CVEs published July 13, 2026
336 CVEs were published on July 13, 2026: 49 critical, 149 high.
- Published
- 336
- Critical
- 49
- High
- 149
- Medium
- 131
- Low
- 6
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 105
Most affected products
- OpenClaw
- 13
- Mattermost
- 10
- EVbee DC-80
- 8
- rejetto hfs
- 6
- Shibby Tomato
- 5
- ChurchCRM CRM
- 4
- GNU gawk
- 4
- hedgedoc
- 4
- SourceCodester Online Book Store System
- 4
- Themeum Kirki
- 4
Critical 49
- CVE-2026-58102Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_extsJONASBN Crypt::OpenSSL::X509
- CVE-2026-623279Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/statsdecolua 9Router · 9router
- CVE-2026-598019Router 0.4.41 - Unauthenticated API Exposure via /api/providersdecolua 9Router · 9router
- CVE-2026-58409ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin UploadChurchCRM CRM
- CVE-2026-6875Sandbox Escape in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-61500Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Keyrejetto hfs
- CVE-2026-61462mcp-gitlab Path Traversal via job_id Parameterzereight mcp-gitlab
- CVE-2026-13221Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunkperl
- CVE-2026-57433Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK recordHAARG Storable
- CVE-2026-6847Unauthenticated Remote Code Execution in ThemisNETPanel4real ThemisNETPanel
- CVE-2026-61498Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.phpVITEC Flamingo
- CVE-2026-60121Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.phpVITEC Flamingo
- CVE-2026-12257Remote code execution in Mura Software’s CMSMura Software CMS
- CVE-2026-14934Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab EnterpriseGoogle Cloud BigQuery · Google Cloud Dataform +1
- CVE-2026-13014Remote Code Execution vulnerability in "Suspicious" applicationThales CERT Suspicious
- CVE-2026-22103Command injection in NPC start web endpointEVbee DC-80
- CVE-2026-22098Sensitive information is written to logsEVbee DC-80
- CVE-2026-22097Missing firmware validation allows remote code executionEVbee DC-80
- CVE-2026-22102Arbitrary file overwrite through certificate update functionalityEVbee DC-80
- CVE-2026-22096Missing authentication for webserver endpointsEVbee DC-80
- CVE-2026-22095Command injection in diagnosis web endpointEVbee DC-80
- CVE-2026-22093Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service appEVbee Service
- CVE-2026-41041Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.Apache Software Foundation Apache Gravitino · apache-gravit…
- CVE-2026-59518WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerabilitywpWax Directorist
- CVE-2026-59515WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerabilitySergey AIWU
- CVE-2026-57813WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerabilityproperfraction MailOptin
- CVE-2026-57811WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerabilityRealtyna Organic IDX plugin
- CVE-2026-57770WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerabilityThemeGoods Grand Photography
- CVE-2026-57744WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerabilitystmcan RT-Theme 18 | Extensions
- CVE-2026-57738WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerabilityaxiomthemes
- CVE-2026-57739WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2026-57724WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerabilityThemeum Kirki
- CVE-2026-57726WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerabilityThemeum Kirki
- CVE-2026-57719WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerabilityCodeRevolution Aimogen Pro
- CVE-2026-57714WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerabilityLatePoint
- CVE-2026-57710WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerabilityquantumcloud WoowBot Pro Max
- CVE-2026-57707WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerabilityquantumcloud Simple Business Directory Pro
- CVE-2026-57702WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerabilityMelograno Venture Studio Amelia
- CVE-2026-57401WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerabilityBrainstorm Force SureDash
- CVE-2026-14453A user with low privileges can inject SSTI templates that can lead to RCE in open-ticketsCentreon Infra Monitoring
- CVE-2026-4769Unauthenticated Access to Internal Diagnostic InterfaceWAGO 0765-110x/0100-0000 · WAGO 0765-120x/0100-0000 +6
- CVE-2026-11964User Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership ActivationUser Registration & Membership
- CVE-2026-51536In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsisten
- CVE-2026-51537EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when proc
- CVE-2026-51538EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions
- CVE-2026-51540OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the pr
- CVE-2026-51541OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged
- CVE-2026-51821SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /use
- CVE-2026-52533An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
High 149
- CVE-2026-57856Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage APICockpit HQ Cockpit CMS
- CVE-2026-57855Cockpit CMS Missing Authorization in Bucket File Storage APICockpit HQ Cockpit CMS
- CVE-2026-58101Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereferenceJONASBN Crypt::OpenSSL::X509
- CVE-2026-58486HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatterhedgedoc
- CVE-2026-623289Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpointsdecolua 9Router · 9router
- CVE-2026-15680Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution VulnerabilityLorex 2K Indoor Wi-Fi Security Camera
- CVE-2026-62185Argo CD Helm Chart < 10.0.0 Missing Network Policy RCEargoproj argo-helm
- CVE-2026-15683Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation VulnerabilityLorex 2K Indoor Wi-Fi Security Camera
- CVE-2026-15684Glarysoft Glary Utilities Link Following Local Privilege Escalation VulnerabilityGlarysoft Glary Utilities
- CVE-2026-62200OpenClaw < 2026.6.6 Authentication Bypass via Git ext transportOpenClaw
- CVE-2026-62199OpenClaw < 2026.6.6 Authentication Bypass via Environment FilteringOpenClaw
- CVE-2026-62196OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDsOpenClaw
- CVE-2026-62195OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopbackOpenClaw
- CVE-2026-62194OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin InstallOpenClaw
- CVE-2026-62192OpenClaw 2026.6.6 < 2026.6.9 Authorization BypassOpenClaw
- CVE-2026-62191OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message MutationsOpenClaw
- CVE-2026-62190OpenClaw < 2026.6.9 Authorization Bypass via flock wrapperOpenClaw
- CVE-2026-62189OpenClaw < 2026.6.9 Symlink Following via Mirror SyncOpenClaw
- CVE-2026-62188OpenClaw < 2026.6.9 Feishu Authorization Bypassopenclaw feishu · @openclaw/feishu
- CVE-2026-62187OpenClaw < 2026.6.9 Feishu tools Authorization Bypassopenclaw feishu · @openclaw/feishu
- CVE-2026-62186OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model OverrideOpenClaw
- CVE-2026-62184luci-app-banip Log Monitor IP Extraction Bypassopenwrt luci-app-banip
- CVE-2026-15685Ollama downloadBlob Improper Validation of Array Index Denial-of-Service VulnerabilityOllama
- CVE-2026-61458PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpointpglombardo PasswordPusher
- CVE-2026-58500MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)appium-mcp
- CVE-2026-58411ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valuesChurchCRM CRM
- CVE-2026-62242Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registrationcodecentric spring-boot-admin
- CVE-2026-62240CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape ToolscrewAIInc crewAI · crewai-tools
- CVE-2026-58410ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ recordsChurchCRM CRM
- CVE-2026-48363ColdFusion | Uncontrolled Search Path Element (CWE-427)Adobe ColdFusion
- CVE-2026-48364ColdFusion | Uncontrolled Search Path Element (CWE-427)Adobe ColdFusion
- CVE-2026-55771CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilitiescedar-policy cedar-java · com.cedarpolicy:cedar-java
- CVE-2026-55773CedarJava has a policy injection vulnerabilitycedar-policy cedar-java · com.cedarpolicy:cedar-java
- CVE-2026-55772CedarJava has a type confusion vulnerabilitycedar-policy cedar-java · com.cedarpolicy:cedar-java
- CVE-2026-49972Laravel-Mediable < 7.0.0 File Upload RCE via Extension Bypassplank laravel-mediable
- CVE-2026-49970Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()plank laravel-mediable · plank/laravel-mediable
- CVE-2026-53365vsock/virtio: fix zerocopy completion for multi-skb sendsLinux
- CVE-2026-61463Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/accountgo-shiori shiori
- CVE-2026-57432Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpackperl
- CVE-2026-59245Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)Apache Software Foundation Apache Airflow FAB provider
- CVE-2026-58065Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verificationApache Software Foundation Apache Airflow Git provider
- CVE-2026-15584Redhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node rootPen Drive Powered by Red Hat Lightspeed
- CVE-2026-22099Missing authentication for Bluetooth communicationEVbee DC-80
- CVE-2026-22100Comnand injection in OCPP ReserveLogin messageEVbee DC-80
- CVE-2026-15548Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflowShibby Tomato
- CVE-2026-61956WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityhamsalam ووسلام – همگام سازی ووکامرس و باسلام
- CVE-2026-61955WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerabilityHannan گرویتی فرم فارسی
- CVE-2026-59521WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerabilityShapedPlugin Real Testimonials
- CVE-2026-59516WordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerabilityRoom 34 Creative Services ICS Calendar
- CVE-2026-57816WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.8 - Cross Site Scripting (XSS) vulnerabilityFunnel Builder by FunnelKit
- CVE-2026-57815WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
- CVE-2026-57814WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Forminator
- CVE-2026-57810WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerabilitySaad Iqbal APIExperts Square for WooCommerce
- CVE-2026-57805WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerabilitySelect-Themes Tonda
- CVE-2026-57804WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerabilityCodexThemes TheGem Theme Elements
- CVE-2026-57803WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerabilitySelect-Themes Struktur Core
- CVE-2026-57802WordPress Struktur theme < 2.7 - Local File Inclusion vulnerabilitySelect-Themes Struktur
- CVE-2026-57801WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerabilitySelect-Themes SetSail
- CVE-2026-57800WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerabilityEdge-Themes Overworld
- CVE-2026-57799WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerabilityuxper Nuss
- CVE-2026-57798WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerabilitySaurabhSharma NewsPlus Shortcodes
- CVE-2026-57796WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerabilityVLThemes Leedo
- CVE-2026-57795WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerabilitythemelexus Kitchor
- CVE-2026-57794WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerabilityuxper Golo Framework
- CVE-2026-57793WordPress Flow theme <= 1.8 - Local File Inclusion vulnerabilityElated-Themes Flow
- CVE-2026-57792WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerabilityMikado-Themes Dør
- CVE-2026-57791WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerabilityThemeMove Brook
- CVE-2026-57789WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerabilityjwsthemes Aqua
- CVE-2026-57790WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerabilityThemeMove Billey
- CVE-2026-57788WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerabilityEdge-Themes Aalto
- CVE-2026-57786WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerabilitypurethemes WorkScout-Core
- CVE-2026-57787WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerabilityCreativeWS CWS SVGicons
- CVE-2026-57773WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerabilityZorem Advanced Shipment Tracking for WooCommerce
- CVE-2026-57772WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerabilityWP Inventory Manager
- CVE-2026-57771WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerabilityMilan Petrovic GD Rating System
- CVE-2026-57768WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerabilityfavethemes Houzez Login Register
- CVE-2026-57745WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilitystmcan RT-Theme 18 | Extensions
- CVE-2026-57743WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerabilitystmcan RT-Theme 18 | Extensions
- CVE-2026-57741WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2026-57740WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2026-57734WordPress tagDiv Composer plugin <= 5.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilitytagDiv Composer
- CVE-2026-57733WordPress tagDiv Cloud Library plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerabilitytagDiv Cloud Library
- CVE-2026-57732WordPress tagDiv Opt-In Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilitytagDiv Opt-In Builder
- CVE-2026-57729WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerabilityUX-themes Flatsome
- CVE-2026-57725WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityThemeum Kirki
- CVE-2026-57728WordPress Flatsome theme <= 3.20.5 - Reflected Cross Site Scripting (XSS) vulnerabilityUX-themes Flatsome
- CVE-2026-57727WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerabilityThemeum Kirki
- CVE-2026-57718WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-57715WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja Fluent CRM
- CVE-2026-57713WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerabilityMarcus (aka @msykes) Events Manager
- CVE-2026-57712WordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerabilityWPZOOM Portfolio
- CVE-2026-57709WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerabilityWP Swings Membership For WooCommerce
- CVE-2026-57708WordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityCRM Perks Contact Form Entries
- CVE-2026-57706WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerabilityDokan
- CVE-2026-57705WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerabilityNexcess Event Tickets
- CVE-2026-57697WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerabilityMetagauss ProfileGrid
- CVE-2026-57695WordPress Document Gallery plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerabilityDan Rossiter Document Gallery
- CVE-2026-57668WordPress NEX-Forms plugin <= 9.2.2 - Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms
- CVE-2026-57423WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityKofi Mokome Message Filter for Contact Form
- CVE-2026-57422WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityVillaTheme Bopo – WooCommerce Product Bundle Builder
- CVE-2026-57421WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityCRM Perks Forms
- CVE-2026-57417WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerabilityRexTheme Cart Lift
- CVE-2026-57416WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilitySiteGround Email Marketing
- CVE-2026-57415WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerabilityCodemenschen Gift Vouchers
- CVE-2026-57411WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityAman CF7 Views – Complete Entry Management for Contac…
- CVE-2026-57410WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerabilityMailerPress Team MailerPress
- CVE-2026-57409WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityRealMag777 Active Products Tables for WooCommerce
- CVE-2026-57407WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerabilityWP Swings PDF Generator for WordPress
- CVE-2026-57405WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerabilitythemehunk Open Shop
- CVE-2026-57403WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerabilityMilan Petrovic GD Security Headers
- CVE-2026-57398WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerabilityWebCodingPlace Real Estate Manager Pro
- CVE-2026-57399WordPress Proxy & VPN Blocker plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerabilityProxy & VPN Blocker
- CVE-2026-57396WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerabilityFlintop Free Gifts for WooCommerce
- CVE-2026-57394WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerabilityTribulant Software Newsletters
- CVE-2026-57389WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerabilityAdrian Tobey Groundhogg
- CVE-2026-57388WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerabilityThemefic Hydra Booking
- CVE-2026-57387WordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilitypicu
- CVE-2026-57382WordPress Simple File List plugin <= 6.3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityMitchell Bennis Simple File List
- CVE-2026-57383WordPress JobSearch plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityeyecix JobSearch
- CVE-2026-57385WordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerabilityappsbd Vitepos
- CVE-2026-57386WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerabilityKodezen aBlocks
- CVE-2026-57381WordPress PropertyHive plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityProperty Hive PropertyHive
- CVE-2026-57379WordPress FormyChat plugin <= 2.15.3 - Cross Site Scripting (XSS) vulnerabilityWPPOOL FormyChat
- CVE-2026-57380WordPress Extensions for Leaflet Map plugin <= 5.1 - Cross Site Scripting (XSS) vulnerabilityhupe13 Extensions for Leaflet Map
- CVE-2026-57378WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerabilityPhil Kurth Advanced Forms
- CVE-2026-57368WordPress Jobmonster theme <= 4.8.5 - Reflected Cross Site Scripting (XSS) vulnerabilityNooTheme Jobmonster
- CVE-2026-57372WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerabilitydenishua WPJAM Basic
- CVE-2026-57363WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud ChatBot
- CVE-2026-57371WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerabilitydenishua WPJAM Basic
- CVE-2026-57376WordPress ElementInvader Addons for Elementor plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2026-57369WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Builder
- CVE-2026-15574Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug defaultRed Hat OpenShift AI
- CVE-2026-15545Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds writeShibby Tomato
- CVE-2026-62143Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addressesmisp-modules
- CVE-2026-15544Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflowShibby Tomato
- CVE-2026-57830Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7joomshaper.com Helix Ultimate extension for Joomla
- CVE-2026-57829Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7joomshaper.com Helix Ultimate extension for Joomla
- CVE-2026-15543Tenda CH22 CertListInfo formCertListInfo buffer overflowTenda CH22
- CVE-2026-14165Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5Dassault Systèmes Tuleap Enterprise Edition
- CVE-2026-12582Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_idLibrary Management System
- CVE-2026-12275Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki IntegrationTutor LMS
- CVE-2026-11963User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDORUser Registration & Membership
- CVE-2026-9492GIGABYTE｜Gigabyte Control Center - Improper Access ControlGIGABYTE MBStorage
- CVE-2026-7162Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected softwarWinFsp
- CVE-2026-15515Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search pathTencent PC Manager
- CVE-2025-45869LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF).
- CVE-2026-26396OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace
- CVE-2026-39042An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a
- CVE-2026-51539A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows.
Medium, low and unrated 138
- CVE-2026-15618mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanismmosaxiv clawlet
- CVE-2026-15607tanstack db Alias Path select.ts select prototype pollutiontanstack db
- CVE-2026-15605wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hashwandb
- CVE-2026-58489HedgeDoc: CSRF in GitHub Gist export callbackhedgedoc
- CVE-2026-15598antv layout object.js setNestedValue prototype pollutionantv layout
- CVE-2026-58487HedgeDoc: Stored HTML injection via email local-parthedgedoc
- CVE-2026-56877The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter aSkillable SCORM Lab Launch Integration
- CVE-2026-15597SourceCodester Class and Exam Timetabling System edit_exam2.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-58488HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofinghedgedoc
- CVE-2026-15681AnyDesk Screen Recording Link Following Denial-of-Service VulnerabilityAnyDesk
- CVE-2026-15682AnyDesk Support Information Link Following Denial-of-Service VulnerabilityAnyDesk
- CVE-2026-62198OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web SearchOpenClaw
- CVE-2026-62197OpenClaw < 2026.6.6 Policy Bypass via CDP DiscoveryOpenClaw
- CVE-2026-62193OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin InstallOpenClaw
- CVE-2026-15596SourceCodester Class and Exam Timetabling System subject.php cross site scriptingSourceCodester Class and Exam Timetabling System
- CVE-2026-62239FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.pyDao-AILab flash-attention
- CVE-2026-15595SourceCodester Class and Exam Timetabling System forsubject.php cross site scriptingSourceCodester Class and Exam Timetabling System
- CVE-2026-15594waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorizationwaooAI waoowaoo
- CVE-2026-58408ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PIIChurchCRM CRM
- CVE-2026-12385Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameternextendweb Smart Slider
- CVE-2026-12536Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Titlethemefusion Avada (Fusion) Builder
- CVE-2026-14906Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOSMozilla Firefox for iOS
- CVE-2026-49971Laravel-Mediable < 7.0.0 Stored XSS via SVG File Uploadplank laravel-mediable
- CVE-2026-49969Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handlingplank laravel-mediable
- CVE-2026-58228Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>phoenixframework phoenix_live_view
- CVE-2026-60103Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA blockblender
- CVE-2026-53364Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()Linux
- CVE-2026-61505Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameterrejetto hfs
- CVE-2026-61504Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listingrejetto hfs
- CVE-2026-61503Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differencesrejetto hfs
- CVE-2026-61502Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requestsrejetto hfs
- CVE-2026-61501Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewerrejetto hfs
- CVE-2026-40553Stack-based buffer overflow in gawkGNU gawk
- CVE-2026-40469Heap buffer overflow in gawkGNU gawk
- CVE-2026-40468Heap buffer overflow in gawkGNU gawk
- CVE-2026-40467Use after free in gawkGNU gawk
- CVE-2026-15559CodeAstro Simple Online Leave Management System POST accept.php sql injectionCodeAstro Simple Online Leave Management System
- CVE-2026-62147Tempo-operator: tempo operator: query rbac bypassRed Hat OpenShift distributed tracing
- CVE-2026-15558CodeAstro Simple Online Leave Management System deletemp.php sql injectionCodeAstro Simple Online Leave Management System
- CVE-2026-6541Unscoped updates to other playbooks' metric configurationMattermost
- CVE-2026-9820Mattermost schemes teams endpoint exposes private team invite IDsMattermost
- CVE-2026-9824Remote cluster metadata enumeration via /share-channel autocompleteMattermost
- CVE-2026-4765Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station ConversasRD Station Conversas Tallos Chat
- CVE-2026-14846Incorrect neutralisation in the PrestaShop firmwarePrestaShop The firmware
- CVE-2026-15557waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authenticationwaooAI waoowaoo
- CVE-2026-49876Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIsApache Software Foundation Apache Gravitino · apache-gravit…
- CVE-2026-61985WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerabilitymagepeopleteam Car Rental Manager
- CVE-2026-61977WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerabilityCrocoblock JetSearch
- CVE-2026-61983WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerabilityandy_moyle Church Admin
- CVE-2026-61976WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerabilityCrocoblock JetBlocks For Elementor
- CVE-2026-61975WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerabilityCrocoblock JetReviews
- CVE-2026-61971WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerabilityCozmoslabs User Profile Picture
- CVE-2026-61970WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerabilityThemeisle Auto Featured Image
- CVE-2026-61968WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerabilitySaad Iqbal myCred
- CVE-2026-61958WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerabilitySaad Iqbal License Manager for WooCommerce
- CVE-2026-59523WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-61952WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerabilityJose Vega WooCommerce Bulk Edit Products – WP Sheet Editor
- CVE-2026-57812WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-57797WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerabilityThemeMove EduMall
- CVE-2026-57783WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerabilitymerkulove Speaker
- CVE-2026-57782WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerabilityPressTigers Universal Clocks
- CVE-2026-57781WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerabilitySovlix MeetingHub
- CVE-2026-57780WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerabilityPlugin Envision Envision Page Builder
- CVE-2026-57779WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerabilitythemebeez Fascinate
- CVE-2026-57778WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerabilitywpdevart Booking calendar, Appointment Booking System
- CVE-2026-57776WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerabilityvowelweb VW Wedding
- CVE-2026-57774WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerabilityvowelweb VW Food Corner
- CVE-2026-57711WordPress SupportCandy plugin <= 3.4.8 - Cross Site Scripting (XSS) vulnerabilityPSM Plugins SupportCandy
- CVE-2026-57698WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerabilityVillaTheme Abandoned Cart Recovery for WooCommerce
- CVE-2026-57693WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerabilitySpacetime Ad Inserter
- CVE-2026-57691WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerabilityEli Anti-Malware Security and Brute-Force Firewall
- CVE-2026-57694WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Tutor LMS
- CVE-2026-57424WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerabilityknitpay Razorpay Payment Links for WooCommerce
- CVE-2026-57420WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityNetrr Author Box WP Lens
- CVE-2026-57418WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2026-57419WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerabilityFahad Mahmood Stock Locations for WooCommerce
- CVE-2026-57414WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud ChatBot for eCommerce – WoowBot
- CVE-2026-57413WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerabilitybdthemes Instant Image Generator
- CVE-2026-57412WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerabilityCodemenschen Gift Vouchers
- CVE-2026-57408WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerabilitypeachpayments Peach Payments Gateway
- CVE-2026-57406WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerabilityRoxnor FundEngine
- CVE-2026-57404WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2026-57402WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerabilitywpdesk Flexible Refund and Return Order for WooCommerce
- CVE-2026-57400WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerabilityWP Swings Event Tickets Manager for WooCommerce
- CVE-2026-57395WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerabilityThemefic Tourfic
- CVE-2026-57393WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerabilityEDGARROJAS WooCommerce PDF Invoice Builder
- CVE-2026-57392WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerabilityThemefic Tourfic
- CVE-2026-57391WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerabilityTangible Loops & Logic
- CVE-2026-57390WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerabilityEDGARROJAS Extra Product Options Builder for WooCommerce
- CVE-2026-57364WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerabilityWPDeveloper Better Payment – Instant Payments, Donations, F…
- CVE-2026-57375WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerabilityFluxBuilder MStore API
- CVE-2026-57365WordPress reCAPTCHA (v2 & v3) for Asgaros Forum plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityHitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Forum
- CVE-2026-57377WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerabilityWPXPO WowAddons
- CVE-2026-15547Shibby Tomato CIFS Mount sub_2D048 os command injectionShibby Tomato
- CVE-2026-9597Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpointMattermost
- CVE-2026-15546Shibby Tomato start_jffs2 sub_2D568 os command injectionShibby Tomato
- CVE-2026-6850Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in MattermostMattermost
- CVE-2026-10106Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in MattermostMattermost
- CVE-2026-10085Ordinary group/direct message member can enable group_constrained and remove all channel participantsMattermost
- CVE-2026-9708Incoming webhook user attribution via unvalidated webhook ownerMattermost
- CVE-2026-10103Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channelsMattermost
- CVE-2026-9571Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in MattermostMattermost
- CVE-2026-15542will-moss Isaiah Websocket Connection Authentication main.go improper authenticationwill-moss Isaiah
- CVE-2026-15541will-moss Isaiah Master Websocket server.go Server.Handle authorizationwill-moss Isaiah
- CVE-2026-15540SourceCodester Online Book Store System Administrative index.php php file inclusionSourceCodester Online Book Store System
- CVE-2026-15539SourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted uploadSourceCodester Online Book Store System
- CVE-2026-15538primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollutionprimefaces primereact
- CVE-2026-12397WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDORWP Job Portal
- CVE-2026-12396WP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and RejectionWP Job Portal
- CVE-2026-12274Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDORTutor LMS
- CVE-2026-12273Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment CreationTutor LMS
- CVE-2026-12271Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDORTutor LMS
- CVE-2026-12081Database for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File FieldDatabase for Contact Form 7, WPforms, Elementor forms
- CVE-2026-10551Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify LibraryBreeze Cache
- CVE-2026-15537SourceCodester Online Book Store System login.php sql injectionSourceCodester Online Book Store System
- CVE-2026-15536itsourcecode Hospital Management System patviewprescription.php sql injectionitsourcecode Hospital Management System
- CVE-2026-15535AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserializationAkariAsai self-rag
- CVE-2026-15533DedeCMS Column Management search.php code injectionDedeCMS
- CVE-2026-15532SourceCodester Online Book Store System User Management cross site scriptingSourceCodester Online Book Store System
- CVE-2026-15531yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserializationyashbhalgat HashNeRF-pytorch
- CVE-2026-15530WuzhiCMS Attachment API index.php listimage information disclosureWuzhiCMS
- CVE-2026-15529yzhao062 pyod persistence.py pyod.utils.persistence.load deserializationyzhao062 pyod · pyod
- CVE-2026-15528lamaalrajih kicad-mcp path_validator.py protection mechanismlamaalrajih kicad-mcp
- CVE-2026-15553Ragic｜Enterprise Cloud Database - Arbitrary File UploadRagic Enterprise Cloud Database
- CVE-2026-15527better-auth better-icons scan_project_icons/sync_icon path traversalbetter-auth better-icons
- CVE-2026-15552Ragic｜Enterprise Cloud Database - Stored Cross-Site ScriptingRagic Enterprise Cloud Database
- CVE-2026-15526augmnt augments-mcp-server scan_project_deps scan-project-deps.ts scanProjectDeps path traversalaugmnt augments-mcp-server
- CVE-2026-15525kLOsk adloop write.py _validate_urls server-side request forgerykLOsk adloop
- CVE-2026-15524alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversalalioshr memory-bank-mcp
- CVE-2026-15523CodeAstro Simple Online Leave Management System dashboard.php sql injectionCodeAstro Simple Online Leave Management System
- CVE-2026-15522tugcantopaloglu godot-mcp run_project index.js validatePath path traversaltugcantopaloglu godot-mcp
- CVE-2026-15521makafeli n8n-workflow-builder update_node_from_file server.cjs path traversalmakafeli n8n-workflow-builder
- CVE-2026-15520GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflowGNU LibreDWG
- CVE-2026-15519usestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphereusestrix strix
- CVE-2026-15518AREA 17 Twill CMS Media Library Insert FileLibraryController.php storeFile unrestricted uploadAREA 17 Twill CMS
- CVE-2026-15517Jinher OA PlanGiveOut.aspx sql injectionJinher OA
- CVE-2026-15516MacCMS Pro Installation Index.php step5 authorizationMacCMS Pro
- CVE-2026-15551Samsung rlottie: Numeric truncation in gray_hline() leads to heap-based buffer overflow when rendering a crafted Lottie animation at native canvas sizeSamsung Open Source rlottie