CVEs published June 25, 2026
466 CVEs were published on June 25, 2026: 36 critical, 207 high. 1 is now in CISA KEV.
- Published
- 466
- Critical
- 36
- High
- 207
- Medium
- 124
- Low
- 35
- Unrated
- 64
- Now in CISA KEV
- 1
- Fix available
- 306
Most affected products
- Linux
- 146
- wolfSSL
- 32
- GitLab
- 13
- pnpm
- 13
- Silicon Labs EmberZNet
- 12
- danny-avila LibreChat
- 9
- vim
- 9
- sparklemotion nokogiri · nokogiri
- 8
- Flowise
- 7
- getk2.org K2 extension for Joomla
- 7
Critical 36
- CVE-2026-9222Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authenticationShenzhen i365-Tech Co. Setracker2 Parental Control App (And…
- CVE-2025-71338Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store APIFlowise
- CVE-2025-71336Flowise - Unsandboxed Remote Code Execution via Custom MCPFlowise
- CVE-2025-71334Flowise - Arbitrary File Access via Missing Chat Flow ID ValidationFlowise
- CVE-2025-71333Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments EndpointFlowise
- CVE-2025-71327Flowise - Authentication Bypass via Unprotected Registration EndpointFlowise
- CVE-2026-40702EVoke Systems EVoke CSMS Missing Authentication for Critical FunctionEVoke CSMS
- CVE-2026-50548Cursor Desktop sandbox escape via agent-controlled working directorycursor
- CVE-2026-50549Cursor Desktop sandbox escape via symlink and failed path canonicalizationcursor
- CVE-2026-56786RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Messagetomojitakasu RTKLIB
- CVE-2026-54088File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)filebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-54089File Browser: Authentication Bypass via Proxy Auth Header Forgeryfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-57700WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerabilityDaan.dev OMGF Pro
- CVE-2026-55413ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code ExecutionToolJet
- CVE-2026-56123socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parsersocat
- CVE-2026-41120Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilitDell Wyse Management Suite
- CVE-2026-54836WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerabilityYMC Filter
- CVE-2026-54849WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerabilityPremmerce Wishlist for WooCommerce
- CVE-2026-54843WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerabilityPluginUs.Net MDTF
- CVE-2026-54823WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerabilityMarketingFire Widget Options
- CVE-2026-53260tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().Linux
- CVE-2026-53247net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardownLinux
- CVE-2026-53246sctp: validate cached peer INIT chunk length in COOKIE_ECHO processingLinux
- CVE-2026-53228ipv6: sit: reload inner IPv6 header after GSO offloadsLinux
- CVE-2026-53225sctp: fix uninit-value in __sctp_rcv_asconf_lookup()Linux
- CVE-2026-53224sctp: validate embedded INIT chunk and address list lengths in cookieLinux
- CVE-2026-53221ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()Linux
- CVE-2026-53216net: mvpp2: limit XDP frame size to the RX bufferLinux
- CVE-2026-53215net: mvpp2: refill RX buffers before XDP or skb useLinux
- CVE-2026-53186RDMA/srp: bound SRP_RSP sense copy by the received lengthLinux
- CVE-2026-53176IB/isert: Reject login PDUs shorter than ISER_HEADERS_LENLinux
- CVE-2026-53175inet: frags: fix use-after-free caused by the fqdir_pre_exit() flushLinux
- CVE-2026-53151rxrpc: Fix the ACK parser to extract the SACK table for parsingLinux
- CVE-2026-53131netfilter: require Ethernet MAC header before using eth_hdr()Linux
- CVE-2026-41566Apache Kvrocks: Improper permission for the APPLYBATCH commandApache Software Foundation Apache Kvrocks
- CVE-2026-46752Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()Apache Software Foundation Apache Kvrocks
High 207
- CVE-2026-9221Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic AlgorithmShenzhen i365-Tech Co. Setracker2 Parental Control App (And…
- CVE-2026-9220Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic keyShenzhen i365-Tech Co. Setracker2 Parental Control App (And…
- CVE-2026-9219Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or IdentifiersShenzhen i365-Tech Co. Setracker2 Parental Control App (And…
- CVE-2026-40941Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packagescacti
- CVE-2026-40083Cacti: SQL Injection in managers.phpcacti
- CVE-2026-13283Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in sGoogle Chrome
- CVE-2026-13281Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2026-22879A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2vtk
- CVE-2025-71340picklescan - Remote Code Execution via idlelib.pyshell.ModifiedInterpreter.runcodepicklescan
- CVE-2025-71335Flowise - Session Invalidation Failure After Password ChangeFlowise
- CVE-2025-71328Flowise - Unverified Password Change via Account SettingsFlowise · flowise-ui
- CVE-2025-71324Flowise - Arbitrary File Read via chatId ParameterFlowise
- CVE-2021-47987Parse Server - Arbitrary Code Execution via Malicious Version Tagsparse-community parse-server · parse-server
- CVE-2021-47986Parse Server - Unreviewed Code Execution via Malicious Version Tagsparse-community parse-server · parse-server
- CVE-2026-12992Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validationRed Hat build of Apicurio Registry
- CVE-2026-12975Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dosRed Hat build of Apicurio Registry
- CVE-2026-50176EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication AttemptsEVoke CSMS
- CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusionRed Hat build of Keycloak · Red Hat Data Grid +2
- CVE-2026-54479EVoke Systems EVoke CSMS Insufficient Session ExpirationEVoke CSMS
- CVE-2026-56445pydicom pynetdicom Library Path Traversalpydicom pynetdicom Library
- CVE-2026-12473OHIF Viewers DICOM Server-Side request forgeryOpen Health Imaging Foundation (OHIF) DICOM Web Viewer Fram…
- CVE-2026-6679DTLS 1.3 ACK serialization heap buffer overflow via integer truncationwolfSSL
- CVE-2026-10097ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recoverywolfSSL
- CVE-2026-46602Lack of limit on tile sizes in x/image/tiff in golang.org/x/imagegolang.org/x/image/tiff · golang.org/x/image
- CVE-2026-46601Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/imagegolang.org/x/image/webp · golang.org/x/image
- CVE-2026-11310X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoringwolfSSL
- CVE-2026-55958Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessagewolfSSL
- CVE-2026-55960Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validationwolfSSL
- CVE-2026-57520Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpointbitwarden server
- CVE-2026-54917SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessseaweedfs · github.com/seaweedfs/seaweedfs
- CVE-2026-4930DPA Countermeasures weakening on Series 3 devicessilabs.com Simplicity SDK
- CVE-2026-56790CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()canboat
- CVE-2026-56789RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Counttomojitakasu RTKLIB
- CVE-2026-56770libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message IDschwehr libais
- CVE-2026-46608Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)nicolargo glances · glances
- CVE-2026-56768Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Methodhaiwen seahub
- CVE-2026-46607Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Executionnicolargo glances · glances
- CVE-2026-53925Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configurationnicolargo glances · glances
- CVE-2026-56767Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlersgetmaxun maxun
- CVE-2026-46606Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.pynicolargo glances · glances
- CVE-2026-56766Hydra - Stack Buffer Overflow in NTLM Authentication Handlervanhauser-thc thc-hydra
- CVE-2026-12921Use after free in AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2026-54090File Browser: Command Allowlist Bypass via Shell Metacharacter Injectionfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-12897Out-of-bounds read in Horner Automation CscapeHorner Automation Cscape
- CVE-2026-54091File Browser: Incorrect access control in public directory shares via rule path rebasingfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-54097File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-54094File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopefilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-54096File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Pathfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-55667File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-49839jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflowjqlang jq
- CVE-2026-11999X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()wolfSSL
- CVE-2026-50016pnpm: Transitive dependency alias path traversal allows project path override via symlink replacementpnpm
- CVE-2026-50015pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)pnpm
- CVE-2026-55961wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signerwolfSSL
- CVE-2026-55700pnpm: stage download writes outside destination via manifest version traversalpnpm
- CVE-2026-55698pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytespnpm
- CVE-2026-55697pnpm: Repository-controlled configDependencies can select a pacquet native install enginepnpm
- CVE-2026-55487pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecyclepnpm
- CVE-2026-13351net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packetszephyrproject-rtos Zephyr
- CVE-2026-55092Trivy: Path traversal via a crafted vulnerability database or other downloaded artifactsaquasecurity trivy · github.com/aquasecurity/trivy
- CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypassRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9099Keycloak: group-admin escalation to realm-adminRed Hat build of Keycloak
- CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonRed Hat build of Keycloak · Red Hat build of Quarkus 3.2… +6
- CVE-2026-55412ToolJet Cloud - SSRF to Azure Cloud Infrastructure CompromiseToolJet
- CVE-2026-54033LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLsdanny-avila LibreChat
- CVE-2026-45233HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosavedanpros htmly
- CVE-2026-54030LibreChat: Missing Resource Parameter Validation in MCP OAuth Flowdanny-avila LibreChat
- CVE-2026-12844List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise functionDROLSKY List::SomeUtils::XS
- CVE-2026-57456Vim: Arbitrary Code Execution via Python Omni-Completion Docstringsvim
- CVE-2026-9717CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized Schneider Electric PowerLogic™ P7
- CVE-2026-9716CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuSchneider Electric PowerLogic™ P7
- CVE-2026-55477Authenticated Arbitrary File Write via Database Import and Xray Log Path ManipulationMHSanaei 3x-ui · github.com/mhsanaei/3x-ui +2
- CVE-2026-9650CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when uSchneider Electric EasyLogic T150 (formerly Saitel DR) Remo…
- CVE-2026-57532Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in pretix
- CVE-2026-46735Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Dell Display and Peripheral Manager
- CVE-2026-46734Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability.Dell Display and Peripheral Manager
- CVE-2026-47154Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47153Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47152Level Control Move divide-by-zero in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47151Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47150IAS Zone enroll invalid table index and write in EmberZNet 9.0.2Silicon Labs EmberZNet
- CVE-2026-47149Door Lock GetUserType invalid table index in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47148Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47147OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47146Color Control color-temperature assertion abort in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-47145Color Control hue/saturation assertion abort in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-56122Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Pathsrickknowles Winstone Servlet Container
- CVE-2026-4526Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2Silicon Labs EmberZNet
- CVE-2026-2815Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keysSilicon Labs SiSDK
- CVE-2026-54848WordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerabilitySaad Iqbal APIExperts Square for WooCommerce
- CVE-2026-54829WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerabilityJacob N. Breetvelt WP Photo Album Plus
- CVE-2026-49506Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path TraDell Wyse Management Suite
- CVE-2026-46733Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability.Dell Display and Peripheral Manager
- CVE-2026-54842WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerabilityRoyal Plugins Royal MCP
- CVE-2026-56071WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Forminator
- CVE-2026-56054WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerabilityAhmad JS Help Desk
- CVE-2026-56053WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerabilityEventPrime
- CVE-2026-56051WordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityTablePress
- CVE-2026-56049WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerabilityPost Snippets
- CVE-2026-56042WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerabilityAlgolplus Advanced Order Export For WooCommerce
- CVE-2026-56014WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerabilityAverta Master Slider
- CVE-2026-56006WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerabilityH5P
- CVE-2026-56005WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
- CVE-2026-54845WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerabilityPluginUs.Net MDTF
- CVE-2026-54844WordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerabilityCheckView Automated Testing
- CVE-2026-54841WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerabilityAppsbd Vitepos
- CVE-2026-54838WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerabilityRymera Web WC Vendors Marketplace
- CVE-2026-54830WordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerabilityEtoile Web Design Incorporated Five Star Restaurant Reserva…
- CVE-2026-54828WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2026-54822WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerabilitySALESmanago & Leadoo
- CVE-2026-54821WordPress Visual Link Preview plugin <= 2.3.1 - Sensitive Data Exposure vulnerabilityBootstrapped Ventures Visual Link Preview
- CVE-2026-27366WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerabilityMainWP Child
- CVE-2026-33612ZoneToCache can poison the cachePowerDNS Recursor
- CVE-2026-56091Apache Shiro: Authentication bypass in Guice-Web integrationApache Software Foundation Apache Shiro
- CVE-2026-53277KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulationLinux
- CVE-2026-53276Bluetooth: ISO: Fix a use-after-free of the hci_conn pointerLinux
- CVE-2026-53275ipv6: mcast: Fix use-after-free when processing MLD queriesLinux
- CVE-2026-53273tee: optee: prevent use-after-free when the client exits before the supplicantLinux
- CVE-2026-53270ipvs: clear the svc scheduler ptr early on editLinux
- CVE-2026-53268netfilter: conntrack_irc: fix possible out-of-bounds readLinux
- CVE-2026-53267netfilter: nft_ct: bail out on template ct in get evalLinux
- CVE-2026-53266netfilter: bridge: make ebt_snat ARP rewrite writableLinux
- CVE-2026-53265dm cache policy smq: check allocation under invalidate lockLinux
- CVE-2026-53264net/sched: act_api: use RCU with deferred freeing for action lifecycleLinux
- CVE-2026-53262l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()Linux
- CVE-2026-53259ipv6: anycast: insert aca into global hash under idev->lockLinux
- CVE-2026-53256Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()Linux
- CVE-2026-53254Bluetooth: RFCOMM: validate skb length in MCC handlersLinux
- CVE-2026-53253Bluetooth: bnep: reject short frames before parsingLinux
- CVE-2026-53250xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()Linux
- CVE-2026-53248net: airoha: Fix use-after-free in metadata dst teardownLinux
- CVE-2026-53244VFS: fix possible failure to unlock in nfsd4_create_file()Linux
- CVE-2026-53242ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streamsLinux
- CVE-2026-53240xfrm: iptfs: fix use-after-free on first_skb in __input_process_payloadLinux
- CVE-2026-53239xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()Linux
- CVE-2026-53235net: add pskb_may_pull() to skb_gro_receive_list()Linux
- CVE-2026-53232net: phy: clean the sfp upstream if phy probing failsLinux
- CVE-2026-53230net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_listLinux
- CVE-2026-53229net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failureLinux
- CVE-2026-53223net: guard timestamp cmsgs to real error queue skbsLinux
- CVE-2026-53217net: mvpp2: sync RX data at the hardware packet offsetLinux
- CVE-2026-53212netfilter: nft_tunnel: fix use-after-free on object destroyLinux
- CVE-2026-53209Bluetooth: hci_sync: reject oversized Broadcast Announcement prependLinux
- CVE-2026-53205accel/ivpu: Add bounds checks for firmware log indicesLinux
- CVE-2026-53203accel/ivpu: Add buffer overflow check in MS get_info_ioctlLinux
- CVE-2026-53202accel/ivpu: Fix signed integer truncation in IPC receiveLinux
- CVE-2026-53201Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend"Linux
- CVE-2026-53200KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNXLinux
- CVE-2026-53199hv_netvsc: use kmap_local_page in netvsc_copy_to_send_bufLinux
- CVE-2026-53198ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCELLinux
- CVE-2026-53194USB: serial: kl5kusb105: fix bulk-out buffer overflowLinux
- CVE-2026-53193ALSA: timer: Forcibly close timer instances at closingLinux
- CVE-2026-53192ALSA: timer: Fix UAF at snd_timer_user_params()Linux
- CVE-2026-53191io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retriesLinux
- CVE-2026-53189mm/huge_memory: update file PMD counter before folio_put()Linux
- CVE-2026-53188RDMA/core: Validate the passed in fops for ib_get_ucaps()Linux
- CVE-2026-53187RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH allocLinux
- CVE-2026-53185zram: fix use-after-free in zram_bvec_write_partial()Linux
- CVE-2026-53184udp: clear skb->dev before running a sockmap verdictLinux
- CVE-2026-53183mptcp: allow subflow rcv wnd to shrinkLinux
- CVE-2026-53182wifi: nl80211: reject oversized EMA RNR listsLinux
- CVE-2026-53180timers/migration: Fix livelock in tmigr_handle_remote_up()Linux
- CVE-2026-53178staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtractionLinux
- CVE-2026-53174ovl: keep err zero after successful ovl_cache_get()Linux
- CVE-2026-53173accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()Linux
- CVE-2026-53172accel/ethosu: fix IFM region index out-of-bounds in command stream parserLinux
- CVE-2026-53171accel/ethosu: fix arithmetic issues in dma_length()Linux
- CVE-2026-53170accel/ethosu: reject DMA commands with uninitialized lengthLinux
- CVE-2026-53165iomap: avoid potential null folio->mapping deref during error reportingLinux
- CVE-2026-53162memcg: use round-robin victim selection in refill_stockLinux
- CVE-2026-53161misc: fastrpc: fix use-after-free of fastrpc_user in workqueue contextLinux
- CVE-2026-53160misc: fastrpc: fix use-after-free race in fastrpc_map_createLinux
- CVE-2026-53159misc: fastrpc: fix DMA address corruption due to find_vma misuseLinux
- CVE-2026-53153mm/list_lru: drain before clearing xarray entry on reparentLinux
- CVE-2026-53148thunderbolt: Clamp XDomain response data copy to allocation sizeLinux
- CVE-2026-53147thunderbolt: Validate XDomain request packet size before type castLinux
- CVE-2026-53146thunderbolt: Limit XDomain response copy to actual frame sizeLinux
- CVE-2026-53145drm/gem: Try to fix change_handle ioctl, attempt 4Linux
- CVE-2026-53143drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11Linux
- CVE-2026-53133RDMA/umem: Fix truncation for block sizes >= 4GLinux
- CVE-2026-53132vsock/virtio: fix potential unbounded skb queueLinux
- CVE-2026-12937Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameterthemefic Tourfic – AI Powered Travel Booking, Hotel Booking…
- CVE-2026-9702InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker HijackingInPost PL
- CVE-2026-5305Email Address Encoder (Free < 1.0.25, Premium < 0.3.12) - Unauthenticated Stored XSSEmail Address Encoder · email-encoder-premium
- CVE-2026-12490Bypass of client certificate verification with transfer over TLSNLnet Labs NSD
- CVE-2026-12246Out of bounds stack write with crafted APL RRNLnet Labs NSD
- CVE-2026-12245Denial of DNS over TLS service by any DoT clientNLnet Labs NSD
- CVE-2026-12244Heap overflow and crash with crafted SVCB RRNLnet Labs NSD
- CVE-2026-10086Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-13311shell-quote parse() is quadratic in token count, enabling denial of serviceljharb shell-quote · shell-quote
- CVE-2026-10712Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-12053Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2026-12077Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameterswedevs Dokan Pro
- CVE-2026-8666OS Command Injection in Rapid7 InsightConnect Traceroute PluginRapid7 InsightConnect Traceroute Plugin
- CVE-2026-8592OS Command Injection in Rapid7 InsightConnect AWK PluginRapid7 InsightConnect AWK Plugin
- CVE-2026-8665OS Command Injection in Rapid7 InsightConnect Translate PluginRapid7 InsightConnect TR Plugin
- CVE-2026-8660OS Command Injection in Rapid7 InsightConnect Ping PluginRapid7 InsightConnect Ping Plugin
- CVE-2026-57589sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root.OpenBSD
- CVE-2026-9154Arbitrary File Write in Rapid7 InsightConnect Sed PluginRapid7 InsightConnect Sed Plugin
- CVE-2026-9155OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.Rapid7 InsightConnect Sed Plugin
- CVE-2025-60464A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attacker
- CVE-2026-37149GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost par
- CVE-2026-37452Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via
- CVE-2026-37453Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via
- CVE-2026-37454Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via
- CVE-2026-38637An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a c
- CVE-2026-38640A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS
Medium, low and unrated 223
- CVE-2026-13083Pen-drive: pen-drive: stored xss via unescaped cluster data in html reportPen Drive Powered by Red Hat Lightspeed
- CVE-2026-13318Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ipRed Hat OpenShift Virtualization
- CVE-2026-13218Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherRed Hat OpenShift Virtualization
- CVE-2026-12993Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subsetRed Hat build of Apicurio Registry
- CVE-2026-43920FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance executionFOSSBilling
- CVE-2026-40084Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parametercacti
- CVE-2026-40082Cacti: Session Fixation via missing session_regenerate_id() after logincacti
- CVE-2026-40080Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirectcacti
- CVE-2026-13282Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2020-37256Grav - Cross-Site Scripting in Admin Plugin Page EditorGrav · getgrav/grav
- CVE-2026-7511PKCS7_verify signer confusion allows forged signatures to be acceptedwolfSSL
- CVE-2026-7532iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefinedwolfSSL
- CVE-2026-8720HMAC-BLAKE2 final discards message when key length exceeds block sizewolfSSL
- CVE-2026-10098OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_statuswolfSSL
- CVE-2026-11703Missing SNI/ALPN binding on stateful (session-ID) TLS session resumptionwolfSSL
- CVE-2026-55962TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerifywolfSSL
- CVE-2026-6092Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configuredwolfSSL
- CVE-2026-6325Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms listwolfSSL
- CVE-2026-6329PKCS#12 MAC verification uses attacker-controlled comparison lengthwolfSSL
- CVE-2026-6330ML-KEM ARM64 NEON ciphertext comparison only compares half of the inputwolfSSL
- CVE-2026-6331HMAC zero-length tag forgery in EVP_DigestVerifyFinalwolfSSL
- CVE-2026-44622EVoke Systems EVoke CSMS Insufficiently Protected CredentialsEVoke CSMS
- CVE-2026-6412Continued acceptance of SHA-1/MD5 digests in certificate processingwolfSSL
- CVE-2026-6450CRL critical extension bypass in ParseCRL_ExtensionswolfSSL
- CVE-2026-6678Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient InfowolfSSL
- CVE-2026-6681PKCS#7 decode ignores caller output buffer size, writing past buffer boundswolfSSL
- CVE-2026-6731X.509 name constraint bypass via Subject CN treated as a DNS namewolfSSL
- CVE-2026-7531Use-after-free in PQC hybrid key-share handlingwolfSSL
- CVE-2026-10512X25519 x86_64 assembly final reduction leaves non-canonical field elementwolfSSL
- CVE-2026-10592Wildcard DNS SAN bypasses CA name-constraint checkswolfSSL
- CVE-2026-12340Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computationwolfSSL
- CVE-2026-55964Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)wolfSSL
- CVE-2026-57522Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templatesbitwarden server
- CVE-2026-57521Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceControllerbitwarden server
- CVE-2026-2299Improper Access Control in Mattermost Google Drive Plugin File Creation EndpointMattermost Google Drive Plugin
- CVE-2026-28898swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translaApple swift-nio-http2
- CVE-2026-56788RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepritomojitakasu RTKLIB
- CVE-2026-56787RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Messagetomojitakasu RTKLIB
- CVE-2026-56779MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters1Panel-dev MaxKB
- CVE-2026-56774Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session IDkanboard
- CVE-2026-56772NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpointsamuelclay NewsBlur
- CVE-2026-56771NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpointsamuelclay NewsBlur
- CVE-2026-56769Huly Platform - Server-Side Request Forgery via /import Endpointhcengineering platform
- CVE-2026-46611Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attacknicolargo glances · glances
- CVE-2026-54250K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompressionk3s-io k3s · github.com/k3s-io/k3s
- CVE-2026-54092File Browser: DoS Vulnerability on Public Login APIfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2026-54093File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-47770jq: stack overflow in deep structural equalityjqlang jq
- CVE-2026-54679jq: potential integer overflow in jvp_string_appendjqlang jq
- CVE-2026-55180pnpm: Repository config can expand victim environment secrets into registry requests before scripts runpnpm
- CVE-2026-48995pnpm: Tarball hash of GitHub git dependencies is not stored in lockfilepnpm
- CVE-2026-50017pnpm binds unscoped user-level npm auth credentials to a repository-selected registrypnpm
- CVE-2026-55967AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reusewolfSSL
- CVE-2026-50014pnpm: Git Fetch Argument Injection via Lockfile resolution.commitpnpm
- CVE-2026-50573pnpm: Unsafe default behavior breaks integrity checkpnpm
- CVE-2026-50021pnpm: Integrity Check Bypass via Missing Lockfile Integrity Fieldpnpm
- CVE-2026-6091Partial-chain verification accepts untrusted intermediate as trust anchorwolfSSL
- CVE-2026-55699pnpm: reserved bin name deletes PNPM_HOME during global removepnpm
- CVE-2026-6291Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryptionwolfSSL
- CVE-2026-6094Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedDatawolfSSL
- CVE-2026-54448Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parseraquasecurity trivy · github.com/aquasecurity/trivy
- CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probingRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypassRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenRed Hat build of Keycloak · org.keycloak:keycloak-services
- CVE-2026-55411ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secretsToolJet
- CVE-2026-13350Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.pretix Venueless
- CVE-2026-54573Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancyoutline
- CVE-2026-55439Halo: Path Traversal in Backup Download Leads to Arbitrary File Readhalo-dev halo
- CVE-2026-54024LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limitsdanny-avila LibreChat
- CVE-2026-54025LibreChat: Stored XSS via unescaped image alt text in markdown artifact previewdanny-avila LibreChat
- CVE-2026-54027LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorizationdanny-avila LibreChat
- CVE-2026-54029LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filterdanny-avila LibreChat
- CVE-2026-54037LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkdanny-avila LibreChat
- CVE-2026-54040LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypassdanny-avila LibreChat
- CVE-2026-54036LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verificationdanny-avila LibreChat
- CVE-2026-4522Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception.HYPR Passwordless
- CVE-2026-55693Vim: Out-of-bounds Write in Spell File Word Countvim
- CVE-2026-55892Vim: Out-of-bounds Write in Spell File Prefix Dumpvim
- CVE-2026-55895Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filenamevim
- CVE-2026-57451Vim: Out-of-bounds Read in Text Property Countvim
- CVE-2026-57452Vim: Out-of-bounds Read with libsodium-encrypted Filesvim
- CVE-2026-48945Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-57453Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extractionvim
- CVE-2026-48940Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-48941Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-48946Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-57454Vim: Out-of-bounds Read with Text Propertiesvim
- CVE-2026-48944Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-48942Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-48943Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26getk2.org K2 extension for Joomla
- CVE-2026-57455Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argumentvim
- CVE-2026-9718CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impactSchneider Electric PowerLogic™ P7
- CVE-2026-9651CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and Schneider Electric EasyLogic T150 (formerly Saitel DR) Remo…
- CVE-2026-57438Nokogiri: Possible Use-After-Free in XInclude Processingsparklemotion nokogiri · nokogiri
- CVE-2026-57437Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimesparklemotion nokogiri · nokogiri
- CVE-2026-57436Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node typesparklemotion nokogiri · nokogiri
- CVE-2026-57435Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`sparklemotion nokogiri · nokogiri
- CVE-2026-57434Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classessparklemotion nokogiri · nokogiri
- CVE-2026-57533Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs.pretix
- CVE-2026-57235Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`sparklemotion nokogiri · nokogiri
- CVE-2026-57234Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247sparklemotion nokogiri · nokogiri
- CVE-2026-57535Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags.pretix
- CVE-2026-57236Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exceptionsparklemotion nokogiri · nokogiri
- CVE-2026-13225Stored XSS in ticket confirmation pagepretix
- CVE-2026-49319Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay AttackAlps Electric Co. Remote Keyless Entry System (RKES) R53R0
- CVE-2026-57534Stored XSS in pretix-pagespretix-pages
- CVE-2026-57536Insufficient validation of payment status in pretix-molliepretix-mollie
- CVE-2026-13222Insufficient validation of payment status in pretix-oppwapretix-oppwa
- CVE-2026-13223Insufficient validation of payment status in pretix-computoppretix-computop
- CVE-2026-13314Stored XSS in pretix-digitalpretix-digital
- CVE-2026-6432Improper bounds validation in EmberZNet SDKSilicon Labs EmberZNet
- CVE-2026-57588SQL Injection in Nessus via Malicious Scan Result File Importtenable Nessus
- CVE-2026-57587SQL Injection in Nessus via Reverse DNS Lookuptenable Nessus
- CVE-2026-46732Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper SyDell Display and Peripheral Manager
- CVE-2026-56050WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerabilityThemeisle PPOM for WooCommerce
- CVE-2026-42389Reject more queries with invalid header valuesPowerDNS Recursor
- CVE-2026-12755Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated usDevolutions Server
- CVE-2026-57429WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerabilityeLightUp Slim SEO
- CVE-2026-56023WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerabilityKnit Pay UPI QR Code Payment Gateway for WooCommerce
- CVE-2026-56013WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerabilitymyCred License Manager for WooCommerce
- CVE-2026-57619WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerabilityElementor Website Builder
- CVE-2026-52690Spoofed answers can mark an authoritative non-EDNS capablePowerDNS Recursor
- CVE-2026-42390ZONEMD validation can be bypassedPowerDNS Recursor
- CVE-2026-42388Missing input validation for catalog zonesPowerDNS Recursor
- CVE-2026-42387Insufficient input validation in ZoneToCachePowerDNS Recursor
- CVE-2026-40012Information about ECS zero scoped answers might leak to clients that use a specific ECSPowerDNS Recursor
- CVE-2026-42004EDNS options smugglingPowerDNS DNSdist
- CVE-2026-40211Denial of service via crafted DoH3 queriesPowerDNS DNSdist
- CVE-2026-40210Out-of-bounds read in SetMacAddrActionPowerDNS DNSdist
- CVE-2026-40209Denial of service via IXFR queriesPowerDNS DNSdist
- CVE-2026-40208Denial of service via DoH3 queriesPowerDNS DNSdist
- CVE-2026-40011Prometheus denial of service via crafted DNS queriesPowerDNS DNSdist
- CVE-2026-42005Insufficient input validation of internal web serverPowerDNS Authoritative
- CVE-2026-56130Apache Shiro: Remember-me cookie isn't checked for expiry on the serverApache Software Foundation Apache Shiro
- CVE-2026-53274net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoSLinux
- CVE-2026-53272erofs: fix use-after-free on sbi->sync_decompressLinux
- CVE-2026-53271ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiersLinux
- CVE-2026-53269netfilter: synproxy: add mutex to guard hook reference countingLinux
- CVE-2026-532636lowpan: fix off-by-one in multicast context address compressionLinux
- CVE-2026-53261devlink: Release nested relation on devlink freeLinux
- CVE-2026-53258wifi: fix leak if split 6 GHz scanning failsLinux
- CVE-2026-53257wifi: cfg80211: enforce HE/EHT cap/oper consistencyLinux
- CVE-2026-53255Bluetooth: MGMT: validate advertising TLV before type checksLinux
- CVE-2026-53252Bluetooth: fix memory leak in error path of hci_alloc_dev()Linux
- CVE-2026-53251Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_syncLinux
- CVE-2026-53249ipv4: restrict IPOPT_SSRR and IPOPT_LSRR optionsLinux
- CVE-2026-53245net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattrLinux
- CVE-2026-53243rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()Linux
- CVE-2026-53241ALSA: seq: dummy: fix UMP event stack overreadLinux
- CVE-2026-53238netlabel: validate unlabeled address and mask attribute lengthsLinux
- CVE-2026-53237gpio: mvebu: fix NULL pointer dereference in suspend/resumeLinux
- CVE-2026-53236tcp: restrict SO_ATTACH_FILTER to priv usersLinux
- CVE-2026-53234net: ibm: emac: Fix use-after-free during device removalLinux
- CVE-2026-53233netdev: fix double-free in netdev_nl_bind_rx_doit()Linux
- CVE-2026-53231net: phy: don't try to setup PHY-driven SFP cages when using genphyLinux
- CVE-2026-53227net: openvswitch: fix possible kfree_skb of ERR_PTRLinux
- CVE-2026-53226gpio: rockchip: fix generic IRQ chip leak on removeLinux
- CVE-2026-53222ptp: ocp: fix resource freeing orderLinux
- CVE-2026-53220netfilter: revalidate bridge portsLinux
- CVE-2026-53219netfilter: x_tables: avoid leaking percpu counter pointersLinux
- CVE-2026-53218netfilter: nft_exthdr: fix register tracking for F_PRESENT flagLinux
- CVE-2026-53214ipv6: Fix a potential NPD in cleanup_prefix_route()Linux
- CVE-2026-53213drm/vc4: fix krealloc() memory leakLinux
- CVE-2026-53211netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR registerLinux
- CVE-2026-53210tee: shm: fix shm leak in register_shm_helper()Linux
- CVE-2026-53208Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsigLinux
- CVE-2026-53207mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoisonLinux
- CVE-2026-53206accel/ivpu: Add bounds check for firmware runtime memoryLinux
- CVE-2026-53204firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probeLinux
- CVE-2026-53197xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()Linux
- CVE-2026-53196USB: serial: io_ti: fix heap overflow in get_manuf_info()Linux
- CVE-2026-53195USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()Linux
- CVE-2026-53190drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()Linux
- CVE-2026-53181vsock/vmci: fix sk_ack_backlog leak on failed handshakeLinux
- CVE-2026-53179staging: rtl8723bs: fix buffer over-read in rtw_update_protectionLinux
- CVE-2026-53177bnxt_en: Fix NULL pointer dereferenceLinux
- CVE-2026-53169accel/ethosu: reject NPU_OP_RESIZE commands from userspaceLinux
- CVE-2026-53168fuse: reject fuse_notify() pagecache ops on directoriesLinux
- CVE-2026-53167fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate foliosLinux
- CVE-2026-53164iommu/dma: Do not try to iommu_map a 0 length region in swiotlbLinux
- CVE-2026-53163locking/rtmutex: Skip remove_waiter() when waiter is not enqueuedLinux
- CVE-2026-53158misc: fastrpc: Fix NULL pointer dereference in rpmsg callbackLinux
- CVE-2026-53157net: phonet: free phonet_device after RCU grace periodLinux
- CVE-2026-53156nvmem: core: fix use-after-free bugs in error pathsLinux
- CVE-2026-53155mm/huge_memory: use correct flags for device private PMD entryLinux
- CVE-2026-53154mm/hugetlb: restore reservation on error in hugetlb folio copy pathsLinux
- CVE-2026-53152mmc: dw_mmc-rockchip: Add missing private data for very old controllersLinux
- CVE-2026-53150thunderbolt: Reject zero-length property entries in validatorLinux
- CVE-2026-53149thunderbolt: Bound root directory content to block sizeLinux
- CVE-2026-53144drm/amdkfd: fix NULL dereference in get_queue_ids()Linux
- CVE-2026-53142drm/xe/display: fix oops in suspend/shutdown without displayLinux
- CVE-2026-53141drm/v3d: Fix global performance monitor reference countingLinux
- CVE-2026-53140drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroupsLinux
- CVE-2026-53139drm/v3d: Skip CSD when it has zeroed workgroupsLinux
- CVE-2026-53138drm/amd/display: Bound VBIOS record-chain walk loopsLinux
- CVE-2026-53137drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer sizeLinux
- CVE-2026-53136drm/amd/display: Clamp VBIOS HDMI retimer register count to array sizeLinux
- CVE-2026-53135drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfsLinux
- CVE-2026-53134netfilter: nft_fib: fix stale stack leak via the OIFNAME registerLinux
- CVE-2026-45188Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename HandlingApache Software Foundation Apache Kvrocks
- CVE-2026-46751Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.Apache Software Foundation Apache Kvrocks
- CVE-2026-54226Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoSApache Software Foundation Apache Kvrocks
- CVE-2026-56129Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc.Dynabook Generic IO & Memory Access driver · TOSHIBA Generi…
- CVE-2026-10824Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and DeletionMasteriyo LMS
- CVE-2026-0934Incorrect Authorization in GitLabGitLab
- CVE-2026-1606Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2026-2238Missing Authorization in GitLabGitLab
- CVE-2026-3176Missing Authorization in GitLabGitLab
- CVE-2026-5309Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-5796Incorrect Authorization in GitLabGitLab
- CVE-2026-5952Incorrect Authorization in GitLabGitLab
- CVE-2026-8330Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2026-11379Incorrect Authorization in GitLabGitLab
- CVE-2026-12635Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLabGitLab
- CVE-2026-2508Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'GravityMore Gravity Bookings
- CVE-2026-12079Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameterwedevs Dokan Pro
- CVE-2026-10833Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attributewpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2026-8658OS Command Injection in Rapid7 InsightConnect Tcpdump PluginRapid7 InsightConnect Tcpdump Plugin
- CVE-2026-8662Path Traversal in Rapid7 InsightConnect Compression PluginRapid7 InsightConnect Compression Plugin
- CVE-2026-8664OS Command Injection in Rapid7 InsightConnect Finger PluginRapid7 InsightConnect Finger Plugin
- CVE-2026-9153Arbitrary File Read in Rapid7 InsightConnect Sed PluginRapid7 InsightConnect Sed Plugin
- CVE-2026-8659OS Command Injection in Rapid7 InsightConnect SQLmap PluginRapid7 InsightConnect SQLmap Plugin
- CVE-2025-60465A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers