CVEs published September 18, 2026
513 CVEs were published on September 18, 2026: 51 critical, 211 high.
- Published
- 513
- Critical
- 51
- High
- 211
- Medium
- 216
- Low
- 35
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 342
Most affected products
- IBM Guardium Data Protection
- 42
- Synology DiskStation Manager
- 19
- OISF suricata
- 17
- AcademySoftwareFoundation OpenImageIO
- 11
- IBM WebSphere Application Server
- 11
- HCL Software HCL BigFix Service Management
- 9
- strukturag libheif
- 9
- IBM MQ
- 8
- MongoDB Mongoid
- 8
- 1Panel-dev CordysCRM
- 7
Critical 51
- CVE-2026-75885Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointRed Hat OpenShift Container Platform
- CVE-2026-93740Totolink A3002MU formWlEncrypt buffer overflowTotolink A3002MU
- CVE-2026-93739Totolink A3002MU formWlAc buffer overflowTotolink A3002MU
- CVE-2026-93738Totolink A3002MU formSchedule buffer overflowTotolink A3002MU
- CVE-2026-58264FluidSynth: Heap-based buffer overrunfluidsynth
- CVE-2026-93868Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNGCotonti
- CVE-2026-63647CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`1Panel-dev CordysCRM
- CVE-2026-84082IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84078IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84075IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84073IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-61781pg_partman has privilege escalation through SQL injection in create_partition_time()pgpartman pg_partman
- CVE-2026-84064IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84031IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82967IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82832IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82340IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81657IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-80442IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-80441IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-75878IBM Sterling File Gateway is Vulnerable to Authentication BypassIBM Sterling File Gateway
- CVE-2026-93839LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket EndpointModelTC LightLLM
- CVE-2023-54399Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettreeHongjing e-HR
- CVE-2026-59163Mnemosyne has JWT signature verification bypass sync server that allows authentication bypassAxDSan mnemosyne · mnemosyne-memory
- CVE-2026-61550Icinga 2: Improper access control for JSON-RPC update certificate messagesicinga2
- CVE-2026-93762Data deletion and attribute disclosure via field-name method injection in in-memory queriesMongoDB Mongoid
- CVE-2026-92701Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier pathultravioletrs cocos
- CVE-2025-66455LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyInternLM lmdeploy · lmdeploy
- CVE-2026-92702Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP pathultravioletrs cocos
- CVE-2026-77240WACRM: Database-layer authorization bypassesArnasDon wacrm
- CVE-2026-81321CareCam CM2507 Cleartext Storage of Sensitive InformationCareCam HMT.CM2507 Firmware
- CVE-2026-85497CareCam CM2507 Use of Password Hash With Insufficient Computational EffortCareCam HMT.CM2507 Firmware
- CVE-2026-61682kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspacekcp-dev kcp · github.com/kcp-dev/kcp
- CVE-2026-10858IBM MQ for HPE NonStop is vulnerable to a denial of service attackIBM MQ for HPE NonStop
- CVE-2026-84383libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` itemsstrukturag libheif
- CVE-2026-10747IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processingIBM MQ Appliance
- CVE-2025-15399Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-75031In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin featurInterchange
- CVE-2025-53837org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issuexwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml
- CVE-2026-93019Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_readImager
- CVE-2026-93606vm2 before 3.12.1 Sandbox Escape via Promise Symbol.speciespatriksimek vm2
- CVE-2026-93605vm2 NodeVM before 3.12.1 Remote Code Execution via child_processpatriksimek vm2 · vm2
- CVE-2026-93603vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Functionpatriksimek vm2
- CVE-2026-28198Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS ShellCohesity NetBackup Flex OS
- CVE-2026-28197Privilege Escalation via Argument Injection in NetBackup Flex OS ShellCohesity NetBackup Flex OS
- CVE-2026-13639An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009Synology DiskStation Manager
- CVE-2026-13684An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12…Synology DiskStation Manager
- CVE-2026-67100HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-67101HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-84738AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCEAF Companion
- CVE-2026-93467HGiga｜OAKlouds - Insecure DeserializationHGiga OAKlouds-custom_page-2.0 · HGiga OAKlouds-custom_p… +1
High 211
- CVE-2026-93923SiYuan through 3.8.4 Stored XSS via Heading Style Attributesiyuan-note siyuan
- CVE-2026-93922SiYuan through 3.8.4 Stored XSS via notebook namessiyuan-note siyuan
- CVE-2026-88097Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2026-68928Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as AcodeAcode-Foundation Acode
- CVE-2026-71418Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumptionOISF suricata
- CVE-2026-57223Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalationOISF suricata
- CVE-2026-63446Suricata app-layer: passed flows can retain transactions, causing resource exhaustionOISF suricata
- CVE-2026-63447Suricata ftp: crafted FTP traffic can cause quadratic CPU consumptionOISF suricata
- CVE-2026-63452Suricata http1: repeated brotli compression bombs can cause excessive CPU consumptionOISF suricata
- CVE-2026-57227Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messagesOISF suricata
- CVE-2026-57228Suricata smtp/mime: heap out-of-bounds read quoted-printable decoderOISF suricata
- CVE-2026-61714FluidSynth: Heap Buffer Overflow in MIDI Playerfluidsynth
- CVE-2026-61721FluidSynth: Heap-based buffer overrun for DLS samplesfluidsynth
- CVE-2026-93872Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb ParameterCotonti
- CVE-2026-84239IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Bufferssveltejs devalue · devalue
- CVE-2026-84241IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84108IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84106IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84105IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84089IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84086IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84085IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84084IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84083IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-61819pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exceptionpgpartman pg_partman
- CVE-2026-61820pg_partman privilege escalation via SQL injection when inheriting template propertiespgpartman pg_partman
- CVE-2026-84081IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-61817pg_partman privilege escalation via SQL injection in several functions via time decoderpgpartman pg_partman
- CVE-2026-84077IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84076IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-61818pg_partman SQL injection in undo partition time encoderpgpartman pg_partman
- CVE-2026-61821pg_partman authorization bypass to move child tables between schemas during retentionpgpartman pg_partman
- CVE-2026-84074IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84071IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84070IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84036IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-84034IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-93031WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box <= 3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload via Media ImportWP Cloud Plugins/_deleeuw_ Use-your-Drive | Google Drive… +2
- CVE-2026-82896IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82893IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82892IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82887IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-82885IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81937IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81933IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81669IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81656IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81626IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-17619The IBM Platform RTM is affected by an SQL injection vulnerabilityspectrum-lsf : IBM Platform RTM
- CVE-2026-11727IBM MQ for HPE NonStop is vulnerable to a denial of service issueIBM MQ for HPE NonStop
- CVE-2026-11726IBM MQ for HPE NonStop is vulnerable to a denial of service issueIBM MQ for HPE NonStop
- CVE-2026-11725IBM MQ queue manager is vulnerable to privilege escalationIBM MQ
- CVE-2026-11716IBM MQ for HPE NonStop is vulnerable to a denial of service attackIBM MQ for HPE NonStop
- CVE-2026-93838SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idxsgl-project sglang
- CVE-2026-75895Out of bounds read at smpp34_unpack()Osmocom libsmpp34
- CVE-2017-20284Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig ServletCaucho Technology Resin
- CVE-2021-48008Chanjet CRM SQL Injection via get_usedspace.phpChanjet Information Technology Co. CRM
- CVE-2019-25776Weaver E-cology SQL Injection via SyncUserInfo.jspWeaver Network Co. E-cology
- CVE-2026-93854In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2OpenStack Blazar
- CVE-2026-75894Reachable assertion at ranap_handle_co_dt()Osmocom osmo-iuh
- CVE-2026-93852In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projecOpenStack Blazar
- CVE-2026-75893Heap based buffer overflow at ipaccess_proxy_read_msg()Osmocom osmo-bsc
- CVE-2026-93753deepmerge through 4.3.1 Prototype Poisoning via mergeObjectTehShrike deepmerge · deepmerge
- CVE-2026-93752CSSOM through 0.5.0 Denial of Service via length PropertyNV CSSOM
- CVE-2026-93750http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcardkornelski http-cache-semantics
- CVE-2026-93749source-map-js through 1.2.1 Event Loop Denial of Service7rulnik source-map-js · source-map-js
- CVE-2026-93748http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stalekornelski http-cache-semantics · http-cache-semantics
- CVE-2026-81180SysReptor: Authenticated RCE by insecure image processingSyslifters sysreptor
- CVE-2026-81179SysReptor: Host header injection might allow account takeoverSyslifters sysreptor
- CVE-2026-85058Moquette: Missing Authorization in io.moquette:moquette-brokermoquette-io moquette · io.moquette:moquette-broker
- CVE-2026-63445Perses: Unvalidated project parameter enables filesystem path traversalperses · github.com/perses/perses
- CVE-2026-63199Perses: Missing authorization in datasource proxy allows cross-scope secret disclosureperses · github.com/perses/perses
- CVE-2026-63458Perses project query parameter authorization bypass exposes cross-project resourcesperses · github.com/perses/perses
- CVE-2026-32641Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareparseablehq parseable
- CVE-2026-93759Server-side JavaScript injection via string query criteria bypassing the strict operator allowlistMongoDB Mongoid
- CVE-2026-69184c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chainsc-ares
- CVE-2026-61552Icinga 2 DSL Injection via Unescaped Import Template Nameicinga2
- CVE-2026-93760NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardMongoDB Mongoid
- CVE-2026-61551Icinga 2: Stack overflow via deeply nested JSON objectsicinga2
- CVE-2026-93761Denial of service via unbounded regex matching in Mongoid's in-memory query matcherMongoDB Mongoid
- CVE-2026-91127File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererflyfish-dev file-viewer · @file-viewer doc +3
- CVE-2026-33625LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingInternLM lmdeploy · lmdeploy
- CVE-2026-62278LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directoryhargata lubelog
- CVE-2026-62279LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Checkhargata lubelog
- CVE-2026-93763Silent plaintext persistence via unresolved callable database name in encryption schema mapMongoDB Mongoid
- CVE-2026-84975PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)pjsip pjproject
- CVE-2026-93764Plaintext storage of encrypted fields via skipped embedded models in encryption schema generationMongoDB Mongoid
- CVE-2026-63349AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsagronholm anyio · anyio
- CVE-2026-93765Document deletion and process crash via unvalidated method-name dispatch in atomic pop operationMongoDB Mongoid
- GHSA-JR78-W6W5-M8F8Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasksmediawiki/semantic-media-wiki
- CVE-2026-93758Cross-principal document update, theft, and deletion via unvalidated id in nested attributesMongoDB Mongoid
- CVE-2026-61833zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionproject-zot zot · zotregistry.dev/zot/v2 +1
- CVE-2026-61548Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured datarsyslog
- CVE-2026-55556Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handlingrsyslog
- CVE-2026-46655virtio-win: Integer overflow causing a heap overflow in Viosock drivervirtio-win kvm-guest-drivers-windows
- CVE-2026-77239WACRM: Service-role routes missing a role checkArnasDon wacrm
- CVE-2026-91149Cockpit: cockpit: denial of service via unbounded connection thread spawningRed Hat Enterprise Linux · Red Hat OpenShift Dev Spaces
- CVE-2026-77301adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)cthackers adm-zip · adm-zip
- CVE-2026-58197ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movementstacklok toolhive · stacklok toolhive-studio +1
- CVE-2026-61672Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcementprojectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2026-62943btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.shdigint btrbk
- CVE-2026-81505Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentialsfrain-dev convoy · github.com/frain-dev/convoy
- CVE-2026-73863NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsingnanomq
- CVE-2026-54148http4k: `DigestAuthProvider.verify` did not bind to request URIhttp4k · org.http4k:http4k-security-digest
- CVE-2026-11381IBM MQ for HPE NonStop is vulnerable to a denial of service issueIBM MQ for HPE NonStop
- CVE-2026-11378IBM MQ queue manager is vulnerable to remote code executionIBM MQ
- CVE-2025-61682Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-11375IBM MQ queue manager is vulnerable to remote code executionIBM MQ
- CVE-2026-84398CareCam CM2507 Empty Password in Configuration FileCareCam HMT.CM2507 Firmware
- CVE-2026-10853IBM MQ queue manager is vulnerable to remote code executionIBM MQ
- CVE-2026-88259CareCam CM2507 Missing Authentication for Critical FunctionCareCam HMT.CM2507 Firmware
- CVE-2026-93737Azkaban through 4.0.0 Authorization Bypass via ScheduleServletazkaban
- CVE-2026-84447libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoSstrukturag libheif
- CVE-2026-84384libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoSstrukturag libheif
- CVE-2026-10751IBM MQ Java messaging is vulnerable to remote code executionIBM MQ
- CVE-2026-84444libheif uncompressed tiled image encoding allows out-of-bounds writestrukturag libheif
- CVE-2026-84446libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_framesstrukturag libheif
- CVE-2026-10744IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validationIBM MQ for HPE NonStop
- CVE-2026-10575IBM MQ queue manager is vulnerable to remote code executionIBM MQ
- CVE-2026-67549OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds writeAcademySoftwareFoundation OpenImageIO
- CVE-2026-63638OpenImageIO: Cineon invalid bit depth heap out-of-bounds writeAcademySoftwareFoundation OpenImageIO
- CVE-2026-10030IBM MQ Console is vulnerable to privilege escalationIBM MQ
- CVE-2026-63419OpenImageIO: IFF ZBUFFER tile read writes past caller tile bufferAcademySoftwareFoundation OpenImageIO
- CVE-2026-10027IBM MQ queue manager is vulnerable to unauthenticated remote code executionIBM MQ
- CVE-2026-86520Use of Hard-coded Credentials in Bransys ELDBransys ELD
- CVE-2026-63422OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds writeAcademySoftwareFoundation OpenImageIO
- CVE-2025-14754IBM Cloud Pak for Data is vulnerable to OS command injectionIBM Cloud Pak for Data
- CVE-2025-14753IBM Cloud Pak for Data is vulnerable to path traversalIBM Cloud Pak for Data
- CVE-2026-81945PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web ServerPLANET Technology PLANET IGS-5225-8P2T4S
- CVE-2026-81944PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web ServerPLANET Technology PLANET IGS-5225-8P2T4S
- CVE-2026-81943PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCEPLANET Technology PLANET IGS-5225-8P2T4S
- CVE-2026-81942PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web ServerPLANET Technology PLANET IGS-5225-8P2T4S
- CVE-2026-93690uri-js through 4.4.1 Denial of Service via removeDotSegmentsgarycourt uri-js
- CVE-2026-93688SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_roomsgl-project sglang
- CVE-2026-93687braces through 3.0.3 Stack Overflow via Deeply Nested Patternsmicromatch braces · braces
- CVE-2026-7006Sublime Text 4192/3207 Local Privilege Escalation via Update Staging MechanismSublime HQ Pty Sublime Text
- CVE-2026-93652Integer Overflow or Wraparound in µD3TNµD3TN
- CVE-2026-93568Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requestsRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +11
- CVE-2026-93576Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)Red Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-93569Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +11
- CVE-2026-77929ClipBucket < 5.5.3-#182 Remote Code Execution via Photo Upload EndpointMacWarrior clipbucket-v5
- CVE-2026-93567Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +11
- CVE-2026-93660SQLBot through 1.10.1 Improper Access Control via Dashboard Updatedataease SQLBot
- CVE-2026-93659Concrete CMS Community Store before 2.7.8 Stored XSSconcretecms-community-store community_store
- CVE-2026-93658uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuiduutils coreutils
- CVE-2026-93657hickory-resolver before 0.26.2 DNSSEC Validation Bypasshickory-dns hickory-resolver · hickory-resolver
- CVE-2026-77928ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion EndpointMacWarrior clipbucket-v5
- CVE-2026-93565Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byteRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12
- CVE-2026-77927ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion EndpointMacWarrior clipbucket-v5
- CVE-2026-93564Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)Red Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +10
- CVE-2026-93558Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of serviceRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12
- CVE-2026-93560Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dosRed Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-93599rustls-webpki before 0.103.13 Panic via empty BIT STRINGrustls webpki · rustls-webpki
- CVE-2026-93598ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundleArcadeData arcadedb
- CVE-2026-93595ArcadeDB before 26.9.1 ACL Bypass via query_database ToolArcadeData arcadedb
- CVE-2026-93594ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeriesArcadeData arcadedb
- CVE-2026-93593ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type PermissionArcadeData arcadedb
- CVE-2026-93592vLLM before 0.28.0 Denial of Service via negative token IDvllm-project vllm · vllm
- CVE-2026-93591SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.gosiyuan-note siyuan
- CVE-2023-5778Missing Length CheckABB Freelance Controller DCP · ABB Freelance Controller… +2
- CVE-2026-93491Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queueRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12
- CVE-2026-93488Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streamsRed Hat Build of Apache Camel 3.33.3.SP2 · Red Hat Buil… +12
- CVE-2026-93563Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dosRed Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-81627Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smramRed Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2026-93572Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limitsRed Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-93575Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoderRed Hat AMQ Broker · Red Hat build of Apache Camel for S… +3
- CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityRed Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Q… +9
- CVE-2026-15579An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length durMoxa TN-4500B Series
- CVE-2026-87915Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameterdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2026-18405Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Contentjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2026-40539An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 andSynology DiskStation Manager
- CVE-2026-85410Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameterpixarlabs Master Addons for Elementor – Elementor Addons, W…
- CVE-2026-83561Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker RegexComplianz GDPR/CCPA Cookie Consent Banner
- CVE-2026-40530An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1Synology DiskStation Manager
- CVE-2026-6205An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280Synology DiskStation Manager
- CVE-2026-13673An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-Synology DiskStation Manager
- CVE-2026-67103HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-67102HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-75157Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)Apache Software Foundation Apache Airflow
- CVE-2026-12384Broken Access Control in TECHIN2B ApplicationTECHIN2B Application
- CVE-2026-85705Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API ParametersAyeCode Location Manager
- CVE-2026-15275WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameterwpexpertsio WP Multi Store Locator Pro
- CVE-2026-12954Mapster WP Maps <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' ParameterMapster WP Maps
- CVE-2026-14323Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' ParametersPrintcart Store – Web to Print Product Designer for WooComm…
- CVE-2026-18442WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameterwclovers WCFM Marketplace – Multivendor Marketplace for Woo…
- CVE-2026-93494Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminatedRed Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-89058Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard configRed Hat RESTEasy · Red Hat build of Quarkus 3.27.6.redh… +11
- CVE-2026-89059Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)Red Hat RESTEasy · Red Hat build of Quarkus 3.27.6.redh… +11
- CVE-2026-92619Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameterwpdevelop Booking Calendar
- CVE-2026-89413Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameterfarazfrank Filter Gallery
- CVE-2026-90978Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce CheckFilter Gallery
- CVE-2026-88825iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget SettingsiGMS Direct Booking
- CVE-2026-87775Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cellTz Weekly Radio Schedule
- CVE-2026-87774Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via weekTz Weekly Radio Schedule
- CVE-2026-87771Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and readProduct Question and Answer
- CVE-2026-87770Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via productPrice Drop Alert for Woo Commerce
- CVE-2026-87767WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via urlwp shortcut link and advertisement baner
- CVE-2026-85127VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentVikBooking Hotel Booking Engine & PMS
- CVE-2026-85122Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type ConfusionEasy Form Builder by WhiteStudio
- CVE-2026-81810All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key DisclosureAll-in-One WP Migration and Backup
- CVE-2026-93485WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerabilityAutomattic WordPress
- CVE-2026-18912ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticateZohocorp ManageEngine DataSecurity Plus
- CVE-2026-18911ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send reqZohocorp ManageEngine DataSecurity Plus
- CVE-2026-17086ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post ContentShortPixel Image Optimizer – Optimize Images, Convert WebP…
- CVE-2026-93468HGiga｜OAKlouds - Arbitrary File ReadHGiga OAKlouds-bulletin_v3-2.0 · HGiga OAKlouds-bulletin_v3…
- CVE-2026-93456django-page-cms through 2.0.13 CSRF via admin mutation viewsbatiste django-page-cms
- CVE-2026-93455django-page-cms through 2.0.13 Unauthorized Content Access via Staff Accountbatiste django-page-cms
- CVE-2026-79954NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCIDNASA CryptoLib
- CVE-2026-88622NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.
- CVE-2026-88623NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read.
Medium, low and unrated 251
- CVE-2026-77875Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storageQUANTUMTECH Hide Photos - Secure vault
- CVE-2026-93921SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpointsiyuan-note siyuan
- CVE-2026-61670microsandbox: Secret values exposed in world-readable process argumentssuperradcompany microsandbox · microsandbox
- CVE-2026-85271Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)openedx-platform
- CVE-2026-93894In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.Vinyl-Cache Vinyl Cache · Varnish-Software Varnish Cache
- CVE-2026-85272Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validationopenedx-platform
- CVE-2026-71855Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow stateOISF suricata
- CVE-2026-63448Suricata smb: some SMB flows can cause resource exhaustionOISF suricata
- CVE-2026-57229Suricata smtp/mime: incomplete state reset allows detection bypassOISF suricata
- CVE-2026-57225Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loadingOISF suricata
- CVE-2026-63451Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule loadOISF suricata
- CVE-2026-63450Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detectionOISF suricata
- CVE-2026-93562Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smugglingRed Hat Build of Debezium · Red Hat build of Quarkus 3.… +11
- CVE-2026-93574Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingRed Hat Build of Debezium · Red Hat build of Quarkus 3.… +11
- CVE-2026-63449Suricata sip: large SIP message bodies can evade detection with frame keywordOISF suricata
- CVE-2026-57224Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustionOISF suricata
- CVE-2026-57226Suricata swf: heap buffer overflow in SWF decompression depth handlingOISF suricata
- CVE-2026-57222Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6OISF suricata
- CVE-2026-61720FluidSynth: SF2 DMOD Chunk Unsigned Underflowfluidsynth
- CVE-2026-61723FluidSynth: DLS ptbl Chunk Integer Overflowfluidsynth
- CVE-2026-61722FluidSynth: DLS Articulation Chunk Integer Overflowfluidsynth
- CVE-2026-76899CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`1Panel-dev CordysCRM
- CVE-2026-76902CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`1Panel-dev CordysCRM
- CVE-2026-76900CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime1Panel-dev CordysCRM
- CVE-2026-93873Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact PluginCotonti
- CVE-2026-93871Cotonti through 1.0.0 Stored Open Redirect via Page redir: PrefixCotonti
- CVE-2026-93870Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX HandlerCotonti
- CVE-2026-93869Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() RegexCotonti
- CVE-2026-76901CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts1Panel-dev CordysCRM
- CVE-2026-63646CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users1Panel-dev CordysCRM
- CVE-2026-52745CordysCRM: Customer Public Pool Sorting Field SQL Injection1Panel-dev CordysCRM
- CVE-2026-61822pg_partman disable maintenance for all partition setspgpartman pg_partman
- CVE-2026-77528Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationcrossbario autobahn-python · crossbar +1
- CVE-2026-82890IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-81623IBM Guardium Data Protection is affected by multiple vulnerabilities.IBM Guardium Data Protection
- CVE-2026-18869IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]IBM i
- CVE-2026-91202Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged pasteRed Hat Enterprise Linux
- CVE-2026-91203Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race conditionRed Hat Enterprise Linux
- CVE-2026-17262IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]IBM i
- CVE-2026-91205Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink raceRed Hat Enterprise Linux
- CVE-2026-11722IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request SmugglingIBM WebSphere Application Server
- CVE-2026-11711IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-11710IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerabilityIBM WebSphere Application Server
- CVE-2026-11549IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access ControlIBM WebSphere Application Server
- CVE-2026-93841vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDsvllm-project vllm · vllm
- CVE-2026-93840vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_idsvllm-project vllm · vllm
- CVE-2026-11548IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request SmugglingIBM WebSphere Application Server
- CVE-2026-11545IBM WebSphere Application Server is affected by a privilege escalationIBM WebSphere Application Server
- CVE-2026-11540IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-11539IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-11538IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-75892Out of bounds write in PDP ctx GSN-Address decodeOsmocom osmo-ggsn
- CVE-2026-93650Saleor throttling.py get_client_ip excessive authenticationSaleor
- CVE-2026-92768Cockpit-machines: cockpit-machines: sensitive data exposure via command-line argumentsRed Hat Enterprise Linux
- CVE-2026-92747Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process listRed Hat Enterprise Linux
- CVE-2026-92745Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process argumentsRed Hat Enterprise Linux
- CVE-2026-93432Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkusRed Hat build of Quarkus 3.27.6.redhat · Red Hat build o… +6
- CVE-2026-93751uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecCharsgarycourt uri-js
- CVE-2026-81181SysReptor: Session Fixation in Password-Protected Shared NotesSyslifters sysreptor
- CVE-2026-81182SysReptor: Unauthorized file disclosure by broken access control in writable shared notesSyslifters sysreptor
- CVE-2026-81178SysReptor: Anonymous note-share link discloses project member identities and non-shared note activitySyslifters sysreptor
- CVE-2026-71537Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)Paymenter · paymenter/paymenter
- CVE-2026-69186c-ares: Memory-amplification denial of service via unvalidated DNS header record countsc-ares
- CVE-2026-77386Kyoo: OIDC login token can be redirected to an attacker-controlled URLzoriya Kyoo
- CVE-2026-77385Kyoo: Transcoder serves uncataloged files from the media directoryzoriya Kyoo
- CVE-2026-84992md-editor-v3: XSS via fenced-code language rendering bypassimzbf md-editor-v3 · md-editor-v3
- CVE-2026-77396PJSIP: Heap buffer overflow in the AVI parserpjsip pjproject
- CVE-2026-64847AnyIO process-pool workers can block indefinitely on undrained stderragronholm anyio · anyio
- CVE-2026-77616Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77610Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)SemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77609Semantic MediaWiki has an open redirect in Special:URIResolverSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-63406AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secretsanycable · github.com/anycable/anycable +1
- CVE-2026-77607Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSSSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-63405AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Bodyanycable · github.com/anycable/anycable-go +1
- CVE-2026-93559Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authenticationForget-C Jellyfish AI Short Drama Studio
- CVE-2026-91142Cockpit: cockpit: unauthorized modification of login records via integer overflowRed Hat Enterprise Linux · Red Hat OpenShift Dev Spaces
- CVE-2026-91147Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slashRed Hat Enterprise Linux · Red Hat OpenShift Dev Spaces
- CVE-2026-77608Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)SemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-77606Semantic MediaWiki has reflected XSS in Special:Ask plain table headersSemanticMediaWiki · mediawiki/semantic-media-wiki
- CVE-2026-93579Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)Red Hat Build of Debezium · Red Hat build of Quarkus 3.… +10
- CVE-2026-77339Process Compose: Browser DNS rebinding lets websites control local process-compose MCP toolsF1bonacc1 process-compose · github.com/f1bonacc1/process-co…
- CVE-2026-61795Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validationprojectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2026-93534spatie Scotty Self Update SelfUpdater.php update code downloadspatie Scotty
- CVE-2026-61794Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panicprojectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2026-93338Grandstream GWN7660ELR < 1.0.27.6 Information Disclosure via SNMP Default Community StringGrandstream Networks GWN7660ELR
- CVE-2026-61633NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoSnanomq
- CVE-2026-44639NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsingnanomq
- CVE-2026-85478CareCam CM2507 Missing Authentication for Critical FunctionCareCam HMT.CM2507 Firmware
- CVE-2026-93533spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injectionspatie Scotty
- CVE-2026-81305CareCam CM2507 Inclusion of Functionality from Untrusted Control SphereCareCam HMT.CM2507 Firmware
- CVE-2026-54147http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URIhttp4k · org.http4k:http4k-security-digest
- CVE-2026-11537IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-84400CareCam CM2507 Missing Authentication for Critical FunctionCareCam HMT.CM2507 Firmware
- CVE-2026-10841IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request SmugglingIBM WebSphere Application Server
- CVE-2026-84450libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)strukturag libheif
- CVE-2026-93736Mealie before 3.21.0 Information Disclosure via Ratings Endpointmealie-recipes mealie
- CVE-2026-84449libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGVstrukturag libheif
- CVE-2026-84451libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds readstrukturag libheif
- CVE-2026-84448libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)strukturag libheif
- CVE-2026-1037Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-1031Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-77960Use of Hard-coded Credentials in Bransys ELDBransys ELD
- CVE-2026-1030Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-65969OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGVAcademySoftwareFoundation OpenImageIO
- CVE-2026-1029Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-1025Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentIBM Common Licensing
- CVE-2026-86689Cleartext Transmission of Sensitive Information in Bransys ELDBransys ELD
- CVE-2026-93532gedelumbung HospitalManagement Password Change password.php simpan improper authenticationgedelumbung HospitalManagement
- CVE-2025-36421Multiple vulnerabilities in IBM ControllerIBM Controller
- CVE-2025-36178Multiple vulnerabilities in IBM ControllerIBM Controller
- CVE-2025-36147IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.IBM Financial Transaction Manager for SWIFT Services for Mu…
- CVE-2026-65970OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`AcademySoftwareFoundation OpenImageIO
- CVE-2025-36076IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesIBM Cognos Analytics
- CVE-2025-36045TS4300 Tape Library addresses security vulnerabilityIBM TS4300
- CVE-2025-33147IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilitiesIBM Cognos Analytics
- CVE-2025-33141IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.IBM QRadar
- CVE-2026-63635OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoSAcademySoftwareFoundation OpenImageIO
- CVE-2026-63420OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row`AcademySoftwareFoundation OpenImageIO
- CVE-2026-59181OpenImageIO: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElementsAcademySoftwareFoundation OpenImageIO
- CVE-2026-59156OpenImageIO: Unbounded recursion in FITS header parser leads to stack overflowAcademySoftwareFoundation OpenImageIO
- CVE-2026-59956OpenImageIO: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is setAcademySoftwareFoundation OpenImageIO
- CVE-2026-75883PPPD buffer overflow in PEAP response codePPP Project ppp
- CVE-2026-81946PLANET IGS-5225-8P2T4S V1/V2 Weak Password Hashing via MD5 AlgorithmPLANET Technology PLANET IGS-5225-8P2T4S
- CVE-2026-93531gedelumbung HospitalManagement cross-site request forgerygedelumbung HospitalManagement
- CVE-2026-93689WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/Owinfsp
- CVE-2026-93685Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)Red Hat Advanced Cluster Management for Kubernetes
- CVE-2026-93506SveltyCMS File Upload Endpoint upload-media server-side request forgerySveltyCMS
- CVE-2026-93573Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smugglingRed Hat Build of Debezium · Red Hat build of Quarkus 3.… +11
- CVE-2025-13882Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.IBM Sterling Partner Engagement Manager Essentials Edition…
- CVE-2025-1350Multiple vulnerabilities in IBM ControllerIBM Controller
- CVE-2026-16515ICMPv6 error messages sent for multicast-destined packets and non-unique source addresses enable network amplification in Zephyr's IPv6 stackzephyrproject zephyr
- CVE-2026-16514Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemovedzephyrproject zephyr
- CVE-2026-16512Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frameszephyrproject zephyr
- CVE-2024-56344IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilitiesIBM Cognos Analytics
- CVE-2026-85511Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2Red Hat JBoss Enterprise Application Platform 8.1.8.GA ·… +4
- CVE-2026-93676Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checksRed Hat Enterprise Linux
- CVE-2026-10832Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payloadRed Hat JBoss Enterprise Application Platform 8.1.8.GA… +12
- CVE-2026-93566Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size lineRed Hat Build of Debezium · Red Hat build of Quarkus 3.… +11
- CVE-2026-93505SveltyCMS SVG Media Upload media-service.server.ts cross site scriptingSveltyCMS
- CVE-2026-93653Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)Red Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-25684File Type Control rule bypassZscaler ZIA File Type Control
- CVE-2026-93018Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_pImager
- CVE-2026-62282OpenCVE: Server-Side Request Forgery (SSRF) in notificationsopencve
- CVE-2026-93604vm2 3.11.8 Sandbox Escape via crypto.setFipspatriksimek vm2
- CVE-2026-93602rustls-webpki before 0.103.10 CRL Revocation Check Bypassrustls webpki · rustls-webpki
- CVE-2026-93601rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypassrustls webpki · rustls-webpki
- CVE-2026-93600rustls webpki Name Constraints URI Validation Bypassrustls webpki · rustls-webpki
- CVE-2026-93597ArcadeDB before 26.9.1 SSRF via IPv6 transition addressesArcadeData arcadedb
- CVE-2026-93596ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge ConnectArcadeData arcadedb
- CVE-2026-93590ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoderImageMagick
- CVE-2026-93589ImageMagick before 7.1.2-31 Division by Zero in FLIF encoderImageMagick
- CVE-2026-93588ImageMagick before 7.1.2-31 Null Pointer Dereference via PNMImageMagick
- CVE-2026-93587ImageMagick before 7.1.2-31 Policy Bypass via PCD decoderImageMagick
- CVE-2026-93586ImageMagick before 7.1.2-31 Use After Free via ImagesToBlobImageMagick
- CVE-2026-93504SveltyCMS User Attribute Update Endpoint +server.ts access controlSveltyCMS
- CVE-2026-93492Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table sizeRed Hat Build of Debezium · Red Hat build of Quarkus 3.… +10
- CVE-2026-28199Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS ShellCohesity NetBackup Flex OS
- CVE-2026-21806HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)HCL Software HCL BigFix Service Management
- CVE-2026-93578Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypassRed Hat build of Apache Camel for Spring Boot
- CVE-2026-93561Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smugglingRed Hat build of Apache Camel for Spring Boot · Red Hat… +2
- CVE-2026-92976Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0T-Systems TAO
- CVE-2026-15797Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_titledanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2026-90884WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpointbrechtvds WP Recipe Maker
- CVE-2026-21822A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).HCL Software HCL AppScan 360°
- CVE-2026-40538An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-Synology DiskStation Manager
- CVE-2026-40535An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation ManagSynology DiskStation Manager
- CVE-2026-40533An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69Synology DiskStation Manager
- CVE-2025-13533CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fieldswipeoutmedia CSS & JavaScript Toolbox
- CVE-2026-40537A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280Synology DiskStation Manager
- CVE-2026-40536An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation ManagerSynology DiskStation Manager
- CVE-2026-40534An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation MSynology DiskStation Manager
- CVE-2026-40532A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280Synology DiskStation Manager
- CVE-2026-40531An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7Synology DiskStation Manager
- CVE-2026-4036An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStationSynology DiskStation Manager
- CVE-2026-56595HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-56597HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-56592HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-13683An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskSynology DiskStation Manager
- CVE-2026-13623An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation MSynology DiskStation Manager
- CVE-2026-13666An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.Synology DiskStation Manager
- CVE-2026-56590HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-13635An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280Synology DiskStation Manager
- CVE-2026-21848HCL BigFix Service Management is affected by multiple security vulnerabilities.HCL Software HCL BigFix Service Management
- CVE-2026-11757Reflected XSS in KA Informatics' Bar Association WebsiteKA Informatics Technologies Ltd. Bar Association Website
- CVE-2026-93493Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate fieldRed Hat build of Apache Camel for Spring Boot
- CVE-2026-92249Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameterqodeinteractive Qi Addons For Elementor
- CVE-2026-12739WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionsaadiqbal WP Easy Pay – Payment and Donation Form Builder f…
- CVE-2026-85652Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode AttributePhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-16777Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameterjkohlbach Store Exporter – Export WooCommerce Products, Ord…
- CVE-2026-15004FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scriptingninjateam FileBird – WordPress Media Library Folders & File…
- CVE-2026-14472Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Contentextendthemes Kubio AI Page Builder
- CVE-2026-75961NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameterwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-92622Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attributewpchill Strong Testimonials
- CVE-2026-90981Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parametersatollo Newsletter – Send awesome emails from WordPress
- CVE-2026-13471LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)Appointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-17607WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attributechuck1982 WP Inventory Manager
- CVE-2026-92554ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Namedevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2026-17586VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Metakurudrive VK All in One Expansion Unit
- CVE-2024-38639QTSQNAP Systems QTS
- CVE-2024-27123QcalAgentQNAP Systems QcalAgent
- CVE-2026-92561Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameterwpdevelop Booking Calendar
- CVE-2026-89330EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameterswpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Googl…
- CVE-2026-89278GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Scriptjohn-dagelmore GPTranslate – Multilingual AI Translation Ag…
- CVE-2026-84909Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attributesmub Custom Twitter Feeds – A Tweets Widget or X Feed Widget
- CVE-2026-12106Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tagsairani Auto Upload Images
- CVE-2026-75017Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpointwpblockart Magazine Blocks – Blog Designer, Magazine & News…
- CVE-2026-91707Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST EndpointElegant Themes Divi
- CVE-2026-89138Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Actionfarazfrank Filter Gallery
- CVE-2026-92714Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parametercodename065 Download Manager
- CVE-2026-75016Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attributewpblockart Magazine Blocks – Blog Designer, Magazine & News…
- CVE-2026-18317Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Actionfoxtheme Foxtool All-in-One: Contact chat button, Custom lo…
- CVE-2026-17576InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Keyrevmakx InfiniteWP Client
- CVE-2026-90977Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session ComparisonClean Login
- CVE-2026-90976Clean Login < 1.19 - Unauthenticated Account Creation with Registration DisabledClean Login
- CVE-2026-88994All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block AttributesAll Bootstrap Blocks
- CVE-2026-86800WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility CheckHide My WP Ghost
- CVE-2026-86796WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request ParametersHide My WP Ghost
- CVE-2026-79713Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersBreeze Cache
- CVE-2026-90984Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form FieldGenerate PDF using Contact Form
- CVE-2026-89008Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII DisclosureBookit — Booking & Appointment Calendar
- CVE-2026-89007Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing AuthorizationBookit — Booking & Appointment Calendar
- CVE-2026-88993All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type AttributeAll Bootstrap Blocks
- CVE-2026-88844MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDORMasterStudy LMS WordPress Plugin
- CVE-2026-88798Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP HeaderReally Simple Security
- CVE-2026-87966Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOREasy Appointments
- CVE-2026-87965Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link TokenEasy Appointments
- CVE-2026-85350UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought TogetherUpsellWP
- CVE-2026-85123Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type ConfusionEasy Form Builder by WhiteStudio
- CVE-2026-85009RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment RecoveryRestroPress
- CVE-2026-84904King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image OptimizerKing Addons for Elementor
- CVE-2026-84903King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page ShortcodeKing Addons for Elementor
- CVE-2026-84902King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog ImportKing Addons for Elementor
- CVE-2026-81340MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDORMasterStudy LMS WordPress Plugin
- CVE-2026-92991Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative APIbdthemes Live Copy Paste for Elementor – Cross Domain Co… +5
- CVE-2026-14855RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Actionthemewant RT Mega Menu – Mega Menu Builder for Elementor &…
- CVE-2026-15650RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attributethemewant RT Mega Menu – Mega Menu Builder for Elementor &…
- CVE-2026-93371marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injectionmarcopiovanello yt-dlp-web-ui
- CVE-2026-93331GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-boundsGPAC
- CVE-2026-93314Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflowFreedesktop Poppler
- CVE-2026-68493After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they arNextcloud Server
- CVE-2026-77164Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, Nextcloud Server
- CVE-2026-82985The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewiNextcloud Server
- CVE-2026-77170The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether theNextcloud Deck
- CVE-2026-82982The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from appNextcloud Approval
- CVE-2026-77169A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegNextcloud Team Folders
- CVE-2026-82980Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users.Nextcloud Files Lock
- CVE-2026-93313Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflowFreedesktop Poppler
- CVE-2026-93312Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereferenceFreedesktop Poppler
- CVE-2026-93311Freedesktop Poppler SampledFunction Function.cc integer overflowFreedesktop Poppler
- CVE-2026-93310O-RAN-SC SMO OAM VES Collector allocation of resourcesO-RAN-SC SMO OAM
- CVE-2026-79294Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the H