CVEs published August 3, 2026
309 CVEs were published on August 3, 2026: 56 critical, 117 high.
- Published
- 309
- Critical
- 56
- High
- 117
- Medium
- 127
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 165
Most affected products
- MediaTek chipset
- 34
- Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- 20
- Microsoft Edge
- 14
- siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- 8
- Adobe Campaign Classic
- 7
- GL.iNet GL-MT3000
- 7
- Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- 7
- Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- 6
- admidio
- 5
- GL-iNet GL-MT3000
- 5
Critical 56
- CVE-2026-18685GL.iNet GL-MT3000 modem.so glc set_upgrade command injectionGL.iNet GL-MT3000
- CVE-2026-18684GL.iNet GL-MT3000 modem.so glc remove_profile command injectionGL.iNet GL-MT3000
- CVE-2026-48323Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe Campaign Classic
- CVE-2026-48333Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic
- CVE-2026-48317Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)Adobe Campaign Classic
- CVE-2026-48331Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Campaign Classic
- CVE-2026-48330Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic
- CVE-2026-48326Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic
- CVE-2026-18667Sensor Proxy Version 1.4.2 Fixes One VulnerabilityTenable Sensor Proxy
- CVE-2026-46713Misskey: JSON-LD signature validation + compaction may lead to improper activity handlingmisskey-dev misskey
- CVE-2026-48063Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payloadWhiskeySockets Baileys · @whiskeysockets/baileys +1
- CVE-2026-69240Sequelize: SQL Injection (Oracle DB)sequelize
- CVE-2026-48031Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgerydhax go-base · github.com/dhax/go-base
- CVE-2026-67598Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.phpemlog
- CVE-2026-18616GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injectionGL-iNet GL-MT3000
- CVE-2026-18615GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injectionGL-iNet GL-MT3000
- CVE-2026-18614GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injectionGL-iNet GL-MT3000
- CVE-2026-18613GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injectionGL-iNet GL-MT3000
- CVE-2026-18612GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injectionGL-iNet GL-MT3000
- CVE-2026-39932OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injectionopenemr
- CVE-2026-41452Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setupkrayin laravel-crm
- CVE-2026-18602GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injectionGL.iNet GL-MT3000
- CVE-2026-18248@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header@fastify/aws-lambda
- CVE-2026-64827Telenia TVox 26.5.3 Authentication Bypass via set_env.phpTelenia Software TVox
- CVE-2026-69085SiYuan before v3.7.3 SQL Injection via searchDocssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-69084SiYuan before v3.7.3 SQL Injection via searchEmbedBlocksiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-69083SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContentsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-68587SiYuan before v3.7.3 Information Disclosure via getHeading*Transactionsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-68586SiYuan before v3.7.3 Content Disclosure via getBacklinkDocsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-68584SiYuan before v3.7.3 Authentication Bypass via Content Endpointssiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-18601GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injectionGL.iNet GL-MT3000
- CVE-2026-9487XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate IDTIMLEGGE XML::Sig
- CVE-2026-9390XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupTIMLEGGE XML::Sig
- CVE-2026-18108Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signatureTIMLEGGE Net::SAML2
- CVE-2026-18574Authentication Bypass in Check Point Security Management Servercheckpoint Security Management Server · checkpoint Multi-Do…
- CVE-2026-2346IDOR in Menulux Software's Mobile AppMenulux Software Mobile App
- CVE-2026-33591Authentication bypass on WaptServerTranquil IT Systems WAPT Server
- CVE-2026-18589Wavlink WL-NU516U1 nas.cgi change_password stack-based overflowWavlink WL-NU516U1
- CVE-2026-16300Chama < 1.0.13 - Unauthenticated Arbitrary User Password ResetChamaWP
- CVE-2026-16250Personal QR Message <= 1.0 - Unauthenticated Arbitrary File UploadPersonal QR Message
- CVE-2026-16060Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File UploadInsert or Embed Articulate Content into WordPress
- CVE-2026-15930Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username CollisionSimple Membership
- CVE-2026-14557SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification BypassSoftMarket — Digital Marketplace
- CVE-2026-12965Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_trackingSuper Store Finder WordPress
- CVE-2026-12872Webinfos <= 1.2 - Unauthenticated Arbitrary File UploadWebinfos
- CVE-2026-18588Wavlink WL-NU516U1 nas.cgi fgets stack-based overflowWavlink WL-NU516U1
- CVE-2026-16534Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV ImportImport and export users and customers
- CVE-2026-16532Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormLink Library
- CVE-2026-58062Stapled OCSP response accepted without binding to the checked certificateLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59638JSSE hostname verifier CN-fallback enabled by default despite documented opt-inLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59650MTI/A0 DH agreement exponentiates unvalidated peer valueLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-8763Name Constraints bypass via trailing dot in rfc822Name and URILegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +5
- CVE-2026-38447osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing.
- CVE-2026-51190The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true
- CVE-2026-51775SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller
- CVE-2026-52102An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary comma
High 117
- CVE-2026-62870Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2026-66322Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-65802Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-66315Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-66310Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge for Android
- CVE-2026-66321Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-66318Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-48399Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)Adobe Campaign Classic
- CVE-2026-47746Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacksmisskey-dev misskey
- CVE-2026-69249python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingpyca cryptography · cryptography
- CVE-2026-10849Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response bodyzephyrproject zephyr
- CVE-2026-69247cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingpyca cryptography · cryptography
- CVE-2026-69246Guzzle: Noncanonical host can bypass host-based checksguzzle · guzzlehttp/guzzle
- CVE-2026-48113Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injectionjpillora chisel · github.com/jpillora/chisel
- CVE-2026-41447FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration PathZucchetti S.p.a. FirmaCheck
- CVE-2026-69244AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)aio-libs aiohttp · aiohttp
- CVE-2026-18737Shlink Blind SQL Injection via tags/stats orderBy Parametershlinkio Shlink
- CVE-2026-18733Prompt injection bypasses shell tool consent gate in Strands Agents ToolsAWS strands-agents-tools
- CVE-2026-66065Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)Q00 ouroboros · ouroboros-ai
- CVE-2026-47211Ouroboros: Remote Code Execution via Untrusted Project-Directory .envQ00 ouroboros · ouroboros-ai
- CVE-2026-68981Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP RequestsApache Software Foundation Apache NiFi
- CVE-2026-62354Apache NiFi: Incorrect Authorization for Parameter Context Validation RequestsApache Software Foundation Apache NiFi
- CVE-2026-69192ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassbeaugunderson ip-address · ip-address
- CVE-2026-69185Socket.IO: Zero-attachment Memory Exhaustionsocketio socket.io · socket.io-parser
- CVE-2026-67599ClearOS 7.9 OS Command Injection via Log Viewer filter parameterClearFoundation ClearOS
- CVE-2026-59913Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulneraDell Display and Peripheral Manager
- CVE-2026-59912Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability.Dell Display and Peripheral Manager
- CVE-2025-15628Hardcoded Certificates in TP-Link Omada Device CommunicationsTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +3
- CVE-2025-9291Improper Certificate Validation in TP-Link Omada Cloud CommunicationsTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +1
- CVE-2026-61524WebsiteBaker CMS < 2.13.10 File Upload RCE via Module InstallationWebsiteBaker Org e.V. WebsiteBaker CMS
- CVE-2026-61523WebsiteBaker CMS < 2.13.10 Code Injection via Droplets EditorWebsiteBaker Org e.V. WebsiteBaker CMS
- CVE-2026-18718Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project StateNational Security Agency Ghidra
- CVE-2026-18607Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflowWavlink WN572 · Wavlink WN570H +10
- CVE-2026-69152brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationjuliangruber brace-expansion · brace-expansion
- CVE-2026-69151Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesangular · @angular compiler +3
- CVE-2026-18606Razer RzUpdateService Named Pipe RzUpdateService.exe privileges managementRazer RzUpdateService
- CVE-2026-69149Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)angular · @angular platform-server +1
- CVE-2026-67611OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configurationopenemr
- CVE-2026-67610OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Accessopenemr
- CVE-2026-18605CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search pathCheckMAL AppCheck Pro
- CVE-2026-68945Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoningangular · @angular common +1
- CVE-2026-39931OpenEMR Authenticated SQL Injection via backup.php Import Featureopenemr
- CVE-2026-41453Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameterkrayin laravel-crm
- CVE-2026-61372Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictionsApache Software Foundation Apache Jena Fuseki
- CVE-2026-18568XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic checkTIMLEGGE XML::Sig
- CVE-2026-67609Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers ConfigurationTelenia Software TVox
- CVE-2026-18642Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lockTUBITAK BILGEM Software Technologies Research Institute eta…
- CVE-2026-67608Telenia TVox 26.5.3 OS Command Injection via action_audio.phpTelenia Software TVox
- CVE-2026-18092Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtreeTIMLEGGE Net::SAML2
- CVE-2026-69097GitPython before 3.1.53 Config Injection via Submodule Namesgitpython-developers GitPython · gitpython
- CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Executionopenwrt luci
- CVE-2026-69095OpenWrt luci-app-bmx7 Path Traversal via bmx7-infoopenwrt luci
- CVE-2026-69093Admidio before 5.0.11 CSRF via category-report preferencesadmidio
- CVE-2026-69091Admidio before 5.0.11 Authentication Bypass via forum.phpadmidio
- CVE-2026-69089Grav CMS before 2.0.11 Path Traversal via watermarkgetgrav grav · getgrav/grav
- CVE-2026-69088Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprintgetgrav grav · getgrav/grav
- CVE-2026-69087Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twiggetgrav grav-plugin-form
- CVE-2026-69086SiYuan before v3.7.3 Path Traversal via unvalidated avIDsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-18600GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injectionGL.iNet GL-MT3000
- CVE-2026-18089Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configuredTIMLEGGE Net::SAML2
- CVE-2026-18599GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injectionGL.iNet GL-MT3000
- CVE-2026-18598GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injectionGL.iNet GL-MT3000
- CVE-2026-0392eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-updateLatvijas Valsts radio un televīzijas centrs (LVRTC) eParaks…
- CVE-2026-69082Cross-Site Request Forgery in the Administrative User Deletion Endpointmisp cti-transmute
- CVE-2026-69079Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmutemisp cti-transmute
- CVE-2026-69078Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Renderingmisp cti-transmute
- CVE-2026-21555In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. UDX710
- CVE-2026-21554In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. UDX710
- CVE-2026-21553In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2026-21552In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2026-21551In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2026-21550In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2026-21549In modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2026-21548In nr modem, there is a possible improper input validation.Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300
- CVE-2026-9593iDTM FDI Unauthorized Debug Interface EnablementEndress+Hauser FDI Package library
- CVE-2026-4793An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files Synology Assistant
- CVE-2026-16572LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' CookieLogMyTrip
- CVE-2026-16539SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplicationsm page duplicator
- CVE-2025-15672Chama < 1.0.13 - Unauthenticated PHP Object InjectionChamaWP
- CVE-2026-18587Wavlink WL-NU516U1 Config Import os command injectionWavlink WL-NU516U1
- CVE-2026-13506Lazy ASN.1 sequence forcing resets nesting-depth guardLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +5
- CVE-2026-12860RSA PKCS#1 verification skips last two hash bytes in NULL-omitted pathLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-12852MLS wire decoder allocates attacker-declared opaque length before bounds checkLegion of the Bouncy Castle BC-JAVA
- CVE-2026-12817OpenPGP AEAD decryption skips final tag on chunk-aligned dataLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-12816IESEngine stream-mode MAC forgery via length-dependent KDF splitLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-12803KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-12802CMS AuthEnvelopedData fails to enforce tag-length on decryptionLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-14682Possible OOM from unbounded up-front allocation on a definite-length readLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-58059Quadratic-time escaping when stringifying X.500 distinguished namesLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-58060HSS public-key level count unbounded, enabling huge allocation on verifyLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-58061CCM-family modes write plaintext to caller buffer before tag checkLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-20495In Bluetooth driver, there is a possible permission bypass due to a missing permission check.MediaTek chipset
- CVE-2026-20483In Telephony, there is a possible escalation of privilege due to a missing permission check.MediaTek chipset
- CVE-2026-20479In Modem, there is a possible out of bounds read due to a missing bounds check.MediaTek chipset
- CVE-2026-20465In wlan AP driver, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-59639CMS verifySignatures returns true for SignedData with zero signersLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59640OpenPGP CFB quick-check oracle active on symmetric/session-key pathsLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59641S/MIME validator trusts signer-asserted signingTime for path validationLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59642CMS AuthenticatedData content not bound to MAC when authAttrs presentLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59643OpenPGP inline-signature policy failures silently ignoredLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-59644MLS hash-ratchet honours arbitrary 32-bit generation counter from senderLegion of the Bouncy Castle BC-JAVA
- CVE-2026-59645OER parser recurses without depth limit on self-referential IEEE 1609.2 schemaLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59646DTLS handshake reassembler allocates buffer from unchecked 24-bit lengthLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59649OpenPGP user-attribute subpacket length bounded only by JVM max memoryLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59651BKS keystore accepts legacy version with 16-bit integrity MAC keyLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-12185BKS/UBER keystore allocates from untrusted lengths before integrity checkLegion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…
- CVE-2026-65875BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability.baserCMS Users Community BaserCMS
- CVE-2026-52521A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in th
- CVE-2026-67969An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a craft
- CVE-2026-67970Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path
- CVE-2026-67972An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly
- CVE-2026-67973An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.
- CVE-2026-67974A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attacker
- CVE-2026-67975Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending T
- CVE-2026-67976The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to ca
- CVE-2026-67977An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service
- CVE-2026-67978An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN fram
Medium, low and unrated 136
- CVE-2026-66326Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-66325Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-66317Microsoft Edge (Chromium-based) Tampering VulnerabilityMicrosoft Edge
- CVE-2026-66311Microsoft Edge (Chromium-based) Tampering VulnerabilityMicrosoft Edge
- CVE-2026-65804Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-66316Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-66314Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-66313Microsoft Edge (Chromium-based) Tampering VulnerabilityMicrosoft Edge
- CVE-2026-66312Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-46714Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilationmisskey-dev misskey
- CVE-2026-67617Microweber CMS 2.0.20 Stored XSS via tag_names Parametermicroweber
- CVE-2026-67616Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpointowen2345 camaleon-cms
- CVE-2026-18682OpenAkita File Upload API upload cross site scriptingOpenAkita
- CVE-2026-46712Misskey: Lack of proper permission checks in Direct Messaging featuremisskey-dev misskey
- CVE-2026-48115Misskey: Improper Authorization in the Announcements APImisskey-dev misskey
- CVE-2026-69248python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreespyca cryptography · cryptography
- CVE-2026-69245Guzzle: Noncanonical cookie domain keeps subdomain scopeguzzle · guzzlehttp/guzzle
- CVE-2026-18648Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversalBlix Email Blue Mail Calendar App
- CVE-2026-18738Shlink CSV Formula Injection via Visit Export CLIshlinkio Shlink
- CVE-2026-48061Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerlitestar-org litestar · litestar
- CVE-2026-69243AIOHTTP: HTTP request smuggling via WebSocket upgradeaio-libs aiohttp · aiohttp
- CVE-2026-18647jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgeryjina-ai reader
- CVE-2026-49132OPNsense < 26.1.9 Stored XSS via Certificate Description FieldDeciso B.V. OPNsense
- CVE-2026-18646danpros HTMLy Author Name htmly.php path traversaldanpros HTMLy
- CVE-2026-49131OPNsense < 26.1.9 Stored XSS via Firewall Rule Description FieldDeciso B.V. OPNsense
- CVE-2026-18736Shlink Server-Side Request Forgery via Short URL Title Auto-Resolutionshlinkio Shlink
- CVE-2026-18645danpros HTMLy Admin Content Endpoint admin.php add_content path traversaldanpros HTMLy
- CVE-2026-18644danpros HTMLy Delete Username Endpoint htmly.php unlink path traversaldanpros HTMLy
- CVE-2026-69198ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksbeaugunderson ip-address · ip-address
- CVE-2026-68980Apache NiFi: Authorization Bypass for Parameter Context Asset DeletionApache Software Foundation Apache NiFi
- CVE-2026-68979Apache NiFi: Missing Authorization for Components Referenced by Parameter Context UpdatesApache Software Foundation Apache NiFi
- CVE-2026-58139DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedureduckdb-aws
- CVE-2026-18641Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injectionSangfor Operation and Maintenance Security Management System
- CVE-2026-18654Disabled SSH host key verification in Amazon AWS CLI EMR helper commandsaws-cli · awscli
- CVE-2026-18632langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template enginelanggenius dify
- CVE-2026-18631jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorizationjeequan jeepay
- CVE-2026-66296Reflected XSS in oaskit's default HTML error handlerlud oaskit
- CVE-2026-18655Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt InjectionAWS amazon-mq-mcp-server
- CVE-2025-15631Weak Credential Storage in TP-Link Omada DevicesTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2
- CVE-2025-15630Device Provisioning Race Condition in TP-Link Omada Adoption WorkflowTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2
- CVE-2025-15629Weak Session Key Generation in TP-Link Omada Adoption ProtocolTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2
- CVE-2025-15627Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol AuthenticationTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2
- CVE-2025-15544Weak Credential Protection During TP-Link Omada Device AdoptionTP-Link Systems Omada Gateways · TP-Link Systems Omada S… +4
- CVE-2026-40717Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability.Dell Monitor driver
- CVE-2026-18610NewType WebEIP EIP_Com_FileList.aspx improper authenticationNewType WebEIP
- CVE-2026-69153PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetpostcss
- CVE-2026-67612OpenEMR 8.2.0 Stored XSS via import_template.php Template Managementopenemr
- CVE-2026-18243HP DesignJet T3500 - Potential Cross-Site Scripting (XSS)HP DesignJet T3500
- CVE-2026-18604textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application componentstextPlus Text Message and Call App
- CVE-2026-68930Russh: Channel-scoped server callbacks can be reached without an open channelEugeny russh · russh
- CVE-2026-18477Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escapeRed Hat Enterprise Linux · Red Hat Discovery +3
- CVE-2026-18651389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked accountRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-18508Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwriteRed Hat Enterprise Linux · Red Hat Discovery +3
- CVE-2026-15430CVE-2026-15430Wellbia XIGNCODE3
- CVE-2026-69094Admidio before 5.0.11 IDOR via save_temporary mylist_function.phpadmidio
- CVE-2026-69092Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpointadmidio
- CVE-2026-69090Admidio before 5.0.11 Cross-Organization Role Modificationadmidio
- CVE-2026-68585SiYuan before v3.7.3 Metadata Disclosure via getBlockInfosiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-56609HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).HCL Software HCL iControl
- CVE-2026-56608HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).HCL Software HCL iControl
- CVE-2026-68742Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddrRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-69075Stored Cross-Site Scripting via Vue Template Injection in FlowIntelflowintel
- CVE-2026-62416Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication Sharp Network Scanner Tool Lite · Network Scanner Tool
- CVE-2026-63563Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in Sharp MFPs · Toshiba Tec MFPs
- CVE-2026-63545Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared.Sharp MFPs · Toshiba Tec MFPs
- CVE-2026-60011Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the Sharp MFPs · Toshiba Tec MFPs
- CVE-2026-18593vxcontrol PentAGI Tool Management Protocol pentester.tmpl sandboxvxcontrol PentAGI
- CVE-2026-18592osCommerce Email Template Configuration EmailController.php EmailController sql injectionosCommerce
- CVE-2026-18591Meesho Online Shopping App com.meesho.supply cleartext storageMeesho Online Shopping App
- CVE-2026-28147WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerabilityUnlimited Elements For Elementor
- CVE-2026-12259Improper Input Validation in nltk/nltknltk/nltk · nltk
- CVE-2026-8794PaperCut NG/MF: User enumeration via timing attackPaperCut NG/MF
- CVE-2026-8793PaperCut NG/MF: Insufficient brute-force protectionPaperCut NG/MF
- CVE-2026-18590Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injectionWavlink WL-NU516U1
- CVE-2026-16565Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST APIDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-16564Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST EndpointDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-16563Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST EndpointAcademy LMS
- CVE-2026-16297Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings ImportClearfy Cache
- CVE-2026-16289ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_groupProfileGrid
- CVE-2026-15931Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber NameSimple Membership
- CVE-2026-15383Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent HeaderBlog Floating Button
- CVE-2026-15260Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDORGEO my WP
- CVE-2026-15231TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDORTag, Category, and Taxonomy Manager
- CVE-2026-13340SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization BypassSVG Support
- CVE-2025-15673Import and export users and customers < 2.4.3 - Admin+ Arbitrary File ReadImport and export users and customers
- CVE-2026-16276Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_searchClassified Listing
- CVE-2026-16274Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_postsClassified Listing
- CVE-2026-16057Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_libraryContest Gallery
- CVE-2026-15254Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin ShortcodeSimply Schedule Appointments
- CVE-2026-18585GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflowGL.iNet MT3000 · GL.iNet MT6000 +9
- CVE-2026-18584GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorizationGL.iNet E5800 · GL.iNet E750 +4
- CVE-2026-18583mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-boundsmz-automation libiec61850
- CVE-2026-6695Gimp: gimp: remote code execution via crafted paa fileRed Hat Enterprise Linux
- CVE-2026-6694Gimp: gimp file-png plugin: denial of service via oversized apng trns chunkRed Hat Enterprise Linux
- CVE-2026-13586PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-58063BCFKS keystore load honours unbounded KDF cost from untrusted fileLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-20498In geniezone, there is a possible escalation of privilege due to a missing permission check.MediaTek chipset
- CVE-2026-20496In geniezone, there is a possible out of bounds read due to a missing bounds check.MediaTek chipset
- CVE-2026-20494In wifi, there is a possible out of bounds read due to a missing bounds check.MediaTek chipset
- CVE-2026-20493In wifi, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20492In Audio HAL, there is a possible system becoming unresponsive due to a race condition.MediaTek chipset
- CVE-2026-20491In med, there is a possible out of bounds write due to an incorrect bounds check.MediaTek chipset
- CVE-2026-20490In ccci, there is a possible out of bounds read due to a missing bounds check.MediaTek chipset
- CVE-2026-20489In display, there is a possible information disclosure due to an integer overflow.MediaTek chipset
- CVE-2026-20488In display, there is a possible information disclosure due to a missing bounds check.MediaTek chipset
- CVE-2026-20486In imgsensor, there is a possible application crash due to incorrect error handling.MediaTek chipset
- CVE-2026-20485In HFRP, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20484In TFA, there is a possible information disclosure due to a missing permission check.MediaTek chipset
- CVE-2026-20470In Telephony, there is a possible information disclosure due to a missing permission check.MediaTek chipset
- CVE-2026-20482In wlan STA FW, there is a possible system becoming unresponsive due to logging.MediaTek chipset
- CVE-2026-20481In geniezone, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20497In geniezone, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20480In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow.MediaTek chipset
- CVE-2026-20478In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow.MediaTek chipset
- CVE-2026-20477In display, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20476In ccci, there is a possible out of bounds read due to a missing bounds check.MediaTek chipset
- CVE-2026-20475In display, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20474In display, there is a possible escalation of privilege due to a race condition.MediaTek chipset
- CVE-2026-20473In display, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2026-20472In TFA, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20471In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20469In trusted_mem, there is a possible escalation of privilege due to improper input validation.MediaTek chipset
- CVE-2026-20468In apusys, there is a possible escalation of privilege due to a confused deputy.MediaTek chipset
- CVE-2026-20467In apusys, there is a possible escalation of privilege due to a missing bounds check.MediaTek chipset
- CVE-2026-20466In sec boot, there is a possible escalation of privilege due to a heap buffer overflow.MediaTek chipset
- CVE-2026-20464In hevc decoder, there is a possible out of bounds write due to an integer overflow.MediaTek chipset
- CVE-2026-18582mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heapmz-automation libiec61850
- CVE-2026-59647CRMF/CMP password-MAC honours unbounded iteration countLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59648OpenPGP Argon2 S2K honours attacker-chosen memory and passesLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-59652LDAP filter injection in legacy jdk1.4 LDAPStoreHelperLegion of the Bouncy Castle BC-JAVA
- CVE-2026-15055PKCS#8 / PBES2 decryptors honour unbounded KDF cost from inputLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-18581ggml-org llama.cpp Jinja Minja Template parser.cpp assertionggml-org llama.cpp
- CVE-2026-38444osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name.
- CVE-2026-38446A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field.
- CVE-2026-52520Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php).
- CVE-2026-67673A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0.