CVEs published February 27, 2026
184 CVEs were published on February 27, 2026: 24 critical, 77 high.
- Published
- 184
- Critical
- 24
- High
- 77
- Medium
- 75
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 76
Most affected products
- Copeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- 23
- Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- 8
- Doditsolutions Homey BNB
- 6
- Johnson Controls Frick Controls Quantum HD
- 6
- vim
- 6
- statamic cms · statamic/cms
- 5
- Tenda F453
- 5
- EV Energy ev.energy
- 4
- gradio-app gradio · gradio
- 4
- libvips
- 4
Critical 24
- CVE-2026-28517openDCIM <= 23.04 OS Command Injection via dot Configuration ParameteropenDCIM
- CVE-2026-28516openDCIM <= 23.04 SQL Injection in Config::UpdateParameteropenDCIM
- CVE-2026-28515openDCIM <= 23.04 Missing Authorization in install.phpopenDCIM
- CVE-2026-28411WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`LabRedesCefetRJ WeGIA
- CVE-2026-28409WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionLabRedesCefetRJ WeGIA
- CVE-2026-28408WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.phpLabRedesCefetRJ WeGIA
- CVE-2026-28268Vikunja Vulnerable to Account Takeover via Password Reset Token Reusego-vikunja vikunja · code.vikunja.io/api
- CVE-2026-27947Group-Office Vulnerable to Remote Code Execution (RCE)Intermesh groupoffice
- CVE-2026-27755SODOLA SL902-SWTGW124AS <= 200.1.20 Predictable Session IDShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-27751SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default CredentialsShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-2749Path traversal in Centreon Open TicketsCentreon Open Tickets on Central Server
- CVE-2026-2750Command Injection via CLAPI generatetrapsCentreon Open Tickets on Central Server
- CVE-2025-15498SQL Injection in Pro3W CMSPro3W CMS
- CVE-2025-11252SQLi in Signum Technologies' windesk.fmSignum Technology Promotion and Training windesk.fm
- CVE-2025-11251SQLi in Dayneks Software's E-Commerce PlatformDayneks Software Industry and Trade E-Commerce Platform
- CVE-2026-2251Path Traversal leading to Remote Code Execution (RCE)Xerox FreeFlow Core
- CVE-2025-12981Listee <= 1.1.6 - Unauthenticated Privilege Escalationdreamstechnologies Listee
- CVE-2026-3301Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injectionTotolink N300RH
- CVE-2026-28370In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger codOpenStack Vitrage · vitrage
- CVE-2026-28363In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compresOpenClaw
- CVE-2026-24663Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-21718Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic AlgorithmCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-27028Mobility46 mobility46.se Missing Authentication for Critical Functionmobility46.se
- CVE-2026-27772EV Energy ev.energy Missing Authentication for Critical FunctionEV Energy ev.energy
High 77
- CVE-2026-28426Statamic vulnerable to privilege escalation via stored cross-site scriptingstatamic cms · statamic/cms
- CVE-2026-28425Statamic vulnerable to remote code execution via Antlers-enabled control panel inputsstatamic cms · statamic/cms
- CVE-2026-28416Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processinggradio-app gradio · gradio
- CVE-2026-28414Gradio has Absolute Path Traversal on Windows with Python 3.13+gradio-app gradio · gradio
- CVE-2026-27939Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypassstatamic cms · statamic/cms
- CVE-2026-28406kaniko has tar archive path traversal in build context extraction allows writing files outside destination directorychainguard-forks kaniko · github.com/chainguard-dev/kaniko
- CVE-2026-28402nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verificationnimiq core-rs-albatross
- CVE-2026-28400Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpointdocker model-runner
- CVE-2026-28272Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerabilitykiteworks security-advisories
- CVE-2026-27836phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpointthorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2026-27832Group-Office Has Authenticated SQL Injection in advancedQueryData.comparatorIntermesh groupoffice
- CVE-2026-27707Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpointseerr-team seerr
- CVE-2026-2880@fastify/middie has an improper path normalization vulnerability@fastify/middie
- CVE-2026-27757SODOLA SL902-SWTGW124AS <= 200.1.20 Unverified Password ChangeShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-27752SODOLA SL902-SWTGW124AS <= 200.1.20 Cleartext Credential TransmissionShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2019-25497osCommerce 2.3.4.1 SQL Injection via currency ParameterosCommerce
- CVE-2019-25496osCommerce 2.3.4.1 SQL Injection via products_id ParameterosCommerce
- CVE-2019-25495osCommerce 2.3.4.1 SQL Injection via reviews_id ParameterosCommerce
- CVE-2019-25494Homey BNB V4 SQL Injection Authentication Bypass via Admin PanelDoditsolutions Homey BNB
- CVE-2019-25493Homey BNB V4 SQL Injection via getrecord.phpDoditsolutions Homey BNB
- CVE-2019-25492Homey BNB V4 SQL Injection via getcmsdata.phpDoditsolutions Homey BNB
- CVE-2019-25491Homey BNB V4 SQL Injection via cms_getpagetitle.phpDoditsolutions Homey BNB
- CVE-2019-25490Homey BNB V4 SQL Injection via admin edit.phpDoditsolutions Homey BNB
- CVE-2019-25489Homey BNB V4 SQL Injection via ajax_refresh_subtotalDoditsolutions Homey BNB
- CVE-2026-25147OpenEMR's Portal Payment Endpoint Trusts User-Controlled pidopenemr
- CVE-2026-2293NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypassnest.js · @nestjs/platform-fastify
- CVE-2026-3304Multer vulnerable to Denial of Service via incomplete cleanupexpressjs multer · multer
- CVE-2026-2359Multer vulnerable to Denial of Service via resource exhaustionexpressjs multer · multer
- CVE-2026-2751Blind SQL InjectionCentreon Web on Central Server
- CVE-2025-10990Rexml: rexml: denial of service via inefficient regex parsingRed Hat Satellite · rexml
- CVE-2026-3223Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web DesignerGoogle Web Designer
- CVE-2026-21659Johnson Controls -Frick Quantum HD-Unauthenticated Remote Code Execution and Information Disclosure due to Local File InclusionJohnson Controls Frick Controls Quantum HD
- CVE-2026-21658Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionJohnson Controls Frick Controls Quantum HD
- CVE-2026-21657Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionJohnson Controls Frick Controls Quantum HD
- CVE-2026-21656Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionJohnson Controls Frick Controls Quantum HD
- CVE-2026-21654Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code ExecutionJohnson Controls Frick Controls Quantum HD
- CVE-2026-2252XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)Xerox FreeFlow Core
- CVE-2026-27776IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue.NTT DATA INTRAMART intra-mart Accel Platform
- CVE-2026-0980Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc usernameRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3
- CVE-2025-15509The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.vivo SmartRemote
- CVE-2026-28372telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added GNU inetutils
- CVE-2026-1442Unitree UPK files Hard-Coded KeyUnitree UPK
- CVE-2026-28364In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution OCaml
- CVE-2026-2428Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modificationtechjewel Fluent Forms Pro Add On Pack
- CVE-2026-24497Stack-based Buffer Overflow vulnerability in SimTech Systems, Inc.SimTech Systems ThinkWise
- CVE-2026-3275Tenda F453 httpd addressNat fromAddressNat buffer overflowTenda F453
- CVE-2026-3037Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-3274Tenda F453 httpd L7Prot frmL7ProtForm buffer overflowTenda F453
- CVE-2026-25037Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25196Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-20764Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25721Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-23702Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-24452Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25105Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-24695Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-20902Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25109Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-24689Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-20910Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25195Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-24517Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-20742Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25111Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-21389Copeland XWEB and XWEB Pro OS Command InjectionCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-25085Copeland XWEB and XWEB Pro Unexpected Status Code or Return ValueCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-3273Tenda F453 httpd AdvSetWrlsafeset formWrlsafeset buffer overflowTenda F453
- CVE-2026-27647Mobility46 mobility46.se Insufficient Session Expirationmobility46.se
- CVE-2026-26305Mobility46 mobility46.se Improper Restriction of Excessive Authentication Attemptsmobility46.se
- CVE-2026-26290EV Energy ev.energy Insufficient Session ExpirationEV Energy ev.energy
- CVE-2026-24445EV Energy ev.energy Improper Restriction of Excessive Authentication AttemptsEV Energy ev.energy
- CVE-2026-25778SWITCH EV swtchenergy.com Insufficient Session ExpirationSWITCH EV swtchenergy.com
- CVE-2026-3272Tenda F453 httpd DhcpListClient fromDhcpListClient buffer overflowTenda F453
- CVE-2026-3271Tenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflowTenda F453
- CVE-2025-69437PublicCMS v5.202506.d and earlier is vulnerable to stored XSS.
- CVE-2026-26861CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage.clevertap-web-sdk
- CVE-2026-26862CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builclevertap-web-sdk
Medium, low and unrated 83
- CVE-2026-27759Featured Image from Content < 1.7 Authenticated SSRF via save_postDhrumil Kumbhani Featured Image from Content
- CVE-2026-28424Statamic's missing authorization allows access to email addressesstatamic cms · statamic/cms
- CVE-2026-28423Statamic Vulnerable to Server-Side Request Forgery via Glidestatamic cms · statamic/cms
- CVE-2026-28422Vim has stack-buffer-overflow in build_stl_str_hl()vim
- CVE-2026-28421Vim has a heap-buffer-overflow and a segmentation faultvim
- CVE-2026-28420Vim has Heap-based Buffer Overflow and OOB Read in :terminalvim
- CVE-2026-28419Vim has Heap-based Buffer Underflow in Emacs tags parsingvim
- CVE-2026-28418Vim has Heap-based Buffer Overflow in Emacs tags parsingvim
- CVE-2026-28417Vim has OS Command Injection in netrwvim
- CVE-2026-28415Gradio has Open Redirect in OAuth Flowgradio-app gradio · gradio
- CVE-2026-27167Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secretgradio-app gradio · gradio
- CVE-2026-28407malcontent's nested archive extraction failure can drop content from scan inputschainguard-dev malcontent · github.com/chainguard-dev/malco…
- CVE-2026-28355"PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scriptingthinkst canarytokens
- CVE-2026-28352Indico missing access check in event series management APIindico
- CVE-2026-28351Manipulated RunLengthDecode streams can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2026-28338PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messagespmd · net.sourceforge.pmd:pmd-core
- CVE-2026-28288Dify has a user enumeration issuelanggenius dify
- CVE-2026-28271Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)kiteworks security-advisories
- CVE-2026-28270Kiteworks Core has an Unrestricted Upload of File with Dangerous Typekiteworks security-advisories
- CVE-2018-25160HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backendTOKUHIROM HTTP::Session2
- CVE-2026-28231pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Readbigcat88 pillow_heif · pi-heif +1
- CVE-2026-3255HTTP::Session2 versions before 1.12 for Perl may generate weak session ids using the rand() functionTOKUHIROM HTTP::Session2
- CVE-2026-27824calibre has IP Ban Bypass via X-Forwarded-For Header Spoofingkovidgoyal calibre
- CVE-2026-27810calibre Vulnerable to HTTP Response Header Injectionkovidgoyal calibre
- CVE-2026-27734Beszel Vulnerable to Docker API Path Traversal via Unsanitized Container IDhenrygd beszel · github.com/henrygd/beszel
- CVE-2026-27793Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentialsseerr-team seerr
- CVE-2026-27792Seerr missing authentication on pushSubscription endpointsseerr-team seerr
- CVE-2026-28354ClipBucket v5 has IDOR in Collection Item ManagementMacWarrior clipbucket-v5
- CVE-2026-26997ClipBucket v5 has Stored XSS via Collection nameMacWarrior clipbucket-v5
- CVE-2026-22717VMware Workstation out-of-bound read vulnerabilityVMware Workstation
- CVE-2026-22716VMware Workstation out-of-bounds write vulnerabilityVMware Workstation
- CVE-2026-27758SODOLA SL902-SWTGW124AS <= 200.1.20 Missing CSRF ProtectionsShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-27756SODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management InterfaceShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-27754SODOLA SL902-SWTGW124AS <= 200.1.20 MD5 Session Token GenerationShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-27753SODOLA SL902-SWTGW124AS <= 200.1.20 Improper Login Rate LimitingShenzhen Hongyavision Technology Co., Ltd. (Sodola Networks…
- CVE-2026-21619Unsafe Deserialization of Erlang Terms in hex_corehexpm hex_core · hexpm hex +1
- CVE-2026-24488OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpointopenemr
- CVE-2026-3277The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext iDevolutions PowerShell Universal
- CVE-2026-3327Authenticated DatoCMS Web Previews Plugin Iframe InjectionDatoCMS Web Previews
- CVE-2025-11950Reflected XSS in Knowhy's EduAsistKNOWHY Advanced Technology Trading Ltd. EduAsist
- CVE-2026-24352Session Fixation in PluXml CMSPluXml CMS
- CVE-2026-24351Stored XSS in PluXml CMSPluXml CMS
- CVE-2026-24350Stored XSS in PluXml CMSPluXml CMS
- CVE-2026-2831MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameterpierrelannoy MailArchiver
- CVE-2026-1434Reflected XSS in Omega-PSIRPolitechnika Warszawska Omega-PSIR
- CVE-2026-1305Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulationshoheitanaka Japanized for WooCommerce
- CVE-2025-14142Electric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attributeelectriccode Electric Enquiries
- CVE-2024-10938OVRI Payment 1.7.0 - Malicious .htaccess directivemoneytigo OVRI Payment
- CVE-2026-21660Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in FirmwareJohnson Controls Frick Controls Quantum HD
- CVE-2026-1627An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of tSICK AG SICK LMS1000 · SICK AG SICK MRS1000
- CVE-2026-1626An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of thSICK AG SICK LMS1000 · SICK AG SICK MRS1000
- CVE-2026-2362WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attributejoedolson WP Accessibility
- CVE-2026-2383Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fieldmra13 Simple Download Monitor
- CVE-2025-12150Org.keycloak/keycloak-services: webauthn attestation statement verification bypasskeycloak · Red Hat build of Keycloak +1
- CVE-2026-0871Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administratorsRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2025-13327Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentialsastral-sh uv · Red Hat OpenShift AI +2
- CVE-2025-9909Aap-gateway: improper path validation in gateway allows credential exfiltrationRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1
- CVE-2025-9908Event-driven-ansible: sensitive internal headers disclosure in aap eda event streamsRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1
- CVE-2025-9907Event-driven-ansible: event stream test mode exposes sensitive headers in aap edaRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1
- CVE-2025-9572Foreman: satellite: graphql api permission bypass leads to information disclosureThe Foreman Foreman · Red Hat Satellite 6.15 for RHEL +3
- CVE-2025-15567Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.vivo Health
- CVE-2025-14149Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box linkXpro Addons — 140+ Widgets for Elementor
- CVE-2025-14040Automotive Car Dealership Business WordPress Theme <= 13.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action Fieldsthemesuite Automotive Car Dealership Business WordPress The…
- CVE-2026-3302SourceCodester Doctor Appointment System Sign Up register.php cross site scriptingSourceCodester Doctor Appointment System
- CVE-2026-27653The installers for multiple products provided by Soliton Systems K.K.Soliton Systems K.K. Soliton SecureBrowser for OneGate ·… +1
- CVE-2026-3293snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redossnowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc
- CVE-2026-3292jizhiCMS Batch Model.php findAll sql injectionjizhiCMS
- CVE-2026-1558WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameterbrechtvds WP Recipe Maker
- CVE-2026-3289Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversalSanluan PublicCMS
- CVE-2026-3287youlaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injectionyoulaitech youlai-mall
- CVE-2026-3286itwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgeryitwanger paicoding
- CVE-2026-3285berry-lang berry be_lexer.c scan_string out-of-boundsberry-lang berry
- CVE-2026-3284libvips extract.c vips_extract_area_build integer overflowlibvips
- CVE-2026-3283libvips extract.c vips_extract_band_build out-of-boundslibvips
- CVE-2026-3282libvips unpremultiply.c vips_unpremultiply_build out-of-boundslibvips
- CVE-2026-3281libvips bandrank.c vips_bandrank_build heap-based overflowlibvips
- CVE-2026-24498Exposure of Sensitive Information to an Unauthorized Actor vulnerability in EFM-Networks, Inc.EFM-Networks ipTIME T5008 · EFM-Networks ipTIME AX2004M +2
- CVE-2026-20797Copeland XWEB and XWEB Pro Stack-based Buffer OverflowCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-22877Copeland XWEB and XWEB Pro Path TraversalCopeland XWEB 300D PRO · Copeland XWEB 500D PRO +1
- CVE-2026-22878Mobility46 mobility46.se Insufficiently Protected Credentialsmobility46.se
- CVE-2021-4456Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impactMRSAM Net::CIDR
- CVE-2026-25774EV Energy ev.energy Insufficiently Protected CredentialsEV Energy ev.energy
- CVE-2026-27773SWITCH EV swtchenergy.com Insufficiently Protected CredentialsSWITCH EV swtchenergy.com