CVEs published September 7, 2026
252 CVEs were published on September 7, 2026: 17 critical, 73 high. 1 is now in CISA KEV.
- Published
- 252
- Critical
- 17
- High
- 73
- Medium
- 144
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 105
Most affected products
- Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- 35
- JetBrains YouTrack
- 22
- MediaTek chipset
- 18
- MISP
- 11
- pmmp PocketMine-MP · pocketmine/pocketmine-mp
- 9
- itsourcecode Sales and Inventory System
- 8
- OpenVPN
- 8
- SourceCodester Syllabus-Aligned Learning Management & Exami…
- 7
- ash-project ash_authentication_oauth2_server
- 6
- ImageMagick
- 6
Critical 17
- CVE-2026-86543knowns before 0.30.0 Unauthenticated Management API Exposureknowns-dev knowns
- CVE-2026-75650Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Adobe Commerce · Adobe Magento Open Source
- CVE-2026-86480In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privilegesJetBrains Hub
- CVE-2026-86478In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeoJetBrains YouTrack
- CVE-2026-7861Code Injection in Next4Biz's CSM (Customer Service Management)Next4Biz Information Technologies CSM
- CVE-2026-18922389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary propertyRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-80238Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86426LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusionlibrenms
- CVE-2026-6223OTP Bypass in Bahçelievler Muncipality's BiHayat AppBahçelievler Muncipality BiHayat App
- CVE-2026-61410Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing AuthorizatDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-76578Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciRed Hat Enterprise Linux
- CVE-2026-86299Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injectionLinksys RE7000
- CVE-2026-86297D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-oneD-Link DIR-605
- CVE-2026-86296D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflowD-Link DIR-822A
- CVE-2026-79698Advantech WISE-6610-NB Node-RED nodered_lib_apply command injectionAdvantech WISE-6610-NB · Advantech WISE-6610-EB +11
- CVE-2026-79697Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injectionAdvantech WISE-6610-NB · Advantech WISE-6610-EB +11
- CVE-2026-16876An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V.NEC UNIVERGE IX-R/IX-V
High 73
- CVE-2026-86544knowns before 0.30.0 Authorization Bypass via Misclassified Code Actionsknowns-dev knowns
- CVE-2026-86542knowns before 0.30.0 Path Traversal via Import Nameknowns-dev knowns
- CVE-2026-86541knowns before 0.30.0 Path Traversal via code.replace MCP actionknowns-dev knowns
- CVE-2026-86540knowns before 0.30.0 Arbitrary Code Execution via LSP Binaryknowns-dev knowns · knowns
- CVE-2026-86538knowns before 0.30.0 Path Traversal via templateFile parameterknowns-dev knowns
- CVE-2026-86439knowns before 0.30.0 Path Traversal via MCP doc and memory toolsknowns-dev knowns · knowns
- CVE-2026-82586AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesash-project ash_lua
- CVE-2026-82753Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_serverash-project ash_authentication_oauth2_server
- CVE-2026-86438Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Actionlaradashboard
- CVE-2026-86437Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Uploadlaradashboard
- CVE-2026-16028Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream tableProtocol-HTTP2
- CVE-2026-86287Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengthsNet-IP-LPM
- CVE-2026-80166Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper PrivilegDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79639Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86504In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executJetBrains IntelliJ IDEA
- CVE-2026-86502In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote DeJetBrains IntelliJ IDEA
- CVE-2026-86498In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without upJetBrains YouTrack
- CVE-2026-86494In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issuesJetBrains YouTrack
- CVE-2026-86492In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokensJetBrains YouTrack
- CVE-2026-86482In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalationJetBrains YouTrack
- CVE-2026-86479In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourcJetBrains YouTrack
- CVE-2026-80127Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79691Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79643Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Incorrect Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-6377Path Traversal in Next4Biz's CSM (Customer Service Management)Next4Biz Information Technologies CSM
- CVE-2026-19843389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +9
- CVE-2026-18453389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-18355389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()Red Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-79644Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79645Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing AuthenticaDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78480Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing AuthenticaDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80130Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path TravDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80131Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper LimitatiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-14444WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' ParameterVery Good Plugins WP Fusion
- CVE-2026-80164Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-76560389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2026-86452MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request FloodingMISP
- CVE-2022-51018PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pagespmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51017PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Datapmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51015PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51014PocketMine-MP before 4.0.7 Denial of Service via JSON Decodingpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51013PocketMine-MP before 4.2.3 Denial of Service via NBT Metadatapmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51012PocketMine-MP before 4.2.9 Denial of Service via NBT Deserializationpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51010PocketMine-MP before 4.4.2 Server Crash via Item IDpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-86435commonmark 1.5.0 before 2.8.4 Denial of Service via Footnotethephpleague commonmark
- CVE-2026-86434commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collisionthephpleague commonmark · league/commonmark
- CVE-2026-86433commonmark 1.5.0 before 2.8.4 Denial of Service via Attributesthephpleague commonmark
- CVE-2026-86430league/commonmark before 2.9.1 Denial of Service via parsingthephpleague commonmark · league/commonmark
- CVE-2026-86429commonmark before 2.9.1 Denial of Service via SmartPunct and Attributesthephpleague commonmark · league/commonmark
- CVE-2026-86428commonmark 1.5.0 before 2.10.0 Denial of Service via Attributesthephpleague commonmark · league/commonmark
- CVE-2026-86427LibreNMS before 26.8.0 Argument Injection via graph_titlelibrenms
- CVE-2026-80135Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check orDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80132ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing AuthenticatDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80133Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path TravDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80134Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86419MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII DiscoveryMISP
- CVE-2026-6431User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Fieldcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-61409Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements useDell Secure Connect Gateway (SCG) 5.0 Application · Dell Se…
- CVE-2026-86408MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected EventsMISP
- CVE-2026-79678Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of serviceRed Hat Enterprise Linux
- CVE-2026-86404Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers…Red Hat JBoss Enterprise Application Platform 8.1.8.GA ·… +4
- CVE-2026-19204A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryEclipse Foundation Eclipse Jetty
- CVE-2026-84173In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rulEclipse Foundation Eclipse Ankaios
- CVE-2026-86347MISP Missing Authorization on Template File Upload Allows Authenticated Disk ExhaustionMISP
- CVE-2026-84732Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service viaOpenVPN
- CVE-2026-14297The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed 20-byte BSS buffer.Nordic Semiconductor ASA nRF Connect SDK
- CVE-2026-14296nRF54H20: MCUBoot can be tricked to executing unauthenticated codeNordic Semiconductor ASA nRF54H20
- CVE-2026-84256An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to exOpenVPN
- CVE-2026-84226OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting aOpenVPN
- CVE-2026-78254Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file writeApache Software Foundation Apache Ant
- CVE-2026-86313Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers.Samsung Opensource Walrus
- CVE-2026-20502In vdec, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20501In vdec, there is a possible out of bounds write due to a heap buffer overflow.MediaTek chipset
Medium, low and unrated 162
- CVE-2026-86539knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpointknowns-dev knowns
- CVE-2026-82584Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadataash-project igniter
- CVE-2026-81638Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entryash-project ash_double_entry
- CVE-2026-82758ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpointash-project ash_authentication_oauth2_server
- CVE-2026-82757ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRFash-project ash_authentication_oauth2_server
- CVE-2026-82756ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injectionash-project ash_authentication_oauth2_server
- CVE-2026-82755ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusionash-project ash_authentication_oauth2_server
- CVE-2026-82754ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsash-project ash_authentication_oauth2_server
- CVE-2026-86436Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpointslaradashboard
- CVE-2026-80176Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86506In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling dataJetBrains GoLand
- CVE-2026-86505In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains MarketplaceJetBrains IntelliJ IDEA
- CVE-2026-86503In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetchingJetBrains IntelliJ IDEA
- CVE-2026-86501In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.logJetBrains IntelliJ IDEA
- CVE-2026-86500In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project AdmJetBrains YouTrack
- CVE-2026-86499In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permissionJetBrains YouTrack
- CVE-2026-86497In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stJetBrains YouTrack
- CVE-2026-86496In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addressesJetBrains YouTrack
- CVE-2026-86495In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projectsJetBrains YouTrack
- CVE-2026-86493In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cardsJetBrains YouTrack
- CVE-2026-86491In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploadsJetBrains YouTrack
- CVE-2026-86490In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpointJetBrains YouTrack
- CVE-2026-86489In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizationsJetBrains YouTrack
- CVE-2026-86488In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searchesJetBrains YouTrack
- CVE-2026-86487In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas contentJetBrains YouTrack
- CVE-2026-86486In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blankJetBrains YouTrack
- CVE-2026-86485In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooksJetBrains YouTrack
- CVE-2026-86484In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSSJetBrains YouTrack
- CVE-2026-86483In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possibleJetBrains YouTrack
- CVE-2026-86481In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project iconsJetBrains YouTrack
- CVE-2026-80125Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80167Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80126Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79975Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80058Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86469Glib2: toctou symlink race in `g_file_create_replace_destination` fallback pathRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-79642Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79943Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper ValidatiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80054Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Incorrect PermissDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86321java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgeryjava-json-tools jackson-coreutils
- CVE-2026-86319java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumptionjava-json-tools json-patch
- CVE-2026-86318java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflowjava-json-tools json-patch
- CVE-2026-78488Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80056Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86317ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertionggml-org llama.cpp
- CVE-2026-80057Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86310itsourcecode Sales and Inventory System cust_edit1.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-80170Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79734Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86309itsourcecode Sales and Inventory System pro_searchfrm.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-78487Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80128Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper AuthentiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86308light0011 cms Debug Mode config.php information disclosurelight0011 cms
- CVE-2026-80129Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper LimitatiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-12757Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Fieldicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2026-86307light0011 cms cross-site request forgerylight0011 cms
- CVE-2026-86306light0011 cms Cookie Helper UserModel.class.php improper authenticationlight0011 cms
- CVE-2026-86451MISP Event Graph Object Reference Lookup Exposes References from Unauthorized ObjectsMISP
- CVE-2022-51016PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replaypmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2022-51011PocketMine-MP before 4.2.10 Denial of Service via Chat Messagespmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-80178Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper PrivilegDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86432commonmark 2.0.0 before 2.8.4 Denial of Service via XMLthephpleague commonmark
- CVE-2026-86431commonmark before 2.9.1 XSS via AttributesExtension form feed bypassthephpleague commonmark · league/commonmark
- CVE-2026-86425ImageMagick before 7.1.2-30 Heap-use-after-free via LayerImageMagick
- CVE-2026-86424ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink RaceImageMagick
- CVE-2026-86423ImageMagick before 7.1.2-30 Heap-use-after-free via GetListImageMagick
- CVE-2026-86422ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink RaceImageMagick
- CVE-2026-86421ImageMagick before 7.1.2-30 Memory Leak via MSL decoderImageMagick
- CVE-2026-86420ImageMagick before 7.1.2-30 Denial of Service Memory BudgetImageMagick
- CVE-2026-86305light0011 cms Upload.class.php upload unrestricted uploadlight0011 cms
- CVE-2026-86441MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation DataMISP
- CVE-2026-86440MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Backslash URLsMISP
- CVE-2026-8279Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress DeletionMasteriyo LMS – LMS Course Builder, Quizzes & Certificates
- CVE-2026-4945Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypassthemeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2026-12853Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-searchrocklobsterinc Flamingo
- CVE-2026-86416ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action MethodsILIAS-eLearning e.V. ILIAS
- CVE-2026-86418MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized UsersMISP
- CVE-2026-86417MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized UsersMISP
- CVE-2026-8630392181 markdown md.c lds out-of-bounds92181 markdown
- CVE-2026-86302code-projects Hospital Information System SQL Database Backup File his.sql information disclosurecode-projects Hospital Information System
- CVE-2026-78325XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML ImportStandard Notes
- CVE-2026-86301code-projects Hospital Information System Patient Management editPatient.php cross site scriptingcode-projects Hospital Information System
- CVE-2026-86300Tenda AC9 Web Management R7WebsSecurityHandler improper authenticationTenda AC9
- CVE-2026-2390Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processingcodesupplyco Powerkit – Supercharge your WordPress Site
- CVE-2026-82325A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a syOpenVPN ovpn-dco-win
- CVE-2026-86298SourceCodester Class and Exam Timetabling System delete_subject.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-77697Privilege EscalationZohocorp ManageEngine Endpoint Central
- CVE-2026-85640Privilege EscalationZohocorp ManageEngine Endpoint Central
- CVE-2025-52657HCL MyXalytics is affected by multiple security vulnerabilities.HCL Software MyXalytics
- CVE-2025-52652HCL MyXalytics is affected by multiple security vulnerabilities.HCL Software MyXalytics
- CVE-2025-52651HCL MyXalytics is affected by multiple security vulnerabilities.HCL Software MyXalytics
- CVE-2026-77699Privilege EscalationZohocorp ManageEngine Endpoint Central
- CVE-2026-86295D-Link DIR-895L udhcpcd serverpacket.c sendACK command injectionD-Link DIR-895L
- CVE-2026-85201In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf mEclipse Foundation Eclipse Ankaios
- CVE-2026-86294SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scriptingSourceCodester Simple Traffic Offense System
- CVE-2026-86351MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URLMISP
- CVE-2026-77698Privilege EscalationZohocorp ManageEngine Endpoint Central
- CVE-2026-86293SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authenticationSourceCodester Simple Traffic Offense System
- CVE-2026-86292SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authenticationSourceCodester Simple Traffic Offense System
- CVE-2026-86291itsourcecode Sales and Inventory System us_edit1.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-86342MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed InformationMISP
- CVE-2026-86290SourceCodester Online Voting System ajax.php save_category sql injectionSourceCodester Online Voting System
- CVE-2026-86289Ollama GGUF Decoder gguf.go readGGUFV1String integer overflowOllama
- CVE-2026-84186Incorrect access control in PrestaShopPrestaShop
- CVE-2026-86332Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated userRed Hat OpenShift AI
- CVE-2026-86288ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-boundsModelCloud GPTQModel
- CVE-2026-86285BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access controlBookStack
- CVE-2026-18796QSPI flash encryption side-channel leakageNordic Semiconductor ASA nRF5340
- CVE-2026-86284jaychouchannel Tourism-Management-System CommonController.java getOption information disclosurejaychouchannel Tourism-Management-System
- CVE-2026-86282jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injectionjaychouchannel Tourism-Management-System
- CVE-2026-82312OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULOpenVPN
- CVE-2026-81830The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directoOpenVPN
- CVE-2026-81738OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SOpenVPN
- CVE-2026-86281SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgerySourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-78221An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated usersOpenVPN
- CVE-2026-78043The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration dirOpenVPN
- CVE-2026-86280SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql cleartext storageSourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-86279SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiationSourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-86278SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scriptingSourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-86277SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorizationSourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-86276SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentialsSourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-86275SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges managementSourceCodester Syllabus-Aligned Learning Management & Exami…
- CVE-2026-86274projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorizationprojeto-siga siga
- CVE-2026-86273projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgeryprojeto-siga siga
- CVE-2026-86272Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted uploadBeijing Meite Software Technology U+Smart Enjoyment WebSite
- CVE-2026-86271FluentCMS PermissionManager.cs GetAccessible authorizationFluentCMS
- CVE-2026-86270itsourcecode Sales and Inventory System settings_edit.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-86315An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScriSamsung Opensource Escargot
- CVE-2026-86269itsourcecode Sales and Inventory System emp_edit1.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-86268itsourcecode School Management System User_Login.php sql injectionitsourcecode School Management System
- CVE-2026-86267itsourcecode Information System Society Membership System check_student.php sql injectionitsourcecode Information System Society Membership System
- CVE-2026-86265itsourcecode Sales and Inventory System us_transac.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-86264sfturing ssm_pro Order Endpoint OrderController.java cross site scriptingsfturing ssm_pro
- CVE-2026-86263sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorizationsfturing hosp_order
- CVE-2026-86262sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorizationsfturing hosp_order
- CVE-2026-86314Integer overflow in the source-bounds check in Memory::init() (src/runtime/Memory.cpp) in Samsung walrus on all platforms allows a remote atSamsung Opensource Walrus
- CVE-2026-86261sfturing hosp_order Order Controller OrderController.java authorizationsfturing hosp_order
- CVE-2026-86260sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password changesfturing hosp_order
- CVE-2026-20518In geniezone, there is a possible information disclosure due to a missing bounds check.MediaTek chipset
- CVE-2026-20517In geniezone, there is a possible escalation of privilege due to use after free.MediaTek chipset
- CVE-2026-20515In gpu, there is a possible system crash due to use after free.MediaTek chipset
- CVE-2026-20514In Audio HAL, there is a possible information disclosure due to a missing permission check.MediaTek chipset
- CVE-2026-20513In Audio HAL, there is a possible information disclosure due to improper input validation.MediaTek chipset
- CVE-2026-20512In Audio HAL, there is a possible escalation of privilege due to improper input validation.MediaTek chipset
- CVE-2026-20511In SurfaceFlinger, there is a possible memory corruption due to use after free.MediaTek chipset
- CVE-2026-20510In camera middleware, there is a possible escalation of privilege due to double free.MediaTek chipset
- CVE-2026-20509In Power HAL, there is a possible out of bounds write due to a missing bounds check.MediaTek chipset
- CVE-2026-20508In Power HAL, there is a possible escalation of privilege due to type confusion.MediaTek chipset
- CVE-2026-20507In Audio HAL, there is a possible escalation of privilege due to use after free.MediaTek chipset
- CVE-2026-20506In Audio HAL, there is a possible escalation of privilege due to use after free.MediaTek chipset
- CVE-2026-20516In MiracastService, there is a possible escalation of privilege due to a confused deputy.MediaTek chipset
- CVE-2026-20504In Modem, there is a possible system crash due to a missing bounds check.MediaTek chipset
- CVE-2026-20503In Modem, there is a possible system crash due to a missing bounds check.MediaTek chipset
- CVE-2026-20500In Modem, there is a possible system crash due to improper input validation.MediaTek chipset
- CVE-2026-86245itsourcecode Sales and Inventory System sup_transac.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-86244FastAdmin User Controller User.php login cross site scriptingFastAdmin
- CVE-2026-86241liufee FeehiCMS Cookie Validation main-local.php hard-coded keyliufee FeehiCMS
- CVE-2026-86240liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgeryliufee FeehiCMS
- CVE-2026-86239liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted uploadliufee FeehiCMS
- CVE-2026-86238projectworlds Online Examination System Feedback Form feedback.php cross site scriptingprojectworlds Online Examination System
- CVE-2026-86237openagents-org openagents http.py test_default_model server-side request forgeryopenagents-org openagents
- CVE-2026-86236itsourcecode Sales and Inventory System pro_transac.php add sql injectionitsourcecode Sales and Inventory System