CVEs published September 4, 2026
562 CVEs were published on September 4, 2026: 52 critical, 161 high.
- Published
- 562
- Critical
- 52
- High
- 161
- Medium
- 187
- Low
- 6
- Unrated
- 156
- Now in CISA KEV
- 0
- Fix available
- 347
Most affected products
- Linux
- 156
- IBM i
- 22
- IBM Langflow OSS
- 17
- yeswiki · yeswiki/yeswiki
- 12
- undici
- 11
- IBM App Connect Enterprise · IBM Integration Bus for z/OS
- 9
- PassMark Software PerformanceTest · PassMark Software Bu… +1
- 8
- pjsip pjproject
- 8
- siyuan-note siyuan
- 8
- thorsten phpMyFAQ
- 8
Critical 52
- CVE-2026-52777YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserializeyeswiki · yeswiki/yeswiki
- CVE-2026-52766YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` actionyeswiki · yeswiki/yeswiki
- CVE-2026-75925IXON VPN Client CRLF InjectionIXON VPN Client
- CVE-2026-81939A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an SonicWall Network Security Manager
- CVE-2026-78328A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privilegedSonicWall Network Security Manager
- CVE-2026-78327An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network SecuritSonicWall Network Security Manager
- CVE-2026-9317Nango < 0.71.6 Missing Authentication RCE via runner tRPC serverNangoHQ nango
- CVE-2026-18658IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressedIBM Operational Decision Manager
- CVE-2026-19274IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container imageIBM Observability with Instana
- CVE-2026-44402Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgiVoltronic Power SNMP Web Pro
- CVE-2026-85696SadTalker OS Command Injection via Audio FilenameOpenTalker SadTalker
- CVE-2026-85695FastChat Unauthenticated Worker Registration SSRF and Model Spoofinglm-sys FastChat
- CVE-2026-85694LaVague 0.2.35 Remote Code Execution via eval extractionlavague-ai LaVague
- CVE-2026-85688TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designerten-framework
- CVE-2026-85672zerox 1.1.20 OS Command Injection via Document URL File Extensiongetomni-ai zerox
- CVE-2026-85667xiaobei through 5.5.2 Unauthenticated Webhook Message InjectionTeamWiseFlow xiaobei
- CVE-2026-85663Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatchaimhubio aim
- CVE-2026-85661excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio modeharis-musa excel-mcp-server
- CVE-2026-85660cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell SubstitutionMladenSU cli-mcp-server
- CVE-2026-85625sift 17.1.3 Prototype Pollution Remote Code Execution via $wherecrcn sift.js
- CVE-2026-85620Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Functioncrystaldba postgres-mcp
- CVE-2026-85614OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checkerOpenpanel-dev openpanel
- CVE-2026-85602Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypassgetgrav grav-plugin-form
- CVE-2026-85595Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuthtraefik
- CVE-2026-82923AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST RoutesAI Website Builder
- CVE-2026-85184@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target@fastify/middie
- CVE-2026-80181Apache Allura: Server-side request forgeryApache Software Foundation Apache Allura
- CVE-2026-70403XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259).XING CPTrans-ME-X
- CVE-2026-69657XING CPTrans-ME-X contains a Use of Default Password (CWE-1393).XING CPTrans-ME-X
- CVE-2026-62928XING CPTrans-ME-X contains an OS Command Injection (CWE-78).XING CPTrans-ME-X
- CVE-2026-85085The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView.Canva
- CVE-2026-11613Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' ParameterDivi Engine Divi Ajax Filter
- CVE-2026-85509FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than FreeIPMI
- CVE-2026-85508ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (FreeIPMI
- CVE-2026-85507ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-iFreeIPMI
- CVE-2026-85506ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-FreeIPMI
- CVE-2026-85504FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-stringFreeIPMI
- CVE-2026-85148Lightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsLightstar SmartIT Desktop Manager
- CVE-2026-85146Lightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsLightstar SmartIT Desktop Manager
- CVE-2026-75754Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center aASUS Control Center Enterprise
- CVE-2025-67066SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /
- CVE-2026-31020In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot
- CVE-2026-50894easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows auth
- CVE-2026-71624An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controlle
- CVE-2026-71625An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component
- CVE-2026-75160An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi
- CVE-2026-75171An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.
- CVE-2026-75429PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Se
- CVE-2026-75430PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the
- CVE-2026-75431PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.
- CVE-2026-78745An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Br
- CVE-2026-79391No authentication exists in the MQTT service of Trueview 6.0.23.4.
High 161
- CVE-2026-52775YesWiki Authenticated SQL Injection in ReactionManageryeswiki · yeswiki/yeswiki
- CVE-2026-52771YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)yeswiki · yeswiki/yeswiki
- CVE-2026-52770Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswikiyeswiki · yeswiki/yeswiki
- CVE-2026-52769YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`yeswiki · yeswiki/yeswiki
- CVE-2026-52767YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`yeswiki · yeswiki/yeswiki
- CVE-2026-52762YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templatesyeswiki · yeswiki/yeswiki
- CVE-2026-86098ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escapentop nDPI
- CVE-2026-86097PX4 Autopilot through 1.17.0 Null Pointer Dereference via param selectPX4-Autopilot
- CVE-2026-86095Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute NameUnidata netcdf-c
- CVE-2026-48019CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relaylaravel framework · laravel/framework
- CVE-2026-46636Twig: Sandbox method allowlist bypass via `Markup` subclasstwigphp Twig
- CVE-2026-86091ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handlerntopng
- CVE-2026-86090ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlersntopng
- CVE-2026-77393Inductive Automation Ignition Incorrect Default PermissionsInductive Automation Ignition
- CVE-2026-82684Tycon Systems TPDIN-Monitor-WEB3 Missing AuthorizationTycon Systems TPDIN-Monitor-WEB3
- CVE-2026-82712Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request ForgeryTycon Systems TPDIN-Monitor-WEB3
- CVE-2026-85787An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-serverAmazon postgres-mcp-server
- CVE-2026-53932wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')stefanzweifel laravel-backup-restore · wnx/laravel-backup-r…
- CVE-2026-63464Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh
- CVE-2026-61699nebula-mesh: Certificate revocation is never enforced at the meshforgekeep nebula-mesh · github.com/forgekeep/nebula-mesh
- CVE-2026-53604nebula-mesh: CA private key not zeroized on web mobile-bundle error pathsforgekeep nebula-mesh · github.com/forgekeep/nebula-mesh
- CVE-2026-53603nebula-mesh: Operator session tokens stored in plaintext in the databaseforgekeep nebula-mesh · github.com/forgekeep/nebula-mesh
- CVE-2026-85786Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-javaAmazon ion-java
- CVE-2026-80119PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTLPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-80118PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTLPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-80116PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTLPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-80114PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sysPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-80112PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sysPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-53761Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/apifrappe crm
- CVE-2026-53758Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitizedemlog
- CVE-2026-61686SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context propSolidInvoice
- CVE-2026-82538ILIAS Arbitrary SQL Injection via Repository Trash Table Sort ParameterILIAS-eLearning e.V. ILIAS
- CVE-2026-85656OS command injection in Amazon log4j-cve-2021-44228-hotpatchAmazon log4j-cve-2021-44228-hotpatch
- CVE-2026-50553Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)enchant97 note-mark · github.com/enchant97/note-mark/backend
- CVE-2026-57164PJSIP: Heap overflow in the HTTP clientpjsip pjproject
- CVE-2026-57163PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backendpjsip pjproject
- CVE-2026-57162PJSIP: Stack overflow parsing SDP a=crypto attributespjsip pjproject
- CVE-2026-57161PJSIP: Stack overflow handling Service-Route headers in a registration responsepjsip pjproject
- CVE-2026-57159PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenancepjsip pjproject
- CVE-2026-19534undici vulnerable to Denial of Service via unrequested WebSocket subprotocolundici
- CVE-2026-85654Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverAmazon awslabs.dynamodb-mcp-server
- CVE-2026-84961undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolundici
- CVE-2026-13297Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-85152undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsundici
- CVE-2026-18175IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]IBM i
- CVE-2026-18221IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]IBM i
- CVE-2026-18486IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter executionIBM ContextForge MCP Gateway
- CVE-2026-18489IBM ContextForge Translate is affected by cross-client credential context confusionIBM ContextForge MCP Gateway - Translate utility
- CVE-2026-19298Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpointIBM Langflow OSS
- CVE-2026-19303Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing componentsIBM Langflow OSS
- CVE-2026-18905IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocationIBM ContextForge MCP Gateway
- CVE-2026-19283IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container imageIBM Observability with Instana
- CVE-2026-19300Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flowsIBM Langflow OSS
- CVE-2026-19304Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple componentsIBM Langflow OSS
- CVE-2026-19305Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple componentsIBM Langflow OSS
- CVE-2026-85730smol-toml: Denial of Service via malformed TOML documentssquirrelchat smol-toml · smol-toml
- CVE-2026-19306Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor componentsIBM Langflow OSS
- CVE-2026-77822IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpointIBM ContextForge MCP Gateway
- CVE-2026-81832IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-6958Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exeInvicti Security Acunetix
- CVE-2026-85700Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpointsonyx-dot-app onyx
- CVE-2026-85699jina-ai reader server-side request forgery via redirect validation bypassjina-ai reader
- CVE-2026-85697Documenso 2.17.0 PDF Route Ignores Document Visibilitydocumenso
- CVE-2026-85693Chatbot UI Cross-User Private File Content Disclosure via Retrieval APImckaywrigley chatbot-ui
- CVE-2026-85692Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encodingccfos nightingale
- CVE-2026-85691MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/urlThe-Vibe-Company megaparse
- CVE-2026-85690Plandex 2.2.1 Path Traversal via ApplyFilesplandex-ai plandex
- CVE-2026-85689llmware 0.4.6 SQL Injection via unescaped filter valuesllmware-ai llmware
- CVE-2026-85687surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot serverdatalab-to surya
- CVE-2026-85686ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLsmodelscope ms-swift
- CVE-2026-85685AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skillagentscope-ai agentscope
- CVE-2026-85684marker through 2.0.0 Path Traversal via upload filenamedatalab-to marker
- CVE-2026-85675OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetchingcamel-ai owl
- CVE-2026-85674aider 0.86.2 Remote Code Execution via .aider.conf.ymlAider-AI aider
- CVE-2026-85673LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebindinghiyouga LlamaFactory
- CVE-2026-85671QAnything 2.0.0 Unauthenticated Cross-User File Disclosurenetease-youdao QAnything
- CVE-2026-85670tokenizers BpeBuilder Buffer Overflow via merge tokenhuggingface tokenizers
- CVE-2026-85669potpie through 2.0.0 Missing Ownership Check via code-changes syncpotpie-ai potpie
- CVE-2026-85668Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-registerxorbitsai inference
- CVE-2026-85666ogx 1.3.1 Server-Side Request Forgery via MCP tool server_urlogx-ai ogx
- CVE-2026-85665Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Pathusebruno bruno
- CVE-2026-85664Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustionchroma-core chroma
- CVE-2026-85651Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replaytriggerdotdev trigger.dev · trigger.dev
- CVE-2026-85626git-mcp-server 2.15.1 Argument Injection via Git Ref Parameterscyanheads git-mcp-server
- CVE-2026-85624Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceListblinkospace blinko
- CVE-2026-85623goose 1.37.0 Arbitrary Command Execution via Recipe Extensionsaaif-goose goose
- CVE-2026-85619AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP APIAppFlowy-IO AppFlowy-Cloud
- CVE-2026-85618ConvertX 0.17.0 Arbitrary File Read via LaTeX Input DirectivesC4illin ConvertX
- CVE-2026-85608Douyin_TikTok_Download_API 4.1.2 SSRF via url parameterEvil0ctal Douyin_TikTok_Download_API
- CVE-2026-85607Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Routerblinkospace blinko
- CVE-2026-85606firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePathfirecrawl-mcp-server
- CVE-2026-82728Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSelixir-mint mint
- CVE-2026-19205User Enumeration in GastroMenum's GastroMenum Web PanelGastroMenum Web Panel
- CVE-2026-52691Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore ModuleApache Software Foundation Apache Griffin Hive Metastore Mo…
- CVE-2026-12483LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload HandlerStellarWP LearnDash LMS
- CVE-2026-85649(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root uchewkeanho software-actualizer
- CVE-2026-74237GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf ClientGFI Software GFI Exinda AI · GFI Software GFI ClearView
- CVE-2026-74236GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion HandlerGFI Software GFI Exinda AI · GFI Software GFI ClearView
- CVE-2026-18198SQL Injection in TAC Information's GoldenHornTAC Information Services Internal and External Trade GOLDEN…
- CVE-2026-19080Username Enumeration in Menulux Software's Menulux PortalMenulux Software Menulux Portal
- CVE-2026-19051Plaintext Storage of User Credentials in Menulux Software's Menulux PortalMenulux Software Menulux Portal
- CVE-2026-85617snipe-it before 8.6.3 Authorization Bypass via Bulk Deletegrokability snipe-it
- CVE-2026-85616Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptancegrokability snipe-it
- CVE-2026-85613OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon ProxyOpenpanel-dev openpanel
- CVE-2026-85612OpenPanel before 2.3.0 SSRF via favicon and og endpointsOpenpanel-dev openpanel
- CVE-2026-85610OpenPanel before 2.3.0 Remote Code Execution via chart formulasOpenpanel-dev openpanel
- CVE-2026-85604Grav before 2.0.18 Remote Code Execution via sort filtergetgrav grav
- CVE-2026-85603Grav Admin Plugin Path Traversal via Save As Language Codegetgrav grav
- CVE-2026-85597Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflicttraefik
- CVE-2026-85596Traefik v3.7 Authentication Bypass via TLS Option Conflicttraefik
- CVE-2026-85594Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middlewaretraefik
- CVE-2026-85591phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Changethorsten phpMyFAQ
- CVE-2026-85590phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disablethorsten phpMyFAQ
- CVE-2026-85585SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrencysiyuan-note siyuan
- CVE-2026-85584SiYuan before v3.8.2 Denial of Service via Auth Throttlesiyuan-note siyuan
- CVE-2026-85583SiYuan before v3.8.2 Path Traversal via symlink in file APIsiyuan-note siyuan
- CVE-2026-85582SiYuan before v3.8.2 Unbounded Session Creation via Basic Authsiyuan-note siyuan
- CVE-2026-85581SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registrationsiyuan-note siyuan
- CVE-2026-85580SiYuan before v3.8.2 Path Guard Bypass via Case Mismatchsiyuan-note siyuan
- CVE-2026-85578SiYuan through 3.8.1 Authorization Bypass via getFilesiyuan-note siyuan
- CVE-2026-84428fastify vulnerable to header validation bypass via incomplete schema case normalizationfastify
- CVE-2026-4644Improper Authorization in Google Cloud Integration Connectors Leads to Project TakeoverGoogle Cloud Integration Connectors
- CVE-2026-79707Arbitrary File Read in Google Agent Development Kit (ADK)Google Cloud Agent Development Kit
- CVE-2026-84469fastify vulnerable to request validation bypass via skipped boolean false schemasfastify
- CVE-2026-76169fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersfastify
- CVE-2026-84504fastify vulnerable to request body replacement via an async validation result collisionfastify
- CVE-2026-85540Interinfo｜DreamMaker - SQL InjectionInterinfo DreamMaker
- CVE-2026-85546MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requestsmisp
- CVE-2026-85538MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributesmisp
- CVE-2026-81665Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassemblyRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-81302PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code wiJAL Digital Co. PALLET CONTROL · JAL Digital Co. PalletCont…
- CVE-2026-85533MISP Sharing Group Authorization Bypass via Omitted Distribution Parametermisp
- CVE-2026-85525Improper OCSP response validation in Snowflake driversSnowflake Connector for Python · Snowflake Go Driver +2
- CVE-2026-57777WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerabilityAutomattic WooCommerce
- CVE-2026-85197Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body uploadRed Hat Enterprise Linux
- CVE-2026-81270Apache Allura: Information exposure via searchApache Software Foundation Apache Allura
- CVE-2026-66840XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497).XING CPTrans-ME-X
- CVE-2026-85094The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView.Canva
- CVE-2026-19224Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on MultisiteHummingbird Performance
- CVE-2026-16281Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDORClassified Listing
- CVE-2026-85505ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitFreeIPMI
- CVE-2026-85147Lightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsLightstar SmartIT Desktop Manager
- CVE-2026-45200GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlagsImagination Technologies Graphics DDK
- CVE-2021-44319Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service.
- CVE-2021-44320Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks.
- CVE-2022-35499In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary p
- CVE-2026-71620File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file
- CVE-2026-71622SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php compon
- CVE-2026-71626An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRe
- CVE-2026-75161An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated u
- CVE-2026-75166Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/
- CVE-2026-75169An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenti
- CVE-2026-75438Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function
- CVE-2026-75439An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component
- CVE-2026-78839An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar fil
- CVE-2026-79389Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing.
- CVE-2026-79390Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1
- CVE-2026-79418EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality.
- CVE-2026-79419A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier.
- CVE-2026-79423An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arb
- CVE-2026-79426An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to d
Medium, low and unrated 349
- CVE-2026-52774Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiyeswiki · yeswiki/yeswiki
- CVE-2026-52773Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWikiyeswiki · yeswiki/yeswiki
- CVE-2026-52772YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)yeswiki · yeswiki/yeswiki
- CVE-2026-52763YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readyeswiki · yeswiki/yeswiki
- CVE-2026-86100Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URLowen2345 CamaleonCMS
- CVE-2026-86096PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task StartupPX4-Autopilot
- CVE-2026-76925Flatpak: flatpak: toctou race condition allows symlink redirectionRed Hat Enterprise Linux
- CVE-2026-85704ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race conditionramon-victor freegpt-webui
- CVE-2026-77847Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded CredentialsTycon Systems TPDIN-Monitor-WEB3
- CVE-2026-85703ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resourcesramon-victor freegpt-webui
- CVE-2026-85702ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authenticationramon-victor freegpt-webui
- CVE-2026-85701ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authenticationramon-victor freegpt-webui
- CVE-2026-53769Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policyavo-hq avo · avo
- CVE-2026-55513nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokensforgekeep nebula-mesh · github.com/forgekeep/nebula-mesh +1
- CVE-2026-55512nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limitingforgekeep nebula-mesh · github.com/forgekeep/nebula-mesh +1
- CVE-2026-53602nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificateforgekeep nebula-mesh · github.com/forgekeep/nebula-mesh
- CVE-2026-85643code-projects Online Shopping System adduser.php mysqli_query sql injectioncode-projects Online Shopping System
- CVE-2026-85639jofpin trape Telemetry Endpoint user.py race conditionjofpin trape
- CVE-2026-85781Unverified access point ownership in Amazon EFS CSI Driveraws-efs-csi-driver
- CVE-2026-85638jofpin trape user.py authorizationjofpin trape
- CVE-2026-80117PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sysPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-80115PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTLPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-80113PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTLPassMark Software PerformanceTest · PassMark Software Bu… +1
- CVE-2026-85637jofpin trape Admin Endpoint sockets.py join_room missing authenticationjofpin trape
- CVE-2026-85636jofpin trape Login Endpoint stats.py missing authenticationjofpin trape
- CVE-2026-53760Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requestsadmidio · admidio/admidio
- CVE-2026-61688SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent propsSolidInvoice
- CVE-2026-61614SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser historySolidInvoice
- CVE-2026-85769Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksizeRed Hat Enterprise Linux
- CVE-2026-73848Emlog: Stored XSS via Tag Name in Article Editoremlog
- CVE-2026-53757Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCEemlog
- CVE-2026-53756Emlog Blind SQL Injection via Authentication Cookieemlog
- CVE-2026-61608SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation linksSolidInvoice
- CVE-2026-18149undici vulnerable to Denial of Service via orphaned RetryHandler response bodyundici
- CVE-2026-80913selinux: require every boolean value to be definedLinux
- CVE-2026-80912selinux: reject an unclaimed class value in security_get_classes()Linux
- CVE-2026-80911ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()Linux
- CVE-2026-80910ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accessesLinux
- CVE-2026-80909drm/amdgpu: Reject UVD message with invalid number of h265 refsLinux
- CVE-2026-80908drm/amdgpu: Reject UVD message with dimensions above 4096Linux
- CVE-2026-80907drm/amdgpu: Fix UVD dpb min size calculation for H264Linux
- CVE-2026-80906net: packet: fix wrong transport_header when sending VLAN-tagged frameLinux
- CVE-2026-80905net: tap: fix wrong transport_header when sending VLAN-tagged frameLinux
- CVE-2026-80904net/tls: Fail tls_sw_splice_read() after a failed async decryptLinux
- CVE-2026-80903drm/xe/oa: Fix sync entry leak on OA config emit failureLinux
- CVE-2026-18540undici vulnerable to downstream response splitting via retry interceptorundici
- CVE-2026-57166PJSIP: Pre-authentication overflow in the telnet CLI errorpjsip pjproject
- CVE-2026-57165PJSIP: Pre-authentication overflow in the telnet CLI historypjsip pjproject
- CVE-2026-57160PJSIP: SIP message header buffer overflowpjsip pjproject
- CVE-2026-80902dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMALinux
- CVE-2026-80901ipvs: fix the checksum validationsLinux
- CVE-2026-80900ASoC: SDCA: Make UMP message size check more robustLinux
- CVE-2026-80899erofs: remove fscache backend entirelyLinux
- CVE-2026-80898netfs: clear PG_private_2 on copy-to-cache append failureLinux
- CVE-2026-80897netfs: release readahead folios on iterator preparation failureLinux
- CVE-2026-80896mshv: Fix race in mshv_irqfd_deassignLinux
- CVE-2026-80895mshv: Order pt_vp_array publish against irqfd assertion pathLinux
- CVE-2026-80894iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replaceLinux
- CVE-2026-80893mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()Linux
- CVE-2026-80892erofs: cap LZMA stream pool sizeLinux
- CVE-2026-80891KVM: s390: pci: Validate AIBV and AISB before pinning guest pagesLinux
- CVE-2026-80890sctp: reject stale cookies with mismatched verification tagsLinux
- CVE-2026-80889can: isotp: fix timer drain order, wakeup handling and tx_gen orderingLinux
- CVE-2026-80888drm/vmwgfx: drop dma_buf reference on foreign-fd prime importLinux
- CVE-2026-80887drm/vmwgfx: use check_add_overflow for shader size+offset boundLinux
- CVE-2026-84890undici vulnerable to Denial of Service via unbounded decompression of compressed responsesundici
- CVE-2026-84933undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesundici
- CVE-2026-84947undici vulnerable to response truncation via oversized chunked responses in the dump interceptorundici
- CVE-2026-80886serial: msm: Disable DMA for kernel console UARTLinux
- CVE-2026-80885afs: Fix uncancelled rxrpc OOB message handlerLinux
- CVE-2026-80884ntb: Store original DMA address for future releaseLinux
- CVE-2026-80883drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registeredLinux
- CVE-2026-80882crypto: tegra - Return ENOMEM when input buffer allocation fails for ccmLinux
- CVE-2026-80881ocfs2: fix buffer head management in ocfs2_read_blocks()Linux
- CVE-2026-80880IB/mlx5: Properly support implicit ODP rereg_mrLinux
- CVE-2026-80879ocfs2: fix circular locking dependency in ocfs2_dio_end_io_writeLinux
- CVE-2026-80878afs: Fix leak of ungot volumeLinux
- CVE-2026-80877afs: Fix vllist leakLinux
- CVE-2026-80876ring-buffer: Fix event length with forced 8-byte alignmentLinux
- CVE-2026-80875ipvs: use parsed transport offset in TCP state lookupLinux
- CVE-2026-80874arm64: dts: renesas: ironhide: Describe inline ECC carveoutsLinux
- CVE-2026-80873KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptionsLinux
- CVE-2026-80872ALSA: hda/tas2781: Cancel async firmware request at unbindLinux
- CVE-2026-80871crypto: xilinx-trng - Remove crypto_rng interfaceLinux
- CVE-2026-80870drm/amdkfd: Validate CRIU-restored IDs before idr_allocLinux
- CVE-2026-80869ntfs: bound the attribute-list entry in ntfs_read_inode_mount()Linux
- CVE-2026-80868ntfs3: Allocate iomap inline_data using alloc_pageLinux
- CVE-2026-80867alpha/PCI: Add security_locked_down() check to pci_mmap_resource()Linux
- CVE-2026-80866tipc: avoid busy looping in tipc_exit_net()Linux
- CVE-2026-80865bpf: Add missing access_ok call to copy_user_symsLinux
- CVE-2026-14350Vulnerabilities exists in IBM Cloud Pak for Data SystemIBM Cloud Pak for Data System
- CVE-2026-14470Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base componentsIBM Langflow OSS
- CVE-2026-16180IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-85008undici vulnerable to caching and replay of unsafe HTTP method responsesundici
- CVE-2026-16660IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]IBM Db2 Mirror for i
- CVE-2026-16689IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-16693IBM i is Affected By Cryptographic Algorithm Weakness in DCM []IBM i
- CVE-2026-16826IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-16892IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service []IBM i
- CVE-2026-16941IBM i is Affected By An Incorrect Authorization Vulnerability []IBM i
- CVE-2026-17057IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]IBM i
- CVE-2026-17207IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]IBM i
- CVE-2026-17255IBM i is Affected By Denial of Service Vulnerability []IBM i
- CVE-2026-17259IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-17270IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-17273IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-17274IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-17440IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-17442IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-17443IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-17444IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-17469IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]IBM i
- CVE-2026-17470IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]IBM i
- CVE-2026-17483IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]IBM Db2 Mirror for i
- CVE-2026-17499IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-17627Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpointIBM Langflow OSS
- CVE-2026-85014undici vulnerable to Denial of Service via WebSocketStream unclean closeundici
- CVE-2026-17621Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base componentsIBM Langflow OSS
- CVE-2026-17622Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base componentsIBM Langflow OSS
- CVE-2026-17631Langflow OSS is affected by server-side request forgery due to missing URL validation in flow componentsIBM Langflow OSS
- CVE-2026-18073IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-18078IBM i is Affected By Denial of Service Vulnerability in Save Restore []IBM i
- CVE-2026-18076IBM i is Affected By Multiple Vulnerabilities in Debug ServerIBM i
- CVE-2026-18341IBM i is Affected By Buffer Overflow Vulnerability []IBM i
- CVE-2026-85024undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionundici
- CVE-2026-18567IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ]IBM Db2 Mirror for i
- CVE-2026-18858IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH []IBM i
- CVE-2026-18887IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE []IBM i
- CVE-2026-19301Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple componentsIBM Langflow OSS
- CVE-2026-80864RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qpLinux
- CVE-2026-80863RDMA/rxe: Fix OOB in free_rd_atomic_resources()Linux
- CVE-2026-80862nvme-tcp: fix usage of page_frag_cacheLinux
- CVE-2026-80861usb: xhci: bail out of setup if the controller is inaccessibleLinux
- CVE-2026-80860fuse: fix race between interrupt and resendLinux
- CVE-2026-80859fuse: fix missing barrier when checking io-uring readinessLinux
- CVE-2026-80858fuse: publish io-uring queues with release semanticsLinux
- CVE-2026-80857fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-freeLinux
- CVE-2026-80856fuse: fix invalidate lock leak on setattr writeback failureLinux
- CVE-2026-80855fuse: fix invalidate lock leak on open O_TRUNC DAX failureLinux
- CVE-2026-80854usb: gadget: f_tcm: keep port count until LUN teardown completesLinux
- CVE-2026-80853KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hostsLinux
- CVE-2026-80852tls: device: fix out-of-bounds write in tls_append_frag()Linux
- CVE-2026-80851gtp: serialize PDP context updatesLinux
- CVE-2026-80850tcp: fix AO info use-after-free in tcp_ao_connect_init()Linux
- CVE-2026-80849net/tcp-ao: fix use-after-free of current_key on reconnect to another peerLinux
- CVE-2026-80848xfrm: espintcp: fix UAF during closeLinux
- CVE-2026-80847tcp: clamp route advmss to TCP_MIN_MSSLinux
- CVE-2026-80846xfrm: drop ESP-in-TCP packets with no ingress deviceLinux
- CVE-2026-80845xfrm: avoid lock inversion in nat keepalive workLinux
- CVE-2026-80844xfrm: ah6: validate routing header segments_leftLinux
- CVE-2026-80843xfrm: fix xfrm_state_construct() auth-trunc leakLinux
- CVE-2026-80842net: bridge: mcast: fix use-after-free of a master VLAN's multicast contextLinux
- CVE-2026-80841net/packet: defer vmalloc TX_RING free until skbs finishLinux
- CVE-2026-80840ipv6: seg6: clear IPv4 control block on IPIP decapsulationLinux
- CVE-2026-80839batman-adv: reject unrepresentable multicast TVLV offsetsLinux
- CVE-2026-80838vxlan: keep the last remote linked during FDB flushLinux
- CVE-2026-80837netfilter: nf_tables: don't queue packet path object notificationsLinux
- CVE-2026-80836crypto: virtio - bound the akcipher result lengthLinux
- CVE-2026-80835crypto: qcom-rng - Remove crypto_rng interfaceLinux
- CVE-2026-80834crypto: sun8i-ce - Remove crypto_rng interfaceLinux
- CVE-2026-80833crypto: sun8i-ss - Remove crypto_rng interfaceLinux
- CVE-2026-80832crypto: qce - fix CCM AAD buffer underallocationLinux
- CVE-2026-80831crypto: mxs-dcp - fix source scatterlist length accessLinux
- CVE-2026-80830usb: core: Add lock to usb_wakeup_notification()Linux
- CVE-2026-80829ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()Linux
- CVE-2026-80828ALSA: usb-audio: Complete cleanup after system-resume errorsLinux
- CVE-2026-80827USB: serial: option: fix slab OOB read in interrupt URB callbackLinux
- CVE-2026-80826USB: c67x00: fix use-after-free in c67x00_add_iso_urb()Linux
- CVE-2026-80825wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skbLinux
- CVE-2026-80824usb: usbfs: fix use-after-free of usb_device in usbdev_release()Linux
- CVE-2026-19299Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor componentsIBM Langflow OSS
- CVE-2026-19302Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor componentsIBM Langflow OSS
- CVE-2026-82911CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changesRoskus Prospero Flow CRM
- CVE-2026-80823nfc: st21nfca: validate ATR_REQ length against the received frameLinux
- CVE-2026-80822mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()Linux
- CVE-2026-80821nvmet: pci-epf: put CQ ref on create_cq mapping failureLinux
- CVE-2026-19645Multiple vulnerabilities in IBM MQ Agent imagesIBM MQ Agent
- CVE-2026-19649IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-5522QRadar contains hard-coded credentialsIBM QRadar
- CVE-2026-80820xfs: don't livelock in scrub on a circular unlinked listLinux
- CVE-2026-80819Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup acceptLinux
- CVE-2026-80818iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardownLinux
- CVE-2026-80817iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pagesLinux
- CVE-2026-80816ALSA: FCP: Use a private URB for the notification endpointLinux
- CVE-2026-80815ALSA: scarlett2: Use a private URB for the notification endpointLinux
- CVE-2026-80814rndis_host: add overflow check in rndis_rx_fixup()Linux
- CVE-2026-80813nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()Linux
- CVE-2026-80812ALSA: dummy: Check card index validity at probeLinux
- CVE-2026-80811io_uring/cmd: fix iovec leak when the async cmd is not recycledLinux
- CVE-2026-80810io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()Linux
- CVE-2026-80809ocfs2: fix missing metadata reservation for large xattrsLinux
- CVE-2026-80808ext4: stop retrying saturated xattr cache entriesLinux
- CVE-2026-80807nilfs2: reject invalid block index in GC ioctlLinux
- CVE-2026-80806ext4: don't enable DAX on new encrypted filesLinux
- CVE-2026-80805xfs: validate attr entry pointer before field accessLinux
- CVE-2026-80804xfs: restore nofs context unconditionally in xfs_trans_rollLinux
- CVE-2026-80803nfc: digital: clamp SENSF_RES length to the destination bufferLinux
- CVE-2026-80802nfc: fdp: bound the device-reported read length and fix an skb leakLinux
- CVE-2026-80801nfc: microread: validate target discovery payload lengthsLinux
- CVE-2026-80800nfc: llcp: bound the connect_sn TLV walk to the skbLinux
- CVE-2026-80799nfc: llcp: fix OOB read and u8 offset wrap in TLV parsersLinux
- CVE-2026-80798nfc: llcp: reject PDUs shorter than the LLCP headerLinux
- CVE-2026-80797nfc: pn533: purge fragmented skbs during cleanupLinux
- CVE-2026-80796nfc: nci: add data_len bound checks to activation parameter extractorsLinux
- CVE-2026-80795nfc: nci: fix out-of-bounds write in nci_target_auto_activated()Linux
- CVE-2026-80794nfc: nci: fix uninit-value in the RF discover/activated NTF handlersLinux
- CVE-2026-80793ipv4: reject undersized MTUs in ip_do_fragment()Linux
- CVE-2026-80792ipv6: fix use-after-free in ip6_finish_output2()Linux
- CVE-2026-80791nvmet-auth: zero the AUTH_RECEIVE response bufferLinux
- CVE-2026-80790nvmet-fc: fix invalid free in LS IOD error pathLinux
- CVE-2026-80789nvmet-tcp: bound SGL data length before allocating command buffersLinux
- CVE-2026-80788nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocationsLinux
- CVE-2026-80787nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()Linux
- CVE-2026-80786fbdev: Wrap user-invoked calls to fb_set_var() in helperLinux
- CVE-2026-80785fbdev: serialize mode sysfs access with lock_fb_info()Linux
- CVE-2026-80784mptcp: pm: fix memory leak from alloc-during-teardown raceLinux
- CVE-2026-80783HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()Linux
- CVE-2026-80782HID: magicmouse: do not keep a stale msc->input if no input is claimedLinux
- CVE-2026-80781HID: core: fix OOB read of field->usage in hid_set_field()Linux
- CVE-2026-80780HID: pidff: fix OOB write when hid->inputs is emptyLinux
- CVE-2026-80779net/ionic: avoid OOB TX partner lookup for hwstamp RXQLinux
- CVE-2026-80778futex/pi: Reject cross-mm private futex ownersLinux
- CVE-2026-80777futex/pi: Plug private futex exec() raceLinux
- CVE-2026-80776futex: Fix race in futex_pivot_pending() during private hash resizeLinux
- CVE-2026-80775futex: Fix race on the initial mm->futex.phash.ref allocationLinux
- CVE-2026-80774HID: asus: fix missing hid_is_usb() checkLinux
- CVE-2026-80773HID: huawei: fix missing hid_is_usb() checkLinux
- CVE-2026-80772HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()Linux
- CVE-2026-80771HID: nintendo: register input device after capabilities are setLinux
- CVE-2026-80770HID: nintendo: stop device IO before hid_hw_stop on probe failureLinux
- CVE-2026-80769HID: rapoo: fix missing hid_is_usb() checkLinux
- CVE-2026-80768HID: ft260: fix stack-use-after-return write in I2C read raceLinux
- CVE-2026-80767HID: sensor: custom: Fix use-after-free in enable_sensorLinux
- CVE-2026-80766HID: uclogic: fix use-after-free of inrange_timer on removeLinux
- CVE-2026-80765HID: hyperv: validate initial device info boundsLinux
- CVE-2026-80764Bluetooth: hci_event: fix LE list UAF on resetLinux
- CVE-2026-80763Bluetooth: hci_event: validate LE Set CIG Parameters responseLinux
- CVE-2026-80762Bluetooth: hci_sync: Fix accept list UAF during suspendLinux
- CVE-2026-80761Bluetooth: ISO: zero the sockaddr before returning it in getnameLinux
- CVE-2026-80760Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255Linux
- CVE-2026-80759Bluetooth: hci_aml: validate firmware segment lengthsLinux
- CVE-2026-80758futex: Avoid private hash use-after-free on final putLinux
- CVE-2026-78543IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-78658IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerabilityUCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy
- CVE-2026-81859Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.IBM Cloud Pak for Business Automation
- CVE-2026-85698Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Servicetursodatabase turso
- CVE-2026-85676Dub Open Redirect via Unrestricted redir_url Parameterdubinc dub
- CVE-2026-85662Marqo 2.26.0 Server-Side Request Forgery via Media URLsmarqo-ai marqo
- CVE-2026-85650Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channeltriggerdotdev trigger.dev · trigger.dev
- CVE-2026-85622AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocketAppFlowy-IO AppFlowy-Cloud
- CVE-2026-85621LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishulobehub
- CVE-2026-85605Slink before 1.12.3 Missing Authorization on Image Comment Endpointsandrii-kryvoviaz slink
- CVE-2026-82729Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoSelixir-mint mint
- CVE-2026-14466Possible XSS in the SNS web administration panelStormshield Network Security
- CVE-2026-9138Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing componentsIBM Langflow OSS
- CVE-2026-8447Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trustIBM Langflow OSS
- CVE-2026-9186Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trustIBM Langflow OSS
- CVE-2026-19727HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation SystemYordam Information Technology Consulting, Training and Elec…
- CVE-2026-19081Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu SystemGastromenum Ticket and QR Menu System
- CVE-2026-19057Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu SystemGastromenum Ticket and QR Menu System
- CVE-2026-85522valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-boundsvalkey-io valkey
- CVE-2026-77818Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation SystemYordam Information Technology Consulting, Training and Elec…
- CVE-2026-85517code-projects Vehicle Management System SQL Database Backup File vehicle_management.sql information disclosurecode-projects Vehicle Management System
- CVE-2026-85516code-projects Vehicle Management System busprofile.php sql injectioncode-projects Vehicle Management System
- CVE-2026-85514StackStorm st2 API Key auth.py privileges managementStackStorm st2
- CVE-2026-85513StackStorm st2 NoOp RBAC backend actionexecutions.py privileges managementStackStorm st2
- CVE-2026-74235GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download HandlerGFI Software GFI Exinda AI · GFI Software GFI ClearView
- CVE-2026-82309Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queriesRobots-Validate
- CVE-2026-19043Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux PortalMenulux Software Menulux Portal
- CVE-2026-18957Stored XSS in Menulux Software's Menulux PortalMenulux Software Menulux Portal
- CVE-2026-85615Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayoutsOpenpanel-dev openpanel
- CVE-2026-85611OpenPanel before 2.3.0 Cross-Tenant BOLA via report proceduresOpenpanel-dev openpanel
- CVE-2026-85609Openpanel before 2.3.0 SSRF via Site Checker EndpointOpenpanel-dev openpanel
- CVE-2026-85601Grav Admin before 2.0.20 Cross-Site Scripting via marked.jsgetgrav grav
- CVE-2026-85600Grav Admin before 2.0.21 Stored XSS via usernamegetgrav grav-plugin-admin2
- CVE-2026-85599Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parametersgetgrav grav-plugin-shortcode-core
- CVE-2026-85598Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pagesgetgrav grav
- CVE-2026-85593phpMyFAQ before 4.1.8 Stored XSS via html_entity_decodethorsten phpMyFAQ
- CVE-2026-85592phpMyFAQ before 4.1.8 Authorization Bypass via question/createthorsten phpMyFAQ
- CVE-2026-85589phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard APIthorsten phpMyFAQ
- CVE-2026-85588phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Exportthorsten phpMyFAQ
- CVE-2026-85587phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pagesthorsten phpMyFAQ
- CVE-2026-85586phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameterthorsten phpMyFAQ
- CVE-2026-85579SiYuan before v3.8.2 Information Disclosure via undoStatesiyuan-note siyuan
- CVE-2026-85577AVideo userLogin.php Reflected XSS via error parameterWWBN AVideo
- CVE-2026-27347WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerabilityCrocoblock JetPopup
- CVE-2026-85534Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body readRed Hat Enterprise Linux
- CVE-2026-85512SourceCodester Class and Exam Timetabling System session.php authorizationSourceCodester Class and Exam Timetabling System
- CVE-2026-84045E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cartE-cab Taxi Booking Manager for Woocommerce
- CVE-2026-84044Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPNRestaurant Menu and Food Ordering
- CVE-2026-84043ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation BypassePayco Payment Gateway for WooCommerce
- CVE-2026-81666Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systemsRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-13148Memory leak in scan methodSofting smartLink HW-PN
- CVE-2026-85547Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISPmisp
- CVE-2026-85541Interinfo｜DreamMaker - Reflected Cross-site ScriptingInterinfo DreamMaker
- CVE-2026-27086WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerabilityXtemos WoodMart
- CVE-2026-27432WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerabilitysc Internet Vivoo WP Rentals
- CVE-2026-85528Snowflake JDBC Driver auto-configuration account validation permits credential redirectionSnowflake JDBC Driver
- CVE-2026-15937Agent receiver certificate confusion allows authentication with a certificate issued for another endpointCheckmk
- CVE-2026-85311WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerabilityKings Plugins MarketKing
- CVE-2026-32480WordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-6217Information Disclosure in Pik Online Software's PortalPik Online Software Solutions Pik Online Portal
- CVE-2026-80190Apache Allura: Stored XSS via code repositoriesApache Software Foundation Apache Allura
- CVE-2026-85229Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)Apache Software Foundation Apache SkyWalking
- CVE-2026-71216Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTPApache Software Foundation Apache SkyWalking
- CVE-2026-80180Apache Allura: Stored XSS via markdown HTML processingApache Software Foundation Apache Allura
- CVE-2026-84146Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick ViewXpro Addons — 140+ Widgets for Elementor
- CVE-2026-84066Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_uploadDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-82194WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path TraversalWPvivid — Backup, Migration & Staging
- CVE-2026-82193WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path TraversalWPvivid — Backup, Migration & Staging
- CVE-2026-82186WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' ParameterWPLP Cookie Consent
- CVE-2026-81347Frontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path TraversalFrontend Admin by DynamiApps
- CVE-2026-80438Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST APINinja Forms
- CVE-2026-79632WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submissionWPFunnels
- CVE-2026-79631WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log FilesWPFunnels
- CVE-2026-79630WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID SubstitutionWPFunnels
- CVE-2026-74853Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display CallbackPods
- CVE-2026-17517Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status FilterContent Views
- CVE-2025-15691WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in FormsWPFunnels
- CVE-2026-85409Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversalEleveo Quality Management
- CVE-2026-85408Eleveo Quality Management Conversation events dynamically-determined object attributesEleveo Quality Management
- CVE-2026-85407Eleveo Quality Management Conversation events denial of serviceEleveo Quality Management
- CVE-2026-85406Eleveo Quality Management Conversation Review cross site scriptingEleveo Quality Management
- CVE-2026-85405Eleveo Call Recording Software roleAddAction.do cross site scriptingEleveo Call Recording Software
- CVE-2026-85403code-projects Doctor Appointment System contactus.php sql injectioncode-projects Doctor Appointment System
- CVE-2026-85402code-projects Doctor Appointment System booking.php sql injectioncode-projects Doctor Appointment System
- CVE-2026-85401Dolibarr Legacy File Manager config.inc.php access controlDolibarr
- CVE-2026-85149Lightstar｜SmartIT Desktop Manager - Use of Hard-coded CredentialsLightstar SmartIT Desktop Manager
- CVE-2026-85399code-projects Hospital Information System PrespController.php getSinglePresp sql injectioncode-projects Hospital Information System
- CVE-2026-85398code-projects Hospital Information System viewReq.php viewReq sql injectioncode-projects Hospital Information System
- CVE-2026-85397code-projects Hospital Information System addReq.php findBySearch sql injectioncode-projects Hospital Information System
- CVE-2026-45197GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSetImagination Technologies Graphics DDK
- CVE-2026-85383itsourcecode Sales and Inventory System inv_del.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-85382light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scriptinglight0011 cms
- CVE-2026-85381light0011 cms Chapter Controller ChapterController.class.php authorizationlight0011 cms
- CVE-2026-85380light0011 cms UEditor controller.php catchimage server-side request forgerylight0011 cms
- CVE-2026-85379light0011 cms Query Builder ChapterController.class.php searchChapter sql injectionlight0011 cms
- CVE-2022-26961Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMS
- CVE-2022-35497In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via re
- CVE-2026-38961Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1)
- CVE-2026-75162An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V
- CVE-2026-75163An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_
- CVE-2026-75164An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenti
- CVE-2026-75165An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privilege
- CVE-2026-75167A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 a
- CVE-2026-75168An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated
- CVE-2026-75170Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote u
- CVE-2026-78849Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote
- CVE-2026-78970JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component.