CVEs published February 10, 2026
280 CVEs were published on February 10, 2026: 11 critical, 129 high. 8 are now in CISA KEV.
- Published
- 280
- Critical
- 11
- High
- 129
- Medium
- 126
- Low
- 14
- Unrated
- 0
- Now in CISA KEV
- 8
- Fix available
- 109
Most affected products
- Microsoft Windows
- 27
- Adobe After Effects
- 15
- MongoDB Server
- 9
- Adobe Substance 3D Designer
- 7
- Adobe Audition
- 6
- AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- 6
- Siemens Simcenter Femap · Siemens Simcenter Nastran
- 6
- Adobe Substance3D - Stager
- 5
- Fortinet FortiOS
- 5
- Adobe DNG Software Development Kit
- 4
Critical 11
- CVE-2026-26009Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Executionkarutoil catalyst
- CVE-2026-21531Azure SDK for Python Remote Code Execution VulnerabilityMicrosoft Azure AI Language Authoring · azure-ai-language-c…
- CVE-2026-25993EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keysevershopcommerce evershop
- CVE-2026-25728ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race ConditionMacWarrior clipbucket-v5
- CVE-2026-1774CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.CASL Ability · @casl/ability
- CVE-2026-23906Apache Druid: Authentication Bypass via LDAP Anonymous BindApache Software Foundation Apache Druid · org.apache.druid.…
- CVE-2025-11242SSRF in Teknolist Computer's OkulistikTeknolist Computer Systems Software Publishing Industry and…
- CVE-2026-2096Flowring｜Agentflow - Missing AuthenticatonFlowring Agentflow
- CVE-2026-2095Flowring｜Agentflow - Authentication BypassFlowring Agentflow
- CVE-2026-0509Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- CVE-2026-0488Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)SAP_SE SAP CRM and SAP S/4HANA
High 129
- CVE-2026-26007cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curvespyca cryptography · cryptography
- CVE-2026-1507Uncaught Exception vulnerability in AVEVA PI Data ArchiveAVEVA PI Data Archive PI Server
- CVE-2025-29951A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privileAMD Athlon™ 3000 Series Mobile Processors with Radeon™ G… +2
- CVE-2021-26381Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a larAMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors… +18
- CVE-2026-21349Lightroom Desktop | Out-of-bounds Write (CWE-787)Adobe Lightroom Desktop
- CVE-2024-36355Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sAMD EPYC™ 9004 Series Processors · AMD Ryzen™ Threadrip… +31
- CVE-2025-29950Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary cAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Serie… +17
- CVE-2026-25506MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgerydun munge
- CVE-2026-25613An unsafe cast in the MongoDB query planner can result in a segmentation fault.MongoDB Server
- CVE-2026-1849Mongod can run out of stack memory when expressions create deeply nested documentsMongoDB Server
- CVE-2026-1850An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplificationMongoDB Server
- CVE-2026-21352DNG SDK | Out-of-bounds Write (CWE-787)Adobe DNG Software Development Kit
- CVE-2026-21353DNG SDK | Integer Overflow or Wraparound (CWE-190)Adobe DNG Software Development Kit
- CVE-2026-25610Invalid $geoNear index hint may cause server crashMongoDB Server
- CVE-2026-21346Bridge | Out-of-bounds Write (CWE-787)Adobe Bridge
- CVE-2026-21347Bridge | Integer Overflow or Wraparound (CWE-190)Adobe Bridge
- CVE-2026-1848Connections received from the proxy port may not count towards total accepted connectionsMongoDB Server
- CVE-2026-21344Substance3D - Stager | Out-of-bounds Read (CWE-125)Adobe Substance3D - Stager
- CVE-2026-21343Substance3D - Stager | Out-of-bounds Read (CWE-125)Adobe Substance3D - Stager
- CVE-2026-21341Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2026-21345Substance3D - Stager | Out-of-bounds Read (CWE-125)Adobe Substance3D - Stager
- CVE-2026-21342Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2026-1847MongoDB Server may crash when inserting large documentsMongoDB Server
- CVE-2026-21335Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-21334Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-25612Internal ResourceId collision may affect unrelated collectionsMongoDB Server
- CVE-2026-21357InDesign Desktop | Heap-based Buffer Overflow (CWE-122)Adobe InDesign Desktop
- CVE-2026-21329After Effects | Use After Free (CWE-416)Adobe After Effects
- CVE-2026-21323After Effects | Use After Free (CWE-416)Adobe After Effects
- CVE-2026-21324After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2026-21326After Effects | Use After Free (CWE-416)Adobe After Effects
- CVE-2026-21322After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2026-21318After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2026-21328After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2026-21330After Effects | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)Adobe After Effects
- CVE-2026-21325After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2026-21327After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2026-21320After Effects | Use After Free (CWE-416)Adobe After Effects
- CVE-2026-21321After Effects | Integer Overflow or Wraparound (CWE-190)Adobe After Effects
- CVE-2026-21351After Effects | Use After Free (CWE-416)Adobe After Effects
- CVE-2026-25611Pre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerMongoDB Server
- CVE-2026-20841Windows Notepad App Remote Code Execution VulnerabilityMicrosoft Windows Notepad
- CVE-2026-20846GDI+ Denial of Service VulnerabilityMicrosoft Office for Android · Microsoft Windows
- CVE-2026-21228Azure Local Remote Code Execution VulnerabilityMicrosoft Azure Local
- CVE-2026-21231Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21232Windows HTTP.sys Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21237Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21238Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21239Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21241Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21240Windows HTTP.sys Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21243Windows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2026-21244Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-21245Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21250Windows HTTP.sys Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21251Cluster Client Failover (CCF) Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2026-21253Mailslot File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21255Windows Hyper-V Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-21256GitHub Copilot and Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2026-21257GitHub Copilot and Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2026-21508Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21511Microsoft Outlook Spoofing VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2026-21516GitHub Copilot for Jetbrains Remote Code Execution VulnerabilityMicrosoft GitHub Copilot Plugin for JetBrains IDEs
- CVE-2026-21514Microsoft Word Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2026-21537Microsoft Defender for Endpoint Linux Extension Remote Code Execution VulnerabilityMicrosoft Defender for Endpoint for Linux
- CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21229Power BI Remote Code Execution VulnerabilityMicrosoft Power BI Report Server
- CVE-2026-21523GitHub Copilot and Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code CoPilot Chat Extension · Micro…
- CVE-2026-21218.NET Spoofing VulnerabilityMicrosoft .NET · System.Security.Cryptography.Cose
- CVE-2026-21236Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21234Windows Connected Devices Platform Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21235Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21242Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21246Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21247Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-21248Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-21260Microsoft Outlook Spoofing VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2026-21259Microsoft Excel Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-21518GitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft Visual Studio Code CoPilot Chat Extension · Micro…
- CVE-2026-21519Desktop Window Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-25992SiYuan has a File Read Interface Case Bypass Vulnerabilitysiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-21312Audition | Out-of-bounds Write (CWE-787)Adobe Audition
- CVE-2026-25947Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validationworklenz
- CVE-2026-0652Remote Code Execution on TP-Link Tapo C260 by Guest UserTP-Link Systems Tapo C260
- CVE-2026-0653Insecure Access Control on TP-Link Tapo D235 and C260TP-Link Systems Tapo C260 · TP-Link Systems Tapo D235
- CVE-2026-25646LIBPNG has a heap buffer overflow in png_set_quantizepnggroup libpng
- CVE-2026-25577Emmett has an Unhandled CookieError Exception Causing Denial of Serviceemmett-framework core · emmett-core
- CVE-2026-24045Docmost Affected by Stored XSS in Public Share Pagedocmost
- CVE-2025-35998Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within RinIntel(R) Platforms
- CVE-2025-32008Out-of-bounds write in the firmware for the Intel(R) AMT and Intel(R) Standard Manageability within Ring 3: User Applications may allow a deIntel(R) AMT and Intel(R) Standard Manageability
- CVE-2025-30513Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege.TDX Module
- CVE-2025-25210Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allServer Firmware Update Utility
- CVE-2025-22453Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allServer Firmware Update Utility
- CVE-2025-20080Null pointer dereference in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability within Ring 0: Kernel may allow a denial Intel(R) AMT and Intel(R) Standard Manageability
- CVE-2026-22153An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauFortinet FortiOS
- CVE-2025-52436An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForFortinet FortiSandbox
- CVE-2025-11004Reflected XSS vulnerability in Simplicity Device Manager toolsilabs.com Simplicity Device Manager
- CVE-2026-1603An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific storedIvanti Endpoint Manager
- CVE-2025-7636SQLi in Ergosis Security Systems' ZEUS PDKSErgosis Security Systems Computer Industry and Trade ZEUS P…
- CVE-2025-7347IDOR in Dinibh Puzzle's Dinibh Patrol Tracking SystemDinibh Puzzle Software Solutions Dinibh Patrol Tracking Sys…
- CVE-2025-6967Authentication Bypass in Sarman Soft's CMSSarman Soft Software and Technology Services Industry and T…
- CVE-2025-15569Artifex MuPDF win_main.c get_system_dpi uncontrolled search pathArtifex MuPDF
- CVE-2026-25656A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1).Siemens SINEC NMS · Siemens User Management Component
- CVE-2026-25655A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2).Siemens SINEC NMS
- CVE-2026-23720A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).Siemens Simcenter Femap · Siemens Simcenter Nastran
- CVE-2026-23719A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).Siemens Simcenter Femap · Siemens Simcenter Nastran
- CVE-2026-23718A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).Siemens Simcenter Femap · Siemens Simcenter Nastran
- CVE-2026-23717A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).Siemens Simcenter Femap · Siemens Simcenter Nastran
- CVE-2026-23716A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).Siemens Simcenter Femap · Siemens Simcenter Nastran
- CVE-2026-23715A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512).Siemens Simcenter Femap · Siemens Simcenter Nastran
- CVE-2026-22923A vulnerability has been identified in NX (All versions < V2512), NX (Managed Mode) (All versions < V2512).Siemens NX
- CVE-2025-40587A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2).Siemens Polarion
- CVE-2026-24343Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsApache Software Foundation Apache HertzBeat
- CVE-2026-1866Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Formjeroenpeters1986 Name Directory
- CVE-2026-2268Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Actionkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2026-2097Flowring｜Agentflow - Arbitrary File UploadFlowring Agentflow
- CVE-2026-2094Flowring｜Docpedia - SQL InjectionFlowring Docpedia
- CVE-2026-2093Flowring｜Docpedia - SQL InjectionFlowring Docpedia
- CVE-2025-11547AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.Axis Communications AB AXIS Camera Station Pro
- CVE-2025-11142The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution.Axis Communications AB AXIS OS
- CVE-2026-24322Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)SAP_SE SAP Solution Tools Plug-In
- CVE-2026-23689Denial of service (DOS) in SAP Supply Chain ManagementSAP_SE SAP Supply Chain Management
- CVE-2026-23687XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP PlatformSAP_SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-2260D-Link DCS-931L setSysAdmin os command injectionD-Link DCS-931L
- CVE-2026-0508Open Redirect vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2026-0490Denial of service (DOS) in SAP BusinessObjects BI PlatformSAP_SE SAP BusinessObjects BI Platform
- CVE-2026-0485Denial of service (DOS) vulnerability in SAP BusinessObjects BI PlatformSAP_SE SAP BusinessObjects BI Platform
Medium, low and unrated 140
- CVE-2026-25872JUNG Smart Panel 5.1 KNX Unauthenticated Path TraversalALBRECHT JUNG GMBH & CO. KG JUNG Smart Panel 5.1 KNX
- CVE-2026-25870DoraCMS <= 3.1 UEditor Remote Image Fetch SSRFdoramart DoraCMS
- CVE-2026-26013LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messageslangchain-ai langchain · langchain-core
- CVE-2026-26006Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogptSignificant-Gravitas AutoGPT
- CVE-2025-12699ZOLL ePCR IOS Mobile Application Insertion of Sensitive Information into Externally-Accessible File or DirectoryZOLL ePCR IOS Mobile Application
- CVE-2026-1495Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT AgentAVEVA PI to CONNECT Agent
- CVE-2026-1763Enervista UR Setup DLL HijackingGE Vernova Enervista
- CVE-2026-1762Enervista UR Setup Directory Traversal VulnerabilityGE Vernova Enervista
- CVE-2024-36311A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validAMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Gr… +4
- CVE-2025-48515Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Gr… +4
- CVE-2021-26410Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memoAMD Ryzen™ 5000 Series Desktop Processors with Radeon™… +13
- CVE-2025-29949Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to wAMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +20
- CVE-2026-21348Substance3D - Modeler | Out-of-bounds Read (CWE-125)Adobe Substance3D - Modeler
- CVE-2024-36310Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMAMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Serie… +16
- CVE-2025-29946Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU.AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- CVE-2025-0029Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writeAMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- CVE-2025-0031A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a diffeAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +7
- CVE-2025-48514Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6
- CVE-2025-54514Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a AMD EPYC™ 9005 Series Processors · AMD Ryzen™ 9000HX Ser… +8
- CVE-2025-48509Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of AMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6
- CVE-2025-52534Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integritAMD EPYC™ 9005 Series Processors
- CVE-2025-0012Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- CVE-2025-29939Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) duAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6
- CVE-2024-21953Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integriAMD EPYC™ 9004 Series Processors · AMD EPYC™ 8004 Series… +1
- CVE-2025-29952Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- CVE-2025-52536Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting iAMD EPYC™ 9004 Series Processors · AMD EPYC™ 7003 Series… +6
- CVE-2025-48517Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guesAMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- CVE-2025-29948Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…
- CVE-2026-2303Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leakMongoDB Go Driver · go.mongodb.org/mongo-driver +1
- CVE-2026-2302Unsafe Reflection in Mongoid::Criteria.from_hashMongoDB Ruby Driver
- CVE-2026-25609profile command may permit unauthorized configurationMongoDB Server
- CVE-2026-21354DNG SDK | Integer Overflow or Wraparound (CWE-190)Adobe DNG Software Development Kit
- CVE-2026-21355DNG SDK | Out-of-bounds Read (CWE-125)Adobe DNG Software Development Kit
- CVE-2026-21337Substance3D - Designer | Out-of-bounds Read (CWE-125)Adobe Substance 3D Designer
- CVE-2026-21339Substance3D - Designer | Out-of-bounds Read (CWE-125)Adobe Substance 3D Designer
- CVE-2026-21338Substance3D - Designer | NULL Pointer Dereference (CWE-476)Adobe Substance 3D Designer
- CVE-2026-21340Substance3D - Designer | Out-of-bounds Read (CWE-125)Adobe Substance 3D Designer
- CVE-2026-21336Substance3D - Designer | NULL Pointer Dereference (CWE-476)Adobe Substance 3D Designer
- CVE-2026-21358InDesign Desktop | Heap-based Buffer Overflow (CWE-122)Adobe InDesign Desktop
- CVE-2026-21332InDesign Desktop | Out-of-bounds Read (CWE-125)Adobe InDesign Desktop
- CVE-2026-1997Certain HP OfficeJet Pro Printers - Information DisclosureHP OfficeJet Pro 8730 All-in-One Printer · HP OfficeJet… +6
- CVE-2026-21319After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2026-21350After Effects | NULL Pointer Dereference (CWE-476)Adobe After Effects
- CVE-2026-26003FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attacklabring FastGPT
- CVE-2026-21222Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-21249Windows NTLM Spoofing VulnerabilityMicrosoft Windows
- CVE-2026-21261Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-21525Windows Remote Access Connection Manager Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-21529Azure HDInsight Spoofing VulnerabilityMicrosoft Azure HDInsight
- CVE-2026-21528Azure IoT Explorer Information Disclosure VulnerabilityMicrosoft Azure IoT Explorer
- CVE-2026-21527Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-21522Microsoft ACI Confidential Containers Elevation of Privilege VulnerabilityMicrosoft ACI Confidential Containers
- CVE-2026-23655Microsoft ACI Confidential Containers Information Disclosure VulnerabilityMicrosoft ACI Confidential Containers
- CVE-2026-21258Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-21512Azure DevOps Server Cross-Site Scripting VulnerabilityMicrosoft Azure DevOps Server
- CVE-2026-21517Windows App for Mac Installer Elevation of Privilege VulnerabilityMicrosoft Windows App for Mac
- CVE-2026-21316Audition | Access of Memory Location After End of Buffer (CWE-788)Adobe Audition
- CVE-2026-21315Audition | Out-of-bounds Read (CWE-125)Adobe Audition
- CVE-2026-21313Audition | Out-of-bounds Read (CWE-125)Adobe Audition
- CVE-2026-21317Audition | Out-of-bounds Read (CWE-125)Adobe Audition
- CVE-2026-21314Audition | Out-of-bounds Read (CWE-125)Adobe Audition
- CVE-2026-25956Frappe Affected by XSS and Open Redirect in Sign Upfrappe
- CVE-2026-1996Certain HP OfficeJet Pro Printers – Denial of ServiceHP OfficeJet Pro 8710 All-in-One Printer series
- CVE-2026-0651Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local httpsTP-Link Systems Tapo C260 · TP-Link Systems Tapo D235 +2
- CVE-2026-25805Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.zed-industries zed
- CVE-2026-25530Kanboard is missing authorization check in getSwimlane API allows cross-project data accesskanboard
- CVE-2026-24885Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignmentkanboard
- CVE-2025-36522Incorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later.Intel(R) Chipset Software
- CVE-2025-36511Incorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an eIntel(R) Memory and Storage Tool
- CVE-2025-35999Incorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) Server Boards and IntSystem Firmware Update Utility (SysFwUpdt) for Intel(R) Ser…
- CVE-2025-35992Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service.Intel(R) NPU Drivers
- CVE-2025-33030Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 3: User Applications may allow an escalation of privileIntel(R) NPU Drivers
- CVE-2025-32739Improper conditions check in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow Intel(R) Graphics Drivers and Intel LTS kernels
- CVE-2025-32735Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service.Intel(R) NPU Drivers
- CVE-2025-32467Use of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure.TDX Module
- CVE-2025-32453Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilIntel(R) Graphics Driver software
- CVE-2025-32452Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an escalation of privilAI Playground
- CVE-2025-32092Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Applications may allow anIntel(R) Graphics Software
- CVE-2025-32007Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information disclosure.TDX
- CVE-2025-32003Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring100GbE Intel(R) Ethernet Network Adapter E810
- CVE-2025-31944Race condition for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow a denial of service.TDX Module
- CVE-2025-31655Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of priIntel(R) Battery Life Diagnostic Tool
- CVE-2025-31648Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege.Intel(R) Processor Family may allow an escalation of privil…
- CVE-2025-30508Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow a denial of serviIntel(R) Platforms
- CVE-2025-27940Out-of-bounds read for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure.TDX Module
- CVE-2025-27708Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel mayIntel(R) Converged Security and Management Engine (CSME) Fi…
- CVE-2025-27572Exposure of sensitive information during transient execution for some TDX within Ring 0: Hypervisor may allow an information disclosure.TDX
- CVE-2025-27560Loop with unreachable exit condition ('infinite loop') for some Intel(R) Platform within Ring 0: Kernel may allow a denial of service.Intel(R) Platform
- CVE-2025-27535Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C.Intel(R) Ethernet Connection E825-C.
- CVE-2025-27243Out-of-bounds write in the firmware for some Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS maIntel(R) Ethernet Controller E810
- CVE-2025-25058Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) & 2.2.3.Intel(R) Ethernet 800-Series
- CVE-2025-24851Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal100GbE Intel(R) Ethernet Controller E810
- CVE-2025-22885Improper buffer restrictions in the firmware for the TDX Module may allow an escalation of privilege.TDX Module may allow an escalation of privilege. System sof…
- CVE-2025-22849Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4Intel(R) Optane(TM) PMem management software
- CVE-2025-20106Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 20VTune(TM) Profiler software and Intel(R) oneAPI Base Toolki…
- CVE-2025-20070Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 Intel(R) Optane(TM) PMem management software
- CVE-2025-62439An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4,Fortinet FortiOS
- CVE-2025-62676An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 Fortinet FortiClientWindows
- CVE-2025-68686An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,Fortinet FortiOS
- CVE-2025-64157A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2Fortinet FortiOS
- CVE-2025-55018An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.Fortinet FortiOS
- CVE-2026-21743A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthentiFortinet FortiAuthenticator
- CVE-2025-15572wasm3 NewCodePage memory leakwasm3
- CVE-2026-1602SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-15571ckolivas lrzip stream.c ucompthread null pointer dereferenceckolivas lrzip
- CVE-2025-15570ckolivas lrzip stream.c lzma_decompress_buf use after freeckolivas lrzip
- CVE-2025-11537Keycloak-services: sensitive headers shown in the http access logsRed Hat build of Keycloak · org.keycloak:keycloak-quarkus-s…
- CVE-2024-52334A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07).Siemens syngo.plaza VB30E
- CVE-2025-14895PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletionroxnor Popup builder with Gamification, Multi-Step Popups,…
- CVE-2026-1922The Events Calendar Shortcode & Block <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesbrianhogg The Events Calendar Shortcode & Block
- CVE-2026-23901Apache Shiro: Brute force attack possible to determine valid user namesApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-1722WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creationwclovers WCFM Marketplace – Multivendor Marketplace for Woo…
- CVE-2026-2099Flowring｜AgentFlow - Stored Cross-Site ScriptingFlowring AgentFlow
- CVE-2026-2098Flowring｜AgentFlow - Reflected Cross-site ScriptingFlowring AgentFlow
- CVE-2025-12063An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissAxis Communications AB AXIS Camera Station Pro
- CVE-2025-12757An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to.Axis Communications AB AXIS Camera Station Pro
- CVE-2025-13064A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by Axis Communications AB AXIS Camera Station Pro
- CVE-2026-0996Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Moduletechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2026-24328Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)SAP_SE Business Server Pages Application
- CVE-2026-24327Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)SAP_SE SAP Strategic Enterprise Management
- CVE-2026-24326Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)SAP_SE SAP S/4HANA Defense & Security
- CVE-2026-24325Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)SAP_SE SAP BusinessObjects Enterprise
- CVE-2026-24324Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)SAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2026-24323Multiple vulnerabilities in BSP Applications of SAP Document Management SystemSAP_SE SAP Document Management System
- CVE-2026-24321Information Disclosure vulnerability in SAP Commerce CloudSAP_SE SAP Commerce Cloud
- CVE-2026-24320Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)SAP_SE SAP NetWeaver and ABAP Platform
- CVE-2026-24319Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files)SAP_SE SAP Business One
- CVE-2026-24312Missing authorization check in SAP Business WorkflowSAP_SE SAP Business Workflow
- CVE-2026-23688Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)SAP_SE SAP Fiori App
- CVE-2026-23686CRLF Injection vulnerability in SAP NetWeaver Application Server JavaSAP_SE SAP NetWeaver Application Server Java
- CVE-2026-23685Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)SAP_SE SAP NetWeaver
- CVE-2026-23684Race condition vulnerability in SAP Commerce CloudSAP_SE SAP Commerce Cloud
- CVE-2026-23681Missing Authorization check in a function module in SAP Support Tools Plug-InSAP_SE SAP Support Tools Plug-In
- CVE-2026-0505Multiple vulnerabilities in BSP Applications of SAP Document Management SystemSAP_SE SAP Document Management System
- CVE-2026-0486Missing Authorization Check in ABAP based SAP systemsSAP_SE ABAP based SAP systems
- CVE-2026-0484Missing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANASAP_SE SAP NetWeaver Application Server ABAP and SAP S/4HANA
- CVE-2026-2259aardappel lobster Parsing parser.h ParseStatements memory corruptionaardappel lobster
- CVE-2026-2258aardappel lobster wfc.h WaveFunctionCollapse memory corruptionaardappel lobster
- CVE-2024-54192An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial of service via a crafted file to the tcpedit_dlt_getplugin function at
- CVE-2025-70347An issue in mquickjs before commit 74b7e (2026-01-15) allows a local attacker to cause a denial of service via a crafted file to the get_mbl