CVEs published February 6, 2026
194 CVEs were published on February 6, 2026: 22 critical, 63 high. 2 are now in CISA KEV.
- Published
- 194
- Critical
- 22
- High
- 63
- Medium
- 97
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 81
Most affected products
- Huawei HarmonyOS
- 12
- devcode-it openstamanager · devcode-it/openstamanager
- 7
- gogs · gogs.io/gogs
- 6
- Huawei HarmonyOS · Huawei EMUI
- 6
- anthropics claude-code · @anthropic-ai/claude-code
- 4
- asterisk
- 4
- Free5GC
- 4
- itsourcecode Student Management System
- 4
- nyariv SandboxJS · @nyariv/sandboxjs
- 4
- UTT 进取
- 4
Critical 22
- CVE-2020-37135AMSS++ 4.7 - Backdoor Admin AccountAmssplus AMSS++
- CVE-2026-258033DP-MANAGER Uses Hard-coded Credentialsdenpiligrim 3dp-manager
- CVE-2026-25763Command Injection on OpenProject repositories leads to Remote Code Executionopf openproject
- CVE-2026-1731Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)BeyondTrust Remote Support(RS) & Privileged Remote Access
- CVE-2026-1727Information Disclosure via Bucket Squatting in Google Cloud Agentspace.Google Cloud Gemini Enterprise
- CVE-2026-25544Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapterspayloadcms payload · @payloadcms/drizzle
- CVE-2026-25592Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDKmicrosoft semantic-kernel · semantic-kernel +1
- CVE-2026-25632EPyT-Flow has unsafe JSON deserialization (__type__)WaterFutures EPyT-Flow · epyt-flow
- CVE-2026-25586SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollutionnyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-25520SandboxJS has a Sandbox Escapenyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-25587SandboxJS has a Sandbox Escapenyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-25641SandboxJS has a sandbox escape via TOCTOU bug on keys in property accessesnyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-25643Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escapeblakeblackshear frigate
- CVE-2026-1709Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authenticationRed Hat Enterprise Linux · keylime
- CVE-2026-25751FUXA Unauthenticated Exposure of Plaintext Database Credentialsfrangoteam FUXA · fuxa-server
- CVE-2026-25752FUXA Unauthenticated Remote Arbitrary Device Tag Writefrangoteam FUXA · fuxa-server
- CVE-2026-25753PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)Praskla-Technology assessment-placipy
- CVE-2025-69212OpenSTAManager has an OS Command Injection in P7M File Processingdevcode-it openstamanager · devcode-it/openstamanager
- CVE-2025-64111Gogs's update .git/config file allows remote command executiongogs · gogs.io/gogs
- CVE-2026-2017IP-COM W30AP POST Request wx3auth R7WebsSecurityHandler stack-based overflowIP-COM W30AP
- CVE-2026-21643An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may aFortinet FortiClientEMS
- CVE-2026-21626Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for JoomlaStackideas.com EasyDiscuss extension for Joomla
High 63
- CVE-2020-37163QuickDate 1.3.2 - SQL InjectionQuickDate
- CVE-2020-37162Wedding Slideshow Studio 1.36 - 'Key' Buffer OverflowWedding Slideshow Studio
- CVE-2020-37161Wedding Slideshow Studio 1.36 - 'Name' Buffer OverflowWedding Slideshow Studio
- CVE-2020-37160SprintWork 2.3.1 - Local Privilege EscalationVeridium SprintWork
- CVE-2020-37159Cuckoo Clock 5.0 - Buffer OverflowParallaxis Cuckoo Clock
- CVE-2020-37157DBPower C300 HD Camera - Remote Configuration DisclosureDBPower C300 HD Camera
- CVE-2020-37154eLection 2.0 - 'id' SQL InjectionTripath Project eLection
- CVE-2020-37147ATutor 2.2.4 - 'id' SQL InjectionATutor
- CVE-2020-37146Aptina AR0130 960P 1.3MP Camera - Remote Configuration DisclosureACE SECURITY Aptina AR0130 960P 1.3MP Camera
- CVE-2020-37141AMSS++ v 4.31 - 'id' SQL InjectionAMSS++
- CVE-2020-37095Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow (SEH)Cyberoam Authentication Client
- CVE-2026-25804Antrea has invalid enforcement order for network policy rules caused by integer overflowantrea-io antrea · antrea.io/antrea
- CVE-2026-25793Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleabilityslackhq nebula · github.com/slackhq/nebula
- CVE-2026-25762AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detectionadonisjs core · @adonisjs/bodyparser
- CVE-2026-25754AdonisJS multipart body parsing has Prototype Pollution issueadonisjs core · @adonisjs/bodyparser
- CVE-2026-25644DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgradedatahub-project datahub
- CVE-2026-25757Unauthenticated Spree Commerce users can view completed guest orders by Order IDspree · spree_storefront
- CVE-2026-2070UTT 进取 520W formPolicyRouteConf strcpy buffer overflowUTT 进取
- CVE-2026-2068UTT 进取 520W formSyslogConf strcpy buffer overflowUTT 进取
- CVE-2026-25758Spree allows unauthenticated users can access all guest addressesspree · spree_api
- CVE-2025-68621Trilium Notes has a Timing Attack Vulnerability in /api/login/syncTriliumNext Trilium
- CVE-2026-25732NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Writezauberzeug nicegui · nicegui
- CVE-2026-2067UTT 进取 520W formTimeGroupConfig strcpy buffer overflowUTT 进取
- CVE-2026-25580Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handlingpydantic-ai · pydantic-ai-slim
- CVE-2026-25593OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.applyopenclaw
- CVE-2026-25628Qdrant affected by arbitrary file write via `/logger` endpointqdrant
- CVE-2026-2066UTT 进取 520W formIpGroupConfig strcpy buffer overflowUTT 进取
- CVE-2026-25634iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()InternationalColorConsortium iccDEV
- CVE-2026-25731Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Exportkovidgoyal calibre
- CVE-2026-25635calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Executionkovidgoyal calibre
- CVE-2026-25636calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Executionkovidgoyal calibre
- CVE-2026-25640Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLpydantic-ai · pydantic-ai-slim
- CVE-2026-23989REVA Public Link Exploitopencloud-eu reva · github.com/opencloud-eu/reva +1
- CVE-2025-69214OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)devcode-it openstamanager · devcode-it/openstamanager
- CVE-2025-69216OpenSTAManager has an SQL Injection in Scadenzario Print Templatedevcode-it openstamanager · devcode-it/openstamanager
- CVE-2026-24416OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Moduledevcode-it openstamanager · devcode-it/openstamanager
- CVE-2026-24417OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Servicedevcode-it openstamanager · devcode-it/openstamanager
- CVE-2026-24418OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations moduledevcode-it openstamanager · devcode-it/openstamanager
- CVE-2026-24419OpenSTAManager has an SQL Injection in the Prima Nota moduledevcode-it openstamanager · devcode-it/openstamanager
- CVE-2026-25725Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.jsonanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-25723Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictionsanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-25722Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protectionanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-24135Gogs vulnerable to arbitrary file deletion via path traversal in wiki page updategogs · gogs.io/gogs
- CVE-2025-64175Gogs Vulnerable to 2FA Bypass via Recovery Codegogs · gogs.io/gogs
- CVE-2019-25293Blue Stacks App Player 2.4.44.62.57 - "BstHdLogRotatorSvc" Unquote Service Pathbluestacks Blue Stacks App Player
- CVE-2019-25305JumpStart 0.6.0.0 - 'jswpbapi' Unquoted Service PathInforprograma JumpStart
- CVE-2019-25304Intelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service PathIssivs Intelligent Security System SecurOS Enterprise
- CVE-2019-25303TheJshen contentManagementSystem 1.04 - 'id' SQL Injectionthejshen contentManagementSystem
- CVE-2019-25302Acer Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service PathAcer Launch Manager
- CVE-2019-25300thejshen Globitek CMS 1.4 - 'id' SQL Injectionthejshen Globitek CMS
- CVE-2019-25299rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injectionrimbalinux AhadPOS
- CVE-2019-25298html5_snmp 1.11 - 'Router_ID' SQL Injectionlolypop55 html5_snmp
- CVE-2019-25292Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service PathAlps HID Monitor Service
- CVE-2019-25266Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service PathWondershare Application Framework Service
- CVE-2026-2103Use of Hard-Coded Cryptographic Key for Password StorageInfor SyteLine ERP
- CVE-2025-13523Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 FlowMattermost Confluence Plugin · github.com/mattermost/matter…
- CVE-2025-13818Local privilege escalation in ESET Management Agent for WindowsESET spol s.r.o. ESET Management Agent
- CVE-2026-24930UAF concurrency vulnerability in the graphics module.Huawei HarmonyOS
- CVE-2026-1499WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Actionrevmakx WP Duplicate – WordPress Migration Plugin
- CVE-2026-24926Out-of-bounds write vulnerability in the camera module.Huawei HarmonyOS
- CVE-2026-24925Heap-based buffer overflow vulnerability in the image module.Huawei HarmonyOS
- CVE-2025-15566ingress-nginx auth-proxy-set-headers nginx configuration injectionKubernetes ingress-nginx
- CVE-2025-70963Gophish <=0.12.1 is vulnerable to Incorrect Access Control.github.com/gophish/gophish
Medium, low and unrated 109
- CVE-2020-37079Wing FTP Server < 6.2.7 - Cross-site Request ForgeryWing FTP Server
- CVE-2020-37171TapinRadio 2.12.3 - 'username' Denial of ServiceRaimersoft TapinRadio
- CVE-2020-37170TapinRadio 2.12.3 - 'address' Denial of ServiceRaimersoft TapinRadio
- CVE-2020-37166AbsoluteTelnet 11.12 - 'SSH2/username' Denial of ServiceCelestial Software AbsoluteTelnet
- CVE-2020-37165AbsoluteTelnet 11.12 - "license name" Denial of ServiceCelestial Software AbsoluteTelnet
- CVE-2020-37164AbsoluteTelnet 11.12 - "license entry" Denial of ServiceCelestial Software AbsoluteTelnet
- CVE-2020-37155Core FTP Lite 1.3 - Denial of Service (PoC)Core FTP Lite
- CVE-2020-37122SpotFTP-FTP Password Recover 2.4.8 - Denial of ServiceNsauditor FTP Password Recover
- CVE-2020-37109aSc TimeTables 2020.11.4 - Denial of Serviceasc Applied Software Consultants aSc TimeTables
- CVE-2020-37107Core FTP LE 2.2 - Denial of ServiceCore FTP LE
- CVE-2020-37106Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)Bdtask Business Live Chat Software
- CVE-2026-25749Heap Overflow in Vimvim
- CVE-2026-25764OpenProject vulnerable to Stored HTML injectionopf openproject
- CVE-2026-2069ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflowggml-org llama.cpp
- CVE-2026-25760Website Path Traversal / Arbitrary File Read (Authenticated) in SliverBishopFox sliver · github.com/bishopfox/sliver
- CVE-2026-25123Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.pinghomarr-labs homarr
- CVE-2026-25533Enclave has a sandbox escape via infinite recursion and error objectsagentfront enclave · enclave-vm +1
- CVE-2026-25516NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML contentzauberzeug nicegui · nicegui
- CVE-2026-25574Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)payloadcms payload · payload
- CVE-2026-25581SCEditor affected by DOM XSS via emoticon URL/HTML injectionsamclarke SCEditor · sceditor
- CVE-2026-25597PrestaShop has a time based enumeration in FO login formPrestaShop · prestashop/prestashop
- CVE-2026-25631Domain allowlist bypass enables credential exfiltrationn8n-io n8n · n8n
- CVE-2026-25729DeepAudit Affected by User Enumeration via Broken Access Controllintsinghua DeepAudit
- CVE-2026-2065Flycatcher Toys smART Pixelator Bluetooth Low Energy missing authenticationFlycatcher Toys smART Pixelator
- CVE-2026-2064Portabilis i-Educar User Data meusdadod.php cross site scriptingPortabilis i-Educar
- CVE-2026-25642HedgeDoc security headers for uploaded files were not workinghedgedoc
- CVE-2026-25727time affected by a stack exhaustion denial of service attacktime-rs time · time
- CVE-2025-15320Tanium addressed a denial of service vulnerability in Tanium Client.Tanium Client
- CVE-2026-22254Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Managerwintercms winter · winter/wn-cms-module
- CVE-2026-25647Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlinksiyuan-note siyuan
- CVE-2026-2063D-Link DIR-823X Web Management set_ac_server os command injectionD-Link DIR-823X
- CVE-2026-25650MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth tokensmn2gnt MCP-Salesforce · mcp-salesforce-connector
- CVE-2026-25651client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirecttgies client-certificate-auth · client-certificate-auth
- CVE-2026-2062Open5GS PGW S5U Address sgwc_sxa_handle_session_modification_response null pointer dereferenceOpen5GS
- CVE-2026-24050Zulip affected by Stored XSS in user profile modalzulip
- CVE-2026-2061D-Link DIR-823X set_ipv6 sub_424D20 os command injectionD-Link DIR-823X
- CVE-2026-24776OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transferopf openproject
- CVE-2026-25724Claude Code Has Permission Deny Bypass Through Symbolic Linksanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-24851OpenFGA Improper Policy Enforcementopenfga · github.com/openfga/openfga
- CVE-2026-23633Gogs has arbitrary file read/write via path traversal in Git hook editinggogs · gogs.io/gogs
- CVE-2026-24903OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session PageAlgoNetLab OrcaStatLLM-Researcher
- CVE-2026-23632Gogs user can update repository content with read-only permissiongogs · gogs.io/gogs
- CVE-2026-22592Gogs is Vulnerable to Denial of Servicegogs · gogs.io/gogs
- CVE-2026-2060code-projects Simple Blood Donor Management System editcampaignform.php sql injectioncode-projects Simple Blood Donor Management System
- CVE-2026-1769Stored XSS on Xerox CentreWare Web 7.0.6Xerox CentreWare
- CVE-2026-2059SourceCodester Medical Center Portal Management System emp_edit1.php sql injectionSourceCodester Medical Center Portal Management System
- CVE-2026-23741ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalationasterisk
- CVE-2026-23740Asterisk vulnerable to potential privilege escalationasterisk
- CVE-2026-23739Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injectionasterisk
- CVE-2026-23738The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitizationasterisk
- CVE-2019-25301thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scriptingthrsrossi Millhouse Project
- CVE-2019-25294html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scriptinglolypop55 html5_snmp
- CVE-2026-2058mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-25556MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double FreeArtifex Software MuPDF
- CVE-2026-2057SourceCodester Medical Center Portal Management System login.php sql injectionSourceCodester Medical Center Portal Management System
- CVE-2026-2056D-Link DIR-605L/DIR-619L DHCP Connection Status wan_connection_status.asp information disclosureD-Link DIR-605L · D-Link DIR-619L
- CVE-2026-1337Insufficient escaping of unicode characters in query logneo4j Enterprise Edition · neo4j Community Edition +1
- CVE-2026-2055D-Link DIR-605L/DIR-619L DHCP Client Information information disclosureD-Link DIR-605L · D-Link DIR-619L
- CVE-2026-2054D-Link DIR-605L/DIR-619L Wifi Setting information disclosureD-Link DIR-605L · D-Link DIR-619L
- CVE-2026-2018itsourcecode School Management System controller.php sql injectionitsourcecode School Management System
- CVE-2026-1293Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block AttributeYoast SEO – Advanced SEO with real-time guidance and built-…
- CVE-2026-2016happyfish100 libfastcommon base64.c base64_decode stack-based overflowhappyfish100 libfastcommon
- CVE-2026-2015Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorizationPortabilis i-Educar
- CVE-2026-2014itsourcecode Student Management System index.php sql injectionitsourcecode Student Management System
- CVE-2026-2013itsourcecode Student Management System index.php sql injectionitsourcecode Student Management System
- CVE-2026-24928Out-of-bounds write vulnerability in the file system module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-24927Out-of-bounds access vulnerability in the frequency modulation module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-24924Vulnerability of improper permission control in the print module.Huawei HarmonyOS
- CVE-2026-24920Permission control vulnerability in the AMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-2012itsourcecode Student Management System index.php sql injectionitsourcecode Student Management System
- CVE-2026-24919Out-of-bounds write vulnerability in the DFX module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-24917UAF vulnerability in the security module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-24916Identity authentication bypass vulnerability in the window module.Huawei HarmonyOS
- CVE-2026-24931Vulnerability of improper criterion security check in the card module.Huawei HarmonyOS
- CVE-2026-24929Out-of-bounds read vulnerability in the graphics module.Huawei HarmonyOS
- CVE-2026-24923Permission control vulnerability in the HDC module.Huawei HarmonyOS
- CVE-2026-24922Buffer overflow vulnerability in the HDC module.Huawei HarmonyOS
- CVE-2026-2011itsourcecode Student Management System controller.php sql injectionitsourcecode Student Management System
- CVE-2026-24921Address read vulnerability in the HDC module.Huawei HarmonyOS
- CVE-2026-24918Address read vulnerability in the communication module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-24915Out-of-bounds read issue in the media subsystem.Huawei HarmonyOS
- CVE-2026-24914Type confusion vulnerability in the camera module.Huawei HarmonyOS
- CVE-2026-1252Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Fieldjackdewey Events Listing Widget
- CVE-2026-1785Code Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actionscodesnippetspro Code Snippets
- CVE-2026-2010Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorizationSanluan PublicCMS
- CVE-2026-2009SourceCodester Gas Agency Management System createUser.php access controlSourceCodester Gas Agency Management System
- CVE-2026-1279Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attributecyberlord92 Employee Directory – Staff Directory and Listing
- CVE-2026-2008abhiphile fermat-mcp eqn_chart.py eqn_chart code injectionabhiphile fermat-mcp
- CVE-2026-1401Tune Library <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Importjackdewey Tune Library
- CVE-2026-1909WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attributex-raym WaveSurfer-WP
- CVE-2025-10753OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorizationcyberlord92 OAuth Single Sign On – SSO
- CVE-2026-1808Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesravanh Orange Comfort+ accessibility toolbar for WordPress
- CVE-2026-1888Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeshtplugins Docus – YouTube Video Playlist
- CVE-2026-2000DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injectionDCN DCME-320
- CVE-2026-0521Reflected Cross-Site Scripting in PDF Export Error MessageTYDAC AG MAP+
- CVE-2026-1998micropython runtime.c mp_import_all memory corruptionmicropython
- CVE-2026-0598Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiRed Hat Ansible Automation Platform
- CVE-2026-1991libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereferencelibuvc
- CVE-2026-1990oatpp Type.hpp ObjectWrapper null pointer dereferenceoatpp
- CVE-2026-1979mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after freemruby
- CVE-2026-1978kalyan02 NanoCMS User Information pagesdata.txt direct requestkalyan02 NanoCMS
- CVE-2026-1977isaacwasserman mcp-vegalite-server visualize_data eval code injectionisaacwasserman mcp-vegalite-server
- CVE-2026-1976Free5GC SMF SessionDeletionResponse null pointer dereferenceFree5GC
- CVE-2026-1975Free5GC pfcp_reports.go identityTriggerType null pointer dereferenceFree5GC
- CVE-2026-1228Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attributebplugins Timeline Block – Beautiful Timeline Builder for Wo…
- CVE-2026-1974Free5GC SMF datapath.go ResolveNodeIdToIp denial of serviceFree5GC
- CVE-2026-1973Free5GC SMF establishPfcpSession null pointer dereferenceFree5GC
- CVE-2026-1972Edimax BR-6208AC auth_check_userpass2 default credentialsEdimax BR-6208AC
- CVE-2026-1971Edimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross site scriptingEdimax BR-6288ACL