CVEs published August 20, 2026
468 CVEs were published on August 20, 2026: 75 critical, 212 high.
- Published
- 468
- Critical
- 75
- High
- 212
- Medium
- 164
- Low
- 17
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 272
Most affected products
- IBM AIX · IBM PowerVM VIOS
- 75
- n8n-io n8n
- 17
- ATutor
- 13
- GIMP
- 10
- libevent
- 10
- Apache Software Foundation Apache InLong
- 9
- cesanta mongoose
- 8
- Frauscher Sensortechnik FDS
- 8
- django-cms
- 7
- Google Chrome
- 7
Critical 75
- CVE-2026-77647SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.SPIP
- CVE-2026-77645Critical Remote Code Execution (RCE) vulnerability reported in WindchillPTC Windchill PDMLink · PTC FlexPLM
- CVE-2026-18835Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17422Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-72843EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeoverevershopcommerce evershop
- CVE-2026-17160Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17157Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17152Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-77644Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise EditionPTC Windchill Risk and Reliability Enterprise Edition
- CVE-2026-17145Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17142Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17141Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17136Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17122Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17118Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17040Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-69555Azure Arc Elevation of Privilege VulnerabilityMicrosoft Azure ARC
- CVE-2026-69400Azure Logic Apps Elevation of Privilege VulnerabilityMicrosoft Azure Logic Apps
- CVE-2026-68782Azure SQL Database Elevation of Privilege VulnerabilityMicrosoft Azure SQL Database
- CVE-2026-66309Azure SQL Database Elevation of Privilege VulnerabilityMicrosoft Azure SQL Database
- CVE-2026-65816Azure Arc Elevation of Privilege VulnerabilityMicrosoft Azure Web Apps
- CVE-2026-63509Microsoft Fabric Elevation of Privilege VulnerabilityMicrosoft Fabric
- CVE-2026-65770Azure Managed Instance for Apache Cassandra Remote Code Execution VulnerabilityMicrosoft Azure Managed Instance for Apache Cassandra
- CVE-2026-69836Microsoft Entra ID Remote Code Execution VulnerabilityMicrosoft Entra
- CVE-2026-69851Microsoft Entra ID Elevation of Privilege VulnerabilityMicrosoft Entra
- CVE-2026-68789Azure SQL Database Elevation of Privilege VulnerabilityMicrosoft Azure SQL Database
- CVE-2026-65801Microsoft Exchange Online Elevation of Privilege VulnerabilityMicrosoft Exchange Online
- CVE-2026-62834Azure Data Factory Elevation of Privilege VulnerabilityMicrosoft Azure Data Factory
- CVE-2026-55769CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG for SQL queries without a fixed `search_path`cloudnative-pg
- CVE-2026-43798A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and contenApple swift-nio-ssh
- CVE-2026-71485Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backendscentrifugal centrifugo · github.com/centrifugal/centrifu… +4
- CVE-2026-67567Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restrictionRed Hat Advanced Cluster Management for Kubernetes
- CVE-2026-19586Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada GatewaysTP-Link Systems ER7212PC · TP-Link Systems ER605 +7
- CVE-2026-66788Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker labelRed Hat Advanced Cluster Management for Kubernetes
- CVE-2026-77148Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflowComfast CF-N1-S
- CVE-2026-2334) Missing Server-Side File Extension Validation in vsDeskvsDesk
- CVE-2026-63385Libevent: HTTP header handling bugs create risk of access control bypass.libevent
- CVE-2026-63382libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smugglinglibevent
- CVE-2026-73253Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matchingcesanta mongoose
- CVE-2026-73256Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TEcesanta mongoose
- CVE-2026-73251Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verificationcesanta mongoose
- CVE-2026-73257Mongoose: Content-Length + Transfer-Encoding coexistence enables request smugglingcesanta mongoose
- CVE-2026-53424Missing one-time-use enforcement in Samly allows replay of SAML bearer assertionsdropbox samly · handnot2 samly
- CVE-2026-77022Comfast CF-N1-S SSID Configuration mbox-config sub_44B438 stack-based overflowComfast CF-N1-S
- CVE-2026-71428unstructured: Server-Side Request Forgery in the URL-based partitioningUnstructured-IO unstructured · unstructured
- CVE-2026-55642dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)t8y2 dbx
- CVE-2026-18265OSNEXUS QuantaStor Missing Authentication Remote Code Execution VulnerabilityOSNEXUS QuantaStor
- CVE-2026-63039Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleServiceApache Software Foundation Apache InLong
- CVE-2026-63038Apache InLong: SQL Injection via String Concatenation Vulnerability ReportApache Software Foundation Apache InLong
- CVE-2026-63037Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpointApache Software Foundation Apache InLong
- CVE-2026-16926Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-15706Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMSBaylan Measuring Instruments Industry and Trade Baylan Smar…
- CVE-2026-28164WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerabilityHashThemes Easy Elementor Addons
- CVE-2026-18482CVE-2026-18482Klarso neo-mjs
- CVE-2026-74018WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerabilitythemagnifico52 Warehouse Cargo
- CVE-2026-74016WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerabilitythemagnifico52 Smart Cleaning
- CVE-2026-74014WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerabilityindithemes IT Residence
- CVE-2026-74001WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerabilityWPEverest User Registration & Membership Pro
- CVE-2026-73993WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerabilityRoxnor FundEngine
- CVE-2026-73992WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerabilityJonathan Daggerhart Query Wrangler
- CVE-2026-68566WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerabilityRepute Infosystems BookingPress Appointment Booking Pro
- CVE-2026-66682WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerabilityTyche Softwares. Abandoned Cart Pro for WooCommerce
- CVE-2026-66680WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerabilityplainware Locatoraid Store Locator
- CVE-2026-66672WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerabilityMonkeysan Flatastic
- CVE-2026-66649WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerabilitye-plugins Directory Pro
- CVE-2026-66609WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerabilityCodexThemes TheGem
- CVE-2026-66600WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-66593WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerabilitySecurity & Malware scan by CleanTalk
- CVE-2026-66592WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerabilityrtCamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-66583WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerabilityWPMU DEV Forminator
- CVE-2025-15689WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerabilityThemeGoods Capella
- CVE-2025-15688WordPress Capella theme <= 2.5.5 - SQL Injection vulnerabilityThemeGoods Capella
- CVE-2026-11861Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationshipsRed Hat Enterprise Linux
- CVE-2026-14950Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logicFrauscher Sensortechnik FDS
- CVE-2026-75860JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options UpdateJSON Options
High 212
- CVE-2026-16520Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians GeniaGenians Genian NAC · Genians Genian ZTNA
- CVE-2026-77646Server Side Request Forgery (SSRF) vulnerability reported in WindchillPTC Windchill PDMLink · PTC FlexPLM
- CVE-2026-19449Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-19446Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-19442Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-19437Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-18840Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-18842Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-18832Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-49217Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictionsMailu
- CVE-2026-18824Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-18716Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-18670Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17436Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17425Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17423Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-72848langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgerylangchain-ai langchain-community
- CVE-2026-72818NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Inputnltk
- CVE-2026-17171Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17170Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17168Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17165Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17163Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17159Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17138Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17124Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17121Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17060Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17024Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17006Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17003Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17000Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16997Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16996Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16991Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-69855Microsoft Copilot in Azure Information Disclosure VulnerabilityMicrosoft Copilot in Azure
- CVE-2026-69543Azure Virtual Machines Elevation of Privilege VulnerabilityMicrosoft Azure Virtual Machines
- CVE-2026-69558Microsoft Partner Center Information Disclosure VulnerabilityMicrosoft Partner Center
- CVE-2026-69419Azure Data Manager for Energy Remote Code Execution VulnerabilityMicrosoft Azure Data Manager for Energy
- CVE-2026-66800Azure Data Factory Information Disclosure VulnerabilityMicrosoft Azure Data Factory
- CVE-2026-16989Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-55013Windows Remote Help Defense Spoofing VulnerabilityMicrosoft Windows Remote Help
- CVE-2026-69519Azure Stack HCI Information Disclosure VulnerabilityMicrosoft Azure Stack HCI
- CVE-2026-49436LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link APIKovah LinkAce
- CVE-2026-55765CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database podcloudnative-pg
- CVE-2026-728609router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachabledecolua 9router
- CVE-2026-46355BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUserbigbluebutton
- CVE-2026-16946Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16945Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-46682BigBlueButton: Blind SQL Injection AUTH (Moderator)bigbluebutton
- CVE-2026-16943Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16937Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-55893Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecodecapstone-engine capstone
- CVE-2026-16936Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16935Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16934Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-64773An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amountApple container
- CVE-2026-77642tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest typetorproject Tor
- CVE-2026-53804OTRS Community Edition OS Command Injection via PGP ConfigurationCenturan Consulting OTRS Community Edition
- CVE-2026-74836HTTP/2 connection-window starvation pins Plug processes indefinitely in Banditmtrudel bandit
- CVE-2026-69242libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident writelibvips
- CVE-2026-77638Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonatorproject Tor
- CVE-2026-76023Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-76022Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox Google Chrome
- CVE-2026-76021Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a Google Chrome
- CVE-2026-76020Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a cGoogle Chrome
- CVE-2026-76019Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-76018Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker leveraging social engineering to potentiallGoogle Chrome
- CVE-2026-76017Use after free in Chromoting in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandboGoogle Chrome
- CVE-2026-18420RCE via Prototype Pollution in OpenSearch DashboardsAWS Amazon OpenSearch Service · OpenSearch Dashboards
- CVE-2026-77584Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams.torproject Tor
- CVE-2026-73137Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespaceRed Hat Advanced Cluster Management for Kubernetes
- CVE-2026-73040Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletionlouislam dockge
- CVE-2026-50190Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink pageShaarli
- CVE-2026-53587libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_datalibgit2
- CVE-2026-66001Frappe: Improper Authorization in OAuth2 Consent Endpointfrappe
- CVE-2026-62315Frappe: Mass assignment via set_valuefrappe
- CVE-2026-72852darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflowhank-ai darknet
- CVE-2026-66787Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addressesRed Hat Advanced Cluster Management for Kubernetes
- CVE-2026-66785Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijackRed Hat Advanced Cluster Management for Kubernetes
- CVE-2026-54623django CMS: Plugin move endpoint allows cyclic reparenting (DoS)django-cms
- CVE-2026-63387Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server responselibevent
- CVE-2026-63384Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.libevent
- CVE-2026-63495Libevent: Unbounded memory accumulation in WebSocket server via fragmented frameslibevent
- CVE-2026-63383Libevent: decode_tag_internal() can lead to out-of-bounds readlibevent
- CVE-2026-63388Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX acceptlibevent
- CVE-2026-76641Expat Out-of-Bounds Read via dtdCopylibexpat
- CVE-2026-53425Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responsesdropbox samly · handnot2 samly
- CVE-2026-65842Plate: SSRF with response disclosure in DOCX image embeddingudecode plate · @platejs/docx-io
- CVE-2026-40345deepmerge-ts: Stack exhaustion when merging recursive object graphsRebeccaStevens deepmerge-ts · deepmerge-ts
- CVE-2026-18263Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityParallels RAS Client
- CVE-2026-18262Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityParallels RAS Client
- CVE-2026-13121Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityParallels RAS Client
- CVE-2026-15686Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution VulnerabilityAdminer
- CVE-2026-15679Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityHugging Face PyTorch Image Models
- CVE-2026-18309GIMP APNG File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18308GIMP TIF File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18307GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18306GIMP SGI File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18305GIMP TIF File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18304GIMP TIF File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18303GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18302GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18301GIMP PSD File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18300GIMP HDR File Parsing Integer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-18299GStreamer rtpsbcdepay Use-After-Free Remote Code Execution VulnerabilityGStreamer
- CVE-2026-18298GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-18297GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-18296GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2026-18295GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityGStreamer
- CVE-2026-18294OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution VulnerabilityOriginLab Origin Viewer
- CVE-2026-18293OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityOriginLab Origin Viewer
- CVE-2026-18292OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution VulnerabilityOriginLab OriginPro
- CVE-2026-18291OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution VulnerabilityOriginLab OriginPro
- CVE-2026-61704link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897OP-Engineering link-preview-js · link-preview-js
- CVE-2026-18290OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityOriginLab OriginPro
- CVE-2026-18289OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityOriginLab OriginPro
- CVE-2026-18288OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityOriginLab OriginPro
- CVE-2026-18287Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerabilityaeon
- CVE-2026-18286Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerabilityaeon
- CVE-2026-18285Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerabilityaeon
- CVE-2026-77176Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicyRed Hat OpenShift Container Platform
- CVE-2026-18284Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation VulnerabilitySony XAV-9500ES
- CVE-2026-18282Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution VulnerabilitySony XAV-9500ES
- CVE-2026-18281Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution VulnerabilitySony XAV-9500ES
- CVE-2026-18279Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution VulnerabilitySony XAV-9500ES
- CVE-2026-69183Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)monkeytypegame monkeytype
- CVE-2026-18274Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution VulnerabilityHeimdall Data Database Proxy
- CVE-2026-18270Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation VulnerabilityKenwood DNR1007XR
- CVE-2026-18268Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation VulnerabilityKenwood DNR1007XR
- CVE-2026-18264NoMachine getstat Command Injection Remote Code Execution VulnerabilityNoMachine
- CVE-2026-54616NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return valueM2Team NanaZip
- CVE-2026-54449LangBot: Authenticated RCE Via MCP Configurationlangbot-app LangBot · langbot
- CVE-2026-19611Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth foldingRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Build… +7
- CVE-2026-75140jsoup Uncontrolled Resource Consumption in XmlTreeBuilderjhy soup · org.jsoup:jsoup
- CVE-2026-63043Apache InLong: Agent path traversal via unvalidated file source pathApache Software Foundation Apache InLong
- CVE-2026-63042Apache InLong: Missing authorization on DataNode management endpointsApache Software Foundation Apache InLong
- CVE-2026-63040Apache InLong: Missing authorization in StreamSource forceDeleteApache Software Foundation Apache InLong
- CVE-2026-63490Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassjknack handlebars.java · com.github.jknack:handlebars-sprin…
- CVE-2026-49825lxml: javascript: URL bypass in Cleaner via xlink:hreflxml · fedora-python lxml_html_clean +1
- CVE-2026-16932Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16928Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16927Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16925Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16924Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16923Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16922Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-61898accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scriptsCanonical accountsservice
- CVE-2026-61897accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scriptsCanonical accountsservice
- CVE-2026-73220CVAT: Stored XSS via annotation guides in audio taskscvat-ai cvat
- CVE-2026-70383Arbitrary file overwrite vulnerability in DigiDoc4 clientEstonian Information System Authority (RIA) DigiDoc4
- CVE-2026-64966Path Traversal leading to Remote Code Execution in ATutorATutor
- CVE-2026-76635baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.phpbaserproject basercms
- CVE-2026-64960Remote Code Execution via Unrestricted File Upload in ATutorATutor
- CVE-2026-76634WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.phpLabRedesCefetRJ WeGIA
- CVE-2026-76633WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenhaLabRedesCefetRJ WeGIA
- CVE-2026-76833@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag@cgauge/yaml
- CVE-2026-77118Out-of-bounds write in GraphicsMagick PCD decoderGraphicsMagick Group GraphicsMagick · Debian graphicsmag… +1
- CVE-2026-74011WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerabilityrevmakx InfiniteWP Client
- CVE-2026-74020WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerabilityAnders Norén Koji
- CVE-2026-74019WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerabilitypaulepro2019 EPROLO Dropshipping
- CVE-2026-74013WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerabilityWordPress.com eShipper Commerce
- CVE-2026-73998WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerabilityaxew3 WP w3all phpBB
- CVE-2026-68564WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityNotificationX Pro
- CVE-2026-66677WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerabilityVaultDweller Leyka
- CVE-2026-66673WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMonkeysan Flatastic
- CVE-2026-66616WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerabilityForm Maker by 10Web
- CVE-2026-66615WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerabilityEric Teubert Podlove Podcast Publisher
- CVE-2026-66614WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerabilitySEO Squirrly SEO Plugin by Squirrly SEO
- CVE-2026-66612WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerabilitythembay Aora
- CVE-2026-66611WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerabilityPaymob for WooCommerce
- CVE-2026-66607WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityThemeHunk Advance Product Search
- CVE-2026-66606WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityThemeGrill SmartSMTP
- CVE-2026-66605WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerabilityHasThemes Swatchly – WooCommerce Variation Swatches for Pro…
- CVE-2026-66604WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerabilityPaolo GeoDirectory
- CVE-2026-66598WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerabilityKingtech LLC. B2BKing Premium
- CVE-2026-66597WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerabilityMelograno Venture Studio wpDataTables
- CVE-2026-66594WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerabilitylukeseager WordPress Persistent Login
- CVE-2026-66590WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerabilityTagembed
- CVE-2026-66582WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs TranslatePress
- CVE-2026-66581WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetEngine
- CVE-2026-28150WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerabilityuxper Golo Framework
- CVE-2025-15637WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerabilityEdge Themes Shuffle
- CVE-2026-74021WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerabilityAnders Norén Chaplin
- CVE-2026-77084n8n before 1.123.69 Remote Code Execution via Git Node Configuration Valuesn8n-io n8n
- CVE-2026-77080n8n before 1.123.69 Arbitrary File Read and Write via Snowflaken8n-io n8n
- CVE-2026-77079n8n before 2.34.1 Authorization Bypass via Custom Role Deletionn8n-io n8n
- CVE-2026-77077n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollutionn8n-io n8n
- CVE-2026-77076n8n before 1.123.69 Credential Leak via GraphQL Node Errorn8n-io n8n
- CVE-2026-77075n8n before 1.123.69 Expression Injection via Resource Locatorn8n-io n8n
- CVE-2026-77072n8n before 1.123.69 Stored XSS via Form Completion Pagen8n-io n8n
- CVE-2026-77071n8n before 1.123.69 PostgREST Filter Injection via Supabasen8n-io n8n
- CVE-2026-77070n8n before 1.123.69 NoSQL Injection via MongoDB Noden8n-io n8n
- CVE-2026-77068n8n before 2.34.1 Remote Code Execution via Path Traversaln8n-io n8n
- CVE-2026-73198Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body readRed Hat Enterprise Linux
- CVE-2026-13097Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastoreRed Hat Enterprise Linux
- CVE-2026-73197Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body readRed Hat Enterprise Linux
- CVE-2026-18917Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflowRed Hat Enterprise Linux
- CVE-2026-14952Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authenticationFrauscher Sensortechnik FDS
- CVE-2026-14951Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headersFrauscher Sensortechnik FDS
- CVE-2026-14949Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access controlFrauscher Sensortechnik FDS
- CVE-2026-14948Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archivesFrauscher Sensortechnik FDS
- CVE-2026-14947Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP fileFrauscher Sensortechnik FDS
- CVE-2026-14946Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.Frauscher Sensortechnik FDS
- CVE-2026-75948Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12icagenda.com iCagenda extension for Joomla
- CVE-2026-76564Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7phoca.cz Phoca Cart extension for Joomla
- CVE-2025-14601vsDesk Task Scheduler OS Command InjectionvsDesk
- CVE-2026-14163In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment vaOctopus Deploy Octopus Server
- CVE-2026-15049Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP ImportDepicter — Popup & Slider Builder
- CVE-2026-75963Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Propertyliedekef Events Made Easy
- CVE-2025-52182The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability.
- CVE-2026-52021An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts,
Medium, low and unrated 181
- CVE-2026-77648In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetcOpenStack Glance
- CVE-2026-77113Path Traversal Vulnerability in apport-unpackCanonical Apport
- CVE-2026-19783Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-19448Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-54389Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdbNationalSecurityAgency ghidra
- CVE-2026-18828Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-18822Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17424Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-72846Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgerylightdash
- CVE-2026-17195Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-49244SFTPGo: Path confinement bypass in public browsable share partial ZIP downloaddrakkan sftpgo · github.com/drakkan/sftpgo +1
- CVE-2026-49245SFTPGo: Stored XSS via inline parameter on public shares and user file downloaddrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2026-17120Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-62945TREK: Cross-trip reservation title disclosure via file linksmauriceboe TREK
- CVE-2026-54509TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)mauriceboe TREK
- CVE-2026-17009Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-17007Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-70105Microsoft Word Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2026-54508TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolutionmauriceboe TREK
- CVE-2026-16980Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16973Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16972Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16964Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16958Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-16952Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-55015Microsoft Remote Help Denial of Service VulnerabilityMicrosoft Windows Remote Help
- CVE-2026-16951Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-54505TREK: Stored cross-user HTML injection via trip title in the Journey suggestion bannermauriceboe TREK
- CVE-2026-50192Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirectkerberos-io agent · github.com/kerberos-io/agent/machinery
- CVE-2026-55489BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypassbigbluebutton
- CVE-2026-55491BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Namebigbluebutton
- CVE-2026-16944Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-55894Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecodecapstone-engine capstone
- CVE-2026-67448Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)axllent mailpit · github.com/axllent/mailpit
- CVE-2026-77643A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists dxapian-core
- CVE-2026-67447Mailpit: SMTP DATA line reader buffers over-limit input before size enforcementaxllent mailpit · github.com/axllent/mailpit
- CVE-2026-67445Mailpit: SMTP command parser buffers unbounded command lines before syntax rejectionaxllent mailpit · github.com/axllent/mailpit
- CVE-2026-75484HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Banditmtrudel bandit
- CVE-2026-67446Mailpit: Thumbnail generation decodes unbounded image dimensions before scalingaxllent mailpit · github.com/axllent/mailpit
- CVE-2026-77641tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails.torproject Tor
- CVE-2026-68921DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)dicebear · @dicebear/core +1
- CVE-2026-70654libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflowlibvips
- CVE-2026-70653libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance imagelibvips
- CVE-2026-70651libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagicklibvips
- CVE-2026-70652libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain maplibvips
- CVE-2026-77640tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1.torproject Tor
- CVE-2026-77639Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just undertorproject Tor
- CVE-2026-77587Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set wtorproject Tor
- CVE-2026-19755NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helperNoSleep
- CVE-2026-77506Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.Znuny
- CVE-2026-75910Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment templateAWS Athena Federated Query Clickhouse Connector deployment…
- CVE-2026-72861Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absentappwrite templates
- CVE-2026-77151lin-snow Ech0 crypto.go MD5Encrypt risky encryptionlin-snow Ech0
- CVE-2026-43678An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent afApple swift-nio
- CVE-2026-49996securedrop-proxy origin limitation can be bypassed with redirectsfreedomofpress securedrop-client
- CVE-2026-64777A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolApple container
- GHSA-JM5P-837G-RV8GWagtail: Improper restriction handling on Page translation API endpointwagtail
- CVE-2026-53586libgit2: HTTP transport can leak credentials to an offsite redirect targetlibgit2
- CVE-2026-53583libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backendlibgit2
- CVE-2026-53585libgit2: Unbounded Memory Allocation via Delta Object Result-Size Headerlibgit2
- CVE-2026-53584libgit2: Submodule path traversallibgit2
- CVE-2026-19683Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada GatewaysTP-Link Systems ER7212PC · TP-Link Systems ER605 +7
- CVE-2026-9033Unauthenticated Captive Portal Session Termination and Forced Logout in Omada GatewaysTP-Link Systems ER7212PC · TP-Link Systems ER605 +16
- CVE-2026-75514BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibotbunkerity bunkerweb
- CVE-2026-66002Frappe: User Enumeration via PDDRfrappe
- CVE-2026-63654Frappe: Unauthenticated Workflow approval via confirm_actionfrappe
- CVE-2026-72854msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservationmsgpack-c
- CVE-2026-15743Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheableCatalyst-Plugin-Static-Simple
- CVE-2026-53569Frappe: Missing authorization in toggle_like and mark_as_seenfrappe
- CVE-2026-75526django CMS: Stored XSS in edit-mode plugin exception renderingdjango-cms
- CVE-2026-63003django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)django-cms
- CVE-2026-61663django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staffdjango-cms
- CVE-2026-54622django CMS: Clipboard copy IDOR discloses unauthorized plugin contentdjango-cms
- CVE-2026-54624django CMS: Structure endpoint bypasses page-view permissiondjango-cms
- CVE-2026-54625django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)django-cms
- CVE-2026-63379Libevent: HTTP Header smugglinglibevent
- CVE-2026-63380Libevent: Null Pointer Dereference in `evws_new_session`libevent
- CVE-2026-63381Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`libevent
- CVE-2026-73255Mongoose: Path traversal in SSI #include directives enables arbitrary file readcesanta mongoose
- CVE-2026-73259Mongoose: Reflected XSS via decoded URI in directory listing rendercesanta mongoose
- CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listingcesanta mongoose
- CVE-2026-73258Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipartcesanta mongoose
- CVE-2026-77036elunez eladmin GenConfigController improper authorizationelunez eladmin
- CVE-2026-72847broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree ViewCanop broot
- CVE-2026-72844Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projectionsleanprover lean4
- CVE-2026-77031Tenda CH22 formcreateFileName command injectionTenda CH22
- CVE-2026-77025itsourcecode Hospital Management System viewappointmentpending.php sql injectionitsourcecode Hospital Management System
- CVE-2026-54136Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_searchwindmill-labs windmill · windmill-api
- CVE-2026-61625VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore rootVictoriaMetrics · github.com/VictoriaMetrics/VictoriaMetrics
- CVE-2026-55586SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM filessumatrapdfreader sumatrapdf
- CVE-2026-54770WebOb: Open redirect in Location header normalization via leading C0 control / space charactersPylons webob · webob
- CVE-2026-77020CodeAstro Apartment Visitor Management System password-recovery.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-63481Hurl: Cookies in Cookies section leak when redirecting to a different hostOrange-OpenSource hurl · hurl
- CVE-2026-55095OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fieldsopf openproject
- CVE-2026-18283Sony XAV-9500ES udev USB Rules Authorization Bypass VulnerabilitySony XAV-9500ES
- CVE-2026-18280Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution VulnerabilitySony XAV-9500ES
- CVE-2026-18278Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure VulnerabilitySony XAV-9500ES
- CVE-2026-64846Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental featureNixOS nix
- CVE-2026-77019CodeAstro Apartment Visitor Management System forgotpw.php sql injectionCodeAstro Apartment Visitor Management System
- CVE-2026-18273Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation VulnerabilityKenwood DNR1007XR
- CVE-2026-18272Kenwood DNR1007XR startUpdateProcess Command Injection VulnerabilityKenwood DNR1007XR
- CVE-2026-18271Kenwood DNR1007XR vCardParser Heap-based Buffer Overflow Code Execution VulnerabilityKenwood DNR1007XR
- CVE-2026-18269Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution VulnerabilityKenwood DNR1007XR
- CVE-2026-71492Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry rootmasci banks · banks
- CVE-2026-18267Kenwood DNR1007XR Firmware Update Link Following Code Execution VulnerabilityKenwood DNR1007XR
- CVE-2026-77004Comfast CF-N1-S mbox-config sprintf command injectionComfast CF-N1-S
- CVE-2026-63044Apache InLong: Authenticated SSRF via POST /api/node/testConnectionApache Software Foundation Apache InLong
- CVE-2026-76999SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorizationSourceCodester CET Automated Grading System with AI Predict…
- CVE-2026-63016Apache InLong: Ordinary users can create new packagesApache Software Foundation Apache InLong
- CVE-2026-63015Apache InLong: Non-template responsible persons can view template informationApache Software Foundation Apache InLong
- CVE-2026-76998SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injectionSourceCodester Simple Online Food Ordering System
- CVE-2026-76997SourceCodester Simple Online Food Ordering System ajax.php save_category sql injectionSourceCodester Simple Online Food Ordering System
- CVE-2026-76996SourceCodester Simple Online Food Ordering System view_order.php sql injectionSourceCodester Simple Online Food Ordering System
- CVE-2026-76995SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted uploadSourceCodester Simple Online Food Ordering System
- CVE-2026-44725EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code executionemqx
- CVE-2026-76993GreyDGL PentestGPT Web-Page Crawling injectionGreyDGL PentestGPT
- CVE-2026-55558aiosmtplib: STARTTLS response injectioncole aiosmtplib · aiosmtplib
- CVE-2026-76991itsourcecode Hospital Management System viewappointmentapproved.php sql injectionitsourcecode Hospital Management System
- CVE-2026-64972Reflected XSS in ATutorATutor
- CVE-2026-64971Reflected XSS in ATutorATutor
- CVE-2026-64970Stored XSS in ATutorATutor
- CVE-2026-64969Insecure Direct Object Reference in ATutorATutor
- CVE-2026-64968Server-Side Request Forgery in ATutorATutor
- CVE-2026-64967Path Traversal in ATutorATutor
- CVE-2026-64965Missing Authorization Check in ATutorATutor
- CVE-2026-64964Generation of Predictable Email Confirmation Token in ATutorATutor
- CVE-2026-64963Path Traversal in ATutorATutor
- CVE-2026-64962Cross-Site Request Forgery (CSRF) in ATutorATutor
- CVE-2026-64961Authentication Bypass in ATutorATutor
- CVE-2026-76990code-projects Simple Inventory System delete.php sql injectioncode-projects Simple Inventory System
- CVE-2026-76989liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-boundsliftoff-sr CIPster
- CVE-2026-76988liftoff-sr CIPster ForwardOpen cipconnectionmanager.cc forward_open out-of-boundsliftoff-sr CIPster
- CVE-2026-28163WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerabilitymyCred New User Approve
- CVE-2026-21784HCL IntelliOps Event Management is affected by multiple security vulnerabilities.HCL Software IEM
- CVE-2025-62299HCL IntelliOps Event Management is affected by multiple security vulnerabilities.HCL Software IEM
- CVE-2026-76987liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruptionliftoff-sr CIPster
- CVE-2025-62300HCL IntelliOps Event Management is affected by multiple security vulnerabilities.HCL Software IEM
- CVE-2026-7485Frozen BI aggregations leak host and service names to unauthorized usersCheckmk
- CVE-2025-62306HCL IntelliOps Event Management is affected by multiple security vulnerabilities.HCL Software IEM
- CVE-2025-62307HCL IntelliOps Event Management is affected by multiple security vulnerabilities.HCL Software IEM
- CVE-2026-73402WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerabilityHakan Ozevin WP BASE Booking
- CVE-2026-66647WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerabilityRadiusTheme Homlisti
- CVE-2026-66601WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-66595WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-66586WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerabilityThemewinter WP Cafe Pro
- CVE-2025-53999WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerabilityThemeGoods Altair
- CVE-2026-77085n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tooln8n-io n8n
- CVE-2026-77083n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollutionn8n-io n8n
- CVE-2026-77082n8n before 1.123.69 ReDoS via Filter and Switch Noden8n-io n8n
- CVE-2026-77081n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Noden8n-io n8n
- CVE-2026-77074n8n before 1.123.69 SSRF via Edit Image Noden8n-io n8n
- CVE-2026-77073n8n before 2.34.1 Cross-Project Credential Access via MCPn8n-io n8n
- CVE-2026-77069n8n before 1.123.69 SSRF Protection Bypass via OAuth2n8n-io n8n
- CVE-2026-77067Omnivore Stored Server-Side Request Forgery via the setWebhook Mutationomnivore-app omnivore
- CVE-2026-77066Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Queryomnivore-app omnivore
- CVE-2026-73199Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request valueRed Hat Enterprise Linux
- CVE-2026-77026Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5tassos.gr Convert Forms extension for Joomla
- CVE-2026-73196Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encodingRed Hat Enterprise Linux
- CVE-2026-76610Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65yootheme.com Zoo extension for Joomla
- CVE-2026-77014Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responsesRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-14953Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access controlFrauscher Sensortechnik FDS
- CVE-2026-76569Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4phoca.cz Phoca Download extension for Joomla
- CVE-2026-76565Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7phoca.cz Phoca Cart extension for Joomla
- CVE-2025-14602Weak File Name Generation in vsDeskvsDesk
- CVE-2026-71368F-RevoCRM contains a cross-site scripting vulnerability.Thinkingreed F-RevoCRM
- CVE-2026-74992Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip UploadKirki
- CVE-2026-19699GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data DisclosureGutenKit
- CVE-2026-19697GutenKit < 2.5.0 - Author+ Stored XSS via SVG UploadGutenKit
- CVE-2026-19615Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPCAdmin and Site Enhancements
- CVE-2026-13405Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget BuilderRoyal Addons for Elementor
- CVE-2026-17153AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST EndpointAI Agent by SiteGround
- CVE-2026-73542Multiple SEIKO EPSON printers and scanners contain revoked root certificates.Multiple SEIKO EPSON printers and scanners
- CVE-2026-76957libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks.libexpat project libexpat
- CVE-2026-76956In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in beinlibexpat project libexpat
- CVE-2026-76800DeDeCMS select_media_post.php unrestricted uploadDeDeCMS
- CVE-2026-76799code-projects Login Registration System SQL Database Backup login_registration_system.sql file accesscode-projects Login Registration System
- CVE-2026-76795AeternaLabsHQ PullMD REST API Endpoint api server-side request forgeryAeternaLabsHQ PullMD
- CVE-2026-75628Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameterPunk-OAuth2
- CVE-2026-76785amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injectionamirsanni Mini-Inventory-and-Sales-Management-System
- CVE-2026-76783DeDeCMS advancedsearch.php sql injectionDeDeCMS
- CVE-2026-76764code-projects Employee Management System Admin Login Endpoint aprocess.php sql injectioncode-projects Employee Management System