CVEs published September 14, 2026
779 CVEs were published on September 14, 2026: 65 critical, 234 high. 1 is now in CISA KEV.
- Published
- 779
- Critical
- 65
- High
- 234
- Medium
- 426
- Low
- 54
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 582
Most affected products
- Apple macOS
- 103
- Apple iOS and iPadOS · Apple macOS +3
- 58
- Apache Software Foundation Apache Syncope
- 22
- Apple iOS and iPadOS · Apple macOS +2
- 20
- Apple iOS and iPadOS · Apple macOS
- 19
- GPAC
- 18
- Mattermost
- 16
- Apple iOS and iPadOS · Apple macOS +1
- 12
- Apple iOS and iPadOS
- 11
- IBM WebSphere Application Server
- 11
Critical 65
- CVE-2026-12944Incomplete Security Scanner Blocklist Enables Network-Based Code ExecutionIBM Langflow OSS
- CVE-2026-67399Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.WebPros WHMCS
- CVE-2026-65414An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-43790The issue was addressed with improved memory handling.Apple macOS
- CVE-2026-84609A permissions issue was addressed with improved path validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84520A buffer overflow was addressed with improved size validation.Apple macOS
- CVE-2026-84561A double free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84625A permissions issue was addressed with additional sandbox restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-86881A certificate validation issue was addressed with improved certificate validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-53713Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosureenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-54334UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`theopolis uefi-firmware-parser · uefi-firmware
- CVE-2026-54333UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTabletheopolis uefi-firmware-parser · uefi-firmware
- CVE-2026-50006Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Modejulien040 anyquery · github.com/julien040/anyquery
- CVE-2026-55209resdata insufficiently validates untrusted GRDECL filesequinor resdata · resdata
- CVE-2026-16338DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareIBM DataStage on Cloud Pak for Data
- CVE-2026-59178ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgradeesphome device-builder · esphome-device-builder
- CVE-2026-90945Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secretcrawlab-team crawlab
- CVE-2026-90942Casdoor through 4.4.0 Private Key Exposure via Certificate Endpointscasdoor
- CVE-2026-57578DotVVM: Missing authorization in AuthorizeActionFilterriganti dotvvm
- CVE-2026-76461Cisco Secure Email Gateway SQL Injection VulnerabilityCisco Secure Email
- CVE-2026-76443Cisco Secure Email Gateway Security Hardening ReleaseCisco Secure Email
- CVE-2026-76440Cisco Secure Email Gateway Security Hardening ReleaseCisco Secure Email
- CVE-2026-20353Cisco Secure Email Gateway Security Hardening ReleaseCisco Secure Email
- CVE-2026-76441Cisco Secure Email Gateway Security Hardening ReleaseCisco Secure Email and Web Manager
- CVE-2026-61534Yayson: Prototype pollution in the Store/LegacyStore deserializationconfetti yayson · yayson
- CVE-2026-57145PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path ValidationMervinPraison PraisonAI · praisonai
- CVE-2026-57131praisonai: Jobs API exposes agent-execution endpoints with no authenticationMervinPraison PraisonAI · praisonai
- CVE-2026-57124PraisonAI UI MCP connect endpoint allows unauthenticated local command executionMervinPraison PraisonAI · praisonai
- CVE-2026-57127praisonai: recipe serve auth middleware silently disables itself when no secret is setMervinPraison PraisonAI · praisonai
- CVE-2026-57123PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inMervinPraison praisonaiagents · praisonaiagents
- CVE-2026-57125PraisonAI: Unauthenticated RCE via Jobs API + Approval BypassMervinPraison PraisonAI · MervinPraison praisonaiagents +2
- CVE-2026-82431Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.usersApache Software Foundation Apache Storm Client
- CVE-2026-82434Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to LogsApache Software Foundation Apache Storm Nimbus · Apache Sof…
- CVE-2026-82435Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging DecoderApache Software Foundation Apache Storm Worker
- CVE-2026-82439Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPCApache Software Foundation Apache Storm DRPC
- CVE-2026-82441Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency KeysApache Software Foundation Apache Storm Nimbus
- CVE-2026-90961MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String CredentialsMISP
- CVE-2026-73370Apache Syncope: Cross-Realm boundaries reconciliation bypassApache Software Foundation Apache Syncope
- CVE-2026-78299In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract fEclipse Foundation Eclipse Embedded CDT
- CVE-2026-73470Apache Syncope: Delegating users can grant unowned RolesApache Software Foundation Apache Syncope
- CVE-2026-73579Apache Syncope: Non-recursive Any search could skip Realms restrictionsApache Software Foundation Apache Syncope
- CVE-2026-75030Apache Syncope: Incomplete authorization checks for Group members deprovisioningApache Software Foundation Apache Syncope
- CVE-2026-77051Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events searchApache Software Foundation Apache Syncope
- CVE-2026-73668Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration valuesApache Software Foundation Apache Syncope
- CVE-2026-90937froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLfroxlor
- CVE-2026-77181Apache Syncope: ClientApp update entitlement not effectiveApache Software Foundation Apache Syncope
- CVE-2026-78330Apache Syncope: Privilege escalation for admin user via JWT authenticationApache Software Foundation Apache Syncope
- CVE-2026-12258Inadequate access control in the Hiperdino REST APIHiperdino REST API
- CVE-2026-90919LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle DeserializationModelTC LightLLM
- CVE-2026-21391Improper Claim Validation in PingAM OIDC ProviderPing Identity PingAM
- CVE-2026-82232Apache Syncope: SQL injection via sort parameter in Task searchApache Software Foundation Apache Syncope
- CVE-2026-86460Apache Syncope: Cypher Injection via FIQL Search on Neo4j PersistenceApache Software Foundation Apache Syncope
- CVE-2026-87785Apache Syncope: JWT subject spoofingApache Software Foundation Apache Syncope
- CVE-2026-87802Apache Syncope: SRA OAuth2 JWT signature verification bypassApache Software Foundation Apache Syncope
- CVE-2026-90898Bifrost unauthenticated remote code execution via MCP stdio client registrationmaximhq Bifrost
- CVE-2026-90703D-Link DWR-M921 formDiskCreateShare system os command injectionD-Link DWR-M921
- CVE-2026-90702D-Link DWR-M921 formDiskFormat system os command injectionD-Link DWR-M921
- CVE-2026-90699D-Link DWR-M920 formPinManageSetup sub_41E60C os command injectionD-Link DWR-M920
- CVE-2026-90693D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflowD-Link DIR-878
- CVE-2026-90692D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflowD-Link DIR-878
- CVE-2026-82787Missing authentication for critical function vulnerability exists in CPSL-08P1EN.Contec Co. CPSL-08P1EN
- CVE-2026-85192Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0regularlabs.com Conditional Content Pro extension for Joomla
- CVE-2026-90680D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflowD-Link DIR-823G
- CVE-2026-90608Totolink A3002MU boa formPortFw buffer overflowTotolink A3002MU
- CVE-2026-90607Totolink A3002MU boa formNewSchedule buffer overflowTotolink A3002MU
High 234
- CVE-2026-91200DevSpace through 6.3.21 Path Traversal via tar extractiondevspace
- CVE-2026-91197Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactoryflowable-engine
- CVE-2026-81900Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)Concrete CMS
- CVE-2026-18116Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval NotificationsConcrete CMS
- CVE-2026-91145Activiti through 7.1.0.M6 Expression Injection via Mail TaskActiviti
- CVE-2026-91144ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpointzfile-dev zfile
- CVE-2026-18117Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias NameConcrete CMS
- CVE-2026-12756Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026IBM Business Automation Workflow containers and traditional
- CVE-2026-13275IBM MQ Managed File Transfer is vulnerable to XML external entity injectionIBM MQ
- CVE-2026-13285IBM MQ Managed File Transfer is vulnerable to XML external entity injectionIBM MQ
- CVE-2026-13293IBM MQ Java messaging is vulnerable to remote code executionIBM MQ
- CVE-2026-13287IBM MQ Managed File Transfer is vulnerable to XML external entity injectionIBM MQ
- CVE-2026-90896Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PIIMarcosCamara01 Ecommerce Template
- CVE-2026-19290IBM Sterling File Gateway is Vulnerable to Improper Access ControlIBM Sterling File Gateway
- CVE-2026-68489Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to executWebPros Plesk extension "Ruby" · WebPros Plesk extension "N…
- CVE-2026-28960A denial-of-service issue was addressed with improved validation.Apple iOS and iPadOS
- CVE-2026-84631This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2026-84563A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-43686A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84575An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-64701A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-84543An out-of-bounds access issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-86895An information disclosure issue was addressed with improved state management.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2026-84580The issue was addressed with improved checks.Apple macOS
- CVE-2026-84611An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84607A race condition was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84578A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-86904A privacy issue was addressed with improved state management.Apple iOS and iPadOS · Apple watchOS
- CVE-2026-84606A privacy issue was addressed with improved handling of identifiers.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84581A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2026-86894A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-84515An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-43691A path handling issue was addressed with improved validation.Apple macOS
- CVE-2026-84535An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-64761A privacy issue was addressed with improved handling of user preferences.Apple iOS and iPadOS
- CVE-2026-43783A race condition was addressed with improved locking.Apple macOS
- CVE-2026-64736An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84553A resource exhaustion issue was addressed with improved input validation.Apple macOS
- CVE-2026-65415A race condition was addressed with additional validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84512A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2026-84549An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-84565An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-43815A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2026-84572An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-65398An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84620An integer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-65357The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84568A path traversal issue was addressed with improved path validation.Apple macOS
- CVE-2026-84544An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-84505An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-65354A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2026-86901An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-86917A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-84584This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2026-65381A validation issue existed in the entitlement verification.Apple macOS
- CVE-2026-84506A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2026-64752A memory corruption issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-43786This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2026-20683An authentication issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-65362This issue was addressed with improved checks.Apple macOS
- CVE-2026-65374A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2026-84623An authorization issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-65375The issue was addressed with improved authentication.Apple macOS
- CVE-2026-84566The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2026-43683An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-65359An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84507A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-64712This issue was addressed with improved checks.Apple macOS
- CVE-2026-84546An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84511An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84497A buffer overflow was addressed with improved size validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-64790A path handling issue was addressed with improved validation.Apple macOS
- CVE-2026-84598A path traversal issue was addressed with improved path validation.Apple iOS and iPadOS
- CVE-2026-84577An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2026-43684A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS
- CVE-2026-43692A validation issue was addressed with improved input sanitization.Apple macOS
- CVE-2026-28935The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-65364An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-43702The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-43688A memory corruption issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-65344An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-84516An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-65391An out-of-bounds write issue was addressed with improved bounds checking.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-84629This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2026-65390An integer overflow was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-65410The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28938A privacy issue was addressed by moving sensitive data.Apple iOS and iPadOS
- CVE-2026-43689A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84632The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-81901Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpointConcrete CMS
- CVE-2026-81902Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block CleanupConcrete CMS
- CVE-2026-13107Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026IBM Business Automation Workflow containers and traditional
- CVE-2026-53714Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceModeenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-13260Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-81903Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container iconConcrete CMS
- CVE-2026-19816PackageKit: dnf5 backend ignores SIMULATE on RepoRemovePackageKit · Fedora +1
- CVE-2026-65838Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstreamzalando skipper · github.com/zalando/skipper
- CVE-2026-54632SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)sipsorcery-org sipsorcery · SIPSorcery
- CVE-2026-15955IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file pathsIBM Db2
- CVE-2026-54628Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Modejulien040 anyquery · github.com/julien040/anyquery
- CVE-2026-82028Magistrala < 1.0.0 SQL Injection via format Parameter in Reader APIabsmach magistrala
- CVE-2026-54629Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Modejulien040 anyquery · github.com/julien040/anyquery
- CVE-2026-47253Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletionjulien040 anyquery · github.com/julien040/anyquery
- CVE-2026-18119Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style valuesConcrete CMS
- CVE-2026-54447garminconnect: Insecure Permission Assignment for Garmin OAuth Token Storecyberjunky python-garminconnect · garminconnect
- CVE-2026-16335DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareIBM DataStage on Cloud Pak for Data
- CVE-2026-73496MCP Atlassian: Arbitrary server-side file read via attachment uploadsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-16432DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareIBM DataStage on Cloud Pak for Data
- CVE-2026-16428DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareIBM DataStage on Cloud Pak for Data
- CVE-2026-16466DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareIBM DataStage on Cloud Pak for Data
- CVE-2026-16673DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareIBM DataStage on Cloud Pak for Data
- CVE-2026-17133IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsIBM App Connect Enterprise
- CVE-2026-17156IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsIBM App Connect Enterprise
- CVE-2026-17416IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsIBM App Connect Enterprise
- CVE-2026-17467Vulnerabilities exists in IBM Cloud Pak for Data SystemIBM Cloud Pak for Data System
- CVE-2026-19624NetworkManager-l2tp: local privilege escalation via ipsec.conf injectionNetworkManager-l2tp · Fedora
- CVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlinkPython Software Foundation CPython · libpython +2
- CVE-2026-82035PyMuPDF 1.28.2 Path Traversal via extract_objects() Font BranchPyMuPDF
- CVE-2026-89023ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST APIThemeAtelier Domain For Sale
- CVE-2026-77884Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposureBrain Trust Gallery - Private Photo Vault
- CVE-2026-86830Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity CenterAWS iam-identity-center-team
- CVE-2026-54180backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)Laravel-Backpack CRUD · backpack/crud
- CVE-2026-91080webhook through 2.8.3 Memory Exhaustion via Oversized Request Bodyadnanh webhook
- CVE-2026-90946DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocketAsyncFuncAI deepwiki-open
- CVE-2026-90944Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parsekrayin laravel-crm
- CVE-2026-54178backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskLaravel-Backpack CRUD · backpack/crud
- CVE-2026-54182backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)Laravel-Backpack CRUD · backpack/crud
- CVE-2026-54175backpack/crud: Unverified password change in MyAccountController via mass assignmentLaravel-Backpack CRUD · backpack/crud
- CVE-2026-86836In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaEclipse Foundation Eclipse Ankaios
- CVE-2026-57577DotVVM: ReDOS in routingriganti dotvvm
- CVE-2026-73494blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserhttp4s blaze · org.http4s blaze-http_2.13 +5
- CVE-2026-53752docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Serviceplutext docx4j · org.docx4j docx4j-core +1
- CVE-2026-53659http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoShttp4k · org.http4k:http4k-core
- CVE-2026-85892Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2026-55091flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keyjoaonuno flat-to-nested-js · flat-to-nested
- CVE-2026-85921Windows Secure Kernel Mode Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-54567Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)jugmac00 flask-reuploaded · flask-reuploaded
- CVE-2026-70658pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierpay-rails pay · pay
- CVE-2026-49250Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsedmundhung conform · @conform-to/dom
- CVE-2026-54087EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldEasyCorp EasyAdminBundle · easycorp/easyadmin-bundle
- CVE-2026-34151XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2026-19499Buffer overflow in strfmon and strfmon_l right-justification paddingThe GNU C Library glibc
- CVE-2026-55253LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposurelangchain-ai langchain-mongodb · langchain-ai langgraph-… +3
- CVE-2026-50276dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-rb · datadog
- CVE-2026-50270dd-trace-java: Improper parsing of W3C baggage headers may lead to DoSDataDog dd-trace-java · com.datadoghq dd-java-agent +1
- CVE-2026-59960Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/coreargos-ci argos-javascript · @argos-ci/core
- CVE-2026-57579Alchemy: Unauthenticated nested page API leaks restricted & unpublished contentAlchemyCMS alchemy_cms · alchemy_cms
- CVE-2026-55416Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterizationpimcore · pimcore/pimcore
- CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table namepimcore · pimcore/pimcore
- CVE-2026-55451gettext-converter: Prototype pollution in js2i18next() via crafted translation keyslocize gettext-converter · gettext-converter
- CVE-2026-84445gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversgrpc-go · google.golang.org/grpc
- CVE-2026-76442Cisco Secure Email Gateway Security Hardening ReleaseCisco Secure Email
- CVE-2026-54156node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSnode-opcua
- CVE-2026-54155node-opcua: Missing nonce verification in UserNameIdentityToken authenticationnode-opcua
- CVE-2026-61701Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Executioncesargb laravel-magiclink · cesargb/laravel-magiclink
- CVE-2026-81301Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file accessEkia File Manager
- CVE-2026-90943parallax filament-comments through 3.0.0 Stored XSS via Comment Bodyparallax filament-comments
- CVE-2026-47701OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authopen-telemetry opentelemetry-operator · github.com/open-tel…
- CVE-2026-90947Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset fileRed Hat Enterprise Linux
- CVE-2026-57132PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationMervinPraison PraisonAI · praisonai
- CVE-2026-57122PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)MervinPraison PraisonAI · praisonai
- CVE-2026-56839PraisonAI Code agent tools fail open without a workspace boundaryMervinPraison PraisonAI · praisonai
- CVE-2026-57119PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs APIMervinPraison PraisonAI · praisonai
- CVE-2026-57129PraisonAI: Arbitrary File Read via `@file:` Mention Path TraversalMervinPraison praisonaiagents · praisonaiagents
- CVE-2026-57126praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSMervinPraison PraisonAI · praisonaiagents
- CVE-2026-59570Android ZCC denial of serviceZscaler Client Connector
- CVE-2026-59569Android ZCC VPN API method privilege escalationZscaler Client Connector
- CVE-2026-25687ZCC race condition in ZPA tunnel handlerZscaler Client Connector
- CVE-2026-57130PraisonAI: IMAP Command Injection via Unsanitized Email Search ParametersMervinPraison praisonaiagents · praisonaiagents
- CVE-2026-82427Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local NameApache Software Foundation Apache Storm Nimbus
- CVE-2026-82428Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob KeysApache Software Foundation Apache Storm Client
- CVE-2026-82429Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker LauncherApache Software Foundation Apache Storm Worker Launcher
- CVE-2026-82430Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the TenantApache Software Foundation Apache Storm Worker Launcher
- CVE-2026-82432Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration OverridesApache Software Foundation Apache Storm Nimbus
- CVE-2026-15600SQL Injection in Alior Bank raty PrestaShop moduleAlior Bank raty
- CVE-2026-7848SQL Injection in Alior Bank raty PrestaShop moduleAlior Bank raty
- CVE-2026-82438Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web OriginsApache Software Foundation Apache Storm Webapp
- CVE-2026-73195Apache Syncope: CSV export spreadsheet formula injectionApache Software Foundation Apache Syncope
- CVE-2026-73236Apache Syncope: Cross-Realm authorization bypass in delegated administrationApache Software Foundation Apache Syncope
- CVE-2026-90949Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatchRed Hat Enterprise Linux
- CVE-2026-90948Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensionsRed Hat Enterprise Linux
- CVE-2026-73178Apache Syncope: JWT Access Token takeoverApache Software Foundation Apache Syncope
- CVE-2026-90938LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketlangbot-app LangBot
- CVE-2026-90934EspoCRM before 10.0.4 Field-level Security Bypass via Attendeesespocrm
- CVE-2026-90933laradashboard through 1.2.2 Missing Authorization via License APIlaradashboard
- CVE-2026-90932LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCElaradashboard
- CVE-2026-90930File Browser through 2.63.23 Path Traversal via Symlink Aliasfilebrowser
- CVE-2026-90929File Browser 2.5.0 Directory Deletion via Upload Failure Cleanupfilebrowser
- CVE-2026-90928File Browser through 2.63.23 Memory Exhaustion via subtitle endpointfilebrowser
- CVE-2026-90927filebrowser through 2.63.23 Denial of Service via unbounded WebSocket messagefilebrowser
- CVE-2024-58383Froxlor before 2.2.0 Insecure File Permissions mysql.conffroxlor · froxlor/froxlor
- CVE-2026-78336Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated userApache Software Foundation Apache Syncope
- CVE-2026-81564Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0joomshaper.com SP Page Builder (Free and Pro) extension for…
- CVE-2026-78375Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0joomshaper.com SP Page Builder (Free and Pro) extension for…
- CVE-2026-20773Improper Authorization in PingFederate Administrative Expression Evaluation EndpointPing Identity PingFederate
- CVE-2026-87779Apache Syncope: AES Secret Key disclosure via log outputApache Software Foundation Apache Syncope
- CVE-2026-8821Playbooks run owner channel membership permission bypassMattermost
- CVE-2026-89180Thinking Software Technology｜EFence - SQL InjectionThinking Software Technology EFence
- CVE-2026-72524Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tablesApache Software Foundation Apache Doris
- CVE-2026-90894Parallels Desktop local privilege escalation via appliance extract argument injectionParallels Desktop for Mac
- CVE-2026-90895MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal InjectionMISP
- CVE-2026-12518Local privilege escalation in the Logi Options+ updater service on WindowsLogitech Logi Options+
- CVE-2026-71198In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image.OpenStack Glance
- CVE-2026-82794SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings.Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F
- CVE-2026-82793Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.Contec Co. CAN-2-WF · Contec Co. CAN-2-USB
- CVE-2026-82765Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series.Contec Co. FXA5000 · Contec Co. FXA5020 +18
- CVE-2026-82791Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication WirContec Co. CAN-2-WF · Contec Co. CAN-2-USB
- CVE-2026-82789An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS).Contec CONPROSYS HMI System
- CVE-2026-82780Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series.Contec Co. CPS-TM341G5MB-ADSC1-931 · Contec Co. CPS-TM34… +1
- CVE-2026-82779Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series.Contec Co. CPS-TM341G5MB-ADSC1-931 · Contec Co. CPS-TM34… +1
- CVE-2026-82777Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series.Contec Co. Integrated Type CPS-PC341[][]-*-9201 · Contec Co…
- CVE-2026-82774Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and Contec Co. M2M Gateway Integrated Type CPS-MG341* · Cont… +2
- CVE-2026-82772Buffer overflow vulnerability exists in Contec EC1000 series.Contec Co. ECE1000 · Contec Co. ECE1020 +1
- CVE-2026-82770Buffer overflow vulnerability exists in Contec RP-WAH-SR Series.Contec Co. RP-WAH-SR1 · Contec Co. RP-WAH-SR2 +2
- CVE-2026-82768Path traversal vulnerability exists in SGA1000.Contec Co. SGA1000
- CVE-2026-82766Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000.Contec Co. SGA1000
- CVE-2026-82762Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 seriContec Co. FXA5000 · Contec Co. FXA5020 +18
- CVE-2026-68955The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries.The installer for Rakuten Kobo Desktop Application
- CVE-2026-88852Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0regularlabs.com Snippets (Free) extension for Joomla · regu…
- CVE-2026-85190Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5regularlabs.com Quick Index (Free, Pro) extension for Joomla
- CVE-2026-85189Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0regularlabs.com Modals (Free, Pro) extension for Joomla
- CVE-2026-90689Tenda W20E formDelWebAuthWhiteUser stack-based overflowTenda W20E
- CVE-2026-85195Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0regularlabs.com Articles Anywhere (Free, Pro) extension for…
- CVE-2026-88853Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0regularlabs.com Modals (Pro) extension for Joomla
- CVE-2026-85191Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0regularlabs.com Tabs & Accordions (Free, Pro) extension for…
- CVE-2026-90688Tenda W20E HTTP formIPMacBindAdd stack-based overflowTenda W20E
- CVE-2023-28148A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.Paessler PRTG Network Monitor
- CVE-2023-32803The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certAmazon ca-certificates
- CVE-2023-45858A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.Paessler PRTG Network Monitor
- CVE-2023-46273Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_sextremenetworks IQ Engine
- CVE-2023-50461An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.TYPO3 direct_mail · directmailteam/direct-mail
- CVE-2026-23789An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400Samsung Exynos 850 firmware
- CVE-2026-31278An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers supremainc BioStar
- CVE-2026-33963An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.Samsung Exynos 1330 firmware
Medium, low and unrated 480
- CVE-2026-90842PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in filePHPGurukul Blood Donor Management System
- CVE-2026-90841PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injectionPHPGurukul Blood Donor Management System
- CVE-2026-90840PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authenticationPHPGurukul Blood Donor Management System
- CVE-2026-90835michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scriptingmichaelliao itranswarp
- CVE-2026-90831GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruptionGNU Binutils
- CVE-2026-90830GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereferenceGNU Binutils
- CVE-2026-75945A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.Arista Networks EOS
- CVE-2026-75944A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserArista Networks EOS
- CVE-2026-90829GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereferenceGNU Binutils
- CVE-2026-75943A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcemArista Networks EOS
- CVE-2026-91201DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessagearc53 DocsGPT
- CVE-2026-91199Refly through 1.1.0 Server-Side Request Forgery via scrape endpointrefly-ai refly
- CVE-2026-91198GrowthBook through 5.0.1 Information Disclosure via Public Endpointsgrowthbook
- CVE-2026-14986Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transactionzephyrproject zephyr
- CVE-2026-77191All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on anArista Networks EOS
- CVE-2026-90828GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereferenceGNU Binutils
- CVE-2026-73449On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIArista Networks EOS
- CVE-2026-91146Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Schemejointakahe takahe
- CVE-2026-91143goproxy through 15.3 Authentication Bypass via CONNECTsnail007 goproxy
- CVE-2026-90827GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after freeGPAC
- CVE-2026-76081ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletionszitadel · github.com/zitadel/zitadel
- CVE-2026-90826GPAC MP4Box base_scenegraph.c gf_node_del out-of-boundsGPAC
- CVE-2026-91181Data Retention Teams Endpoint Leaks Private Team Invite IDMattermost
- CVE-2026-12758Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.IBM Cloud Pak for Business Automation
- CVE-2026-90825GPAC MP4Box base_scenegraph.c gf_node_unregister use after freeGPAC
- CVE-2026-12759Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.IBM Cloud Pak for Business Automation
- CVE-2026-13265IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injectionIBM MQ
- CVE-2026-14275IBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesIBM i Access Family
- CVE-2026-14276IBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesIBM i Access Family
- CVE-2026-14277IBM i Access Client Solutions (ACS) is Affected By Multiple VulnerabilitiesIBM i Access Family
- CVE-2026-18069IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []IBM i
- CVE-2026-19273The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access ControlIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-19086IBM i is Affected By Multiple Vulnerabilities in PASE [, ]IBM i
- CVE-2026-90824GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflowGPAC
- CVE-2026-19280IBM i is Affected By Multiple Vulnerabilities in PASE [, ]IBM i
- CVE-2026-75792IBM Sterling Secure Proxy is vulnerable to multiple issuesIBM Sterling Secure Proxy
- CVE-2026-78415IBM Sterling Secure Proxy is vulnerable to multiple issuesIBM Sterling Secure Proxy
- CVE-2026-7884IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesIBM Cognos Analytics
- CVE-2026-65409A type confusion issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84559A permissions issue was addressed with improved validation.Apple macOS
- CVE-2026-43741A logic issue was addressed with improved state management.Apple macOS
- CVE-2026-28937This issue was addressed through improved state management.Apple macOS
- CVE-2026-86876An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-84518This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +1
- CVE-2026-84534A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-43690A race condition was addressed with improved locking.Apple macOS
- CVE-2026-84522A race condition was addressed with improved state management.Apple macOS
- CVE-2026-86909A logic issue was addressed with improved state management.Apple macOS
- CVE-2026-86883A privacy issue was addressed with improved handling of files.Apple iOS and iPadOS · Apple visionOS
- CVE-2026-64756A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-65393A permissions issue was addressed with improved validation.Apple Xcode · Apple macOS
- CVE-2026-65405A memory initialization issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84555An authorization issue was addressed with improved access control.Apple macOS
- CVE-2026-65413An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-64717A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84514This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2026-43761An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-84492A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84538A denial-of-service issue was addressed with improved input validation.Apple macOS
- CVE-2026-86905This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84596An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84597An out-of-bounds read issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-43664This issue was addressed with improved data protection.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-43808A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-43737An authorization issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65412A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65404An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2026-84554An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-86882An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84574A permissions issue was addressed with improved state management.Apple macOS
- CVE-2026-43687The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84489A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-84523An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84562A race condition was addressed with additional validation.Apple macOS
- CVE-2026-84630A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86898A logic issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-84519An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-65371This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-65408An integer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-84558A double free issue was addressed with improved memory management.Apple macOS
- CVE-2026-84626An information disclosure issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86924A memory corruption issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2026-86885An input validation issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2026-65395An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65403This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65383This issue was addressed with improved checks.Apple macOS
- CVE-2026-86893A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2026-43788An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-84569An access issue was addressed with additional sandbox restrictions on the system pasteboards.Apple macOS
- CVE-2026-84586An information disclosure issue was addressed with improved state management.Apple macOS · Apple watchOS
- CVE-2026-84617An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84601A permissions issue was addressed with improved state management.Apple macOS
- CVE-2026-86903An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86889A certificate validation issue was addressed with improved certificate validation.Apple macOS
- CVE-2026-84621An authorization issue was addressed with improved access control.Apple iOS and iPadOS · Apple macOS
- CVE-2026-65399A file quarantine bypass was addressed with additional checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65376An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-28966An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65360A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86870A heap buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-84532An out-of-bounds read issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-43696An authorization issue was addressed with improved entitlement checks.Apple macOS
- CVE-2026-84524An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84573This issue was addressed with improved checks.Apple macOS
- CVE-2026-84525A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2026-43697An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-84533A cryptographic issue was addressed with improved integrity checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-43785A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-84564An uninitialized memory issue was addressed with improved memory initialization.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84636An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2026-65361This issue was addressed with improved checks.Apple macOS
- CVE-2026-84548An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-65377A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86888A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84509An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-86902A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2026-84600An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-43674An authentication issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2026-84616A type confusion issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84587A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-43789An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2026-86892This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple visionOS
- CVE-2026-84513A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-65382A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2026-65402A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84552The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2026-86884A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-84603A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple visionOS +1
- CVE-2026-84615An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2026-43677An out-of-bounds write issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2026-65342A permissions issue was addressed with improved validation.Apple macOS
- CVE-2026-84510A heap buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-86891An authorization issue was addressed with improved state management.Apple macOS · Apple watchOS
- CVE-2026-28968An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84551A logic issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65401A race condition was addressed with improved state handling.Apple macOS
- CVE-2026-65378An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-86887A privacy issue was addressed by removing sensitive data.Apple iOS and iPadOS · Apple visionOS
- CVE-2026-65358A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84571A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84526An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84619An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2026-84530An information disclosure issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84588A memory corruption issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2026-84567The issue was addressed with improved memory handling.Apple macOS
- CVE-2026-84635A logic issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-28933A use-after-free issue was addressed with improved memory management.Apple macOS
- CVE-2026-28899A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-84622A memory initialization issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-28836A correctness issue was addressed with improved checks.Apple macOS
- CVE-2026-84589A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2026-43787A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-84531An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-84618A permissions issue was addressed with improved validation.Apple macOS
- CVE-2026-43695An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84527A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84570A logic issue was addressed with improved checks.Apple macOS
- CVE-2026-43791A validation issue was addressed with improved input sanitization.Apple macOS
- CVE-2026-86869An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-64753A permissions issue was addressed by removing the vulnerable code.Apple Safari · Apple iOS and iPadOS +4
- CVE-2026-86886A path traversal issue was addressed with improved input validation.Apple iOS and iPadOS · Apple watchOS
- CVE-2026-84550A race condition was addressed with additional validation.Apple macOS
- CVE-2026-65380An issue existed in the handling of snapshots.Apple macOS
- CVE-2026-86890A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2026-84585A permissions issue was addressed with improved state management.Apple macOS
- CVE-2026-84602A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86900An out-of-bounds read issue was addressed with improved input validation.Apple macOS
- CVE-2026-65355An information disclosure issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84593A use after free issue was addressed with improved memory management.Apple iOS and iPadOS
- CVE-2026-84536An integer underflow was addressed with improved input validation.Apple macOS
- CVE-2026-65348A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2026-65352An information disclosure issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-86911This issue was addressed with improved state management.Apple macOS
- CVE-2026-86878A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS
- CVE-2026-86897This issue was addressed with additional entitlement checks.Apple Safari · Apple iOS and iPadOS +2
- CVE-2026-84541An input validation issue was addressed with improved input validation.Apple macOS
- CVE-2026-65411A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple visionOS
- CVE-2026-65407A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84628An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84556An authorization issue was addressed with improved access control.Apple macOS
- CVE-2026-65406A logic issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2026-65369A logic issue was addressed with improved state management.Apple macOS
- CVE-2026-84540An authorization issue was addressed with improved state management.Apple macOS
- CVE-2026-64714A memory corruption issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-43719A use-after-free issue was addressed with improved memory management.Apple macOS
- CVE-2026-86879A denial-of-service issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2026-84517An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2026-43762The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-65345A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2026-84583A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84612An authorization issue was addressed with improved access control.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-86910A permissions issue was addressed with improved path validation.Apple macOS
- CVE-2026-84491A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84487An integer overflow was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-65353An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2026-84624A permissions issue was addressed with improved path validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-65365An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2026-28934A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2026-84560An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2026-84537The issue was addressed with improved memory handling.Apple macOS
- CVE-2026-84521A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2026-84576This issue was addressed with improved checks.Apple macOS
- CVE-2026-90820a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorizationa2aproject a2a-java
- CVE-2026-12763Langflow is vulnerable to authentication bypass and insufficient session expirationIBM Langflow OSS
- CVE-2026-12765Langflow OSS is affected by server-side request forgery due to missing URL validation in flow componentsIBM Langflow OSS
- CVE-2026-90819a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splittinga2aproject a2a-java
- CVE-2026-12766Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple componentsIBM Langflow OSS
- CVE-2026-12767Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetchesIBM Langflow OSS
- CVE-2026-53716Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-90818netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgerynetease-youdao LobsterAI
- CVE-2026-53715Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-53719Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-13272Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-13276Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-53718Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypassenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-13277Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-53717Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2026-15396IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request SmugglingIBM WebSphere Application Server
- CVE-2026-15412IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open RedirectIBM WebSphere Application Server
- CVE-2026-54559PocketSphinx: Buffer overflows in language and acoustic model loading codecmusphinx pocketsphinx · pocketsphinx
- CVE-2026-54247Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoSzalando skipper · github.com/zalando/skipper
- CVE-2026-54246Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authenticationzalando skipper · github.com/zalando/skipper
- CVE-2026-15634IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request SmugglingIBM WebSphere Application Server
- CVE-2026-55244ASTEVAL: Sandbox Escape via BaseException Subclasseslmfit asteval · asteval
- CVE-2026-90816FFmpeg Duration hlsproto.c parse_playlist denial of serviceFFmpeg
- CVE-2026-15887IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-16186IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-16185IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-16187IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-16188IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-16190IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-16189IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-73497MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadatasooperset mcp-atlassian · mcp-atlassian
- CVE-2026-16435IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-55093tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model loadsonos tract · tract-nnef
- CVE-2026-90815FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-boundsFFmpeg
- CVE-2026-16702IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereferenceIBM Db2
- CVE-2026-17047IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []IBM Db2 Mirror for i
- CVE-2026-17463IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumptionIBM Db2
- CVE-2026-17628Langflow is affected by improper authentication due to missing password verification in the password reset endpointIBM Langflow OSS
- CVE-2026-18065IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.IBM i
- CVE-2026-18251IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.IBM i
- CVE-2026-16148Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work itemzephyrproject zephyr
- CVE-2026-16147it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruptionzephyrproject zephyr
- CVE-2026-15924Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr socketszephyrproject zephyr
- CVE-2026-90814cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgerycosmicstack-labs mercury-agent
- CVE-2026-90813cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalizecosmicstack-labs mercury-agent
- CVE-2026-82519Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handlerreallysimpleplugins Really Simple Security
- CVE-2026-90812cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignmentcosmicstack-labs mercury-agent
- CVE-2026-15893Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoSzephyrproject zephyr
- CVE-2026-90811cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosurecosmicstack-labs mercury-agent
- CVE-2026-18151IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.IBM i
- CVE-2026-90810cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorizationcosmicstack-labs mercury-agent
- CVE-2026-18515IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.IBM i
- CVE-2026-19543Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-90809HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injectionHKUDS nanobot
- CVE-2026-89021MikroTik RouterOS Path Traversal via Container OCI/tar Image ExtractionMikroTik RouterOS
- CVE-2026-89020MikroTik RouterOS Stack Buffer Overflow via TFTP URL PathMikroTik RouterOS
- CVE-2026-90808HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklistHKUDS nanobot
- CVE-2026-55832Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnxsonos tract · tract-onnx
- CVE-2026-54181backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedLaravel-Backpack CRUD · backpack/crud
- CVE-2026-54177backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserverLaravel-Backpack CRUD · backpack/crud
- CVE-2026-54176backpack/crud: MyAccountController allows changing the login email without a current-password checkLaravel-Backpack CRUD · backpack/crud
- CVE-2026-91081Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpointsuitenumerique docs
- CVE-2026-91079Huly Platform through 0.7.426 SSRF via Print Servicehcengineering platform
- CVE-2026-57570backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelationLaravel-Backpack CRUD · backpack/crud
- CVE-2026-44162fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`fluent-plugin-s3
- CVE-2026-90807nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link followingnanocoai NanoClaw
- CVE-2026-57583OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated sourceOpenZeppelin contracts-wizard · @openzeppelin wizard +7
- CVE-2026-54723devpi: Database contents leakdevpi · devpi-server
- CVE-2026-57581DotVVM: Unrestricted file uploadriganti dotvvm
- CVE-2026-90806DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorizationDjangoCRM django-crm
- CVE-2026-47256OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenopen-telemetry opentelemetry-collector-contrib · github.com…
- CVE-2026-54150next-video: Unauthenticated arbitrary file read via /api/video request handlermuxinc next-video · next-video
- CVE-2026-55866SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expectedauthzed spicedb · github.com/authzed/spicedb
- CVE-2026-55847Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace renderingallure-framework allure2 · io.qameta.allure allure-gener… +1
- CVE-2026-55846Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Readallure-framework allure2 · io.qameta.allure:allure-commandl…
- CVE-2026-19542Stack-based out-of-bounds write in tdelete during tree rebalancingThe GNU C Library glibc
- CVE-2026-53495containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Servicecontainerd · github.com/containerd/containerd/v2 +1
- CVE-2026-49400October CMS: PHP Object Injection via Backend Widget Session Storageoctobercms october · october/system
- CVE-2026-90805subhajitkhan online-clinic-management-system doctorlogin.php sql injectionsubhajitkhan online-clinic-management-system
- CVE-2026-91021CVE-2026-91021Trilium Trillium Notes
- CVE-2026-46696October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Callsoctobercms system · october/system
- CVE-2026-50157Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKauth0 symfony · auth0/symfony
- CVE-2026-90804GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflowGNU Binutils
- CVE-2026-55102hashi-vault-js: Vault token and secret values exposed in thrown errorskyndryl-open-source hashi-vault-js · hashi-vault-js
- CVE-2026-55837dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokensdbt-labs dbt-mcp · dbt-mcp
- CVE-2026-55073WeasyPrint restrictive URL fetcher bypass allows local file read and SSRFKozea WeasyPrint · weasyprint
- CVE-2026-90803GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflowGNU Binutils
- CVE-2026-90802GNU Binutils ld libbfd.c bfd_putl64 null pointer dereferenceGNU Binutils
- CVE-2026-90801GNU Binutils ld cache.c cache_bwrite buffer overflowGNU Binutils
- CVE-2026-54452safeurl: Missing IPv6 CIDR Ranges in Blocklistdoyensec safeurl · github.com/doyensec/safeurl
- CVE-2026-15923Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_sizezephyrproject zephyr
- CVE-2026-53496ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxesmattiasw ExifReader · exifreader
- CVE-2026-57497webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsulesquic-go webtransport-go · github.com/quic-go/webtransport-go
- CVE-2026-90796itsourcecode Leave Management System index.php sql injectionitsourcecode Leave Management System
- CVE-2026-53708ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)IBM mcp-context-forge · IBM mcp-contextforge-gateway +1
- CVE-2026-90996Sssd: sssd: denial of service in nss responder via crafted zero-length requestsRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-90995Sssd: sssd: local denial of service due to null pointer dereference in pam responderRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-90994Sssd: sssd: denial of service via malformed pam v1 requestsRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-55795Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypasscraftcms commerce · craftcms/commerce
- CVE-2026-4103Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script ExecutionWSO2 API Control Plane · WSO2 API Manager
- CVE-2026-55235langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authenticationlangchain-ai langgraph-api · langgraph-api
- CVE-2026-55236langgraph-api: Incomplete assistant authorization in LangGraph Server run creationlangchain-ai langgraph-api · langgraph-api
- CVE-2026-90795itsourcecode Loan Management System navbar.php cross site scriptingitsourcecode Loan Management System
- CVE-2026-54529SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`smithyhq sqladmin · sqladmin
- CVE-2026-88819In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.Eclipse Foundation Eclipse Data Plane Core
- CVE-2026-54541Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keysnimiq core-rs-albatross · nimiq-primitives
- CVE-2026-90794GPAC MP4Box vrml_tools.c gf_sg_script_load use after freeGPAC
- CVE-2026-54542Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proofnimiq core-rs-albatross · nimiq-primitives
- CVE-2025-24890gix-sec safe.directory protections absent for elevated administratorsGitoxideLabs gitoxide · gix-sec
- CVE-2026-90463Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-90793GPAC MP4Box base_scenegraph.c gf_node_get_name use after freeGPAC
- CVE-2026-90792GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereferenceGPAC
- CVE-2026-57120PraisonAI: execute_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunderMervinPraison praisonaiagents · praisonaiagents
- CVE-2026-90791GPAC MP4Box base_scenegraph.c gf_node_unregister use after freeGPAC
- CVE-2026-90790a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgerya2aproject a2a-python
- CVE-2026-57128PraisonAI: Unauthenticated Event Injection via SSE `/publish` EndpointMervinPraison PraisonAI · praisonaiagents
- CVE-2026-57115PraisonAI: SpiderTools redirect-target SSRF protection bypassMervinPraison PraisonAI · MervinPraison praisonaiagents +1
- CVE-2026-90789itsourcecode Leave Management System login.php sql injectionitsourcecode Leave Management System
- CVE-2026-82433Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UIApache Software Foundation Apache Storm Nimbus · Apache Sof…
- CVE-2026-82019TripleLift video-bundle.js DOM-based XSS via postMessageTripleLift video-bundle.js
- CVE-2026-12985Mattermost DCR redirect URI allowlist bypass via improper URL component validationMattermost
- CVE-2026-82437Apache Storm Logviewer: Log Access Controls Not Enforced by LogviewerApache Software Foundation Apache Storm Logviewer
- CVE-2026-82426Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar LocationApache Software Foundation Apache Storm Nimbus
- CVE-2026-90788magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injectionmagicblack MacCMS10
- CVE-2026-82920Mattermost ABAC parent policy bypass via policy update endpointMattermost
- CVE-2026-90941novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint201206030 novel-plus
- CVE-2026-90940novel-plus through 5.3.3 Default Cache Management Password in the Front Portal201206030 novel-plus
- CVE-2026-90939novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint201206030 novel-plus
- CVE-2026-84179Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology PageApache Software Foundation Apache Storm Nimbus · Apache Sof…
- CVE-2026-86348MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin processMattermost
- CVE-2026-86349Mattermost Server Algorithmic DoS via Unbounded Markdown Block NestingMattermost
- CVE-2026-90787Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges managementSoarkey StudentManagement
- CVE-2026-90786Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertionDvidelabs flatcc
- CVE-2026-73191Apache Syncope: CAS service URL injection via Forwarded HTTP headersApache Software Foundation Apache Syncope
- CVE-2026-7208Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File DeletionYealink SIP-T33G
- CVE-2026-90785Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertionDvidelabs flatcc
- CVE-2026-90957MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report PicturesMISP
- CVE-2026-90784Dvidelabs flatcc semantics.c fb_clear_parser memory leakDvidelabs flatcc
- CVE-2026-75015Apache Syncope: Nested secrets leak cleartext into audit records readableApache Software Foundation Apache Syncope
- CVE-2026-77147Apache Syncope: Groovy Sandbox escape for empty CommandArgsApache Software Foundation Apache Syncope
- CVE-2026-90936Froxlor before 2.3.7 Information Disclosure via customer_email.phpfroxlor · froxlor/froxlor
- CVE-2026-90935Froxlor before 2.3.7 Authorization Bypass via Mysqls.add APIfroxlor · froxlor/froxlor
- CVE-2026-90931LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Uploadlaradashboard
- CVE-2026-90716marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-boundsmarcobambini Gravity
- CVE-2026-90955MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model LoadMISP
- CVE-2026-77883Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylistApache Software Foundation Apache Syncope
- CVE-2026-90715marcobambini Gravity udp json-parser gravity_json.c integer overflowmarcobambini Gravity
- CVE-2026-78318Apache Syncope: Unauthenticated reflected XSS in Console and EnduserApache Software Foundation Apache Syncope
- CVE-2026-90714marcobambini Gravity JSON parser gravity_json.c memory corruptionmarcobambini Gravity
- CVE-2026-90713vllm-project vLLM tiktoken vocab File mod.rs new denial of servicevllm-project vLLM
- CVE-2026-90712Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of serviceGitlawb openclaude
- CVE-2026-90710taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgerytaisan tarzan-cms
- CVE-2026-90709Yot CMS Admin Console admin.php eval code injectionYot CMS
- CVE-2026-79701Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0joomshaper.com SP Page Builder (Pro) extension for Joomla
- CVE-2026-81566Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0joomshaper.com SP Page Builder (Free and Pro) extension for…
- CVE-2026-90708Yot CMS Cookie global.php login sql injectionYot CMS
- CVE-2026-81565Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0joomshaper.com SP Page Builder (Free and Pro) extension for…
- CVE-2026-79700Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0joomshaper.com SP Page Builder (Pro) extension for Joomla
- CVE-2026-10556Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.Mattermost
- CVE-2026-90707Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after freeOpen5GS
- CVE-2026-13417Boards plugin denial of service via unvalidated block fields.propertiesMattermost
- CVE-2026-9812Missing property field ownership validation in Playbooks run property update endpointMattermost
- CVE-2026-5132Unbounded zlib decompression in Calls SDP WebSocket messagesMattermost
- CVE-2026-15814Uploading a crafted image causes excessive memory allocation in the Mattermost ServerMattermost
- CVE-2026-90891ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access ControlASRock Polychrome SYNC/RGB for MB · ASRock Polychrome SYNC/…
- CVE-2026-10542Playbooks channel action update validation issueMattermost
- CVE-2026-90890ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer DereferenceASRock Polychrome SYNC/RGB for MB · ASRock Polychrome SYNC/…
- CVE-2026-14344Inconsistent authorization checks in Mattermost Boards endpointsMattermost
- CVE-2026-12882Mattermost Markdown autolink parsing denial of serviceMattermost
- CVE-2026-90706D-Link DWR-M921 formWsc os command injectionD-Link DWR-M921
- CVE-2026-11993Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustionMattermost
- CVE-2026-14259Board archive import bypasses team board creation permissionsMattermost
- CVE-2026-90705D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injectionD-Link DWR-M921
- CVE-2026-68570Apache Doris: Authorization bypass leading to unauthorized data accessApache Software Foundation Apache Doris
- CVE-2026-90704D-Link DWR-M921 formDiskPartition system command injectionD-Link DWR-M921
- CVE-2026-90701subhajitkhan online-clinic-management-system listdoctor.php sql injectionsubhajitkhan online-clinic-management-system
- CVE-2026-90893MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle EndpointsMISP
- CVE-2026-90700itsourcecode Sales and Inventory System pro_edit1.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-88932multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsmulter
- CVE-2026-90698memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-boundsmemcached
- CVE-2026-90697SourceCodester Inventory Management System invoice.php authorizationSourceCodester Inventory Management System
- CVE-2026-89321Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entryEclipse Foundation Eclipse OpenVSX
- CVE-2026-90696SourceCodester Inventory Management System Product Management products_handler.php cross site scriptingSourceCodester Inventory Management System
- CVE-2026-90695SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scriptingSourceCodester Inventory Management System
- CVE-2026-90694SourceCodester Inventory Management System Customer Management customers_handler.php cross site scriptingSourceCodester Inventory Management System
- CVE-2026-85125The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation.YAMAP -Social Trekking GPS App
- CVE-2026-82796SolarView Compact contains a cross-site scripting vulnerability in Image Management.Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F
- CVE-2026-82795SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting.Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F
- CVE-2026-82792Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.Contec Co. CAN-2-WF · Contec Co. CAN-2-USB
- CVE-2026-82790Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US.Contec Co. PC-HELPER Wireless I/O DIO-0404RY-LWF · Contec C…
- CVE-2026-906910x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal0x4m4 HexStrike AI
- CVE-2026-82763Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series.Contec Co. FXA5000 · Contec Co. FXA5020 +18
- CVE-2026-82788Cross-site scripting vulnerability exists in CPSL-08P1EN.Contec Co. CPSL-08P1EN
- CVE-2026-82786Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…
- CVE-2026-82785Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…
- CVE-2026-82784Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…
- CVE-2026-82783Plaintext storage of a password issue exists in CONPROSYS nano Series .Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1
- CVE-2026-82782Out-of-bounds write vulnerability exists in CONPROSYS nano Series.Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1
- CVE-2026-82781Cross-site scripting vulnerability exists in CONPROSYS nano Series.Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1
- CVE-2026-82778An exposure of information through directory listing issue exists in CONPROSYS PAC Series.Contec Co. Integrated Type CPS-PC341[][]-*-9201 · Contec Co…
- CVE-2026-82776Cross-site scripting vulnerability exists in CONPROSYS PAC Series.Contec Co. Integrated Type CPS-PC341[][]-*-9201 · Contec Co…
- CVE-2026-82775An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series.Contec Co. M2M Gateway Integrated Type CPS-MG341* · Cont… +2
- CVE-2026-82773Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series.Contec Co. M2M Gateway Integrated Type CPS-MG341* · Cont… +2
- CVE-2026-82771Cross-site scripting vulnerability exists in Contec EC1000 series.Contec Co. ECE1000 · Contec Co. ECE1020 +1
- CVE-2026-82769Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series.Contec Co. RP-WAH-SR1 · Contec Co. RP-WAH-SR2 +2
- CVE-2026-82767Cross-site scripting vulnerability exists in SGA1000.Contec Co. SGA1000
- CVE-2026-82764Cross-site request forgery vulnerability exists in multiple Contec products.Contec Co. FXA5000 · Contec Co. FXA5020 +31
- CVE-2026-906900x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection0x4m4 HexStrike AI
- CVE-2026-85196Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0regularlabs.com Articles Anywhere (Pro) extension for Jooml…
- CVE-2026-85188Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomlaregularlabs.com Advanced Module Manager (Free, Pro) exte… +2
- CVE-2026-16726Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.panasonic PANATERM · panasonic RTEX LogReader
- CVE-2026-90687GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after freeGPAC
- CVE-2026-90686GPAC MP4Box loader_bt.c gf_bt_report memory corruptionGPAC
- CVE-2026-90685GPAC MP4Box lsr_dec.c lsr_exec_command_list assertionGPAC
- CVE-2026-90684GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertionGPAC
- CVE-2026-90683GPAC MP4Box base_scenegraph.c gf_node_unregister assertionGPAC
- CVE-2026-90682Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflowMatthias-Wandel jhead
- CVE-2026-90681Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-boundsMatthias-Wandel jhead
- CVE-2026-90623andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validationandreashappe cochise
- CVE-2026-90622GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereferenceGNU libredwg
- CVE-2026-90621ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injectionipa-lab HackingBuddyGPT
- CVE-2026-906200x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication0x4m4 HexStrike AI
- CVE-2026-906190x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection0x4m4 HexStrike AI
- CVE-2026-90618GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injectionGH05TCREW PentestAgent
- CVE-2026-90617GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injectionGH05TCREW PentestAgent
- CVE-2026-90615SourceCodester Class and Exam Timetabling System subject1.php cross site scriptingSourceCodester Class and Exam Timetabling System
- CVE-2026-90614FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserializationFedML-AI FedML
- CVE-2026-90613GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertionGPAC
- CVE-2026-90612GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertionGPAC
- CVE-2026-90611GPAC MP4Box loader_xmt.c xmt_parse_element assertionGPAC
- CVE-2026-90610GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-readGPAC
- CVE-2026-90609GPAC MP4Box vrml_tools.c null pointer dereferenceGPAC
- CVE-2023-22631PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.Paessler PRTG Network Monitor
- CVE-2023-22632PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.Paessler PRTG Network Monitor
- CVE-2023-24034An issue was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3.Nagios XI
- CVE-2023-24035An issue was discovered in Nagios XI before 5.9.3.Nagios XI
- CVE-2023-24283Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of SSimon Tatham Portable Puzzle Collection
- CVE-2023-24284Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function.Simon Tatham Portable Puzzle Collection
- CVE-2023-24285Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long movSimon Tatham Portable Puzzle Collection
- CVE-2023-24286Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter.Simon Tatham Portable Puzzle Collection
- CVE-2023-24287Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command.Simon Tatham Portable Puzzle Collection
- CVE-2023-24288An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessiveSimon Tatham Portable Puzzle Collection
- CVE-2023-24291Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter.Simon Tatham Portable Puzzle Collection
- CVE-2023-29377An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22.Softing Secure Integration Server
- CVE-2023-32778An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1.ILIAS
- CVE-2023-34854HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.digitaldruid HotelDruid
- CVE-2023-37252An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.MediaWiki CheckUser
- CVE-2023-37253An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3.MediaWiki ProofreadPage
- CVE-2023-37366An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 98Samsung Exynos 850 firmware
- CVE-2023-40772A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted requDataEase
- CVE-2023-45023The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation componentTYPO3 femanager · in2code/femanager
- CVE-2023-46035The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.fnando svg_optimizer · svg_optimizer
- CVE-2023-50459An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3.TYPO3 femanager · in2code/femanager
- CVE-2023-50460An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3.TYPO3 femanager
- CVE-2023-50462An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3.TYPO3 content_consent · t3s/content-consent
- CVE-2023-51769Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.Frappe
- CVE-2024-23176An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2.MediaWiki MassMessage
- CVE-2025-26790Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during proceWithSecure Atlant
- CVE-2025-64031libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compresslibarchive
- CVE-2025-68624N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound emaN-able Mail Assure
- CVE-2026-23786An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.Samsung Exynos 1280 firmware
- CVE-2026-23787An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.Samsung Exynos 1280 firmware
- CVE-2026-23788An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380.Samsung Exynos 1280 firmware
- CVE-2026-23790An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.Samsung Exynos 1280 firmware
- CVE-2026-23791An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600.Samsung Exynos 1280 firmware
- CVE-2026-23792An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, WSamsung Exynos 1080 firmware
- CVE-2026-23793An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400.Samsung Exynos 1330 firmware
- CVE-2026-25832In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.TrustedFirmware Mbed TLS
- CVE-2026-33956An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500.Samsung Exynos 1330 firmware
- CVE-2026-33957An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580.Samsung Exynos 1580 firmware
- CVE-2026-33960An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000.Samsung Exynos 1330 firmware
- CVE-2026-33962An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930.Samsung Exynos 850 firmware
- CVE-2026-33964An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500.Samsung Exynos 1580 firmware
- CVE-2026-33966An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.Samsung Exynos 1330 firmware
- CVE-2026-33967An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.Samsung Exynos 1330 firmware
- CVE-2026-33968An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.Samsung Exynos 1330 firmware
- CVE-2026-33970An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330Samsung Exynos 850 firmware
- CVE-2026-38924In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0.Oraios AI Serena