CVEs published May 28, 2026
543 CVEs were published on May 28, 2026: 57 critical, 260 high. 1 is now in CISA KEV.
- Published
- 543
- Critical
- 57
- High
- 260
- Medium
- 134
- Low
- 15
- Unrated
- 77
- Now in CISA KEV
- 1
- Fix available
- 395
Most affected products
- Google Chrome
- 151
- Linux
- 135
- Canonical Ubuntu Linux
- 12
- Elastic Kibana
- 10
- Oracle REST Data Services
- 10
- portainer · github.com/portainer/portainer
- 8
- Casdoor · github.com/casdoor/casdoor
- 7
- Red Hat build of Keycloak · org.keycloak:keycloak-services
- 7
- rustfs
- 7
- jpadilla pyjwt · pyjwt
- 5
Critical 57
- CVE-2026-8809Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameterhwk-fr Advanced Custom Fields: Extended
- CVE-2026-9967Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a Google Chrome
- CVE-2026-9918Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escGoogle Chrome
- CVE-2026-9891Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-9886Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape viaGoogle Chrome
- CVE-2026-9881Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious Google Chrome
- CVE-2026-9876Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escapGoogle Chrome
- CVE-2026-9875Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox eGoogle Chrome
- CVE-2026-9874Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-9872Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox esGoogle Chrome
- CVE-2026-44848Portainer: Missing authorization on Docker plugin endpoints allows host RCEportainer · github.com/portainer/portainer
- CVE-2026-44849Portainer: Endpoint security bypass via Swarm service create/updateportainer · github.com/portainer/portainer
- CVE-2026-9645ScadaBR Authenticated Remote Code ExecutionScadaBR
- CVE-2026-45288Marten has an SQL injection vulnerability in its full-text search regConfig parameterJasperFx marten · Marten
- CVE-2026-46840Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).Oracle REST Data Services
- CVE-2026-46839Vulnerability in Oracle REST Data Services (component: Core).Oracle REST Data Services
- CVE-2026-46833Vulnerability in the Net Service component of Oracle Database Server.Oracle Database Server
- CVE-2026-46824Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration).Oracle Universal Work Queue
- CVE-2026-46822Vulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal Operations).Oracle iAssets
- CVE-2026-46819Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations).Oracle Internet Procurement Connector
- CVE-2026-46817Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).Oracle Payments
- CVE-2026-46775Vulnerability in Oracle REST Data Services (component: Core).Oracle REST Data Services
- CVE-2026-34311Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera).Oracle Hospitality OPERA 5 Property Services
- CVE-2026-9037Download of code without integrity check in XCharge C6XCharge C6
- CVE-2026-45039RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonationrustfs
- CVE-2026-43898SandboxJS: Sandbox escape via Function.caller leakage of internal call opnyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-45311CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without ApprovalHmbown CodeWhale · deepseek-tui +1
- CVE-2026-45374CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project FilesHmbown CodeWhale · deepseek-tui
- CVE-2026-45058electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarkelecterm
- CVE-2026-45353electerm: Local code through electerm's single-instance socketelecterm
- CVE-2026-45323MeshCore Card: XSS vulnerability through meshcore node namejpettitt meshcore-card
- CVE-2026-9098CVE-2026-9098Casdoor · github.com/casdoor/casdoor
- CVE-2026-9097CVE-2026-9097Casdoor · github.com/casdoor/casdoor
- CVE-2026-9094CVE-2026-9094Casdoor · github.com/casdoor/casdoor
- CVE-2026-9093CVE-2026-9093Casdoor · github.com/casdoor/casdoor
- CVE-2026-45261GitButler: Link injection via forge integration enables arbitrary script executiongitbutlerapp gitbutler
- CVE-2026-9092CVE-2026-9092Casdoor
- CVE-2026-9090CVE-2026-9090Casdoor · github.com/casdoor/casdoor
- CVE-2026-44477CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCEcloudnative-pg · github.com/cloudnative-pg/cloudnative-pg
- CVE-2026-24444SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.phpSDMC Technology Co. NE6037
- CVE-2026-44672mapfish-print: Remote Code Injection (RCE) in Dynamic tablemapfish-print · camptocamp mapfish_print +4
- CVE-2026-8980Privilege EscalationMennekes Amtron
- CVE-2026-8979Authentication BypassMennekes Amtron
- CVE-2026-46195smb: client: validate dacloffset before building DACL pointersLinux
- CVE-2026-46185smb/client: fix out-of-bounds read in symlink_data()Linux
- CVE-2026-46155smb/client: fix out-of-bounds read in smb2_compound_op()Linux
- CVE-2026-46137mptcp: pm: ADD_ADDR rtx: fix potential data-raceLinux
- CVE-2026-46135nvmet-tcp: fix race between ICReq handling and queue teardownLinux
- CVE-2026-46119libceph: Fix slab-out-of-bounds access in auth message processingLinux
- CVE-2026-46115block: add pgmap check to biovec_phys_mergeableLinux
- CVE-2026-4408Samba: remote code execution in samrRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-32999Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute WebPros Comet Backup
- CVE-2026-32998This vulnerability in Veeam Service Provider Console allows for remote code execution.Veeam Service Provider Console
- CVE-2026-38702A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR
- CVE-2026-38703A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR
- CVE-2026-38704A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, I
- CVE-2026-38707A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315
High 260
- CVE-2026-5343SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031Drupal SAML SSO - Service Provider · drupal/miniorange_saml
- CVE-2026-10022Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to eGoogle Chrome
- CVE-2026-10021Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary coGoogle Chrome
- CVE-2026-10020Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had comGoogle Chrome
- CVE-2026-10017Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-10016Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-10015Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-10014Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-10013Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-10012Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-10009Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execGoogle Chrome
- CVE-2026-10007Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-10006Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftedGoogle Chrome
- CVE-2026-10005Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-10003Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gesGoogle Chrome
- CVE-2026-10002Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-10001Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-10000Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-9999Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inGoogle Chrome
- CVE-2026-9998Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2026-9997Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9995Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-9994Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-9993Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9992Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-9990Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-9988Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escapeGoogle Chrome
- CVE-2026-9987Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker toGoogle Chrome
- CVE-2026-9984Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HGoogle Chrome
- CVE-2026-9983Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-9982Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-9978Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-9977Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who hadGoogle Chrome
- CVE-2026-9976Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a craftGoogle Chrome
- CVE-2026-9975Out of bounds read and write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-9974Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2026-9973Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-9972Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-9970Use after free in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9969Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary Google Chrome
- CVE-2026-9968Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-9966Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-9965Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2026-9964Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious Google Chrome
- CVE-2026-9963Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specifiGoogle Chrome
- CVE-2026-9962Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via aGoogle Chrome
- CVE-2026-9961Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2026-9960Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to exGoogle Chrome
- CVE-2026-9958Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-9957Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-9956Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UGoogle Chrome
- CVE-2026-9954Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2026-9952Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox viaGoogle Chrome
- CVE-2026-9951Use after free in UI in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafteGoogle Chrome
- CVE-2026-9949Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-9948Use after free in Views in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-9947Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-9946Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9945Use after free in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sanGoogle Chrome
- CVE-2026-9941Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-9940Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2026-9939Heap buffer overflow in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-9938Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sanGoogle Chrome
- CVE-2026-9937Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-9936Use after free in GFX in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-9934Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2026-9933Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gesGoogle Chrome
- CVE-2026-9932Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-9931Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-9928Out of bounds read in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crGoogle Chrome
- CVE-2026-9927Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-9926Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-9925Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9924Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-9923Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2026-9922Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-9916Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-9915Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-9914Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-9910Out of bounds memory access in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sGoogle Chrome
- CVE-2026-9909Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execGoogle Chrome
- CVE-2026-9906Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2026-9905Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-9904Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a craGoogle Chrome
- CVE-2026-9902Use after free in Accessibility in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-9901Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execuGoogle Chrome
- CVE-2026-9900Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-9899Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9898Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compGoogle Chrome
- CVE-2026-9897Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-9896Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-9895Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-9894Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-9893Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-9892Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-9890Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-9889Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a Google Chrome
- CVE-2026-9888Use after free in WebView in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-9887Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC scripGoogle Chrome
- CVE-2026-9885Insufficient validation of untrusted input in UI in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-9884Use after free in Browser in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted Google Chrome
- CVE-2026-9883Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2026-9880Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-9879Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTMLGoogle Chrome
- CVE-2026-9878Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-9877Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-9873Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-45364Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotationbetter-auth
- CVE-2026-44973Billy: Path traversal vulnerabilitiesgo-git go-billy · github.com/go-git/go-billy/v5 +1
- CVE-2026-48116AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skillMintplex-Labs anything-llm
- CVE-2026-39929Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDPLakeside Software, LLC. SysTrack Agent
- CVE-2026-44881Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Updateportainer · github.com/portainer/portainer
- CVE-2026-44850Portainer: Bind-mount restriction bypass via HostConfig.Mountsportainer · github.com/portainer/portainer
- CVE-2026-10044ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/Usagi-org ai-goofish-monitor
- CVE-2026-44882Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorizationportainer · github.com/portainer/portainer
- CVE-2026-44883Portainer: JWT accepted in URL query leaks tokens to logs and referersportainer · github.com/portainer/portainer
- CVE-2026-45342LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and NotesKovah LinkAce
- CVE-2026-45343LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session HijackingKovah LinkAce
- CVE-2026-45344LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instancesKovah LinkAce
- CVE-2026-42071MantisBT: Private Bugnote Attachment Content Leak via REST APImantisbt · mantisbt/mantisbt
- CVE-2026-44655MantisBT: Stored XSS on Move Attachments Admin Pagemantisbt · mantisbt/mantisbt
- CVE-2026-44657MantisBT: Stored XSS in File Downloadmantisbt · mantisbt/mantisbt
- CVE-2026-46837Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security).Oracle Flow Manufacturing
- CVE-2026-46835Vulnerability in the Net Service component of Oracle Database Server.Oracle Database Server
- CVE-2026-46834Vulnerability in the Net Service component of Oracle Database Server.Oracle Database Server
- CVE-2026-46829Vulnerability in Oracle REST Data Services (component: Mongoapi).Oracle REST Data Services
- CVE-2026-46828Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).Oracle Payroll
- CVE-2026-46827Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager).Oracle Payroll
- CVE-2026-46826Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).Oracle Payroll
- CVE-2026-46823Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization).Oracle Public Sector Financials
- CVE-2026-46821Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components).Oracle Financials Common Modules
- CVE-2026-46820Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components).Oracle Financials Common Modules
- CVE-2026-46818Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).Oracle Payments
- CVE-2026-35277Vulnerability in Oracle REST Data Services (component: Core).Oracle REST Data Services
- CVE-2026-35266Vulnerability in Oracle REST Data Services (component: Core).Oracle REST Data Services
- CVE-2026-49095Improper Input Validation in Kibana Fleet Leading to Privilege EscalationElastic Kibana
- CVE-2026-42398Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network AccessElastic Kibana
- CVE-2026-32847DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.pyHKUDS DeepCode
- CVE-2026-33590Insecure default permissions in Portainer CEPortainer Community Edition
- CVE-2026-9039Initialization of a resource with an insecure default in XCharge C6XCharge C6
- CVE-2026-9038Stack-based buffer overflow in XCharge C6XCharge C6
- CVE-2026-49128Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI HandlingMusicPlayerDaemon MPD
- CVE-2026-49127Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24beMusicPlayerDaemon MPD
- CVE-2026-45041RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgeryrustfs
- CVE-2026-45042RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Sourcerustfs
- CVE-2026-45044RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlersrustfs
- CVE-2026-47333Out-of-bounds read in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47331Use-after-free in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-45332Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpointmarcantondahmen automad · automad/automad
- CVE-2026-4944Hardcoded trust_remote_code=True in vllm-project/vllm Bypasses User Security Controlvllm-project/vllm
- CVE-2026-46509deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')ranfdev deepobj · @ranfdev/deepobj
- CVE-2026-45310CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url ToolHmbown CodeWhale · deepseek-tui +1
- CVE-2026-45373CodeWhale: SSRF IPV6 bypassHmbown CodeWhale · deepseek-tui
- CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literalpyload · pyload-ng
- CVE-2026-44797Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)nautobot
- CVE-2026-44798Nautobot: GitRepository.current_head field should not be writable through REST APInautobot
- CVE-2026-45296OpenReplay: Cross-tenant information disclosure in app_apikey projectKey routes via missing tenant bindingopenreplay
- CVE-2026-34126Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100CTP-Link Systems Tapo L535E v1.0, · TP-Link Systems Tapo… +1
- CVE-2026-44543Local Path Provisioner: HelperPod Template Injectionrancher local-path-provisioner · github.com/rancher/local-p…
- CVE-2026-9096CVE-2026-9096Casdoor · github.com/casdoor/casdoor
- CVE-2026-9095CVE-2026-9095Casdoor
- CVE-2026-44466Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissionszed-industries zed
- CVE-2026-44463Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissionszed-industries zed
- CVE-2026-44465Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/configzed-industries zed
- CVE-2026-44461Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)zed-industries zed
- CVE-2026-6720Calicoctl leaks cluster credentials to stderr when verbose logging is enabledTigera Calico · github.com/projectcalico/calicoctl/v3 +1
- CVE-2026-8697Improper Authentication Rate Limiting on TP-Link's Archer C64TP-Link Systems Archer C64
- CVE-2026-47762TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentstinymce · tinymce/tinymce
- CVE-2026-47761TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injectiontinymce · tinymce/tinymce
- CVE-2026-47759TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributestinymce · tinymce/tinymce
- CVE-2026-47760TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGstinymce · tinymce/tinymce
- CVE-2026-48526PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedjpadilla pyjwt · pyjwt
- CVE-2026-44594esm.sh: Path Traversal via package.json browser field allows reading arbitrary server filesesm-dev esm.sh · github.com/esm-dev/esm.sh
- CVE-2026-44593esm.sh: Legacy Route Path Traversal Can Lead to RCEesm-dev esm.sh · github.com/esm-dev/esm.sh
- CVE-2026-44358Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypointespressif shared-github-dangerjs
- CVE-2026-45017Python Liquid: Absolute paths escape filesystem loader search pathjg-rp liquid · python-liquid
- CVE-2026-41565CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpersMIK CryptX
- CVE-2026-35676phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpointthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-35675phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/updatethorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-35672phpMyFAQ - Authentication Bypass via Empty API Tokenthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-35671phpMyFAQ - Insecure Direct Object Reference in User Password APIthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-49237Local Privilege Escalation in Canonical MultipassCanonical Multipass
- CVE-2026-49238SFTP Server VM Escape in Canonical MultipassCanonical Multipass
- CVE-2026-9658Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request pathsRRWO Plack::Middleware::Security::Common
- CVE-2026-46240media: iris: Fix use-after-free in iris_release_internal_buffers()Linux
- CVE-2026-46238batman-adv: stop caching unowned originator pointers in BAT IVLinux
- CVE-2026-46232HID: playstation: Clamp num_touch_reportsLinux
- CVE-2026-46230drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msgLinux
- CVE-2026-46227sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALLLinux
- CVE-2026-46218drm/amdgpu: Add bounds checking to ib_{get,set}_valueLinux
- CVE-2026-46215drm: Set old handle to NULL before prime swap in change_handleLinux
- CVE-2026-46212batman-adv: bla: prevent use-after-free when deleting claimsLinux
- CVE-2026-46210media: iris: fix use-after-free of fmt_src during MBPF checkLinux
- CVE-2026-46209drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()Linux
- CVE-2026-46208batman-adv: stop tp_meter sessions during mesh teardownLinux
- CVE-2026-46206batman-adv: reject new tp_meter sessions during teardownLinux
- CVE-2026-46205staging: media: atomisp: Disallow all private IOCTLsLinux
- CVE-2026-46204drm/amdgpu/vcn4: Prevent OOB reads when parsing IBLinux
- CVE-2026-46201drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()Linux
- CVE-2026-46199drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msgLinux
- CVE-2026-46198batman-adv: fix integer overflow on buff_posLinux
- CVE-2026-46197drm/amdkfd: validate SVM ioctl nattr against buffer sizeLinux
- CVE-2026-46190mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()Linux
- CVE-2026-46189RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error pathLinux
- CVE-2026-46181RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()Linux
- CVE-2026-46178RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()Linux
- CVE-2026-46177ipmi: Add limits to event and receive message requestsLinux
- CVE-2026-46176RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()Linux
- CVE-2026-46175f2fs: fix fsck inconsistency caused by FGGC of node blockLinux
- CVE-2026-46174x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cacheLinux
- CVE-2026-46173exit: prevent preemption of oopsing TASK_DEAD taskLinux
- CVE-2026-46166wifi: mac80211: use safe list iteration in radar detect workLinux
- CVE-2026-46164btrfs: fix double free in create_space_info_sub_group() error pathLinux
- CVE-2026-46157ALSA: pcm: oss: Fix data race at accessing runtime.oss.triggerLinux
- CVE-2026-46154sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup settersLinux
- CVE-2026-46152wifi: mac80211: drop stray 'static' from fast-RX rx_resultLinux
- CVE-2026-46150fanotify: fix false positive on permission eventsLinux
- CVE-2026-46149scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()Linux
- CVE-2026-46145RDMA/mana: Validate rx_hash_key_lenLinux
- CVE-2026-46138Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evtLinux
- CVE-2026-46133RDMA/rxe: Reject unknown opcodes before ICRC processingLinux
- CVE-2026-46129btrfs: fix double free in create_space_info() error pathLinux
- CVE-2026-46125wifi: mac80211: remove station if connection prep failsLinux
- CVE-2026-46124isofs: validate block number from NFS file handle in isofs_export_igetLinux
- CVE-2026-46123Bluetooth: virtio_bt: clamp rx length before skb_putLinux
- CVE-2026-46120ip6_gre: Use cached t->net in ip6erspan_changelink().Linux
- CVE-2026-46117RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()Linux
- CVE-2026-46116xfrm: defensively unhash xfrm_state lists in __xfrm_state_deleteLinux
- CVE-2026-46114RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloadsLinux
- CVE-2026-46113KVM: x86: Fix shadow paging use-after-free due to unexpected GFNLinux
- CVE-2026-46112RDMA/hns: Fix unlocked call to hns_roce_qp_remove()Linux
- CVE-2026-46111Bluetooth: hci_conn: fix potential UAF in create_big_syncLinux
- CVE-2026-46110net: stmmac: Prevent NULL deref when RX memory exhaustedLinux
- CVE-2026-46107dm-thin: fix metadata refcount underflowLinux
- CVE-2026-46105scsi: mpt3sas: Limit NVMe request size to 2 MiBLinux
- CVE-2026-47074ex_aws_sns SigningCertURL not validated in verify_message/1ex-aws ex_aws_sns
- CVE-2025-48977Apache Ignite: REST HTTP arbitrary file read vulnerabilityApache Software Foundation Apache Ignite · org.apache.ignit…
- CVE-2026-6226Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injectionshabti Frontend Admin by DynamiApps
- CVE-2026-9804Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readRed Hat Container Native Virtualization · Red Hat OpenSh… +1
- CVE-2026-7052HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Fieldhtplugins HT Contact Form – Drag & Drop Form Builder for Wo…
- CVE-2026-7797Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parametercroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2026-6455WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameteryudiz WP Contact Form 7 DB Handler
- CVE-2026-9227GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filtercssigniterteam GutenBee – Gutenberg Blocks
- CVE-2026-7634SlimStat Analytics <= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerveronalabs SlimStat Analytics
- CVE-2026-7862Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund InitiationEupago Gateway For Woocommerce
- CVE-2026-44604Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell commandRed Hat Hardened Images · Red Hat Enterprise Linux
- CVE-2026-9009Crawlomatic Multipage Scraper Post Generator <= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode AttributeCodeRevolution Crawlomatic Multipage Scraper Post Generator
- CVE-2026-9673Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which cajson-2-csv · org.webjars.npm:json-2-csv
- CVE-2026-32997A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & RepVeeam Backup and Replication
- CVE-2026-32996This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.Veeam Backup and Replication
- CVE-2026-32995The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 Rocket.Chat
- CVE-2026-9795Keycloak: keycloak: privilege escalation via improper scope mapping enforcementRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-7802Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parametershabti Frontend Admin by DynamiApps
- CVE-2026-2374Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELFrobertpeake Login No Captcha reCAPTCHA
- CVE-2026-9789NitroSense V3: Security Vulnerability InformationAcer NitrorSense
- CVE-2026-8915Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.Samsung Open Source Escargot
- CVE-2026-30760An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a craft
- CVE-2026-30761An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to
- CVE-2026-37266An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_d
- CVE-2026-37579An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java comp
Medium, low and unrated 226
- CVE-2026-6891Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with lCanon My Image Garden for macOS
- CVE-2026-6816TFA Basic Plugins - Access BypassDrupal TFA Basic Plugins
- CVE-2026-10028Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chainRed Hat Enterprise Linux
- CVE-2026-10019Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-10018Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information froGoogle Chrome
- CVE-2026-10011Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-10010Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the Google Chrome
- CVE-2026-10008Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive inforGoogle Chrome
- CVE-2026-10004Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoGoogle Chrome
- CVE-2026-9996Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive inforGoogle Chrome
- CVE-2026-9991Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the Google Chrome
- CVE-2026-9989Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a Google Chrome
- CVE-2026-9986Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had cGoogle Chrome
- CVE-2026-9985Insufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had cGoogle Chrome
- CVE-2026-9981Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-9980Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-9979Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-9971Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engageGoogle Chrome
- CVE-2026-9959Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-9955Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2026-9953Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information fGoogle Chrome
- CVE-2026-9950Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromiGoogle Chrome
- CVE-2026-9944Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leGoogle Chrome
- CVE-2026-9943Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2026-9942Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to byGoogle Chrome
- CVE-2026-9935Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pGoogle Chrome
- CVE-2026-9930Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory wriGoogle Chrome
- CVE-2026-9929Inappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin datGoogle Chrome
- CVE-2026-9921Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information viGoogle Chrome
- CVE-2026-9920Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-9919Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2026-9917Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infGoogle Chrome
- CVE-2026-9913Inappropriate implementation in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform out of boundGoogle Chrome
- CVE-2026-9912Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensGoogle Chrome
- CVE-2026-9911Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a cGoogle Chrome
- CVE-2026-9908Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information fGoogle Chrome
- CVE-2026-9907Out of bounds read in Dawn in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2026-9903Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compGoogle Chrome
- CVE-2026-9882Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-49299In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defiOpenStack Neutron · neutron
- CVE-2026-45023AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/executeSignificant-Gravitas AutoGPT
- CVE-2026-45410Time-based user enumeration in TREK authentication endpointmauriceboe TREK
- CVE-2026-47713AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migrationMintplex-Labs anything-llm
- CVE-2026-45403AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directoryMintplex-Labs anything-llm
- CVE-2026-44884Portainer: Missing authorization on custom template file endpoint exposes template contentportainer · github.com/portainer/portainer
- CVE-2026-44885Portainer: Path traversal in backup archive extraction allows arbitrary file writeportainer · github.com/portainer/portainer
- CVE-2026-45366typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocoluniversal-tool-calling-protocol typescript-utcp · @utcp/http
- CVE-2026-9646ScadaBR Unauthenticated Reflected Cross-Site ScriptingScadaBR
- CVE-2026-42070MantisBT: Authorization Bypass in Bugnote Editing via Issue Update APImantisbt · mantisbt/mantisbt
- CVE-2026-41897MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Fieldmantisbt · mantisbt/mantisbt
- CVE-2026-46843Vulnerability in Oracle REST Data Services (component: Core).Oracle REST Data Services
- CVE-2026-46842Vulnerability in Oracle REST Data Services (component: Core).Oracle REST Data Services
- CVE-2026-46841Vulnerability in Oracle REST Data Services (component: General).Oracle REST Data Services
- CVE-2026-46830Vulnerability in Oracle REST Data Services (component: Mongoapi).Oracle REST Data Services
- CVE-2026-49093Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network AccessElastic Kibana
- CVE-2026-49094Uncontrolled Resource Consumption in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-42399Uncontrolled Resource Consumption in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-42400Uncontrolled Resource Consumption in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-42401Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML InjectionElastic Kibana
- CVE-2026-33463Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File AccessElastic Kibana
- CVE-2026-33464Uncontrolled Resource Consumption in Kibana Leading to Denial of ServiceElastic Kibana
- CVE-2026-33462Path Traversal in Kibana Leading to Unauthorized Deletion of User AccountsElastic Kibana
- CVE-2026-49130Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxxMusicPlayerDaemon MPD
- CVE-2026-49129Music Player Daemon < 0.24.11 SSRF via CurlInputPluginMusicPlayerDaemon MPD
- CVE-2026-46685RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on consolerustfs
- CVE-2026-45040RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]rustfs
- CVE-2026-47136RustFS: Unauthenticated RustFS console license endpoint exposes license metadatarustfs
- CVE-2026-47337NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediationCanonical Ubuntu Linux
- CVE-2026-47336Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rulesCanonical Ubuntu Linux
- CVE-2026-47335NULL pointer dereference in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47334Deadlock or kernel panic in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47332Out-of-bounds read in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47330Use of uninitialized value in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47329Incorrect validation of field size in Ubuntu Linux AppArmor notification responsesCanonical Ubuntu Linux
- CVE-2026-47328Invalid pointer deallocation in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47327NULL pointer dereference in Ubuntu Linux AppArmor notification handlingCanonical Ubuntu Linux
- CVE-2026-47326Memory leak in Ubuntu Linux AppArmor large notification response allocationCanonical Ubuntu Linux
- CVE-2026-43979Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)LearningCircuit local-deep-research · local-deep-research
- CVE-2026-46526Local Deep Research: SSRF bypass in `safe_get`LearningCircuit local-deep-research · local-deep-research
- CVE-2026-45307Speakr: Open redirect in is_safe_url via parser mismatch on next parametermurtaza-nasir speakr
- CVE-2026-45021Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdminkumahq kuma · github.com/kumahq/kuma +1
- CVE-2026-45787electerm's encrypt method not safe enoughelecterm
- CVE-2026-45306pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directorypyload · pyload-ng
- CVE-2026-46561pyLoad: SSRF via HTTP Redirect Bypass in parse_urls APIpyload · pyload-ng
- CVE-2026-44794Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to referencenautobot
- CVE-2026-44796Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)nautobot
- CVE-2026-45297Cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatchopenreplay
- CVE-2026-45292opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagationopen-telemetry opentelemetry-java · io.opentelemetry ope… +3
- CVE-2026-41141EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookupespocrm
- CVE-2026-41160EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notesespocrm
- CVE-2026-9091CVE-2026-9091Casdoor · github.com/casdoor/casdoor
- CVE-2026-44462Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissionszed-industries zed
- CVE-2026-45078Synapse CPU starvation (Denial of Service)element-hq synapse · matrix-synapse
- CVE-2026-45076Synapse pagination denial of serviceelement-hq synapse · matrix-synapse
- CVE-2026-41185ServiceAccount token disclosure via Azure IPAM CNI plugin logsTigera Calico · github.com/projectcalico/calico +1
- CVE-2026-41184ServiceAccount token disclosure via install-cni container logsTigera Calico · github.com/projectcalico/calico +1
- CVE-2026-47673Hono: JWT middleware accepts any Authorization scheme, not only Bearerhonojs hono · hono
- CVE-2026-47674Hono: IP Restriction bypasses static deny rules for non-canonical IPv6honojs hono · hono
- CVE-2026-47675Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionhonojs hono · hono
- CVE-2026-47676Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathshonojs hono · hono
- CVE-2026-48525PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSjpadilla pyjwt · pyjwt
- CVE-2026-48523PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keysjpadilla pyjwt · pyjwt
- CVE-2026-48524PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)jpadilla pyjwt · pyjwt
- CVE-2026-48522PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemesjpadilla pyjwt · pyjwt
- CVE-2026-48155pypdf: Possible large memory usage for large offsets for layout mode textpy-pdf pypdf · pypdf
- CVE-2026-48156pypdf: Possible long runtimes for zero-only width values in cross-reference streamspy-pdf pypdf · pypdf
- CVE-2026-48735pypdf: Manipulated XMP metadata streams can exhaust RAMpy-pdf pypdf · pypdf
- CVE-2026-8990Authentication Bypass in KidsviewView Concept Kidsview
- CVE-2026-42250Off-by-One Leading to Out-of-Bounds Write in bzip2bzip2
- CVE-2026-9828Logback deserialization whitelist bypass for java.lang and java.utilQOS.CH Sarl logback · ch.qos.logback:logback-core
- CVE-2026-40914Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permissionApache Software Foundation Apache Artemis Stomp Protocol… +1
- CVE-2026-46241spi: mpc52xx: fix use-after-free on registration failureLinux
- CVE-2026-46239media: i2c: ov5647: Fix runtime PM refcount leak in s_ctrlLinux
- CVE-2026-46236media: rc: xbox_remote: heed DMA restrictionsLinux
- CVE-2026-46235media: saa7164: add ioremap return checks and cleanupsLinux
- CVE-2026-46234vsock: fix buffer size clamping orderLinux
- CVE-2026-46233batman-adv: bla: only purge non-released claimsLinux
- CVE-2026-46231batman-adv: bla: put backbone reference on failed claim hash insertLinux
- CVE-2026-46229drm/amdkfd: Clear VRAM on allocation to prevent stale data exposureLinux
- CVE-2026-46228spi: ch341: fix devres lifetimeLinux
- CVE-2026-46226spi: fsl: fix controller deregistrationLinux
- CVE-2026-46225spi: rspi: fix controller deregistrationLinux
- CVE-2026-46224drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failureLinux
- CVE-2026-46223cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulatedLinux
- CVE-2026-46222media: rockchip: rkcif: Add missing MUST_CONNECT flag to padsLinux
- CVE-2026-46221EDAC/versalnet: Fix device name memory leakLinux
- CVE-2026-46220drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emissionLinux
- CVE-2026-46219spi: mpc52xx: fix use-after-free on unbindLinux
- CVE-2026-46216drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()Linux
- CVE-2026-46214vsock/virtio: fix accept queue count leak on transport mismatchLinux
- CVE-2026-46213HID: appletb-kbd: fix UAF in inactivity-timer cleanup pathLinux
- CVE-2026-46211drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()Linux
- CVE-2026-46207vsock/virtio: fix empty payload in tap skb for non-linear buffersLinux
- CVE-2026-46203spi: cadence-quadspi: fix unclocked access on unbindLinux
- CVE-2026-46202HID: appletb-kbd: run inactivity autodim from workqueuesLinux
- CVE-2026-46200spi: mpc52xx: fix controller deregistrationLinux
- CVE-2026-46196tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()Linux
- CVE-2026-46193xfrm: ah: account for ESN high bits in async callbacksLinux
- CVE-2026-46192spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operationsLinux
- CVE-2026-46191fbcon: Avoid OOB font access if console rotation failsLinux
- CVE-2026-46188octeon_ep_vf: add NULL check for napi_build_skb()Linux
- CVE-2026-46187wifi: rsi: fix kthread lifetime race between self-exit and external-stopLinux
- CVE-2026-46186Bluetooth: virtio_bt: validate rx pkt_type header lengthLinux
- CVE-2026-46184sound: ua101: fix division by zero at probeLinux
- CVE-2026-46183mm/damon/sysfs-schemes: protect path kfree() with damon_sysfs_lockLinux
- CVE-2026-46182pseries/papr-hvpipe: Prevent kernel stack memory leak to userspaceLinux
- CVE-2026-46180wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog taskLinux
- CVE-2026-46179ASoC: SOF: Don't allow pointer operations on unconfigured streamsLinux
- CVE-2026-46172ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()Linux
- CVE-2026-46171riscv: kvm: fix vector context allocation leakLinux
- CVE-2026-46170mptcp: pm: ADD_ADDR rtx: free sk if lastLinux
- CVE-2026-46169hfsplus: fix uninit-value by validating catalog record sizeLinux
- CVE-2026-46168mptcp: fix scheduling with atomic in timestamp sockoptLinux
- CVE-2026-46167usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctlLinux
- CVE-2026-46165openvswitch: vport: fix self-deadlock on release of tunnel portsLinux
- CVE-2026-46163wifi: b43legacy: enforce bounds check on firmware key index in RX pathLinux
- CVE-2026-46162ice: fix double free in ice_sf_eth_activate() error pathLinux
- CVE-2026-46161md/raid10: fix divide-by-zero in setup_geo() with zero far_copiesLinux
- CVE-2026-46160btrfs: fix missing last_unlink_trans update when removing a directoryLinux
- CVE-2026-46159btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leakLinux
- CVE-2026-46158mptcp: pm: ADD_ADDR rtx: always decrease sk refcountLinux
- CVE-2026-46156LoongArch: Fix potential ADE in loongson_gpu_fixup_dma_hang()Linux
- CVE-2026-461538021q: delete cleared egress QoS mappingsLinux
- CVE-2026-46151usb: usblp: fix heap leak in IEEE 1284 device ID via short responseLinux
- CVE-2026-46148spi: microchip-core-qspi: control built-in cs manuallyLinux
- CVE-2026-46147KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()Linux
- CVE-2026-46146ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()Linux
- CVE-2026-46144RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()Linux
- CVE-2026-46143ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opensLinux
- CVE-2026-46142net: libwx: fix VF illegal register accessLinux
- CVE-2026-46141powerpc/xive: fix kmemleak caused by incorrect chip_data lookupLinux
- CVE-2026-46140Bluetooth: btmtk: validate WMT event SKB length before struct accessLinux
- CVE-2026-46139smb: client: use kzalloc to zero-initialize security descriptor bufferLinux
- CVE-2026-46136wifi: mt76: mt7921: fix a potential clc buffer length underflowLinux
- CVE-2026-46134platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registrationLinux
- CVE-2026-46132net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfoLinux
- CVE-2026-46131KVM: x86: check for nEPT/nNPT in slow flush hypercallsLinux
- CVE-2026-46130dm-verity-fec: fix reading parity bytes split across blocks (take 3)Linux
- CVE-2026-46128ipmi: Check event message buffer response for bad dataLinux
- CVE-2026-46127RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()Linux
- CVE-2026-46126RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()Linux
- CVE-2026-46122wifi: b43: enforce bounds check on firmware key index in b43_rx()Linux
- CVE-2026-46121mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lockLinux
- CVE-2026-46118pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()Linux
- CVE-2026-46109usb: ulpi: fix memory leak on ulpi_register() error pathsLinux
- CVE-2026-46108ipmi:si: Return state to normal if message allocation failsLinux
- CVE-2026-46106eventfs: Hold eventfs_mutex and SRCU when remount walks eventsLinux
- CVE-2026-46104selinux: use sk blob accessor in socket permission helpersLinux
- CVE-2026-9813FlowIntel external reference URL probe allows server-side request forgeryflowintel
- CVE-2026-4377Use of Weak Credentials in D-Link DWR-X1820 routerD-Link DWR-X1820
- CVE-2026-4334Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting3uu Shariff Wrapper
- CVE-2024-47097Reflected Cross-Site Scripting in Follet School Solutions DestinyFollet School Solutions Destiny
- CVE-2024-47096Reflected Cross-Site Scripting in Follet School Solutions DestinyFollet School Solutions Destiny
- CVE-2026-6937Appointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpointcroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2026-8689Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functionsthemeisle Visualizer: Tables and Charts Manager for WordPre…
- CVE-2026-9015Equalize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Actionequalizedigital Equalize Digital Accessibility Checker – WC…
- CVE-2026-7048Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode AttributePhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-7526PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Pagesmub PDF Embedder – PDF Viewer & Embed PDF Files for WordPr…
- CVE-2026-9807Incorrect Authorization in GitLabGitLab
- CVE-2026-86823D Viewer <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpointhasanazizul 3D Viewer – 3D Model Viewer – Augmented Reality…
- CVE-2026-7660Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameterdavidanderson Easy Updates Manager
- CVE-2026-7621SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/TruncateSMTP2GO for WordPress – Email Made Easy
- CVE-2026-7552Geo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parametercyberhobo Geo Mashup
- CVE-2026-6427a3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Elementa3rev a3 Lazy Load
- CVE-2026-9618PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe UnlinkPeachPay — Payments & Express Checkout for WooCommerce
- CVE-2026-7651User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameterwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-9806Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Namesmisp cti-transmute
- CVE-2026-7533Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parametersmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2026-9644LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingnhadjidimitrov LiveSmart Video Chat Live Video Chat
- CVE-2026-3173Meta Field Block <= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposuremr2p Meta Field Block – Display custom fields in the Block…
- CVE-2026-9802Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9803Keycloak: keycloak: denial of service via malformed authorization headerRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9801Keycloak: keycloak: denial of service via malformed ldap password policy responseRed Hat build of Keycloak · org.keycloak:keycloak-ldap-fede…
- CVE-2026-9798Keycloak: keycloak: brute-force protection bypass in ciba flowRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9796Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerabilityRed Hat build of Keycloak · org.keycloak:keycloak-server
- CVE-2026-9794Keycloak: keycloak: information disclosure via saml ecp endpointRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9792Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9793Keycloak: keycloak: security policy bypass in jwe-encrypted request object processingRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9228Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Functionjetmonsters Timetable and Event Schedule by MotoPress
- CVE-2026-9241FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameterrealmag777 FOX – Currency Switcher Professional for WooComm…
- CVE-2026-5737Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Routebensibley Independent Analytics – WordPress Analytics Plugin
- CVE-2026-9791Keycloak-rhel9: organization data leak after feature disabled in keycloakRed Hat build of Keycloak · org.keycloak:keycloak-server… +1
- CVE-2026-42998An issue was discovered in OpenStack Keystone before 29.0.2.OpenStack Keystone · keystone
- CVE-2026-42999An issue was discovered in OpenStack Keystone before 29.0.2.OpenStack Keystone · keystone
- CVE-2026-43000An issue was discovered in OpenStack Keystone before 29.0.2.OpenStack Keystone · keystone
- CVE-2026-44394An issue was discovered in OpenStack Keystone before 29.0.2.OpenStack Keystone · keystone