CVEs published June 9, 2026
718 CVEs were published on June 9, 2026: 36 critical, 350 high. 2 are now in CISA KEV.
- Published
- 718
- Critical
- 36
- High
- 350
- Medium
- 304
- Low
- 23
- Unrated
- 5
- Now in CISA KEV
- 2
- Fix available
- 406
Most affected products
- Microsoft Windows
- 104
- Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- 57
- Linux
- 21
- Microsoft SharePoint Enterprise Server · Microsoft SharePoi…
- 21
- Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- 20
- OpenSSL
- 18
- Adobe InDesign Desktop
- 12
- MongoDB Server
- 12
- Huawei HarmonyOS
- 11
- signalwire freeswitch
- 9
Critical 36
- CVE-2026-44963A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.Veeam Backup and Replication
- CVE-2026-47938Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Campaign Classic
- CVE-2026-48303Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic
- CVE-2026-47928ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-10045CVE-2026-10045Shenzhen Kangda Xin Intelligent Network Technology Co. DR300
- CVE-2026-34691Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager 6.5 LTS · Adobe Experience Manager
- CVE-2026-44815DHCP Client Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-42904Windows TCP/IP Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-47643Azure Stack Edge Remote Code Execution VulnerabilityMicrosoft Azure Stack Edge
- CVE-2026-47281Visual Studio Code Elevation of Privilege VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-45602Windows Dynamic Host Configuration Protocol (DHCP) Tampering VulnerabilityMicrosoft Windows
- CVE-2026-26142Nuance PowerScribe Remote Code Execution VulnerabilityMicrosoft Nuance PowerScribe 360 · Microsoft Nuance Powe… +1
- CVE-2026-47291HTTP.sys Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-45657Windows Kernel Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-34182CMS AuthEnvelopedData Processing May Accept Forged MessagesOpenSSL
- CVE-2026-49841FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body readsignalwire freeswitch
- CVE-2026-49840FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsingsignalwire freeswitch
- CVE-2026-8025SQLi in MOSK Informatics' CBS PlatformMOSK Information Technologies CBS Platform
- CVE-2026-25089A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 thFortinet FortiSandbox
- CVE-2026-10523An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthentivanti Sentry
- CVE-2026-10520An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated userivanti Sentry
- CVE-2026-46325RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZELinux
- CVE-2026-7486SQLi in Netcad's E-İmarNetcad Software E-İmar
- CVE-2026-46316KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryLinux
- CVE-2017-20251WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST APIThemeisle Woody Code Snippets
- CVE-2025-10263Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-Arm C1-Ultra · Arm C1-Premium +14
- CVE-2026-10731SQL injection in Nemon productsNemon Trade Energy
- CVE-2009-10007Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacksETHER Catalyst::Plugin::Authentication
- CVE-2026-5067Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Keyzephyrproject-rtos Zephyr
- CVE-2026-44748XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP PlatformSAP_SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-40128Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)SAP_SE SAP NetWeaver Application Server Java
- CVE-2026-27671Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP PlatformSAP_SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-30141An issue was discovered in bitbank2 AnimatedGIF v2.2.0.
- CVE-2026-36721A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authenticatio
- CVE-2026-36727An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via
- CVE-2026-38615DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
High 350
- CVE-2026-44634Stack buffer overflows in SimpleBLEsimpleble
- CVE-2026-41732In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserializationSpring for Apache Pulsar · org.springframework.pulsar:sprin…
- CVE-2026-41731In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserializationSpring for Apache Kafka · org.springframework.kafka:spring-…
- CVE-2026-41729Spring Data REST SpEL Injection via Map Key in JSON PatchSpring Data REST · org.springframework.data:spring-data-res…
- CVE-2026-41728Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collectionsSpring Data REST · org.springframework.data:spring-data-res…
- CVE-2026-41717Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter BindingSpring Data MongoDB · org.springframework.data:spring-data-…
- CVE-2026-41716Spring Data web support unbounded negative-result cache keyed on attacker-supplied property namesSpring Data Commons · org.springframework.data:spring-data-…
- CVE-2026-46545nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed itemnimiq core-rs-albatross · nimiq-primitives
- CVE-2026-41695Denial of Service in Spring Data Commons Property Path ResolutionSpring Data Commons · org.springframework.data:spring-data-…
- CVE-2026-41003Unencoded HTML Outputs in Spring Security May Allow Cross-Site ScriptingSpring Security · org.springframework.security:spring-secur…
- CVE-2026-40993Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database EntrySpring Security · org.springframework.security:spring-secur…
- CVE-2026-40988Unbounded DEFLATE Inflation in SAML 2.0 Service ProviderSpring Security · org.springframework.security:spring-secur…
- CVE-2026-46541Nimiq network-libp2p: DHT query poisoning via first-record verification failurenimiq core-rs-albatross
- CVE-2026-53674BuddyPress 14.4.0 REGEXP Injection via @Mention Username ResolutionBuddyPress
- CVE-2026-53673BuddyPress 14.4.0 Private Message IDOR via REST API user_id ParameterBuddyPress · buddypress/buddypress
- CVE-2026-44716Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separatorpipecat-ai pipecat · pipecat-ai
- CVE-2026-46517LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outInternLM lmdeploy · lmdeploy
- CVE-2026-46432LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initializationInternLM lmdeploy · lmdeploy
- CVE-2026-46491SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletionsimplesamlphp-module-casserver · simplesamlphp/simplesamlph…
- CVE-2026-45782Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completioncloud-hypervisor
- CVE-2026-46518OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicsopenemr
- CVE-2026-9740Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflowMongoDB Server
- CVE-2026-46374SQLFluff: Uncontrolled Resource Consumption in Parsersqlfluff
- CVE-2026-46373SQLFluff: Recursive Stack Overflow in Parsersqlfluff
- CVE-2026-9754Stack memory disclosure in filemd5 commandMongoDB
- CVE-2026-9753Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.MongoDB Server
- CVE-2026-9752GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generationMongoDB Server
- CVE-2026-9750Metadata name collision on $-prefixed fields causes post-auth server crashMongoDB Server
- CVE-2026-9749Using MaxKey() may crash the serverMongoDB Server
- CVE-2026-9748$_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries inputMongoDB Server
- CVE-2026-9747Crafted cross-shard merge aggregation crashes MongoDB ServerMongoDB Server
- CVE-2026-9746Server crashes in case of the use of exchangeMongoDB Server
- CVE-2026-9743Aggregation sub-pipeline null dereference may allow DoS via crafted getMoreMongoDB server
- CVE-2026-9742Authenticate command with specific mechanism parameter can trigger server crashMongoDB Server
- CVE-2026-9741Client side encryption fails to encrypt values in a $vectorSearchMongoDB Server
- CVE-2026-34711CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-34712CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-34713CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-11799UXSS in Focus for iOS / Klar Webkit navigationMozilla Focus for iOS · Mozilla Klar for iOS
- CVE-2026-48291Format Plugins | Heap-based Buffer Overflow (CWE-122)Adobe Format Plugins
- CVE-2026-48292Format Plugins | Heap-based Buffer Overflow (CWE-122)Adobe Format Plugins
- CVE-2026-47929ColdFusion | Incorrect Authorization (CWE-863)Adobe ColdFusion
- CVE-2026-47932ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2026-47960ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe ColdFusion
- CVE-2026-47931ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-47930ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-47937Acrobat Reader | Uncontrolled Search Path Element (CWE-427)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47916Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47918Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47915Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47952Acrobat Reader | Heap-based Buffer Overflow (CWE-122)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47917Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47955Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47919Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47921Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47920Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47913Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47914Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47912Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47959Acrobat Reader | Stack-based Buffer Overflow (CWE-121)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47911Acrobat Reader | Out-of-bounds Write (CWE-787)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2025-71319image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parserimage-size
- CVE-2026-47907Dreamweaver Desktop | Improper Access Control (CWE-284)Adobe Dreamweaver Desktop
- CVE-2026-47906Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)Adobe Dreamweaver Desktop
- CVE-2026-47908Dreamweaver Desktop | Access of Uninitialized Pointer (CWE-824)Adobe Dreamweaver Desktop
- CVE-2026-11824SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterateSQLite
- CVE-2026-48306Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-34710Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-48305Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-34709Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-6444A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, accesEverpure FlashArray
- CVE-2026-6445A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticatedEverpure FlashArray
- CVE-2026-8863CVE-2026-8863OracleLinux(7.2) shim · PC-Doctor Service Center Enterp… +11
- CVE-2026-34707InCopy | Heap-based Buffer Overflow (CWE-122)Adobe InCopy
- CVE-2026-34706InCopy | Out-of-bounds Write (CWE-787)Adobe InCopy
- CVE-2026-34708InCopy | Stack-based Buffer Overflow (CWE-121)Adobe InCopy
- CVE-2026-34701InDesign Desktop | Heap-based Buffer Overflow (CWE-122)Adobe InDesign Desktop
- CVE-2026-34695InDesign Desktop | Stack-based Buffer Overflow (CWE-121)Adobe InDesign Desktop
- CVE-2026-34700InDesign Desktop | Out-of-bounds Write (CWE-787)Adobe InDesign Desktop
- CVE-2026-34696InDesign Desktop | Use After Free (CWE-416)Adobe InDesign Desktop
- CVE-2026-34698InDesign Desktop | Heap-based Buffer Overflow (CWE-122)Adobe InDesign Desktop
- CVE-2026-34699InDesign Desktop | Heap-based Buffer Overflow (CWE-122)Adobe InDesign Desktop
- CVE-2026-34697InDesign Desktop | Stack-based Buffer Overflow (CWE-121)Adobe InDesign Desktop
- CVE-2026-48293InDesign Desktop | Out-of-bounds Write (CWE-787)Adobe InDesign Desktop
- CVE-2026-34702InDesign Desktop | Stack-based Buffer Overflow (CWE-121)Adobe InDesign Desktop
- CVE-2026-50511Microsoft PC Manager Elevation of Privilege VulnerabilityMicrosoft PC Manager
- CVE-2026-50512Microsoft PC Manager Elevation of Privilege VulnerabilityMicrosoft PC Manager
- CVE-2026-50636LimeSurvey RemoteControl invite_participants/remind_participants SQL InjectionLimeSurvey · limesurvey/limesurvey
- CVE-2026-50635LimeSurvey Password Reset Host Header Injection Discloses Reset TokenLimeSurvey · limesurvey/limesurvey
- CVE-2026-34693Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager 6.5 LTS · Adobe Experience Manager
- CVE-2026-44804Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-44813Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42993Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-44812Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Excel for Android · Microsoft PowerPoint for A… +2
- CVE-2026-44803Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Excel for Android · Microsoft PowerPoint for A… +2
- CVE-2026-42987Windows Deployment Services (WDS) Remote Code ExecutionMicrosoft Windows Server
- CVE-2026-42985Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2026-44801Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2026-44802Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42983Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-44799Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2026-44807Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-44808Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-44811Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42992Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-44810Microsoft Cryptographic Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-44809Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42989Winlogon Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42991Windows Push Notifications Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42979Windows Push Notifications Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42977Windows Push Notifications Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42978Windows Push Notifications Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42986Microsoft Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42974Windows Performance Monitor Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-42981Windows Performance Monitor Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-42984Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42912Windows Telephony Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42913Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2026-42911Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42916NT OS Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42909Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2026-42980NT OS Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42908Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42905Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42837Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-42836Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-49160HTTP.sys Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-48574Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-48569Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-48565Windows Narrator Braille Elevation of Privilege VulnerabilityMicrosoft Windows Narrator Braille
- CVE-2026-47656Windows Boot Manager Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-45484Microsoft SharePoint Elevation of Privilege VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45481Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47634Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Server
- CVE-2026-42910Windows Hotpatch Monitoring Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-47293Microsoft Office Click-To-Run Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45658Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-45654Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-45653Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45644Microsoft Live Share Canvas SDK Elevation of Privilege VulnerabilityMicrosoft Live Share Canvas SDK
- CVE-2026-45637Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45603Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45638Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45635Windows UPnP Device Host Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-45600Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45596Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45636Windows NTFS Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-45598Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45601Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45599Windows UPnP Device Host Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-45597Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45593Windows SDK Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45592Windows Internet (wininet.dll) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45591ASP.NET Core Denial of Service VulnerabilityMicrosoft .NET · Microsoft ASP.NET Core +5
- CVE-2026-45586Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45482Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass VulnerabilityMicrosoft Visual Studio Code CoPilot Chat Extension
- CVE-2026-45476Microsoft Azure Network Adapter Elevation of Privilege VulnerabilityLinux kernel - Microsoft MANA Network Driver
- CVE-2026-45463Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45457Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 365… +1
- CVE-2026-44822Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-40376Visual Studio Code Elevation of Privilege VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-42835Microsoft Teams for Android Information Disclosure VulnerabilityMicrosoft Teams for Android
- CVE-2026-42829Windows Administrator Protection Secure Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-42828Windows Projected File System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40371Microsoft Dynamics 365 (on-premises) Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2026-49161Microsoft PC Manager Security Feature Bypass VulnerabilityMicrosoft PC Manager
- CVE-2026-48583Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-48578Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48576Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48575Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48573Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48570Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48568Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48563Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-47654Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2026-47652Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-47653Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-47648Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45588Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-47635Microsoft Outlook and Word Remote Code Execution VulnerabilityMicrosoft Office LTSC
- CVE-2026-41098Azure Stack Edge Spoofing VulnerabilityMicrosoft Azure Stack Edge
- CVE-2026-47631Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-47298Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-32193Azure Kubernetes Service (AKS) Remote Code Execution VulnerabilityMicrosoft Azure Kubernetes Service
- CVE-2026-41092Microsoft Kinect Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-47292Visual Studio Code MSSQL Extension Remote Code Execution VulnerabilityMicrosoft Visual Studio Code - MSSQL Extension
- CVE-2026-47289Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-47288Windows Kerberos Key Distribution Center (KDC) Remote Code ExecutionMicrosoft Windows Server
- CVE-2026-45656UEFI Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-45649Office for Android Spoofing VulnerabilityMicrosoft Excel for Android · Microsoft PowerPoint for A… +1
- CVE-2026-45648Windows Active Directory Domain Services Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2026-45645Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45643Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 365… +1
- CVE-2026-45641Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-45607Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-45640Windows Bluetooth Port Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45639Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2026-45605Windows Bluetooth Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45583Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-45504Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-45503Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-45490.NET SDK Elevation of Privilege VulnerabilityMicrosoft .NET · dotnet +1
- CVE-2026-45487Windows Program Compatibility Assistant Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45461Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45458Microsoft Outlook and Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2026-45456Microsoft Outlook and Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2026-44824Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2026-44823Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-44820Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-44819Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2026-44818Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-44817Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-42902Microsoft PowerToys Elevation of Privilege VulnerabilityMicrosoft PowerToys
- CVE-2026-34335Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-33828Windows Device Health Attestation (DHA) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40404Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-40409Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45486Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 365… +1
- CVE-2026-45474Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45471Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +3
- CVE-2026-45472Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45475Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2026-45469Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-41108Windows DNS Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-49959Hermes WebUI < 0.51.311 RCE via Git Configuration Injectionnesquena hermes-webui
- CVE-2026-22926Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.Omnissa Workspace ONE® Assist for macOS
- CVE-2026-42570Svelte devalue: DoS via sparse array deserializationsveltejs devalue · devalue
- CVE-2026-24180NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow.NVIDIA DALI
- CVE-2026-24181NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation.NVIDIA DALI
- CVE-2026-49956Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions searchnesquena hermes-webui
- CVE-2026-46492md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)commenthol md-fileserver · md-fileserver
- CVE-2026-49847FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSONsignalwire freeswitch
- CVE-2026-45447Heap Use-After-Free in the PKCS7_verify() FunctionOpenSSL
- CVE-2026-45445AES-OCB IV Ignored on EVP_Cipher() PathOpenSSL
- CVE-2026-42765NULL Dereference in Certificate Verification with OCSP CheckingOpenSSL
- CVE-2026-42764NULL Pointer Dereference in QUIC Server Initial Packet HandlingOpenSSL
- CVE-2026-34183Unbounded Memory Growth in the QUIC PATH_CHALLENGE HandlerOpenSSL
- CVE-2026-34181PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC KeysOpenSSL
- CVE-2026-34180Heap Buffer Over-read in ASN.1 Content ParsingOpenSSL
- CVE-2026-9076Out-of-Bounds Read in CMS Password-Based DecryptionOpenSSL
- CVE-2026-7383Possible Heap Buffer Overflow in ASN.1 Multibyte String ConversionOpenSSL
- CVE-2026-49842FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test framessignalwire freeswitch
- CVE-2026-49475FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsingsignalwire freeswitch
- CVE-2026-45771Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansionsignalwire freeswitch
- CVE-2026-49948Mem0 0.2.8 Missing Authorization via POST /configure Endpointmem0ai mem0
- CVE-2026-24065Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOSWaves Audio Waves Central
- CVE-2026-24064Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOSWaves Audio Waves Central
- CVE-2026-8045CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side fiSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2026-10727An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker Ivanti Endpoint Manager Mobile
- CVE-2026-47899Arbitrary File Read, Write, Rename, and Delete in Logseqlogseq
- CVE-2026-9279Shell command injection in Logseqlogseq
- CVE-2026-52907media: rockchip: rkcif: fix off by one bugsLinux
- CVE-2026-529069p: fix access mode flags being ORed instead of replacedLinux
- CVE-2026-46332greybus: gb-beagleplay: bound bootloader receive bufferingLinux
- CVE-2026-46330Revert "net/smc: Introduce TCP ULP support"Linux
- CVE-2026-46328apparmor: fix rlimit for posix cpu timersLinux
- CVE-2026-46327dm: fix unlocked test for dm_suspended_mdLinux
- CVE-2026-46326iio: pressure: mprls0025pa: fix spi_transfer struct initialisationLinux
- CVE-2026-46324netfilter: nf_tables: use list_del_rcu for netlink hooksLinux
- CVE-2026-46323net: gro: don't merge zcopy skbsLinux
- CVE-2026-46322tun: free page on build_skb failure in tun_xdp_one()Linux
- CVE-2026-46321tun: free page on short-frame rejection in tun_xdp_one()Linux
- CVE-2026-46320tap: free page on error paths in tap_get_user_xdp()Linux
- CVE-2026-46319net/sched: act_ct: Only release RCU read lock after ct_ftLinux
- CVE-2026-46317KVM: arm64: Reassign nested_mmus array behind mmu_lockLinux
- CVE-2017-20250WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File DownloadApptha Mac Photo Gallery
- CVE-2017-20249WordPress Plugin Apptha Slider Gallery 1.0 SQL InjectionApptha Slider Gallery
- CVE-2017-20248WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File DownloadApptha Slider Gallery
- CVE-2017-20247WordPress Plugin PICA Photo Gallery 1.0 SQL InjectionApptha PICA Photo Gallery
- CVE-2017-20246KittyCatfish 2.2 Plugin for WordPress SQL InjectionMissilesilo KittyCatfish
- CVE-2017-20245Wow Viral Signups 2.1 WordPress Plugin SQL InjectionWow-Company Wow Viral Signups
- CVE-2017-20244Wow Forms WordPress Plugin 2.1 SQL InjectionWow-Company Wow Forms
- CVE-2017-20243WordPress Car Park Booking Plugin SQL Injection via space_idgurutechteam Car Park Booking WordPress Plugin
- CVE-2016-20065Product Catalog 8 1.2 Plugin WordPress SQL InjectionEvWill Product Catalog
- CVE-2016-20063Single Personal Message 1.0.3 WordPress Plugin SQL InjectionMd. Shamim Shahnewaz Single Personal Message
- CVE-2016-20062Simply Poll 1.4.1 Plugin for WordPress SQL InjectionOllie Armstrong Simply Poll
- CVE-2026-2638X-VPN macOS website versions - Local Privilege EscalationX-VPN macOS website
- CVE-2026-49742TYPO3 CMS - Broken Access Control in Media ModuleTYPO3 CMS · typo3/cms-core +1
- CVE-2026-49741TYPO3 CMS - Privilege Escalation & SQL Injection in Form FrameworkTYPO3 CMS · typo3/cms-core +1
- CVE-2026-47346TYPO3 CMS - Broken Access Control in Form FrameworkTYPO3 CMS · typo3/cms-core +1
- CVE-2026-47343TYPO3 CMS - Destructive Actions on File Mount FoldersTYPO3 CMS · typo3/cms-core
- CVE-2026-11607TYPO3 CMS - Broken Access Control in Form FrameworkTYPO3 CMS · typo3/cms-core +1
- CVE-2026-41031A Stored Cross-Site Scripting (XSS) vulnerability occurs in Vinna Process MonitorSkilja Vinna Process Monitor
- CVE-2026-46749A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Siemens SINEC INS
- CVE-2026-46748A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Siemens SINEC INS
- CVE-2026-46746A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Siemens SINEC INS
- CVE-2026-24349A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versioSiemens SIMATIC WinCC Unified PC Runtime
- CVE-2026-8365Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Fieldcreativethemeshq Blocksy
- CVE-2026-11616Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalationstiofansisland Events Calendar for GeoDirectory
- CVE-2026-9698DBI versions before 1.648 for Perl saved errors in a limited-sized bufferHMBRAND DBI
- CVE-2026-44083QuMagieQNAP Systems QuMagie
- CVE-2026-5068bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_datazephyrproject-rtos Zephyr
- CVE-2026-11572Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of degit
- CVE-2026-41007Spring HATEOAS heap exhaustion through unbounded internal cachingSpring HATEOAS · org.springframework.hateoas:spring-hateoas
- CVE-2026-41006Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configurationSpring HATEOAS · org.springframework.hateoas:spring-hateoas
- CVE-2026-41855Spring Framework Unsafe Deserialization via Jackson JMS ConvertersSpring Framework · org.springframework:spring-jms
- CVE-2026-41850Spring Framework Algorithmic Denial of Service via SpEL ExpressionsSpring Framework · org.springframework:spring-expression
- CVE-2026-41849Spring Framework Denial of Service via Integer Overflow in SpEL ExpressionsSpring Framework · org.springframework:spring-expression
- CVE-2026-41845Spring Framework Cross-site Scripting via JavaScriptUtilsSpring Framework · org.springframework:spring-webmvc
- CVE-2026-41842Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFluxSpring Framework · org.springframework:spring-webmvc +1
- CVE-2026-41720Authentication Bypass with Empty Password in Spring LDAPSpring LDAP · org.springframework.ldap:spring-ldap-core
- CVE-2026-40984Micrometer HTTP server instrumentations DoS vulnerabilitySpring Micrometer · io.micrometer:micrometer-core +2
- CVE-2026-40983Micrometer gRPC server instrumentation DoS vulnerabilitySpring Micrometer · io.micrometer:micrometer-core
- CVE-2026-91856Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parametersixstorage 6Storage Rentals
- CVE-2026-9662Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameterplasmatizemedia Recover Exit For WooCommerce
- CVE-2026-7556FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Textfoliovision FV Flowplayer Video Player
- CVE-2026-8795A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6.Rapid7 Velociraptor
- CVE-2026-44751Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP PlatformSAP_SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2023-29146The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data i
- CVE-2023-43688An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later).
- CVE-2025-52292A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v
- CVE-2025-52293A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to caus
- CVE-2025-55657A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denia
- CVE-2026-36719An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sen
- CVE-2026-36720Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type
- CVE-2026-36723An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage dire
- CVE-2026-36770Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered to contain a stack overflow in the Go parameter of the ask_to_r
- CVE-2026-36771Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parame
- CVE-2026-36779Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain multiple stack overflows in the fromVir
- CVE-2026-36783Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the domain paramete
- CVE-2026-36784Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the ip parameter of
- CVE-2026-36791Shenzhen Tenda Technology Co., Ltd Tenda O3v3 v1.0.0.5 was discovered to contain a stack overflow in the save_list_data parameter of the for
- CVE-2026-36792Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parame
- CVE-2026-36793Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the formwrl
- CVE-2026-36794Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the R7WebsS
- CVE-2026-36796Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the picCropName parameter of the formCr
- CVE-2026-36797Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the IPMacBindRuleIp parameter of the fo
- CVE-2026-36799Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the portalAuth parameter of the formPo
- CVE-2026-36800Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the IPMacBindIndex parameter of the fo
- CVE-2026-36801Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the IPMacBindRule parameter of the for
- CVE-2026-36802Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the SafeMacFilte
- CVE-2026-36803Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting f
- CVE-2026-36805Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple buffer overflows in the Saveqqlist function via th
- CVE-2026-36806Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the
- CVE-2026-36807Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the
- CVE-2026-36808Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of th
- CVE-2026-36809Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteID parameter of the
- CVE-2026-36810Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the gotoUrl parameter of the formPo
- CVE-2026-36811Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picName parameter of the formDe
- CVE-2026-36813Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picCropName parameter of the fo
- CVE-2026-36815Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the hostname parameter of the formS
- CVE-2026-36816Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter o
- CVE-2026-36817Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter
- CVE-2026-36818Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of
- CVE-2026-36819Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the bindMACAddr parameter of the fro
- CVE-2026-36820Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter o
- CVE-2026-36821Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the picCropName parameter of the for
- CVE-2026-36822Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the macAddr parameter of the formDel
- CVE-2026-36823Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the
- CVE-2026-39169SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
Medium, low and unrated 332
- CVE-2026-46546Frappe LMS: HTML injection in user-controlled metadatafrappe lms
- CVE-2026-47838Unauthorized User Impersonation when Using X.509 Client CertificatesSpring Security · org.springframework.security:spring-secur…
- CVE-2026-41837Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keysSpring Data REST · org.springframework.data:spring-data-res…
- CVE-2026-41730Spring Data REST exposes persistence-layer internals in error responsesSpring Data REST · org.springframework.data:spring-data-res…
- CVE-2026-41727In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behaviorSpring for Apache Kafka · org.springframework.kafka:spring-…
- CVE-2026-41726In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector headerSpring for Apache Kafka · org.springframework.kafka:spring-…
- CVE-2026-41721Spring Data Commons Denial of Service via Data BindingSpring Data Commons · org.springframework.data:spring-data-…
- CVE-2026-41719Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparatorSpring Data KeyValue · Spring Data Redis +1
- CVE-2026-41714In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManagerSpring AMQP · org.springframework.amqp:spring-amqp
- CVE-2026-41711Potential Denial of Service through crafted Sort ParametersSpring Data Commons · org.springframework.data:spring-data-…
- CVE-2026-41706Open Redirect When Using CookieRequestCacheSpring Security · org.springframework.security:spring-secur…
- CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queuesSpring AMQP · org.springframework.amqp:spring-amqp
- CVE-2026-41697Spring Data Relational Parameter not Escaped for Query By Example LIKE PatternSpring Data Relational · Spring Data JDBC +2
- CVE-2026-41696Spring Data MongoDB Bind Parameter Literal Quoting BreakoutSpring Data MongoDB · org.springframework.data:spring-data-…
- CVE-2026-46543nimiq-blockchain: Genesis batch set requestnimiq core-rs-albatross · nimiq-blockchain
- CVE-2026-41694SAML Payloads Decrypted Without Valid SignatureSpring Security · org.springframework.security:spring-secur…
- CVE-2026-41008Spring Security Authorization Server Open Redirect via request_uriSpring Security · Spring Authorization Server +1
- CVE-2026-40991XML External Entity (XXE) injection when documenting untrusted XML contentSpring REST Docs · org.springframework.restdocs:spring-r… +1
- CVE-2026-46542nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve pointsnimiq core-rs-albatross · nimiq-keys
- CVE-2026-46540Nimiq light-blockchain: Light blockchain rebranch issuenimiq core-rs-albatross
- CVE-2026-46539nimiq-primitives: BlockInclusionProof interlink issue when hops are emptynimiq core-rs-albatross · nimiq-primitives
- CVE-2026-53675BuddyPress 14.4.0 Friends List IDOR via REST APIBuddyPress · buddypress/buddypress
- CVE-2026-44505Nimiq network-libp2p: Untrusted peer can wedge DHTnimiq core-rs-albatross
- CVE-2026-46411FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and olderhalfgaar FlashMQ
- CVE-2026-46433lldpd: Heap OOB Read in VLAN Decapsulation memmovelldpd
- CVE-2026-9735Keyfile contents are in MongoDB Server logsMongoDB Server
- CVE-2026-9751Sensitive data could be written to mongod.logMongoDB Server
- CVE-2026-47904CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-47903CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-47902CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-47905CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-34657CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-25860OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handlerfrankverbeke OpenClinic GA
- CVE-2026-34417OSCAL-GUI Reflected XSS via project parameter in oscal-forms.phpbrian-ruf OSCAL-GUI
- CVE-2026-34416OSCAL-GUI Reflected XSS via project parameter in oscal.phpbrian-ruf OSCAL-GUI
- CVE-2026-25557Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameterEvoluted PHP Directory Listing Script
- CVE-2026-47933ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)Adobe ColdFusion
- CVE-2026-47923Acrobat Reader | Out-of-bounds Read (CWE-125)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47924Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47926Acrobat Reader | Out-of-bounds Read (CWE-125)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47961Acrobat Reader | Out-of-bounds Read (CWE-125)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47925Acrobat Reader | Integer Overflow or Wraparound (CWE-190)Adobe Acrobat DC · Adobe Acrobat Reader DC +1
- CVE-2026-47909Dreamweaver Desktop | Improper Input Validation (CWE-20)Adobe Dreamweaver Desktop
- CVE-2026-47910Dreamweaver Desktop | Incorrect Authorization (CWE-863)Adobe Dreamweaver Desktop
- CVE-2026-47106Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes APIEllucian Banner Self-Service
- CVE-2026-32856Ellucian Banner Self-Service Reflected XSS via dateConverterEllucian Banner Self-Service
- CVE-2026-11822SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeekSQLite
- CVE-2026-40639Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability.Dell Edge Gateway · DELL EMBEDDED PC +4
- CVE-2026-44275Dell/Alienware Purchased Apps, versions prior to 1.1.32.0, contain an Improper Link Resolution Before File Access ('Link Following') vulneraDell/Alienware Purchased Apps
- CVE-2026-34704InDesign Desktop | NULL Pointer Dereference (CWE-476)Adobe InDesign Desktop
- CVE-2026-34703InDesign Desktop | NULL Pointer Dereference (CWE-476)Adobe InDesign Desktop
- CVE-2026-34705InDesign Desktop | Out-of-bounds Read (CWE-125)Adobe InDesign Desktop
- CVE-2026-28237Unrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of avaAMD µProf
- CVE-2026-0466Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentialAMD µProf
- CVE-2026-41116Dell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulneraDell Inventory Collector Client
- CVE-2025-54509Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to causeAMD EPYC™ 9004 Series Processors · AMD EPYC™ 9005 Series… +4
- CVE-2026-34694Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager 6.5 LTS · Adobe Experience Manager
- CVE-2026-44814Windows DWM Core Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-44805Windows Network Controller (NC) Host Agent Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2026-42973Windows Push Notification Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42970Windows Push Notification Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42971Windows Push Notification Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42969Windows Push Notification Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42972Windows Hyper-V Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42968Windows Telephony Server Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42915Microsoft Windows VMSwitch Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-42914Windows Kerberos Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-42907Windows Shell Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42906Windows Shell Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-42903Windows Kerberos Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-50507Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-48562Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-48560Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47640Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47284Visual Studio Code Information Disclosure VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-45647Microsoft Defender for Endpoint for Mac Elevation of Privilege VulnerabilityMicrosoft Defender for Endpoint for Mac
- CVE-2026-45608Windows DHCP Client Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-45595Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-45604Windows Managed Installer Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-45594Windows Application Identity (AppID) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-45465Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45464Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45462Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45459Microsoft Excel Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 365… +1
- CVE-2026-45455Microsoft Excel Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-45454Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-33113Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-50508Windows NTLM Spoofing VulnerabilityMicrosoft Windows
- CVE-2026-48566Windows DWM Core Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-47641Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47639Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47638Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47637Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47636Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47287Visual Studio Code Tampering VulnerabilityMicrosoft Visual Studio Code
- CVE-2026-45655Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-45650Microsoft Bing Search Spoofing VulnerabilityMicrosoft Bing Search for Android
- CVE-2026-45642Microsoft Azure Attestation service and Device Health Attestation Service Spoofing VulnerabilityMicrosoft Windows
- CVE-2026-45634Windows DHCP Client Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2026-45606Microsoft UxTheme Library (uxtheme.dll) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-45502Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-45501Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-45500Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-45491.NET Tampering VulnerabilityMicrosoft .NET · Microsoft.NETCore.App.Runtime.linux-x64 +2
- CVE-2026-45466Microsoft Word Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 365… +1
- CVE-2026-45460Microsoft Office Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-45453Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-44821Microsoft Office Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2026-45483Microsoft Office Project Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45485Microsoft Office Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +2
- CVE-2026-45479Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45468Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45467Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-47980Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47945Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48280Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47985Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47935Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47941Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48251Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48289Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48297Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48256Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48268Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47993Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47936Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47956Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47939Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47982Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47989Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47977Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47991Adobe Experience Manager | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47947Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47972Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47954Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47951Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47943Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47974Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47942Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48258Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47975Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47962Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47990Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47970Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47950Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47957Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47948Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47986Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47966Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48301Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48264Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-34692Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47983Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48304Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47981Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48300Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47944Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47953Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47946Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47973Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47987Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47958Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48265Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48288Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48250Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48271Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47978Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-47949Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48299Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-48266Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager as a Cloud Service · Adobe Expe… +1
- CVE-2026-49958Hermes WebUI < 0.51.303 TOCTOU Race Condition via git_discardnesquena hermes-webui
- CVE-2026-49957Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.pynesquena hermes-webui
- CVE-2026-42599Cross-site scripting via spread attributes in Svelte SSRsveltejs svelte · svelte
- CVE-2026-42567Svelte: ReDoS in `<svelte:element>` Tag Validationsveltejs svelte · svelte
- CVE-2026-42573Svelte: XSS via DOM Clobbering of Internal Framework Statesveltejs svelte · svelte
- CVE-2026-49848FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto`signalwire freeswitch
- CVE-2026-49955Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/optionsnesquena hermes-webui
- CVE-2026-49843FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`signalwire freeswitch
- CVE-2026-45446Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modesOpenSSL
- CVE-2026-42771Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()OpenSSL
- CVE-2026-42770FFC-DH Peer Validation Uses Attacker-Supplied qOpenSSL
- CVE-2026-42769Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdateOpenSSL
- CVE-2026-42768Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()OpenSSL
- CVE-2026-42767NULL Pointer Dereference in CRMF EncryptedValue DecryptionOpenSSL
- CVE-2026-42766Possible NULL Dereference in Password-Based CMS DecryptionOpenSSL
- CVE-2026-35188Double-free When Checking OCSP Stapled ResponseOpenSSL
- CVE-2026-49472FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpatsignalwire freeswitch
- CVE-2026-0420Missing TLS certificate validation in NETGEAR's ReadyCloud client appNETGEAR RAX120v1 · NETGEAR RAX120v2 +3
- CVE-2026-9212Insufficient authentication and input validation in certain NETGEAR productsNETGEAR LBR1020 · NETGEAR LBR20 +23
- CVE-2026-0411A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi SatellitesNETGEAR RBE970 · NETGEAR RBR350 +3
- CVE-2026-0415Insufficient input validation vulnerability in certain Orbi routersNETGEAR RBE970 · NETGEAR RBR750 +11
- CVE-2026-0414Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR RoutersNETGEAR RBE970
- CVE-2026-0413Buffer overflow vulnerability in certain NETGEAR Nighthawk routersNETGEAR RBE370 · NETGEAR RBE770 +12
- CVE-2026-0418Certain NETGEAR devices allow administrators to tamper with systemNETGEAR CBR750 · NETGEAR EX6120 +33
- CVE-2026-0417Insufficient input validation in certain NETGEAR routersNETGEAR MR60 · NETGEAR MR70 +25
- CVE-2026-9210Certain NETGEAR routers allow authenticated administrators to gain unintended control of the routerNETGEAR EX3700 · NETGEAR EX3800 +29
- CVE-2026-9211Certain NETGEAR routers allow unauthenticated users to gain control of the routerNETGEAR CAX30 · NETGEAR RAX30 +2
- CVE-2026-0416Improper input validation in certain NETGEAR routers allows unauthorized modification of protected router functionalityNETGEAR RAXE450 · NETGEAR RAXE500
- CVE-2026-3088Unauthenticated users can disrupt router operationNETGEAR RBR860 · NETGEAR RBRE950 +6
- CVE-2026-9213Insufficient input validation in certain NETGEAR routersNETGEAR MR70 · NETGEAR MS70 +2
- CVE-2026-0419Insufficient input validation vulnerability in NETGEAR JR6150NETGEAR JR6150
- CVE-2026-0412Insufficient input validation vulnerability in NETGEAR JR6150 Web UINETGEAR JR6150
- CVE-2026-0410Insufficient input validation in certain NETGEAR routersNETGEAR R7000 · NETGEAR RAX20 +18
- CVE-2026-28301SolarWinds Observability Self-Hosted Open Redirect VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2026-0409Netgear Orbi 370 Series Remote Code Execution vulnerabilityNETGEAR Orbi
- CVE-2025-67862An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6Fortinet FortiOS · Fortinet FortiProxy
- CVE-2026-49938A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, FortiPortal 7.0 all veFortinet FortiPortal
- CVE-2026-49762Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of serviceelixir-lang elixir
- CVE-2026-47901Iframe escape by plugins in Logseqlogseq
- CVE-2026-47900Stored XSS via Unsanitized Plugin Metadata in Logseqlogseq
- CVE-2026-11792389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)Red Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11793389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsingRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11790389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of serviceRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11789389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crashRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11788389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parserRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-11787389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsingRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11785389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handlerRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11786389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()Red Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-52905mm/damon/core: disallow non-power of two min_region_sz on damon_start()Linux
- CVE-2026-52904drm/nouveau: fix nvkm_device leak on aperture removal failureLinux
- CVE-2026-46329erofs: handle end of filesystem properly for file-backed mountsLinux
- CVE-2026-46318Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"Linux
- CVE-2026-11764Data exposed without proper permissionpretix
- CVE-2016-20064WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parametermyasui WP Vault
- CVE-2026-49740TYPO3 CMS - Insecure Deserialization in Core APITYPO3 CMS · typo3/cms-core
- CVE-2026-49738TYPO3 CMS - Broken Access Control in File Abstraction LayerTYPO3 CMS · typo3/cms-core
- CVE-2026-47352TYPO3 CMS - Broken Access Control in Backend APITYPO3 CMS · typo3/cms-core +1
- CVE-2026-47351TYPO3 CMS - Broken Access Control in ClipboardTYPO3 CMS · typo3/cms-core +1
- CVE-2026-47350TYPO3 CMS - Broken Access Control in DataHandlerTYPO3 CMS · typo3/cms-core
- CVE-2026-47349TYPO3 CMS - Broken Access Control in RecyclerTYPO3 CMS · typo3/cms-core +1
- CVE-2026-47348TYPO3 CMS - Cross-Site Scripting in Indexed SearchTYPO3 CMS · typo3/cms-core +1
- CVE-2026-47347TYPO3 CMS - Open Redirect in Core UtilitiesTYPO3 CMS · typo3/cms-core
- CVE-2026-52902Awxkit: path traversal via yaml !include directiveRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +3
- CVE-2026-4058User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellationwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2026-46747A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Siemens SINEC INS
- CVE-2025-40808A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CSiemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +34
- CVE-2026-28262Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability.Dell iDRAC Tools
- CVE-2026-6899Improper Check for Certificate Revocation in S2OPCSysterel S2OPC
- CVE-2026-8677Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settingswpmessiah Prime Elementor Addons – Lightweight Elementor Wi…
- CVE-2026-8599MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content FieldMailerPress – Email Marketing, Newsletter, Email Automation…
- CVE-2026-7542Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information DisclosureRevolution Slider Slider Revolution
- CVE-2026-49818Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object namesApache Software Foundation Apache Airflow Samba provider ·…
- CVE-2026-46315io_uring/waitid: clear waitid info before copying it to userspaceLinux
- CVE-2026-34905Apache Answer: Unlisted Questions Accessible via Direct API AccessApache Software Foundation Apache Answer · github.com/ap… +1
- CVE-2026-34033Apache Answer: HTML Content Injection in EmailApache Software Foundation Apache Answer · github.com/ap… +1
- CVE-2026-34031Apache Answer: The custom avatar was not properly validatedApache Software Foundation Apache Answer · github.com/ap… +1
- CVE-2026-33582Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory errorApache Software Foundation Apache Answer · github.com/ap… +1
- CVE-2026-25699Apache Answer: Authorization Bypass in Timeline APIApache Software Foundation Apache Answer · github.com/ap… +1
- CVE-2026-25688Apache Answer: XSS in AI Answer RenderingApache Software Foundation Apache Answer · github.com/ap… +1
- CVE-2026-41982Race condition vulnerability in the IPC module.Huawei HarmonyOS
- CVE-2026-41981Out-of-bounds write vulnerability in the IPC module.Huawei HarmonyOS
- CVE-2026-41977DoS vulnerability in the log service.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-41976Permission control vulnerability in the audio framework.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-41974Permission control vulnerability in service notifications.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-41973Permission control vulnerability in calls.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-41972Path traversal vulnerability in the SMS app.Huawei HarmonyOS
- CVE-2026-41986Logic bypass vulnerability in the file system.Huawei HarmonyOS
- CVE-2026-41985UAF vulnerability in the package management module.Huawei HarmonyOS
- CVE-2026-41984UAF vulnerability in the package management module.Huawei HarmonyOS
- CVE-2026-41983Null pointer dereference vulnerability in the browser module.Huawei HarmonyOS
- CVE-2025-62858QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2026-8981Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTMLCustom Block Builder
- CVE-2026-4986WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook ForgeryWPForms
- CVE-2026-41539QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2026-26236QuMagieQNAP Systems QuMagie
- CVE-2026-41854Spring Framework Server-Side Request Forgery via UriComponentsBuilderSpring Framework · org.springframework:spring-web
- CVE-2026-41853Spring Framework Multipart Request Smuggling in Spring MVC and WebFluxSpring Framework · org.springframework:spring-webmvc +1
- CVE-2026-41980Permission control vulnerability in the file preview module.Huawei HarmonyOS
- CVE-2026-41852Spring Framework Arbitrary Method Invocation in SpEL ExpressionsSpring Framework · org.springframework:spring-expression
- CVE-2026-41851Spring Framework Denial of Service via Unbounded Cache in SpELSpring Framework · org.springframework:spring-expression
- CVE-2026-41848Spring Framework Denial of Service via AntPathMatcherSpring Framework · org.springframework:spring-core
- CVE-2026-41847Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSLSpring Framework · org.springframework:spring-webflux
- CVE-2026-41846Spring Framework Cross-site Scripting via JSP Form TagsSpring Framework · org.springframework:spring-webmvc
- CVE-2026-41844Spring Framework Open Redirect in Spring MVC and WebFluxSpring Framework · org.springframework:spring-webmvc +1
- CVE-2026-41843Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxSpring Framework · org.springframework:spring-webmvc +1
- CVE-2026-41979Permission control vulnerability in the print module.Huawei HarmonyOS
- CVE-2026-41841Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFluxSpring Framework · org.springframework:spring-webmvc +1
- CVE-2026-41840Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks when processing multipart requests.Spring Framework · org.springframework:spring-webflux
- CVE-2026-41839Spring Framework Escalation via Session Fixation in WebFluxSpring Framework · org.springframework:spring-webflux
- CVE-2026-41838Spring Framework Predictable Session ID in WebSocket ModuleSpring Framework · org.springframework:spring-websocket
- CVE-2026-41978Permission control vulnerability in the clone module.Huawei HarmonyOS
- CVE-2026-41715Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade RedirectSpring Reactor Netty · io.projectreactor.netty:reactor-netty
- CVE-2026-41710Cache Exhaustion in Stateful Retries leads to Denial of ServiceSpring Retry · org.springframework.retry:spring-retry
- CVE-2026-41975Permission management vulnerability in the network management module.Huawei HarmonyOS
- CVE-2026-8895kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeskenz60 kk blog card
- CVE-2026-11603Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameterbrthumar1959 Product Filter Widget for Elementor
- CVE-2026-8904FastPicker, an order picker and order management system (oms) for WooCommerce on steroids <= 1.0.2 - Cross-Site Request Forgery via Settings Saveyuluma FastPicker, an order picker and order management sys…
- CVE-2026-10553jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Updateweaverlancegmailcom jQuery Hover Footnotes
- CVE-2026-8910WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameterrahulbhangale WP Emoticon Rating
- CVE-2026-10738jQuery Hover Footnotes <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)weaverlancegmailcom jQuery Hover Footnotes
- CVE-2026-8882WP ApplicantStack Jobs Display <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesjdm-labs WP ApplicantStack Jobs Display
- CVE-2026-8977WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Actiontechjewel WP GDPR Cookie Consent
- CVE-2026-7662ePaperFlip Publisher <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attributejoshin85 Plugin Name: ePaperFlip Publisher
- CVE-2026-8902AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Updatetierrainnovation AJAX Report Comments
- CVE-2026-8909WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Actionrahulbhangale WpMobi
- CVE-2026-8880RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesromancartsupport RomanCart Ecommerce
- CVE-2026-8907WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameterrahulbhangale WP-Ultimate-Map
- CVE-2026-10024TinyMCE shortcode Addon <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute360crest TinyMCE shortcode Addon
- CVE-2026-8499Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings UpdateHelpfulcrowd Product Reviews
- CVE-2026-8940WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Updatejasonpitts WP Meta Sort Posts
- CVE-2026-8883Global Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeshelpstring Global Body Mass Index Calculator
- CVE-2026-8841Extra Settings for RocketChat <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesandrewabarber Extra Settings for RocketChat
- CVE-2026-11623tmux image.c image_free use after freetmux
- CVE-2026-11621Dcat-Admin User Setting upload editorMDUpload unrestricted uploadDcat-Admin
- CVE-2026-11620TOTOLINK EX200 vsftpd vsftpd.conf least privilege violationTOTOLINK EX200
- CVE-2026-11619Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorizationDolibarr ERP CRM
- CVE-2026-5714Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parametershortpixel Enable Media Replace
- CVE-2026-11618DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authenticationDTStack Taier
- CVE-2026-10862Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Fieldpickplugins Accordions
- CVE-2026-44757Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise ManagerSAP_SE SAP Wily Introscope Enterprise Manager
- CVE-2026-44755Email Spoofing vulnerability in SAP Business Objects Business Intelligence PlatformSAP_SE SAP Business Objects Business Intelligence Platform
- CVE-2026-44754Missing caller identification check-in for ODP Data Replication APIsSAP_SE ODP Data Replication APIs
- CVE-2026-44750Missing Authorization check in SAP MDG (Review Match Groups Application)SAP_SE SAP MDG
- CVE-2026-44746Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet)SAP_SE SAP NetWeaver AS Java
- CVE-2026-44744SQL Injection vulnerability in SAP S/4HANASAP_SE SAP S/4HANA
- CVE-2026-44743Security Misconfiguration vulnerability in SAP Business ObjectsSAP_SE SAP Business Objects
- CVE-2026-24315Path Traversal Vulnerability in SAP Fiori (launchpad)SAP_SE SAP Fiori
- CVE-2023-43686An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later).
- CVE-2025-55651A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause
- CVE-2025-55658GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c)
- CVE-2025-55659A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2026-36722An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arb
- CVE-2026-36724An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_tas
- CVE-2026-36725A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to e
- CVE-2026-36726An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers t
- CVE-2026-36728A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execu
- CVE-2026-36772Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parame
- CVE-2026-36773Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the Go parameter of
- CVE-2026-36777Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the param_1 paramet
- CVE-2026-36778Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the username parame
- CVE-2026-36798Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple stack overflows in the formSetDebugCfgr function v
- CVE-2026-39170SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.