CVEs published July 15, 2026
267 CVEs were published on July 15, 2026: 33 critical, 123 high.
- Published
- 267
- Critical
- 33
- High
- 123
- Medium
- 93
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 202
Most affected products
- ImageMagick · Magick.NET-Q16-AnyCPU +16
- 13
- Absolute Security Secure Access
- 11
- dataease
- 10
- wekan
- 10
- Huawei HarmonyOS
- 7
- Cisco RoomOS Software
- 6
- taosdata TDengine
- 6
- decolua 9router · 9router
- 5
- labring FastGPT
- 5
- MervinPraison PraisonAI · praisonai
- 5
Critical 33
- CVE-2026-54458AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket PluginWWBN AVideo · WWBN/AVideo
- CVE-2026-55445Qinglong: Incomplete fix for CVE-2026-3965: Improper Authenticationwhyour qinglong · @whyour/qinglong
- CVE-2026-55652Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)wekan
- CVE-2026-52893Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hookwekan
- CVE-2026-52891Wekan: Shell Injection via Avatar Uploadwekan
- CVE-2026-493529Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypassdecolua 9router · 9router
- CVE-2026-463399Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routesdecolua 9router · 9router
- CVE-2026-54052n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deploymentsczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-52887NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCEnocobase · @nocobase/plugin-notification-in-app-message
- CVE-2026-46684DataEase: Unauthorized Command Execution Vulnerabilitydataease
- CVE-2026-45534DataEase: RCE Vulnerabilitydataease
- CVE-2026-49445Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket accesscilium · github.com/cilium/cilium
- CVE-2026-46421Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)@cap-js/sqlite · @cap-js/postgres +1
- CVE-2026-62948OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UIopenwrt
- CVE-2026-53512Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsbetter-auth
- CVE-2026-53513Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registrationbetter-auth · @better-auth sso +1
- CVE-2026-14960CVE-2026-14960Pegatron Tdelo64.sys
- CVE-2026-50562FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflowslabring FastGPT
- CVE-2026-62378RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeoverrustfs console
- CVE-2026-52842Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypasslightpanda-io browser
- CVE-2026-52843Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials modelightpanda-io browser
- CVE-2026-50148Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Writemetabase
- CVE-2026-44986Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profilepenpot
- CVE-2026-61740LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionHKUDS LightRAG · lightrag-hku
- CVE-2026-61736LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsHKUDS LightRAG · lightrag-hku
- CVE-2026-61451Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_urlgetgrav grav-plugin-api
- CVE-2026-56400open-webui - Remote Code Execution via CORS Misconfiguration and Session Validationopen-webui
- CVE-2026-13385An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-theASUS Router
- CVE-2025-65720An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a gpt-researcher
- CVE-2026-26718A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform una
- CVE-2026-30618xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling.
- CVE-2026-30623LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.
- CVE-2026-51380Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or pote
High 123
- CVE-2026-63175Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCaptureLookyloo PlaywrightCapture
- CVE-2026-48795Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparseradonisjs core · @adonisjs/bodyparser
- CVE-2026-45313Sandboxie-Plus: Sandboxie APC Injection Sandbox Escapesandboxie-plus Sandboxie
- CVE-2026-55234Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)wekan
- CVE-2026-53444Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to adminwekan
- CVE-2026-53445Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boardswekan
- CVE-2026-52890Wekan: Arbitrary file read and server DoS via attachment versions.original.pathwekan
- CVE-2026-55576MaaAssistantArknights: PR-title expression injection in release-preparation.ymlMaaAssistantArknights
- CVE-2026-49279WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)WWBN AVideo · wwbn/avideo
- CVE-2026-623129Router: Authenticated RCE via Unvalidated MCP Plugin Argumentsdecolua 9router
- CVE-2026-566799Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgradedecolua 9router · 9router
- CVE-2026-493539Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofINGdecolua 9router · 9router
- CVE-2026-33445Memory management vulnerability in Secure Access serversAbsolute Security Secure Access
- CVE-2026-59950MCP Python SDK: WebSocket server transport does not support Host/Origin validationmodelcontextprotocol python-sdk · mcp
- CVE-2026-52870MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksmodelcontextprotocol python-sdk · mcp
- CVE-2026-33443Memory management error in Secure Access servers prior to 14.55Absolute Security Secure Access
- CVE-2026-52869MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalmodelcontextprotocol python-sdk · mcp
- CVE-2026-50144ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter idTencent ncnn
- CVE-2026-45738Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalationargoproj argo-cd · github.com/argoproj/argo-cd/v3 +2
- CVE-2026-45320DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injectiondataease
- CVE-2026-45535DataEase: Stored SQL Injection Vulnerabilitydataease
- CVE-2026-45533DataEase: Path Traversal Vulnerabilitydataease
- CVE-2026-50124DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropperdataease
- CVE-2026-40952Privilge misconfiguration in Secure Access installersAbsolute Security Secure Access
- CVE-2026-50030DataEase: Arbitrary SQL execution in preview path (direct data disclosure)dataease
- CVE-2026-45419DataEase: Arbitrary File Write Vulnerabilitydataease
- CVE-2026-45417DataEase: SQL injection vulnerabilitydataease
- CVE-2026-62351TDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsgtaosdata TDengine
- CVE-2026-15895OS command injection in jsii-diff in AWS jsiiAWS jsii · jsii-diff
- CVE-2026-62349TDengine: Off-by-One Buffer Overflowtaosdata TDengine
- CVE-2026-62350TDengine: UDF lead to RCEtaosdata TDengine
- CVE-2026-12997Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' ParameterGravity Forms
- CVE-2026-46485Dash: Users can write to config despire permissions (OIDC tested)lissy93 dashy
- CVE-2026-49987Repomix: Command Injection (RCE) via `--remote-branch` Argument Injectionyamadashy repomix · repomix
- CVE-2026-40501Cherry Studio RCE via SearchService nodeIntegration MisconfigurationCherryHQ cherry-studio
- CVE-2026-10673Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassemblyzephyrproject zephyr
- CVE-2026-53517Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forkingbetter-auth · @better-auth oauth-provider +1
- CVE-2026-56687Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Feature in UI vulnerability.Dell ThinOS
- CVE-2026-45337Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingbetter-auth
- CVE-2026-53514Better Auth: Unauthorized invitation acceptance via unverified email match in organization pluginbetter-auth
- CVE-2026-53515Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/ssobetter-auth · @better-auth sso +1
- CVE-2026-12382Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingRed Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1
- CVE-2026-20296SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-20297Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-53518Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemptionbetter-auth · @better-auth/oauth-provider
- CVE-2026-53516Better Auth: Account takeover via OAuth auto-link to unverified pre-registered emailbetter-auth
- CVE-2026-59258immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUserimmich-app immich
- CVE-2026-59255BloodHound Missing Authorization on Custom Node Management APISpecterOps BloodHound
- CVE-2026-58660Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Dropkanboard
- CVE-2026-58659PyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterLightning-AI pytorch-lightning · lightning +1
- CVE-2026-58658GPUStack Unauthenticated Information Disclosure via Worker Endpointsgpustack
- CVE-2026-59954Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingapolloconfig apollo · com.ctrip.framework.apollo:apollo
- CVE-2026-59955Apollo ConfigService access key authentication bypass via raw config file appId parsingapolloconfig apollo · com.ctrip.framework.apollo:apollo
- CVE-2026-45793Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logscomposer · composer/composer
- CVE-2026-20187Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling VulnerabilitiesCisco RoomOS Software
- CVE-2026-20158Cisco RoomOS Security Hardening Release - Resource Lifetime Management VulnerabilitiesCisco RoomOS Software
- CVE-2026-20153Cisco RoomOS Security Hardening Release - Input Validation VulnerabilitiesCisco RoomOS Software
- CVE-2026-20157Cisco RoomOS Security Hardening Release - Missing Encryption VulnerabilitiesCisco RoomOS Software
- CVE-2026-20156Cisco RoomOS Security Hardening Release - Buffer Management VulnerabilitiesCisco RoomOS Software
- CVE-2026-20150Cisco RoomOS Security Hardening Release - Access Control VulnerabilitiesCisco RoomOS Software
- CVE-2026-48799Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhookgitroomhq postiz-app
- CVE-2026-45804Diffusers: TOCTOU Trust Remote Code Bypasshuggingface diffusers · diffusers
- CVE-2026-62685File Browser: Colliding username normalization gives two users the same home directoryfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-55242ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefixfrappe erpnext
- CVE-2026-50147Metabase: Arbitrary File Read via MySQL Connection Property Injectionmetabase
- CVE-2026-45805Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCEpenpot · @penpot/mcp
- CVE-2026-45806Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-urlpenpot
- CVE-2026-60005NGINX ngx_http_slice_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-47164Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identitydani-garcia vaultwarden
- CVE-2026-47158Vaultwarden: CSRF in SSO Authorization Flowdani-garcia vaultwarden
- CVE-2026-46709Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038)Eugeny tabby
- CVE-2026-61828nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`NixOS nixpkgs
- CVE-2026-54560Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claimcloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-54563Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (`/dav`) — scoped DAV credential escapes its configured account rootcloudreve · github.com/cloudreve/Cloudreve +2
- CVE-2026-42533NGINX Map directive and Regex matching vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-55723NGINX Ingress Controller vulnerabilityF5 NGINX Ingress Controller
- CVE-2026-59762BIG-IP HTTP/2 vulnerabilityF5 BIG-IP
- CVE-2026-61644FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookuplabring FastGPT
- CVE-2026-61684FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')labring FastGPT
- CVE-2026-61613Cursor: Cloud Agent Browser Sandbox Escapecursor
- CVE-2026-61836Directus: Authorization-dependent response served from unsegmented cache keydirectus
- CVE-2026-61835Directus: SSRF Protection Bypass via 0.0.0.0 in File Importdirectus
- CVE-2026-43637Cornac < 2.6.0 Path Traversal via _extract_archive() in download.pyPreferredAI cornac
- CVE-2026-46458Credential exposure in ICU Scandinavia BoomerangICU Scandinavia Boomerang
- CVE-2026-58558Permission control vulnerability in the file system.Huawei Harmony OS · Huawei EMUI
- CVE-2026-15809Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home envRed Hat OpenShift Container Platform · Red Hat Confidential…
- CVE-2026-61873Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filenamegetgrav grav
- CVE-2026-61449Grav before 2.0.2 Decompression Bomb via Forged ZIP Sizegetgrav grav · getgrav/grav
- CVE-2026-61446PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-DiscoveryMervinPraison PraisonAI · praisonaiagents
- CVE-2026-61443PraisonAI before 1.6.78 Remote Code Execution via SkillToolsMervinPraison PraisonAI · praisonaiagents
- CVE-2026-61440PraisonAI Platform before 0.1.9 Authorization Bypass via Label EndpointsMervinPraison PraisonAI · praisonai-platform
- CVE-2026-61438PraisonAI before 4.6.78 Remote Code Execution via Broken AST SandboxMervinPraison PraisonAI
- CVE-2026-61436PraisonAI before 4.6.78 Missing Webhook Signature VerificationMervinPraison PraisonAI · praisonai
- CVE-2026-61435PraisonAI before 4.6.78 Authentication Bypass via Host Header SpoofingMervinPraison PraisonAI · praisonai
- CVE-2026-61433PraisonAI before 4.6.78 Code Injection via API deployment generatorMervinPraison PraisonAI · praisonai
- CVE-2026-61430PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawlMervinPraison PraisonAI · praisonaiagents
- CVE-2026-60085PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess SandboxMervinPraison PraisonAI · praisonai
- CVE-2026-58655Grav Flex Objects - Server-Side Template Injection via Dynamic Titlesgetgrav grav
- CVE-2026-57996phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add EndpointphpMyFAQ
- CVE-2026-56398Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URIopen-webui
- CVE-2026-56339Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPCCap-go capgo
- CVE-2026-59235Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accountsRoskus Prospero Flow CRM
- CVE-2026-40633Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information iDell PowerScale OneFS
- CVE-2026-57821Apache Fineract: Office list: SQL Injection via Subquery in orderByApache Software Foundation Apache Fineract
- CVE-2026-35152Apache Fineract: SQL injection in runreports endpointApache Software Foundation Apache Fineract
- CVE-2026-56287Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File DisclosureApache Software Foundation Apache Fineract
- CVE-2026-58077Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2weeblr.com 4Analytics extension for Joomla
- CVE-2026-57833Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2weeblr.com 4Analytics extension for Joomla
- CVE-2026-57832Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9joomdonation.com EDocman extension for Joomla
- CVE-2026-57831Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2digital-peak.com DP Calendar extension for Joomla
- CVE-2026-15804MetaGuru｜HCM - SQL InjectionMetaGuru HCM
- CVE-2026-15583SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL headerGrafana MCP Server
- CVE-2026-14251Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dosRed Hat OpenShift GitOps
- CVE-2026-12512Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc ParameterQuotes llama
- CVE-2026-12281Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header SpoofingShibboleth
- CVE-2026-42936The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries.SBI SECURITIES Co. HYPER SBI
- CVE-2026-15029Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local aASUS System Control Interface · ASUS Business Manager
- CVE-2026-13585Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System ContASUS System Control Interface · ASUS Business Manager
- CVE-2026-8920Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service alloASUS Aura Wallpaper Service
- CVE-2026-8919Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by coASUS GameSDK
- CVE-2026-9770Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71TP-Link Systems Kasa EC71 · TP-Link Systems Kasa EC70
- CVE-2026-36590An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c compon
- CVE-2026-61371Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the sym
Medium, low and unrated 111
- CVE-2026-15907H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injectionH3C SecPath F1000-C8300
- CVE-2026-62314Anubis: Policy bypass via client controlled X-Original-URI headerTecharoHQ anubis · github.com/TecharoHQ/anubis
- CVE-2026-15921nvm path traversal via a malicious mirror's LTS codename writes outside the alias directorynvm-sh nvm
- CVE-2026-50183WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionWWBN AVideo · WWBN/AVideo
- CVE-2026-53447Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by IDwekan
- CVE-2026-53446Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLswekan
- CVE-2026-52892Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)wekan
- CVE-2026-50182AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery PaginationWWBN AVideo · WWBN/AVideo
- CVE-2026-62361listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsknadh listmonk
- CVE-2026-566789Router: Kiro region injection allows authenticated SSRF with Authorization header forwardingdecolua 9router · 9router
- CVE-2026-33684AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet PermissionsWWBN AVideo · wwbn/avideo
- CVE-2026-55608n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP modeczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-55399Resource exhaustion vulnerability in the Secure Access publisherAbsolute Security Secure Access
- CVE-2026-55410NocoBase backup restore schema name allows command injectionnocobase · @nocobase/plugin-backups
- CVE-2026-55398Memory management vulnerability in Secure Access clientsAbsolute Security Secure Access
- CVE-2026-52888NocoBase: Sensitive Data Exposure via SQL Blacklist Bypassnocobase · @nocobase/plugin-collection-sql
- CVE-2026-33444Memory management vulnerability in Secure Access serversAbsolute Secutity Secure Access
- CVE-2026-40958Input validation error in Secure Access clients prior to 14.55Absolute Security Secure Access
- CVE-2026-45737Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotationsargoproj argo-cd · github.com/argoproj/argo-cd +2
- CVE-2026-40957Frameable content vulnerability in the Secure Access server login pageAbsolute Security Secure Access
- CVE-2026-40956Memory disclosure in Secure Access ClientsAbsolute Security Secure Access
- CVE-2026-40955Integer underflow vulnerability in Secure Access clientsAbsolute Security Secure Access
- CVE-2026-40954Integer underflow in Secure Access clients prior to 14.55Absolute Security Secure Access
- CVE-2026-49867DataEase: Authenticated Stored XSS in DataEase Template Static Resourcesdataease
- CVE-2026-40953Heap overflow in Secure Access clientsAbsolute Security Secure Access
- CVE-2026-56743Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock matchcilium · github.com/cilium/cilium
- CVE-2026-56742Cilium: Namespaced HTTPRoutes can redirect traffic to other namespacescilium · github.com/cilium/cilium +1
- CVE-2026-62353TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetTokentaosdata TDengine
- CVE-2026-62348TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrationstaosdata TDengine
- CVE-2026-62355TDengine: Standard User permission unexpecttaosdata TDengine
- CVE-2026-26032Apache Ivy: PackagerResolver path traversal vulnerabilityApache Software Foundation Apache Ivy
- CVE-2026-15746Credential disclosure in Strands Agents Tools elasticsearch_memory toolAmazon strands-agents-tools
- CVE-2026-54443Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)lissy93 dashy
- CVE-2026-49988Repomix: attach_packed_output can bypass file-read secret scanning for supported local filesyamadashy repomix · repomix
- CVE-2026-62947OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-downloadopenwrt
- CVE-2026-56087Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability.Dell ThinOS
- CVE-2026-20298Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2026-14961CVE-2026-14961Pegatron Tdelo64.sys
- CVE-2026-61643FastGPT: workflow runtime can execute another user's private HTTP toolsetlabring FastGPT
- CVE-2026-1563Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.Pegasystems Pega Infinity
- CVE-2026-1562Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.Pegasystems Pega Infinity
- CVE-2025-32781Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdapolloconfig apollo · com.ctrip.framework.apollo:apollo
- CVE-2026-20146Cisco Identity Services Engine Path Traversal VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2026-49997SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deletedsurrealdb
- CVE-2026-47703AdGuard Home: DoQ-to-UDP State Reduction and Source-Port OracleAdguardTeam AdGuardHome · github.com/AdguardTeam/AdGuard… +1
- CVE-2026-62843File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)filebrowser · github.com/filebrowser/filebrowser +1
- CVE-2026-9007Reflected XSS in HCL NotesHCL Software HCL Notes
- CVE-2026-62683File Browser: Trailing-slash delete leaves a stale public share behindfilebrowser
- CVE-2026-45150Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofingzen-browser desktop
- CVE-2026-47160Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypassdani-garcia vaultwarden
- CVE-2026-47159Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposuredani-garcia vaultwarden
- CVE-2026-41580Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)Stirling-Tools Stirling-PDF
- CVE-2026-54562Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsescloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-33213Redash: Open redirect vulnerability in post-login redirect handlinggetredash redash
- CVE-2026-60065NGINX Plus ngx_stream_mqtt_filter_module vulnerabilityF5 NGINX Plus
- CVE-2026-56434NGINX ngx_http_ssi_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source
- CVE-2026-60062NGINX Agent VulnerabilityF5 NGINX Agent · F5 NGINX Instance Manager
- CVE-2026-52865NGINX Ingress Controller vulnerabilityF5 NGINX Ingress Controller
- CVE-2026-61646FastGPT: Shared axios SSRF guard validates only the initial URL before following redirectslabring FastGPT
- CVE-2026-62294Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"flameshot-org flameshot
- CVE-2026-59838A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 tFortinet FortiSIEM
- CVE-2026-46459Missing Authorization in ICU Scandinavia BoomerangICU Scandinavia Boomerang
- CVE-2026-58559DoS vulnerability in the vibration service.Huawei Harmony OS · Huawei EMUI
- CVE-2026-58556Permission control vulnerability in the Bluetooth module.Huawei Harmony OS · Huawei EMUI
- CVE-2026-15779Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validationRed Hat Enterprise Linux
- CVE-2026-58557Design defect vulnerability in Expedition mode.Huawei HarmonyOS
- CVE-2026-58554Permission control vulnerability in the Settings module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-58555Permission bypass vulnerability in the card module.Huawei HarmonyOS
- CVE-2026-58553Out-of-bounds read vulnerability in the image codec module.Huawei HarmonyOS
- CVE-2026-58552Out-of-bounds read vulnerability in the image codec module.Huawei HarmonyOS
- CVE-2026-58551Out-of-bounds read vulnerability in the image codec module.Huawei HarmonyOS
- CVE-2026-58550Out-of-bounds read vulnerability in the image codec module.Huawei HarmonyOS
- CVE-2026-58549Out-of-bounds read vulnerability in the image codec module.Huawei HarmonyOS
- CVE-2026-61872ImageMagick before 7.1.2-26 Memory Leak via TIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61871ImageMagick before 7.1.2-26 Memory Leak in ICON decoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61869ImageMagick before 7.1.2-26 Memory Leak in MIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61868ImageMagick before 7.1.2-26 Memory Leak in YUV DecoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61867ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61866ImageMagick before 7.1.2-26 Memory Leak in JNG encoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61865ImageMagick before 7.1.2-26 Memory Leak in Hough LinesImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61864ImageMagick before 7.1.2-26 Memory Leak in Log ColorspaceImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61863ImageMagick before 7.1.2-26 Memory Leak in TIFF EncoderImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61862ImageMagick before 7.1.2-26 Information Disclosure via identifyImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61860ImageMagick before 7.1.2-26 Use-After-Free via freetypeImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61859ImageMagick before 7.1.2-26 Policy Bypass via script operationImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61464ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11ImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-61457Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypassgetgrav grav
- CVE-2026-61453Grav before 2.0.1 XSS via Twig String Concatenationgetgrav grav · getgrav/grav
- CVE-2026-61452Grav before 2.0.4 Improper Session Invalidation JWT Access Tokensgetgrav grav
- CVE-2026-61427PraisonAI before 4.6.78 Authentication Bypass via HTTP-streamMervinPraison PraisonAI · praisonai
- CVE-2026-60087PraisonAI before 1.6.78 Tool Approval Cache BypassMervinPraison PraisonAI · praisonaiagents
- CVE-2026-59259n8n - Permission Bypass via Expression Parser Mismatch in External Secretsn8n
- CVE-2026-59254n8n - External Secrets Disclosure via Workflow Node Expressionsn8n
- CVE-2026-56764Hono - Timing Attack in basicAuth and bearerAuth MiddlewareHono
- CVE-2026-56375ImageMagick - Memory Leak in ASHLAR Coder Action FailureImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56353n8n - Authentication Bypass in Chat Trigger Noden8n
- CVE-2026-56352n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parametern8n
- CVE-2026-56349n8n - Guardrail Node Bypass via Crafted Inputn8n
- CVE-2026-59236Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injectionRoskus Prospero Flow CRM
- CVE-2026-49501Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vuDell PowerScale OneFS
- CVE-2026-11580Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDORKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-11579Kali Forms < 2.4.17 - Unauthenticated Media UploadKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-15030Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administratoASUS System Control Interface · ASUS Business Manager
- CVE-2026-11851Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router ASUS Router
- CVE-2026-13230Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71TP-Link Systems Kasa EC71 · TP-Link Systems Kasa EC70
- CVE-2026-26719Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET reques
- CVE-2026-38752A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) viaBusyBox
- CVE-2026-38753A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplyBusyBox
- CVE-2026-38754A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplyBusyBox
- CVE-2026-38755A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supplBusyBox
- CVE-2026-38974Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.