CVEs published August 26, 2026
394 CVEs were published on August 26, 2026: 81 critical, 171 high. 1 is now in CISA KEV.
- Published
- 394
- Critical
- 81
- High
- 171
- Medium
- 101
- Low
- 16
- Unrated
- 25
- Now in CISA KEV
- 1
- Fix available
- 225
Most affected products
- Linux
- 92
- FreeBSD
- 9
- WeblateOrg weblate
- 7
- Dell PowerProtect One
- 6
- GitLab
- 6
- wintercms winter · winter/wn-backend-module
- 6
- Spring Reactor Netty
- 5
- Ubiquiti UniFi OS Server · Ubiquiti Cloud Keys +11
- 5
- fleetdm fleet · github.com/fleetdm/fleet/v4
- 4
- HCLSoftware BigFix Quantum Risk Analyzer
- 4
Critical 81
- CVE-2026-65956KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF1Panel-dev KubePi
- CVE-2026-65646Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arWebPros Plesk
- CVE-2026-65641A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.Veeam One
- CVE-2026-60004Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.Gitea · code.gitea.io/gitea +1
- CVE-2026-70419Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS ComDell Cloud Disaster Recovery
- CVE-2026-19485Bucket Squatting in Vertex AI Search for CommerceGoogle Cloud Vertex AI Search for Commerce
- CVE-2026-81032NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configurationvesoft-inc nebula
- CVE-2026-80428ILIAS PHP Object Injection via Shibboleth LogoutILIAS-eLearning e.V. ILIAS
- CVE-2026-54569SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.coresenaite.core · senaite-core
- CVE-2026-75062Eval Injection in google/langfun via default lf.query protocolGoogle langfun
- CVE-2026-80589block: stop the timeout timer when releasing a never added diskLinux
- CVE-2026-80587mptcp: avoid combining some incoming suboptionsLinux
- CVE-2026-80586mptcp: options: reset DSS fields in case of unexpected sizeLinux
- CVE-2026-80585mptcp: fastopen: only mark MPTFO subflows with SYN dataLinux
- CVE-2026-80561libceph: fix multiple unsafe decodes in decode_locker()Linux
- CVE-2026-80558libceph: Avoid using invalid osd indices from primary_tempLinux
- CVE-2026-80557libceph: fix OOB read in decode_watchers() via missing bounds checkLinux
- CVE-2026-80554s390/vfio_ccw: Limit the number of channel program segmentsLinux
- CVE-2026-80551s390/vfio_ccw: Ensure first IDAW remains constantLinux
- CVE-2026-80528ceph: avoid fs reclaim while using current->journal_infoLinux
- CVE-2026-80519ovpn: finish crypto callback cleanup before peer releaseLinux
- CVE-2026-74752sctp: validate cookie AUTH state before useLinux
- CVE-2026-74751riscv: lib: Fix ZBB strnlen reading past count boundaryLinux
- CVE-2026-74746netfilter: flowtable: publish GC-visible tuple lastLinux
- CVE-2026-74744ipvlan: inherit needed_headroom and needed_tailroom from phy_devLinux
- CVE-2026-74743macvlan: inherit needed_headroom and needed_tailroom from lowerdevLinux
- CVE-2026-74737net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAGLinux
- CVE-2026-54523Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any…kyverno · github.com/kyverno/kyverno
- CVE-2026-75896Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's LiderahenkTÜBİTAK BİLGEM Software Technologies Research Institute Lid…
- CVE-2026-12717Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String InjectionGoogle Cloud BigQuery Data Transfer Service
- CVE-2026-18080ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachmentwedevs ERP: Complete HR, Accounting & CRM Suite Built for W…
- CVE-2026-77557A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalatUbiquiti UniFi Protect AI Key
- CVE-2026-77554A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exeUbiquiti UniFi Talk Application
- CVE-2026-77553A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi AccessUbiquiti UniFi Access Application
- CVE-2026-77552A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Ubiquiti UniFi Enterprise Audio/Video Bridge
- CVE-2026-77551A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UnUbiquiti UniFi Connect Display Cast Pro
- CVE-2026-77550A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devicUbiquiti UniFi OS Server · Ubiquiti Cloud Keys +11
- CVE-2026-77549A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulneraUbiquiti UniFi OS Server · Ubiquiti Cloud Keys +11
- CVE-2026-80204Grav before 1.0.18 Authentication Bypass via Scoped API Keygetgrav grav
- CVE-2026-80203Grav before 1.0.18 Authentication Bypass via Scoped API Keygetgrav grav
- CVE-2026-77548A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtUbiquiti UniFi Protect Application
- CVE-2026-77547A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceUbiquiti UniFi Access Application
- CVE-2026-77546A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceUbiquiti UniFi Access Application
- CVE-2026-77545A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability fUbiquiti UniFi OS Server · Ubiquiti Cloud Keys +11
- CVE-2026-80349TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid ParameterTarsCloud TarsWeb
- CVE-2026-77543A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi AcceUbiquiti UniFi Access Application
- CVE-2026-77542A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID EnterUbiquiti UID Enterprise Agent
- CVE-2026-77541A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi NetwoUbiquiti UniFi Network Application
- CVE-2026-77540A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Ubiquiti UniFi OS Server
- CVE-2026-77539A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Ubiquiti UniFi OS Server
- CVE-2026-77537A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to Ubiquiti UniFi Protect Application
- CVE-2026-77536A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain deviUbiquiti UniFi OS Server · Ubiquiti Cloud Keys +11
- CVE-2026-77535A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi NetUbiquiti UniFi Network Application
- CVE-2026-59683OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled stringsCalcProgrammer1 OpenRGB
- CVE-2026-77534A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain deviUbiquiti UniFi OS Server · Ubiquiti Cloud Keys +11
- CVE-2026-77533A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi ProtUbiquiti UniFi Protect Application
- CVE-2026-80235Thinking Software Technology｜EFence - Arbitrary File UploadThinking Software Technology EFence
- CVE-2026-18431Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Writethemefusion Avada (Fusion) Builder · ThemeFusion Avada | We…
- CVE-2026-15203Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid softwareDanfoss iC7-Automation SP · Danfoss iC7-Marine +1
- CVE-2026-19632TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosurecozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2023-42179Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation proc
- CVE-2025-51679An issue was discovered in openRISC OR1200 commit 83ac6b.
- CVE-2025-61163Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.
- CVE-2025-61165An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute arbit
- CVE-2025-70290An issue was discovered in Denx U-Boot before 2026.04.
- CVE-2025-70293An issue was discovered in Denx U-Boot before 2026.04.
- CVE-2026-26448Stomper 5e2741e is vulnerable to Use-After-Free.
- CVE-2026-51106An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
- CVE-2026-52103A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attacke
- CVE-2026-68000The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.
- CVE-2026-75325DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
- CVE-2026-75327In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload v
- CVE-2026-75329The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism.
- CVE-2026-75330The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection.
- CVE-2026-75332Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
- CVE-2026-75334The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution.
- CVE-2026-75336Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.
- CVE-2026-75338disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control.
- CVE-2026-75340The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Serve
- CVE-2026-75411JeecgBoot v3.9.2 is vulnerable to Remote command execution.
- CVE-2026-75414In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command ex
High 171
- CVE-2026-47852Predictable cache directory location allows local ONNX model substitution in Spring AISpring AI
- CVE-2026-47851Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document ReaderSpring AI
- CVE-2026-80183In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignmentOpenStack Keystone
- CVE-2026-47665Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLpenpot
- CVE-2026-47666Penpot: Stored XSS via custom font family name injected into a @font-face style rulepenpot
- CVE-2026-61617Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustionpterodactyl wings
- CVE-2026-55182LibreNMS: Remote Code Execution by Signal Alert Transportation Modulelibrenms · librenms/librenms
- CVE-2026-63360LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpointLimeSurvey
- CVE-2026-16809LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message renderingLimeSurvey
- CVE-2026-77611SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basenameseaweedfs
- CVE-2026-43621Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()SimpleMachines SMF
- CVE-2026-77317SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwriteseaweedfs
- CVE-2026-64632A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.Veeam ONE
- CVE-2026-65642Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and WebPros Plesk
- CVE-2026-65647Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.WebPros Plesk Migrator · WebPros Plesk Site Import
- CVE-2026-77298SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policyseaweedfs
- CVE-2026-77368SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Pathsseaweedfs
- CVE-2026-15973LimeSurvey 7.0.5 - Stored XSS in Survey Menu EntriesLimeSurvey
- CVE-2026-61792Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)WeblateOrg weblate
- CVE-2026-79921amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payloadrabbitmq amqp091-go · github.com/rabbitmq/amqp091-go
- CVE-2026-55228Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projectWeblateOrg weblate · weblate
- CVE-2026-79938Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability.Dell Power Protect Cyber Recovery · Dell Cyber Recovery
- CVE-2026-46369Nimiq: Validity store off by one errornimiq core-rs-albatross · nimiq-blockchain
- CVE-2026-66003Frappe: Access control bypass via REST API dot-notation fields on linked doctypesfrappe
- CVE-2026-77652Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette indexGNOME Dia
- CVE-2026-74770Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS CommanDell PowerProtect One
- CVE-2026-54245Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databasefleetdm fleet · github.com/fleetdm/fleet/v4 +1
- CVE-2026-68861Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS CommanDell PowerProtect One
- CVE-2026-68863Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability.Dell PowerProtect One
- CVE-2026-71171Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS ComDell Cloud Disaster Recovery
- CVE-2026-58474whichllm < 0.5.16 Code Injection via run and snippet commandsAndyyyy64 whichllm
- CVE-2026-76784Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home DevicesTP-Link Systems HS103P3 / HS103P4 · TP-Link Systems EP10 +18
- CVE-2026-47841WebAuthn User Verification Bypass via Session SerializationSpring Security
- CVE-2026-47836Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVNSpring Cloud Config
- CVE-2026-32258Winter: Stored XSS through Editor Settings custom styleswintercms winter · winter/wn-backend-module
- CVE-2026-32257Winter: Stored XSS through Brand Settings custom styleswintercms winter · winter/wn-backend-module
- CVE-2026-35445Winter: Authenticated backend users can bypass Users controller permission checkswintercms winter · winter/wn-backend-module
- CVE-2026-81036Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uristalwartlabs stalwart
- CVE-2026-81035Midday Missing Owner Check on Team Deletionmidday-ai midday
- CVE-2026-81034Netmaker through 1.6.0 Improper Certificate Validation in SMTP Clientgravitl netmaker
- CVE-2026-81031IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Updateidurar-erp-crm
- CVE-2026-81030Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpointmage-ai
- CVE-2026-81029OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URIopen-metadata OpenMetadata
- CVE-2026-81027one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinningsongquanpeng one-api
- CVE-2026-80427bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiternfriedly bestzip
- CVE-2026-80426FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Descriptionvoxel51 fiftyone
- CVE-2026-54606SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe EmbedJiHong88 suneditor · suneditor
- CVE-2026-80588mptcp: reclaim forward-allocated memory on RX path errorsLinux
- CVE-2026-80584s390/qeth: validate user buffer length in SNMP and ARP query ioctlsLinux
- CVE-2026-80583ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accessesLinux
- CVE-2026-80582drm/shmem_helper: Check VMA boundaries for PMD mappingsLinux
- CVE-2026-80580fbdev: bound mode sysfs output to the sysfs bufferLinux
- CVE-2026-80579fbdev: clear fb_info->mode before deleting a videomodeLinux
- CVE-2026-80578fbdev: core: Fix pointer desynchronization in fb_io_read()Linux
- CVE-2026-80576drm/amdgpu: reject oversized IBs with per-ring packet limitsLinux
- CVE-2026-80575Input: cs40l50-vibra - validate custom data from user spaceLinux
- CVE-2026-80574Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packetLinux
- CVE-2026-80572Input: byd - synchronize timer deletion before freeing private dataLinux
- CVE-2026-80570Input: synaptics-rmi4 - zero report size on F54 work errorLinux
- CVE-2026-80569Input: synaptics-rmi4 - bound the F54 report size to the allocated bufferLinux
- CVE-2026-80568Input: synaptics-rmi4 - block s_input when F54 queue is busyLinux
- CVE-2026-80565crypto: qce - fix error path in devm_qce_register_algsLinux
- CVE-2026-80560openrisc: signal: do not restore privileged SR bits on sigreturnLinux
- CVE-2026-80559Input: sur40 - fix input device registration orderingLinux
- CVE-2026-80556mmc: atmel-mci: Fix use-after-free in atmci_remove due to race conditionLinux
- CVE-2026-80555s390/vfio_ccw: Free all memory if cp_init() failsLinux
- CVE-2026-80553s390/vfio_ccw: Cancel existing workqueuesLinux
- CVE-2026-80552s390/vfio_ccw: Ensure index for read/write regions are within rangeLinux
- CVE-2026-80550s390/vfio_ccw: Fix out of bounds check on CCW arrayLinux
- CVE-2026-80549s390/vfio_ccw: Move cp cleanup out of not operationalLinux
- CVE-2026-80548s390/vfio_ccw: Selectively expand io_mutexLinux
- CVE-2026-80547s390/vfio_ccw: Implement a crw lockLinux
- CVE-2026-80546s390/zcrypt: Improve CCA CPRB length and overflow checksLinux
- CVE-2026-80545s390/zcrypt: Improve EP11 CPRB length and overflow checksLinux
- CVE-2026-80544s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsingLinux
- CVE-2026-80541drm/amdgpu: validate GEM_CREATE domain combinationsLinux
- CVE-2026-80540drm/amdgpu: Fix UVD decode image min size calculationLinux
- CVE-2026-80538xfs: propagate errors from xfs_rtginode_loadLinux
- CVE-2026-80537xfs: fix off-by-one in rtrefcount btree root level validationLinux
- CVE-2026-80536xfs: bounds-check buffer log item's dirty bitmapLinux
- CVE-2026-80531xfs: avoid UAF on sc->tempip in xrep_tempfile_createLinux
- CVE-2026-80530xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTENLinux
- CVE-2026-80527ceph: fix hanging __ceph_get_caps() with stale mds_wantedLinux
- CVE-2026-80526ASoC: tas2562: Validate values for volume writesLinux
- CVE-2026-80523clk: spacemit: k3: set hdma clock as criticalLinux
- CVE-2026-80522crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()Linux
- CVE-2026-80521af_unix: Unlink scc_entry in unix_del_edge().Linux
- CVE-2026-80520ovpn: fix NULL dereference when killing missing keyLinux
- CVE-2026-74753perf: Reject exited events as group leadersLinux
- CVE-2026-74750ovpn: defer key slot crypto freeing to workqueueLinux
- CVE-2026-74748netfilter: ipset: fix refcount race between list:set GC and swapLinux
- CVE-2026-74747ipvs: revalidate ihl to prevent out-of-bounds accessLinux
- CVE-2026-74745eth: bnxt: avoid deadlock when canceling IRQ affinity notifierLinux
- CVE-2026-74742veth: fix queue index used to wake the peer txq in veth_pollLinux
- CVE-2026-74741net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enablingLinux
- CVE-2026-74739net/sched: cls_u32: skip hash tables in u32_bind_class()Linux
- CVE-2026-74736net/sched: cls_bpf: reject dev-bound programs bound to a different deviceLinux
- CVE-2026-54511@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keysdahlia logtape · @logtape/syslog
- CVE-2026-54550IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entriesizpack · org.codehaus.izpack:izpack-installer
- CVE-2026-54556Http4s: HTTP/2 Denial of Service with Ember Backendhttp4s · org.http4s http4s-ember-core_2.12 +5
- CVE-2026-19271Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's LiderahenkTÜBİTAK BİLGEM Software Technologies Research Institute Lid…
- CVE-2026-18252Inclusion of Functionality from Untrusted Control Sphere in GitLabGitLab
- CVE-2026-15990Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' ParameterStrategy11 Formidable Charts
- CVE-2026-75960Insufficiently Protected Credentials in Rently Smart HomeRently Smart Home
- CVE-2026-73108RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodecrustdesk
- CVE-2026-79619OpenZFS: user-namespace capability check allows unprivileged local authorization bypassOpenZFS
- CVE-2026-12587Embedded credentials in VirtuagymResamania Virtuagym
- CVE-2026-77658Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project filesGNOME Dia
- CVE-2026-15985Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP LoginRadiusTheme Classified Listing - Mobile Number Verification
- CVE-2026-77532A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwiUbiquiti EdgeMAX EdgeSwitch
- CVE-2026-80206NLTK 3.10.2 Regular Expression Denial of Service via tgrepnltk
- CVE-2026-80205NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regexnltk
- CVE-2026-80350OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URLOneUptime
- CVE-2026-80348TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete EndpointsTarsCloud TarsWeb
- CVE-2026-80347mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Bracketskazuph mcp-fetch
- CVE-2026-80346StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized ViewsStarRocks
- CVE-2026-77538A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to esUbiquiti UniFi Connect Application
- CVE-2026-18794OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwriteCalcProgrammer1 OpenRGB
- CVE-2026-19042Command Injection in TeamViewer Desktop Client for Linux through Chat Link HandlingTeamViewer Full Client · TeamViewer Host
- CVE-2026-59682Arbitrary file overwrite and deletion local and remote in OpenRGBCalcProgrammer1 OpenRGB
- CVE-2026-16444Improper Validation of File Paths in TeamViewer Desktop ClientsTeamViewer Full Client, Host, QuickSupport & Portable · Tea…
- CVE-2026-19538Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLSNLnet Labs NSD
- CVE-2026-19401Remote UDP DoS by sending multiple DNS Cookie optionsNLnet Labs NSD
- CVE-2026-18664Wrong interpretation of ACL rangesNLnet Labs NSD
- CVE-2026-80237Thinking Software Technology｜Efence - Arbitrary File UploadThinking Software Technology Efence
- CVE-2026-80236Thinking Software Technology｜Efence - SQL InjectionThinking Software Technology Efence
- CVE-2026-80233CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File UploadCAYIN Technology CAYIN CMS-WS · CAYIN Technology CAYIN C… +1
- CVE-2026-75977Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookiekitae-park Mang Board WP
- CVE-2026-18884WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameterswpgenie WooCommerce Lottery
- CVE-2026-78237Insufficient input validation in Admin By Request (ABR)Admin By Request
- CVE-2026-78236Insecure PIN derivation mechanism in Admin By Request (ABR)Admin By Request
- CVE-2026-18331Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameterstrategy11team Formidable Forms – WordPress Form Builder fo…
- CVE-2026-77693Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajaxOrder Tip for WooCommerce
- CVE-2026-75797AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' ParameterAI Engine
- CVE-2026-74928WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import RoutesProject Manager
- CVE-2026-74851Pods < 3.3.9.1 - Author+ RCE via Shortcode Display CallbackPods
- CVE-2026-19718BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key RecoveryBlogVault Backup & Staging · MalCare WordPress Security… +1
- CVE-2026-58094TOCTOU race in POSIX shared memory large page configurationFreeBSD
- CVE-2026-58093Kernel use-after-free via tty ioctlsFreeBSD
- CVE-2026-19760WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Headeremrevona WP Fastest Cache – WordPress Cache Plugin
- CVE-2026-58097ppp(8): missing length validation in mp_SetEnddisc()FreeBSD
- CVE-2026-58096ppp(8): missing length validation in LcpDecodeConfig()FreeBSD
- CVE-2026-58095ppp(8): incorrect length calculation in mp_Enddisc()FreeBSD
- CVE-2026-76148CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.SASAKI Nobuyuki CorvusSKK
- CVE-2026-58092Unauthorized credential switchingFreeBSD
- CVE-2026-58091Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctlFreeBSD
- CVE-2026-58090Use-after-free in unix SOCK_STREAM message handlingFreeBSD
- CVE-2026-58089hwpmc fails to detach PMCs during exec credential transitionsFreeBSD
- CVE-2026-54467On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, TrustedFirmware Trusted Firmware-M
- CVE-2026-29988A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecteMilesight AM102/102L · Milesight AM103/103L +62
- CVE-2026-80214LibreNMS Virtualisation Discovery Module RCElibrenms
- CVE-2020-15874An issue was discovered in LibreNMS 1.65.
- CVE-2020-15876An issue was discovered in LibreNMS 1.65.
- CVE-2020-15878An issue was discovered in LibreNMS 1.65.
- CVE-2025-29419CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.
- CVE-2025-51675An issue was discovered in openRISC OR1200 commit 83ac6b.
- CVE-2025-56798Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to
- CVE-2025-61162Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/int
- CVE-2025-61164Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.
- CVE-2025-61478An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of
- CVE-2025-61479An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of
- CVE-2025-61480An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of
- CVE-2026-26445stomper 5e2741e is vulnerable to Denial of Service.
- CVE-2026-26446Stomper 5e2741e is vulnerable to Denial of Service.
- CVE-2026-26447Stomper 5e2741e is vulnerable to Use-After-Free.
- CVE-2026-26449In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or
- CVE-2026-36851Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.
- CVE-2026-75328In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnera
- CVE-2026-75333yx-image-recognition v1.0 is vulnerable to Path Traversal.
- CVE-2026-75413DocSys V2.02.80 is vulnerable to Any File Download.
- CVE-2026-75415AntFlow V2.0.0 is vulnerable to Incorrect Access Control.
Medium, low and unrated 142
- CVE-2026-47874Reactor Netty HTTP Server Denial of Service With Pipelined RequestsSpring Reactor Netty
- CVE-2026-47861UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseSpring Integration
- CVE-2026-81421ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgeryddfourtwo sentry-selfhosted-mcp
- CVE-2026-47863Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flushSpring Reactor Core
- CVE-2026-47862ZipTransformer uses file_name header to build workDirectory path without sanitizationSpring Integration
- CVE-2026-47860Unbounded decompression of attacker-supplied compressed message bodiesSpring AMQP
- CVE-2026-47859Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoSSpring Integration
- CVE-2026-47857Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-aroundSpring Reactor Core
- CVE-2026-47856JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listSpring Integration
- CVE-2026-47850Spring Data REST allows mutation of the version property of immutable aggregates via PUTSpring Data REST
- CVE-2026-47845Reactor Netty HTTP Server may incorrectly evaluate proxy addressesSpring Reactor Netty
- CVE-2026-81203SourceCodester Simple Online Food Ordering System ajax.php login2 sql injectionSourceCodester Simple Online Food Ordering System
- CVE-2025-62341HCL Connections is vulnerable to server-side request forgery (SSRF)HCLSoftware Connections
- CVE-2026-80158Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listingsRed Hat Ceph Storage · Red Hat OpenStack Platform
- CVE-2026-69129KubePi: Insufficient per-cluster authorization checks in cluster management APIs1Panel-dev KubePi
- CVE-2026-21808HCL BigFix Quantum Risk Analyzer is affected by logging sensitive informationHCLSoftware BigFix Quantum Risk Analyzer
- CVE-2026-21807HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflowHCLSoftware BigFix Quantum Risk Analyzer
- CVE-2026-21810HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checkingHCLSoftware BigFix Quantum Risk Analyzer
- CVE-2026-45694LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameterslibrenms · librenms/librenms
- CVE-2026-81202itsourcecode Payroll System CRUD Operation ajax.php delete missing authenticationitsourcecode Payroll System
- CVE-2026-65930LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fieldsLimeSurvey
- CVE-2026-58070A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access toVeeam Backup and Replication
- CVE-2026-21809HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive informationHCLSoftware BigFix Quantum Risk Analyzer
- CVE-2026-77573Weblate: DNS rebinding in VCS operations allows server-side request forgeryWeblateOrg weblate
- CVE-2026-77507Weblate: Object-scoped RSS feeds disclose private change history to unauthorized usersWeblateOrg weblate
- CVE-2026-62326Weblate Has Uncontrolled Resource Consumption viaWeblateOrg weblate
- CVE-2026-62249Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpointWeblateOrg weblate
- CVE-2026-61790Weblate: Team-enforced 2FA is bypassed for global permissionsWeblateOrg weblate
- CVE-2026-55227Observable object existence disclosure in private Weblate projects via globally scoped object lookupsWeblateOrg weblate · weblate
- CVE-2026-71054Vulnerability in Oracle Java SE (component: 2D).Oracle Java SE
- CVE-2026-77508Weblate: Unverified REST API email changesWeblateOrg weblate
- CVE-2026-75601Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabledstatic-web-server
- CVE-2026-79939Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability.Dell Power Protect Cyber Recovery · Dell Cyber Recovery
- CVE-2026-49809Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SDell Power Protect Cyber Recovery · Dell Cyber Recovery
- CVE-2026-47848Reactor Netty WebSocket Client Leaks Credentials On RedirectSpring Reactor Netty
- CVE-2026-47844Reactor Netty HTTP Server Leaks Exception DetailsSpring Reactor Netty
- CVE-2026-47843Reactor Netty may incorrectly route traffic due to DNS resolver reuseSpring Reactor Netty
- CVE-2026-47842Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext CorrelationSpring Security
- CVE-2026-47834Spring Data JPA Sort expression validation bypassSpring Data JPA
- CVE-2026-74771Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability.Dell PowerProtect One
- CVE-2026-46371Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-74774Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability.Dell PowerProtect One
- CVE-2026-67275Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability.Dell PowerProtect One
- CVE-2026-56547An input reflection vulnerability affects HCL TravelerHCLSoftware Traveler
- CVE-2026-46370Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-71172Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability.Dell Cloud Disaster Recovery
- CVE-2026-41262Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpointfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-48786Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpointfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-79940Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability.Dell iDRAC9
- CVE-2026-63179Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assetswintercms winter · winter/wn-backend-module
- CVE-2026-54256Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadatawintercms winter · winter/wn-backend-module
- CVE-2026-32639Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploadswintercms winter · winter/wn-cms-module
- CVE-2026-32593Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjaxwintercms winter · winter/wn-backend-module
- CVE-2026-47837Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook RequestsSpring Cloud Config
- CVE-2026-81033Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancyautomatisch
- CVE-2026-81028ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix CollisionZLMediaKit
- CVE-2026-48549Nagios Core / XI CSRF via cmd.cgi Double-Submit CookieNagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…
- CVE-2026-48548Nagios Core CSRF via cmd.cgiNagios Enterprises, LLC. Nagios Core
- CVE-2026-54614DebugKit: MailPreview contains unsafe reflectioncakephp debug_kit · cakephp/debug_kit
- CVE-2026-80581ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeoutLinux
- CVE-2026-80577drm/panthor: skip zero-sized firmware sectionsLinux
- CVE-2026-80573Input: iforce - validate input packet lengthsLinux
- CVE-2026-80571powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leakLinux
- CVE-2026-80567Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queueLinux
- CVE-2026-80566Input: hynitron_cstxxx - validate touch count and finger IDsLinux
- CVE-2026-80564gve: fix NULL dereference due to missing ptp adjfineLinux
- CVE-2026-80563gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbindLinux
- CVE-2026-80562gpio: ml-ioh: use raw_spinlock_t for the register lockLinux
- CVE-2026-80543s390/zcrypt: Pad trailing CCA or EP11 message with zerosLinux
- CVE-2026-80542drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()Linux
- CVE-2026-80539drm/amdgpu: disallow multiple FENCE chunks in one submitLinux
- CVE-2026-80535xfs: don't double-lock when deleting a self-referential directoryLinux
- CVE-2026-80534xfs: fix ilock leak on error in xfs_dq_get_next_idLinux
- CVE-2026-80533xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repairLinux
- CVE-2026-80532xfs: fix another iunlink infinite loop bug in online fsckLinux
- CVE-2026-80529xfs: don't swallow dquot recovery verification errorsLinux
- CVE-2026-80525ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setupLinux
- CVE-2026-80524optee: ffa: Add NULL check in optee_ffa_lend_protmemLinux
- CVE-2026-74754scsi: core: pair EH runtime PM get and putLinux
- CVE-2026-74749rseq: Prevent hard lockup on granted time slice extensionLinux
- CVE-2026-74740net/sched: act_api: fix TOCTOU NULL deref on a->goto_chainLinux
- CVE-2026-74738regmap: sdw-mbq: don't call an unset readable_reg callbackLinux
- CVE-2026-74735l2tp: fix tunnel and session refcount leak on seq_file releaseLinux
- CVE-2026-74734firewire: ohci: fix NULL pointer dereference in ar_context_releaseLinux
- CVE-2026-54548kas: Persistent SSH Host Key Checking Disablementsiemens kas · kas
- CVE-2026-54553Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoSjowilf starlette-admin · starlette-admin
- CVE-2026-13481Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTPzephyrproject zephyr
- CVE-2026-13480Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handlerzephyrproject zephyr
- CVE-2026-13479Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handlerzephyrproject zephyr
- CVE-2025-10903Loop with Unreachable Exit Condition ('Infinite Loop') in GitLabGitLab
- CVE-2026-3035Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-7487Access Control Check Implemented After Asset is Accessed in GitLabGitLab
- CVE-2026-15387Acceptance of Extraneous Untrusted Data With Trusted Data in GitLabGitLab
- CVE-2026-77801Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-79902Gimp: stack vla size underflow denial of service in seattleGNOME GIMP · Red Hat Enterprise Linux
- CVE-2026-73102RustDesk Path Traversal via macOS Clipboard File-Pasterustdesk
- CVE-2026-63041Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headersApache Software Foundation Apache APISIX
- CVE-2026-3235WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Accesspeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-5092Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URIwpsoul Greenshift – animation and page builder blocks
- CVE-2026-2388Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodesdesignextreme Reviews and Rating – Google Reviews
- CVE-2026-19197Broken access control in dashboard snapshotsGrafana OSS · Grafana Enterprise
- CVE-2026-18916Remote TCP DoS by throttling the TCP receive windowNLnet Labs NSD
- CVE-2026-80234CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing AuthenticationCAYIN Technology CAYIN CMS-WS · CAYIN Technology CAYIN CMS-…
- CVE-2026-9668SQL injection vulnerability in ZTE SCP productZTE SCP
- CVE-2026-6178Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' ShortcodeMuffinGroup Betheme
- CVE-2026-58108Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDBEricsson CodeChecker
- CVE-2026-15366A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the pagevivo Kids Mode
- CVE-2026-15365A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.vivo Kids Mode
- CVE-2026-3002Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocksjegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…
- CVE-2026-78146Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions PageSimple Newsletter Plugin
- CVE-2026-77790RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' ParameterRegistrationMagic
- CVE-2026-77789Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDORStripe Payment Forms by WP Full Pay
- CVE-2026-77758Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed SessionStripe Payment Forms by WP Full Pay
- CVE-2026-77757Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing SubmissionDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-77754Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apisKirki
- CVE-2026-77695Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and ManipulationReturn Refund and Exchange For WooCommerce
- CVE-2026-77694Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_tokenEventin
- CVE-2026-75798AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor AssistantAI Engine
- CVE-2026-74930WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDORProject Manager
- CVE-2026-74929WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDORProject Manager
- CVE-2026-19226Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect SettingsRoyal Addons for Elementor
- CVE-2026-19220Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege EscalationForminator Forms
- CVE-2026-19094Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' ParametersTutor LMS
- CVE-2026-16986Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost ParametersBooking Package
- CVE-2026-16984WP Legal Pages < 3.7.1 - Unauthenticated API Secret DisclosurePrivacy Policy Generator, Terms & Conditions, GDPR, CCPA, C…
- CVE-2026-14550WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing AuthorizationWPCafe
- CVE-2026-14216Amelia < 2.4.7 - Unauthenticated Notification Queue DispatchBooking for Appointments and Events Calendar
- CVE-2026-14212Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDORBooking for Appointments and Events Calendar
- CVE-2026-13406Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosureRoyal Addons for Elementor
- CVE-2026-13404Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_initRoyal Addons for Elementor
- CVE-2026-13172Eventin < 4.1.22 - Unauthenticated Unpublished Content DisclosureEventin
- CVE-2026-79654Ketello: katello content view history api cross-organization authorization bypassRed Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3
- CVE-2026-76149CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file.SASAKI Nobuyuki CorvusSKK
- CVE-2026-73335Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939).Digital Agency Android App "Myna Point"
- CVE-2026-9805FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer OverflowInsyde Software InsydeH2O
- CVE-2025-70340A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionali
- CVE-2026-39275Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, f
- CVE-2026-52473An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessB
- CVE-2026-75331tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS.
- CVE-2026-75363An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config,
- CVE-2026-75364Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to saniti
- CVE-2026-75466libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader.