CVEs
Browse the synced catalog, newest first.
- CVE-2026-109871User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership RenewalUser Registration & Membership
- CVE-2026-109870User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment BypassUser Registration & Membership
- CVE-2026-106468Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet ImportCode Snippets
- CVE-2026-104718Elementor < 4.3.6 - Contributor+ Stored XSS via Element IDElementor Website Builder
- CVE-2025-15714Live Composer < 2.1.24 - Admin+ Stored XSS via ButtonLive Composer
- CVE-2025-15713Live Composer < 2.1.24 - Admin+ Stored XSS via IconLive Composer
- CVE-2025-15712Live Composer < 2.1.24 - Admin+ Stored XSS via StaffLive Composer
- CVE-2025-15711Live Composer < 2.1.24 - Admin+ Stored XSS via SocialLive Composer
- CVE-2026-116081Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc.Fenrir Sleipnir Mobile for iPhone / iPad
- CVE-2026-118368Akaunting 3.3.0 - Stored XSS through imported item namesAkaunting
- CVE-2026-59191TwigView: FileLoader is vulnerable to arbitrary file readcakephp twig-view
- CVE-2026-59192TwigView: Deserialization of Untrusted Datacakephp twig-view
- CVE-2026-61810libspdm: SPDM (DSP0274) FINISH transcript under-specifies the new 1.4 OpaqueData fieldsDMTF libspdm
- CVE-2026-64686OpenSearch Dashboards: SSRF in fetchDataSourceMetaData — missing endpoint validationopensearch-project OpenSearch-Dashboards
- CVE-2026-64678Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Pathnitrite-java
- CVE-2026-64682AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable nameNauelG astro-blocks
- CVE-2026-64669pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clientsmcdope pam_usb
- CVE-2026-64667pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scanmcdope pam_usb
- CVE-2026-64666pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unsetmcdope pam_usb
- CVE-2026-64668pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clientsmcdope pam_usb
- CVE-2026-64670Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on editwalinejs waline
- CVE-2026-64671Stored XSS in the @waline/client UserList widget via an unescaped commenter link fieldwalinejs waline
- CVE-2026-97054HTTP/1 server crash due to MaxBytesReader header race in net/httpGo standard library net/http · stdlib
- CVE-2026-97033Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97034Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97035Unexpected code execution and arbitrary file write via Clang -gen- and GCC -gnat flags in cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97036Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97037Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97038Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/goGo toolchain cmd/go · toolchain
- CVE-2026-97039Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/goGo toolchain cmd/go · toolchain