CVEs published May 29, 2026
248 CVEs were published on May 29, 2026: 43 critical, 105 high.
- Published
- 248
- Critical
- 43
- High
- 105
- Medium
- 84
- Low
- 16
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 113
Most affected products
- Waterfall WF-500
- 17
- JetBrains TeamCity
- 11
- dokploy
- 10
- WWBN AVideo · WWBN/AVideo
- 9
- Indian Motorcycle Scout Bobber + Tech
- 7
- mautic/core
- 7
- Open ISES Project
- 7
- OpenClaw
- 6
- SillyTavern
- 6
- Sitejo HaPe PKH
- 6
Critical 43
- CVE-2026-45372cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injectionyhirose cpp-httplib
- CVE-2026-45697Formie: Pre-authenticated server-side template injection in Hidden fieldsverbb formie · verbb/formie
- CVE-2026-9051Authentication Bypass Vulnerability in NI SystemLink EnterpriseNI SystemLink Enterprise
- CVE-2026-47744Shopper: Authorization bypass and RBAC privilege escalation in team settingsshopperlabs shopper · shopper/framework
- CVE-2026-44650SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')SillyTavern
- CVE-2026-44649SillyTavern: Authentication Bypass via SSO Header InjectionSillyTavern
- CVE-2026-45668Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled)TriliumNext Trilium
- CVE-2026-7786Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded CredentialsJinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485…
- CVE-2026-45625Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configsgetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-45629Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpointdokploy
- CVE-2026-45628Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipelinedokploy
- CVE-2026-5386KMW CCTV Security Cameras Unverified Password ChangeKMW KM-IP521 · KMW KM-IP421
- CVE-2026-45630Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statementdokploy
- CVE-2026-45631Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secretdokploy
- CVE-2026-45632Dokploy: Schedule Authorization Bypass Enables Host/Server Command Executiondokploy
- CVE-2026-45633Dokploy: Command Injection in /docker-container-logs Endpointdokploy
- CVE-2026-45661Dokploy: Remote Code Execution through Path Traversaldokploy
- CVE-2026-45663Dokploy: Remote Code Execution via destinationPath in Container File Uploaddokploy
- CVE-2026-44962Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolatWebPros Plesk
- CVE-2026-10042manga-image-translator RCE via Unsafe Pickle Deserialization in Share Modelzyddnys manga-image-translator
- CVE-2026-4290WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including AdministratorsWPTravel WP Travel Pro
- CVE-2026-46376FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP InterfaceFreePBX security-reporting
- CVE-2026-10071Interinfo｜DreamMaker - Arbitrary File UploadInterinfo DreamMaker
- CVE-2026-45043RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Rootrustfs
- CVE-2026-45312RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Executioninfiniflow ragflow
- CVE-2026-9508Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStarSuprema BioStar
- CVE-2026-8326Remote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCERemote Spark (https://www.remotespark.com/) SparkView
- CVE-2025-41277Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41276Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41275Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41274Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41273Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500Waterfall WF-500
- CVE-2025-41272Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41270Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41269Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2026-9559A path traversal vulnerability exists in the campaign import feature of Mautic 7.mautic/core
- CVE-2026-9558A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.mautic/core
- CVE-2026-49201Acer Wave 7 router: Hardcoded Cryptographic KeyAcer Wave 7 router
- CVE-2026-49200Acer Wave 7 router: Broken Access ControlAcer Wave 7 router
- CVE-2026-49199Predator Connect W6x: RCE via MQTTAcer Predator Connect W6x
- CVE-2026-49197Predator Connect W6x: Improper AuthenticationAcer Predator Connect W6x
- CVE-2026-3655OTP Login With Phone Number, OTP Verification <= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verificationglboy OTP Login With Phone Number, OTP Verification
- CVE-2026-8732WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Actionflippercode WP Maps Pro
High 105
- CVE-2026-46385iskorotkov/avro: CPU Exhaustion in Avro Decoderiskorotkov avro · github.com/iskorotkov/avro/v2 +1
- CVE-2026-46384iskorotkov/avro: Integer Overflow in Avro Decoderiskorotkov avro · github.com/iskorotkov/avro/v2 +1
- CVE-2026-47123FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Pathfreescout-help-desk freescout
- CVE-2026-48557Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.phpspatie laravel-medialibrary · spatie/laravel-medialibrary
- CVE-2026-45700Heap-buffer-overflow write in planar bitmap decoderFreeRDP
- CVE-2026-44420FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB_CLIP_CAPSFreeRDP
- CVE-2026-44422FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusionFreeRDP
- CVE-2026-44421FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypassFreeRDP
- CVE-2026-46599Excessive resource consumption in PackBits decompression in golang.org/x/image/tiffgolang.org/x/image/tiff · golang.org/x/image
- CVE-2026-44285FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview APIlabring FastGPT
- CVE-2026-46527cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crashyhirose cpp-httplib
- CVE-2026-47266Formie: Unauthenticated front-end submission editing can overwrite existing submissionsverbb formie · verbb/formie
- CVE-2026-49374In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parametersJetBrains TeamCity
- CVE-2026-49373In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsJetBrains TeamCity
- CVE-2026-49372In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possibleJetBrains TeamCity
- CVE-2026-49371In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleJetBrains TeamCity
- CVE-2026-49368In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possibleJetBrains YouTrack
- CVE-2026-49367In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user accountJetBrains IntelliJ IDEA
- CVE-2026-49366In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completionJetBrains IntelliJ IDEA
- CVE-2026-47740Shopper: Authorization bypass in multiple Livewire admin componentsshopperlabs shopper · shopper/framework
- CVE-2026-44648SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeoverSillyTavern
- CVE-2026-42929MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded CredentialsDanelec MacGregor Voyage Data Recorder (VDR) G4e
- CVE-2026-46372SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrlSillyTavern
- CVE-2026-42941MacGregor Voyage Data Recorder (VDR) G4e Use of Default CredentialsDanelec MacGregor Voyage Data Recorder (VDR) G4e
- CVE-2026-44697Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payloadklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-45627Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeovergetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-47125Arcane: Missing admin authorization on global variables endpointgetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-47179Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcanegetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-5768Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical FunctionFourth Frontier Frontier X Android application · Fourth… +1
- CVE-2026-10108xiaomusic 0.5.7 Path Traversal via GET /music endpointhanxi xiaomusic · xiaomusic
- CVE-2026-10107MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpointjxxghp MoviePilot
- CVE-2026-6824CP Plus 8 Ch. Network Video Recorder Cross-site ScriptingCP Plus CP-UNR-108F1 Hardware · CP Plus CP-UNR-108F1 Web +1
- CVE-2026-10105agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()agno-agi agno · agno
- CVE-2026-45662Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)dokploy
- CVE-2026-10069Shibby Tomato miniupnpd resource consumptionShibby Tomato
- CVE-2026-10067Shibby Tomato multimon.cgi sub_90F0 stack-based overflowShibby Tomato
- CVE-2026-10066Shibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflowShibby Tomato
- CVE-2026-48501GitHub CLI tokens leak via `gh attestation` commandscli · github.com/cli/cli +1
- CVE-2026-35674OpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send RouteOpenClaw
- CVE-2026-35630OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval ButtonsOpenClaw
- CVE-2026-32905OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat CommandOpenClaw
- CVE-2026-10065Shibby Tomato tomatodata.cgi get_ups_field stack-based overflowShibby Tomato
- CVE-2018-25404The Open ISES Project 3.30A SQL Injection via add_facnote.phpOpen ISES Project
- CVE-2018-25403The Open ISES Project 3.30A SQL Injection via city_graph.phpOpen ISES Project
- CVE-2018-25402The Open ISES Project 3.30A SQL Injection via inc_types_graph.phpOpen ISES Project
- CVE-2018-25401The Open ISES Project 3.30A SQL Injection via sever_graph.phpOpen ISES Project
- CVE-2018-25400The Open ISES Project 3.30A SQL Injection via form_post.phpOpen ISES Project
- CVE-2018-25399The Open ISES Project 3.30A SQL Injection via nearby.phpOpen ISES Project
- CVE-2018-25398The Open ISES Project 3.30A SQL Injection via main.phpOpen ISES Project
- CVE-2018-25396Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htmHeatmiser Wifi Thermostat
- CVE-2018-25395Kados R10 GreenBee SQL Injection via update_feature.phpKados R10 GreenBee
- CVE-2018-25394Kados R10 GreenBee SQL Injection via update_release.phpKados R10 GreenBee
- CVE-2018-25393Navigate CMS 2.8.5 Path Traversal via navigate_download.phpNavigatecms Navigate CMS
- CVE-2018-25392MaxOn ERP Software 8.x-9.x SQL Injection via nomor ParameterTalagasoft MaxOn ERP
- CVE-2018-25391HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record DeletionSitejo HaPe PKH
- CVE-2018-25390HaPe PKH 1.1 SQL Injection via desa ParameterSitejo HaPe PKH
- CVE-2018-25389HaPe PKH 1.1 SQL Injection via nama_kelompok ParameterSitejo HaPe PKH
- CVE-2018-25388HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.phpSitejo HaPe PKH
- CVE-2018-25386HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.phpSitejo HaPe PKH
- CVE-2018-25385E-Registrasi Pencak Silat 18.10 SQL Injection via id_partaieregistrasi-kejuaraan-silat Registrasi Pencak Silat
- CVE-2018-25383Free MP3 CD Ripper 2.8 Buffer Overflow SEH DEP BypassCommentcamarche Free MP3 CD Ripper
- CVE-2018-25382Zechat 1.5 SQL Injection via uname ParameterBylancer Zechat
- CVE-2026-10063TRENDnet TEW-432BRP formWPS stack-based overflowTRENDnet TEW-432BRP
- CVE-2026-45609mcp-security: Unvalidated URL Fetching (SSRF)spring-ai-community mcp-security · org.springaicommunity:mc…
- CVE-2026-10062TRENDnet TEW-432BRP formSetRoute stack-based overflowTRENDnet TEW-432BRP
- CVE-2026-46510Prototype pollution in form-data-objectizer via bracket-notation form keyskaspernj form-data-objectizer · form-data-objectizer
- CVE-2026-45707n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incompleteczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-44698Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injectionhome-assistant core · Home Assistant Companion app
- CVE-2026-45615mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in `INTEGER_decode_oer` via Malformed OER Payloadmouse07410 asn1c
- CVE-2026-45578WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URLWWBN AVideo · WWBN/AVideo
- CVE-2026-47696WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpointWWBN AVideo · WWBN/AVideo
- CVE-2026-45555Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code ExecutionMarcelRoozekrans roslyn-codelens-mcp
- CVE-2026-44237FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API ModuleFreePBX security-reporting
- CVE-2026-44238FreePBX: Authenticated SQL Injection via ORDER BY in CDR ReportsFreePBX security-reporting
- CVE-2026-44239FreePBX: Authenticated Local File Inclusion in Dashboard ModuleFreePBX security-reporting
- CVE-2026-10073Interinfo｜DreamMaker - Arbitrary File ReadInterinfo DreamMaker
- CVE-2026-10072Interinfo｜DreamMaker - Arbitrary File UploadInterinfo DreamMaker
- CVE-2026-48527HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpointhaxtheweb haxcms-nodejs · haxtheweb haxcms-php +1
- CVE-2026-9509Uncaught exception vulnerability in Suprema's BioStarSuprema BioStar
- CVE-2025-41281Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in WateWaterfall WF-500
- CVE-2025-41280Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 thatWaterfall WF-500
- CVE-2025-41279Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41278Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attackWaterfall WF-500
- CVE-2025-41271Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.Waterfall WF-500
- CVE-2025-41268Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in versionWaterfall WF-500
- CVE-2025-41267Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41266Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2025-41265Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Waterfall WF-500
- CVE-2026-9809A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7.mautic/core
- CVE-2026-9808An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform).mautic/core
- CVE-2026-42965Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validationRed Hat OpenShift Container Platform
- CVE-2026-46579Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontendRed Hat OpenShift Container Platform
- CVE-2026-49198Predator Connect W6x: MQTT Broker Access ControlAcer Predator Connect W6x
- CVE-2026-49196Predator Connect W6x: Web Interface Command InjectionAcer Predator Connect W6x
- CVE-2026-10056CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin requestNetwork Optix Nx Witness VMS
- CVE-2026-49195Predator Connect W6x: unauthenticated Debug ServiceAcer Predator Connect W6x
- CVE-2026-6075Media Library Assistant <= 3.35 - Cross-Site Request Forgery via Bulk Action Formdglingren Media Library Assistant
- CVE-2026-4776An SQL injection vulnerability exists in Mautic's API contact filtering mechanism.mautic/core
- CVE-2025-11262Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scriptinglinkwhspr Link Whisper Free
- CVE-2026-9493BankPro E-Service Technology｜Service Center - Insecure Direct Object ReferenceBankPro E-Service Technology Service Center
- CVE-2025-11993WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injectionsbthemes WooCommerce Infinite Scroll and Ajax Pagination
- CVE-2026-7480An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate priviASUS System Control Interface
- CVE-2026-8070Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, reASUS Armoury Crate
- CVE-2026-39276The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitra
- CVE-2026-39292Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows
Medium, low and unrated 100
- CVE-2026-9831ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race ConditionExtreme Networks Extreme Platform ONE
- CVE-2026-45149brace-expansion: Large numeric range defeats documented `max` DoS protectionjuliangruber brace-expansion · brace-expansion
- CVE-2026-45294FreeScout: User Account Enumeration via Password Reset Response Differentiationfreescout-help-desk freescout
- CVE-2026-48810FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Checkfreescout-help-desk freescout
- CVE-2026-48811FreeScout: Thread Deletion Bypasses Mailbox Access Revocationfreescout-help-desk freescout
- CVE-2026-44287FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassablelabring FastGPT
- CVE-2026-45151NanoMQ: NULL Pointer Dereferencenanomq
- CVE-2026-44640NanoMQ: QUIC Dialer Close Type Confusionnanomq
- CVE-2026-45352cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encodingyhirose cpp-httplib
- CVE-2026-45324Rizin: Double free in cmd_search.crizinorg rizin
- CVE-2026-45613Rizin: Heap-buffer-overflow in OMF parserrizinorg rizin
- CVE-2026-34127Stored Cross-Site Scripting (XSS) via Configuration File Import on TP-Link's TL-SG108PETP-Link Systems TL-SG108PE
- CVE-2026-42500Panic when reading out of bound palette index in golang.org/x/image/bmpgolang.org/x/image/bmp · golang.org/x/image
- CVE-2026-48555Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()spatie laravel-medialibrary · spatie/laravel-medialibrary
- CVE-2026-4387Unencrypted storage of authentication state in StrongDM Desktop Application state.kv fileStrongDM Desktop Application · StrongDM Desktop Client
- CVE-2026-49386In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning CanvasJetBrains YouTrack
- CVE-2026-49385In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accountsJetBrains YouTrack
- CVE-2026-49384In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possibleJetBrains PyCharm
- CVE-2026-49383In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possibleJetBrains IntelliJ IDEA
- CVE-2026-49382In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright pluginJetBrains IntelliJ IDEA
- CVE-2026-49381In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleJetBrains TeamCity
- CVE-2026-49380In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleJetBrains TeamCity
- CVE-2026-49379In JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesJetBrains TeamCity
- CVE-2026-49378In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionJetBrains TeamCity
- CVE-2026-49377In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersJetBrains TeamCity
- CVE-2026-49376In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML pluginJetBrains TeamCity
- CVE-2026-49375In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download pageJetBrains TeamCity
- CVE-2026-49370In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requestsJetBrains YouTrack
- CVE-2026-49369In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesJetBrains YouTrack
- CVE-2026-46344liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194)open-quantum-safe liboqs
- CVE-2026-44518liboqs: XMSS Buffer Overread Bugopen-quantum-safe liboqs
- CVE-2026-47741Shopper: Race condition on Discount.usage_limit allows silent over-redemptionshopperlabs shopper · shopper/cart
- CVE-2026-47742Shopper: Missing authorization on Product admin Livewire sub-form componentsshopperlabs shopper · shopper/framework
- CVE-2026-47745Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tablesshopperlabs shopper · shopper/framework
- CVE-2026-44651SillyTavern: Reflected XSS vulnerability in the CORS proxy middlewareSillyTavern
- CVE-2026-40425MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External PartiesDanelec MacGregor Voyage Data Recorder (VDR) G4e
- CVE-2026-44652SillyTavern: SSRF vulnerability in the CORS proxy middlewareSillyTavern
- CVE-2026-44611MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational EffortDanelec MacGregor Voyage Data Recorder (VDR) G4e
- CVE-2026-42951MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected CredentialsDanelec MacGregor Voyage Data Recorder (VDR) G4e
- CVE-2026-45626Arcane: OS Command Injection in Volume Browser ListDirectory via path query parametergetarcaneapp arcane · github.com/getarcaneapp/arcane/backend
- CVE-2026-45577Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypassmarkmhendrickson neotoma · neotoma
- CVE-2026-45660Statamic: Server-Side Request Forgery via Glidestatamic cms · statamic/cms
- CVE-2026-43917Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validationdokploy
- CVE-2026-10070macrozheng mall Super Admin Password update improper authorizationmacrozheng mall
- CVE-2026-10099XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.pyXX-Net
- CVE-2026-10068Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgeryShibby Tomato
- CVE-2026-10101Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view usersRed Hat Multicluster Engine for Kubernetes
- CVE-2026-33386XSS in QuickCMSOpenSolution QuickCMS
- CVE-2026-33384Session Fixation in QuickCMSOpenSolution QuickCMS
- CVE-2026-35673OpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export RoutesOpenClaw
- CVE-2026-34507OpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom ChecksOpenClaw
- CVE-2026-32906OpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver GateOpenClaw
- CVE-2018-25397PHP-SHOP 1.0 Cross-Site Request Forgery via users.phpjoeyrush PHP-SHOP master
- CVE-2018-25387HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.phpSitejo HaPe PKH
- CVE-2018-25384Wikidforum 2.20 Cross-Site Scripting via reply_text ParameterWikidforum
- CVE-2026-10064TRENDnet TEW-432BRP formSetPortTr stack-based overflowTRENDnet TEW-432BRP
- CVE-2026-41150Mermaid Gantt Charts are vulnerable to an Infinite Loop DoSmermaid-js mermaid · mermaid
- CVE-2026-41159Mermaid: Improper sanitization of configuration leads to CSS injectionmermaid-js mermaid · mermaid
- CVE-2026-40528OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.cOpenSC
- CVE-2026-45582n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parametersczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-10061TRENDnet TEW-432BRP formWPS command injectionTRENDnet TEW-432BRP
- CVE-2026-40510OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.cOpenSC
- CVE-2026-49318Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at bootIndian Motorcycle Scout Bobber + Tech
- CVE-2026-10060TRENDnet TEW-432BRP formSetRoute command injectionTRENDnet TEW-432BRP
- CVE-2026-45580WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attributeWWBN AVideo · WWBN/AVideo
- CVE-2026-45610WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FAWWBN AVideo · WWBN/AVideo
- CVE-2026-45619AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD postWWBN AVideo · WWBN/AVideo
- CVE-2026-45620AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumerationWWBN AVideo · WWBN/AVideo
- CVE-2026-45731WWBN AVideo: Authenticated Arbitrary File Read in view/update.phpWWBN AVideo · WWBN/AVideo
- CVE-2026-46337WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`WWBN AVideo · WWBN/AVideo
- CVE-2026-47694WWBN AVideo: Stored XSS via unescaped Gallery category descriptionWWBN AVideo · WWBN/AVideo
- CVE-2026-10075Interinfo｜DreamMaker - Path TraversalInterinfo DreamMaker
- CVE-2026-10074Interinfo｜DreamMaker - Arbitrary File ReadInterinfo DreamMaker
- CVE-2026-49317Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at bootIndian Motorcycle Scout Bobber + Tech
- CVE-2026-49316Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdownIndian Motorcycle Scout Bobber + Tech
- CVE-2026-49325Indian Scout Bobber 2025 WCM voltage-based shutdownIndian Motorcycle Scout Bobber + Tech
- CVE-2026-45551Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting WriteIntermesh groupoffice
- CVE-2026-49324Indian Scout Bobber 2025 WCM brute-forceIndian Motorcycle Scout Bobber + Tech
- CVE-2026-49323Indian Scout Bobber 2025 WCM-to-ECM weak authenticationIndian Motorcycle Scout Bobber + Tech
- CVE-2026-9811A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7.mautic/core
- CVE-2026-9557A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component.mautic/core
- CVE-2026-10078Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystringRed Hat Quay
- CVE-2025-12714Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modificationrankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2026-10058ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site ScriptingITP Technology ITS Intelligent SCADA System
- CVE-2026-10057ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site ScriptingITP Technology ITS Intelligent SCADA System
- CVE-2026-9189Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)scottpaterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2026-10052Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpointsRed Hat Quay
- CVE-2026-10039Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parametershabti Frontend Admin by DynamiApps
- CVE-2026-49322Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchangeIndian Motorcycle Scout Bobber + Tech
- CVE-2026-9243The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameterposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2026-9714Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributecreaweb2b Simple Divi Shortcode
- CVE-2025-14042Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Detailsthemesuite Automotive Car Dealership Business WordPress The…
- CVE-2026-6275StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author NicknameStatCounter – Free Real Time Visitor Stats
- CVE-2026-6324Libsoup: libsoup: http request smuggling via unsigned to signed conversion errorRed Hat Enterprise Linux
- CVE-2026-2128Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookiecloudways Breeze Cache
- CVE-2026-8995Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Actionays-pro Poll Maker by AYS – Versus Polls, Anonymous Polls,…
- CVE-2026-7430Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Importsaadiqbal Post Snippets – Custom WordPress Code Snippets Cu…
- CVE-2026-6892Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker with login privileges toCanon PIXUS iX6800 Series CUPS Printer Driver for macOS… +1
- CVE-2026-36324SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in
- CVE-2026-39229Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages.