CVEs published September 9, 2026
653 CVEs were published on September 9, 2026: 60 critical, 204 high. 2 are now in CISA KEV.
- Published
- 653
- Critical
- 60
- High
- 204
- Medium
- 338
- Low
- 42
- Unrated
- 9
- Now in CISA KEV
- 2
- Fix available
- 425
Most affected products
- Google Chrome
- 230
- Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- 68
- grokability snipe-it
- 36
- Samsung Mobile Devices
- 20
- pmmp PocketMine-MP · pocketmine/pocketmine-mp
- 17
- open-webui
- 16
- Tanium Comply
- 16
- Linux
- 12
- siyuan-note siyuan
- 9
- Huawei HarmonyOS
- 8
Critical 60
- CVE-2026-87931Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflowBehavioral Technology Group Pavlok Behavioral Conditioning…
- CVE-2026-88069Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysispandora-analysis pandora
- CVE-2026-87911Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-serverAWS Labs postgres MCP Server
- CVE-2026-54694NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverNationalSecurityAgency skills-service
- CVE-2026-87930MaxSite CMS through 109.6 PHP Object Injection via ci_sessionMaxSite CMS
- CVE-2026-87929MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption KeyMaxSite CMS
- CVE-2026-47156MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administratormantisbt · mantisbt/mantisbt
- CVE-2026-67401A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack componentWebPros cPanel
- CVE-2026-68484Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API.Sage AR Automation
- CVE-2026-67403Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API.Sage AR Automation
- CVE-2026-22590Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA_FRAG sampleSize / fragmentsInSubmessageeProsima Fast-DDS
- CVE-2026-85103Heap-based Buffer Overflow in VPN Certificate ASN.1 Decodingcheckpoint Quantum Security Gateway · checkpoint Quantum Se…
- CVE-2026-85102Improper Certificate Validation in Quantum Security Gatewaycheckpoint Quantum Security Gateway
- CVE-2026-80172Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient VeriDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-87806Parse Server 9.0.0 Authentication Bypass via LDAP Empty Passwordparse-community parse-server
- CVE-2026-87827KGUARD DVR unauthenticated remote command execution vulnerabilityKGUARD_firmware
- CVE-2026-41871Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)Apache Software Foundation Apache Nutch
- CVE-2026-41869Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)Apache Software Foundation Apache Nutch
- CVE-2026-56207Apache Impala: SAML authentication bypass via forged bearer tokenApache Software Foundation Apache Impala
- CVE-2026-85978Unauthenticated Remote Code Execution in Akana API PlatformPerforce Akana
- CVE-2026-16272Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS ModulePayTR Payment and Electronic Money Institution PayTR Virtua…
- CVE-2026-79696Remote Code Execution in Google ADK for Python via Incomplete Standard Library DenylistGoogle Cloud Agent Development Kit (ADK) for Python
- CVE-2026-21102Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.Samsung Mobile Devices
- CVE-2026-21096Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbiSamsung Mobile Devices
- CVE-2026-21095Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitSamsung Mobile Devices
- CVE-2026-87448Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox vGoogle Chrome
- CVE-2026-87595Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypGoogle Chrome
- CVE-2026-87634Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsiGoogle Chrome
- CVE-2026-87609Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the Google Chrome
- CVE-2026-87526Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially eGoogle Chrome
- CVE-2026-87455Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sGoogle Chrome
- CVE-2026-87638Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsideGoogle Chrome
- CVE-2026-87528Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codeGoogle Chrome
- CVE-2026-87470Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbiGoogle Chrome
- CVE-2026-87529Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code ouGoogle Chrome
- CVE-2026-87637Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside tGoogle Chrome
- CVE-2026-87494Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to eGoogle Chrome
- CVE-2026-87643Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary codGoogle Chrome
- CVE-2026-87613Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrGoogle Chrome
- CVE-2026-87547Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeringGoogle Chrome
- CVE-2026-87504Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary Google Chrome
- CVE-2026-87474Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside tGoogle Chrome
- CVE-2026-87581Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially exGoogle Chrome
- CVE-2026-87558Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside theGoogle Chrome
- CVE-2026-87607Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code oGoogle Chrome
- CVE-2026-87500Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitraGoogle Chrome
- CVE-2026-87646Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside theGoogle Chrome
- CVE-2026-87621Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrarGoogle Chrome
- CVE-2026-87654Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside tGoogle Chrome
- CVE-2026-87650Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside Google Chrome
- CVE-2026-87520Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside theGoogle Chrome
- CVE-2026-87492Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code Google Chrome
- CVE-2026-87512Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thGoogle Chrome
- CVE-2026-87527Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox viaGoogle Chrome
- CVE-2026-87438Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outsiGoogle Chrome
- CVE-2026-87488Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside thGoogle Chrome
- CVE-2026-87464Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via Google Chrome
- CVE-2026-36433An issue in Actions Semiconductor Co.
- CVE-2026-71801An issue was discovered in s-pms SPMS-Server through v1.0.
- CVE-2026-71805An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0.
High 204
- CVE-2026-87999Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchopen-webui
- CVE-2026-87998Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletionopen-webui
- CVE-2026-87996Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loaderopen-webui
- CVE-2026-87995Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originopen-webui
- CVE-2026-87016Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLiteopen-webui
- CVE-2026-15913Path Traversal in Fortra's GoAnywhere MFT EndpointFortra GoAnywhere MFT
- CVE-2026-87011Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutopen-webui
- CVE-2026-50165alf.io has Improper Access Control for Organization Owners that Exposes System Secretsalfio-event alf.io
- CVE-2026-73787Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web InterfaceHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2026-73786Unauthenticated Network-Based Denial of Service in CPPM systemsHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2026-73769Authenticated Remote Code Execution in CPPM Web InterfaceHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2026-87927MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcherMaxSite CMS
- CVE-2026-18147Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted urlRed Hat Enterprise Linux
- CVE-2026-77120CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause priSchneider Electric PowerLogic T300
- CVE-2026-19233CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server daSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2026-80924crypto: krb5 - use kfree_sensitive() for derived key buffersLinux
- CVE-2026-80921KVM: s390: vsie: zero stale crypto bitsLinux
- CVE-2026-8044CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote codeSchneider Electric EcoStruxure™ IT Data Center Expert
- CVE-2026-80914Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_readyLinux
- CVE-2026-87853Sssd: sssd: idp authentication prefix comparison allows cross-user impersonationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-87874Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controllerRed Hat Ceph Storage · Red Hat OpenStack Platform
- CVE-2026-23855Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, coDell iDRAC9 · Dell iDRAC10
- CVE-2026-22591Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)eProsima Fast-DDS
- CVE-2026-77974Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical functionSoftish EarVision Android application · Softish C6 Ear Came…
- CVE-2026-81640Softish C6 Ear Camera and EarVision Android Application Use of Hard-coded CredentialsSoftish EarVision Android application · Softish C6 Ear Came…
- CVE-2026-82563Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofingSoftish EarVision Android application · Softish C6 Ear Came…
- CVE-2026-81330Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive informationSoftish EarVision Android application · Softish C6 Ear Came…
- CVE-2026-26212Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCERara Themes Rara One Click Demo Import
- CVE-2026-87877zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()luben zstd-jni
- CVE-2026-87825zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionariesluben zstd-jni
- CVE-2026-87824zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirectluben zstd-jni
- CVE-2026-87823zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methodsluben zstd-jni
- CVE-2026-87822t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytestdunning t-digest
- CVE-2026-79617Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM GreeterTÜBİTAK BİLGEM Software Technologies Research Institute Par…
- CVE-2026-79950Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86775knowns before 0.30.0 Path Traversal via Document APIknowns-dev knowns
- CVE-2026-86771Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_numgrokability snipe-it
- CVE-2026-86770Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collationgrokability snipe-it
- CVE-2026-86766Snipe-IT 8.6.3 Race Condition via Consumable Checkoutgrokability snipe-it
- CVE-2026-86765Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpointgrokability snipe-it
- CVE-2026-86764Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned componentsgrokability snipe-it
- CVE-2026-86762Snipe-IT before 8.7.0 Authentication Bypass via API Middlewaregrokability snipe-it
- CVE-2026-86759Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importergrokability snipe-it
- CVE-2026-86758Snipe-IT before 8.7.0 License Key Exposure via CSV Exportgrokability snipe-it
- CVE-2026-86757Snipe-IT before 8.7.0 Information Disclosure via Custom Fieldsgrokability snipe-it
- CVE-2026-86754Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clientsgrokability snipe-it
- CVE-2026-86751Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdowngrokability snipe-it
- CVE-2026-86750snipe-it before 8.7.0 Authorization Bypass via API User Create/Updategrokability snipe-it
- CVE-2026-86749snipe-it before 8.7.0 Data Loss via Failed Image Writegrokability snipe-it
- CVE-2026-86746Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replaygrokability snipe-it
- CVE-2026-86741Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULAgrokability snipe-it
- CVE-2026-86204PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-86201PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientDatapmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-86199PocketMine-MP before 5.43.1 Denial of Service via unauthenticated loginpmmp PocketMine-MP
- CVE-2026-86099Chainlit through 2.12.0 Path Traversal via socket.io sessionIdchainlit
- CVE-2026-56711VLC media player 3.0.0 through 3.0.23 memory corruption vulnerabilityVideoLAN VLC media player
- CVE-2025-71417PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2024-58382league/commonmark before 2.6.0 Denial of Service via Quadratic Complexitythephpleague commonmark · league/commonmark
- CVE-2024-58381PocketMine-MP before 5.11.1 Denial of Service via LoginPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2024-58380PocketMine-MP before 5.11.2 Denial of Service via BookEditPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54396PocketMine-MP before 4.8.1 Server Crash via Banner NBTpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54393PocketMine-MP before 4.20.5 Denial of Service via LoginPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54392PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54390PocketMine-MP before 5.3.1 Denial of Service via LoginPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54355PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curvepmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-79740Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79738Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-15140A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP).Everpure Portworx Operator
- CVE-2026-79972Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79692Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78490Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper RestrictDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79695Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper HandlingDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78485Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper LimitatiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-87821Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetchlaradashboard
- CVE-2026-87819GitPython before 3.1.60 Denial of Service via ReDoSgitpython-developers GitPython · gitpython
- CVE-2026-87818GitPython 3.1.59 Local File Content Oracle via --no-indexgitpython-developers GitPython · gitpython
- CVE-2026-87817GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonationgitpython-developers GitPython · gitpython
- CVE-2026-87816PasswordPusher before 2.11.1 Race Condition View Limit Bypasspglombardo PasswordPusher
- CVE-2026-87815SiYuan before v3.8.2 Path Traversal via removeRiffDecksiyuan-note siyuan
- CVE-2026-87814SiYuan before v3.8.2 Stored XSS via Asset Previewsiyuan-note siyuan
- CVE-2026-87813SiYuan before v3.8.2 Stored XSS via unescaped asset filenamessiyuan-note siyuan
- CVE-2026-87812SiYuan before v3.8.2 Stored XSS via Bazaar iconURLsiyuan-note siyuan
- CVE-2026-87811SiYuan before v3.8.2 Stored XSS via notebook template pathssiyuan-note siyuan
- CVE-2026-87809Siyuan before v3.8.2 Information Disclosure via Export Previewsiyuan-note siyuan
- CVE-2026-87808SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlocksiyuan-note siyuan
- CVE-2026-87807siyuan before v3.8.2 SQL Injection via fullTextSearchBlocksiyuan-note siyuan
- CVE-2026-78492Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-74761Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientIdApache Software Foundation Apache ActiveMQ Broker · Apac… +1
- CVE-2026-79637Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79963Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code WDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79635Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side RequesDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-73334Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validationApache Software Foundation Apache Parquet Hadoop
- CVE-2026-41870Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)Apache Software Foundation Apache Nutch
- CVE-2026-65181Apache Impala: RCE via External Data Source Class LoadingApache Software Foundation Apache Impala
- CVE-2026-57866Apache Impala: Secrets Exfiltration via SSRFApache Software Foundation Apache Impala
- CVE-2026-79641Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-87795zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompressluben zstd-jni
- CVE-2026-87794bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destinationnfriedly bestzip
- CVE-2026-87766Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setupRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-12858Local privilege escalation vulnerability in ESET AV RemoverESET spol. s.r.o. ESET AV Remover
- CVE-2026-14989Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameterwplegalpages WPLP Cookie Consent – Cookie Banner & Consent…
- CVE-2026-14359YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_userYITH WooCommerce Waitlist Premium
- CVE-2026-80099Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty SecretNewfold WP Plugin Web · Newfold WP Plugin Crazy Domains +3
- CVE-2026-78491Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80122Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78494Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79636Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper ValidatiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80123Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side RequesDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-75927PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability GrantUser Role Editor – PublishPress Capabilities: Access Contro…
- CVE-2026-84068Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' ParameterQuentn WP
- CVE-2026-16960Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option DisclosureLoops & Logic
- CVE-2026-14962ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_idELEX WooCommerce Request a Quote
- CVE-2026-76009Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpointmartinnguyen1990 Next-Cart Store to WooCommerce Migration
- CVE-2026-83593WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameterquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2026-21104Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary codeSamsung Mobile Devices
- CVE-2026-21101Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitraSamsung Mobile Devices
- CVE-2026-21092Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.Samsung Mobile Devices
- CVE-2026-21087Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server priviSamsung Mobile Devices
- CVE-2026-21085Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-87734An issue was discovered in the utcp package before 0.0.6 for OCaml.OCaml utcp
- CVE-2026-12855H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.Insyde Software InsydeH2O
- CVE-2026-6485UEFI BIOS embedded Shell can be used to bypass Secure BootInsyde Software InsydeH2O
- CVE-2026-49315DoS vulnerability in the input device module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-84293Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Valuesaddonsorg Repeater Fields for Gravity Forms
- CVE-2026-17553Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Actionlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2026-49310Permission control vulnerability in the event notification module.Huawei HarmonyOS
- CVE-2026-49314OOB write vulnerability in the rendering and composition module.Huawei HarmonyOS
- CVE-2026-15667Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameterarraytics Eventin – Event Calendar, Tickets, Registration,…
- CVE-2026-15406Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameterarraytics Eventin – Event Calendar, Tickets, Registration,…
- CVE-2026-76801FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalationfireplugins FireBox – WooCommerce Popup Builder, Exit Inten…
- CVE-2026-13359Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameterbestweblayout Contact Form to DB by BestWebSoft – Messages…
- CVE-2026-87036Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87021Tanium addressed an unauthorized code execution vulnerability in Comply.Tanium Comply
- CVE-2026-87023Tanium addressed a path traversal vulnerability in Comply.Tanium Comply
- CVE-2026-87084Tanium addressed a server-side request forgery vulnerability in Enforce.Tanium Enforce
- CVE-2026-87034Tanium addressed a SQL injection vulnerability in Comply.Tanium Comply
- CVE-2026-87072Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87030Tanium addressed a path traversal vulnerability in Comply.Tanium Comply
- CVE-2026-87075Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87088Tanium addressed an unauthorized code execution vulnerability in Enforce.Tanium Enforce
- CVE-2026-87430Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside theGoogle Chrome
- CVE-2026-87544Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictionsGoogle Chrome
- CVE-2026-87601Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-87608Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to Google Chrome
- CVE-2026-87489Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sGoogle Chrome
- CVE-2026-87509Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code Google Chrome
- CVE-2026-87617Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrGoogle Chrome
- CVE-2026-87618Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-87510Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-87625Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary coGoogle Chrome
- CVE-2026-87431Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a Google Chrome
- CVE-2026-87533Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox viGoogle Chrome
- CVE-2026-87644Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-87616Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-87530Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to exeGoogle Chrome
- CVE-2026-87505Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-87450Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obGoogle Chrome
- CVE-2026-87570Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-87648Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-87479Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-87579Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viaGoogle Chrome
- CVE-2026-87582Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-87471Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-87537Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-87481Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-87457Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside tGoogle Chrome
- CVE-2026-87433Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypaGoogle Chrome
- CVE-2026-87506Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-87553Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-87606Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-87636Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sanGoogle Chrome
- CVE-2026-87588Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox Google Chrome
- CVE-2026-87487Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-87491Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viaGoogle Chrome
- CVE-2026-87536Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-87612Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-87480Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-87499Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-87587Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-87639Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-87542Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via aGoogle Chrome
- CVE-2026-87460Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox viGoogle Chrome
- CVE-2026-87572Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentiaGoogle Chrome
- CVE-2026-87604Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2026-87514Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via aGoogle Chrome
- CVE-2026-87467Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary coGoogle Chrome
- CVE-2026-87554Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outsidGoogle Chrome
- CVE-2026-87569Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sysGoogle Chrome
- CVE-2026-87524Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-87578Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandboGoogle Chrome
- CVE-2026-87633Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UGoogle Chrome
- CVE-2026-87440Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vGoogle Chrome
- CVE-2026-87444Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vGoogle Chrome
- CVE-2026-87585Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code Google Chrome
- CVE-2026-87628Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside thGoogle Chrome
- CVE-2026-52482An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spa
- CVE-2026-71612Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx_
- CVE-2026-71613Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_p
- CVE-2026-71614An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, de
- CVE-2026-71808A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands v
- CVE-2026-71809Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticate
- CVE-2026-79322SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote u
- CVE-2026-79323Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1
- CVE-2026-79324Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote u
Medium, low and unrated 389
- CVE-2026-87926Rizwan17 inventory-management-system Login Page index.php cross site scriptingRizwan17 inventory-management-system
- CVE-2026-87925Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injectionRizwan17 inventory-management-system
- CVE-2026-87924Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authenticationRizwan17 inventory-management-system
- CVE-2026-15460Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive pathzephyrproject zephyr
- CVE-2026-87923Rizwan17 inventory-management-system List DBOperation.php cross site scriptingRizwan17 inventory-management-system
- CVE-2026-87922Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authenticationRizwan17 inventory-management-system
- CVE-2026-88002Open WebUI: Any authenticated user can hang the server via a cyclic chat message historyopen-webui
- CVE-2026-88001Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targetsopen-webui
- CVE-2026-88000Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat treeopen-webui
- CVE-2026-87921Rizwan17 inventory-management-system manage.php update_record sql injectionRizwan17 inventory-management-system
- CVE-2026-87997Open WebUI: Any authenticated user can inject chats into another user's folder via chat completionsopen-webui
- CVE-2026-87994Open WebUI: Channel members can overwrite another member's message via the chat completions endpointopen-webui
- CVE-2026-87017Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backendsopen-webui
- CVE-2026-87015Open WebUI: A user's session cookies are sent to tool servers configured for bearer authenticationopen-webui
- CVE-2026-87014Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notesopen-webui
- CVE-2026-87013Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycleopen-webui
- CVE-2026-87012Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueopen-webui
- CVE-2026-53956Rattler vulnerable to package cache path traversal via conda package build stringconda rattler_cache · conda py-rattler +2
- CVE-2026-73789Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web InterfaceHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2026-73788Privilege Escalation in ClearPass OnGuard AgentHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2026-87928MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_pageMaxSite CMS
- CVE-2026-46460Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an IncoDell PowerScale OneFS
- CVE-2026-85788Incomplete list of disallowed inputs in awslabs mysql-mcp-serverAWS Labs MySQL MCP Server
- CVE-2026-40635Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability.Dell PowerScale OneFS
- CVE-2026-80925vlan: fix skb_under_panic and races when toggling HW VLAN offloadLinux
- CVE-2026-80923xhci: dbgtty: Fix unregister on tty_register_driver() failureLinux
- CVE-2026-80922crypto: qcom-rng - Allow zero as a random numberLinux
- CVE-2026-70425Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain Dell PowerScale OneFS
- CVE-2026-80920io_uring: defer eventfd signaling when queued from a wakeup handlerLinux
- CVE-2026-80919drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_formatLinux
- CVE-2026-80918HID: core: fix number/pointer type confusion on long itemsLinux
- CVE-2026-80917PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systemsLinux
- CVE-2026-80916kcov: fix data corruption and race conditions on PREEMPT_RTLinux
- CVE-2026-80915drm/xe: Fix DPT allocation paths.Linux
- CVE-2026-87876Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)Red Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-87872Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosureRed Hat Ceph Storage · Red Hat OpenStack Platform
- CVE-2026-87875Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length boundRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-79947Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78484Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79945Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78493Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79735Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79693Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege ViDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79942Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with UnDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79944Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege ViDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79946Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79741Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79689Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79941Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79690Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-83530Uncontrolled Memory Allocation in cel-goGoogle cel-go
- CVE-2026-79736Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79729Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79732Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper Certificate Validation vulnerability.Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78482Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-82530IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP HeaderIP2Location Country Blocker
- CVE-2026-78483Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79731Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-64857tirreno has Session Fixation in Login Authenticationtirrenotechnologies tirreno
- CVE-2026-86774Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicygrokability snipe-it
- CVE-2026-86773Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpointsgrokability snipe-it
- CVE-2026-86772Snipe-IT 8.6.3 Stored XSS via Department Namesgrokability snipe-it
- CVE-2026-86769Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkoutgrokability snipe-it
- CVE-2026-86768Snipe-IT before 8.7.0 Improper Input Validation via API Checkoutgrokability snipe-it
- CVE-2026-86767Snipe-IT before 8.7.0 Cross-Company Read via requested-assetsgrokability snipe-it
- CVE-2026-86763snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importergrokability snipe-it
- CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpointsgrokability snipe-it
- CVE-2026-86760snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flaggrokability snipe-it
- CVE-2026-86756Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayStategrokability snipe-it
- CVE-2026-86755Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuthgrokability snipe-it
- CVE-2026-86753snipe-it before 8.7.0 Business Logic Bypass via asset_model endpointgrokability snipe-it
- CVE-2026-86752snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpointsgrokability snipe-it
- CVE-2026-86748Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archivegrokability snipe-it
- CVE-2026-86747snipe-it before 8.7.0 Authorization Bypass via Pivot-Only Usergrokability snipe-it
- CVE-2026-86745Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Exportgrokability snipe-it
- CVE-2026-86744snipe-it before 8.7.0 Race Condition in Asset Checkoutgrokability snipe-it
- CVE-2026-86743Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Reportgrokability snipe-it
- CVE-2026-86742Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Reportgrokability snipe-it
- CVE-2026-86740Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remainsgrokability snipe-it
- CVE-2026-86739Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidencegrokability snipe-it
- CVE-2026-86203PocketMine-MP before 5.39.2 Item Duplication via Despawn Statepmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-86202PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-86200PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWTpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-86198PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-73324VLC media player 3.0.0 through 3.0.23 information disclosure vulnerabilityVideoLAN VLC media player
- CVE-2025-71418PocketMine-MP before 5.25.2 Denial of Service via explodepmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54395PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2023-54394PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacketpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2026-78486Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79964Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79952Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper EncodingDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79971Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper SanitizaDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79968Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check TimeDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79962Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent ExecutiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79965Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control Dell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79966CWE-532: Insertion of Sensitive Information into Log FileDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79969Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent ExecutiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80169Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79638Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79694Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79728Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path TravDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79961Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing AuthenticaDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-78481Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-codedDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79730Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check TimeDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79970Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper VerificaDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-87820CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scannerusmannasir cyberpanel
- CVE-2026-87810Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlocksiyuan-note siyuan
- CVE-2026-78489Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80171Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient EntrDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79727Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of SensiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-54048Apache Impala: Avro Schema URL Server-Side Request ForgeryApache Software Foundation Apache Impala
- CVE-2026-80239Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of SensiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80174Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient SessDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-86777AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodesAlchemyCMS alchemy_cms
- CVE-2026-86776KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field SizeKeePass
- CVE-2026-86547mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTERmrubyc
- CVE-2026-78377Open Redirect in Yordam Informatics's Library Automation SystemYordam Informatics Technology Consulting, Training, and Ele…
- CVE-2026-19733SSRF in Yordam Informatics's Library Automation SystemYordam Informatics Technology Consulting, Training, and Ele…
- CVE-2025-3271DOM-based XSS vulnerability in OpenText™ Documentum WebtopOpenText™ Documentum Webtop
- CVE-2026-11838Improper Authorization in Yordam Informatics' Library Reservation SystemYordam Informatics Technology Consulting, Training, and Ele…
- CVE-2026-79974Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper AuthentiDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79967Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper CertificDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79973Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized AcDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-79640Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2025-46808Sensitive information is leaked into NeuVector’s manager container logsSUSE neuvector
- CVE-2026-80175Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80124Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of SensDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80177Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-80055Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliDell Secure Connect Gateway 5.0 - Application · Dell Secure…
- CVE-2026-17149myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attributesaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2026-19778WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameteraukejomm WPMR Google Feed Manager for WooCommerce – Sell on…
- CVE-2026-19729Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parametersRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-19802Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameterstylemix Checkout Custom Fields Builder for WooCommerce
- CVE-2026-87747Ragic｜Enterprise Cloud Database - Arbitrary File ReadRagic Enterprise Cloud Database
- CVE-2026-85117Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationContact Form 7 Captcha
- CVE-2026-83537WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymentWP Express Checkout
- CVE-2026-80440Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message PlaceholdersHustle
- CVE-2026-19855Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment TextCleanTalk
- CVE-2025-7062Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi EducationLumi Education UG h5p-nodejs-library
- CVE-2026-85418Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table WidgetOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie…
- CVE-2026-85133WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX ActionsWPLP Cookie Consent
- CVE-2026-85132WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scanWPLP Cookie Consent
- CVE-2026-85037Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDORSunshine Photo Cart
- CVE-2026-84222Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' ParameterKirki
- CVE-2026-84113Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' ParameterQuentn WP
- CVE-2026-83541Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table WidgetSina Extension for Elementor
- CVE-2026-82848Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment DisclosureMasteriyo LMS
- CVE-2026-82185WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data ResetWPLP Cookie Consent
- CVE-2026-82184WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option UpdateWPLP Cookie Consent
- CVE-2026-81741Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' ParameterGroundhogg — CRM, Newsletters, and Marketing Automation
- CVE-2026-81022SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code LeakSupportCandy
- CVE-2026-81021SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment DisclosureSupportCandy
- CVE-2026-80341Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDORPayment Plugins for PayPal WooCommerce
- CVE-2026-80340Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-payPayment Plugins for PayPal WooCommerce
- CVE-2026-80339Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-payPayment Plugins for Stripe WooCommerce
- CVE-2026-75861Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized RedemptionUltimate Gift Cards for WooCommerce
- CVE-2026-18042WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking CancellationWP Travel
- CVE-2026-13146WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDORWP Travel
- CVE-2026-13144WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment ResetWP Travel
- CVE-2025-15690Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and StylesContent Mask
- CVE-2026-75905WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcodebrechtvds WP Recipe Maker
- CVE-2026-8615ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Functionghera74 ilGhera Reviso Exporter for WooCommerce
- CVE-2026-84908WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Actiongetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2026-19946Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameterawesomesupport Awesome Support – WordPress HelpDesk & Suppo…
- CVE-2026-21113Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wiSamsung Mobile Visual Voicemail
- CVE-2026-21112Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilegSamsung Mobile Samsung Tips
- CVE-2026-21111Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory.Samsung Mobile libsthmbc
- CVE-2026-21110Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code.Samsung Mobile libsavscmn.so
- CVE-2026-21109Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.Samsung Mobile Watch Plugin
- CVE-2026-21108Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive inforSamsung Mobile Bixby Touch
- CVE-2026-21107Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2026-21106Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enSamsung Mobile Samsung Cloud Assistant
- CVE-2026-21105Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access seSamsung Mobile Collection
- CVE-2026-21103Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.Samsung Mobile Devices
- CVE-2026-21100Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.Samsung Mobile Devices
- CVE-2026-21099Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information.Samsung Mobile Devices
- CVE-2026-21098Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC withSamsung Mobile Devices
- CVE-2026-21097Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary Samsung Mobile Devices
- CVE-2026-21094Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21093Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memorSamsung Mobile Devices
- CVE-2026-21091Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21090Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2026-21089Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-ofSamsung Mobile Devices
- CVE-2026-21088Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write Samsung Mobile Devices
- CVE-2026-21086Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration.Samsung Mobile Devices
- CVE-2026-11821Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpointarraytics Eventin – Event Calendar, Tickets, Registration,…
- CVE-2026-19945WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameterthemeum WP Crowdfunding
- CVE-2026-87737An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml.OCaml mirage-crypto-ec
- CVE-2026-87736An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml.OCaml mirage-crypto-ec
- CVE-2026-87735An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml.OCaml mirage-crypto-pk
- CVE-2026-87733An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml.OCaml mirage-crypto-ec
- CVE-2026-87732An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml.OCaml mirage-crypto
- CVE-2026-49313Permission control vulnerability in the app lock module.Huawei HarmonyOS
- CVE-2026-49309Permission control vulnerability in the Settings module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-41987Permission control vulnerability in the app management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2026-81647Out-of-bounds read vulnerability in the graphics module.Huawei HarmonyOS
- CVE-2026-81646Out-of-bounds read vulnerability in the graphics module.Huawei HarmonyOS
- CVE-2026-75966Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parametereteubert Podlove Podcast Publisher
- CVE-2026-11363Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Importkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2026-19944WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Metathemeum WP Crowdfunding
- CVE-2026-19800Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parametergetwpfunnels Mail Mint – Email Marketing, Newsletter, Email…
- CVE-2026-19797User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parametergm_alex User Access Manager
- CVE-2026-77187My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributesjoedolson My Calendar – Accessible Event Manager
- CVE-2026-77186My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attributejoedolson My Calendar – Accessible Event Manager
- CVE-2026-7804Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameterwoobewoo Product Filter for WooCommerce by WBW
- CVE-2026-81644DoS vulnerability in the preview service module.Huawei HarmonyOS
- CVE-2026-49312Permission control vulnerability in the window module.Huawei HarmonyOS
- CVE-2026-49311Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availabilHuawei HarmonyOS
- CVE-2026-13709Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Settingiqonicdesign Graphina – Charts and Graphs For Elementor
- CVE-2026-12956Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameterarraytics Eventin – Event Calendar, Tickets, Registration,…
- CVE-2026-87048Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87073Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87032Tanium addressed an information disclosure vulnerability in Tanium Server.Tanium Server
- CVE-2026-87035Tanium addressed an information disclosure vulnerability in Comply.Tanium Comply
- CVE-2026-87033Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-14892Tanium addressed an improper access controls vulnerability in Tanium Server.Tanium Server
- CVE-2026-87046Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87025Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87047Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87019Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-14505Tanium addressed a path traversal vulnerability in Tanium Data Service.Tanium Data Service
- CVE-2026-87037Tanium addressed an improper access controls vulnerability in Comply.Tanium Comply
- CVE-2026-87724Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial torprject Tor
- CVE-2026-87083tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserializationtile-ai tilelang
- CVE-2026-87593Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Google Chrome
- CVE-2026-87602Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outsiGoogle Chrome
- CVE-2026-87437Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTMGoogle Chrome
- CVE-2026-87551Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bGoogle Chrome
- CVE-2026-87477Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML Google Chrome
- CVE-2026-87571Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering toGoogle Chrome
- CVE-2026-87575Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass Google Chrome
- CVE-2026-87469Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into aGoogle Chrome
- CVE-2026-87631Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information viaGoogle Chrome
- CVE-2026-87461Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome exGoogle Chrome
- CVE-2026-87473Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bGoogle Chrome
- CVE-2026-87583UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via aGoogle Chrome
- CVE-2026-87490Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information Google Chrome
- CVE-2026-87605Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2026-87624UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the reGoogle Chrome
- CVE-2026-87597UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via Google Chrome
- CVE-2026-87565Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information Google Chrome
- CVE-2026-87523Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain senGoogle Chrome
- CVE-2026-87545Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leakGoogle Chrome
- CVE-2026-87538Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveragGoogle Chrome
- CVE-2026-87546Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass systGoogle Chrome
- CVE-2026-87463Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof Google Chrome
- CVE-2026-87459Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a craGoogle Chrome
- CVE-2026-87502Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process andGoogle Chrome
- CVE-2026-87620Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafteGoogle Chrome
- CVE-2026-87592Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially read memory inside the sandbox vGoogle Chrome
- CVE-2026-87627Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineGoogle Chrome
- CVE-2026-87511Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafteGoogle Chrome
- CVE-2026-87656Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictGoogle Chrome
- CVE-2026-87568Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-87522Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeriGoogle Chrome
- CVE-2026-87543Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-87519Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bGoogle Chrome
- CVE-2026-87598Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via aGoogle Chrome
- CVE-2026-87561Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy Google Chrome
- CVE-2026-87619Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a craftedGoogle Chrome
- CVE-2026-87614Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-87429Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-87653UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via Google Chrome
- CVE-2026-87629Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sGoogle Chrome
- CVE-2026-87626Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web oriGoogle Chrome
- CVE-2026-87610Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions inGoogle Chrome
- CVE-2026-87591Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictionsGoogle Chrome
- CVE-2026-87566Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a craftGoogle Chrome
- CVE-2026-87623Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensGoogle Chrome
- CVE-2026-87632Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craGoogle Chrome
- CVE-2026-87584Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions intoGoogle Chrome
- CVE-2026-87586Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a craftGoogle Chrome
- CVE-2026-87531Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtaiGoogle Chrome
- CVE-2026-87435Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-87563Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a craftedGoogle Chrome
- CVE-2026-87468Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a craftedGoogle Chrome
- CVE-2026-87493Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypasGoogle Chrome
- CVE-2026-87641Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a craftGoogle Chrome
- CVE-2026-87635UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML pGoogle Chrome
- CVE-2026-87535Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system acGoogle Chrome
- CVE-2026-87454Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive informatiGoogle Chrome
- CVE-2026-87483Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to bypass system access rGoogle Chrome
- CVE-2026-87550Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web oGoogle Chrome
- CVE-2026-87484UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UIGoogle Chrome
- CVE-2026-87589Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-87518Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-87594Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-87540Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTMGoogle Chrome
- CVE-2026-87622Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HGoogle Chrome
- CVE-2026-87439Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2026-87532Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictGoogle Chrome
- CVE-2026-87600Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social Google Chrome
- CVE-2026-87555Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sanGoogle Chrome
- CVE-2026-87451Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-87541Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-87495Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leaGoogle Chrome
- CVE-2026-87574Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafteGoogle Chrome
- CVE-2026-87458UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UIGoogle Chrome
- CVE-2026-87549Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass syGoogle Chrome
- CVE-2026-87441Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions viGoogle Chrome
- CVE-2026-87496UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI Google Chrome
- CVE-2026-87567UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoGoogle Chrome
- CVE-2026-87445UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML paGoogle Chrome
- CVE-2026-87649UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass Google Chrome
- CVE-2026-87462UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elGoogle Chrome
- CVE-2026-87655Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemenGoogle Chrome
- CVE-2026-87486Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar viaGoogle Chrome
- CVE-2026-87472Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-87559UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemeGoogle Chrome
- CVE-2026-87507UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UGoogle Chrome
- CVE-2026-87599Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafGoogle Chrome
- CVE-2026-87516Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a craftGoogle Chrome
- CVE-2026-87452Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-87501UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML Google Chrome
- CVE-2026-87548Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictionGoogle Chrome
- CVE-2026-87573Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craGoogle Chrome
- CVE-2026-87508Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafteGoogle Chrome
- CVE-2026-87556Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via Google Chrome
- CVE-2026-87562Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially sGoogle Chrome
- CVE-2026-87534Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeriGoogle Chrome
- CVE-2026-87539Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafteGoogle Chrome
- CVE-2026-87521Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtGoogle Chrome
- CVE-2026-87560Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via Google Chrome
- CVE-2026-87432Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-87513Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to Google Chrome
- CVE-2026-87436Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web Google Chrome
- CVE-2026-87475Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sGoogle Chrome
- CVE-2026-87476Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crGoogle Chrome
- CVE-2026-87576Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-87497Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a cGoogle Chrome
- CVE-2026-87482Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leaGoogle Chrome
- CVE-2026-87580Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-87590Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive inforGoogle Chrome
- CVE-2026-87630Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a craftedGoogle Chrome
- CVE-2026-87443Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a craftGoogle Chrome
- CVE-2026-87645Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictGoogle Chrome
- CVE-2026-87449Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web Google Chrome
- CVE-2026-87577Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a priGoogle Chrome
- CVE-2026-87642Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTGoogle Chrome
- CVE-2026-87615Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemeGoogle Chrome
- CVE-2026-87603Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions vGoogle Chrome
- CVE-2026-87466Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craftGoogle Chrome
- CVE-2026-87652Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-87485Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-87503Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social Google Chrome
- CVE-2026-87557Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-87442Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-87515Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypassGoogle Chrome
- CVE-2026-87465Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-87658Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain croGoogle Chrome
- CVE-2026-87456Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-87611Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-87453Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-87434Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-87657Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memoGoogle Chrome
- CVE-2026-87446Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sGoogle Chrome
- CVE-2026-87478Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a cGoogle Chrome
- CVE-2026-87640Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-87498Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-87564Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML Google Chrome
- CVE-2026-87651Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a craftedGoogle Chrome
- CVE-2026-87552Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensiGoogle Chrome
- CVE-2026-87647Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-87596Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a craftGoogle Chrome
- CVE-2026-87517Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypassGoogle Chrome
- CVE-2026-87525Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sGoogle Chrome
- CVE-2026-87447Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypassGoogle Chrome
- CVE-2025-51619A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service
- CVE-2026-38998A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.
- CVE-2026-39020An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file
- CVE-2026-57825In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .OCaml opam
- CVE-2026-61907An issue was discovered in Cyrus IMAP before 3.12.4.cyrusimap Cyrus IMAP
- CVE-2026-61908An issue was discovered in Cyrus IMAP before 3.12.4.cyrusimap Cyrus IMAP
- CVE-2026-61909An issue was discovered in Cyrus IMAP before 3.12.4.cyrusimap Cyrus IMAP
- CVE-2026-61910An issue was discovered in Cyrus IMAP before 3.12.4.cyrusimap Cyrus IMAP
- CVE-2026-61911An issue was discovered in Cyrus IMAP before 3.12.4.cyrusimap Cyrus IMAP
- CVE-2026-61915An issue was discovered in Cyrus IMAP before 3.12.4.cyrusimap Cyrus IMAP
- CVE-2026-71616An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_co
- CVE-2026-71802A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3.
- CVE-2026-71803money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability.
- CVE-2026-71807In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the
- CVE-2026-75307zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.
- CVE-2026-75308yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS).
- CVE-2026-79387SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (i
- CVE-2026-79513A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attacke
- CVE-2026-79514An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS
- CVE-2026-79515An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS
- CVE-2026-79516An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of S
- CVE-2026-79522An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of S