CVEs published August 7, 2026
214 CVEs were published on August 7, 2026: 23 critical, 80 high.
- Published
- 214
- Critical
- 23
- High
- 80
- Medium
- 104
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 155
Most affected products
- Tobit Laboratories AG TeamDavid
- 22
- Sonatype Nexus Repository
- 10
- HashiCorp Consul
- 8
- Cisco Secure Endpoint
- 7
- aehrc pathling
- 6
- Datadog Android App
- 6
- ATN-B1 CPDLC
- 5
- klever-io klever-go · github.com/klever-io/klever-go
- 5
- SourceCodester Photo Share Website
- 5
- frappe
- 4
Critical 23
- CVE-2026-46409OpenYak local API: unauthenticated CSRF chain leads to Remote Code Executionopenyak
- CVE-2026-47243Kata guest escape: runtime-rs guest-root to host-root escape via virtiofskata-containers · github.com/kata-containers/kata-containers
- CVE-2026-48170scimPatch vulnerable to prototype pollution via unfiltered keys in patchthomaspoignant scim-patch · scim-patch
- CVE-2026-50540Kata Containers: Config Path Annotation Arbitrary File Loadingkata-containers
- CVE-2026-61808LightRAG: Missing Authentication for Critical API Functions in Default ConfigurationHKUDS LightRAG
- CVE-2026-48039Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Tokenpipeboard-co meta-ads-mcp · meta-ads-mcp
- CVE-2026-71851crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chainbrix crypto-js · crypto-js
- CVE-2026-64637Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessiWebPros Plesk
- CVE-2022-4995Weaver E-cology 9.0 File Upload RCE via uploaderOperate.jspWeaver Network Co. E-cology
- CVE-2026-19264Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeovergitroomhq postiz-app
- CVE-2026-66914Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1seblod.com SEBLOD extension for Joomla
- CVE-2026-54213TeamDavid: Denial of Service via endpoint 'internalRestart'Tobit Laboratories AG TeamDavid
- CVE-2026-54212TeamDavid: Buffer Overflow in JSON-parsingTobit Laboratories AG TeamDavid
- CVE-2026-54211TeamDavid: Buffer Overflow in multiple form data parametersTobit Laboratories AG TeamDavid
- CVE-2026-54210TeamDavid: Buffer Overflow in file names of file upload functionalitiesTobit Laboratories AG TeamDavid
- CVE-2026-54203TeamDavid: Memory Leak leaking sensitive informationTobit Laboratories AG TeamDavid
- CVE-2026-71558Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserializationApache Software Foundation Apache Fory
- CVE-2026-71560Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-pathApache Software Foundation Apache Fory
- CVE-2026-16258Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST EndpointAjax Search Lite
- CVE-2026-16038MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment GatewaysMStore API
- CVE-2026-14205WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' ParameterWP Events Manager
- CVE-2026-14364TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'themetechmount TrueBooker – Appointment Booking and Schedul…
- CVE-2026-14365TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'themetechmount TrueBooker – Appointment Booking and Schedul…
High 80
- CVE-2026-52880Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Runklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-52879Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoSklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-48120Kakoune has a Critical RCE via Autorestore Backup Filename Injectionmawww kakoune
- CVE-2026-52878Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chainklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-48026lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTMLtreeverse lakeFS · treeverse lakeFS-enterprise
- CVE-2026-47249Klever-Go KVM: Hash-array amplification in P2P resolver request handlingklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-58262Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorumklever-io klever-go
- CVE-2026-48169PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform APIMervinPraison praisonai-platform · praisonai-platform
- CVE-2026-45808OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACLopenbao · github.com/openbao/openbao
- CVE-2026-66061Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation executionhome-assistant core
- CVE-2026-66060Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callershome-assistant core
- CVE-2026-47664Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoningaehrc pathling
- CVE-2026-47663Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutationaehrc pathling
- CVE-2026-47662Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLsaehrc pathling
- CVE-2026-62296HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of servicehapifhir org.hl7.fhir.core · hapifhir ca.uhn.hapi.fhir:o… +3
- CVE-2026-47661Pathling has path traversal in $result endpoint that allows arbitrary warehouse file readaehrc pathling
- CVE-2026-47660Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltrationaehrc pathling
- CVE-2026-47659Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}aehrc pathling
- CVE-2026-62295HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of servicehapifhir org.hl7.fhir.core · hapifhir ca.uhn.hapi.fhir:o… +3
- CVE-2026-48007Element Call reports full URLs of visited pages to analytics serverelement-hq element-call · @element-hq/element-call-embedded
- CVE-2026-15972Unauthenticated denial of service via unbounded external gRPC connection acceptanceHashiCorp Consul
- CVE-2026-65819gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParsergopacket
- CVE-2026-48098NexTOR IP Changer Unsafely Uses sudo and shell=True0x5t4l1n NexTOR_IP_CHANGER
- CVE-2026-48097NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution0x5t4l1n NexTOR_IP_CHANGER
- CVE-2025-71409No Authentication for Very High Frequency Data Link messages used in CPDLCATN-B1 CPDLC
- CVE-2025-71412In CPDLC, False Emergency or Status Messages Will be Accepted as LegitimateATN-B1 CPDLC
- CVE-2026-71847Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsruby json · json
- CVE-2026-70561TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.phpTestLinkOpenSourceTRMS TestLink
- CVE-2025-58375Frappe has potential SQL Injection due to missing validationfrappe
- CVE-2026-64638WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.WordPress
- CVE-2026-64636An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data froWebPros Plesk
- CVE-2026-19082Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tagsTONYC Imager
- CVE-2026-20348ClamAV XAR File Format Processing Memory Corruption VulnerabilityCisco Secure Endpoint
- CVE-2026-20345ClamAV GPT File Format Processing Memory Corruption VulnerabilityCisco Secure Endpoint
- CVE-2026-20339ClamAV PESpin File Format Processing Integer Overflow VulnerabilityCisco Secure Endpoint
- CVE-2026-20347ClamAV Mach-O File Format Processing Memory Corruption VulnerabilityCisco Secure Endpoint
- CVE-2026-67585Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federationDivvyPayHQ absinthe_federation
- CVE-2026-20346ClamAV PDF File Format Processing Memory Corruption VulnerabilityCisco Secure Endpoint
- CVE-2026-20338ClamAV ZIP File Format Processing Memory Corruption VulnerabilityCisco Secure Endpoint
- CVE-2026-20337ClamAV ZIP File Format Processing Memory Corruption VulnerabilityCisco Secure Endpoint
- CVE-2026-71556go-git: Worktree operations may follow symlinksgo-git · github.com/go-git/go-git/v5 +1
- CVE-2026-68772ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializerZenML
- CVE-2026-14644Nexus Repository 3 - Privilege EscalationSonatype Nexus Repository
- CVE-2026-17593Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationSonatype Nexus Repository
- CVE-2026-17594Nexus Repository 3 - Authorization Bypass in Repository CreationSonatype Nexus Repository
- CVE-2026-17600Nexus Repository 3 - Session Not Invalidated on User Account Deletion or DeactivationSonatype Nexus Repository · org.sonatype.security:securi… +2
- CVE-2026-17601Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to AdministratorSonatype Nexus Repository
- CVE-2026-17603Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration APISonatype Nexus Repository
- CVE-2026-18497The nothings stb TrueType library contains a heap buffer overflow vulnerabilitySean Barrett (nothings) nothings stb
- CVE-2026-15570Improper URL Scheme and Destination Validation in SmartCenter browserseturl CommandVestel Telefunken TE24553B45V2DZ Smart TV
- CVE-2026-66494Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0joomshaper.com SP Page Builder extension for Joomla
- CVE-2026-56793Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +1
- CVE-2026-15816Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2026-54218TeamDavid: Weak Cryptography and Insecure Password StorageTobit Laboratories AG TeamDavid
- CVE-2026-54209TeamDavid: Buffer Overflow in 'editini' functionTobit Laboratories AG TeamDavid
- CVE-2026-54208TeamDavid: Arbitrary File Write leading to Stored XSSTobit Laboratories AG TeamDavid
- CVE-2026-54204TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionalityTobit Laboratories AG TeamDavid
- CVE-2026-54202TeamDavid: Path Traversal in the archive creation functionalityTobit Laboratories AG TeamDavid
- CVE-2026-54200TeamDavid: Local File Inclusion via the form field 'scjob'Tobit Laboratories AG TeamDavid
- CVE-2026-12070TeamDavid: Arbitrary File Deletion via form field 'scjob'Tobit Laboratories AG TeamDavid
- CVE-2026-71559Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadataApache Software Foundation Apache Fory
- CVE-2026-9169LUCID Vision Labs: DLL Search Order Hijacking in Arena SDK 1.0.80.49 on WindowsLUCID Vision Labs Arena SDK
- CVE-2026-66491Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3phoca.cz Phoca Commander extension for Joomla
- CVE-2026-49007Information leakage vulnerability in ZTE F689 productZTE F689
- CVE-2026-16263WP Maps < 4.9.7 - Subscriber+ Local File InclusionWP Maps
- CVE-2026-16262Estatik < 4.3.3 - Login CSRFEstatik Real Estate Plugin
- CVE-2026-16041MStore API < 4.21.0 - Unauthenticated Product Review CreationMStore API
- CVE-2026-16030MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone AuthenticationMStore API
- CVE-2026-15361Content Views < 4.5 - Subscriber+ SQL Injection via preview_requestContent Views
- CVE-2026-15215Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationSubscriptions for WooCommerce
- CVE-2026-14943Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST APIPassword Protected — Lock Entire Site, Pages, Posts, Catego…
- CVE-2026-19195V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access controlV-Secure Jingyun Antivirus
- CVE-2026-19193Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access controlJiangmin Antivirus
- CVE-2026-19192DeepCool DisplayService DeepCoolDisplayService.exe access controlDeepCool DisplayService
- CVE-2026-19191StableBit DrivePool DrivePoolService DrivePool.Service.exe permissionStableBit DrivePool
- CVE-2026-19190StableBit Scanner ScannerService Scanner.Service.exe permissionStableBit Scanner
- CVE-2026-19189Power Sofware PowerISO Kernel Driver scdemu.sys privileges managementPower Sofware PowerISO
- CVE-2026-49746GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMemImagination Technologies Graphics DDK
- CVE-2026-45198GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrustedImagination Technologies Graphics DDK
- CVE-2025-63235In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets.
Medium, low and unrated 111
- CVE-2026-47127Ghostfolio has a Stripe subscription bypassghostfolio
- CVE-2026-48122Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extensionShopify ruby-lsp
- CVE-2026-49343Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoSklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-48047XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) adminxwiki-platform · org.xwiki.platform:xwiki-platform-webjars-…
- CVE-2026-64676Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memorykata-containers
- CVE-2026-46405OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokensopenbao · github.com/openbao/openbao
- CVE-2026-11743Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and writezephyrproject zephyr
- CVE-2026-11742Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlockzephyrproject zephyr
- CVE-2026-19246HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgeryHKUDS nanobot
- CVE-2026-54338JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Loginjupyterhub
- CVE-2026-69207Hono: ReDoS in CORS middleware via Access-Control-Request-Headershonojs hono · hono
- CVE-2026-19245HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosureHKUDS nanobot
- CVE-2026-9031Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6TP-Link Systems Archer A6
- CVE-2026-9030Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6TP-Link Systems Archer A6
- CVE-2026-46358OpenBao's Inline Auth Incorrectly Redacted Headersopenbao · github.com/openbao/openbao
- CVE-2026-19244HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access controlHKUDS nanobot
- CVE-2026-71381Adobe Genuine Software Integrity Service | CWE-863 Incorrect AuthorizationAdobe Genuine Software Integrity Service
- CVE-2026-11425Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device RenderingDomoticz
- CVE-2026-59717Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishinghome-assistant core
- CVE-2026-66151SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, SonicWall Global VPN Client
- CVE-2026-19243HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injectionHKUDS nanobot
- CVE-2026-71870pypdf: Possible large memory usage for large /ToUnicode streamspy-pdf pypdf · pypdf
- CVE-2026-62293HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titleshapifhir org.hl7.fhir.core · hapifhir ca.uhn.hapi.fhir:o… +1
- CVE-2026-19113Unauthenticated denial of service via unbounded request body processingHashiCorp Consul
- CVE-2026-15970L7 intention authorization bypass via custom public listenerHashiCorp Consul
- CVE-2026-19017Consul vulnerable to partial arbitrary file read via Vault Connect CA providerHashiCorp Consul
- CVE-2026-19015Uncontrolled resource consumption in the Consul Connect CA roots endpointHashiCorp Consul
- CVE-2026-19014Uncontrolled resource consumption in the Consul Connect authorization endpointHashiCorp Consul
- CVE-2026-19012Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade pathHashiCorp Consul
- CVE-2026-19016Authorization bypass for session deletion in the transaction APIHashiCorp Consul
- CVE-2026-17435File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating filesRRWO File::Rotate::Simple
- CVE-2025-71410Malicious Link Control Frames Can Cause Loss of CPDLC FunctionsATN-B1 CPDLC
- CVE-2026-11430Grav CMS Scheduler Webhook Authentication Bypass via Null Short-CircuitTrilby Media grav-plugin-scheduler-webhook · Trilby Media g…
- CVE-2025-71411In CPDLC, Broadcast Control Frames Can Disconnect Multiple Aircraft SimultaneouslyATN-B1 CPDLC
- CVE-2025-71413In CPDLC, Malformed or Out of Sequence Frames Can Cause ResetsATN-B1 CPDLC
- CVE-2026-71852pypdf: Possible long runtimes/large memory usage for large CID font width rangespy-pdf pypdf · pypdf
- CVE-2026-71850Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurehonojs hono · hono
- CVE-2026-71849Hono: Proxy Helper does not remove response headers listed in the `Connection` headerhonojs hono · hono
- CVE-2026-71848Hono: Algorithmic Complexity DoS in Language Middlewarehonojs hono · hono
- CVE-2026-69127Kirby: System path exposure from error messages in the REST APIgetkirby kirby · getkirby/cms
- CVE-2026-19231SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injectionSourceCodester Simple Doctors Appointment System
- CVE-2026-66000Frappe: Unrestricted access to Document Follow APIsfrappe
- CVE-2026-19230SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scriptingSourceCodester Photo Share Website
- CVE-2026-44965In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorDatadog Android App
- CVE-2026-44964In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guardDatadog Android App
- CVE-2026-47364In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no userDatadog Android App
- CVE-2026-47363In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied Datadog Android App
- CVE-2026-47361In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEDatadog Android App
- CVE-2026-47362In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LDatadog Android App
- CVE-2026-19229SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosureSourceCodester Online Clothing Store
- CVE-2026-66058Frappe: Unrestricted access to a Document Follow APIfrappe
- CVE-2026-19213WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflowWonderTrader
- CVE-2026-56818Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate statenetty · io.netty:netty-codec-redis
- CVE-2026-66062SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headersveltejs kit · @sveltejs/kit
- CVE-2026-71557go-git: Malicious reference names may modify files outside the reference storagego-git · github.com/go-git/go-git/v5 +1
- CVE-2026-19212WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variableWonderTrader
- CVE-2026-19211SourceCodester Photo Share Website ajax.php signup sql injectionSourceCodester Photo Share Website
- CVE-2026-17595Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read BypassSonatype Nexus Repository
- CVE-2026-17596Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store NameSonatype Nexus Repository
- CVE-2026-17598Nexus Repository 3 - Improper Input Validation in Scheduled Task ConfigurationSonatype Nexus Repository
- CVE-2026-17599Nexus Repository 3 - Unverified Onboarding State on change-admin-password EndpointSonatype Nexus Repository
- CVE-2026-17597Nexus Repository 3 - Server-Side Request Forgery via Email Configuration VerificationSonatype Nexus Repository
- CVE-2026-19210SourceCodester Photo Share Website ajax.php save_upload unrestricted uploadSourceCodester Photo Share Website
- CVE-2026-48093Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embeddartiss code-embed
- CVE-2026-19209SourceCodester Photo Share Website index.php home cross site scriptingSourceCodester Photo Share Website
- CVE-2026-66059Frappe: Field-level permission bypass via Document Followfrappe
- CVE-2026-62996Smarty Security stream restriction bypass through stream: resourcesmarty-php smarty · smarty/smarty
- CVE-2026-62992Smarty: Symlink path traversal out of trusted directoriessmarty-php smarty · smarty/smarty
- CVE-2026-19208WonderTrader TraderDD.cpp queryTrades behavioral workflowWonderTrader
- CVE-2026-19207PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scriptingPHPGurukul Company Visitor Management System
- CVE-2026-61477Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injectionRed Hat Enterprise Linux
- CVE-2026-19206MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflowMZ Automation libiec61850
- CVE-2026-16637OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated RedirectsOPeNDAP hyrax-docker
- CVE-2026-48094ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Outputdartiss shareopenly
- CVE-2026-66838SQL injection via the :comment option in Postgrex.stream/4elixir-ecto postgrex
- CVE-2026-56794Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability.Dell OpenManage Server Administrator Managed Node (Patch… +1
- CVE-2026-54205TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionalityTobit Laboratories AG TeamDavid
- CVE-2026-54217TeamDavid: Stored XSS in web applicationTobit Laboratories AG TeamDavid
- CVE-2026-54216TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameterTobit Laboratories AG TeamDavid
- CVE-2026-54215TeamDavid: Open Redirect via the 'replyUrl' parameterTobit Laboratories AG TeamDavid
- CVE-2026-54214TeamDavid: Header Injection through the 'cType' URL parameterTobit Laboratories AG TeamDavid
- CVE-2026-54207TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionalityTobit Laboratories AG TeamDavid
- CVE-2026-54206TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionalityTobit Laboratories AG TeamDavid
- CVE-2026-54201TeamDavid: Missing AuthorizationTobit Laboratories AG TeamDavid
- CVE-2026-54199TeamDavid: Header Injection through request body in link storing functionalityTobit Laboratories AG TeamDavid
- CVE-2026-12071TeamDavid: Header Injection leading to Open Redirect via URL-encoded charactersTobit Laboratories AG TeamDavid
- CVE-2026-18938P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systemsRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-66492Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3phoca.cz Phoca Commander extension for Joomla
- CVE-2026-49008Integrity‑check credential leakage vulnerability in an application function of ZTE F689 productZTE F689
- CVE-2026-66493Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3phoca.cz Phoca Commander extension for Joomla
- CVE-2026-15239Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache KeySimple CAPTCHA with Cloudflare Turnstile
- CVE-2026-15211Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture TokenSubscriptions for WooCommerce
- CVE-2026-15148WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDORWP Events Manager
- CVE-2026-19079Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulationRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-16027Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-SignatureRevenue Administration E-Signature
- CVE-2026-49006TLS credential leakage vulnerability in ZTE F689 productZTE F689
- CVE-2026-12261Improper Access Control in nltk/nltknltk/nltk · nltk
- CVE-2026-16265WP Maps < 4.9.7 - Subscriber+ Denial of ServiceWP Maps
- CVE-2026-16039MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDORMStore API
- CVE-2026-15386Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-TextMeow Gallery
- CVE-2026-15359Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection OverwriteTemplately
- CVE-2026-15245BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider ShortcodeBNE Testimonials
- CVE-2026-15214Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDORSubscriptions for WooCommerce
- CVE-2026-15032wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL ConversionComments
- CVE-2026-14331Subscribe2 < 10.46 - Reflected XSS via email ParameterSubscribe2
- CVE-2026-19196SourceCodester Photo Share Website ajax.php login sql injectionSourceCodester Photo Share Website
- CVE-2026-11907Stream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat APIxwp Stream – Activity Log & Audit Trail
- CVE-2026-12801Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributesthemefic Ultra Addons for Contact Form
- CVE-2026-49005Root password hash exposure vulnerability in ZTE F689 productZTE F689
- CVE-2026-45204GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memoryImagination Technologies Graphics DDK
- CVE-2026-37171A lack of tenant separation in SuperTokens Inc.