CVEs published June 26, 2026
353 CVEs were published on June 26, 2026: 42 critical, 137 high. 1 is now in CISA KEV.
- Published
- 353
- Critical
- 42
- High
- 137
- Medium
- 124
- Low
- 9
- Unrated
- 41
- Now in CISA KEV
- 1
- Fix available
- 128
Most affected products
- Linux
- 47
- opf openproject
- 17
- envoyproxy envoy
- 14
- GeoVision GV-LPCLPC2011/2211
- 10
- nodejs node
- 9
- budibase · @budibase/server
- 6
- JetBrains YouTrack
- 6
- kestra-io kestra
- 6
- notepad-plus-plus
- 6
- Revive Adserver
- 6
Critical 42
- CVE-2026-28701Daktronics Controller Firmware Path TraversalDaktronics VFC-DMP-5000 · Daktronics DMP-5000 +1
- CVE-2026-49869Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`kestra-io kestra
- CVE-2026-53576Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypasskestra-io kestra
- CVE-2026-54350Budibase: Anonymous NoSQL operator injection via published-app query templatesbudibase · @budibase/server
- CVE-2026-54352Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink uploadbudibase · @budibase/server
- CVE-2026-53309ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparisonLinux
- CVE-2026-46386OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`opf openproject
- CVE-2026-52780OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)opf openproject
- CVE-2026-52782OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resourcesopf openproject
- CVE-2026-52785OpenProject: SQL injection in timestamps functionalityopf openproject
- CVE-2026-33646mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)jdx mise · mise
- CVE-2026-54636Dokku: OS Command Injection via app.json managed Crondokku
- CVE-2026-45405Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:adddokku
- CVE-2026-45406Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through evaldokku
- CVE-2026-45408Dokku: OS Command Injection via App Name in Git Pre-Receive Hookdokku
- CVE-2026-0685Server side template inject (SSTI) in Edgewall Genshi Template EngineEdgewall *Genshi* Genshi
- CVE-2025-11919Unprotected temporary directories in Wolfram Cloud may result in privilege escalationWolfram Research Cloud
- CVE-2026-57658WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerabilityTemplateSpare
- CVE-2026-56070WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerabilityThemeHunk Advance Product Search
- CVE-2026-56068WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerabilityCrocoblock. Jetimpex JetEngine
- CVE-2026-56067WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerabilityCrocoblock. Jetimpex JetSmartFilters
- CVE-2026-56062WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerabilityoooorgle Quotes llama
- CVE-2026-56059WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerabilityPhysCode Travel Booking
- CVE-2026-56058WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerabilityThemeCatcher Quform
- CVE-2026-56057WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerabilityUncanny Owl Uncanny Automator Pro
- CVE-2026-56036WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerabilitycodemstory 워드프레스 결제 심플페이
- CVE-2026-56034WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerabilityOnline Web Tutor Library Management System
- CVE-2026-56033WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerabilityDokan Multivendor Plugin Dokan Pro
- CVE-2026-56032WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerabilityBuddyboss Platform
- CVE-2026-56030WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerabilitypaytiumsupport Paytium
- CVE-2026-56028WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerabilitythemewant Easy Elements for Elementor – Addons &…
- CVE-2026-56027WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerabilityPluggabl Booster for WooCommerce
- CVE-2026-54831WordPress GeoDirectory plugin <= 2.8.162 - SQL Injection vulnerabilityPaolo GeoDirectory
- CVE-2026-54827WordPress Real Estate 7 theme <= 3.5.9 - SQL Injection vulnerabilitycontempoinc Real Estate
- CVE-2026-54825WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerabilitywpDataTables
- CVE-2026-54820WordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerabilityCrocoblock. Jetimpex JetBooking
- CVE-2025-64152Apache IoTDB: Path Traversal VulnerabilityApache Software Foundation Apache IoTDB
- CVE-2025-55017Apache IoTDB: Path Traversal VulnerabilityApache Software Foundation Apache IoTDB
- CVE-2026-57881GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57880GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57879GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57878GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd)GeoVision GV-LPCLPC2011/2211
High 137
- CVE-2026-56414H.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous TypeH.VIEW HV-500S6 IP Camera
- CVE-2026-55975H.VIEW HV-500S6 IP Camera OS Command InjectionH.VIEW HV-500S6 IP Camera
- CVE-2026-31928Daktronics Controller Firmware Use of Hard-coded CredentialsDaktronics VFC-DMP-5000 · Daktronics DMP-5000 +1
- CVE-2026-33560Daktronics Controller Firmware Unrestricted Upload of File with Dangerous TypeDaktronics VFC-DMP-5000 · Daktronics DMP-5000 +1
- CVE-2026-45807Kestra: Path traversal via URL-encoded "%2E%2E" in execution and namespace file endpoints allows arbitrary file readkestra-io kestra
- CVE-2026-49984Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)kestra-io kestra
- CVE-2026-55069Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attackkestra-io kestra
- CVE-2026-54351Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Overridebudibase · @budibase/server
- CVE-2026-54353Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validationbudibase · @budibase/backend-core
- CVE-2026-50137Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentialsbudibase · @budibase/server
- CVE-2026-50136Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentialsbudibase · @budibase/server
- CVE-2026-50132Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibasebudibase · @budibase/server
- CVE-2026-46604Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/imagegolang.org/x/image/tiff · golang.org/x/image
- CVE-2026-48778Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreternotepad-plus-plus
- CVE-2026-52885Notepad++ TOCTOU: HMAC Checks Disk, Executes from Memorynotepad-plus-plus
- CVE-2026-46710Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Pathnotepad-plus-plus
- CVE-2026-48800Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injectionnotepad-plus-plus
- CVE-2026-52884Notepad++: CVE-2026-48800 Bypassnotepad-plus-plus
- CVE-2026-55188RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentialsrustfs
- CVE-2026-49991RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injectionrustfs
- CVE-2026-55189RustFS: FTP frontend skips IAM authorization on object readsrustfs
- CVE-2026-32833Cudy LT300 3.0 OS Command Injection via NTP ConfigurationShenzhen Cudy Technology Co. LT300
- CVE-2026-53322vfio/pci: Clean up DMABUFs before disabling functionLinux
- CVE-2026-53300net: enetc: fix NTMP DMA use-after-free issueLinux
- CVE-2026-53290drm/xe/eustall: Fix drm_dev_put called before stream disable in closeLinux
- CVE-2026-53284btrfs: only release the dirty pages io tree after successful writesLinux
- CVE-2026-53281iommu/vt-d: Avoid NULL pointer dereference or refcount corruptionLinux
- CVE-2026-47193OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checksopf openproject
- CVE-2026-52783OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposureopf openproject
- CVE-2026-52784OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"opf openproject
- CVE-2026-13372Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.Devolutions Remote Desktop Manager
- CVE-2026-47220Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log formatenvoyproxy envoy
- CVE-2026-48743Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Lengthenvoyproxy envoy
- CVE-2026-48044Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosionenvoyproxy envoy
- CVE-2026-48042Envoy: Stack overflow in destructor of highly nested JSONenvoyproxy envoy
- CVE-2026-55441mise: Arbitrary command execution via task-include files in an untrusted, config-less repositoryjdx mise · mise
- CVE-2026-56876extract-zip unvalidated symlink path traversalmax-mapper extract-zip · extract-zip
- CVE-2026-54341Dragonfly: RESTORE operations may crash the serverdragonflydb dragonfly
- CVE-2026-57231Podman: Malformed Image can trick podman run into leaking host environment variables into the containerpodman-container-tools podman · github.com/containers/li… +6
- CVE-2026-55677Echo: Encoded slash (%2F) bypasses route-level protection and exposes static fileslabstack echo · github.com/labstack/echo/v4 +2
- CVE-2026-56663AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` accessSignificant-Gravitas AutoGPT
- CVE-2026-57518Pagekit CMS 1.0.18 Privilege Escalation via UserApiControllerpagekit
- CVE-2026-9640LXD Snapshot Import Privilege Escalation VulnerabilityCanonical LXD
- CVE-2026-0828Kernel driver vulnerability in Safetica Endpoint ClientSafetica Endpoint Client
- CVE-2026-47214Docling: Unsafe URI and Path Handling in HTML Backenddocling-project docling · docling
- CVE-2026-12411Broken Access Control in Canonical LXD DevLXD APICanonical lxd
- CVE-2026-45195GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrustedImagination Technologies Graphics DDK
- CVE-2026-5757There exists an unauthenticated remote information disclosure vulnerability in Ollama's model quantization engineOllama AI Ollama
- CVE-2026-21734GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilationImagination Technologies Graphics DDK
- CVE-2026-57667WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerabilityAdrian Tobey Groundhogg
- CVE-2026-57663WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injection vulnerabilityIgor Benic Recipe Maker For Your Food Blog from Zip Recipes
- CVE-2026-57662WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerabilityWasiliy Strecker Contest Gallery
- CVE-2026-57659WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityStranger Studios Paid Memberships Pro - Add Member From Adm…
- CVE-2026-57655WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilityJay Versluis Child Theme Wizard
- CVE-2026-57653WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerabilitywpjobportal WP Job Portal
- CVE-2026-57647WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerabilitybPlugins Panorama Viewer – 360 Degree Image + Video Viewer
- CVE-2026-57645WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerabilityTribulant Software Newsletters
- CVE-2026-57644WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerabilityjetmonsters Restaurant Menu by MotoPress
- CVE-2026-57643WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vulnerabilityAF themes WP Post Author
- CVE-2026-57642WordPress Gallery plugin <= 4.7.8 - SQL Injection vulnerabilitybestwebsoft Gallery
- CVE-2026-57636WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerabilityTomdever wpForo Forum
- CVE-2026-57631WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerabilityAys Pro Popup box
- CVE-2026-57628WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerabilityWP All Import
- CVE-2026-57325WordPress NanoMag theme <= 1.8 - Cross Site Scripting (XSS) vulnerabilityJellywp NanoMag
- CVE-2026-57322WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityweDevs weMail
- CVE-2026-57321WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerabilityicc0rz H5P
- CVE-2026-57319WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityRealMag777 FOX
- CVE-2026-57317WordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-57315WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerabilityCreative Themes Blocksy Companion Pro
- CVE-2026-57314WordPress SureCart plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitySureCart
- CVE-2026-57312WordPress Everest Forms plugin <= 3.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilitywpeverest Everest Forms
- CVE-2026-56072WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerabilityXtemos WoodMart
- CVE-2026-56069WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerabilitySite Building with Toolset Toolset Forms
- CVE-2026-56064WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerabilityThemefic Tourfic
- CVE-2026-56063WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerabilitybPlugins MailChimp Block
- CVE-2026-56061WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerabilityWP Swings Subscriptions for WooCommerce
- CVE-2026-56060WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 7.1.1 - Sensitive Data Exposure vulnerabilitytychesoftwares Print Invoice & Delivery Notes for WooCommer…
- CVE-2026-56055WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerabilityInspiryThemes RealHomes
- CVE-2026-56047WordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityPerfmatters, Powered Kinsta + GeneratePress Docs Changelog…
- CVE-2026-56045WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerabilityValvePress Automatic
- CVE-2026-56044WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerabilityAdenion Blog2Social
- CVE-2026-56043WordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerabilityCusRev Customer Reviews for WooCommerce
- CVE-2026-56041WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerabilitydFactory Responsive Lightbox
- CVE-2026-56040WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityWordPress.com Gutenverse Form
- CVE-2026-56039WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress.com Quick Interest Slider
- CVE-2026-56038WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerabilityFrisbii Pay
- CVE-2026-56035WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerabilityCory Marsh BitFire Security
- CVE-2026-56031WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerabilityUncanny Owl Uncanny Automator
- CVE-2026-56029WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerabilityCorvusPay WooCommerce Payment Gateway
- CVE-2026-56025WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerabilityPaymob for WooCommerce
- CVE-2026-56011WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerabilitychrisvrichardson MapPress Maps for WordPress
- CVE-2026-56010WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerabilityTyche Softwares. Abandoned Cart Pro for WooCommerce
- CVE-2026-56008WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerabilityThemeFusion Fusion Builder
- CVE-2026-54847WordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerabilityDesign Stylish Cost Calculator
- CVE-2026-54846WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerabilityakosglys Syncee Premium Dropshipping & Wholesale
- CVE-2026-54840WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerabilityTribulant Software Newsletters
- CVE-2026-54839WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerabilitykingaddons Trinity Backup – Backup, Migrate, Restore,…
- CVE-2026-54837WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerabilitySyed Balkhi Intranet & Private Site – All-In-One…
- CVE-2026-54835WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerabilityRustaurius Five Star Restaurant Menu
- CVE-2026-54834WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerabilityfpuenteonline Object Cache 4 everyone
- CVE-2026-54833WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerabilityDev Kabir Enable CORS
- CVE-2026-54832WordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerabilityJegstudio Gutenverse Companion
- CVE-2026-54826WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerabilityPSM Plugins SupportCandy
- CVE-2026-54824WordPress Ads by WPQuads plugin <= 3.0.3 - Sensitive Data Exposure vulnerabilityAds WPQuads Ads by WPQuads
- CVE-2025-68064WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerabilityEverthemess Goya Core
- CVE-2025-68063WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerabilityStylemixThemes Splash - Sport Club WordPress Theme for Bask…
- CVE-2025-68052WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityEagle-Themes Eagle Booking
- CVE-2026-45257Arbitrary file overwrite via the KTLS receive pathFreeBSD
- CVE-2026-57527ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode()zaproxy zap-extensions
- CVE-2026-56773Teable - Missing Authorization in v2 REST APIteableio teable
- CVE-2026-40711Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contDell Container Storage Modules
- CVE-2026-57920Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} enPeplink InControl
- CVE-2026-57915Apache Kerby: Kerberos Pre-Authentication BypassApache Software Foundation Apache Kerby
- CVE-2026-57918libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection tsahlberg libnfs
- CVE-2025-7958A Code Injection vulnerability existed in Trellix Network Security CM and NX.Trellix Network Security NX, EX, FX, AX, and CMS
- CVE-2026-57913Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.Johnson & Johnson Audit Tracking Management System
- CVE-2026-57912Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about studentJohnson & Johnson Campus Recruiting
- CVE-2026-11702Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processesDAVIDO Bytes::Random::Secure::Tiny
- CVE-2026-11625Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processesDAVIDO Bytes::Random::Secure
- CVE-2026-2053Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API ManagerWSO2 API Manager
- CVE-2026-57877GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57876GV-LPC2011/LPC2211 - unauthorized out-of-bounds writing vulnerability (onvif.cgi)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57875GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability in packet parsingGeoVision GV-LPCLPC2011/2211
- CVE-2026-57874GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (IEEE8021x_upload.cgi)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57873GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability (IEEE8021x_upload.cgi)GeoVision GV-LPCLPC2011/2211
- CVE-2026-57872GV-LPC2011/LPC2211 - unauthorized directory traversal vulnerability (get_fcont.cgi)GeoVision GV-LPCLPC2011/2211
- CVE-2026-49486Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)Apache Software Foundation Apache Airflow FTP provider · ap…
- CVE-2026-10835SALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL InjectionSALESmanago & Leadoo
- CVE-2026-10823YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post DisclosureYMC Filter
- CVE-2026-8797An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows.NEC ExpressUpdate Agent for Windows
- CVE-2026-48618A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypasnodejs node
- CVE-2026-48933A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.nodejs node
- CVE-2026-50741Bypass to the fix for CVE-2026-34916.Revive Adserver
- CVE-2026-30041An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial o
- CVE-2026-36478An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServe
- CVE-2026-38639An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via par
- CVE-2026-38641An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafte
Medium, low and unrated 174
- CVE-2026-53577Kestra: Cross-Execution File Read via Preview Endpoint (IDOR)kestra-io kestra
- CVE-2024-23581HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerabilityHCLSoftware Traveler for Microsoft Outlook
- CVE-2026-48770Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crashnotepad-plus-plus
- CVE-2026-55838RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metricsrustfs
- CVE-2026-44733OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirementsopf openproject
- CVE-2026-44731OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosureopf openproject
- CVE-2026-53324net: mana: Use pci_name() for debugfs directory namingLinux
- CVE-2026-53323net: dsa: remove redundant netdev_lock_ops() from conduit ethtool opsLinux
- CVE-2026-53321io_uring/napi: cap busy_poll_to 10 msecLinux
- CVE-2026-53320nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()Linux
- CVE-2026-53319blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()Linux
- CVE-2026-53318wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr()Linux
- CVE-2026-53317wifi: mt76: mt7921: Place upper limit on station AIDLinux
- CVE-2026-53316drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()Linux
- CVE-2026-53315drm/amd/ras: Fix NULL deref in ras_core_get_utc_second_timestamp()Linux
- CVE-2026-53314padata: Put CPU offline callback in ONLINE section to allow failureLinux
- CVE-2026-53313drm/amd/display: Avoid NULL dereference in dc_dmub_srv error pathsLinux
- CVE-2026-53312iommu/riscv: Remove overflows on the invalidation pathLinux
- CVE-2026-53311fuse: fix uninit-value in fuse_dentry_revalidate()Linux
- CVE-2026-53310soc/tegra: cbb: Fix cross-fabric target timeout lookupLinux
- CVE-2026-53308power: supply: max77705: Free allocated workqueue and fix removal orderLinux
- CVE-2026-53307pinctrl: pinconf-generic: Fully validate 'pinmux' propertyLinux
- CVE-2026-53306tty: hvc_iucv: fix off-by-one in number of supported devicesLinux
- CVE-2026-53305usb: typec: ps883x: Fix Oops at unbindLinux
- CVE-2026-53304scsi: sg: Resolve soft lockup issue when opening /dev/sgXLinux
- CVE-2026-53303f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()Linux
- CVE-2026-53302crypto: eip93 - fix hmac setkey algo selectionLinux
- CVE-2026-53301reset: amlogic: t7: Fix null reset opsLinux
- CVE-2026-53299net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()Linux
- CVE-2026-53298net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()Linux
- CVE-2026-53297net: mana: Guard mana_remove against double invocationLinux
- CVE-2026-53296mailbox: mailbox-test: free channels on probe errorLinux
- CVE-2026-53295mailbox: add sanity check for channel arrayLinux
- CVE-2026-53294mailbox: mailbox-test: don't free the reused channelLinux
- CVE-2026-53293drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REGLinux
- CVE-2026-53292net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bindLinux
- CVE-2026-53291ALSA: hda/conexant: Fix missing error check for jack detectionLinux
- CVE-2026-53289ice: fix NULL pointer dereference in ice_reset_all_vfs()Linux
- CVE-2026-53288arm64: Reserve an extra page for early kernel mappingLinux
- CVE-2026-53287audit: fix incorrect inheritable capability in CAPSET recordsLinux
- CVE-2026-53286idpf: fix double free and use-after-free in aux device error pathsLinux
- CVE-2026-53285drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLEDLinux
- CVE-2026-53283iommu/amd: Bounds-check devid in __rlookup_amd_iommu()Linux
- CVE-2026-53282x86/kexec: Push kjump return address even for non-kjump kexecLinux
- CVE-2026-53280iommu: Fix NULL group->domain dereference in pci_dev_reset_iommu_done()Linux
- CVE-2026-53279drm/gma500/oaktrail_lvds: fix hang on init failureLinux
- CVE-2026-53278arm_mpam: Check whether the config array is allocated before destroying itLinux
- CVE-2026-44732OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resourcesopf openproject
- CVE-2026-44734OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/renameopf openproject
- CVE-2026-44735OpenProject: Shares API Information Disclosureopf openproject
- CVE-2026-29509Patool < 4.0.5 Path Traversal via safe_extract() Functionwummel patool
- CVE-2026-44696OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltrationopf openproject
- CVE-2026-49355OpenProject: Private work package data disclosure through single meeting agenda item APIopf openproject
- CVE-2026-44736OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjectsopf openproject
- CVE-2026-52779OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projectsopf openproject
- CVE-2026-52781OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"opf openproject
- CVE-2026-54753Nx: `nx graph` dev server permissive CORS policynrwl nx · nx
- CVE-2026-48090Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)envoyproxy envoy
- CVE-2026-47205Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overridesenvoyproxy envoy
- CVE-2026-47692Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application streamenvoyproxy envoy
- CVE-2026-47207Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC messageenvoyproxy envoy
- CVE-2026-48706Envoy Heap Buffer Overflow in TcpStatsdSinkenvoyproxy envoy
- CVE-2026-47204Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routesenvoyproxy envoy
- CVE-2026-47221Envoy: Null pointer deref in internal redirectsenvoyproxy envoy
- CVE-2026-48497Envoy: Abnormal process termination in DNS UDP filterenvoyproxy envoy
- CVE-2026-47778Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)envoyproxy envoy
- CVE-2026-47775Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryptionenvoyproxy envoy
- CVE-2026-54557mise HTTP backend uses raw version path for install symlink destinationjdx mise · mise
- CVE-2026-55448mise: Local credential_command executes untrusted configjdx mise · mise
- CVE-2026-47206Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializerdragonflydb dragonfly
- CVE-2026-48529GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusiongithub-mcp-server · github.com/github/github-mcp-server
- CVE-2026-55686Podman: WORKDIR symlink traversal vulnerabilitypodman-container-tools podman · github.com/containers/po… +4
- CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated usersCanonical lxd
- CVE-2026-45407Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touchdokku
- CVE-2025-32394AutoGPT: There is a DoS vulnerability in AITextSummarizerBlockSignificant-Gravitas AutoGPT
- CVE-2026-11779PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessPayloadCMS · payload
- CVE-2025-32423AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlockSignificant-Gravitas AutoGPT
- CVE-2026-56823AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping TriggeringSignificant-Gravitas AutoGPT
- CVE-2026-13434Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabledRed Hat OpenShift Virtualization
- CVE-2023-20572An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheAMD Athlon™ 3000 Series Mobile Processors with Radeon™… +15
- CVE-2023-20540An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheAMD Ryzen™ 3000 Series Desktop Processors · AMD Ryzen™ 5… +3
- CVE-2026-44018Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backenddocling-project docling · docling
- CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXDCanonical LXD
- CVE-2026-57665WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerabilityGravityKit GravityView
- CVE-2026-57664WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure vulnerabilityVillaTheme Bopo – WooCommerce Product Bundle Builder
- CVE-2026-57661WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerabilityNexcess WPComplete
- CVE-2026-57660WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2026-57657WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerabilityNoor Alam Gmail SMTP
- CVE-2026-57656WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityperegrinethemes Hester Core
- CVE-2026-57654WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerabilitywp.insider Affiliates Manager
- CVE-2026-57652WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerabilityJoomSky JS Help Desk
- CVE-2026-57651WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilitynK Ghost Kit
- CVE-2026-57650WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityBlockArt Magazine Blocks
- CVE-2026-57649WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerabilitystudiowombat Shoppable Images Lite
- CVE-2026-57648WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerabilityNelio Software Nelio Content
- CVE-2026-57646WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerabilityMajestic Support
- CVE-2026-57641WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerabilityContempoinc Real Estate
- CVE-2026-57640WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerabilityStylemix MasterStudy LMS
- CVE-2026-57638WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Fluent Booking
- CVE-2026-57637WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerabilitytychesoftwares Abandoned Cart Lite for WooCommerce
- CVE-2026-57635WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerabilityFunnelKit Payment Gateway for Stripe WooCommerce
- CVE-2026-57634WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerabilityWP Folio Team PPWP
- CVE-2026-57633WordPress WCBoost – Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilityWCBoost – Products Compare
- CVE-2026-57632WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerabilityEmail Marketing for WooCommerce by Omnisend
- CVE-2026-57630WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerabilityCreative Themes Blocksy Companion Pro
- CVE-2026-57629WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityStatCounter
- CVE-2026-57627WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityThemeum Kirki
- CVE-2026-57622WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerabilityArraytics WPCafe
- CVE-2026-57618WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityThemeisle Neve PRO
- CVE-2026-57617WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerabilitySeedProd LLC. SeedProd Pro
- CVE-2026-57431WordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityMervin Praison Featured Image
- CVE-2026-57430WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerabilitySEOPress Free SEOPress PRO
- CVE-2026-57324WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerabilityVillaTheme GIFT4U
- CVE-2026-57323WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerabilitybPlugins Flash & HTML5 Video
- CVE-2026-57318WordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerabilityGemini Labs Site Reviews
- CVE-2026-57316WordPress GetGenie plugin <= 4.4.2 - Sensitive Data Exposure vulnerabilityRoxnor GetGenie
- CVE-2026-57313WordPress SureCart plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerabilitySureCart
- CVE-2026-56066WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerabilityShortPixel Adaptive Images
- CVE-2026-56048WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerabilitytychesoftwares Payment Gateway Based Fees and Discounts for…
- CVE-2026-56046WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerabilityCridioStudio ListingPro
- CVE-2026-56026WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerabilityChris Carlevato utm.codes
- CVE-2026-52701WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerabilityThemegrill User Registration
- CVE-2026-24547WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerabilitySiteGround Email Marketing
- CVE-2025-68075WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityKerry BNE Testimonials
- CVE-2025-68074WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Image Carousel
- CVE-2025-66123WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerabilityAbout Envato BookPro
- CVE-2025-64637WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerabilityOpal_WP Auros Core
- CVE-2025-64636WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerabilityrhewlif Donation Thermometer
- CVE-2025-63079WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerabilitybdthemes Live Copy Paste for Elementor
- CVE-2025-63078WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerabilityjetmonsters Restaurant Menu by MotoPress
- CVE-2025-63041WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerabilityCode Amp Forget About Shortcode Buttons
- CVE-2026-4339SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP serverMattermost
- CVE-2026-9699Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errorsMattermost
- CVE-2026-45256Missing permission check in thr_kill2(2)FreeBSD
- CVE-2026-3472Markdown image rendering bypass in AI bot tool result posts in MattermostMattermost
- CVE-2026-13426Client4 fails to validate path parametersgithub.com/mattermost/mattermost/server/public
- CVE-2026-57940HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality.danpros HTMLy
- CVE-2026-53914In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadataJetBrains Kotlin · org.jetbrains.kotlin:kotlin-gradle-plugin
- CVE-2026-57926In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attackJetBrains YouTrack
- CVE-2026-57925In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tagsJetBrains YouTrack
- CVE-2026-57924In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile detailsJetBrains YouTrack
- CVE-2026-57923In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settingsJetBrains YouTrack
- CVE-2026-57922In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possibleJetBrains YouTrack
- CVE-2026-57921In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpointJetBrains YouTrack
- CVE-2026-57620WordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerabilityTim Strifler Exclusive Addons Elementor
- CVE-2026-57914Apache Kerby: StackOverflow on parsing deeply nested ASN1 structuresApache Software Foundation Apache Kerby
- CVE-2026-57473A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibilReolink Home Hub
- CVE-2026-6658Cross-site Scripting (XSS) in jupyter/nbconvertjupyter/jupyter
- CVE-2026-1869User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypasswpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-8380Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post DeletionFrontend File Manager Plugin
- CVE-2025-10268Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path TraversalPrintcart Web to Print Product Designer for WooCommerce
- CVE-2026-8661Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF PluginRapid7 InsightConnect Markdown Plugin
- CVE-2026-13226Groundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-48930A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation inodejs node
- CVE-2026-48928A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.nodejs node
- CVE-2026-48934A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.nodejs node
- CVE-2026-48936A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permissionodejs node
- CVE-2026-48935A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g.nodejs node
- CVE-2026-48619A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on nodejs node
- CVE-2026-48615A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.nodejs node
- CVE-2026-50745A missing sanitisation vulnerability exists with user input in the stats-video.php script.Revive Adserver
- CVE-2026-50740A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier.Revive Adserver
- CVE-2026-50742A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7.Revive Adserver
- CVE-2026-50739A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns Revive Adserver
- CVE-2026-50744A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7.Revive Adserver
- CVE-2026-13322Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of serviceRed Hat OpenShift Virtualization
- CVE-2026-30040A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context
- CVE-2026-36907A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of
- CVE-2026-36908A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers t
- CVE-2026-38571Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticat
- CVE-2026-39031Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials.
- CVE-2026-50765A stored cross-site scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System 0 thr
- CVE-2026-50766A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System 0 through 25.11 versions al
- CVE-2026-50767A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System 0 through 25.11 ver