2026-124579aaPanel BillionMail Relay Configuration API relay.go injectionaaPanel BillionMail
- CVE-2026-120386Effekseer improperly validates "effect" files.Effekseer
- CVE-2026-124578Pantum BP5100DW Web omDB.shtml missing authenticationPantum BP5100DW
- CVE-2026-124577Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authenticationIntelbras SG 2404 PoE L2+
- CVE-2026-124576BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflowBeikeShop
- CVE-2026-124575SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authenticationSiteServer SSCMS
- CVE-2026-124574chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorizationchenyme grok2api
- CVE-2026-124573logseq Local HTTP API server.cljs validate-auth-token missing authenticationlogseq
- CVE-2026-124572DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversalDataLinkDC dinky
- CVE-2026-81422Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User RegistrationAdvanced Appointment Booking & Scheduling
- CVE-2026-123751WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication BypassWP Duplicate
- CVE-2026-123145WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express CheckoutWooCommerce Stripe Payment Gateway
- CVE-2026-123131GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check BypassGemBooking
- CVE-2026-123129Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price ManipulationEvent Tickets Manager for WooCommerce
- CVE-2026-123128GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race ConditionGemBooking
- CVE-2026-123091Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login FormsVigilant