CVEs published May 27, 2026
714 CVEs were published on May 27, 2026: 46 critical, 250 high. 1 is now in CISA KEV.
- Published
- 714
- Critical
- 46
- High
- 250
- Medium
- 199
- Low
- 9
- Unrated
- 210
- Now in CISA KEV
- 1
- Fix available
- 337
Most affected products
- Linux
- 275
- MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- 40
- mcdope pam_usb
- 15
- budibase · @budibase/server
- 10
- budibase
- 7
- free5gc · github.com/free5gc/nef
- 7
- GitLab
- 6
- Gladinet Triofox
- 6
- microsoft UFO
- 6
- Synology Surveillance Station
- 6
Critical 46
- CVE-2026-9739Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790).Google MCP Toolbox for Databases · github.com/googleapis/mc…
- CVE-2026-45083Goobi viewer: Unauthenticated Solr Streaming Expression Proxyintranda goobi-viewer-core · io.goobi.viewer:viewer-core
- CVE-2026-8362Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dllGladinet Triofox
- CVE-2026-8363Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dllGladinet Triofox
- CVE-2026-8364Gladinet Triofox Missing Authentication for Critical FunctionsGladinet Triofox
- CVE-2026-44590Sherlock: Command Injection via pull_request_target in validate_modified_targets.ymlsherlock-project sherlock
- CVE-2026-44887Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)leiweibau Pi.Alert
- CVE-2026-44888Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)leiweibau Pi.Alert
- CVE-2026-45102OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursiononeuptime
- CVE-2026-45087Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Modehahwul dalfox · github.com/hahwul/dalfox/v2 +1
- CVE-2026-46425Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant usersbudibase
- CVE-2026-48150Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignbudibase · @budibase/server
- CVE-2026-44315free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactionsfree5gc · github.com/free5gc/nef
- CVE-2026-48027Compromised Nx Console version 18.95.0nrwl nx-console
- CVE-2026-44326free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptionsfree5gc · github.com/free5gc/nef
- CVE-2026-44327free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handlerfree5gc · github.com/free5gc/nef
- CVE-2026-44329free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlersfree5gc · github.com/free5gc/smf
- CVE-2026-44330free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptionsfree5gc · github.com/free5gc/nef
- CVE-2026-49103Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component.Webmin
- CVE-2026-7876Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for IntegrationIBM Aspera HSTS for CP4I
- CVE-2026-8175Multiple vulnerabilities in Aspera applications.IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…
- CVE-2026-7524Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code ExecutionIBM Langflow OSS
- CVE-2026-46043RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcvLinux
- CVE-2026-46039rxgk: Fix potential integer overflow in length checkLinux
- CVE-2026-45988rxrpc: Fix re-decryption of RESPONSE packetsLinux
- CVE-2026-35090Authentication Bypass in Slican telephone exchangesSlican CCT-1668 · Slican MAC-6400 +3
- CVE-2026-35087Authentication Bypass in Slican telephone exchangesSlican IPx · Slican CCT-1668 +3
- CVE-2026-45972smb: client: fix potential UAF and double free in smb2_open_file()Linux
- CVE-2026-45898RDMA/iwcm: Fix workqueue list corruption by removing work_listLinux
- CVE-2026-42761WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerabilityRealMag777 Active Products Tables for WooCommerce
- CVE-2026-42758WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerabilitySaleswonder Team: Tobias WebinarIgnition
- CVE-2026-42757WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerabilitySaleswonder Team: Tobias WebinarIgnition
- CVE-2026-42756WordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion vulnerabilityLudwig You QuickWebP – Compress / Optimize Images &am…
- CVE-2026-42755WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerabilityRealMag777 TableOn
- CVE-2026-42748WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerabilityWPify Woo Czech
- CVE-2026-42747WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerabilityhassantafreshi Easy Form Builder
- CVE-2026-42740WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerabilityTainacan
- CVE-2026-42727WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerabilityRealMag777 Active Products Tables for WooCommerce
- CVE-2026-42731WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerabilityminiorange otp verification
- CVE-2026-48906Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomlatassos.gr Novarain/Tassos Framework · tassos.gr Convert… +6
- CVE-2025-12686Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-6Synology BeeStation OS
- CVE-2026-49002Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE productZTE ZXUniPOS NDS-LTE
- CVE-2026-8054Unauthenticated SQL Injection in dotCMS Publish Audit APIdotCMS Core
- CVE-2026-8760Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Forceindia-web-developer Login with OTP
- CVE-2026-8450HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()OALDERS HTTP::Daemon
- CVE-2026-9312Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpointGitHub Enterprise Server
High 250
- CVE-2026-46414Microsoft UFO WebSocket role spoofing allows authenticated peer task hijackingmicrosoft UFO
- CVE-2026-46402Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directorymicrosoft UFO
- CVE-2026-45322OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSONmicrosoft UFO
- CVE-2026-45152uniget: Command Injection in tool.Check Leading to Arbitrary Code Executionuniget-org cli · gitlab.com/uniget-org/cli
- CVE-2026-9208Tanium addressed an unauthorized code execution vulnerability in Connect.Tanium Connect
- CVE-2026-45137Anchor: Program<'info, System> is not properly validatedsolana-foundation anchor · anchor-lang
- CVE-2026-45136claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.shcnighswonger claude-code-cache-fix · claude-code-cache-fix
- CVE-2026-44660UltraJSON: Memory Leak in ujson.dump() on Write Failureultrajson · ujson
- CVE-2026-44712pam_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agentmcdope pam_usb
- CVE-2026-44709pam_usb: PINENTRY_FALLBACK_APP environment variable allows arbitrary command executionmcdope pam_usb
- CVE-2026-44711pam_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruptionmcdope pam_usb
- CVE-2026-44713pam_usb: Command injection via $TMUX environment variable leads to RCE as rootmcdope pam_usb
- CVE-2026-47269pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as localmcdope pam_usb
- CVE-2026-47272pam_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffermcdope pam_usb
- CVE-2026-48064pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypassmcdope pam_usb
- CVE-2026-8359Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoSGladinet Triofox
- CVE-2026-8360Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOSGladinet Triofox
- CVE-2026-8361Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dllGladinet Triofox
- CVE-2026-45134LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warninglangchain-ai langsmith-sdk · langsmith +2
- CVE-2026-44724systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile namesebhildebrandt systeminformation · systeminformation
- CVE-2026-44886Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injectionleiweibau Pi.Alert
- CVE-2026-45108Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flowhimmelblau-idm himmelblau
- CVE-2026-45104MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`MapServer
- CVE-2026-47161RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserializationinducer relate
- CVE-2026-42197RELATE Vulnerable to Stored XSS via Unprivileged User Profileinducer relate
- CVE-2026-44635Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`kysely-org kysely · kysely
- CVE-2026-4868Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-45088Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server Modehahwul dalfox · github.com/hahwul/dalfox +1
- CVE-2026-45089Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Modehahwul dalfox · github.com/hahwul/dalfox +1
- CVE-2026-45090Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)hahwul dalfox · github.com/hahwul/dalfox +1
- CVE-2026-42553Cinny: Access token disclosure via invalidated emoji pack avatar URL in service workercinnyapp cinny · cinny
- CVE-2026-5509Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200TP-Link Systems Archer BE7200 · TP-Link Systems Archer BE450
- CVE-2026-44345BentoML: Dockerfile command injection via docker.base_imageBentoML
- CVE-2026-44346BentoML: Dockerfile command injection via envs[*].name in bentofile.yamlBentoML
- CVE-2026-44521elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)Studio-42 elFinder · studio-42/elfinder
- CVE-2026-45548Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validationbudibase · @budibase/server
- CVE-2026-45715Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integrationbudibase · @budibase/server
- CVE-2026-45716Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configurationbudibase · @budibase/worker
- CVE-2026-45717Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL.budibase · @budibase/server
- CVE-2026-46426Budibase: Unrestricted Upload of File with Dangerous Typebudibase
- CVE-2026-46427Budibase: Snowflake private key returned unmasked from datasource API to BASIC usersbudibase
- CVE-2026-48146Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protectionbudibase · @budibase/server
- CVE-2026-48149Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypassbudibase
- CVE-2026-48151Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schemabudibase · @budibase/server
- CVE-2026-48152Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLbudibase · @budibase/server
- CVE-2026-48153Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadatabudibase · @budibase/server
- CVE-2026-45061Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)budibase
- CVE-2026-44460FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secreterror311 FileRise
- CVE-2026-45047bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decodingxddxdd bird-lg-go · github.com/xddxdd/bird-lg-go
- CVE-2026-42083free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPIfree5gc · github.com/free5gc/pcf
- CVE-2026-42459free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udmfree5gc · github.com/free5gc/udm
- CVE-2026-44316free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereferencefree5gc · github.com/free5gc/pcf
- CVE-2026-44319free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)free5gc · github.com/free5gc/nef
- CVE-2026-44320free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing pathfree5gc · github.com/free5gc/nef
- CVE-2026-44321free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)free5gc · github.com/free5gc/smf
- CVE-2026-44322free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereferencefree5gc · github.com/free5gc/nef
- CVE-2026-44325free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)free5gc · github.com/free5gc/nrf
- CVE-2026-44328free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutatingfree5gc · github.com/free5gc/smf
- CVE-2026-44483RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)airjp73 rvf · @rvf set-get +1
- CVE-2026-44473Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponseellanetworks core · github.com/ellanetworks/core
- CVE-2026-42790nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verificationErlang OTP
- CVE-2026-48545Gradio < 6.15.0 Cookie Injection via Shared Proxy Clientgradio-app gradio · gradio
- CVE-2026-45022go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Gitgo-git · github.com/go-git/go-git/v5 +1
- CVE-2026-49046WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerabilityArjun Thakur Duplicate Page and Post
- CVE-2026-44902opentelemetry-js: Prometheus exporter process crash via malformed HTTP requestopen-telemetry opentelemetry-js · @opentelemetry exporte… +5
- CVE-2026-44971GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltrationDataDog guarddog · guarddog
- CVE-2026-42280Improper Permission Checking in Auth.js SDKauth0.js · auth0-js
- CVE-2026-48544Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()Avaiga taipy · taipy
- CVE-2026-44988LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writeslibvncserver
- CVE-2026-6957Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write.Mattermost
- CVE-2026-47118Agent Zero < 1.15 Path Traversal File Read via image_get API3clyp50 agent-zero
- CVE-2026-44830Empty API_TOKEN disables authentication on network-reachable HTTP/SSE transportDataojitori nocturne_memory
- CVE-2026-48922Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, aJenkins Project Jenkins Credentials Binding Plugin · org.je…
- CVE-2026-48921Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aJenkins Project Jenkins Pipeline: Groovy Libraries Plugin ·…
- CVE-2026-48920Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlinJenkins Project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2026-7365IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installationIBM Operations Analytics - Log Analysis
- CVE-2024-56462IBM QRadar SIEM is vulnerable to using components with known vulnerabilitiesIBM QRadar
- CVE-2026-8180Multiple vulnerabilities in Aspera applications.IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…
- CVE-2026-48972WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerabilitySeedProd Pro
- CVE-2026-8179Multiple vulnerabilities in Aspera applications.IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…
- CVE-2026-7528Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSSIBM Langflow OSS
- CVE-2026-46102net: strparser: fix skb_head leak in strp_abort_strp()Linux
- CVE-2026-46100fs: afs: revert mmap_prepare() changeLinux
- CVE-2026-46099net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnelsLinux
- CVE-2026-46093mm/vmalloc: take vmap_purge_lock in shrinkerLinux
- CVE-2026-46090ALSA: aloop: Fix peer runtime UAF during format-change stopLinux
- CVE-2026-46085rxrpc: Fix rxkad crypto unalignment handlingLinux
- CVE-2026-46081crypto: acomp - fix wrong pointer stored by acomp_save_req()Linux
- CVE-2026-46078erofs: fix the out-of-bounds nameoff handling for trailing direntsLinux
- CVE-2026-46076KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1Linux
- CVE-2026-46070md/raid5: validate payload size before accessing journal metadataLinux
- CVE-2026-46065fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_infoLinux
- CVE-2026-46062ntfs3: fix integer overflow in run_unpack() volume boundary checkLinux
- CVE-2026-46058media: amphion: Fix race between m2m job_abort and device_runLinux
- CVE-2026-46056Bluetooth: hci_event: fix potential UAF in SSP passkey handlersLinux
- CVE-2026-46055apparmor: Fix string overrun due to missing terminationLinux
- CVE-2026-46054selinux: fix overlayfs mmap() and mprotect() access checksLinux
- CVE-2026-46053net: rds: fix MR cleanup on copy errorLinux
- CVE-2026-46052ceph: only d_add() negative dentries when they are unhashedLinux
- CVE-2026-5065IBM Controller is affected by vulnerabilitiesIBM Controller
- CVE-2026-46037ipv4: icmp: validate reply type before using icmp_pointersLinux
- CVE-2026-46036vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutexLinux
- CVE-2026-46033crypto: authencesn - reject short ahash digests during instance creationLinux
- CVE-2026-46031net: ks8851: Reinstate disabling of BHs around IRQ handlerLinux
- CVE-2026-46029mm/slab: return NULL early from kmalloc_nolock() in NMI on UPLinux
- CVE-2026-46027net/smc: avoid early lgr access in smc_clc_wait_msgLinux
- CVE-2026-46024libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()Linux
- CVE-2026-46015tcp: call sk_data_ready() after listener migrationLinux
- CVE-2026-46011media: mtk-jpeg: fix use-after-free in release path due to uncancelled workLinux
- CVE-2026-46010rxrpc: Fix error handling in rxgk_extract_token()Linux
- CVE-2026-46006drm/nouveau: fix u32 overflow in pushbuf reloc bounds checkLinux
- CVE-2026-45999erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()Linux
- CVE-2026-45998rxrpc: Fix potential UAF after skb_unshare() failureLinux
- CVE-2026-45991udf: fix partition descriptor append bookkeepingLinux
- CVE-2026-3623Vulnerabilities exists in IBM Netezza Performance Server Replication ServicesIBM Netezza Performance Server Replication Services
- CVE-2026-35089Use of Weak Credentials in Slican telephone exchangesSlican IPx · Slican CCT-1668 +2
- CVE-2026-1933Samba: missing access check on reparse point operationsRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-3366InfoSphere Optim Test Data Fabrication is affected by Arbitrary File ReadIBM InfoSphere Optim Test Data Fabrication
- CVE-2025-71311fs/ntfs3: Initialize new folios before useLinux
- CVE-2026-42789Non-CA certificate accepted as intermediate issuer in public_key path validationErlang OTP
- CVE-2026-45984gfs2: Fix use-after-free in iomap inline data write pathLinux
- CVE-2026-1718IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedureIBM Db2
- CVE-2026-45980accel/amdxdna: Stop job scheduling across aie2_release_resource()Linux
- CVE-2026-45970bonding: alb: fix UAF in rlb_arp_recv during bond up/downLinux
- CVE-2026-45959crypto: ccp - Fix a crash due to incorrect cleanup usage of kfreeLinux
- CVE-2026-45958drm/exynos: vidi: fix to avoid directly dereferencing user pointerLinux
- CVE-2026-45956drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()Linux
- CVE-2026-45955md/md-llbitmap: fix percpu_ref not resurrected on suspend timeoutLinux
- CVE-2026-45951bpf: Fix a potential use-after-free of BTF objectLinux
- CVE-2026-45945iommu/vt-d: Fix race condition during PASID entry replacementLinux
- CVE-2026-45944iommu/vt-d: Clear Present bit before tearing down context entryLinux
- CVE-2026-45942ext4: fix e4b bitmap inconsistency reportsLinux
- CVE-2026-45935fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRootLinux
- CVE-2026-45933bpf: Preserve id of register in sync_linked_regs()Linux
- CVE-2026-45932bpf: Fix tcx/netkit detach permissions when prog fd isn't givenLinux
- CVE-2026-45931accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()Linux
- CVE-2026-45929ovpn: fix possible use-after-free in ovpn_net_xmitLinux
- CVE-2026-45910RDMA/rxe: Fix race condition in QP timer handlersLinux
- CVE-2026-45909clk: mediatek: Drop __initconst from gatesLinux
- CVE-2026-45894iommu/vt-d: Clear Present bit before tearing down PASID entryLinux
- CVE-2026-45878drm/amdkfd: Fix watch_id bounds checking in debug address watch v2Linux
- CVE-2026-45862iommu/vt-d: Flush cache for PASID table before using itLinux
- CVE-2026-45861gfs2: Fix slab-use-after-free in qd_putLinux
- CVE-2026-45860netfilter: nf_conncount: increase the connection clean up limit to 64Linux
- CVE-2026-45859netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentationLinux
- CVE-2026-45856RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_sendLinux
- CVE-2026-45852RDMA/rxe: Fix double free in rxe_srq_from_initLinux
- CVE-2026-3012Samba: group policy certificate enrollment uses http:// without validationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-42762WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2026-42760WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerabilityrevmakx Backup and Staging by WP Time Capsule
- CVE-2026-42759WordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityTimo Affiliate Super Assistent
- CVE-2026-42754WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerabilityphbernard Favicon
- CVE-2026-42753WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-42749WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerabilityThemeisle Disable Comments for Any Post Types
- CVE-2026-42746WordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerabilityZAYTECH Smart Online Order for Clover
- CVE-2026-42745WordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerabilityZAYTECH Smart Online Order for Clover
- CVE-2026-42739WordPress Advanced IP Blocker plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerabilityIniLerm Advanced IP Blocker
- CVE-2026-42738WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilityZAYTECH Smart Online Order for Clover
- CVE-2026-42737WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerabilitye4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2026-42736WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerabilitywordplus BP Better Messages
- CVE-2026-42735WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerabilityIqonic Design KiviCare
- CVE-2026-42728WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilityHT Plugins HT Contact Form
- CVE-2026-42730WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerabilityStylemix MasterStudy LMS
- CVE-2026-42733WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityRealMag777 WPCS
- CVE-2026-42729WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityProperty Hive PropertyHive
- CVE-2026-42734WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-45843slip: bound decode() reads against the compressed packet lengthLinux
- CVE-2025-30028A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.Synology Active Backup for Business
- CVE-2025-52747WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityJthemes Themebox - Digital Products Ecommerce
- CVE-2025-14713An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote atSynology C2 Identity Edge Server
- CVE-2025-13392Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3Synology DiskStation Manager
- CVE-2025-22741WordPress Felan Framework plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityRiceTheme Felan Framework
- CVE-2023-52945Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local useSynology BeeDrive for desktop
- CVE-2026-40852Command injection via malicious configurationMB connect line mbNET/mbNET.rokey · MB connect line mbNE… +2
- CVE-2026-40851Command injection via USBMB connect line mbNET/mbNET.rokey · MB connect line mbNE… +2
- CVE-2026-40850Unauthenticated SQLi in getAccountData functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40849Authenticated SQLi in user_alarmprofile viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40848Authenticated SQLi in tag viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40847Authenticated SQLi in system_tag viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40846Authenticated SQLi in system viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40845Authenticated SQLi in devices_configuration viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40844Authenticated SQLi in dashboard viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40843Authenticated SQLi in alarming viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40842Authenticated SQLi in getWidgetTags functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40841Authenticated SQLi in getProjectTags functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40840Authenticated SQLi in VerifyCreateLicences functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40839Authenticated SQLi in getComponentScalings functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40838Authenticated SQLi in getDeviceScalings functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40837Authenticated SQLi in getProjectScalings functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40836Authenticated SQLi in inmessage modelMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40835Authenticated SQLi in saveObjectFromData functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40834Authenticated SQLi in saveDashboardLayout functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40833Authenticated SQLi in saveDashboardLayout functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40832Authenticated SQLi in getDevicegroups functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40831Authenticated SQLi in Easy ViewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40830Authenticated SQLi in UpdateParam functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40829Authenticated SQLi in UpdateParam functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40828Authenticated SQLi in DeleteSysLogEntry functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40827Authenticated SQLi in _RemoveRequest functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40825Authenticated SQLi in accountstatus viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40824Authenticated SQLi in accountstatus viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40823Authenticated SQLi in DevSerialReset functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40819Unauthenticated SQLi in sync_data24 taskMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40818Unauthenticated SQLi in _mb24confi_getDevice function functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40817Unauthenticated SQLi in getAlarmProfiles functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40816Unauthenticated SQLi in _mb24confi_getTagAlarm functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40815Unauthenticated SQLi in _mb24api_getUserAccount functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40814Unauthenticated SQLi in _mb24confi_getTagAlarm functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-3375LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpointslitespeedtech LiteSpeed Cache
- CVE-2026-40813Unauthenticated SQLi in getLiveValuesMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40812Unauthenticated SQLi in getLiveValues functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40811Unauthenticated SQLi in ssoabstractserviceMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40810Unauthenticated SQLi in userinfo EndpointMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2025-41669Insufficient Verification of Data AuthenticityPhoenix Contact AXC F · Phoenix Contact BPC +4
- CVE-2025-41670Untrusted Search PathPhoenix Contact AXC F · Phoenix Contact BPC +4
- CVE-2026-8143Booking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parametersomnivo Booking Calendar – Event Calendar
- CVE-2026-6169affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Executioncservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2026-8832WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPostsmub WPCode – Insert Headers and Footers + Custom Code Snip…
- CVE-2026-6268EventPress < 22.2 – Reflected Cross-Site ScriptingEventPress
- CVE-2026-8994Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameterlearnnearclub Login with NEAR
- CVE-2026-8787Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationdevsabbirahmed Firebase Support & Chat Management
- CVE-2026-9200Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attributeshazdeh Query Shortcode
- CVE-2026-49000Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE productZTE ZXUniPOS NDS-LTE
- CVE-2026-48962IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output globPMQS IO::Compress
- CVE-2026-2253Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity ReferenceHitachi Vantara Pentaho Data Integration and Analytics
- CVE-2026-48961IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GIDPMQS IO::Compress
- CVE-2026-48959IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForwardPMQS IO::Uncompress::Unzip
- CVE-2026-49017In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request boOpenStack Swift · swift
- CVE-2026-49014In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow.GDAL
- CVE-2026-9632UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflowUTT HiPER 1250GW
- CVE-2026-9207Tanium addressed an unauthorized code execution vulnerability in Connect.Tanium Connect
- CVE-2026-9631UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflowUTT HiPER 1250GW
- CVE-2026-9628UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflowUTT HiPER 1200GW
- CVE-2026-9627UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflowUTT HiPER 1200GW
- CVE-2025-69600Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getco
- CVE-2025-70103Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/de
- CVE-2026-31266Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).
- CVE-2026-36044@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool.
- CVE-2026-36045picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go).github.com/sipeed/picoclaw
- CVE-2026-36538Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample.
- CVE-2026-36539Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configuration as a JSON resp
- CVE-2026-36540Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint.
- CVE-2026-37711An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/
- CVE-2026-37712An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/
- CVE-2026-37713An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/
- CVE-2026-38422Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the tasmota/ta
- CVE-2026-38426Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_sc
- CVE-2026-38427An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow.
- CVE-2026-38807Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component
- CVE-2026-38945Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path
Medium, low and unrated 418
- CVE-2026-4888Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sendingwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-46538Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injectionmicrosoft UFO
- CVE-2026-46416Microsoft UFO shared WebSocket handler state causes cross-client response hijackingmicrosoft UFO
- CVE-2026-46544Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requestersmicrosoft UFO
- CVE-2026-44720OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeoverth30d4y OpenLearnX · openlearnx
- CVE-2026-44247Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body sizevolcano-sh volcano · volcano.sh/volcano
- CVE-2026-44710pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-servicemcdope pam_usb
- CVE-2026-21785HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security PolicyHCLSoftware BigFix Remote Control Server
- CVE-2026-47270pam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote resultmcdope pam_usb
- CVE-2026-47271pam_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crashmcdope pam_usb
- CVE-2026-47273pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriesmcdope pam_usb
- CVE-2026-47274pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulationmcdope pam_usb
- CVE-2026-48065pam_usb: Unchecked integer multiplication before xmalloc() in conf.c allows heap-based buffer overflow on 32-bit targetsmcdope pam_usb
- CVE-2026-48066pam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authenticationmcdope pam_usb
- CVE-2026-48792pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root executionmcdope pam_usb
- CVE-2026-44681Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorizationauthlib
- CVE-2026-42877FacturaScripts: Stored XSS via product reference in sales/purchasesNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-9759NULL Pointer Dereference in WiresharkWireshark Foundation Wireshark
- CVE-2026-42879FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-42878FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsNeoRazorX facturascripts · facturascripts/facturascripts
- CVE-2026-45046Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Contentsafedep gryph · github.com/safedep/gryph
- CVE-2026-1402Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-2601Missing Authorization in GitLabGitLab
- CVE-2026-5296Missing Authorization in GitLabGitLab
- CVE-2026-6713Incorrect Authorization in GitLabGitLab
- CVE-2026-8716Use of Incorrectly-Resolved Name or Reference in GitLabGitLab
- CVE-2026-45081Frappe HR: Permission Bypass in HRMS Leave Details APIfrappe hrms
- CVE-2026-48147Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Workerbudibase · @budibase/backend-core
- CVE-2026-48148Budibase: Unvalidated VectorDB Host Parameter Enables SSRFbudibase · @budibase/server
- CVE-2026-45718Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rowsbudibase
- CVE-2026-45719Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views APIbudibase · @budibase/server
- CVE-2026-46424Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hourbudibase · @budibase/backend-core
- CVE-2026-48128Budibase: SSRF via User-Controlled queryId in Automation Execute Query Stepbudibase
- CVE-2026-4392TeamSpeak 3 Server clientek Handshake assertionTeamSpeak 3 Server
- CVE-2026-4391TeamSpeak 3 Server ECC Key heap-based overflowTeamSpeak 3 Server
- CVE-2026-44378Botan: Quadratic complexity decoding BER indefinite length encodingsrandombit botan
- CVE-2026-42328go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depthgo-ipld-prime · github.com/ipld/go-ipld-prime
- CVE-2026-4390TeamSpeak 3 Server Connection State Management process_resend_queue use after freeTeamSpeak 3 Server
- CVE-2026-42081free5GC: UE Security Capability bypass on NGAP PathSwitchRequestfree5gc · github.com/free5gc/amf
- CVE-2026-42082free5GC: Missing Concurrent NAS SMC Validation During NGAP Handoverfree5gc · github.com/free5gc/amf
- CVE-2026-44317free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereferencefree5gc · github.com/free5gc/pcf
- CVE-2026-44323free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)free5gc · github.com/free5gc/udr
- CVE-2026-44324free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)free5gc · github.com/free5gc/udr
- CVE-2026-44318free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptionsfree5gc · github.com/free5gc/bsf
- CVE-2022-41656WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerabilityBizswoop Account Manager for WooCommerce
- CVE-2026-45335WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPageLabRedesCefetRJ WeGIA
- CVE-2026-45027WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.phpLabRedesCefetRJ WeGIA
- CVE-2026-44475Ella Core: UE Security Capability bypass on NGAP PathSwitchRequestellanetworks core · github.com/ellanetworks/core
- CVE-2026-44474Ella Core: Handover failures during concurrent Security Mode Commandellanetworks core · github.com/ellanetworks/core
- CVE-2026-49054WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerabilityMamunur Rashid The Post Grid
- CVE-2026-44353Streamlink: Arbitrary local file read via file:// URI in HLS and DASHstreamlink
- CVE-2026-44839RabbitMQ: Unsanitized vhost names allow for XSS in management UIrabbitmq-server
- CVE-2026-44838RabbitMQ MQTT Topic Permission Authorization Bypassrabbitmq-server
- CVE-2026-45570go-git: Improper single-quote escaping in go-git SSH transportgo-git · github.com/go-git/go-git +2
- CVE-2026-49053WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerabilityWpmet ElementsKit Elementor addons Lite
- CVE-2026-45571go-git: Crafted repositories may modify main and submodule .git directoriesgo-git · github.com/go-git/go-git/v5 +2
- CVE-2026-49052WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerabilityWpmet ElementsKit Elementor addons Lite
- CVE-2026-49051WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerabilityPrasad Kirpekar WP Meta and Date Remover
- CVE-2026-49047WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerabilityDearHive DearFlip
- CVE-2026-49044WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerabilityJustin Kruit Advanced Custom Fields: Font Awesome Field
- CVE-2026-49045WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerabilityWP Media Adminimize
- CVE-2026-44972GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package contentDataDog guarddog · guarddog
- CVE-2026-9712Insecure direct object referencepretix
- CVE-2026-49059WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerabilityFacebook for WooCommerce
- CVE-2026-49102Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/Webmin
- CVE-2026-42184Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commandstauri-apps tauri · tauri
- CVE-2026-48973WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerabilityBenbodhi SVG Support
- CVE-2026-47119Agent Zero < 1.15 Stored XSS via image_get API Endpointagent0ai agent-zero
- CVE-2026-1248IBM Business Automation Workflow information leakIBM Business Automation Workflow containers and traditional
- CVE-2026-9674A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b_b_d and earlier allows attackers to resume failJenkins Project Jenkins Multijob Plugin · org.jenkins-ci.pl…
- CVE-2026-48927Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerabilityJenkins Project Jenkins buildgraph-view Plugin · org.jenkin…
- CVE-2026-48926Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with OJenkins Project Jenkins Job Import Plugin · org.jenkins-ci.…
- CVE-2026-48925A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to trJenkins Project Jenkins GitHub Integration Plugin · org.jen…
- CVE-2026-48924Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacJenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…
- CVE-2026-48923Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackersJenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…
- CVE-2026-48919Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.Jenkins Project Jenkins Active Directory Plugin · org.jenki…
- CVE-2026-48918Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.Jenkins Project Jenkins Active Directory Plugin · org.jenki…
- CVE-2026-48917Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…
- CVE-2026-48916Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…
- CVE-2026-9617PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() functionDALIBO PostgreSQL Anonymizer
- CVE-2024-40684IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout MechanismIBM Operations Analytics - Log Analysis
- CVE-2024-28765Security vulnerability was found in IBM Security Directory IntegratorIBM SDI · IBM Security Directory Integrator
- CVE-2026-9035Multiple vulnerabilities in Aspera applications.IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…
- CVE-2026-23679libusb < 1.0.30 NULL Pointer Dereference in parse_interface()libusb
- CVE-2026-8405IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerabilityIBM Guardium Data Protection
- CVE-2026-47104libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array()libusb
- CVE-2026-7254Open BMC Denial of ServiceIBM OPENBMC
- CVE-2026-6938IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special queryIBM Db2
- CVE-2026-6936IBM i is Affected by a Denial of Service Vulnerability []IBM i
- CVE-2026-6053IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tablesIBM Db2
- CVE-2026-6052IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tablesIBM Db2
- CVE-2026-6051IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heapIBM Db2
- CVE-2026-5516IBM WebSphere Application Server Liberty is affected by a security bypass vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-46103can: ucan: fix devres lifetimeLinux
- CVE-2026-46101netfilter: reject zero shift in nft_bitwiseLinux
- CVE-2026-46098net: caif: clear client service pointer on teardownLinux
- CVE-2026-46097Input: edt-ft5x06 - fix use-after-free in debugfs teardownLinux
- CVE-2026-46096tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()Linux
- CVE-2026-46095md/md-llbitmap: raise barrier before state machine transitionLinux
- CVE-2026-46094ext4: fix bounds check in check_xattrs() to prevent out-of-bounds accessLinux
- CVE-2026-46092wifi: rtw88: check for PCI upstream bridge existenceLinux
- CVE-2026-46091media: rc: igorplugusb: heed coherency rulesLinux
- CVE-2026-46089zram: do not forget to endio for partial discard requestsLinux
- CVE-2026-46088ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()Linux
- CVE-2026-46087mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start()Linux
- CVE-2026-46086net: bridge: use a stable FDB dst snapshot in RCU readersLinux
- CVE-2026-46084RDMA/mana_ib: Disable RX steering on RSS QP destroyLinux
- CVE-2026-46083spi: fix resource leaks on device setup failureLinux
- CVE-2026-46082KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0Linux
- CVE-2026-46080ocfs2: split transactions in dio completion to avoid credit exhaustionLinux
- CVE-2026-46079rbd: fix null-ptr-deref when device_add_disk() failsLinux
- CVE-2026-5515IBM App Connect Enterprise is vulnerable to a confidential disclosureIBM App Connect Enterprise
- CVE-2026-46077crypto: atmel-tdes - fix DMA sync directionLinux
- CVE-2026-46075crypto: atmel-sha204a - Fix potential UAF and memory leak in remove pathLinux
- CVE-2026-46074spi: ch341: fix memory leaks on probe failuresLinux
- CVE-2026-46073hwmon: (powerz) Fix missing usb_kill_urb() on signal interruptLinux
- CVE-2026-46072ntfs3: add buffer boundary checks to run_unpack()Linux
- CVE-2026-46071KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12Linux
- CVE-2026-46069wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()Linux
- CVE-2026-46068crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctxLinux
- CVE-2026-46067mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bpLinux
- CVE-2026-46066ceph: fix num_ops off-by-one when crypto allocation failsLinux
- CVE-2026-46064ibmasm: fix heap over-read in ibmasm_send_i2o_message()Linux
- CVE-2026-46063x86/shstk: Prevent deadlock during shstk sigreturnLinux
- CVE-2026-46061jbd2: fix deadlock in jbd2_journal_cancel_revoke()Linux
- CVE-2026-46060crypto: qat - fix IRQ cleanup on 6xxx probe failureLinux
- CVE-2026-46059KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUNLinux
- CVE-2026-46057landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()Linux
- CVE-2026-46051md/raid5: fix soft lockup in retry_aligned_read()Linux
- CVE-2026-46050md/raid10: fix deadlock with check operation and nowait requestsLinux
- CVE-2026-46049ALSA: ctxfi: Add fallback to default RSR for S/PDIFLinux
- CVE-2026-46048ALSA: caiaq: fix usb_dev refcount leak on probe failureLinux
- CVE-2026-46047net: qrtr: ns: Fix use-after-free in driver remove()Linux
- CVE-2026-46046ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()Linux
- CVE-2026-46045md/md-llbitmap: skip reading rdevs that are not in_syncLinux
- CVE-2026-46044ipmi:ssif: Clean up kthread on errorsLinux
- CVE-2026-46042mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()Linux
- CVE-2026-46041greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()Linux
- CVE-2026-46040inotify: fix watch count leak when fsnotify_add_inode_mark_locked() failsLinux
- CVE-2026-46038net: qrtr: ns: Free the node during ctrl_cmd_bye()Linux
- CVE-2026-46035mm/page_alloc: return NULL early from alloc_frozen_pages_nolock() in NMI on UPLinux
- CVE-2026-46034vfio/cdx: Fix NULL pointer dereference in interrupt trigger pathLinux
- CVE-2026-46032KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXITLinux
- CVE-2026-46030EDAC/versalnet: Fix device_node leak in mc_probe()Linux
- CVE-2026-46028crypto: algif_aead - snapshot IV for async AEAD requestsLinux
- CVE-2026-46026net: qrtr: ns: Limit the maximum number of lookupsLinux
- CVE-2026-46025mm/damon/core: fix damon_call() vs kdamond_fn() exit raceLinux
- CVE-2026-46023dm mirror: fix integer overflow in create_dirty_log()Linux
- CVE-2026-46022misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt()Linux
- CVE-2026-46021thermal: core: Fix thermal zone governor cleanup issuesLinux
- CVE-2026-46020mm/damon/core: validate damos_quota_goal->nid for node_mem_{used,free}_bpLinux
- CVE-2026-46019crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanupLinux
- CVE-2026-46018ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATESLinux
- CVE-2026-46017mm: fix deferred split queue races during migrationLinux
- CVE-2026-46016remoteproc: xlnx: Only access buffer information if IPI is bufferedLinux
- CVE-2026-46014KVM: SVM: Add missing save/restore handling of LBR MSRsLinux
- CVE-2026-46013mm/memfd_luo: fix physical address conversion in put_folios cleanupLinux
- CVE-2026-46012rxrpc: Fix memory leaks in rxkad_verify_response()Linux
- CVE-2026-46009PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardownLinux
- CVE-2026-46008mm/damon/core: fix damos_walk() vs kdamond_fn() exit raceLinux
- CVE-2026-46007hwmon: (powerz) Avoid cacheline sharing for DMA bufferLinux
- CVE-2026-46005xfs: fix a resource leak in xfs_alloc_buftarg()Linux
- CVE-2026-46004ALSA: caiaq: Handle probe errors properlyLinux
- CVE-2026-9704Keycloak: keycloak: privilege escalation due to oversized subject_token jwtRed Hat build of Keycloak · org.keycloak:keycloak-server… +1
- CVE-2026-46003net: qrtr: ns: Limit the total number of nodesLinux
- CVE-2026-46002ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()Linux
- CVE-2026-46001hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data()Linux
- CVE-2026-46000rxrpc: Fix conn-level packet handling to unshare RESPONSE packetsLinux
- CVE-2026-45997scsi: sd: fix missing put_disk() when device_add(&disk_dev) failsLinux
- CVE-2026-45996spi: imx: fix use-after-free on unbindLinux
- CVE-2026-45995io_uring/zcrx: fix user_struct uafLinux
- CVE-2026-45994ibmasm: fix OOB reads in command_file_write due to missing size checksLinux
- CVE-2026-45993LoongArch: Add spectre boundry for syscall dispatch tableLinux
- CVE-2026-45990slub: fix data loss and overflow in krealloc()Linux
- CVE-2026-45989of: unittest: fix use-after-free in testdrv_probe()Linux
- CVE-2026-45987KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2Linux
- CVE-2026-45986crypto: ccree - fix a memory leak in cc_mac_digest()Linux
- CVE-2026-4410IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of serviceIBM WebSphere Application Server - Liberty · IBM WebSphere…
- CVE-2026-3676There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products.IBM Cloud APM, Base Private · IBM Cloud APM, Advanced Priva…
- CVE-2025-71312fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()Linux
- CVE-2026-42791OCSP responder certificate validity period not checked in public_keyErlang OTP
- CVE-2026-2607Multiple vulnerabilities in IBM MQ Operator and Queue manager container imagesIBM MQ Operator · IBM supplied MQ Advanced container images
- CVE-2026-45985ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/OLinux
- CVE-2026-45983nfsd: never defer requests during idmap lookupLinux
- CVE-2026-45982ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()Linux
- CVE-2026-45981s390/cio: Fix device lifecycle handling in css_alloc_subchannel()Linux
- CVE-2026-45979drm/amdgpu: clean up the amdgpu_cs_parser_bosLinux
- CVE-2026-45978staging: greybus: lights: avoid NULL derefLinux
- CVE-2026-45977fbnic: close fw_log race between users and teardownLinux
- CVE-2026-45976drm/amdgpu: Fix memory leak in amdgpu_ras_init()Linux
- CVE-2026-45975ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmdLinux
- CVE-2026-45974btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not foundLinux
- CVE-2026-45973RDMA/mlx5: Fix UMR hang in LAG error state unloadLinux
- CVE-2026-45971bpf: Limit bpf program signature sizeLinux
- CVE-2026-45969HID: playstation: Add missing check for input_ff_create_memlessLinux
- CVE-2026-45968cpuidle: Skip governor when only one idle state is availableLinux
- CVE-2026-45967bpf: Return proper address for non-zero offsets in insn arrayLinux
- CVE-2026-45966apparmor: fix NULL pointer dereference in __unix_needs_revalidationLinux
- CVE-2026-45965apparmor: fix invalid deref of rawdata when export_binary is unsetLinux
- CVE-2026-45964SUNRPC: fix gss_auth kref leak in gss_alloc_msg error pathLinux
- CVE-2026-45963ASoC: nau8821: Cancel delayed work on component removeLinux
- CVE-2026-45962ublk: Validate SQE128 flag before accessing the cmdLinux
- CVE-2026-45961gfs2: fix memory leaks in gfs2_fill_super error pathLinux
- CVE-2026-45960hfsplus: return error when node already exists in hfs_bnode_createLinux
- CVE-2026-45957rcu: Fix rcu_read_unlock() deadloop due to softirqLinux
- CVE-2026-45954fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()Linux
- CVE-2026-45953md/raid5: fix IO hang with degraded array with llbitmapLinux
- CVE-2026-45952eth: fbnic: Add validation for MTU changesLinux
- CVE-2026-45950crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req()Linux
- CVE-2026-45949hwrng: core - use RCU and work_struct to fix race conditionLinux
- CVE-2026-45948ext4: fix memory leak in ext4_ext_shift_extents()Linux
- CVE-2026-45947drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()Linux
- CVE-2026-45946power: supply: ab8500: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45943erofs: fix inline data read failure for ztailpacking pclustersLinux
- CVE-2026-45941tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failureLinux
- CVE-2026-45940net: stmmac: fix oops when split header is enabledLinux
- CVE-2026-45939gpib: Fix memory leak in ni_usb_init()Linux
- CVE-2026-45938power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45937crypto: inside-secure/eip93 - fix kernel panic in driver detachLinux
- CVE-2026-45936power: supply: goldfish: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45934btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocationLinux
- CVE-2026-45930net: mctp: ensure our nlmsg responses are initialisedLinux
- CVE-2026-45928media: chips-media: wave5: Fix memory leak on codec_info allocation failureLinux
- CVE-2026-45927bpf: Require frozen map for calculating map hashLinux
- CVE-2026-45926rust: pwm: Fix potential memory leak on init errorLinux
- CVE-2026-45925thermal/of: Fix reference leak in thermal_of_cm_lookup()Linux
- CVE-2026-45924ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error pathsLinux
- CVE-2026-45923net: usb: catc: enable basic endpoint checkingLinux
- CVE-2026-45922RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handlerLinux
- CVE-2026-45921mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()Linux
- CVE-2026-45920ext4: fix dirtyclusters double decrement on fs shutdownLinux
- CVE-2026-45919sched/rt: Skip currently executing CPU in rto_next_cpu()Linux
- CVE-2026-45918ovpn: tcp - don't deref NULL sk_socket member after tcp_close()Linux
- CVE-2026-45917ipvs: do not keep dest_dst if dev is going downLinux
- CVE-2026-45916power: supply: sbs-battery: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45915fat: avoid parent link count underflow in rmdirLinux
- CVE-2026-45914Revert "hwmon: (ibmpex) fix use-after-free in high/low store"Linux
- CVE-2026-45913net: bridge: mcast: always update mdb_n_entries for vlan contextsLinux
- CVE-2026-45912ext4: don't cache extent during splitting extentLinux
- CVE-2026-45911usb: cdns3: fix role switching during resumeLinux
- CVE-2026-45908accel/amdxdna: Fix memory leak in amdxdna_ubuf_mapLinux
- CVE-2026-45907net/mlx5e: Fix deadlocks between devlink and netdev instance locksLinux
- CVE-2026-45906power: supply: pf1550: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45905xfrm: fix ip_rt_bug race in icmp_route_lookup reverse pathLinux
- CVE-2026-45904powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handlingLinux
- CVE-2025-3633IBM Cognos Analytics is affected by multiple security vulnerabilitiesIBM Cognos Analytics · IBM Cognos Transformer
- CVE-2026-45903bpf: Fix memory access flags in helper prototypesLinux
- CVE-2026-45902power: supply: bq256xx: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45901netfilter: nf_tables: revert commit_mutex usage in reset pathLinux
- CVE-2026-45900crypto: caam - fix netdev memory leak in dpaa2_caam_probeLinux
- CVE-2026-45899ext4: drop extent cache when splitting extent failsLinux
- CVE-2026-45897netfilter: nft_counter: serialize reset with spinlockLinux
- CVE-2026-45896mtd: intel-dg: Fix accessing regions before setting nregionsLinux
- CVE-2026-45895quota: fix livelock between quotactl and freeze_superLinux
- CVE-2026-45893apparmor: Fix & Optimize table creation from possibly unaligned memoryLinux
- CVE-2026-45892ext4: drop extent cache after doing PARTIAL_VALID1 zerooutLinux
- CVE-2026-45891net: hns3: fix double free issue for tx spare bufferLinux
- CVE-2026-45890xen-netback: reject zero-queue configuration from guestLinux
- CVE-2026-45889mptcp: do not account for OoO in mptcp_rcvbuf_grow()Linux
- CVE-2026-45888md/raid1: fix memory leak in raid1_run()Linux
- CVE-2026-45887af_unix: Fix memleak of newsk in unix_stream_connect().Linux
- CVE-2026-45886bpf: Fix bpf_xdp_store_bytes proto for read-only argLinux
- CVE-2026-45885power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45884apparmor: avoid per-cpu hold underflow in aa_get_bufferLinux
- CVE-2026-45883iio: sca3000: Fix a resource leak in sca3000_probe()Linux
- CVE-2026-45882power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45881soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()Linux
- CVE-2026-45880PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() failsLinux
- CVE-2026-45879power: supply: bq25980: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45877HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clientsLinux
- CVE-2026-45876arm64/gcs: Fix error handling in arch_set_shadow_stack_status()Linux
- CVE-2026-45875mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failureLinux
- CVE-2026-45874phy: freescale: imx8qm-hsio: fix NULL pointer dereferenceLinux
- CVE-2026-45873netfilter: nft_set_rbtree: check for partial overlaps in anonymous setsLinux
- CVE-2026-45872scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()Linux
- CVE-2026-45871tpm: st33zp24: Fix missing cleanup on get_burstcount() errorLinux
- CVE-2026-45870SUNRPC: auth_gss: fix memory leaks in XDR decoding error pathsLinux
- CVE-2026-45869power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()Linux
- CVE-2026-45868pinctrl: single: fix refcount leak in pcs_add_gpio_func()Linux
- CVE-2026-45867power: supply: act8945a: Fix use-after-free in power_supply_changed()Linux
- CVE-2026-45866serial: caif: fix use-after-free in caif_serial ldisc_close()Linux
- CVE-2026-45865mctp i2c: initialise event handler read bytesLinux
- CVE-2026-45864fs/ntfs3: prevent infinite loops caused by the next valid being the sameLinux
- CVE-2026-45863i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()Linux
- CVE-2026-45858ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1Linux
- CVE-2026-45857scsi: csiostor: Fix dereference of null pointer rnLinux
- CVE-2026-45855ata: libata-scsi: avoid Non-NCQ command starvationLinux
- CVE-2026-45854crypto: inside-secure/eip93 - unregister only available algorithmLinux
- CVE-2026-45853drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()Linux
- CVE-2026-45851efi: Fix reservation of unaccepted memory tableLinux
- CVE-2026-45850ipvs: skip ipv6 extension headers for csum checksLinux
- CVE-2026-45849net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()Linux
- CVE-2026-45848apparmor: fix NULL sock in aa_sock_file_permLinux
- CVE-2026-45847net: remove WARN_ON_ONCE when accessing forward path arrayLinux
- CVE-2025-71309fs/ntfs3: fix deadlock in ni_read_folio_cmprLinux
- CVE-2025-71308accel/amdxdna: Fix potential NULL pointer dereference in context cleanupLinux
- CVE-2025-71307drm/panthor: Fix NULL pointer dereference on panthor_fw_unplugLinux
- CVE-2025-71306ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()Linux
- CVE-2025-71305drm/display/dp_mst: Add protection against 0 vcpiLinux
- CVE-2025-71304smack: /smack/doi: accept previously used valuesLinux
- CVE-2025-71303accel/amdxdna: Fix race condition when checking rpm_onLinux
- CVE-2026-2340Samba: vfs_worm does not block directory modificationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-48971WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerabilityWebToffee Product Import Export for WooCommerce
- CVE-2026-9689Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604Red Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-42751WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerabilitywpdevelop Booking Manager
- CVE-2026-42750WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerabilityNexcess WPComplete
- CVE-2026-42744WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerabilityAds by WPQuads
- CVE-2026-42732WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerabilityAds by WPQuads
- CVE-2026-42725WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerabilityWP Wham Checkout Files Upload for WooCommerce
- CVE-2026-42726WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerabilityStrategy11 Team AWP Classifieds
- CVE-2026-2288myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parametersilvercover myLinksDump
- CVE-2026-3349MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' ParameterMinhNhut Link Gateway
- CVE-2026-3348MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin SettingsMinhNhut Link Gateway
- CVE-2026-2280rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settingslarsdrasmussen rexCrawler
- CVE-2025-0898Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVGWPXpro Xpro Elementor Addons - Pro
- CVE-2026-45846bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()Linux
- CVE-2026-45845net/sched: taprio: fix NULL pointer dereference in class dumpLinux
- CVE-2026-45844netfilter: arp_tables: fix IEEE1394 ARP payload parsingLinux
- CVE-2026-45842slip: reject VJ receive packets on instances with no rstate arrayLinux
- CVE-2026-45841netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULOLinux
- CVE-2026-45840openvswitch: cap upcall PID array size and pre-size vport repliesLinux
- CVE-2026-45839bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()Linux
- CVE-2026-45838bpf: fix end-of-list detection in cgroup_storage_get_next_key()Linux
- CVE-2026-45837bpf: Fix use-after-free in arena_vm_close on forkLinux
- CVE-2026-48968WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerabilityAverta Master Slider
- CVE-2026-48877WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerabilityTom GenerateBlocks
- CVE-2026-2237A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1Synology Storage Manager
- CVE-2025-66593An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricteSynology Assistant
- CVE-2025-66592An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrarSynology Active Backup for Business Agent
- CVE-2025-13593Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with resSynology ActiveProtect Agent
- CVE-2025-13167Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology ContSynology Contacts
- CVE-2025-10466Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access beSynology Safe Access
- CVE-2024-47272Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows rSynology Surveillance Station
- CVE-2024-47271Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575Synology Surveillance Station
- CVE-2024-47270Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9Synology Surveillance Station
- CVE-2024-47269Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-1157Synology Surveillance Station
- CVE-2024-47268Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remoteSynology Surveillance Station
- CVE-2024-47267Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology SurSynology Surveillance Station
- CVE-2024-11399Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13Synology BeeDrive for desktop
- CVE-2026-40826Authenticated SQLi in dsgvo_contracts viewMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40822Authenticated SQLi in DevSerialReset functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-40821Authenticated SQLi in getAccountByID functionMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2026-8042Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingoctalmage Github Shortcode
- CVE-2026-8942MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Pagelhughes33472 MetaMagic SEO Plugin
- CVE-2026-8906WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameterrahulbhangale WP Promoter
- CVE-2026-3001Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameterjegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…
- CVE-2026-49001Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE productZTE ZXUniPOS NDS-LTE
- CVE-2026-41704Compromised VM can make arbitrary blobstore deletesCloud Foundry Foundation BOSH Director
- CVE-2026-3895WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingWPBakery Page Builder Addons by Livemesh
- CVE-2026-2030WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesWPBakery Page Builder Addons by Livemesh
- CVE-2026-7618EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameterdattateccom EnvíaloSimple: Email Marketing y Newsletters
- CVE-2026-3896Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingLivemesh SiteOrigin Widgets
- CVE-2026-3897Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing AuthorizationLivemesh Addons for Beaver Builder
- CVE-2026-3279Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgradeclorith Enable jQuery Migrate Helper
- CVE-2026-41009Local Blobstore may allow arbitrary reads/deletesCloud Foundry Foundation BOSH Director
- CVE-2026-8884Instant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesneilmccutcheon Instant-Quote.co Quotation Page
- CVE-2026-8867Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesfides-it Post Categories Gallery
- CVE-2026-8899Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesgapgag55 Auto Thumbnails
- CVE-2026-8040faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attributeyehudah faq shortocde
- CVE-2026-8886hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attributehuankong hk_shortcode
- CVE-2026-8708Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Pageshra Genzel breadcrumbs
- CVE-2026-8847Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesmshomali Dideo
- CVE-2026-8844Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeskevin1804 Responsive Check
- CVE-2026-8707NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELFnsthemes NS Product icon badge
- CVE-2026-9014WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Actionrahulbhangale WP Promoter
- CVE-2026-7614Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Updatemkhfr Old Posts Highlighter
- CVE-2026-8875Easy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescuamckuy Easy Prism Syntax Highlighter
- CVE-2026-8894iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesvinaysankhyan iWR Tooltip
- CVE-2026-8845Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessamiullah-kaifi Islamic Database
- CVE-2026-8873Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescelloexpressions Content Slideshow
- CVE-2026-8846Tuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeseldougo Tuxquote
- CVE-2026-8891BitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesBitForm – Data management solution for WordPress
- CVE-2026-8871Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesthomstark Formidable Kinetic
- CVE-2026-8048My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]paulpela My Email Shortcode
- CVE-2026-8872Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesfides-it Animate Your Content
- CVE-2026-8903Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Updateyoutag Two-factor authentication
- CVE-2026-8869Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attributemutualfunddata Mutual Funds Data
- CVE-2026-8911WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parametergodlessons WP AutoBuzz
- CVE-2026-8898Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesruchit47 Events In City
- CVE-2026-8866jQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesbradyholt jQuery googleslides
- CVE-2026-8943GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Functionrchmura GoStats for WordPress
- CVE-2026-8941CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Updatewmark CDN Linker lite
- CVE-2026-8701GNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesgolzarrahman GNTT Post Title Ticker
- CVE-2026-8887Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeskonforti Listen Shortcode
- CVE-2026-8897Shortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesvincentastolfi Shortcode Buddy
- CVE-2026-8870Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesadnanmoqsood Team Master – A Modern WordPress Team Showcase
- CVE-2026-8702GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attributegarber GBI To Print
- CVE-2026-8938auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypassnakamura1458 auto making JSON-LD
- CVE-2026-8939Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Updatesimonailie Search Simple Fields
- CVE-2026-8842Google+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesmorettolss Google+ Link Name
- CVE-2026-8703Endless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]codycave Endless Scroll
- CVE-2026-8868Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesjonathan-robrecht Single Mailchimp
- CVE-2026-8698Cryptocurrency Prijsvergelijking Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attributecryptoprijzen Cryptocurrency Prijsvergelijking Widget
- CVE-2026-8837WP Iframe Geo Style for Amazon affiliates <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attributeektorcaba WP Iframe Geo Style for Amazon affiliates
- CVE-2026-8877Responsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesesiteq Responsive Video Embedder
- CVE-2026-6287ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attributedevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2026-9236CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Managementcreativemindssolutions CM Ad Changer – A simple tool to con…
- CVE-2025-14481Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' ParameterYoast SEO – Advanced SEO with real-time guidance and built-…
- CVE-2026-2255Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected CredentialsHitachi Vantara Pentaho Data Integration and Analytics
- CVE-2026-2254Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical ResourceHitachi Vantara Pentaho Data Integration and Analytics
- CVE-2026-9022Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attributedkjensen Splide Carousel Block
- CVE-2025-15649IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS datePMQS IO::Uncompress::Unzip
- CVE-2026-48999Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE productZTE ZXUniPOS NDS-LTE
- CVE-2026-6565Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Titleanalogwp Style Kits for Elementor
- CVE-2026-7493Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.11.5 - Unauthenticated Denial of Servicecroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2026-9156Tanium addressed a denial of service vulnerability in Tanium Server.Tanium Server
- CVE-2026-9609QianFox FoxCMS Admin.php edit password recoveryQianFox FoxCMS
- CVE-2026-9608QianFox FoxCMS Administrator Backend edit cross site scriptingQianFox FoxCMS
- CVE-2026-9607itsourcecode Courier Management System parcel_list.php sql injectionitsourcecode Courier Management System
- CVE-2025-67903Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.
- CVE-2025-68712SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authenti
- CVE-2025-70116A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing des
- CVE-2026-30498A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.
- CVE-2026-33552Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control.
- CVE-2026-38808SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /O
- CVE-2026-38930OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component.
- CVE-2026-38931A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cf
- CVE-2026-49009Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.