CVEs published September 21, 2026
285 CVEs were published on September 21, 2026: 31 critical, 104 high.
- Published
- 285
- Critical
- 31
- High
- 104
- Medium
- 136
- Low
- 14
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 183
Most affected products
- 1Panel-dev MaxKB
- 13
- laurent22 joplin
- 11
- MISP
- 11
- envoyproxy envoy
- 9
- jishenghua jshERP
- 9
- gocd
- 8
- warp-tech warpgate
- 7
- InvenTree
- 6
- Apache Software Foundation Apache Neethi
- 5
- dromara lamp-cloud
- 5
Critical 31
- CVE-2026-94425Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges managementMoore Threads MTT S80 Driver Package
- CVE-2026-46649Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpointlaurent22 joplin
- CVE-2026-77521MaxKB: Prompt-injectable agent can lead to command execution1Panel-dev MaxKB
- CVE-2026-94424Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflowMoore Threads MTT S80 Driver Package
- CVE-2026-79916MaxKB AWS Bedrock model credential injection leads to remote code execution1Panel-dev MaxKB
- CVE-2026-94572In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control charactOpenStack Octavia
- CVE-2026-94571In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirectOpenStack Octavia
- CVE-2026-58491Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameterwarp-tech warpgate
- CVE-2026-94403ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereferenceColorFul iGameCenter
- CVE-2026-93012Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipeEmail-Sender
- CVE-2026-79920Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install taskajenti
- CVE-2026-61674Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerfluent-bit
- CVE-2026-85751Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trustMailu
- CVE-2026-94301Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232Apache Software Foundation Apache MINA
- CVE-2026-86473Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryApache Software Foundation Apache Airflow · apache-airflow
- CVE-2025-12999UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-ForwardEclipse Foundation Eclipse Open VSX
- CVE-2026-94146BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-whereBioStar BIOS Update Utility
- CVE-2026-82187WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File UploadWeb to Print Online Designer
- CVE-2026-94142BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-whereBioStar Temperature Monitor Utility
- CVE-2026-94129BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-whereBioStar VALKYRIE AURORA
- CVE-2026-94128BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-whereBioStar VIVID LED DJ
- CVE-2026-94101Netcore NBR200V2 routerd vlan_load_form_uci buffer overflowNetcore NBR200V2
- CVE-2026-94100Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflowNetcore NBR200V2
- CVE-2026-94099Netcore NBR200V2 Backup Restore restore.cgi command injectionNetcore NBR200V2
- CVE-2026-94098Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionNetcore NBR200V2
- CVE-2026-36469CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload
- CVE-2026-67827Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE)
- CVE-2026-78847An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w
- CVE-2026-88402A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje
- CVE-2026-88404A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U
- CVE-2026-88405A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of U
High 104
- CVE-2026-94627vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collisionvllm-project vllm
- CVE-2026-94626vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizevllm-project vllm · vllm
- CVE-2026-94624vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessionsvllm-project vllm · vllm
- CVE-2026-94623vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failurevllm-project vllm · vllm
- CVE-2026-94622vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadatavllm-project vllm · vllm
- CVE-2026-94540DesktopSMS 1.11.0 Unauthorized Access via Local ServiceMrPear DesktopSMS
- CVE-2026-65980Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitutionchartbrew
- CVE-2026-94535lamp-cloud through 5.10.0 Unauthorized Notification Deletiondromara lamp-cloud
- CVE-2026-94534lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpointsdromara lamp-cloud
- CVE-2026-93340Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password EndpointGladys Assistant
- CVE-2026-55210Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)laurent22 joplin
- CVE-2026-61652Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)kap-sh zapros · zapros
- CVE-2026-59814Joplin: Stored XSS via inline-served note attachment on published shareslaurent22 joplin
- CVE-2026-61647@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directoryroomi-fields notebooklm-mcp · @roomi-fields/notebooklm-mcp
- CVE-2026-55105Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewerlaurent22 joplin
- CVE-2026-49453Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directorylaurent22 joplin
- CVE-2026-49450Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherNamelaurent22 joplin
- CVE-2026-77523MaxKB: Cross-workspace model parameter form write1Panel-dev MaxKB
- CVE-2026-73553Envoy: RBAC Authorization Bypass via Path Parametersenvoyproxy envoy
- CVE-2026-58269Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`Sync-in server · @sync-in/server
- CVE-2026-73546Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)envoyproxy envoy
- CVE-2026-73512Envoy: use-after-free in QUIC on internal redirectsenvoyproxy envoy
- CVE-2026-73550Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoyenvoyproxy envoy · envoy
- CVE-2026-73547Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null checkenvoyproxy envoy
- CVE-2026-73513Envoy: oghttp2 upstream trailers incorrect handlingenvoyproxy envoy · envoy
- CVE-2026-49811Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability.Dell Command | Monitor
- CVE-2026-73552Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header valuesenvoyproxy envoy
- CVE-2026-73548Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend poolenvoyproxy envoy · envoy
- CVE-2026-55897luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as rootopenwrt luci
- CVE-2026-81469Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability.Dell Inventory Collector Client
- CVE-2026-55159luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entriesopenwrt luci-app-adblock-fast
- CVE-2026-52835Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_databaseTautulli
- CVE-2026-63330Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessionswarp-tech warpgate
- CVE-2026-17052Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspacezephyrproject zephyr
- CVE-2026-49810Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability.Dell Command Powershell Provider
- CVE-2026-94501jshERP through 3.6 Privilege Escalation via userBusiness CRUDjishenghua jshERP
- CVE-2026-94497jshERP through 3.6 Unauthorized Access via by-id Endpointsjishenghua jshERP
- CVE-2026-94496jshERP through 3.6 Privilege Escalation via Role Managementjishenghua jshERP
- CVE-2026-94495jshERP through 3.6 Missing Authorization via systemConfigjishenghua jshERP
- CVE-2026-94412jshERP through 3.6 Authorization Bypass via resetPwdjishenghua jshERP
- CVE-2026-94411jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypejishenghua jshERP
- CVE-2026-48826HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switchingsysadminsmedia homebox
- CVE-2026-48975HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homeboxsysadminsmedia homebox
- CVE-2026-48976HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijacksysadminsmedia homebox
- CVE-2026-62182KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodeskubeedge · github.com/kubeedge/kubeedge
- CVE-2026-94488Telegram Desktop before 6.9.4 allows XSS in the HTML exporter.Telegram Desktop
- CVE-2026-62369KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node joinkubeedge · github.com/kubeedge/kubeedge
- CVE-2026-62371KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 APIkubeedge · github.com/kubeedge/kubeedge
- CVE-2026-94449Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of serviceRed Hat build of Quarkus 3.27.6.redhat · Red Hat build o… +4
- CVE-2026-63116deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writesdeepstreamIO deepstream.io · @deepstream/server
- CVE-2026-77560Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist fortinyauthapp tinyauth · github.com/tinyauthapp/tinyauth
- CVE-2026-76898draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsjgraph drawio
- CVE-2026-84990ntopng: Missing Authorization on System Configuration Backup Download and Listingntopng
- CVE-2026-83621ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsntopng
- CVE-2026-82412ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIntopng
- CVE-2026-55563Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`feast-dev feast
- CVE-2026-61687hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStatehatchet-dev hatchet · github.com/hatchet-dev/hatchet +1
- CVE-2026-53940Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementationconda
- CVE-2026-71543OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Charactersopenbao · github.com/openbao/openbao
- CVE-2026-52741GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pagesgocd
- CVE-2026-68919GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pagesgocd
- CVE-2026-61628nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Conditionlucasdillmann nginx-ignition · github.com/lucasdillmann/ngi…
- CVE-2026-55074Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)chofstede ansible_jailexec · ansible-jailexec
- CVE-2026-55567BleachBit: Exploit File Delete to Escalate Privilegebleachbit
- CVE-2026-61629nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewarelucasdillmann nginx-ignition · github.com/lucasdillmann/ngi…
- CVE-2026-55071MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`SepineTam mcp-for-stata · stata-mcp
- CVE-2026-80110Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpointRed Hat Enterprise Linux · Red Hat Certificate System
- CVE-2026-75939Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumedRed Hat OpenShift Container Platform
- CVE-2026-94404MISP CSRF vulnerability allows unauthorized attribute modificationMISP
- CVE-2026-88807libXrender RenderQueryPictFormats Reply Heap-based Buffer OverflowX.org libXrender
- CVE-2025-71421UVdesk core-framework before 1.1.7 Privilege Escalation via editAgentuvdesk core-framework · uvdesk community-skeleton
- CVE-2026-88806libX11 XkbGetMap Reply Heap-based Buffer Overflowx.org libX11
- CVE-2026-94401MISP Arbitrary Local File Read and SSRF via MISP Export UploadMISP
- CVE-2026-94383MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File ExtensionMISP
- CVE-2026-94381MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimeMISP
- CVE-2026-94374MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' ReportsMISP
- CVE-2026-84285OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5Dassault Systèmes Tuleap Enterprise Edition
- CVE-2026-94368Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source headerRed Hat Openshift Data Foundation
- CVE-2026-89139Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service hostTemporal Technologies Temporal Server
- CVE-2026-87858Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorizationTemporal Technologies Temporal Server
- CVE-2026-65654temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossipTemporal Technologies temporalio/ringpop-go
- CVE-2026-65653temporalio/tchannel-go zero-chunk call fragment causes process terminationTemporal Technologies temporalio/tchannel-go
- CVE-2026-65652temporalio/tchannel-go malformed checksum type causes process terminationTemporal Technologies temporalio/tchannel-go
- CVE-2026-65651temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversalTemporal Technologies temporalio/sqlparser · Temporal Techn…
- CVE-2026-16651temporalio/sqlparser malformed MySQL version comments can cause a panicTemporal Technologies temporalio/sqlparser · Temporal Techn…
- CVE-2026-91866Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceApache Software Foundation Apache Neethi
- CVE-2026-91865Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceApache Software Foundation Apache Neethi
- CVE-2026-91864Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionApache Software Foundation Apache Neethi
- CVE-2026-91863Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceApache Software Foundation Apache Neethi
- CVE-2026-16652Temporal Server Schedule exclusion search can cause excessive CPU consumptionTemporal Technologies Temporal Server
- CVE-2026-92574Cri-o: cri-o checkpoint restore bypasses destination security contextcri-o · Red Hat Confidential Compute Attestation +2
- CVE-2026-15801Cri-o: cri-o: insufficient validation during container checkpoint restoreRed Hat OpenShift Container Platform
- CVE-2026-47321Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateApache Software Foundation Apache MINA
- CVE-2026-90860The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVieCanva
- CVE-2026-36467Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access
- CVE-2026-79079An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c com
- CVE-2026-79316An improper access control vulnerability exists in x-ui 0.3.2.
- CVE-2026-88406FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_valid
- CVE-2026-88407An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers
- CVE-2026-88409FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matri
- CVE-2026-88410The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the
- CVE-2026-88411Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser
- CVE-2026-88738Jazzware RT1000 Edge webUI v.
- CVE-2026-88746idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
Medium, low and unrated 150
- CVE-2026-94426xuxueli xxl-job insert cross site scriptingxuxueli xxl-job
- CVE-2026-94625vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholdersvllm-project vllm · vllm
- CVE-2026-61851Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Toolchartbrew
- CVE-2026-61852Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Toolchartbrew
- CVE-2026-61743Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validationchartbrew
- CVE-2026-94536lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resourcedromara lamp-cloud
- CVE-2026-94533lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/filedromara lamp-cloud
- CVE-2026-94532lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoByIddromara lamp-cloud
- CVE-2026-61541Zapros has an Unbounded Content-Encoding decompression chain that allows denial of servicekap-sh zapros · zapros
- CVE-2026-59830Discourse: Stored XSS via unescaped actor name in post actionsdiscourse
- CVE-2026-46650Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrllaurent22 joplin
- CVE-2026-17054Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassemblyzephyrproject zephyr
- CVE-2026-15890AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronizationzephyrproject zephyr
- CVE-2026-59815Joplin: Pending share recipients can write items into shared folders before accepting invitationslaurent22 joplin
- CVE-2026-55179Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server IDlaurent22 joplin
- CVE-2026-59816Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slashlaurent22 joplin
- CVE-2026-49449Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windowslaurent22 joplin
- CVE-2026-79919MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)1Panel-dev MaxKB
- CVE-2026-79918MaxKB: Sandbox escape via unhooked fexecve1Panel-dev MaxKB
- CVE-2026-94588In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality.Proxmox pmg-api
- CVE-2026-77517MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base1Panel-dev MaxKB
- CVE-2026-77522MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)1Panel-dev MaxKB
- CVE-2026-79917MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation1Panel-dev MaxKB
- CVE-2026-77516MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path1Panel-dev MaxKB
- CVE-2026-77525MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id1Panel-dev MaxKB
- CVE-2026-77518MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows1Panel-dev MaxKB
- CVE-2026-58272Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)Sync-in server · @sync-in/server
- CVE-2026-58270Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`Sync-in server · @sync-in/server
- CVE-2026-77520MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application1Panel-dev MaxKB
- CVE-2026-77519MaxKB: Expired application API keys remain usable on `/chat/api/mcp`1Panel-dev MaxKB
- CVE-2026-73511Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)envoyproxy envoy
- CVE-2026-73551Envoy: Path normalization does not handle dot and dotdot segments with parametersenvoyproxy envoy · envoy
- CVE-2026-93433Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsingRed Hat Enterprise Linux
- CVE-2026-58271@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`Sync-in server · @sync-in/server
- CVE-2026-48521Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is nullenvoyproxy envoy
- CVE-2026-73549Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustersenvoyproxy envoy
- CVE-2026-85219Denial-of-Service in the OpenCanary Redis serviceThinkst Applied Research OpenCanary
- CVE-2026-50572Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfaultenvoyproxy envoy
- CVE-2026-45381Tautulli: Reflected XSS in `/search` endpointTautulli
- CVE-2026-49995Tautulli: Stored Cross-Site Scripting (XSS) in the newsletterTautulli
- CVE-2026-54915Tautulli: Open redirect via whitespace bypass in /auth/redirectTautulli
- CVE-2026-62247Supabase Realtime: Incorrect Authorizationsupabase realtime
- CVE-2026-91167Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundarywarp-tech warpgate
- CVE-2026-91166Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the targetwarp-tech warpgate
- CVE-2026-91165Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error valueswarp-tech warpgate
- CVE-2026-91164Warpgate: API tokens bypass the user's allowed_ip_ranges restrictionwarp-tech warpgate
- CVE-2026-63329Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targetswarp-tech warpgate
- CVE-2026-61748InvenTree: Report/Label print endpoints ignore per-model permissionsInvenTree
- CVE-2026-61746InvenTree: Plugin-settings GET endpoints are readable without authenticationInvenTree
- CVE-2026-61744InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleInvenTree
- CVE-2026-61747InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappingsInvenTree
- CVE-2026-61749InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential DisclosureInvenTree
- CVE-2026-82165Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability.Dell Command | Integration Suite for System Center
- CVE-2026-94494jshERP through 3.6 Tenant Information Disclosure via GET /tenant/infojishenghua jshERP
- CVE-2026-94414jshERP through 3.6 Missing Authorization via updateBtnStrjishenghua jshERP
- CVE-2026-94413jshERP through 3.6 Password Hash Disclosure via /user/infojishenghua jshERP
- CVE-2026-82163Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability.Dell Command | Intel vPro Out of Band
- CVE-2026-61745InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipmentInvenTree
- CVE-2026-69190Graylog: Manager-to-Owner privilege escalation on saved searches and dashboardsgraylog2-server · org.graylog2:graylog2-server
- CVE-2026-55473HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egresssysadminsmedia homebox
- CVE-2026-48974HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handlersysadminsmedia homebox
- CVE-2026-61612@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509ondata ckan-mcp-server · @aborruso/ckan-mcp-server
- CVE-2026-92382Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds writeRed Hat Enterprise Linux
- CVE-2026-62370KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHubkubeedge · github.com/kubeedge/kubeedge
- CVE-2026-59168Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSTomWright dasel · github.com/tomwright/dasel +2
- CVE-2026-62866Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`TomWright dasel · github.com/tomwright/dasel +2
- CVE-2026-77561Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of servicetinyauthapp tinyauth · github.com/steveiliop56/tinyauth +1
- CVE-2026-77582Tinyauth: User enumeration attack by timing oracletinyauthapp tinyauth · github.com/tinyauthapp/tinyauth
- CVE-2026-17051Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell lengthzephyrproject zephyr
- CVE-2026-17050Double free of the USB host configuration descriptor when device enumeration failszephyrproject zephyr
- CVE-2026-63373draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injectionjgraph drawio
- CVE-2026-63334draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklistjgraph drawio
- CVE-2026-63416draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointsjgraph drawio
- CVE-2026-58504draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642jgraph drawio
- CVE-2026-62987Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection headerfabiolb fabio · github.com/fabiolb/fabio
- CVE-2026-88978Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterhatchet-dev hatchet · github.com/hatchet-dev/hatchet
- CVE-2026-84298Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcherhatchet-dev hatchet · github.com/hatchet-dev/hatchet
- CVE-2026-63342Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Checkhatchet-dev hatchet · github.com/hatchet-dev/hatchet
- CVE-2026-61681Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handlerhatchet-dev hatchet · hatchet-dev/hatchet +1
- CVE-2026-77165File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of Nextcloud Server
- CVE-2026-77166The emoji field in the page emoji update endpoint does not properly validate user input.Nextcloud Collectives
- CVE-2026-52742GoCD is vulnerable to historical server configuration API authorization bypassgocd
- CVE-2026-55870GoCD is vulnerable to credential exposure when admins insecurely configure material URLsgocd
- CVE-2026-55625GoCD is vulnerable to authorization bypass via material connection test APIsgocd
- CVE-2026-52740GoCD is vulnerable to pipeline template view API authorization bypassgocd
- CVE-2026-55060GoCD is vulnerable to authorization bypass via support process list APIgocd
- CVE-2026-75158Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filterApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-82355Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixationApache Software Foundation Apache Airflow · apache-airflow
- CVE-2026-93339Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper AttributeMetaphor Creations Ditty
- CVE-2026-52743GoCD before 26.1.0 is vulnerable to authorization bypass via job status APIgocd
- CVE-2026-94184Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)Red Hat Enterprise Linux
- CVE-2026-61630nginx ignition has TOTP Reuse During Validity Windowlucasdillmann nginx-ignition · github.com/lucasdillmann/ngi…
- CVE-2026-54584mport trusts environment-controlled temporary directories in privileged metadata extractionMidnightBSD mport
- CVE-2026-94387Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogWebkul Aureus ERP
- CVE-2025-71420UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Replyuvdesk core-framework · uvdesk community-skeleton
- CVE-2025-71419UVdesk core-framework before 1.1.7 Stored XSS via SwiftMaileruvdesk core-framework · uvdesk community-skeleton
- CVE-2026-94394MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object ReferencesMISP
- CVE-2026-94393MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReportMISP
- CVE-2026-85220Denial-of-Service in the Thinkst Canary Redis serviceThinkst Applied Research Canary
- CVE-2026-94382Beszel before 0.19.0 Insecure Direct Object Reference via user-alertshenrygd beszel
- CVE-2026-94216ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splittingST Engineering iDirect iDX · ST Engineering iDirect Evo iDX
- CVE-2026-94379MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)MISP
- CVE-2026-94373MISP DOM-based Cross-Site Scripting via innerHTML in Contextual MenuMISP
- CVE-2026-94214ST Engineering iDirect iDX/Evo iDX Location Header redirectST Engineering iDirect iDX · ST Engineering iDirect Evo iDX
- CVE-2026-94372Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies IndexMISP
- CVE-2026-94211Hyve5 Leantime Project Dashboard show.blade.php cross site scriptingHyve5 Leantime
- CVE-2026-94210Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scriptingHyve5 Leantime
- CVE-2026-91867Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitelyApache Software Foundation Apache Neethi
- CVE-2026-77021Missing decompression size limit in agent receiver allows memory exhaustion via push agent dataCheckmk
- CVE-2026-92612In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asEclipse Foundation Eclipse iceoryx™ · iceoryx2-bb-container
- CVE-2026-91921Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platformAI Chatbot Platform (SaaS) de 1millionbot.
- CVE-2026-94277Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameMISP
- CVE-2026-92400Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment ConfusionPayment Gateway for PayPal on WooCommerce
- CVE-2026-86802To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via ImportTo Do List Member
- CVE-2026-85113GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor NameGiveWP
- CVE-2026-85010RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-onsRestroPress
- CVE-2026-94152Omega Solution FBP Fulfillment by People User Profile API user authorizationOmega Solution FBP Fulfillment by People
- CVE-2026-94151Omega Solution HRM OS Role Permission API permission missing authenticationOmega Solution HRM OS
- CVE-2026-94150Omega Solution HRM OS SVG File Upload view cross site scriptingOmega Solution HRM OS
- CVE-2026-94149Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injectionOmega Solution HRM OS
- CVE-2026-94148ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosureScadaBR
- CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-94217Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collisionRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-94145xuxueli xxl-job Task Management JobInfoController.java cross site scriptingxuxueli xxl-job
- CVE-2026-94144drogonframework drogon ORM Criteria.cc makeCriteria sql injectiondrogonframework drogon
- CVE-2026-94215Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership checkRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-94213Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identityRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-94143drogonframework drogon ORM Mapper Mapper.h orderBy sql injectiondrogonframework drogon
- CVE-2026-94139Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injectionChengdu Feiyuxing Technology Feiyu Star Router
- CVE-2026-94138Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injectionChengdu Feiyuxing Technology Feiyu Star Router
- CVE-2026-94137Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of serviceHangzhou Shunwang Technology shzh
- CVE-2026-94185nvm alias resolution follows `..` and discloses files outside $NVM_DIR/aliasnvm-sh nvm
- CVE-2026-94110QCMS Content Detail Controllers.php self_Tmp sql injectionQCMS
- CVE-2026-94103RooCMS Frontend Rendering site_pagePHP.php eval code injectionRooCMS
- CVE-2026-94102WuzhiCMS Login index.php redirectWuzhiCMS
- CVE-2026-36468Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL param
- CVE-2026-36470CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php.
- CVE-2026-36471Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbi
- CVE-2026-36472CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2026-78806An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive i
- CVE-2026-79317A session invalidation flaw exists in x-ui 0.3.2.
- CVE-2026-79318web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (appl
- CVE-2026-79319Stencil core 4.43.5 is vulnerable to Incorrect Access Control.
- CVE-2026-79320Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime.
- CVE-2026-88403A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resou
- CVE-2026-88408FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c).
- CVE-2026-88412An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause
- CVE-2026-88467CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors
- CVE-2026-88745EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
- CVE-2026-88756Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logi