CVEs published August 28, 2026
496 CVEs were published on August 28, 2026: 63 critical, 204 high. 3 are now in CISA KEV.
- Published
- 496
- Critical
- 63
- High
- 204
- Medium
- 153
- Low
- 16
- Unrated
- 60
- Now in CISA KEV
- 3
- Fix available
- 268
Most affected products
- Linux
- 135
- Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- 24
- yamcs · org.yamcs:yamcs-core
- 9
- budibase server
- 8
- IBM Langflow OSS
- 8
- Microsoft Edge
- 8
- PLANET Technology PLANET GS-4210-16P2S
- 8
- MongoDB BI Connector
- 6
- sveltejs kit · @sveltejs/kit
- 6
- go-vikunja vikunja · code.vikunja.io/api
- 5
Critical 63
- CVE-2026-3627Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-19295Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementIBM Langflow OSS
- CVE-2026-19286Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementIBM Langflow OSS
- CVE-2026-18527IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].IBM Administration Runtime Expert for i
- CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Namepimcore · pimcore/pimcore
- CVE-2026-55220Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store columnpimcore · pimcore/pimcore
- CVE-2026-55247plone.app.event: Denial of service via iCalendar importplone.app.event · plone-app-event
- CVE-2026-82021Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch ReferenceNousResearch hermes-agent
- CVE-2026-55248plone.app.portlets: Denial of service via RSS feed portletplone.app.portlets · plone-app-portlets
- CVE-2026-82329Potential authentication bypass leading to administrative access in Artifactoryjfrog artifactory
- CVE-2026-55378JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context valuesshriyanss js-recon
- CVE-2026-55565Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)yamcs · org.yamcs:yamcs-core
- CVE-2026-55559Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)yamcs · org.yamcs:yamcs-core
- CVE-2026-55511Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`yamcs · org.yamcs:yamcs-core
- CVE-2026-55068free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpointsfree5gc · github.com/free5gc/free5gc
- CVE-2026-54755Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)klever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-54754Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)klever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-82281Kotaemon Missing Ownership Check in Conversation FunctionsCinnamon kotaemon
- CVE-2026-82277Argo Rollouts Dashboard Unauthenticated Mutating Operationsargoproj argo-rollouts
- CVE-2026-82266Redpanda Admin API Unauthenticated Superuser Access via Default Configurationredpanda-data redpanda
- CVE-2026-54745Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=truekubeflow pipelines
- CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorPaperCut MF/NG
- CVE-2026-82244Budibase before 3.41.3 Remote Code Execution via Plugin eval()budibase server
- CVE-2026-82222WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerabilityLiquid Web / StellarWP GiveWP
- CVE-2026-42007An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-18918OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed defaultEclipse Foundation Eclipse Lyo
- CVE-2026-40541An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat SerSynology Chat Server
- CVE-2026-80714ipvs: do not propagate one-packet flag to synced connsLinux
- CVE-2026-80694net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controllerLinux
- CVE-2026-80693idpf: bound interrupt-vector register fill to the allocated arrayLinux
- CVE-2026-80684KVM: s390: pci: Fix NULL dereference on AIBV allocation failureLinux
- CVE-2026-80681vxlan: re-fetch eth header after route_shortcircuit()Linux
- CVE-2026-80674ntfs: validate resident attribute lists and harden the validatorLinux
- CVE-2026-80673ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()Linux
- CVE-2026-80671perf sched: Fix register_pid() overflow, strcpy, and BUG_ONLinux
- CVE-2026-80670perf tools: Use perf_env__get_cpu_topology() in machine__resolve()Linux
- CVE-2026-80668netfilter: nf_conntrack_expect: use conntrack GC to reap expectationsLinux
- CVE-2026-80634netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untagLinux
- CVE-2026-80630net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlenLinux
- CVE-2026-80617net: airoha: fix foe_check_time allocation sizeLinux
- CVE-2026-80612net: lwtunnel: Drop skb metadata before LWT encapsulationLinux
- CVE-2026-80609qede: fix out-of-bounds check for cqe->len_list[]Linux
- CVE-2026-80603netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB readLinux
- CVE-2026-80600batman-adv: dat: acquire ARP hw source only after skb reallocLinux
- CVE-2026-76581WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusionwpmudev WPMU DEV Dashboard
- CVE-2026-78032SOY CMS contains an issue with deserialization of untrusted data.Tsuyoshi Saito SOY CMS
- CVE-2026-82090Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.getpocket Pocket
- CVE-2026-82082Green-Computing｜NUMail - OS Command InjectionGreen-Computing NUMail
- CVE-2026-37236grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control.
- CVE-2026-37751An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac
- CVE-2026-51611Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrari
- CVE-2026-51622Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN confi
- CVE-2026-51626Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS c
- CVE-2026-51628Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to gene
- CVE-2026-51636Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-
- CVE-2026-51643Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP confi
- CVE-2026-51645Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the
- CVE-2026-51646Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain pa
- CVE-2026-51649Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain dia
- CVE-2026-51657Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain syslog
- CVE-2026-51660Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtai
- CVE-2026-51661Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51663Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger w
High 204
- CVE-2026-55848mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain typesmapfish-print · org.mapfish.print.print-lib +4
- CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIfree5gc · github.com/free5gc/ausf
- CVE-2026-55841Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original messagegraylog2-server · org.graylog2:graylog2-server
- CVE-2026-55764Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-82017IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration AreaIGEL OS
- CVE-2026-18904Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesIBM Langflow OSS
- CVE-2026-18899Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesIBM Langflow OSS
- CVE-2026-18891Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesIBM Langflow OSS
- CVE-2026-18729Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementIBM Langflow OSS
- CVE-2026-17203IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].IBM Administration Runtime Expert for i
- CVE-2026-16821Vulnerabilities in IBM AIX and PowerVM VIOSIBM AIX · IBM PowerVM VIOS
- CVE-2026-75118http_gdpr_decrypt Pre-Authentication Stack-Based Buffer OverflowTP-Link Systems TL-MR100
- CVE-2026-55763Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splitsklever-io klever-go · github.com/klever-io/klever-go
- CVE-2026-81532BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory CorruptionMongoDB BI Connector ODBC Driver
- CVE-2026-81520MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection ExhaustionMongoDB BI Connector
- CVE-2026-81518BI Connector Optional Client Certificate Verification Allows Unauthenticated ConnectionsMongoDB BI Connector
- CVE-2026-81517MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL ServiceMongoDB BI Connector
- CVE-2026-82333multer vulnerable to Denial of Service via oversized array index in field namesmulter
- CVE-2026-81490MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL ServiceMongoDB BI Connector
- CVE-2026-77078multer vulnerable to Denial of Service via crafted multipart field namesmulter
- CVE-2026-77037multer vulnerable to Denial of Service via file descriptor leak on aborted uploadsmulter
- CVE-2026-77586MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE OutputMongoDB BI Connector
- CVE-2026-55484ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire serverguno1928 alos-http · github.com/guno1928/alos-http
- CVE-2026-55215MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`mariadb-corporation mariadb-connector-nodejs · mariadb
- CVE-2026-82020Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write ToolNousResearch hermes-agent
- CVE-2026-55520Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matchingscrapy protego · protego
- CVE-2026-55673PowSyBl: Command Injection in LocalCommandExecutor-spowsybl-core · com.powsybl:powsybl-computation-local
- CVE-2026-55584phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headersphpsysinfo · phpsysinfo/phpsysinfo
- CVE-2026-55245Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURLmaximhq bifrost · github.com/maximhq/bifrost/core
- CVE-2026-55485Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.piccolo-orm piccolo_admin · piccolo-admin
- CVE-2026-55509WsgiDAV: Blind SQL injection in the MySQL providermar10 wsgidav · wsgidav
- CVE-2026-81849Path traversal in the aws:downloadContent plugin in amazon-ssm-agentamazon-ssm-agent
- CVE-2026-56100SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign EndpointSpringBlade
- CVE-2026-72984Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-55552Yamcs: Unauthenticated Directory Traversalyamcs · org.yamcs:yamcs-core
- CVE-2026-55521Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core APIyamcs · org.yamcs:yamcs-core
- CVE-2026-77939Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpointflextype
- CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/apigo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-54788dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoSDataDog dd-trace-rs · datadog-opentelemetry
- CVE-2026-82291HeyForm Reflects Any Origin in CORS Responses While Allowing Credentialsheyform
- CVE-2026-82289Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosurecoderamp-labs gitingest
- CVE-2026-82288Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flagsAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-82287Rybbit Reflects Any Origin in CORS Responses While Allowing Credentialsrybbit-io rybbit
- CVE-2026-82286gpt-crawler Arbitrary File Write via outputFileName ParameterBuilderIO gpt-crawler
- CVE-2026-82285BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callbackdataelement bisheng
- CVE-2026-82284Quivr Chat Endpoints Missing Ownership ValidationQuivrHQ quivr
- CVE-2026-82283VoltAgent Memory API Handlers Missing Ownership Checksvoltagent
- CVE-2026-82282Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callersrunatlantis atlantis
- CVE-2026-82280Quivr Prompt Endpoints Missing Ownership ValidationQuivrHQ quivr
- CVE-2026-82279HyperDX Team Management Operations Missing Role-Based Access Controlhyperdxio hyperdx
- CVE-2026-82278BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_oncedataelement bisheng
- CVE-2026-82275Qwen-Agent Arbitrary File Read via Caller-Supplied Document PathQwenLM Qwen-Agent
- CVE-2026-82273Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unsetmastra-ai mastra
- CVE-2026-82272Immich Locked Assets Remain Readable Through Albums and Shared Linksimmich-app immich
- CVE-2026-82271R2R Missing Ownership Check Allows Modifying Other Users' ConversationsSciPhi-AI R2R
- CVE-2026-82270Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*Portkey-AI gateway
- CVE-2026-82269Gophish Account Lockout and Forced Password Change Bypassable via API Keygophish
- CVE-2026-82268Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URLQwenLM Qwen-Agent
- CVE-2026-82263Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URLlogto-io logto
- CVE-2026-82262Logto Server-Side Request Forgery via webhook test endpointlogto-io logto
- CVE-2026-55108KubeVela Terraform remote loader DoS via unbounded file readkubevela · github.com/oam-dev/kubevela
- CVE-2026-75486Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Namesnyk sweater-comb
- CVE-2026-75124PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParamPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-75123PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_postPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-75122PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgiPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-75121PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_postPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-56854Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/sshgolang.org/x/crypto/ssh · golang.org/x/crypto
- CVE-2026-81020wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 recordwolfSSL wolfEngine
- CVE-2026-81019wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 recordwolfSSL wolfProvider
- CVE-2026-81767WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerabilityyalla ya! Simple Payment
- CVE-2026-81760WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2026-81757WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerabilityRank Math SEO
- CVE-2026-81285WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerabilityWPMU DEV Smush Image Compression and Optimization
- CVE-2026-82227WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerabilityVillaTheme WPBulky
- CVE-2026-19412Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S RouterCP Plus CP-XR-DE21-S Router
- CVE-2026-13761Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.Pegasystems Pega Infinity
- CVE-2026-81578PaperCut MF/NG: Authentication BypassPaperCut MF/NG
- CVE-2026-6176Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Formivole Customer Reviews for WooCommerce
- CVE-2026-5934WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon EndpointWP Media WP Rocket
- CVE-2026-82261SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserializationsveltejs kit · @sveltejs/kit
- CVE-2026-82260SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserializationsveltejs kit · @sveltejs/kit
- CVE-2026-82259SvelteKit 2.49.0 before 2.53.3 Denial of Service via formsveltejs kit · @sveltejs/kit
- CVE-2026-82255gitoxide 0.25.4 HTTP Credential Leak via RedirectGitoxideLabs gitoxide · gix-transport
- CVE-2026-82254gitoxide before 0.69.0 Denial of Service via gix-packGitoxideLabs gitoxide · gix-pack
- CVE-2026-82253gitoxide before 0.82.0 Path Traversal via Submodule Name Validation BypassGitoxideLabs gitoxide · gix +1
- CVE-2026-82252gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesGitoxideLabs gitoxide · gitoxide +1
- CVE-2026-82251gitoxide before 0.52.1 Path Traversal via Submodule NameGitoxideLabs gitoxide · gitoxide +1
- CVE-2026-82250gitoxide gix-packetline before 0.21.5 Denial of ServiceGitoxideLabs gitoxide · gix-packetline
- CVE-2026-82247gitoxide before 0.37.1 HTTP Basic credential leak via URL parsingGitoxideLabs gitoxide
- CVE-2026-82246Budibase Server before 3.41.3 SSRF via Query Importbudibase server
- CVE-2026-82245Budibase before 3.41.3 Missing Authorization License Managementbudibase server
- CVE-2026-82243Budibase Server before 3.41.3 SSRF with Credential Leakagebudibase server
- CVE-2026-82242Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorizationbudibase server
- CVE-2026-82241Budibase backend-core SSRF via incomplete default blacklistbudibase server
- CVE-2026-82240Budibase before 3.41.3 Privilege Escalation via User Update APIbudibase server
- CVE-2026-82239Budibase before 3.41.3 Authorization Bypass via datasources/querybudibase server
- CVE-2026-82235filebrowser through 2.63.23 Denial of Service via named pipesfilebrowser
- CVE-2026-82234SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOUsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-73208An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a sOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-42391An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40018None None None No publicly available exploits are known.Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-33605An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating.Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-27852An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parametersOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-78071Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0digital-peak.com DP Calendar extension for Joomla
- CVE-2026-78072Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1Jefferson49 Sexy Polling Reloaded extension for Joomla
- CVE-2026-80724ptp: vmclock: prevent read-only mappings from becoming writableLinux
- CVE-2026-80723of: reserved_mem: prevent OOB when too many dynamic regions are definedLinux
- CVE-2026-80722wifi: mac80211: validate individual TWT params before driver setupLinux
- CVE-2026-80721Bluetooth: ISO: ensure no dangling hcon references in iso_connLinux
- CVE-2026-80720iomap: add a separate bio_set for iomap_split_ioendLinux
- CVE-2026-80718mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()Linux
- CVE-2026-80717sctp: validate Adaptation Indication parameter lengthLinux
- CVE-2026-80716ALSA: pcm: wake linked drain waiters on unlinkLinux
- CVE-2026-80713io_uring: preserve task restrictions across execLinux
- CVE-2026-80712spi: spi-qpic-snand: write the feature value before executing SET_FEATURELinux
- CVE-2026-80710s390/dasd: Fix undersized format-check bufferLinux
- CVE-2026-80709s390/zcrypt: Fix wrong domain value verification with EP11 CPRBsLinux
- CVE-2026-80707can: j1939: transport: j1939_session_fresh_new(): initialize receive bufferLinux
- CVE-2026-80706can: softing: fw_parse(): validate firmware record spansLinux
- CVE-2026-80702drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as sizeLinux
- CVE-2026-80700drm/vmwgfx: validate external BO copy bounds for both stride pathsLinux
- CVE-2026-80696hwmon: (ltc4282) Fix reading the minimum alarm voltageLinux
- CVE-2026-80692Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacksLinux
- CVE-2026-80691scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASELinux
- CVE-2026-80685mm/util: don't read __page_2 for order-1 folios in snapshot_page()Linux
- CVE-2026-80683Bluetooth: SCO: give the socket its own sco_conn referenceLinux
- CVE-2026-80682riscv/mm: use physical alignment for vmemmap_start_pfnLinux
- CVE-2026-80680i2c: amd-mp2: Unregister callback on adapter add failureLinux
- CVE-2026-80678i2c: imx: Fix slave registration race and error handlingLinux
- CVE-2026-80677driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()Linux
- CVE-2026-80675libbpf: Reject non-exclusive metadata maps in the signed loaderLinux
- CVE-2026-80672ntfs: fix u16 truncation of restart-area length checkLinux
- CVE-2026-80665KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFNLinux
- CVE-2026-80664netfilter: xt_nat: reject unsupported target familiesLinux
- CVE-2026-80663tools/power/x86/intel-speed-select: Harden daemon pidfile openLinux
- CVE-2026-80662cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability sizeLinux
- CVE-2026-80661ufs: core: tracing: Do not dereference pointers in TP_printk()Linux
- CVE-2026-80656hfsplus: Add a sanity check for btree node sizeLinux
- CVE-2026-80653scsi: hisi_sas: Add slave_destroy interface for v3 hwLinux
- CVE-2026-80649firmware: arm_scmi: Fix OOB in scmi_power_name_get()Linux
- CVE-2026-80646ipv6: guard against possible NULL deref in __in6_dev_stats_get()Linux
- CVE-2026-80645rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()Linux
- CVE-2026-80638ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extentLinux
- CVE-2026-80637netfilter: synproxy: fix unaligned memory access in timestamp adjustmentLinux
- CVE-2026-80635wifi: wcn36xx: fix OOB read from short trigger BA firmware responseLinux
- CVE-2026-80633iommufd: Take dma_resv lock before dma_buf_unpin() in release pathLinux
- CVE-2026-80631btrfs: lzo: reject compressed segment that overflows the compressed inputLinux
- CVE-2026-80628ALSA: seq: oss: Serialize readq reset state with q->lockLinux
- CVE-2026-80622char: tlclk: fix use-after-free in tlclk_cleanup()Linux
- CVE-2026-80619apparmor: fix potential UAF in aa_replace_profilesLinux
- CVE-2026-80615net: dst_metadata: fix false-positive memcpy overflow in tun_dst_uncloneLinux
- CVE-2026-80614net: emac: Fix NULL pointer dereference in emac_probeLinux
- CVE-2026-80613veth: fix NAPI leak in XDP enable error pathLinux
- CVE-2026-80608accel/amdxdna: Fix iommu domain lifetime race during device removalLinux
- CVE-2026-80606drm/xe/userptr: Hold notifier_lock for write on inject test pathLinux
- CVE-2026-80604HID: core: Fix OOB read in hid_get_report for numbered reportsLinux
- CVE-2026-80601batman-adv: gw: acquire ethernet header only after skb reallocLinux
- CVE-2026-80599batman-adv: dat: ensure accessible eth_hdr proto fieldLinux
- CVE-2026-80598ntfs3: fix out-of-bounds read in decompress_lzntLinux
- CVE-2026-80596Input: ims-pcu - only expose sysfs attributes on control interfaceLinux
- CVE-2026-80593hwmon: (asus_atk0110) Check package count before accessing elementLinux
- CVE-2026-80591f2fs: fix listxattr handling of corrupted xattr entriesLinux
- CVE-2026-5097wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parametertomdever wpForo Forum
- CVE-2026-6286Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submissionmelograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-80590inet: frags: strip GSO state from fragments before reassemblyLinux
- CVE-2026-79996User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login SettingsUser Registration & Membership
- CVE-2026-19423Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile FormsUltimate Member
- CVE-2026-19084Shared Files < 1.7.70 - Unauthenticated Arbitrary File Readshared-files-pro
- CVE-2026-14558WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form BuilderUser Frontend
- CVE-2026-18983One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameteronedesigns One User Avatar | User Profile Picture
- CVE-2026-18324Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Fieldwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-18978LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Contentlitespeedtech LiteSpeed Cache
- CVE-2026-82089The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a wallabag android-app
- CVE-2026-77365Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) ParameterOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-76053TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parsercozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-38822In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulneopenNDS
- CVE-2026-38821A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal netopenNDS
- CVE-2026-38820openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on openNDS
- CVE-2026-37237vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.
- CVE-2026-37736An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a
- CVE-2026-38636An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafte
- CVE-2026-38638An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafte
- CVE-2026-50979A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated atta
- CVE-2026-51615Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addre
- CVE-2026-51616Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN add
- CVE-2026-51617Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sen
- CVE-2026-51618Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup
- CVE-2026-51619Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain onl
- CVE-2026-51620Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain netwo
- CVE-2026-51621Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitiv
- CVE-2026-51623Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS
- CVE-2026-51624Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain a
- CVE-2026-51625Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sens
- CVE-2026-51627Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain IPTV and
- CVE-2026-51641Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain m
- CVE-2026-51642Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51644Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud
- CVE-2026-51647Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cloud re
- CVE-2026-51648Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN info
- CVE-2026-51650Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain remote
- CVE-2026-51658Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DMZ confi
- CVE-2026-51659Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain D
- CVE-2026-51662Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obt
Medium, low and unrated 229
- CVE-2026-55860MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)mariadb-corporation mariadb-connector-r2dbc · org.mariad… +1
- CVE-2026-55859MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbmariadb-corporation mariadb-connector-r2dbc · org.mariad… +1
- CVE-2026-55858MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-clientmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-55857MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentialsmariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-55856MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshakemariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…
- CVE-2026-55785free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAfree5gc · github.com/free5gc/ausf
- CVE-2026-55779Silverstripe Versioned: XSS in archive admin restoresilverstripe-versioned · silverstripe/versioned
- CVE-2026-55867Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensgraylog2-server · org.graylog2:graylog2-server
- CVE-2026-55855MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsmariadb-corporation mariadb-connector-nodejs · mariadb
- CVE-2026-55854MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadbmariadb-corporation mariadb-connector-nodejs · mariadb
- CVE-2026-22056CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)NetApp StorageGRID
- CVE-2026-82018IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf FileIGEL OS
- CVE-2026-3686Vulnerabilities exists in IBM Cloud Pak for Data SystemIBM Cloud Pak for Data System
- CVE-2026-19294Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesIBM Langflow OSS
- CVE-2026-18545Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilitiesIBM Langflow OSS
- CVE-2025-64649Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-36290IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service componentIBM Integrated Analytics System
- CVE-2025-36271IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto componentIBM Integrated Analytics System
- CVE-2026-13735WireGuard keepalive transport-data messages accepted without Poly1305 authenticationzephyrproject zephyr
- CVE-2026-13734Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijackzephyrproject zephyr
- CVE-2026-55678Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unsetBasekick-Labs arc · github.com/basekick-labs/arc
- CVE-2026-81533MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT ValuesMongoDB BI Connector ODBC Driver
- CVE-2026-55891PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URIPrivateBin · privatebin/privatebin
- CVE-2026-55696PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionPrivateBin · privatebin/privatebin
- CVE-2026-76651Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841NTP-Link System TL-WR841N
- CVE-2026-76650Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841NTP-Link System TL-WR841N
- CVE-2026-76649Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841NTP-Link System TL-WR841N
- CVE-2026-77063multer vulnerable to file size limit bypass via async fileFilter race conditionmulter
- CVE-2026-77184MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE OutputMongoDB BI Connector
- CVE-2026-76798MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML ReportsMongoDB BI Connector Transition Readiness Report
- CVE-2026-76797MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated ReportsMongoDB BI Connector Transition Readiness Report
- CVE-2026-76794MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database MetadataMongoDB BI Connector Transition Readiness Report
- CVE-2026-55425Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fieldsgraylog2-server · org.graylog2:graylog2-server
- CVE-2026-70309Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2026-66798Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-66324Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-66323Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2026-62904Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-58616Copilot Chat (Microsoft Edge) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2026-70331Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft Edge
- CVE-2026-55566Yamcs: DOM XSS in Extension Routingyamcs · org.yamcs:yamcs-core
- CVE-2026-55549Yamcs: Reflected XSS in the URL of the Authorize Endpointyamcs · org.yamcs:yamcs-core
- CVE-2026-55547Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configurationyamcs · org.yamcs:yamcs-core
- CVE-2026-55545Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforceyamcs · org.yamcs:yamcs-core
- CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-55064Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0go-vikunja vikunja · code.vikunja.io/api
- CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent projectgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-55834Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=nonepocket-id · github.com/pocket-id/pocket-id/backend
- CVE-2026-55569aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directoryaquaproj aqua · github.com/aquaproj/aqua +1
- CVE-2026-82343Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handlingGNOME GIMP · Red Hat Enterprise Linux
- CVE-2026-82306StarRocks Query Detail Endpoint Returns Every User's Query Historystarrocks
- CVE-2026-82290Chainlit Feedback Endpoints Missing Ownership Validationchainlit
- CVE-2026-82276StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gatestarrocks
- CVE-2026-82274Twenty Open Redirect via OAuth Propagator Callbacktwentyhq twenty
- CVE-2026-82267Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Checkmoghtech komodo
- CVE-2026-82265Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposureopenzipkin zipkin
- CVE-2026-82264Duplicacy Path Traversal during Restore via Unsanitized Snapshot Pathsgilbertchen duplicacy
- CVE-2026-54746Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribehatchet-dev hatchet · github.com/hatchet-dev/hatchet
- CVE-2026-77218PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Credential HandlersPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-77217PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS HandlersPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-75126PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Standard HandlersPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-75125PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmtip_postPLANET Technology PLANET GS-4210-16P2S
- CVE-2026-4378Stored XSS in Akıllı Ticaret's E-Commerce PackAkilli Ticaret Software Technologies E-Commerce Pack
- CVE-2026-82330Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds checkGNOME GIMP · Red Hat Enterprise Linux
- CVE-2026-81341wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 recordswolfSSL wolfEngine
- CVE-2026-82220WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerabilityWPMU DEV Forminator
- CVE-2026-81761WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerabilityMagepeople WpEvently
- CVE-2026-81759WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerabilityMagepeople WpEvently
- CVE-2026-81299WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerabilityAhmad WP Job Portal
- CVE-2026-81284WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerabilityACF Extended
- CVE-2026-82328Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette countGNOME GIMP · Red Hat Enterprise Linux
- CVE-2026-82327Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist dataRed Hat Enterprise Linux · Red Hat Hardened Images +3
- CVE-2026-5953Reflected XSS in Ceviz Informatics's Web DesignCeviz Informatics Web Design
- CVE-2026-5800Reflected XSS in Dayneks Software's E-Commerce PlatformDayneks Software Industry and Trade E-Commerce Platform
- CVE-2026-82324Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0GNOME GIMP · Red Hat Enterprise Linux
- CVE-2026-15603morgan vulnerable to Log Forging via unescaped Unicode line separatorsmorgan
- CVE-2026-58107Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRunEricsson CodeChecker
- CVE-2026-58106Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocationEricsson CodeChecker
- CVE-2026-82181Le-yan｜Medical Practice Management System - Sensitive Data in URLLe-yan Medical Practice Management System
- CVE-2026-82112houtini-ai houtini-lm code_task_files index.ts path traversalhoutini-ai houtini-lm
- CVE-2026-5096Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-3423Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Descriptionsmub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2026-75758Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixirelixir-lang elixir
- CVE-2026-82111iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversaliswalle getnote-mcp
- CVE-2026-82258SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchsveltejs kit · @sveltejs/kit
- CVE-2026-82257SvelteKit before 2.69.1 Prototype Pollution via File Inputsveltejs kit · @sveltejs/kit
- CVE-2026-82256SvelteKit before 2.69.1 Denial of Service via Remote Formsveltejs kit · @sveltejs/kit
- CVE-2026-82249gitoxide before 0.38.2 Credential Helper Protocol Field InjectionGitoxideLabs gitoxide
- CVE-2026-82248gitoxide before 0.33.0 Path Traversal via symlink followingGitoxideLabs gitoxide
- CVE-2026-82238filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploadsfilebrowser
- CVE-2026-82237filebrowser through 2.63.23 Stale Share Link via File Renamefilebrowser
- CVE-2026-82236File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletionfilebrowser
- CVE-2026-82233SiYuan before v3.8.1 Path Traversal via asset.uploadsiyuan-note siyuan · github.com/siyuan-note/siyuan/kernel
- CVE-2026-81733WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.phpWWBN AVideo
- CVE-2026-81732WWBN AVideo through 30.0 Information Disclosure via report4.json.phpWWBN AVideo
- CVE-2026-73209An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash.Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-52687An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a largeOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-52681Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedlyOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-42395A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following logOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-42393The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret.Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-42392An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the erOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-42008Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a vaOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40205An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requiOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40204None None None No publicly available exploits are known.Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40203When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40019An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop cOpen-Xchange OX Dovecot CE
- CVE-2026-40017An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makeOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40015An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermitOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40014An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the sOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-40013An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-33607An attacker that has valid credentials can use IMAP LIST command to consume CPU.Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-33606Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync witOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-33604An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending iOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-33263When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor haOpen-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE
- CVE-2026-81777WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2026-18393Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursorRed Hat Enterprise Linux AI (RHEL AI) · Red Hat OpenShift AI
- CVE-2026-78073Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0mrvinoth.com All Video Share extension for Joomla
- CVE-2026-78070Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2digital-peak.com DP Calendar extension for Joomla
- CVE-2026-5510GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2026-6128All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameterservmask All-in-One WP Migration Unlimited Extension
- CVE-2026-9548An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat SerSynology Chat Server
- CVE-2026-9491A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users toSynology Chat Server
- CVE-2026-82123WordPress Loops & Logic - Reflected XSSTangible Loops & Logic
- CVE-2026-80719mm: mglru: fix stale batch updates after memcg reparentingLinux
- CVE-2026-80715igc: remove napi_synchronize() in igc_down()Linux
- CVE-2026-80711power: supply: max17040: handle missing status supplierLinux
- CVE-2026-80708s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()Linux
- CVE-2026-80705drm/amd/display: check if dml21_add_phantom_plane() is successfulLinux
- CVE-2026-80704drm/amd/display: use proper context for loggingLinux
- CVE-2026-80703drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLELinux
- CVE-2026-80701drm/vmwgfx: enforce cursor size limits for MOB cursorsLinux
- CVE-2026-80699KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested contextLinux
- CVE-2026-80698dmaengine: idxd: fix double free of wq, engine, and group structsLinux
- CVE-2026-80697erofs: ensure valid f_path for page cache sharingLinux
- CVE-2026-80695hwmon: (sht3x) Fix unaligned accessesLinux
- CVE-2026-80690scsi: ufs: core: Initialize hba->rpmbs list in ufshcdLinux
- CVE-2026-80689tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functionsLinux
- CVE-2026-80688riscv: drop __init from vec_check_unaligned_access_speed_all_cpusLinux
- CVE-2026-80687iommufd/viommu: Release the igroup lock on the vdevice_size error pathLinux
- CVE-2026-80686mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTELinux
- CVE-2026-80679s390/dasd: Fix potential NULL pointer dereferenceLinux
- CVE-2026-80676Drivers: hv: vmbus: use generic driver_override infrastructureLinux
- CVE-2026-80669bpf: Disable xfrm_decode_session hook attachmentLinux
- CVE-2026-80667net/mlx5: LAG, MPESW, Fix missing complete() on devcom errorLinux
- CVE-2026-80666Bluetooth: sco: Fix a race condition in sco_sock_timeout()Linux
- CVE-2026-80660hwmon: (occ) unregister sysfs devices outside occ lockLinux
- CVE-2026-80659mmc: vub300: defer reset until cmd_mutex is unlockedLinux
- CVE-2026-80658drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove()Linux
- CVE-2026-80657accel/amdxdna: Guard management mailbox channel cleanup against NULL pointerLinux
- CVE-2026-80655soc: xilinx: Fix race condition in event registrationLinux
- CVE-2026-80654soc: xilinx: Shutdown and free rx mailbox channelLinux
- CVE-2026-80652crypto: ccp - Treat zero-length cert chain as query for blob lengthsLinux
- CVE-2026-80651crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULLLinux
- CVE-2026-80650media: atomisp: gc2235: fix UAF and memory leakLinux
- CVE-2026-80648pinctrl: spacemit: fix NULL check in spacemit_pin_set_configLinux
- CVE-2026-80647RDMA/hns: Fix warning in poll cq direct modeLinux
- CVE-2026-80644ocfs2: don't BUG_ON an invalid journal dinodeLinux
- CVE-2026-80643EDAC/igen6: Fix call trace due to missing release()Linux
- CVE-2026-80642liveupdate: Reference count incoming FLB dataLinux
- CVE-2026-80641wifi: wlcore: enable the right set of ciphersLinux
- CVE-2026-80640cxl/fwctl: Fix __fortify_panicLinux
- CVE-2026-80639cxl/test: Fix __fortify_panicLinux
- CVE-2026-80636netfilter: conntrack: revert ct extension genid infrastructureLinux
- CVE-2026-80632wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues()Linux
- CVE-2026-80629octeontx2-af: npc: Fix size of entry2cntr_mapLinux
- CVE-2026-80627MIPS: mm: Fix out-of-bounds write in maar_res_walk()Linux
- CVE-2026-80626powerpc/perf: fix preempt count underflow in fsl_emb_pmu_delLinux
- CVE-2026-80625RDMA/hns: Fix memory leak of bonding resourcesLinux
- CVE-2026-80624mfd: cs42l43: Sanity check firmware sizeLinux
- CVE-2026-80623coresight: ete: Always save state on power downLinux
- CVE-2026-80621PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capabilityLinux
- CVE-2026-80620Revert "PCI/MSI: Unmap MSI-X region on error"Linux
- CVE-2026-80618drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on freeLinux
- CVE-2026-80616ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()Linux
- CVE-2026-80611ACPI: processor_idle: Mark LPI enter functions as __cpuidleLinux
- CVE-2026-80610net: enetc: fix potential divide-by-zero when num_vsi is zeroLinux
- CVE-2026-80607tracing/probes: Remove WARN_ON_ONCE from parse_btf_argLinux
- CVE-2026-80605HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()Linux
- CVE-2026-80602perf/x86/amd/lbr: Fix kernel address leakageLinux
- CVE-2026-80597mtd: maps: vmu-flash: fix NULL pointer dereference in initializationLinux
- CVE-2026-80595Input: ims-pcu - add response length checksLinux
- CVE-2026-80594Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsingLinux
- CVE-2026-80592samples/damon/mtier: fail early if address range parameters are invalidLinux
- CVE-2026-78238SOY Gallery contains a cross-site scripting vulnerability.Tsuyoshi Saito SOY Gallery
- CVE-2026-77838SOY Calendar contains a cross-site scripting vulnerability.Tsuyoshi Saito SOY Calendar
- CVE-2026-73827SOY Calendar contains a cross-site scripting vulnerability.Tsuyoshi Saito SOY Calendar
- CVE-2026-79995User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDORUser Registration & Membership
- CVE-2026-79706Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path TraversalBreeze Cache
- CVE-2026-79615Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDORQuiz and Survey Master
- CVE-2026-77701WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest OrdersWCFM Marketplace
- CVE-2026-14567WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User DirectoryUser Frontend
- CVE-2026-12514Shared Files < 1.7.70 - Unauthenticated Limited File UploadShared Files · shared-files-pro
- CVE-2026-12513Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path TraversalShared Files · shared-files-pro
- CVE-2026-4246ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameterwpmet ElementsKit Pro
- CVE-2026-16654Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attributethemefusion Avada (Fusion) Builder
- CVE-2026-3129LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributeslitespeedtech LiteSpeed Cache
- CVE-2026-16759Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parametersthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-82081wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export.wallabag
- CVE-2026-15798Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attributenextendweb Smart Slider
- CVE-2026-38819Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memoopenNDS
- CVE-2026-37710Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL
- CVE-2026-38093file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android imp
- CVE-2026-38725xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and cont
- CVE-2026-39070WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature.
- CVE-2026-39071WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.
- CVE-2026-50980Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute
- CVE-2026-51376An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mes
- CVE-2026-51610Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily f
- CVE-2026-51613Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain devic
- CVE-2026-51614Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51629Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51630Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS con
- CVE-2026-51631Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51632Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51633Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51634Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain cor
- CVE-2026-51635Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51637Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain
- CVE-2026-51638Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain gue
- CVE-2026-51639Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain AP-
- CVE-2026-51640Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtai
- CVE-2026-51651Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Smar
- CVE-2026-51652Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain UPnP ena
- CVE-2026-51653Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain stora
- CVE-2026-51654Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sche
- CVE-2026-51655Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain M
- CVE-2026-51656Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain VPN p
- CVE-2026-51664Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Telnet
- CVE-2026-51665Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain tr