CVEs published March 25, 2026
619 CVEs were published on March 25, 2026: 55 critical, 247 high.
- Published
- 619
- Critical
- 55
- High
- 247
- Medium
- 211
- Low
- 8
- Unrated
- 98
- Now in CISA KEV
- 0
- Fix available
- 382
Most affected products
- Linux
- 116
- Apple macOS
- 43
- openemr
- 20
- IBM InfoSphere Information Server
- 14
- Apple iOS and iPadOS · Apple macOS +3
- 12
- GitLab
- 11
- n8n-io n8n · n8n
- 11
- Cisco IOS XE Software
- 10
- nats-io nats-server · github.com/nats-io/nats-server +1
- 7
- Apple iOS and iPadOS
- 6
Critical 55
- CVE-2026-33696n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCEn8n-io n8n · n8n
- CVE-2026-33660n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Moden8n-io n8n · n8n
- CVE-2026-32573WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerabilityNelio Software Nelio AB Testing
- CVE-2026-32539WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerabilityPublishPress Revisions
- CVE-2026-32536WordPress Green Downloads plugin <= 2.08 - Arbitrary File Upload vulnerabilityhalfdata Green Downloads
- CVE-2026-32525WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerabilityjetmonsters JetFormBuilder
- CVE-2026-32524WordPress Photo Engine plugin <= 6.4.9 - Arbitrary File Upload vulnerabilityJordy Meow Photo Engine
- CVE-2026-32523WordPress WPJAM Basic plugin <= 6.9.2 - Arbitrary File Upload vulnerabilitydenishua WPJAM Basic
- CVE-2026-32520WordPress RewardsWP plugin <= 1.0.4 - Privilege Escalation vulnerabilityAndrew Munro / AffiliateWP RewardsWP
- CVE-2026-32519WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerabilityBit Apps Bit SMTP
- CVE-2026-32512WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerabilityEdge-Themes Pelicula
- CVE-2026-32502WordPress Borgholm theme < 1.6 - PHP Object Injection vulnerabilitySelect-Themes Borgholm
- CVE-2026-32499WordPress ChatBot plugin <= 7.7.9 - SQL Injection vulnerabilityQuantumCloud ChatBot
- CVE-2026-32482WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerabilitydeothemes Ona
- CVE-2026-31920WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerabilityDevteam HaywoodTech Product Rearrange for WooCommerce
- CVE-2026-27095WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerabilitymagepeopleteam Bus Ticket Booking with Seat Reservation
- CVE-2026-27084WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerabilityThemeREX Buisson
- CVE-2026-27083WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerabilityThemeREX Work & Travel Company
- CVE-2026-27082WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerabilityThemeREX Love Story
- CVE-2026-27071WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerabilityArraytics WPCafe
- CVE-2026-27051WordPress Golo theme <= 1.7.0 - Privilege Escalation vulnerabilityuxper Golo
- CVE-2026-27049WordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerabilityNooTheme Jobica Core
- CVE-2026-27044WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerabilityTotalSuite Total Poll Lite
- CVE-2026-25447WordPress Widget Wrangler plugin <= 2.3.9 - Remote Code Execution (RCE) vulnerabilityJonathan Daggerhart Widget Wrangler
- CVE-2026-25429WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerabilitywpdive Nexa Blocks
- CVE-2026-25413WordPress WPBookit Pro plugin <= 1.6.18 - Arbitrary File Upload vulnerabilityiqonicdesign WPBookit Pro
- CVE-2026-25377WordPress Addon Jobsearch Chat plugin <= 3.0 - SQL Injection vulnerabilityeyecix Addon Jobsearch Chat
- CVE-2026-25371WordPress Lumise Product Designer plugin < 2.0.9 - SQL Injection vulnerabilityKing-Theme Lumise Product Designer
- CVE-2026-25366WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerabilityThemeisle Woody ad snippets
- CVE-2026-25345WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerabilityGalleryCreator SimpLy Gallery
- CVE-2026-25340WordPress Jobmonster theme < 4.8.4 - SQL Injection vulnerabilityNooTheme Jobmonster
- CVE-2026-25035WordPress Contest Gallery plugin <= 28.1.2.2 - Account Takeover vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2026-25032WordPress Ricky theme < 2.31 - PHP Object Injection vulnerabilitypark_of_ideas Ricky
- CVE-2026-25031WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerabilitypark_of_ideas Tasty Daily
- CVE-2026-25030WordPress Goldish theme < 3.47 - PHP Object Injection vulnerabilitypark_of_ideas Goldish
- CVE-2026-25029WordPress KIDZ theme <= 5.24 - PHP Object Injection vulnerabilitypark_of_ideas KIDZ
- CVE-2026-24993WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerabilityWPFactory Advanced WooCommerce Product Sales Reporting
- CVE-2026-24989WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerabilityFantasticPlugins SUMO Affiliates Pro
- CVE-2026-24971WordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerabilityElated-Themes Search & Go
- CVE-2026-24968WordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerabilityXagio SEO
- CVE-2026-24378WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerabilityMetagauss EventPrime
- CVE-2026-22507WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerabilityAncoraThemes Beelove
- CVE-2026-22500WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerabilityaxiomthemes m2 | Construction and Tools Store
- CVE-2026-22484WordPress Lisfinity Core plugin <= 1.5.0 - SQL Injection vulnerabilitypebas Lisfinity Core
- CVE-2026-28858A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS
- CVE-2026-28827A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2026-20688A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-32991In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
- CVE-2025-59706In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.
- CVE-2025-59707In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vul
- CVE-2025-70888An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c compon
- CVE-2026-26830pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter.pdf-image
- CVE-2026-26831textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.textract
- CVE-2026-26832node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR.node-tesseract-ocr
- CVE-2026-26833thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user ithumbler
High 247
- CVE-2026-34056OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Dataopenemr
- CVE-2026-34055OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modificationopenemr
- CVE-2026-34053OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handleropenemr
- CVE-2026-33932OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributesopenemr
- CVE-2026-33918OpenEMR Missing Authorization on Claim File Download Endpointopenemr
- CVE-2026-33917OpenEMR has SQL Injection in CAMOS Formopenemr
- CVE-2026-4758WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Fieldwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2026-33914OpenEMR has SQL Injection in PostCalendar Category Deleteopenemr
- CVE-2026-33913OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Filesopenemr
- CVE-2026-33910OpenEMR has a SQL Injection Vulnerability in patient selectionopenemr
- CVE-2026-33348OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3openemr
- CVE-2026-29187OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.phpopenemr
- CVE-2026-4824Enter Software Iperius Backup Backup Job Configuration File privileges managementEnter Software Iperius Backup
- CVE-2026-30976Sonarr Path Traversal vulnerabilitySonarr
- CVE-2026-30975Sonarr Authentication Bypass vulnerabilitySonarr
- CVE-2026-4822Enter Software Iperius Backup Backup Service temp fileEnter Software Iperius Backup
- CVE-2025-36258IBM InfoSphere Information Server is vulnerable due to plaintext storage of a passwordIBM InfoSphere Information Server
- CVE-2026-33247NATS credentials are exposed in monitoring port via command-line argvnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-33218NATS has pre-auth server panic via leafnode handlingnats-io nats-server · github.com/nats-io/nats-server/v2 +1
- CVE-2026-33217NATS allows MQTT clients to bypass ACL checksnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-33216NATS has MQTT plaintext password disclosurenats-io nats-server · github.com/nats-io/nats-server/v2 +1
- CVE-2026-29785NATS Server panic via malicious compression on leafnode portnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-27889NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadnats-io nats-server · github.com/nats-io/nats-server/v2 +1
- CVE-2026-27602Modoboa has an OS Command Injectionmodoboa
- CVE-2026-33722n8n Has External Secrets Authorization Bypass in Credential Savingn8n-io n8n · n8n
- CVE-2026-33713n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expressionn8n-io n8n · n8n
- CVE-2026-33665n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeovern8n-io n8n · n8n
- CVE-2026-33663n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Editionn8n-io n8n · n8n
- CVE-2026-27496n8n has In-Process Memory Disclosure in its Task Runnern8n-io n8n · n8n
- CVE-2026-2995Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabGitLab
- CVE-2026-3857Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2026-3988Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2026-32546WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerabilityStellarWP Restrict Content
- CVE-2026-32545WordPress Taboola Pixel plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityTaboola Pixel
- CVE-2026-32544WordPress OOPSpam Anti-Spam plugin <= 1.2.62 - Cross Site Scripting (XSS) vulnerabilityOOPSpam Team OOPSpam Anti-Spam
- CVE-2026-32542WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeFusion Fusion Builder
- CVE-2026-32540WordPress Bookly plugin <= 26.7 - Reflected Cross Site Scripting (XSS) vulnerabilityBookly
- CVE-2026-32538WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerabilityNoor Alam SMTP Mailer
- CVE-2026-32537WordPress Visual Portfolio, Photo Gallery & Post Grid plugin <= 3.5.1 - Local File Inclusion vulnerabilitynK Visual Portfolio, Photo Gallery & Post Grid
- CVE-2026-32534WordPress JS Help Desk plugin <= 3.0.3 - SQL Injection vulnerabilityJoomSky JS Help Desk
- CVE-2026-32532WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityThemeHunk Contact Form & Lead Form Elementor Builder
- CVE-2026-32531WordPress Kunco theme < 1.4.5 - Local File Inclusion vulnerabilitygavias Kunco
- CVE-2026-32530WordPress Creator LMS plugin <= 1.1.18 - Privilege Escalation vulnerabilityWPFunnels Creator LMS
- CVE-2026-32529WordPress Molla theme < 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerabilitydon-themes Molla
- CVE-2026-32528WordPress Riode | Multi-Purpose WooCommerce theme < 1.6.29 - Reflected Cross Site Scripting (XSS) vulnerabilitydon-themes Riode
- CVE-2026-32526WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilityVillaTheme Abandoned Cart Recovery for WooCommerce
- CVE-2026-32522WordPress WooCommerce Support Ticket System plugin < 18.5 - Arbitrary File Deletion vulnerabilityvanquish WooCommerce Support Ticket System
- CVE-2026-32518WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityimithemes Gaea
- CVE-2026-32517WordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityKleor Contact Manager
- CVE-2026-32516WordPress Miraculous Core Plugin plugin < 2.1.2 - SQL Injection vulnerabilitykamleshyadav Miraculous Core Plugin
- CVE-2026-32515WordPress Miraculous theme < 2.1.2 - Broken Access Control vulnerabilitykamleshyadav Miraculous
- CVE-2026-32513WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerabilityMiguel Useche JS Archive List
- CVE-2026-32505WordPress Kiddy theme <= 2.0.8 - Local File Inclusion vulnerabilityCreativeWS Kiddy
- CVE-2026-32504WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerabilityCreativeWS VintWood
- CVE-2026-32503WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerabilityCreativeWS Trendustry
- CVE-2026-32501WordPress WP Configurator Pro plugin <= 3.7.9 - Broken Access Control vulnerabilitywp-configurator WP Configurator Pro
- CVE-2026-32500WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerabilityCreativeWS MetaMax
- CVE-2026-32498WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
- CVE-2026-32495WordPress WP Terms Popup plugin <= 2.10.0 - Broken Access Control vulnerabilityLink Software WP Terms Popup
- CVE-2026-32494WordPress Image Slider by Ays plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilityAys Pro Image Slider by Ays
- CVE-2026-32493WordPress JobSearch plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityeyecix JobSearch
- CVE-2026-32488WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerabilitywpeverest User Registration
- CVE-2026-32485WordPress WP User Frontend plugin <= 4.2.8 - Broken Access Control vulnerabilityweDevs WP User Frontend
- CVE-2026-32484WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerabilityBoldGrid weForms
- CVE-2026-32441WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerabilityWebToffee Comments Import & Export
- CVE-2026-31921WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerabilityDevteam HaywoodTech Product Rearrange for WooCommerce
- CVE-2026-31913WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerabilityWhitebox-Studio Scape
- CVE-2026-27088WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityG5Theme Darna Framework
- CVE-2026-27087WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityG5Theme Wolverine Framework
- CVE-2026-27081WordPress Rosebud theme <= 1.4 - Local File Inclusion vulnerabilityMikado-Themes Rosebud
- CVE-2026-27080WordPress Deston theme <= 1.0 - Local File Inclusion vulnerabilityMikado-Themes Deston
- CVE-2026-27079WordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerabilityMikado-Themes Amfissa
- CVE-2026-27078WordPress Emaurri theme <= 1.0.1 - Local File Inclusion vulnerabilityMikado-Themes Emaurri
- CVE-2026-27077WordPress MultiOffice theme <= 1.2 - Local File Inclusion vulnerabilityMikado-Themes MultiOffice
- CVE-2026-27076WordPress LuxeDrive theme <= 1.0 - Local File Inclusion vulnerabilityMikado-Themes LuxeDrive
- CVE-2026-27075WordPress Belfort theme <= 1.0 - Local File Inclusion vulnerabilityMikado-Themes Belfort
- CVE-2026-27073WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerabilityAddi – Cuotas que se adaptan a ti
- CVE-2026-27054WordPress Penci Soledad Data Migrator plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityPenciDesign Penci Soledad Data Migrator
- CVE-2026-27048WordPress The Aisle Core plugin <= 2.0.5 - Local File Inclusion vulnerabilityElated-Themes The Aisle Core
- CVE-2026-27047WordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerabilityMikado-Themes Curly Core
- CVE-2026-27045WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerabilitysbthemes WooCommerce Infinite Scroll
- CVE-2026-27040WordPress WZone plugin <= 14.0.31 - Arbitrary File Deletion vulnerabilityAA-Team WZone
- CVE-2026-27039WordPress WZone plugin <= 14.0.31 - SQL Injection vulnerabilityAA-Team WZone
- CVE-2026-25464WordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerabilityTieLabs Jannah
- CVE-2026-25461WordPress Listeo Core plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilitypurethemes Listeo Core
- CVE-2026-25458WordPress Moments theme <= 2.2 - Local File Inclusion vulnerabilitySelect-Themes Moments
- CVE-2026-25457WordPress Mixtape theme <= 2.1 - Local File Inclusion vulnerabilitySelect-Themes Mixtape
- CVE-2026-25456WordPress Automated FedEx live/manual rates with shipping labels plugin <= 5.1.9 - Broken Access Control vulnerabilityAarsiv Groups Automated FedEx live/manual rates with shippi…
- CVE-2026-25452WordPress Remoji plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityWPDO Remoji
- CVE-2026-25435WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Cross Site Scripting (XSS) vulnerabilitywpdevart Booking calendar, Appointment Booking System
- CVE-2026-25414WordPress WPBookit Pro plugin <= 1.6.18 - Privilege Escalation vulnerabilityiqonicdesign WPBookit Pro
- CVE-2026-25406WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerabilityThemeum Tutor LMS Pro
- CVE-2026-25401WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerabilityArni Cinco WPCargo Track & Trace
- CVE-2026-25400WordPress Apicona theme <= 24.1.0 - PHP Object Injection vulnerabilitythememount Apicona
- CVE-2026-25397WordPress File Uploader for WooCommerce plugin <= 1.0.4 - Path Traversal vulnerabilitySnowray Software File Uploader for WooCommerce
- CVE-2026-25396WordPress Commerce Coinbase For WooCommerce plugin <= 1.6.6 - Broken Access Control vulnerabilityCoderPress Commerce Coinbase For WooCommerce
- CVE-2026-25383WordPress KiviCare plugin <= 3.6.16 - Reflected Cross Site Scripting (XSS) vulnerabilityIqonic Design KiviCare
- CVE-2026-25382WordPress IdealAuto theme < 3.8.6 - Local File Inclusion vulnerabilityjwsthemes IdealAuto
- CVE-2026-25381WordPress LoveDate theme < 3.8.6 - Local File Inclusion vulnerabilityjwsthemes LoveDate
- CVE-2026-25380WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerabilityjwsthemes Feedy
- CVE-2026-25379WordPress StreamVid theme < 6.8.6 - Local File Inclusion vulnerabilityjwsthemes StreamVid
- CVE-2026-25376WordPress Addon Jobsearch Chat plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityeyecix Addon Jobsearch Chat
- CVE-2026-25373WordPress Vayvo - Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityProgressionStudios Vayvo
- CVE-2026-25361WordPress WpEvently plugin <= 5.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilitymagepeopleteam WpEvently
- CVE-2026-25360WordPress Vex theme < 1.2.9 - PHP Object Injection vulnerabilityrascals Vex
- CVE-2026-25359WordPress Pendulum theme < 3.1.5 - PHP Object Injection vulnerabilityrascals Pendulum
- CVE-2026-25358WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerabilityrascals Meloo
- CVE-2026-25357WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerabilityazzaroco Ultimate Membership Pro
- CVE-2026-25356WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup Yobazar
- CVE-2026-25354WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup Reebox
- CVE-2026-25353WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup Nooni
- CVE-2026-25352WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup MyDecor
- CVE-2026-25351WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup MyMedi
- CVE-2026-25350WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup Miti
- CVE-2026-25349WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup Loobek
- CVE-2026-25347WordPress WP REST Cache plugin <= 2026.1.0 - Cross Site Scripting (XSS) vulnerabilityAcato WP REST Cache
- CVE-2026-25346WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerabilityAys Pro FAQ Builder AYS
- CVE-2026-25342WordPress Boutique theme < 2.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes Boutique
- CVE-2026-25341WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerabilityRSJoomla! RSFirewall!
- CVE-2026-25334WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerabilitywordpresschef Salon Booking System Pro
- CVE-2026-25317WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerabilitytychesoftwares Print Invoice & Delivery Notes for WooCommer…
- CVE-2026-25309WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerabilityPublishPress Authors
- CVE-2026-25306WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability8theme XStore Core
- CVE-2026-25304WordPress Jaroti theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityskygroup Jaroti
- CVE-2026-25033WordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityuixthemes Motta Addons
- CVE-2026-25026WordPress Team plugin <= 5.0.11 - Broken Access Control vulnerabilityRadiusTheme Team
- CVE-2026-25025WordPress VikRestaurants plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRestaurants
- CVE-2026-25018WordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitystmcan NaturaLife Extensions
- CVE-2026-25017WordPress NaturaLife Extensions plugin <= 2.1 - Local File Inclusion vulnerabilitystmcan NaturaLife Extensions
- CVE-2026-25013WordPress Phox Hosting plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityWHMCSdes Phox Hosting
- CVE-2026-25007WordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2026-25002WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerabilityThimPress LearnPress – Sepay Payment
- CVE-2026-25001WordPress Post Snippets plugin <= 4.0.12 - Remote Code Execution (RCE) vulnerabilitySaad Iqbal Post Snippets
- CVE-2026-24983WordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerabilityUpSolution Core
- CVE-2026-24981WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerabilityNooTheme Visionary Core
- CVE-2026-24980WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Visionary Core
- CVE-2026-24979WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Jobica Core
- CVE-2026-24978WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerabilityNooTheme Jobica Core
- CVE-2026-24977WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerabilityNooTheme Organici Library
- CVE-2026-24976WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerabilityNooTheme Organici Library
- CVE-2026-24975WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Organici Library
- CVE-2026-24974WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerabilityNooTheme CitiLights
- CVE-2026-24973WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme CitiLights
- CVE-2026-24970WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerabilitydesigningmedia Energox
- CVE-2026-24969WordPress Instant VA theme <= 1.0.1 - Arbitrary File Deletion vulnerabilitydesigningmedia Instant VA
- CVE-2026-24391WordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeMakers Car Dealer
- CVE-2026-24382WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerabilitywproyal News Magazine X
- CVE-2026-24373WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerabilityMetagauss RegistrationMagic
- CVE-2026-24372WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerabilityWP Swings Subscriptions for WooCommerce
- CVE-2026-24369WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerabilityThemeOne The Grid
- CVE-2026-24363WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerabilityloopus WP Cost Estimation & Payment Forms Builder
- CVE-2026-24359WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerabilityDokan
- CVE-2026-23979WordPress Gyan Elements plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitySoftwebmedia Gyan Elements
- CVE-2026-23977WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerabilityWPFactory Helpdesk Support Ticket System for WooCommerce
- CVE-2026-23973WordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerabilityuxper Golo
- CVE-2026-23971WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerabilityxtemos WoodMart
- CVE-2026-23807WordPress WP Telegram Widget and Join Link plugin <= 2.2.13 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Socio WP Telegram Widget and Join Link
- CVE-2026-23806WordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerabilityBlueGlass Interactive AG Jobs for WordPress
- CVE-2026-22524WordPress Legacy Admin plugin <= 9.5 - Reflected Cross Site Scripting (XSS) vulnerabilitythemepassion Legacy Admin
- CVE-2026-22523WordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerabilitythemepassion Ultra WordPress Admin
- CVE-2026-22520WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityG5Theme Handmade Framework
- CVE-2026-22516WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerabilityAncoraThemes Wizor's
- CVE-2026-22515WordPress VegaDays theme <= 1.2.0 - Local File Inclusion vulnerabilityAncoraThemes VegaDays
- CVE-2026-22514WordPress Unica theme <= 1.4.1 - Local File Inclusion vulnerabilityAncoraThemes Unica
- CVE-2026-22513WordPress Triompher theme <= 1.1.0 - Local File Inclusion vulnerabilityAncoraThemes Triompher
- CVE-2026-22512WordPress Roisin theme <= 1.2.1 - Local File Inclusion vulnerabilityElated-Themes Roisin
- CVE-2026-22511WordPress NeoBeat theme <= 1.2 - Local File Inclusion vulnerabilityElated-Themes NeoBeat
- CVE-2026-22510WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerabilityAncoraThemes Melody
- CVE-2026-22509WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerabilityElated-Themes Gioia
- CVE-2026-22508WordPress Dentalux theme <= 3.3 - Local File Inclusion vulnerabilityAncoraThemes Dentalux
- CVE-2026-22506WordPress Amoli theme <= 1.0 - Local File Inclusion vulnerabilityElated-Themes Amoli
- CVE-2026-22505WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerabilityAncoraThemes Morning Records
- CVE-2026-22504WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerabilityThemeREX ProLingua
- CVE-2026-22503WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerabilityThemeREX Nelson
- CVE-2026-22502WordPress Mr. Cobbler theme <= 1.1.9 - Local File Inclusion vulnerabilityAncoraThemes Mr. Cobbler
- CVE-2026-22499WordPress Lella theme <= 1.2 - Local File Inclusion vulnerabilityElated-Themes Lella
- CVE-2026-22498WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerabilityElated-Themes Laurent
- CVE-2026-22496WordPress Hypnotherapy theme <= 1.2.10 - Local File Inclusion vulnerabilityAncoraThemes Hypnotherapy
- CVE-2026-22495WordPress Greenville theme <= 1.3.2 - Local File Inclusion vulnerabilityAncoraThemes Greenville
- CVE-2026-22494WordPress Good Homes theme <= 1.3.13 - Local File Inclusion vulnerabilityThemeREX Good Homes
- CVE-2026-22493WordPress Gaspard theme <= 1.3 - Local File Inclusion vulnerabilityElated-Themes Gaspard
- CVE-2026-22491WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerabilitywphocus My auctions allegro
- CVE-2026-22480WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerabilityWebToffee Product Feed for WooCommerce
- CVE-2026-22448WordPress PitchPrint plugin <= 11.1.2 - Arbitrary File Deletion vulnerabilityflexcubed PitchPrint
- CVE-2025-69358WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerabilityMetagauss EventPrime
- CVE-2025-69347WordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerabilityConvers Lab WPSubscription
- CVE-2025-69096WordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityG5Theme Zorka
- CVE-2026-20004A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memorCisco IOS XE Software
- CVE-2024-58341OpenCart Core 4.0.2.3 SQL Injection via search ParameterOpenCart Core
- CVE-2026-20125A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote aCisco IOS
- CVE-2026-20012A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall ACisco IOS · Cisco Secure Firewall Adaptive Security Appl… +1
- CVE-2026-20086A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless ControllerCisco IOS XE Software
- CVE-2026-20084A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packetsCisco IOS XE Software
- CVE-2026-24750Kiteworks Secure Data Forms vulnerable to Cross-site Scriptingkiteworks Secure Data Forms
- CVE-2026-23514Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Managementkiteworks core
- CVE-2026-4815SQL Injection vulnerability in Support BoardSchiocco Support Board
- CVE-2026-3104Memory leak in code preparing DNSSEC proofs of non-existenceISC BIND
- CVE-2026-1519Excessive NSEC3 iterations cause high CPU load during insecure delegation validationISC BIND
- CVE-2025-40842Ericsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation VulnerabilityEricsson Indoor Connect
- CVE-2026-28529cryptodev-linux <= 1.14 get_userbuf Use After Free LPEcryptodev-linux
- CVE-2025-27260Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements VulnerabilityEricsson Indoor Connect
- CVE-2026-4760Potential unauthorized access to files on the Web HMI server hostCODRA Panorama Suite
- CVE-2026-23395Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQLinux
- CVE-2026-23393bridge: cfm: Fix race condition in peer_mep deletionLinux
- CVE-2026-23392netfilter: nf_tables: release flowtable after rcu grace period on errorLinux
- CVE-2026-23391netfilter: xt_CT: drop pending enqueued packets on template removalLinux
- CVE-2026-23383bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearingLinux
- CVE-2026-23378net/sched: act_ife: Fix metalist update behaviorLinux
- CVE-2026-23372nfc: rawsock: cancel tx_work before socket teardownLinux
- CVE-2026-23364ksmbd: Compare MACs in constant timeLinux
- CVE-2026-23351netfilter: nft_set_pipapo: split gc into unlink and reclaim phaseLinux
- CVE-2026-23350drm/xe/queue: Call fini on exec queue creation failLinux
- CVE-2026-23340net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscsLinux
- CVE-2026-23336wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()Linux
- CVE-2026-23317drm/vmwgfx: Return the correct value in vmw_translate_ptr functionsLinux
- CVE-2026-23306scsi: pm8001: Fix use-after-free in pm8001_queue_command()Linux
- CVE-2026-23294bpf: Fix race in devmap on PREEMPT_RTLinux
- CVE-2026-23288accel/amdxdna: Fix out-of-bounds memset in command slot handlingLinux
- CVE-2026-23280accel/amdxdna: Prevent ubuf size overflowLinux
- CVE-2026-31788xen/privcmd: restrict usage in unprivileged domULinux
- CVE-2026-3608Stack overflow in Kea daemonsISC Kea
- CVE-2026-26306The installer for OM Workspace (Windows Edition) Ver 2.4 and earlier insecurely loads Dynamic Link Libraries (DLLs), which could allow an atOM Digital Solutions OM Workspace
- CVE-2026-2072Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center AnalyzerHitachi Infrastructure Analytics Advisor · Hitachi Ops Cent…
- CVE-2026-28825An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-20687A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20701An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2026-28891A race condition was addressed with additional validation.Apple macOS
- CVE-2026-28832An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-28865An authentication issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28842The issue was addressed with improved bounds checks.Apple macOS
- CVE-2026-20639An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-28874The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2026-28875A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS
- CVE-2026-28855A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2026-20622A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2026-28817A race condition was addressed with improved state handling.Apple macOS
- CVE-2026-28876A parsing issue in the handling of directory paths was addressed with improved path validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28821A validation issue existed in the entitlement verification.Apple macOS
- CVE-2026-28837A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-28894A denial-of-service issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-20631A logic issue was addressed with improved checks.Apple macOS
- CVE-2024-51346An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme.
- CVE-2024-51347A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32.
- CVE-2024-51348A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated a
- CVE-2025-67030Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2dorg.codehaus.plexus:plexus-utils
- CVE-2025-70887An issue in ralphje Signify before v.0.9.2 allows a remote attacker to escalate privileges via the signed_data.py and the context.py componesignify
- CVE-2025-70952pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names corg.pf4j:pf4j
Medium, low and unrated 317
- CVE-2026-30892Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalationcontainers crun
- CVE-2026-34051OpenEMR has Improper ACL On Import/Export Popupopenemr
- CVE-2026-33934OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signaturesopenemr
- CVE-2026-33933Reflected XSS via Unescaped contextName Parameter in Custom Template Editoropenemr
- CVE-2026-33931OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Accessopenemr
- CVE-2026-4826SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-33915OpenEMR Missing ACL Checks on Insurance Company API Routesopenemr
- CVE-2026-33912OpenEMR has reflected XSS in ajax_download.php via reportID parameteropenemr
- CVE-2026-33911OpenEMR vulnerable to reflected XSS in graphs.php via title parameteropenemr
- CVE-2026-33909OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processingopenemr
- CVE-2026-4825SourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injectionSourceCodester Sales and Inventory System
- CVE-2026-32120OpenEMR has IDOR in Fee Sheet Product Saveopenemr
- CVE-2026-4823Enter Software Iperius Backup NTLM2 information disclosureEnter Software Iperius Backup
- CVE-2025-36187Multiple Security vulnerabilities affecting IBM Knowledge Catalog Standard CartridgeIBM Knowledge Catalog Standard Cartridge
- CVE-2025-14684IBM Maximo Application Suite - Monitor Component uses Log Forging which is vulnerable to .IBM Maximo Application Suite - Monitor Component
- CVE-2025-14807IBM InfoSphere Information Server is vulnerable to HTTP header injectionIBM InfoSphere Information Server
- CVE-2026-1015IBM InfoSphere Information Server is vulnerable to server-side request forgeryIBM InfoSphere Information Server
- CVE-2026-1014IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive informationIBM InfoSphere Information Server
- CVE-2026-2483IBM InfoSphere Information Server Cross-Site ScriptingIBM InfoSphere Information Server
- CVE-2025-64648Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-64647Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-2484IBM InfoSphere Information Server Information DisclosureIBM InfoSphere Information Server
- CVE-2025-64646Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-36440Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-36438Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-36422IBM InfoSphere Information Server is vulnerable to cross-site request forgeryIBM InfoSphere Information Server
- CVE-2026-2485IBM InfoSphere Information Server Cross-Site ScriptingIBM InfoSphere Information Server
- CVE-2026-33249NATS: Message tracing can be redirected to arbitrary subjectnats-io nats-server · github.com/nats-io/nats-server/v2 +1
- CVE-2025-14974IBM InfoSphere Information Server is vulnerable due to Insecure Direct Object ReferenceIBM InfoSphere Information Server
- CVE-2026-33223NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofingnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-1262IBM InfoSphere Information Server Information DisclosureIBM InfoSphere Information Server
- CVE-2026-33248NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2025-14917IBM WebSphere Application Server Liberty could provide weaker than expected securityIBM WebSphere Application Server - Liberty
- CVE-2025-14912IBM InfoSphere Information Server is vulnerable to server-side request forgeryIBM InfoSphere Information Server
- CVE-2025-14915IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2025-14810IBM InfoSphere Information Server is vulnerable due to insufficient session expirationIBM InfoSphere Information Server
- CVE-2026-33222NATS JetStream has an authorization bypass through its Management APInats-io nats-server · github.com/nats-io/nats-server/v2 +1
- CVE-2026-1561IBM WebSphere Application Server Liberty Server-Side Request ForgeryIBM WebSphere Application Server Liberty
- CVE-2025-14808IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive informationIBM InfoSphere Information Server
- CVE-2025-14790IBM InfoSphere Information Server is vulnerable to disclosure of sensitive informationIBM InfoSphere Information Server
- CVE-2025-12708Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-33219NATS is vulnerable to pre-auth DoS through WebSockets client servicenats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-33246NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersnats-io nats-server · github.com/nats-io/nats-server +1
- CVE-2026-33751n8n Vulnerable to LDAP Filter Injection in LDAP Noden8n-io n8n · n8n
- CVE-2026-33749n8n Vulnerable to XSS via Binary Data Inline HTML Renderingn8n-io n8n · n8n
- CVE-2026-33724n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=non8n-io n8n · n8n
- CVE-2026-33809OOM from malicious IFD offset in golang.org/x/image/tiffgolang.org/x/image/tiff · golang.org/x/image
- CVE-2026-1001Domoticz < 2026.1 Stored XSS via Hardware Configuration EndpointDomoticz
- CVE-2026-33720n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACKn8n-io n8n · n8n
- CVE-2026-2414Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.HYPR Server
- CVE-2026-25645Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionpsf requests · requests
- CVE-2026-29092Kiteworks Email Protection Gateway has an Insufficient Session ExpirationKiteworks Email Protection Gateway
- CVE-2026-23636Kiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous Typekiteworks Secure Data Forms
- CVE-2026-23635Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentialskiteworks Secure Data Forms
- CVE-2026-1712Incorrect privilege assignment vulnerability in HYPR Server allows Privilege Escalation.This issue affects HYPR Server: from 10.5.1 before 1HYPR Server
- CVE-2026-34085fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, afontconfig project fontconfig
- CVE-2025-13078Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2025-13436Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-14595Missing Authorization in GitLabGitLab
- CVE-2026-1724Missing Authentication for Critical Function in GitLabGitLab
- CVE-2026-2745Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-2726Incorrect Authorization in GitLabGitLab
- CVE-2026-2973Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-27659CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpointMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2026-20719DoS via URL Previews Rendering Malicious SVGsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-27656Account Takeover via Substring Matching in OpenID Connect AuthenticationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-26233Denial of Service via HTTP/2 single packet attack on login endpointMattermost · github.com/mattermost/mattermost-server
- CVE-2026-32567WordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerabilityicopydoc YML for Yandex Market
- CVE-2026-32562WordPress PPWP plugin <= 1.9.15 - Broken Access Control vulnerabilityWP Folio Team PPWP
- CVE-2026-32541WordPress Premmerce Redirect Manager plugin <= 1.0.12 - Broken Access Control vulnerabilityPremmerce Redirect Manager
- CVE-2026-32535WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerabilityJoomSky JS Help Desk
- CVE-2026-32533WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerabilityLatePoint
- CVE-2026-32527WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerabilityCRM Perks WP Insightly for Contact Form 7, WPForms, Element…
- CVE-2026-32521WordPress WP Custom Admin Interface plugin <= 7.42 - Cross Site Scripting (XSS) vulnerabilityNorthern Beaches Websites WP Custom Admin Interface
- CVE-2026-32514WordPress Petitioner plugin <= 0.7.3 - Broken Access Control vulnerabilityAnton Voytenko Petitioner
- CVE-2026-32511WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerabilityMikado-Themes Stål
- CVE-2026-32510WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerabilityEdge-Themes Kamperen
- CVE-2026-32509WordPress Gracey theme < 1.4 - Arbitrary Object Instantiation vulnerabilityEdge-Themes Gracey
- CVE-2026-32508WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerabilityMikado-Themes Halstein
- CVE-2026-32507WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerabilityElated-Themes Leroux
- CVE-2026-32506WordPress Archicon theme < 1.7 - Arbitrary Object Instantiation vulnerabilityEdge-Themes Archicon
- CVE-2026-32497WordPress User Verification plugin <= 2.0.45 - Email Verification Bypass vulnerabilityPickPlugins User Verification
- CVE-2026-32496WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerabilityNYSL Spam Protect for Contact Form
- CVE-2026-32492WordPress My Tickets plugin <= 2.1.1 - Bypass Vulnerability vulnerabilityJoe Dolson My Tickets
- CVE-2026-32491WordPress WP Review Slider plugin <= 13.9 - Cross Site Scripting (XSS) vulnerabilityjgwhite33 WP Review Slider
- CVE-2026-32490WordPress WP TripAdvisor Review Slider plugin <= 14.1 - Cross Site Scripting (XSS) vulnerabilityjgwhite33 WP TripAdvisor Review Slider
- CVE-2026-32489WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerabilitybPlugins B Blocks
- CVE-2026-32483WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerabilitycodepeople Contact Form Email
- CVE-2026-31914WordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerabilityhookandhook WP Courses LMS
- CVE-2026-27046WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerabilityKaira StoreCustomizer
- CVE-2026-25469WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerabilityViaBill for WooCommerce ViaBill – WooCommerce
- CVE-2026-25465WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerabilitycodepeople CP Multi View Event Calendar
- CVE-2026-25462WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerabilityavalex
- CVE-2026-25460WordPress Ave Core plugin <= 2.9.1 - Broken Access Control vulnerabilityLiquidThemes Ave Core
- CVE-2026-25455WordPress Product Slider for WooCommerce plugin <= 1.13.61 - Broken Access Control vulnerabilityPickPlugins Product Slider for WooCommerce
- CVE-2026-25454WordPress The League theme <= 4.4.1 - Broken Access Control vulnerabilityMVPThemes The League
- CVE-2026-25437WordPress GZSEO plugin <= 2.0.14 - Broken Access Control vulnerabilityسید محمدامین هاشمی GZSEO
- CVE-2026-25430WordPress Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.2 - Broken Access Control vulnerabilityCRM Perks Integration for Mailchimp and Contact Form 7, WPF…
- CVE-2026-25417WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerabilityMetagauss ProfileGrid
- CVE-2026-25398WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerabilityWebilia Vertex Addons for Elementor
- CVE-2026-25390WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerabilitySaad Iqbal New User Approve
- CVE-2026-25365WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerabilityÖzgür KARALAR Kargo Takip
- CVE-2026-25355WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerabilityskygroup Sanzo
- CVE-2026-25344WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerabilityRadiusTheme Review Schema
- CVE-2026-25339WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerabilitySyed Balkhi Contact Form by WPForms
- CVE-2026-25328WordPress Product File Upload for WooCommerce plugin <= 2.2.4 - Arbitrary File Deletion vulnerabilityadd-ons.org Product File Upload for WooCommerce
- CVE-2026-25327WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerabilityRustaurius Five Star Restaurant Reservations
- CVE-2026-25034WordPress KiviCare plugin <= 3.6.16 - Broken Access Control vulnerabilityIqonic Design KiviCare
- CVE-2026-25009WordPress Education Zone theme <= 1.3.8 - Broken Access Control vulnerabilityraratheme Education Zone
- CVE-2026-24987WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerabilityactivity-log.com WP System Log
- CVE-2026-24972WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerabilityElated-Themes Elated Listing
- CVE-2026-24964WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2026-24376WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerabilityJavier Casares WPVulnerability
- CVE-2026-24370WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerabilityThemeOne The Grid
- CVE-2026-24364WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerabilityweDevs WP User Frontend
- CVE-2026-24362WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerabilitybdthemes Ultimate Post Kit
- CVE-2026-23972WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2026-22485WordPress My Album Gallery plugin <= 1.0.4 - Arbitrary File Deletion vulnerabilityRuhul Amin My Album Gallery
- CVE-2026-20108A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to condCisco Catalyst SD-WAN Manager
- CVE-2026-20112A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an authCisco IOS XE Software
- CVE-2026-20113A vulnerability in the web-based Cisco IOx application hosting environment management interface of Cisco IOS XE Software could allow an unauCisco IOS XE Software
- CVE-2026-20114A vulnerability in the Lobby Ambassador web-based management API of Cisco IOS XE Software could allow an authenticated, remote attacker to eCisco IOS XE Software
- CVE-2026-20115A vulnerability in Cisco IOS XE Software for Cisco Meraki could allow a remote, unauthenticated attacker to view confidential device informaCisco IOS XE Software
- CVE-2026-20083A vulnerability in the Secure Copy Protocol (SCP) server feature of Cisco IOS XE Software could allow an authenticated, local attacker with Cisco IOS XE Software
- CVE-2026-20110A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to cause a denial of service (DoS) conditioCisco IOS XE Software
- CVE-2026-20104A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches, Cisco Catalyst ESS9300 Embedded Series SCisco IOS XE Software
- CVE-2026-3218Responsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019Drupal Responsive Favicons · drupal/responsive_favicons
- CVE-2026-3217SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-3216Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017Drupal Canvas · drupal/canvas
- CVE-2026-3215Islandora - Moderately critical - Arbitrary file upload, Cross-site scripting - SA-CONTRIB-2026-016Drupal Islandora · drupal/islandora
- CVE-2026-3214CAPTCHA - Moderately critical - Access bypass - SA-CONTRIB-2026-015Drupal CAPTCHA · drupal/captcha
- CVE-2026-3213Anti-Spam by CleanTalk - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-014Drupal Anti-Spam by CleanTalk · drupal/cleantalk
- CVE-2026-3212Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013Drupal Tagify · drupal/tagify
- CVE-2026-3211Theme Negotiation by Rules - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-012Drupal Theme Negotiation by Rules · drupal/theme_rule
- CVE-2026-3210Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011Drupal Material Icons · drupal/material_icons
- CVE-2026-2349UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010Drupal UI Icons · drupal/ui_icons
- CVE-2026-2348Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009Drupal Quick Edit · drupal/quickedit
- CVE-2026-1917Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008Drupal Login Disable · drupal/login_disable
- CVE-2026-4363Incorrect Authorization in GitLabGitLab
- CVE-2026-33268Nanoleaf Lines unauthenticated firmware file storeNanoleaf Lines
- CVE-2026-3591A stack use-after-return flaw in SIG(0) handling code may enable ACL bypassISC BIND
- CVE-2026-3119Authenticated query containing a TKEY record may cause named to terminate unexpectedlyISC BIND
- CVE-2026-4816Reflected Cross Site Scripting (XSS) vulnerability in Support BoardSchiocco Support Board
- CVE-2025-40841Ericsson Indoor Connect 8855 - Cross-Site Request Forgery VulnerabilityEricsson Indoor Connect
- CVE-2026-4761Unnecessary permissions on private keys of certificates installed by Network and Security WizardCODRA Panorama Suite
- CVE-2026-23394af_unix: Give up GC if MSG_PEEK intervened.Linux
- CVE-2026-23390tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflowLinux
- CVE-2026-23389ice: Fix memory leak in ice_set_ringparam()Linux
- CVE-2026-23388Squashfs: check metadata block offset is within rangeLinux
- CVE-2026-23387pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()Linux
- CVE-2026-23386gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPLLinux
- CVE-2026-23385netfilter: nf_tables: clone set on flush onlyLinux
- CVE-2026-23384RDMA/ionic: Fix kernel stack leak in ionic_create_cq()Linux
- CVE-2026-23382HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing themLinux
- CVE-2026-23381net: bridge: fix nd_tbl NULL dereference when IPv6 is disabledLinux
- CVE-2026-23380tracing: Fix WARN_ON in tracing_buffers_mmap_closeLinux
- CVE-2026-23379net/sched: ets: fix divide by zero in the offload pathLinux
- CVE-2026-23377ice: change XDP RxQ frag_size from DMA write length to xdp.frame_szLinux
- CVE-2026-23376nvmet-fcloop: Check remoteport port_state before calling done callbackLinux
- CVE-2026-23375mm: thp: deny THP for files on anonymous inodesLinux
- CVE-2026-23374blktrace: fix __this_cpu_read/write in preemptible contextLinux
- CVE-2026-23373wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_configLinux
- CVE-2026-23371sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boostingLinux
- CVE-2026-23370platform/x86: dell-wmi-sysman: Don't hex dump plaintext password dataLinux
- CVE-2026-23369i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"Linux
- CVE-2026-23368net: phy: register phy led_triggers during probe to avoid AB-BA deadlockLinux
- CVE-2026-23367wifi: radiotap: reject radiotap with unknown bitsLinux
- CVE-2026-23366drm/client: Do not destroy NULL modesLinux
- CVE-2026-23365net: usb: kalmia: validate USB endpointsLinux
- CVE-2026-23363wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()Linux
- CVE-2026-23362can: bcm: fix locking for bcm_op runtime updatesLinux
- CVE-2026-23361PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entryLinux
- CVE-2026-23360nvme: fix admin queue leak on controller resetLinux
- CVE-2026-23359bpf: Fix stack-out-of-bounds write in devmapLinux
- CVE-2026-23358drm/amdgpu: Fix error handling in slot resetLinux
- CVE-2026-23357can: mcp251x: fix deadlock in error path of mcp251x_openLinux
- CVE-2026-23356drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()Linux
- CVE-2026-23355ata: libata: cancel pending work after clearing deferred_qcLinux
- CVE-2026-23354x86/fred: Correct speculative safety in fred_extint()Linux
- CVE-2026-23353ice: fix crash in ethtool offline loopback testLinux
- CVE-2026-23352x86/efi: defer freeing of boot services memoryLinux
- CVE-2026-23349HID: pidff: Fix condition effect bit clearingLinux
- CVE-2026-23348cxl: Fix race of nvdimm_bus object when creating nvdimm objectsLinux
- CVE-2026-23347can: usb: f81604: correctly anchor the urb in the read bulk callbackLinux
- CVE-2026-23346arm64: io: Extract user memory type in ioremap_prot()Linux
- CVE-2026-23345arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabledLinux
- CVE-2026-23344crypto: ccp - Fix use-after-free on error pathLinux
- CVE-2026-23343xdp: produce a warning when calculated tailroom is negativeLinux
- CVE-2026-23342bpf: Fix race in cpumap on PREEMPT_RTLinux
- CVE-2026-23341accel/amdxdna: Fix crash when destroying a suspended hardware contextLinux
- CVE-2026-23339nfc: nci: free skb on nci_transceive early error pathsLinux
- CVE-2026-23338drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warningsLinux
- CVE-2026-23337pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()Linux
- CVE-2026-23335RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()Linux
- CVE-2026-23334can: usb: f81604: handle short interrupt urb messages properlyLinux
- CVE-2026-23332cpufreq: intel_pstate: Fix crash during turbo disableLinux
- CVE-2026-23331udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.Linux
- CVE-2026-23330nfc: nci: complete pending data exchange on device closeLinux
- CVE-2026-23329libie: don't unroll if fwlog isn't supportedLinux
- CVE-2026-23328accel/amdxdna: Fix NULL pointer dereference of mgmt_channLinux
- CVE-2026-23327cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()Linux
- CVE-2026-23326xsk: Fix fragment node deletion to prevent buffer leakLinux
- CVE-2026-23325wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()Linux
- CVE-2026-23324can: usb: etas_es58x: correctly anchor the urb in the read bulk callbackLinux
- CVE-2026-23323hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driverLinux
- CVE-2026-23322ipmi: Fix use-after-free and list corruption on sender errorLinux
- CVE-2026-23321mptcp: pm: in-kernel: always mark signal+subflow endp as usedLinux
- CVE-2026-23319bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shimLinux
- CVE-2026-23318ALSA: usb-audio: Use correct version for UAC3 header validationLinux
- CVE-2026-23316net: ipv4: fix ARM64 alignment fault in multipath hash seedLinux
- CVE-2026-23315wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()Linux
- CVE-2026-23314regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()Linux
- CVE-2026-23313i40e: Fix preempt count leak in napi poll tracepointLinux
- CVE-2026-23312net: usb: kaweth: validate USB endpointsLinux
- CVE-2026-23311perf/core: Fix invalid wait context in ctx_sched_in()Linux
- CVE-2026-23310bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loadedLinux
- CVE-2026-23309tracing: Add NULL pointer check to trigger_data_free()Linux
- CVE-2026-23308pinctrl: equilibrium: fix warning trace on loadLinux
- CVE-2026-23307can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a messageLinux
- CVE-2026-23305accel/rocket: fix unwinding in error path in rocket_probeLinux
- CVE-2026-23304ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()Linux
- CVE-2026-23303smb: client: Don't log plaintext credentials in cifs_set_cifscredsLinux
- CVE-2026-23302net: annotate data-races around sk->sk_{data_ready,write_space}Linux
- CVE-2026-23301ASoC: SDCA: Add allocation failure check for Entity nameLinux
- CVE-2026-23300net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthopLinux
- CVE-2026-23299Bluetooth: purge error queues in socket destructorsLinux
- CVE-2026-23298can: ucan: Fix infinite loop from zero-length messagesLinux
- CVE-2026-23297nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().Linux
- CVE-2026-23296scsi: core: Fix refcount leak for tagset_refcntLinux
- CVE-2026-23295accel/amdxdna: Fix dead lock for suspend and resumeLinux
- CVE-2026-23293net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabledLinux
- CVE-2026-23292scsi: target: Fix recursive locking in __configfs_open_file()Linux
- CVE-2026-23291nfc: pn533: properly drop the usb interface reference on disconnectLinux
- CVE-2026-23290net: usb: pegasus: validate USB endpointsLinux
- CVE-2026-23289IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()Linux
- CVE-2026-23287irqchip/sifive-plic: Fix frozen interrupt due to affinity settingLinux
- CVE-2026-23286atm: lec: fix null-ptr-deref in lec_arp_clear_vccsLinux
- CVE-2026-23285drbd: fix null-pointer dereference on local read errorLinux
- CVE-2026-23284net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()Linux
- CVE-2026-23283regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()Linux
- CVE-2026-23282smb: client: fix oops due to uninitialised var in smb2_unlink()Linux
- CVE-2026-23281wifi: libertas: fix use-after-free in lbs_free_adapter()Linux
- CVE-2026-23279wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()Linux
- CVE-2026-32326SHARP routers do not perform authentication for some web APIs.Sharp home 5G HR01 · Sharp home 5G HR02 +6
- CVE-2026-2343PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive DownloadPeproDev Ultimate Invoice
- CVE-2026-33253SANUPS SOFTWARE provided by SANYO DENKI CO., LTD.SANYO DENKI CO. SANUPS SOFTWARE STANDALONE · SANYO DENKI CO…
- CVE-2026-1166Open Redirect Vulnerability in Hitachi Ops Center AdministratorHitachi Ops Center Administrator
- CVE-2026-4766Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Metadevrix Easy Image Gallery
- CVE-2026-4784code-projects Simple Laundry System Parameter checkcheckout.php sql injectioncode-projects Simple Laundry System
- CVE-2026-28864This issue was addressed with improved permissions checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20691An authorization issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +3
- CVE-2026-28833A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20668A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +1
- CVE-2025-43534A path handling issue was addressed with improved validation.Apple iOS and iPadOS
- CVE-2026-28868A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20633This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2026-28829A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-20664The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-28852A stack overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28844A file access issue was addressed with improved input validation.Apple macOS
- CVE-2026-28845An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-28890An out-of-bounds read was addressed with improved bounds checking.Apple Xcode
- CVE-2026-20665This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28828A permissions issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2026-20632A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2026-28886A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20686This issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2026-28824An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-20690An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28881A privacy issue was addressed by moving sensitive data.Apple macOS
- CVE-2026-28839The issue was addressed with improved checks.Apple macOS
- CVE-2026-28878A privacy issue was addressed by removing sensitive data.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28862A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2026-4783itsourcecode College Management System Parameter add-single-student-results.php sql injectionitsourcecode College Management System
- CVE-2026-20697A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-28835A use-after-free issue was addressed with improved memory management.Apple macOS
- CVE-2026-28823A path handling issue was addressed with improved validation.Apple macOS
- CVE-2026-28818A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2026-28859The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28822A type confusion issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28834A race condition was addressed with improved state handling.Apple macOS
- CVE-2026-28863A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2026-28879A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28838A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2026-28880A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-28856The issue was addressed with improved authentication.Apple iOS and iPadOS · Apple visionOS +1
- CVE-2026-28895The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2026-20637A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-20699A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.Apple macOS
- CVE-2026-20695An information disclosure issue was addressed with improved memory management.Apple macOS
- CVE-2026-28861A logic issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-20694This issue was addressed with improved handling of symlinks.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28820This issue was addressed with improved checks.Apple macOS
- CVE-2026-28877An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-20657A buffer overflow issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-20698The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28882This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28857The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-28841A buffer overflow was addressed with improved size validation.Apple macOS
- CVE-2026-28816A path handling issue was addressed with improved validation.Apple macOS
- CVE-2026-20607A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-28870An information leakage was addressed with additional validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28831An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-20693This issue was addressed through improved state management.Apple macOS
- CVE-2026-28866This issue was addressed with improved validation of symlinks.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28889A permissions issue was addressed with additional restrictions.Apple Xcode
- CVE-2026-28893A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2026-20670An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-28892A permissions issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2026-28867This issue was addressed with improved authentication.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28888A race condition was addressed with improved state handling.Apple macOS
- CVE-2026-20692A privacy issue was addressed with improved handling of user preferences.Apple iOS and iPadOS · Apple macOS
- CVE-2026-28826A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2026-28871A logic issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +1
- CVE-2026-20684A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-20651A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2026-30587Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,@seafile/sdoc-editor