CVEs published May 12, 2026
553 CVEs were published on May 12, 2026: 72 critical, 285 high. 1 is now in CISA KEV.
- Published
- 553
- Critical
- 72
- High
- 285
- Medium
- 177
- Low
- 19
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 289
Most affected products
- Microsoft Windows
- 59
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- 27
- Adobe Commerce · Adobe Magento Open Source
- 15
- Adobe Content Credentials JS SDK · Adobe Content Credential…
- 14
- Intel(R) QAT software drivers for Windows
- 9
- Apache Software Foundation Apache Tomcat · org.apache.to… +2
- 7
- M2Team NanaZip
- 7
- Microsoft 365 Apps for Enterprise · Microsoft Office
- 6
- Microsoft 365 Apps for Enterprise · Microsoft Office +1
- 6
- Microsoft SharePoint Enterprise Server · Microsoft SharePoi…
- 6
Critical 72
- CVE-2026-41901Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsthymeleaf · org.thymeleaf:thymeleaf +2
- CVE-2026-44547ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2ChurchCRM CRM
- CVE-2026-42288ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDChurchCRM CRM
- CVE-2026-42854arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCEespressif arduino-esp32
- CVE-2026-44257efw4.X: RCE via zipslipefwGrp efw4.X
- CVE-2026-44258efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code ExecutionefwGrp efw4.X
- CVE-2026-42196django-s3file: Relative path traversalcodingjoe django-s3file · django-s3file
- CVE-2026-44262Scramble: Remote code execution via evaluation of user-controlled input in validation rulesdedoc scramble · dedoc/scramble
- CVE-2026-43948wger: cross-tenant password reset and plaintext disclosure via gym=None bypasswger-project wger · wger
- CVE-2026-44225Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user filesenesgkky Pulpy
- CVE-2026-44221ArcadeDB: Cross-database authorization bypass and unsecured newly-created databasesArcadeData arcadedb · com.arcadedb:arcadedb-server
- CVE-2026-42889Relay Server WebSocket authentication bypass when token is omittedNo-Instructions relay-server
- CVE-2026-8431Ops Manager RCE via webhook bodyMongoDB Ops Manager
- CVE-2026-34659Adobe Connect | Deserialization of Untrusted Data (CWE-502)Adobe Connect
- CVE-2026-34660Adobe Connect | Incorrect Authorization (CWE-863)Adobe Connect
- CVE-2026-29204Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` WebPros WHMCS
- CVE-2026-44196Pingvin Share X: TOTP Authentication Bypass via Password-only Loginsmp46 pingvin-share-x
- CVE-2026-42048Langflow: Path Traversal in Langflow Knowledge Bases APIlangflow-ai langflow · langflow
- CVE-2026-44183Cleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabledCleanuparr
- CVE-2026-42300DevGuard: Unauthenticated identity assertion via `X-Admin-Token` headerl3montree-dev devguard · github.com/l3montree-dev/devguard
- CVE-2026-42833Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2026-42823Azure Logic Apps Elevation of Privilege VulnerabilityMicrosoft Azure Logic Apps
- CVE-2026-41103Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege VulnerabilityMicrosoft Confluence SAML SSO plugin · Microsoft JIRA SAML…
- CVE-2026-40402Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42898Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2026-41096Windows DNS Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-41089Windows Netlogon Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2026-33117Azure SDK for Java Security Feature Bypass VulnerabilityMicrosoft Azure SDK for Java · com.azure:azure-security-key…
- CVE-2026-40379Azure Entra ID Spoofing VulnerabilityMicrosoft Entra
- CVE-2026-44277A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6Fortinet FortiAuthenticator
- CVE-2026-26083A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0Fortinet FortiSandbox
- CVE-2026-44343WGDashboard: Critical Vulnerability in 4.3.2WGDashboard
- CVE-2026-20794Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers mayIntel(R) Data Center Graphics Driver for VMware ESXi softwa…
- CVE-2026-43992JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameterDragonmonk111 junoclaw
- CVE-2026-43515Apache Tomcat: Security constraints not correctly appliedApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown userApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validatedApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-30805Insecure Default Initialization in API Authentication leads to Authentication BypassPandora FMS
- CVE-2026-8401Sandbox escape in the Profile Backup componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-8043External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files andivanti Xtraction
- CVE-2026-45091sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)davidalmeidac sealed-env · sealed-env +1
- CVE-2026-8072Insecure generation of SAT access credentials in Ingecon EMS BoardIngeteam Ingecon Sun EMS Board
- CVE-2025-6577SQLi in Akilli Commerce's E-Commerce WebsiteAkilli Commerce Software Technologies Ltd. E-Commerce Websi…
- CVE-2026-7428Insecure default administrative credentials in AlloyDB for PostgreSQLGoogle Cloud AlloyDB for PostgreSQL
- CVE-2026-41551A vulnerability has been identified in ROS# (All versions < V2.2.2).Siemens ROS#
- CVE-2026-25787Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +77
- CVE-2026-25786Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interfaceSiemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +77
- CVE-2026-22924A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0).Siemens SIMATIC CN
- CVE-2025-40949A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2026-34263Missing authentication check in SAP Commerce cloud configurationSAP_SE SAP Commerce cloud configuration
- CVE-2026-34260SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)SAP_SE SAP S/4HANA
- CVE-2026-45321Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys@tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82
- CVE-2025-65719An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user interaction with a kubectl-mcp-server
- CVE-2026-31214The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains
- CVE-2026-31215The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface.
- CVE-2026-31216The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API.
- CVE-2026-31217The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f
- CVE-2026-31220PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxisyft
- CVE-2026-31226The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability (
- CVE-2026-31228The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component.
- CVE-2026-31229The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component'
- CVE-2026-31230The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (rob
- CVE-2026-31231Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint.
- CVE-2026-31233Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism.guardrails-ai
- CVE-2026-31234Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component.horovod
- CVE-2026-31235The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py moimgaug
- CVE-2026-31236The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument.llm
- CVE-2026-31237The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method.ludwig
- CVE-2026-31238The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component.ludwig
- CVE-2026-31239The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from Huggimamba-ssm
- CVE-2026-31242The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memorie
- CVE-2026-45185Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path.Exim
High 285
- CVE-2026-8053FlatBSON Duplicate Field Index DriftMongoDB Server
- CVE-2026-42156Flowsint: Cypher query injection in node type on node creationreconurge flowsint
- CVE-2026-44548ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)ChurchCRM CRM
- CVE-2026-8108Fuji Electric Tellus Exposed Dangerous Method or FunctionFuji Electric Tellus
- CVE-2026-43680A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restrictiClaris FileMaker Cloud
- CVE-2026-43685A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating sClaris FileMaker Cloud
- CVE-2026-1250Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injectionwebmuehle Court Reservation – Manage Your Court Bookings On…
- CVE-2026-5371MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Resetchriscct7 MonsterInsights – Google Analytics Dashboard for…
- CVE-2026-42289ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege EscalationChurchCRM CRM
- CVE-2026-40863PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML ReaderPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-40902PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row DimensionsPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2026-42855arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attackespressif arduino-esp32
- CVE-2026-44307Mako: Path traversal via backslash URI on Windows in TemplateLookupsqlalchemy mako · mako
- CVE-2026-42544Granian: Unauthenticated DoS via WebSocket subprotocol header panicemmett-framework granian · granian
- CVE-2026-42844Grav: Low-privileged API users can create super-admin accounts via blueprint-uploadgetgrav grav · getgrav/grav
- CVE-2026-42268ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operatorsowasp-modsecurity ModSecurity
- CVE-2026-44302Snappier: Infinite loop in SnappyStream decompression on malformed framed inputbrantburnett Snappier · Snappier
- CVE-2026-44304Lemur: LDAP Filter Injection enables post-authentication privilege escalationNetflix lemur · lemur
- CVE-2026-44241Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Headermicronaut-projects micronaut-core · io.micronaut:micronaut-…
- CVE-2026-45227Heym < 0.0.21 Sandbox Escape via Python Introspectionheymrun heym
- CVE-2026-45226Heym < 0.0.21 Authorization Bypass in Workflow Executionheymrun heym
- CVE-2026-44260efw4.X: readonly Flag Not Enforced Server-SideefwGrp efw4.X
- CVE-2026-45225Heym < 0.0.21 Path Traversal File Upload via upload_file()heymrun heym
- CVE-2026-44871Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-26289Subnet Solutions PowerSYSTEM Center Incorrect AuthorizationSubnet Solutions PowerSYSTEM Center
- CVE-2026-44296Deskflow: TLS multiplexer DoS on failed `SSL_accept`deskflow
- CVE-2026-44015Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2026-35555Subnet Solutions PowerSYSTEM Center Incorrect AuthorizationSubnet Solutions PowerSYSTEM Center
- CVE-2026-44403Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session SerializationWing FTP Server
- CVE-2026-44246nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`MIC-DKFZ nnUNet
- CVE-2026-44240basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingpatrickjuchli basic-ftp · basic-ftp
- CVE-2026-44224Wiki.js: Privilege Escalation via Missing Group Validation in users.updaterequarks wiki
- CVE-2026-44232dssrf: every IPv6 category bypasses is_url_safeHackingRepo dssrf-js · dssrf
- CVE-2025-65088Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt ShareAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2025-65087Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt ShareAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2026-44011Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms cms · craftcms/cms
- CVE-2025-65086Out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt ShareAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2026-44012Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosurecraftcms cms · craftcms/cms
- CVE-2026-44010Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosurecraftcms cms · craftcms/cms
- CVE-2026-34665CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34650Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34686Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34647Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34653Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34652Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34645Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34648Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34649Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34651Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34646Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34690After Effects | Stack-based Buffer Overflow (CWE-121)Adobe After Effects
- CVE-2026-44872Authenticated Arbitrary File Upload via Command Injection in AOS-8 AND AOS-10 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44870Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44869Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44868Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44867Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44866Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44865Authenticated Command Injection Vulnerabilities in the Web-Based Management Interface of AOS-8 and AOS-10Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44864Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-7474Nomad vulnerable to path traversal in dynamic host volume which may lead to code executionHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2026-44863Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44862Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44861Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44860Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating SystemsHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44859Authenticated Stack-Based Buffer Overflow in PAPI ServicesHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44858Authenticated Stack-Based Buffer Overflow in PAPI ServicesHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44857Authenticated Stack-Based Buffer Overflow in PAPI ServicesHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44856Authenticated Stack-Based Buffer Overflow in PAPI ServicesHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44855Authenticated Stack-Based Buffer Overflow in PAPI ServicesHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44854Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44853Authenticated Remote Code Execution via Arbitrary File Write in AOS-8 and AOS-10 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-44852Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23827Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management ServiceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23826Unauthenticated Denial of Service in AOS-8 Network Management ServiceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23825Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling ComponentHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-23824Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling ComponentHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-8430SPIP < 4.4.14 Remote Code Execution via nginxSPIP
- CVE-2026-23823Authenticated Command Injection leads to RCE in AOS-10 CLI CommandHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-23821Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLIHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-23820Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLIHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-8429SPIP < 4.4.14 Remote Code Execution via Private SpaceSPIP
- CVE-2026-23819Error in SSID Processing allows Stored XSS in Web Management InterfaceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-34682Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-34681Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-34684Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-34683Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-34687Illustrator | Heap-based Buffer Overflow (CWE-122)Adobe Illustrator Desktop
- CVE-2026-34661Illustrator | Out-of-bounds Write (CWE-787)Adobe Illustrator Desktop
- CVE-2026-43929ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputsfelippe-regazio ssrfcheck · ssrfcheck
- CVE-2026-43892AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injectionAntSwordProject antSword
- CVE-2026-34676Substance3D - Painter | Out-of-bounds Write (CWE-787)Adobe Substance3D - Painter
- CVE-2026-34675Substance3D - Painter | Out-of-bounds Write (CWE-787)Adobe Substance3D - Painter
- CVE-2025-46311An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2025-43524An access issue was addressed with additional sandbox restrictions.Apple macOS Sequoia · Apple macOS Sonoma +1
- CVE-2026-44184Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API readsCleanuparr
- CVE-2026-20767Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow Intel(R) QAT software drivers for Windows
- CVE-2026-20714Out-of-bounds write for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a escaIntel(R) QAT software drivers for Windows
- CVE-2026-44167phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()phpseclib · phpseclib/phpseclib
- CVE-2026-34644After Effects | Integer Overflow or Wraparound (CWE-190)Adobe After Effects
- CVE-2026-34643After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2026-34642After Effects | Heap-based Buffer Overflow (CWE-122)Adobe After Effects
- CVE-2026-34640Media Encoder | Integer Overflow or Wraparound (CWE-190)Adobe Media Encoder
- CVE-2026-34639Media Encoder | Out-of-bounds Write (CWE-787)Adobe Media Encoder
- CVE-2026-42141Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionalityxibosignage xibo-cms
- CVE-2026-34637Premiere Pro | Out-of-bounds Write (CWE-787)Adobe Premiere
- CVE-2026-34638Premiere Pro | Use After Free (CWE-416)Adobe Premiere
- CVE-2026-34636Premiere Pro | Out-of-bounds Write (CWE-787)Adobe Premiere
- CVE-2026-33821Microsoft Dynamics 365 Customer Insights Elevation of Privilege VulnerabilityMicrosoft Dynamics
- CVE-2026-42893Microsoft Outlook for iOS Tampering VulnerabilityMicrosoft Outlook for iOS
- CVE-2026-42832Microsoft Office Spoofing VulnerabilityMicrosoft Excel for Android · Microsoft Office LTSC for… +1
- CVE-2026-41613Visual Studio Code Elevation of Privilege VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-40381Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Azure Connected Machine Agent
- CVE-2026-41086Windows Admin Center in Azure Portal Elevation of Privilege VulnerabilityMicrosoft Windows Admin Center in Azure Portal
- CVE-2026-40420Microsoft Office Click-To-Run Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-35436Microsoft Office Click-To-Run Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-40418Microsoft Office Click-To-Run Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-40413Windows TCP/IP Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-40403Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-40401Windows TCP/IP Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-40398Windows Remote Desktop Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40397Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40382Windows Telephony Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40369Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40370SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2026-40367Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2026-40365Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-40362Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-40361Microsoft Outlook and Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2026-40359Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-40358Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-40357Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-34341Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34340Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34338Windows Telephony Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34337Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34336Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34334Windows TCP/IP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34332Windows Kernel-Mode Driver Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2026-33838Windows Message Queuing (MSMQ) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33837Windows TCP/IP Local Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33835Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33833Azure Machine Learning Notebook Spoofing VulnerabilityMicrosoft Azure Machine Learning
- CVE-2026-33112Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-33110Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-42899ASP.NET Core Denial of Service VulnerabilityMicrosoft .NET · Microsoft.AspNetCore.App.Runtime.win-a… +11
- CVE-2026-42896Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42825Windows Telephony Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-41107Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-42831Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office for Android · Microsoft Office LTSC for Mac
- CVE-2026-32161Windows Native WiFi Miniport Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-41611Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-41109GitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-41102Microsoft PowerPoint for Android Spoofing VulnerabilityMicrosoft PowerPoint for Android
- CVE-2026-41101Microsoft Word for Android Spoofing VulnerabilityMicrosoft Word for Android
- CVE-2026-41095Data Deduplication Elevation of Privilege VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2026-41094Microsoft Data Formulator Remote Code Execution VulnerabilityMicrosoft Data Formulator
- CVE-2026-41088Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40419Microsoft Office Click-To-Run Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-40417Microsoft Dynamics 365 Business Central Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 Business Central 2024 Release Wav… +2
- CVE-2026-40415Windows TCP/IP Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-40414Windows TCP/IP Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-40410Windows SMB Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40408Windows WAN ARP Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40407Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40406Windows TCP/IP Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-40405Windows TCP/IP Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-40399Windows TCP/IP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40377Microsoft Cryptographic Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40368Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-40366Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2026-40364Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2026-40363Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-40360Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-35439Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-35438Windows Admin Center Elevation of Privilege VulnerabilityMicrosoft Windows Admin Center
- CVE-2026-35433.NET Elevation of Privilege VulnerabilityMicrosoft .NET · Microsoft.WindowsDesktop.App.Runtime.wi… +2
- CVE-2026-35424Internet Key Exchange (IKE) Protocol Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-35421Windows GDI Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-35420Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2026-35418Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-35417Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-35416Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-35415Windows Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34351Windows TCP/IP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34347Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34345Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34344Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34343Windows Application Identity (AppID) Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34342Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34333Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34331Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34330Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-34329Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-33841Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33840Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33839Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33834Windows Event Logging Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-32177.NET Elevation of Privilege VulnerabilityMicrosoft .NET · Microsoft Visual Studio
- CVE-2026-32204Azure Monitor Agent Elevation of Privilege VulnerabilityMicrosoft Azure Monitor
- CVE-2026-43891changedetection.io: Arbitrary Local File Read via crafted backup restoredgtlmoon changedetection.io · changedetection-io
- CVE-2025-53844A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allowFortinet FortiOS
- CVE-2026-41895changedetection.io: XXE vulnerability in the changedetection.io projectdgtlmoon changedetection.io · changedetection-io
- CVE-2025-35990Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring 3: User ApplicationsIntel Endpoint Management Assistant (EMA) software
- CVE-2026-20887Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service.Intel Vision software
- CVE-2026-20879Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device DriversIntel(R) Data Center Graphics Driver for VMware ESXi softwa…
- CVE-2026-20753Integer overflow in the UEFI firmware for the Slim Bootloader may allow an escalation of privilege.Slim Bootloader may allow an escalation of privilege. Syste…
- CVE-2026-20751Out-of-bounds read for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers Intel(R) Data Center Graphics Driver for VMware ESXi softwa…
- CVE-2026-20738Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may aIntel(R) QuickAssist Adapter 8960 software
- CVE-2026-43993JunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service accessDragonmonk111 junoclaw
- CVE-2026-43990JunoClaw: plugin-shell shell-metacharacter injection via shell wrapperDragonmonk111 junoclaw
- CVE-2026-43989JunoClaw: upload_wasm accepted arbitrary filesystem paths without validationDragonmonk111 junoclaw
- CVE-2026-43991JunoClaw: plugin-shell shell-injection bypass via substring blocklistDragonmonk111 junoclaw
- CVE-2026-5089YAML::Syck versions before 1.38 for Perl has an out-of-bounds readTODDR YAML::Syck
- CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitiveApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-42498Apache Tomcat: WebSocket authentication header exposureApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-34187SQL Injection in Graph Container ParameterPandora FMS
- CVE-2026-30810Server-Side Request Forgery in API Checker leads to Privilege EscalationPandora FMS
- CVE-2026-30808Session Fixation in Authentication leads to Session HijackingPandora FMS
- CVE-2026-30807Cross-Site Request Forgery on Extension PagesPandora FMS
- CVE-2026-8111SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remoteivanti Endpoint Manager
- CVE-2026-8110Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to esivanti Endpoint Manager
- CVE-2026-8051OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges toivanti Virtual Traffic Manager
- CVE-2026-7432A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMivanti Secure Access Client
- CVE-2026-43983Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionspocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-32687SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3elixir-ecto postgrex
- CVE-2026-42260Open-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`Aas-ee open-webSearch · open-websearch
- CVE-2026-43937YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql`YAFNET · YAFNET.Core
- CVE-2026-6866Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel ServerSchneider Electric EcoStruxure™ Panel Server
- CVE-2026-43938YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderYAFNET · YAFNET.Core
- CVE-2026-43939YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersYAFNET · YAFNET.Core
- CVE-2026-43916pam_authnft: Heap buffer overflow in NETLINK_SOCK_DIAG reply walkeridentd-ng pam_authnft
- CVE-2026-27851When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabliOpen-Xchange OX Dovecot Pro
- CVE-2026-35071Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Dell PowerScale InsightIQ
- CVE-2026-8390Use-after-free in the JavaScript: WebAssembly componentMozilla Firefox
- CVE-2026-8389JIT miscompilation in the JavaScript Engine: JIT componentMozilla Firefox
- CVE-2025-12659Heap-based buffer overflow in Siemens Simcenter FemapSiemens Simcenter Femap
- CVE-2026-6865Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple ProductsSchneider Electric EasyLogic T150 (formerly Saitel DR) Remo…
- CVE-2026-4827Insufficient Entropy vulnerability on Multiple ProductsSchneider Electric Easergy MiCOM C264 · Schneider Elect… +12
- CVE-2026-45218WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerabilityWP Travel
- CVE-2026-45214WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerabilityXpro Elementor Addons
- CVE-2026-45213WordPress BEAR plugin <= 1.1.7.1 - SQL Injection vulnerabilityRealMag777 BEAR
- CVE-2026-45211WordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerabilitySaad Iqbal APIExperts Square for WooCommerce
- CVE-2026-42742WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerabilityAman Views for WPForms
- CVE-2026-42741WordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerabilityAman Ninja Forms Views – Display & Edit Ninja For…
- CVE-2026-2465Improper Authorization in E-Kalite's Turboard FOR-SE-Kalite Software Hardware Engineering Design and Internet…
- CVE-2026-41713Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisorVMware Spring AI · org.springframework.ai:spring-ai-client-…
- CVE-2026-41712ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakageVMware Spring AI · org.springframework.ai:spring-ai-clie… +2
- CVE-2026-6001IDOR in Abis Technology's BAPSİSABIS Technology Ltd. BAPSİS
- CVE-2026-8162multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsingmultiparty
- CVE-2026-5029RCE in Code Runner MCP ServerCode Runner MCP Server
- CVE-2026-8161multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exceptionmultiparty
- CVE-2026-8159multiparty vulnerable to ReDoS via filename parsingmultiparty
- CVE-2026-44412A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5).Siemens Solid Edge SE2026
- CVE-2026-44411A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5).Siemens Solid Edge SE2026
- CVE-2026-33893A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), TeamcenteSiemens Teamcenter
- CVE-2026-33862A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), TeamcenteSiemens Teamcenter
- CVE-2026-27662Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in pSiemens SIMATIC HMI MTP1000 Unified Comfort Panel · Sie… +35
- CVE-2026-25789Affected devices do not properly validate and sanitize filenames on the Firmware Update page.Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +77
- CVE-2026-22925A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0).Siemens SIMATIC CN
- CVE-2025-40947A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2025-40946A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 1Siemens blueplanet 100 NX3 M8 · Siemens blueplanet 100… +21
- CVE-2025-40833The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests.Siemens IE/PB LINK HA · Siemens IE/PB link PN IO +165
- CVE-2026-39432WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerabilityArraytics Timetics
- CVE-2026-2993AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated SQL Injection in getListForTbl()wupsales AI Chatbot & Workflow Automation by AIWU
- CVE-2026-6690LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Actionashanjay LifePress
- CVE-2026-35227Improper resource management in CODESYS Modbus TCP ServerCODESYS Modbus
- CVE-2026-41872"Kura Sushi Official App" provided by EPG, Inc.EPG "Kura Sushi Official App" for Android · EPG "Kura Sushi…
- CVE-2026-45430The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow agaBackdrop CMS contributed projects backdrop-contrib/salesfor…
- CVE-2026-7287** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and foZyxel NWA1100-N firmware
- CVE-2026-7256** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 coZyxel WRE6505 v2 firmware
- CVE-2026-34259OS Command Injection Vulnerability in SAP Forecasting & ReplenishmentSAP_SE SAP Forecasting & Replenishment
- CVE-2026-45393Local privilege escalation to SYSTEM in Cribl Edge for WindowsCribl Edge
- CVE-2026-45392DOM-based XSS in Cribl StreamCribl Stream
- CVE-2026-45391Local privilege escalation in Cribl Edge for LinuxCribl Edge
- CVE-2023-27753An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2026-31218The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f
- CVE-2026-31219The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f
- CVE-2026-31221PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanismlightning · pytorch-lightning
- CVE-2026-31222The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() method of the Trainer clsnorkel
- CVE-2026-31223The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler.load() method of thsnorkel
- CVE-2026-31224The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier.load() method of thsnorkel
- CVE-2026-31225The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component.superduper-framework
- CVE-2026-31232The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (
- CVE-2026-31240The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints.mem0ai
Medium, low and unrated 196
- CVE-2026-42158Flowsint: Broken Access Control allows modification of investigation metadata from any userreconurge flowsint
- CVE-2026-42157Flowsint: Stored XSS on map node marker in map pagereconurge flowsint
- CVE-2026-44352Flowsint: Broken Access Control allows reading of sketch logs from any userreconurge flowsint
- CVE-2026-44245Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Componentkyverno · github.com/kyverno/policy-reporter-ui
- CVE-2026-44347Warpgate: SSO CSRF -- State Token Not Validated on Returnwarp-tech warpgate
- CVE-2026-44341GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpointkarnop gojobs
- CVE-2025-15463Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Executionhwk-fr Advanced Custom Fields: Extended
- CVE-2026-42545Granian: DoS via WSGI response header panicemmett-framework granian · granian
- CVE-2026-44301Hugo: Node tool execution allows file system access outside the project directorygohugoio hugo · github.com/gohugoio/hugo
- CVE-2026-44306Statamic: Email enumeration via forgot password endpointstatamic cms · statamic/cms
- CVE-2026-44305Lemur: LDAP TLS certificate verification globally disabled enables credential interceptionNetflix lemur · lemur
- CVE-2026-41195mosparo: Rule package source URL stored SSRF enables internal HTTP probingmosparo
- CVE-2026-44242Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Headermicronaut-projects micronaut-core · io.micronaut:micronaut-…
- CVE-2026-44259efw4.X: Stored XSS via previewServletefwGrp efw4.X
- CVE-2026-33570Subnet Solutions PowerSYSTEM Center Incorrect AuthorizationSubnet Solutions PowerSYSTEM Center
- CVE-2026-35504Subnet Solutions PowerSYSTEM Center CRLF injectionSubnet Solutions PowerSYSTEM Center
- CVE-2026-34672CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34671CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34669CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34678CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34688CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34680CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34668CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34673CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34667CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34670CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34679CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34666CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-34677CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials JS SDK · Adobe Content Credential…
- CVE-2026-44223vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parametersvllm-project vllm · vllm
- CVE-2026-44222vLLM: Remote DoS via Special-Token Placeholdersvllm-project vllm · vllm
- CVE-2026-44217sse-channel: SSE Injection via unsanitized event fieldsrexxars sse-channel · sse-channel
- CVE-2026-34656Adobe Commerce | Improper Authorization (CWE-285)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34658Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34685Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34655Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-34654Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-42338ip-address: XSS in Address6 HTML-emitting methodsbeaugunderson ip-address · ip-address
- CVE-2026-44219ciguard: SCA HTTP client reads response body without size capJo-Jo98 ciguard · ciguard
- CVE-2026-44218ciguard: Container image runs as root (no USER directive)Jo-Jo98 ciguard · ciguard
- CVE-2026-44220ciguard: discover_pipeline_files follows symlinks out of scan rootJo-Jo98 ciguard · ciguard
- CVE-2026-44215NanaZip: Heap out-of-bounds write in NanaZip UFS directory parserM2Team NanaZip
- CVE-2026-42445NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustionM2Team NanaZip
- CVE-2026-42444NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCountM2Team NanaZip
- CVE-2026-42443NanaZip: Integer divide-by-zero in NanaZip UFS inode offset calculationM2Team NanaZip
- CVE-2026-42442NanaZip: Null-pointer dereference in NanaZip UFS parser when root inode is a symlinkM2Team NanaZip
- CVE-2026-42355NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustionM2Team NanaZip
- CVE-2026-44873Insufficient Session Invalidation on User Account Deactivation in AOS-8 Operating SystemHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-42446NanaZip: Stack out-of-bounds read in NanaZip ZealFS bitmap parserM2Team NanaZip
- CVE-2026-44874Authenticated Arbitrary File Download via AOS-10 Web-Based Management InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking Wirel…
- CVE-2026-42191OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporteropen-telemetry opentelemetry-dotnet · OpenTelemetry.Exporte…
- CVE-2026-8052Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attackHashiCorp Shared library · github.com/hashicorp/nomad-drive…
- CVE-2026-6959Nomad vulnerable to arbitrary file read/write on client host through symlink attackHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2026-23822Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of ServiceHewlett Packard Enterprise (HPE) ArubaOS
- CVE-2026-34664Substance3D - Designer | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Substance 3D Designer
- CVE-2026-42348OpAMP client reads unbounded HTTP response bodiesopen-telemetry opentelemetry-dotnet-contrib · OpenTelemetry…
- CVE-2026-42541Kubewarden: RBAC Reconnaissance via unchecked can_i host capability callkubewarden-controller · github.com/kubewarden/kubewarden-co…
- CVE-2026-42175requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598saleor requests-hardened · requests-hardened
- CVE-2026-34662Illustrator | NULL Pointer Dereference (CWE-476)Adobe Illustrator Desktop
- CVE-2026-34663Illustrator | Out-of-bounds Read (CWE-125)Adobe Illustrator Desktop
- CVE-2026-44204Shelf: SQL Injection via sortBy ParameterShelf-nu shelf.nu
- CVE-2026-42303Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detectionethyca fides · ethyca-fides
- CVE-2026-5146Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or deletDevolutions Server
- CVE-2026-44166Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradepocketbase · github.com/pocketbase/pocketbase
- CVE-2026-42177linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are grantedsiemens linux-entra-sso
- CVE-2026-42838Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2026-40416Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-42830Azure Monitor Agent Metrics Extension Elevation of Privilege VulnerabilityMicrosoft Azure Monitor Agent Metrics Extension
- CVE-2026-41097Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-32209Windows Filtering Platform (WFP) Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-34339Windows Lightweight Directory Access Protocol (LDAP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-35429Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2026-42891Microsoft Edge (Chromium-based) for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2026-32175.NET Core Tampering VulnerabilityMicrosoft .NET · Microsoft Visual Studio +4
- CVE-2026-32185Microsoft Teams Spoofing VulnerabilityMicrosoft Teams for Android
- CVE-2026-32170Windows Rich Text Edit Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-41614M365 Copilot for Desktop Spoofing VulnerabilityMicrosoft M365 Copilot for Desktop
- CVE-2026-41612Visual Studio Code Information Disclosure VulnerabilityMicrosoft Visual Studio Code - Live Preview extension
- CVE-2026-41610Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-41100Microsoft 365 Copilot for Android Spoofing VulnerabilityMicrosoft 365 Copilot for Android · Microsoft Excel for… +4
- CVE-2026-40421Microsoft Word Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2026-40380Windows Volume Manager Extension Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-40374Microsoft Power Automate Desktop Information Disclosure VulnerabilityMicrosoft Power Automate for Desktop
- CVE-2026-35440Microsoft Word Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2026-35423Windows 11 Telnet Client Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-35422Windows TCP/IP Driver Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-35419Windows DWM Core Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-34350Windows Storport Miniport Driver Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2026-21530Windows Rich Text Edit Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2025-53870An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 througFortinet FortiAP · Fortinet FortiAP-W2
- CVE-2025-53680An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in FortinFortinet FortiAP-U · Fortinet FortiAP-W2 +1
- CVE-2025-67604A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2025-53681An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FoFortinet FortiMail
- CVE-2026-25690An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through Fortinet FortiDeceptor
- CVE-2026-44279An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allFortinet FortiTokenAndroid
- CVE-2026-44278A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions Fortinet FortiClientWindows
- CVE-2026-25088An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6Fortinet FortiNDR
- CVE-2026-42045LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)lobehub · @lobehub/lobehub
- CVE-2026-41513Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpointshorilla-hr
- CVE-2025-36515Uncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3: User Applications may allow an escalationAI Playground software
- CVE-2025-36510Improper buffer restrictions for some Display Virtualization for Windows OS driver software within Ring 2: Device Drivers may allow a denialDisplay Virtualization for Windows OS driver software
- CVE-2025-35991Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an information disclosure.Intel platforms
- CVE-2025-35979Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some Intel(R) Intel(R) Processors
- CVE-2025-35969Uncontrolled search path for some Intel(R) Server Firmware Update Utility Software before version 16.0.12.Intel(R) Server Firmware Update Utility Software
- CVE-2025-27723Use after free for some Linux kernel driver for the Intel(R) Ethernet 800 series before version 2.3.14 within Ring 0: Kernel may allow a denIntel(R) Ethernet 800 series
- CVE-2026-20914Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow Intel(R) QAT software drivers for Windows
- CVE-2026-20905Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow aIntel(R) QAT software drivers for Windows
- CVE-2026-20881Divide by zero for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial ofIntel(R) QAT software drivers for Windows
- CVE-2026-20793Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a dIntel(R) QAT software drivers for Windows
- CVE-2026-20782Buffer overflow for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial oIntel(R) QAT software drivers for Windows
- CVE-2026-20772Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.193 within Ring 3: UIntel(R) Connectivity Performance Suite software installers
- CVE-2026-20771Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow aIntel(R) QAT software drivers for Windows
- CVE-2026-20754Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service.Intel(R) NPU Drivers
- CVE-2026-20718Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring 3: User ApplicationsIntel(R) NPU Driver software installers
- CVE-2026-20717Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow Intel(R) QAT software drivers for Windows
- CVE-2026-40300Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/historyzulip
- CVE-2026-25431WordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerabilityWPMU DEV Hustle
- CVE-2026-8407Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions Devolutions Server
- CVE-2026-43514Apache Tomcat: AJP secret compared in non-constant timeApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-8109An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to ivanti Endpoint Manager
- CVE-2026-7431An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user toivanti Secure Access Client
- CVE-2026-8368LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirectsOALDERS LWP::UserAgent
- CVE-2026-5061Consul-template vulnerable to sandbox path bypass in file helper via a symlink attackHashiCorp Tooling
- CVE-2026-43930Parse Server: MFA SMS one-time password accepted twice under concurrent loginparse-community parse-server · parse-server
- CVE-2026-40638Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability.Dell PowerScale InsightIQ
- CVE-2026-42006An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.Open-Xchange OX Dovecot Pro
- CVE-2026-40020Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no.Open-Xchange OX Dovecot Pro
- CVE-2026-40016Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 Open-Xchange OX Dovecot Pro
- CVE-2026-33603Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.Open-Xchange OX Dovecot Pro
- CVE-2026-8391Other issue in the JavaScript Engine componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-8388Incorrect boundary conditions in the JavaScript Engine: JIT componentMozilla Firefox · Mozilla Thunderbird
- CVE-2026-45215WordPress WP EasyPay plugin <= 4.3.0 - Sensitive Data Exposure vulnerabilitySaad Iqbal WP EasyPay
- CVE-2026-45212WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerabilityGabe Livan Asset CleanUp: Page Speed Booster
- CVE-2026-45210WordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerabilityBroadstreet Ads
- CVE-2026-32684The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications Hikvision Hik-Connect APP
- CVE-2026-6813Continually <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' ParameterContinually
- CVE-2026-6800FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsFastBots
- CVE-2026-1934Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-41125A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (AllSiemens blueplanet 100 NX3 M8 · Siemens blueplanet 100… +20
- CVE-2025-40948A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGESiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX MX5… +9
- CVE-2024-54017A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +36
- CVE-2026-2300BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Blockbjornjohansen BJ Lazy Load
- CVE-2026-6247scratchblocks for WP <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attributetkc49 scratchblocks for WP
- CVE-2026-5028Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter10up Eight Day Week Print Workflow
- CVE-2026-7464WP Google Maps Integration <= 1.2 - Reflected Cross-Site Scripting via 'page' Parametertrapesium WP Google Maps Integration
- CVE-2026-6710Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Formdavidskysa Skysa Text Ticker App
- CVE-2026-6256Credits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attributejashjacob Credits Shortcode
- CVE-2026-6932Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Formhemant29 Woo Commerce Minimum Weight
- CVE-2026-5693Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellationzealopensource Smart Appointment & Booking
- CVE-2026-6709Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parametercoderpress Coinbase Commerce for Contact Form
- CVE-2026-7659Advanced Social Media Icons <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcoderiotweb Advanced Social Media Icons
- CVE-2026-5715Voyage Plus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcodescui2 Voyage Plus
- CVE-2026-4920Next Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attributejeremyshapiro Next Date
- CVE-2026-7616Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parametersaturngod Zawgyi Embed
- CVE-2026-7561Tm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptingtienrocker Tm – WordPress Redirection
- CVE-2026-7050Forms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameterrbplugins Forms Rb
- CVE-2026-4859SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attributesoftpulseinfotech SP Blog Designer
- CVE-2026-6237Quick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attributerdcravens Quick Table
- CVE-2026-6663GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agentthewebsitesupply GWD Conex
- CVE-2026-7437AzonPost <= 1.3 - Reflected Cross-Site Scriptingmoch-a AzonPost
- CVE-2026-7626Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fieldsqqqjus Slek Gateway for WooCommerce
- CVE-2026-3604WP SEO Structured Data Schema <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameterkcseopro WP SEO Structured Data Schema
- CVE-2026-7661Bootstrap Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcodeshamim_d Bootstrap Shortcode
- CVE-2026-7562WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Updatephkcorp2005 WP-Redirection
- CVE-2026-5340Fancy Image Show <= 9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesgopi_plus Fancy Image Show
- CVE-2026-4301Rate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parametervideowhisper Rate Star Review Vote – AJAX Reviews, Votes, S…
- CVE-2026-6808Pricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' Parameteroptimalplugins Pricing Tables for WP
- CVE-2026-6913Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attributepatilswapnilv Shortcodely
- CVE-2026-6708HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameterhigheredlab HEL Online Classroom: AI-powered Online Classro…
- CVE-2026-6402webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originswebpack-dev-server
- CVE-2026-1185A configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privileAxis Communications AB AXIS OS
- CVE-2026-0804An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escaAxis Communications AB AXIS OS
- CVE-2026-0802An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalatAxis Communications AB AXIS OS
- CVE-2026-0541ACAP applications can gain elevated privileges due to improper input validation during the installation process, potentially leading to privAxis Communications AB AXIS OS
- CVE-2026-1681net: Stack Overflow with Ping (to own IP Address) via Shellzephyrproject-rtos Zephyr
- CVE-2026-41530The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability.Chitora soft Lhaz · Chitora soft Lhaz+
- CVE-2026-7257** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firZyxel WRE6505 v2 firmware
- CVE-2026-7255** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web management interface oZyxel WRE6505 v2 firmware
- CVE-2026-40137Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)SAP_SE Business Server Pages Application
- CVE-2026-40136Denial of service (DoS) in SAP Financial ConsolidationSAP_SE SAP Financial Consolidation
- CVE-2026-40135OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2026-40134Missing Authorization Check in SAP Incentive and Commission ManagementSAP_SE SAP Incentive and Commission Management
- CVE-2026-40133Missing Authorization check in SAP S/4HANA Condition MaintenanceSAP_SE SAP S/4HANA Condition Maintenance
- CVE-2026-40132Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)SAP_SE SAP Strategic Enterprise Management
- CVE-2026-40131SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy librarySAP_SE SAP HANA Deployment Infrastructure (HDI) deploy libr…
- CVE-2026-40129Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP PlatformSAP_SE SAP Application Server ABAP for SAP NetWeaver and AB…
- CVE-2026-34258Content Spoofing vulnerability in SAPUI5 (Search UI)SAP_SE SAPUI5
- CVE-2026-27682Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)SAP_SE SAP NetWeaver Application Server ABAP
- CVE-2026-0502Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2026-45362Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.Sangoma Switchvox
- CVE-2023-30059An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation
- CVE-2025-70842A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3.
- CVE-2026-31241The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories).mem0ai
- CVE-2026-31243The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible vi
- CVE-2026-31244The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}).
- CVE-2026-31245The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories).mem0ai