CVEs published August 4, 2026
272 CVEs were published on August 4, 2026: 46 critical, 113 high.
- Published
- 272
- Critical
- 46
- High
- 113
- Medium
- 99
- Low
- 13
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 148
Most affected products
- open-webui
- 17
- NVIDIA Dynamo
- 15
- FlowiseAI Flowise · flowise
- 12
- Qualcomm Snapdragon
- 11
- Bilin Software and Informatics Consultancy HUMANIST Digital…
- 9
- FlowiseAI Flowise · flowise +1
- 8
- opensips
- 8
- TryGhost Ghost · ghost
- 7
- Eclipse Foundation Eclipse Milo
- 6
- nodejs node
- 6
Critical 46
- CVE-2026-45537OpenSIPS: Global Buffer Overflow in construct_uriopensips
- CVE-2026-45100OpenSIPS: Buffer Overflow in Base64 Encode Transformationopensips
- CVE-2026-66902Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system callCJCOLLIER Google::Auth
- CVE-2026-45538OpenSIPS: Stack Buffer Overflow in sip_to_json() Header Name Copyopensips
- CVE-2026-70554MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser CookieMaxSite CMS
- CVE-2026-70553MaxSite CMS Unauthenticated RCE via Install EndpointMaxSite CMS
- CVE-2026-70478Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected serviceFlowiseAI Flowise · flowise
- CVE-2026-70477Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityFlowiseAI Flowise · flowise +1
- CVE-2026-70552MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.phpMaxSite CMS
- CVE-2026-49435Keysight IxChariot-related products stack-based buffer overflowKeysight Hawkeye · Keysight IxChariot +3
- CVE-2017-20242Keysight IxChariot Endpoint stack-based buffer overflowKeysight IxChariot
- CVE-2017-20241Keysight IxChariot Endpoint heap-based buffer overflowKeysight IxChariot
- CVE-2026-69703Atlas-Livre Unauthenticated Access via Admin Controllers Missing ExitmaximeAmini Atals-Livre
- CVE-2026-0163In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free.Google Android
- CVE-2026-70470Flowise: Pyodide validator Unicode homoglyph bypass leads to RCEFlowiseAI Flowise · flowise +1
- CVE-2026-24254NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write.NVIDIA Dynamo
- CVE-2026-69264Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationFlowiseAI Flowise · flowise +1
- CVE-2026-63456Authentication bypass via spoofed HTTP headers Orchestrator REST APIHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2026-63455Authentication bypass via spoofed HTTP headers Orchestrator REST APIHewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…
- CVE-2026-69259Flowise RCE via SQLite Record Manager NodeFlowiseAI Flowise · flowise +1
- CVE-2026-58072A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execuVeeam Service Provider Console
- CVE-2026-58073A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent'sVeeam Service Provider Console
- CVE-2026-64633A vulnerability allowing remote unauthenticated code execution on the agent host.Veeam ONE
- CVE-2026-69256Flowise: Remote Code Execution Vulnerability in CSVAgentFlowiseAI Flowise · flowise-components +1
- CVE-2026-69255Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell VerifiedFlowiseAI Flowise · flowise +1
- CVE-2026-69110OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/musicMicrock opencode-studio
- CVE-2026-69254Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions OverrideFlowiseAI Flowise · flowise +1
- CVE-2026-69098kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure DeserializationCinnamon kotaemon
- CVE-2026-69253Flowise Sandbox Escape to RCEFlowiseAI Flowise · flowise +1
- CVE-2026-25289Stack-based Buffer Overflow in WLAN FirmwareQualcomm Snapdragon
- CVE-2026-18801Stored Clickhouse SQL Injection Through Customer Usage Attributionopenmeter
- CVE-2026-69251Flowise RCE via TypeORM DataSourceFlowiseAI Flowise · FlowiseAI flowise-components +2
- CVE-2026-61514Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456Puwell Technology IP Camera
- CVE-2026-61515Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShellPuwell Technology IP Camera
- CVE-2026-60007In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding aEclipse Foundation Eclipse Milo
- CVE-2026-14804Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-14175Unrestricted File Upload in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-15721Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-18754Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)GeoVision GV-AS1620
- CVE-2026-18753Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)GeoVision GV-AS1620
- CVE-2026-64564sctp: don't free the ASCONF's own transport in DEL-IP processingLinux
- CVE-2026-15958Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAXEasy Integration for Dropbox
- CVE-2026-16618ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionImprove SEO
- CVE-2026-18686GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injectionGL.iNet GL-MT3000
- CVE-2025-29296H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R
- CVE-2026-67979Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute a
High 113
- CVE-2026-46334OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloningopensips
- CVE-2026-45809OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URIopensips
- CVE-2026-45103OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflowopensips
- CVE-2026-45084OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type stateopensips
- CVE-2026-70619Odysseus Missing Admin Authorization via Embedding Endpoint Routesodysseus-dev odysseus
- CVE-2026-18814H3C NX15 esps reload.reload_config command injectionH3C NX15
- CVE-2026-18813H3C NX15 esps delete command injectionH3C NX15
- CVE-2026-70494Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolderopen-webui
- CVE-2026-13227ERPNext v16.25.0 - Improper authorization in Prospect opportunities APIFrappe ERPNext
- CVE-2026-70492Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesopen-webui
- CVE-2026-66901Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSONCJCOLLIER Google::Auth
- CVE-2026-18812H3C NX15 esps esps.ipv6.wan command injectionH3C NX15
- CVE-2026-18811H3C NX15 esps add command injectionH3C NX15
- CVE-2026-65986CVAT has stored XSS via annotation guide assetscvat-ai cvat
- CVE-2026-70486Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originopen-webui
- CVE-2026-47682CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writescvat-ai cvat
- CVE-2026-70485Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLsopen-webui
- CVE-2026-70482Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any clientopen-webui
- CVE-2026-16793Remote Command Injection via OS Profile Password in Lenovo XClarity OrchestratorLenovo XClarity Orchestrator
- CVE-2026-70479Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loaderopen-webui
- CVE-2026-18657Executable Resolution from Untrusted Project Directory in Kiro CLI on WindowsAmazon Kiro CLI
- CVE-2026-18656Executable Resolution from Untrusted Project Directory in Kiro IDE on WindowsAmazon Kiro IDE
- CVE-2026-70476Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationFlowiseAI Flowise · flowise
- CVE-2026-70475Flowise: Missing Authorization on Execution Update EndpointFlowiseAI Flowise · flowise
- CVE-2026-69704Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()maximeAmini Atals-Livre
- CVE-2026-47781pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsingpdm-project pdm · pdm
- CVE-2026-13229Zammad 7.0.1 - Improper authorization in ticket article attachment cloningZammad
- CVE-2026-70474Flowise: Cross-Workspace OAuth2 Credential Metadata LeakFlowiseAI Flowise · flowise
- CVE-2026-47764pdm: Path traversal in wheel installation via overridden write_to_fspdm-project pdm · pdm
- CVE-2026-70473Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyFlowiseAI Flowise · flowise
- CVE-2026-70472Flowise: Cross-workspace credential IDOR in openai-assistants-vector-storeFlowiseAI Flowise · flowise
- CVE-2026-69702SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOMaizuda SnailJob
- CVE-2026-70471Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureFlowiseAI Flowise · flowise
- CVE-2026-18830Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness APIAWS Amazon Bedrock AgentCore harness
- CVE-2026-47623NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data.NVIDIA Dynamo
- CVE-2026-47618NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forgNVIDIA Dynamo
- CVE-2026-47617NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery viaNVIDIA Dynamo
- CVE-2026-47616NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery.NVIDIA Dynamo
- CVE-2026-47615NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a mulNVIDIA Dynamo
- CVE-2026-47614NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery.NVIDIA Dynamo
- CVE-2026-47613NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by NVIDIA Dynamo
- CVE-2026-47612NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathnamNVIDIA Dynamo
- CVE-2026-24255NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitNVIDIA Dynamo
- CVE-2026-24253NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write.NVIDIA Dynamo
- CVE-2026-18787GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injectionGL.iNet AX1800
- CVE-2026-15314Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110TP-Link Systems P110
- CVE-2026-69263Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)FlowiseAI Flowise · flowise +1
- CVE-2026-69262Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow typeFlowiseAI Flowise · flowise
- CVE-2026-56848A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executnodejs node
- CVE-2026-69258Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APIFlowiseAI Flowise · flowise
- CVE-2026-58074A vulnerability allowing a high-privileged user to execute arbitrary code on the server.Veeam ONE
- CVE-2026-64631A vulnerability allowing a low-privileged user to inject SQL and extract database contents.Veeam ONE
- CVE-2026-58075A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privilVeeam ONE
- CVE-2026-64634A vulnerability allowing local privilege escalation to the Reporter service context.Veeam ONE
- CVE-2026-58071A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal AdministVeeam Service Provider Console
- CVE-2026-58067A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service.Veeam Service Provider Console
- CVE-2026-69257Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 AddressesFlowiseAI Flowise · flowise
- CVE-2026-15307Server-side file-write and request forgery via spatial lookupsdjangoproject Django · django
- CVE-2026-69100LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Executiondromara lamp-cloud
- CVE-2026-25292Improper Validation of Syntactic Correctness of Input in Automotive Linux OSQualcomm Snapdragon
- CVE-2026-25288Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2026-24084Insecure Security Identifier Mechanism in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2026-24083Untrusted Pointer Dereference in Automotive SecurityQualcomm Snapdragon
- CVE-2026-24080Buffer Copy Without Checking Size of Input in BiometricsQualcomm Snapdragon
- CVE-2026-24079Missing Authentication for Critical Function in Data ModemQualcomm Snapdragon
- CVE-2026-21366Integer Overflow or Wraparound in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2026-69252Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organizationFlowiseAI Flowise · flowise
- CVE-2026-68494jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)FasterXML jackson-core · com.fasterxml.jackson.core:jack… +1
- CVE-2026-67618marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadatamarimo-team marimo
- CVE-2026-11368Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transferzephyrproject zephyr
- CVE-2026-69250Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret ExfiltrationFlowiseAI Flowise · flowise
- CVE-2026-67200Perspective 5.0.0 Path Traversal via cwd_static_file_handlerperspective-dev perspective
- CVE-2026-67199Perspective 5.0.0 DoS via Loop Expression Evaluationperspective-dev perspective
- CVE-2026-67198Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcherperspective-dev perspective
- CVE-2026-67195Perspective 5.0.0 RCE via eval() Expression Injectionperspective-dev perspective
- CVE-2026-18650Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYSHAVELSAN Liman MYS
- CVE-2026-17070Vault Credential Confusion via Authorization Bypass in HAVELSAN's Liman MYSHAVELSAN Liman MYS
- CVE-2026-70373Koha - SQL Injection in reports/issues_stats.plKoha Community Koha
- CVE-2026-70372Koha - SQL Injection in reports/bor_issues_top.plKoha Community Koha
- CVE-2026-70371Koha - SQL Injection in reports/issues_avg_stats.plKoha Community Koha
- CVE-2026-70370Koha - SQL Injection in reports/catalogue_stats.plKoha Community Koha
- CVE-2026-70369Koha - SQL Injection in reports/acquisitions_stats.plKoha Community Koha
- CVE-2026-10710FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDKAutodesk FBX SDK
- CVE-2026-10709FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDKAutodesk FBX SDK
- CVE-2026-18806Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writerTÜBİTAK BİLGEM Software Technologies Research Institute par…
- CVE-2026-58080In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`.Eclipse Foundation Eclipse Milo
- CVE-2026-63252In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel Eclipse Foundation Eclipse Milo
- CVE-2026-62927In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculatiEclipse Foundation Eclipse Milo
- CVE-2026-10050Digest authentication lossy encodingEclipse Foundation Eclipse Jetty - EE8 · Eclipse Foundat… +4
- CVE-2026-14838Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-18759An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync.ASUSTOR ABP · ASUSTOR AES
- CVE-2026-18755GV-ASManager DLL hijacking vulnerabilityGeoVision GV-ASManager
- CVE-2026-67243freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability.refirio freo2
- CVE-2026-64563rhashtable: clear stale iter->p on table restartLinux
- CVE-2026-64562KVM: nVMX: Hide shadow VMCS right after VMCLEARLinux
- CVE-2026-64561KVM: x86: Check for invalid/obsolete root *after* making MMU pages availableLinux
- CVE-2026-16623Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)Create Block Theme
- CVE-2026-16881A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.LY LINE client for Android
- CVE-2026-42169Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)Red Hat Enterprise Linux
- CVE-2026-14818A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 throuZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2026-6837A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4Zyxel WAX650S firmware
- CVE-2026-56846A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.nodejs node
- CVE-2026-56845An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem.Rocket.Chat
- CVE-2026-51400An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within fi
- CVE-2026-51401An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within fi
- CVE-2026-67855open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled.
- CVE-2026-67856An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitor
- CVE-2026-67857open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua_client_connect.c.
- CVE-2026-67858Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled thro
- CVE-2026-67859Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling.
- CVE-2026-67860open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the mem
- CVE-2026-67861An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_getRemoteDataTypes componen
- CVE-2026-67862open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highlevel.c.
Medium, low and unrated 113
- CVE-2026-18853ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversalZomboDroid Meme Generator App
- CVE-2026-45705OpenSIPS: OOB Read in Multipart Body Boundary Parsingopensips
- CVE-2026-18852epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual conditionepsilla-cloud vectordb
- CVE-2026-18103Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapiRed Hat Enterprise Linux
- CVE-2026-18819RackTables cross-site request forgeryRackTables
- CVE-2026-18818Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorizationEhco1996 django-sspanel
- CVE-2026-18817Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorizationBaserow
- CVE-2026-70594Ghost: Session Fixation in Ghost AdminTryGhost Ghost · ghost
- CVE-2026-70593Ghost: Theme Upload Path TraversalTryGhost Ghost · ghost
- CVE-2026-18816Baserow 2FA Verify Endpoint views.py verify improper authenticationBaserow
- CVE-2026-70592Ghost: Database Backup Path TraversalTryGhost Ghost · ghost
- CVE-2026-70591Ghost: Server-Side Request Forgery in Image FetchingTryGhost Ghost · ghost
- CVE-2026-70590Ghost: Blind Password Hash Disclosure in Ghost Admin APITryGhost Ghost · ghost
- CVE-2026-70620Odysseus SSRF via Embedding Endpoint Configurationodysseus-dev odysseus
- CVE-2026-70589Ghost: Archived Offers can be RedeemedTryGhost Ghost · ghost
- CVE-2026-70588Ghost: Cross-Site Scripting in Universal ImportTryGhost Ghost · ghost
- CVE-2026-70493Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophicallyopen-webui
- CVE-2026-70491Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpointsopen-webui
- CVE-2026-70490Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role checkopen-webui
- CVE-2026-70489Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingopen-webui
- CVE-2026-54020Open WebUI: DNS Rebinding SSRF Bypassopen-webui
- CVE-2026-70488Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanupopen-webui
- CVE-2026-70487Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadataopen-webui
- CVE-2026-18810H3C NX15 networkSetup missing authenticationH3C NX15
- CVE-2026-70484Open WebUI: Users denied the image-generation permission can still generate images via chat completionsopen-webui
- CVE-2026-70483Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpointopen-webui
- CVE-2026-16792Global TLS Certificate Validation Bypass in Lenovo XClarity OrchestratorLenovo XClarity Orchestrator
- CVE-2026-16791Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLILenovo XClarity Essentials OneCLI
- CVE-2026-48154GoRest: InMemorySecret2FA race condition allows process crash via concurrent map accesspilinux gorest · github.com/pilinux/gorest
- CVE-2026-70481Open WebUI: Any member with write access to a standard channel can edit or delete other members' messagesopen-webui
- CVE-2026-70480Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart renderingopen-webui
- CVE-2026-66300SNOMED International Snowstorm reflected XSSSNOMED International Snowstorm
- CVE-2026-68743Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-47622NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive inforNVIDIA Dynamo
- CVE-2026-47621NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationNVIDIA Dynamo
- CVE-2026-47620NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationNVIDIA Dynamo
- CVE-2026-47619NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure.NVIDIA Dynamo
- CVE-2026-18790Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-boundsSysterel S2OPC
- CVE-2026-47763pdm: Project-Local State and Config Writes Follow Symlinkspdm-project pdm · pdm
- CVE-2026-47487NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, wrNVIDIA Triton Inference Server
- CVE-2026-18788Trippo ResponsiveFilemanager dialog.php unrestricted uploadTrippo ResponsiveFilemanager
- CVE-2026-48121@langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state accesslangchain-ai langgraphjs · @langchain/langgraph-checkpoint-…
- CVE-2026-18785o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after freeo6 open62541
- CVE-2026-18784o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflowo6 open62541
- CVE-2026-18775NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgeryNousResearch hermes-agent
- CVE-2026-18774NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgeryNousResearch hermes-agent
- CVE-2026-64630A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.Veeam ONE
- CVE-2026-15920Potential cross-site scripting via URLField values in the admindjangoproject Django
- CVE-2026-15830Potential denial-of-service vulnerability via nested geometry collectionsdjangoproject Django · django
- CVE-2026-15337Potential denial-of-service vulnerability in check_for_language()djangoproject Django
- CVE-2026-10032Arbitrary JavaScript Execution via openUrl in @a2ui/web_coreGoogle @a2ui/web_core · @a2ui/web_core
- CVE-2026-24078Exposure of Private Personal Information to an Unauthorized Actor in Data ModemQualcomm Snapdragon
- CVE-2026-24077Integer Underflow (Wrap or Wraparound) in WLAN HostQualcomm Snapdragon
- CVE-2026-24076Buffer Copy Without Checking Size of Input in Bluetooth HOSTQualcomm Snapdragon
- CVE-2026-18773NousResearch hermes-agent Quick run.py _check_slash_access authorizationNousResearch hermes-agent
- CVE-2026-18770vibesurf-ai VibeSurf Python Validation code code injectionvibesurf-ai VibeSurf
- CVE-2026-18401jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceFasterXML jackson-core · tools.jackson.core:jackson-core +1
- CVE-2026-18766chetans9 core-php-admin-panel customers.php sql injectionchetans9 core-php-admin-panel
- CVE-2026-67196Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolationperspective-dev perspective
- CVE-2026-70368Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log messageMobi-Com Polska Sp. z o.o. stunnel · Red Hat Enterprise Lin…
- CVE-2026-70367Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only servicesMobi-Com Polska Sp. z o.o. stunnel · Red Hat Enterprise Lin…
- CVE-2026-14337Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.Pegasystems Pega Infinity
- CVE-2026-18809Information disclosure in Firefox for Android and Firefox Focus for AndroidMozilla Firefox
- CVE-2026-63248In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization.Eclipse Foundation Eclipse Milo
- CVE-2026-61387In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an uncheckeEclipse Foundation Eclipse Milo
- CVE-2026-66883Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookupErlang Ecosystem Foundation oidcc_plug
- CVE-2026-66884Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protectionErlang Ecosystem Foundation oidcc_plug
- CVE-2026-14202Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-14465Session Fixation in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-14192Stored XSS in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-14219URL Redirection in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-14194Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human ResourcesBilin Software and Informatics Consultancy HUMANIST Digital…
- CVE-2026-18772Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion.Samsung Open Source rlottie
- CVE-2026-64565Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()Linux
- CVE-2026-16548Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response EndpointChat Widget: Floating Customer Support Button for 30+ Chann…
- CVE-2026-16547REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download EndpointREST API Log
- CVE-2026-16546Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvpWired Impact Volunteer Management
- CVE-2026-16296Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 HandlerClearfy Cache
- CVE-2026-16295Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action DispatcherClearfy Cache
- CVE-2026-16293Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URLPowerPress Podcasting plugin by Blubrry
- CVE-2026-16070Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDORBrizy
- CVE-2026-16069Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal PointBrizy
- CVE-2026-16068Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code AssetBrizy
- CVE-2026-16056Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_promptsContest Gallery
- CVE-2026-16035miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP SendminiOrange 2FA
- CVE-2026-15233Nested Pages < 3.2.15 - Editor+ Stored XSS via Post TitleNested Pages
- CVE-2026-14939Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON ImportVisualizer
- CVE-2026-14872Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id ParameterDatabase for Contact Form 7, WPforms, Elementor forms
- CVE-2026-14848Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkoutPaid Membership Subscriptions
- CVE-2026-14824Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar QuestionQuiz and Survey Master
- CVE-2026-14816The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests SpamThe GDPR Framework By Data443
- CVE-2026-12698wpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass AssignmentwpForo Forum
- CVE-2026-11366MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC BypassMonsterInsights
- CVE-2026-10526EmbedPress < 4.6.1 - Unauthenticated Blind SSRFEmbedPress
- CVE-2026-16536Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_idSimple Google Calendar Outlook Events Widget
- CVE-2026-18739Popt-devel: popt-static: off-by-one in poptstuffargsrpm-software-management popt · Red Hat Hardened Images +2
- CVE-2026-68744Sssd: sssd: nss responder uninitialized heap disclosure in initgroups replyRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-18569Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokensRed Hat Build of Keycloak · Red Hat Data Grid +2
- CVE-2026-18723diaowen DWSurvey Survey Status up-survey-status.do improper authorizationdiaowen DWSurvey
- CVE-2026-18722diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorizationdiaowen DWSurvey
- CVE-2026-18721kalcaddle kodbox SSO API Login apiLogin redirectkalcaddle kodbox
- CVE-2026-17614Wildfly-core: path traversal on wildfly domain controllerRed Hat JBoss Enterprise Application Platform · Red Hat Sin…
- CVE-2026-8508An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 couZyxel WAX650S firmware
- CVE-2026-18720kalcaddle kodbox msgWarning Plugin action improper authorizationkalcaddle kodbox
- CVE-2026-18719cemtan sar2html Search sar2html.py sql injectioncemtan sar2html
- CVE-2026-58042A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.nodejs node
- CVE-2026-58044A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from nodejs node
- CVE-2026-58045A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing tnodejs node
- CVE-2026-58041A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cacnodejs node
- CVE-2026-11835Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)Caliptra Core ROM
- CVE-2026-11836Production Debug-Unlock Token Verification Missing Device BindingCaliptra Core ROM · Caliptra Core Firmware
- CVE-2026-51144Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary
- CVE-2026-52370A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascr