CVEs published September 22, 2026
453 CVEs were published on September 22, 2026: 85 critical, 178 high. 4 are now in CISA KEV.
- Published
- 453
- Critical
- 85
- High
- 178
- Medium
- 178
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 4
- Fix available
- 273
Most affected products
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- 33
- sooperset mcp-atlassian · mcp-atlassian
- 25
- MISP
- 19
- Adobe Campaign Classic
- 17
- NVIDIA Infrastructure Controller
- 14
- RTI Connext Professional
- 11
- Hewlett Packard Enterprise (HPE) ALE
- 10
- LANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- 10
- Adobe Connect
- 9
- radareorg radare2
- 9
Critical 85
- CVE-2026-18169IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18163IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18162IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-19202Token Cache Reuse in mcp-toolbox-sdk-pythonGoogle mcp-toolbox-sdk-python
- CVE-2026-17645IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17635IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17472Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-16346DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-77987GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgeryGitHub Enterprise Server
- CVE-2026-87121Out-of-bounds write in lwIP TCP/IP Stack MQTT Client ApplicationlwIP TCP/IP Stack MQTT
- CVE-2026-47116LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSHLTSecurity LTK3500SF
- CVE-2026-89282CVE-2026-89282Apache HTTP Server Project Apache Lounge Windows
- CVE-2026-76709Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76708Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-28324SolarWinds Observability Self-Hosted Remote Code Execution VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2026-91130Home Assistant: XSS in Statistics Graph Cardhome-assistant core · homeassistant
- CVE-2026-57149plone.app.portlets Vulnerable to Remote Code Execution via TALES Injectionplone.app.portlets · plone-app-portlets
- CVE-2026-75745Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE
- CVE-2026-82000Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE
- CVE-2026-81995Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE
- CVE-2026-75689Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Connect
- CVE-2026-75686Adobe Connect | Improper Input Validation (CWE-20)Adobe Connect
- CVE-2026-75682Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Connect
- CVE-2026-75698Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Connect
- CVE-2026-75684Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Connect
- CVE-2026-75697Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Connect
- CVE-2026-77254MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentialssooperset mcp-atlassian
- CVE-2026-43642Softaculous Virtualizor PHP Object Injection via Billing Module HandlerSoftaculous Virtualizor
- CVE-2026-43641Softaculous Virtualizor OS Command Injection via Billing Module HandlerSoftaculous Virtualizor
- CVE-2026-18461Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.RTI Connext Professional
- CVE-2026-7866Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.RTI Connext Professional
- CVE-2026-77244[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty tokensooperset mcp-atlassian · mcp-atlassian
- CVE-2026-75703Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-84412Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-89276Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-83660Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Campaign Classic
- CVE-2026-82013Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Campaign Classic
- CVE-2026-82009Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic
- CVE-2026-75721Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-75723Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic
- CVE-2026-75699Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-73369Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-82011Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic
- CVE-2026-82443Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Campaign Classic
- CVE-2026-82008Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)Adobe Campaign Classic
- CVE-2026-89275Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)Adobe Campaign Classic
- CVE-2026-75728Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic
- CVE-2026-82010Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic
- CVE-2026-85734LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksHKUDS LightRAG · lightrag-hku
- CVE-2026-86059Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.onedokploy
- CVE-2026-94456Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keysGitroomHQ postiz-app
- CVE-2026-95654Databasement before 1.7.14 Authorization Bypass via Stale Invitation TokenDavid-Crty Databasement
- CVE-2026-80156Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation BypassLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-63374AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofingagronholm anyio · anyio
- CVE-2026-80155Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path TruncationLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80152Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script scheduleLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80151Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80147Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom writeLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80146Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom readLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-77621Vector: Arbitrary file write in the file sink via templated path (path traversal).vectordotdev vector
- CVE-2026-80145Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80144Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom writeLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80143Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom readLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-94127BIG-IP APM OAuth vulnerabilityF5 BIG-IP
- CVE-2026-84388A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM ChromeFortinet FortiPAM Chrome Extension
- CVE-2026-65113NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials.NVIDIA Infrastructure Controller
- CVE-2026-93088CVE-2026-93088SGLang
- CVE-2026-12718SQLi in Karel Electronics' KarelIPSKarel Electronic Industry and Trade KarelIPS
- CVE-2026-95675D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management InterfaceD-LINK DAP-1360
- CVE-2026-93616Directory Traversal and File upload allows execution of arbitrary script on the Management Servercheckpoint Quantum Security Management
- CVE-2026-74849Remote code execution vulnerabilityZohocorp ManageEngine ADSelfService Plus
- CVE-2026-25254Improper authorization in Qualcomm Software CenterQualcomm Snapdragon
- CVE-2026-93556Direct references to unsafe objects (IDOR) in Tankuam Places by KompiniKompini Tankuam Places
- CVE-2026-89422TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extensionErlang OTP
- CVE-2026-93952Security Advisory 0183Arista Networks VeloCloud Orchestrator (VCO) On-Prem
- CVE-2026-87080Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycodeNet-IDN-Encode
- CVE-2026-87078Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycodeNet-IDN-Encode
- CVE-2016-15059Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycodeNet-IDN-Encode
- CVE-2026-19658Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' ParameterLiquidWeb Give Tributes
- CVE-2026-13355Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' ParameterMeta Box Frontend Submission
- CVE-2026-94493Gigatech PDV5701 WebSocket Service index.html missing authenticationGigatech PDV5701
- CVE-2026-79313webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.
- CVE-2026-88414MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
- CVE-2026-88416MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
- CVE-2026-88624Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory dele
High 178
- CVE-2026-94367OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup.OpenEye Apex Network Video Recorder
- CVE-2026-61685ReactPress has SQL injection via dynamic column names in TypeORM query buildersfecommunity reactpress · @fecommunity/reactpress
- CVE-2026-18176IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18172IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18154IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18152IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18137IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18134IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18131IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18123IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18095IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18074IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18066IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17647IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17646IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17644IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17643IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17637IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17636IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17618IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17102DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-16672DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-16469DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-16468DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-77912Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineGitHub Enterprise Server
- CVE-2026-96269GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affectGNU Emacs
- CVE-2026-77426Unleash: Missing await on permission check + cross-project IDOR in admin APIunleash · unleash-server
- CVE-2026-67615openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerApereo Foundation openEQUELLA
- CVE-2026-91018Double Free in lwIP (lightweight IP)lwIP API
- CVE-2026-95815OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL LoggingOpenClaw iOS
- CVE-2026-95814Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Checkdani-garcia vaultwarden
- CVE-2026-94450Potential denial of service when configured to send Retry packets in s2n-quicAWS s2n-quic
- CVE-2026-61570MPXJ: XXE Vulnerability in MerlinReaderjoniles mpxj · net.sf.mpxj:mpxj +5
- CVE-2026-77322SIPGO: DoS via unvalidated WebSocket frame lengthemiago sipgo · github.com/emiago/sipgo
- CVE-2026-58268SIPGO: DoS via unvalidated Content-Length in the stream parseremiago sipgo · github.com/emiago/sipgo
- CVE-2026-63104Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpointusekaneo kaneo
- CVE-2026-94574CVE-2026-94574GNU Wget (Windows Builds) Wget
- CVE-2026-89281CVE-2026-89281Apache HTTP Server Project Apache Lounge Windows
- CVE-2026-62985request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js processazu request-filtering-agent · request-filtering-agent
- CVE-2026-28325SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution VulnerabilitySolarWinds Observability Self-Hosted
- CVE-2026-76715Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76714Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76713Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76712Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76711Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76710Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-59991psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometrypsd-tools
- CVE-2026-84395Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Premiere
- CVE-2026-83963Substance3D - Modeler | Out-of-bounds Write (CWE-787)Adobe Substance3D - Modeler
- CVE-2026-81998Substance3D - Modeler | Out-of-bounds Write (CWE-787)Adobe Substance3D - Modeler
- CVE-2026-83962Substance3D - Modeler | Stack-based Buffer Overflow (CWE-121)Adobe Substance3D - Modeler
- CVE-2026-79906Substance3D - Modeler | Out-of-bounds Write (CWE-787)Adobe Substance3D - Modeler
- CVE-2026-94462Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)spree · spree_api
- CVE-2026-75743Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE
- CVE-2026-75744Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE
- CVE-2026-81999Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE
- CVE-2026-34689Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe Connect
- CVE-2026-75658Bridge | Out-of-bounds Write (CWE-787)Adobe Bridge
- CVE-2026-75649Bridge | Heap-based Buffer Overflow (CWE-122)Adobe Bridge
- CVE-2026-75676Bridge | Stack-based Buffer Overflow (CWE-121)Adobe Bridge
- CVE-2026-75655Bridge | Uncontrolled Recursion (CWE-674)Adobe Bridge
- CVE-2026-75665Bridge | Heap-based Buffer Overflow (CWE-122)Adobe Bridge
- CVE-2026-75663Bridge | Out-of-bounds Write (CWE-787)Adobe Bridge
- CVE-2026-77246MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Pathsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-75632CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-19480CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-77248MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transportsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-95862A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to exUbiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5
- CVE-2026-77256MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umasksooperset mcp-atlassian
- CVE-2026-95861A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices toUbiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5
- CVE-2026-77259MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77558A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeUbiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5
- CVE-2026-77556A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exeUbiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5
- CVE-2026-77555A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to exUbiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5
- CVE-2026-77544A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to exUbiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5
- CVE-2026-77247MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameterssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77255MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issuesooperset mcp-atlassian · mcp-atlassian
- CVE-2026-95831Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URLCrypt-SelfCertificate
- CVE-2026-77262MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)sooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77253MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local filessooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77257MCP Atlassian: HTTP upload tools accept arbitrary server-local file pathssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77261MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branchessooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77260MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira)sooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77271MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)sooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77242MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)sooperset mcp-atlassian
- CVE-2026-77243MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypasssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77251MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)sooperset mcp-atlassian · mcp-atlassian
- CVE-2026-43643Softaculous Virtualizor Authorization Bypass via Billing Module HandlerSoftaculous Virtualizor
- CVE-2026-77267mcp-atlassian has an incomplete SSRF remediationsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-18462Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.RTI Connext Professional
- CVE-2026-18459Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.RTI Connext Professional
- CVE-2026-18457Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.RTI Connext Professional
- CVE-2026-8849Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation.RTI Connext Professional
- CVE-2026-82003Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)Adobe Campaign Classic
- CVE-2026-77258MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()sooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77274MCP Atlassian: SSRF Protection Bypasssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-85995Notepad++: Authenticode verification bypass allows modified updater executionnotepad-plus-plus
- CVE-2026-77605Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)notepad-plus-plus
- CVE-2026-86054Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session pathnotepad-plus-plus
- CVE-2026-85279Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Valuenotepad-plus-plus
- CVE-2026-93345MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRIMikroTik RouterOS
- CVE-2026-94384Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambdaamazon-connect-salesforce-lambda
- CVE-2026-83597Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Executionnetdata
- CVE-2026-83598Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repairnetdata
- CVE-2026-83603Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCEnetdata
- CVE-2026-83599Netdata: WebSocket Decompression Bombnetdata
- CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the WordPress
- CVE-2026-83803Sentry: Unsafe pickle deserialization in Relocation Featuregetsentry sentry
- CVE-2026-85740LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guardHKUDS LightRAG · lightrag-hku
- CVE-2026-94455Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API keyGitroomHQ postiz-app
- CVE-2026-566819Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Headerdecolua 9router · 9router
- CVE-2026-94640Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of serviceRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-70410Apache Calcite Avatica: Unrestricted class initialization when instantiating pluginsApache Software Foundation Apache Calcite Avatica
- CVE-2026-75608Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive informationblakeblackshear frigate
- CVE-2026-75607Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operationsblakeblackshear frigate
- CVE-2026-77633Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of servicecloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-95655Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelWebkul Aureus ERP
- CVE-2026-95653Concrete CMS Community Store before 2.7.8 Predictable Digital Download Tokenconcretecms-community-store community_store
- CVE-2026-80154Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation BypassLANTRONIX SLC8000 · LANTRONIX EMG8500 +5
- CVE-2026-80150Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl ParameterLANTRONIX SLC8000 · LANTRONIX EMG8500 +3
- CVE-2026-80149Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl ParameterLANTRONIX SLC8000 · LANTRONIX EMG8500 +3
- CVE-2026-80148Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username TruncationLANTRONIX SLC8000 · LANTRONIX EMG8500 +3
- CVE-2026-85055Twenty: Field-level read bypasstwentyhq twenty
- CVE-2026-77620Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).vectordotdev vector
- CVE-2026-77619Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.vectordotdev vector
- CVE-2026-95806MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem pathsMISP
- CVE-2026-19915HP Support Assistant - Local Escalation of PrivilegeHP Support Assistant
- CVE-2026-89407jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSFasterXML jackson-core · com.fasterxml.jackson.core:jack… +1
- CVE-2026-65118NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation.NVIDIA Infrastructure Controller
- CVE-2026-65114NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical funcNVIDIA Infrastructure Controller
- CVE-2026-65130NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection.NVIDIA Infrastructure Controller
- CVE-2026-65128NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection.NVIDIA Infrastructure Controller
- CVE-2026-65121NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue.NVIDIA Infrastructure Controller
- CVE-2026-65179NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via picNVIDIA NeMo Speech
- CVE-2026-65178NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parametNVIDIA NeMo Speech
- CVE-2026-65111NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection.NVIDIA NeMo Speech
- CVE-2026-24239NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution.NVIDIA NeMo Speech
- CVE-2026-24267NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attaNVIDIA NeMo Speech
- CVE-2026-93344MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAXWebWizards MarketKing
- CVE-2026-93343MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajaxWebWizards MarketKing
- CVE-2026-95619Gcc: libstdc++ integer overflow in `new` operatorRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-75791Authentication bypass vulnerabilityZohocorp ManageEngine ADSelfService Plus
- CVE-2026-87119mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayedZenHive mpp
- CVE-2026-89420Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for freeZenHive mpp
- CVE-2026-25265Creation of Temporary File with Insecure Permissions in Qualcomm Software CenterQualcomm Snapdragon
- CVE-2026-25264Uncontrolled Search Path Element in Qualcomm Software CenterQualcomm Snapdragon
- CVE-2026-25255Exposed function in Qualcomm Package Manager and Qualcomm Software Center.Qualcomm Snapdragon
- CVE-2026-90882Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataEclipse Foundation open-vsx.org
- CVE-2026-94117WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerabilityDevItems HashBar – WordPress Notification Bar
- CVE-2026-65634Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoderErlang OTP
- CVE-2026-68956SSH daemon allocates unbounded idle session channels, bypassing max_channelsErlang OTP
- CVE-2026-93928WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerabilityMagepeople Taxi Booking Manager for WooCommerce
- CVE-2026-95508Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtuRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-9231WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attributewptravelengine WP Travel Engine – Tour Booking Plugin – Tou…
- CVE-2026-93836WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameterwpclever WPC Product Bundles for WooCommerce
- CVE-2026-93778WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)jgwhite33 WP Yelp Review Slider
- CVE-2026-92235WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameterroxnor WP Ultimate Review
- CVE-2026-6922WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameterwptb WP Table Builder – Drag & Drop Table Builder
- CVE-2025-1281BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File DeletionSeaTheme BM Content Builder
- CVE-2026-92969HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAXrealmag777 HUSKY – Products Filter for WooCommerce Professi…
- CVE-2026-87082Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycodeNet-IDN-Encode
- CVE-2026-87081Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_asciiNet-IDN-Encode
- CVE-2026-87079Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycodeNet-IDN-Encode
- CVE-2026-74766Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycodeNet-IDN-Encode
- CVE-2026-91827Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV ExportNinja Forms
- CVE-2026-92438Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions AdminNinja Forms
- CVE-2026-94504Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scriptingkstover Ninja Forms – Contact Form Builder with Calculators…
- CVE-2026-89412TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panelcozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-12470CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX ActionCMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVE-2026-93712Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handlerDancer2
- CVE-2026-93710Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooksDancer2
- CVE-2026-79314A horizontal privilege escalation vulnerability exists in x-ui 0.3.2.
- CVE-2026-88340An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files.
- CVE-2026-88344An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e.
- CVE-2026-88345An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e.
- CVE-2026-88415MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS).
- CVE-2026-88418CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin reques
- CVE-2026-88419An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of Wuzh
Medium, low and unrated 190
- CVE-2026-95833itsourcecode Leave Management System index.php sql injectionitsourcecode Leave Management System
- CVE-2026-95830theRealSain Pixtream post_upload.php unrestricted uploadtheRealSain Pixtream
- CVE-2026-95829TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injectionTDuckCloud tduck-platform
- CVE-2026-92930OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-deviceOpenEye Apex Network Video Recorder
- CVE-2026-92929OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determiniOpenEye Apex Network Video Recorder
- CVE-2026-92928OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential thOpenEye Apex Network Video Recorder
- CVE-2026-57576plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description lengthplone.app.dexterity · plone.app.contenttypes +1
- CVE-2026-95828Mstfakts College-Management-System Authentication server.php session_start session fixiationMstfakts College-Management-System
- CVE-2026-95820anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted uploadanirbandutta9 College-Notes-Gallery
- CVE-2026-18173IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18170IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18161IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18156IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18153IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-95819anirbandutta9 College-Notes-Gallery login.php sql injectionanirbandutta9 College-Notes-Gallery
- CVE-2026-18133IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18132IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18124IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-18114IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17620IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM Financial Transaction Manager (FTM) for RedHat OpenShift
- CVE-2026-17465Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-16426Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-15915Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-12767Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2025-36084Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-75101Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collisionGitHub Enterprise Server
- CVE-2026-88020Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3Autonomy Logic OpenPLC Runtime
- CVE-2026-96260Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated userMattermost
- CVE-2026-96259Mattermost server-side request forgery via OAuth endpoints configurable by a System AdministratorMattermost
- CVE-2026-77425Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit logunleash · unleash-server
- CVE-2026-76910Unleash: Clone-feature lets a user copy a feature from a project they cannot readunleash · unleash-server
- CVE-2026-95813e621ng before 26.09.16 Open Redirect via URL Parameterse621ng
- CVE-2026-95812ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query ParametersMacWarrior clipbucket-v5
- CVE-2026-76909Unleash: CR-approval email renders user-controlled raw HTMLunleash · unleash-server
- CVE-2026-62364wlc may disclose API tokens to project-configured URLsWeblateOrg wlc · wlc
- CVE-2026-79767Gardener: Authorization Bypass via Group Subject Injectiongardener · github.com/gardener/gardener +1
- CVE-2026-65829MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersjoniles mpxj · MPXJ.Net +5
- CVE-2026-83805Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsnautobot
- CVE-2026-83801Nautobot: Stored cross-site scripting (XSS) in object create/edit form help textnautobot
- CVE-2026-76717Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-76716Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)Hewlett Packard Enterprise (HPE) ALE
- CVE-2026-63628mppx: Gas Draining with access listwevm mppx · mppx
- CVE-2026-63627mppx: Gas Draining with paddingwevm mppx · mppx
- CVE-2026-91129Home Assistant: mDNS Server-Side Request Forgeryhome-assistant core · homeassistant
- CVE-2026-63386js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested inputsunnyadn js-toml
- CVE-2026-77399icalendar: Denial of service via unbounded VALARM REPEAT expansioncollective icalendar
- CVE-2026-83964Adobe Connect | Improper Certificate Validation (CWE-295)Adobe Connect
- CVE-2026-48361Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Connect
- CVE-2026-75656Bridge | Out-of-bounds Read (CWE-125)Adobe Bridge
- CVE-2026-75634CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-75633CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-89277CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-75638CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-76194CAI Content Credentials | Improper Input Validation (CWE-20)Adobe Content Credentials Rust SDK · Adobe Content Credenti…
- CVE-2026-77249MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookupsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77268MCP Atlassian: Insecure File Permissions on OAuth Token Storagesooperset mcp-atlassian · mcp-atlassian
- CVE-2026-84396InDesign Desktop | NULL Pointer Dereference (CWE-476)Adobe InDesign Desktop
- CVE-2026-76192InDesign Desktop | NULL Pointer Dereference (CWE-476)Adobe InDesign Desktop
- CVE-2026-77272MCP Atlassian: Reflected XSS in OAuth Setup Callback Handlersooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77269MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825)sooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77266MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool callsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-95660Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injectionMoonshot AI Kimi Code
- CVE-2026-77252MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search toolssooperset mcp-atlassian
- CVE-2026-77250MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-18626Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.RTI Connext Professional
- CVE-2026-18460Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.RTI Connext Professional
- CVE-2026-18458Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.RTI Connext Professional
- CVE-2026-11389Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.RTI Connext Professional
- CVE-2026-11388Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.RTI Connext Professional
- CVE-2026-77265MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flowsooperset mcp-atlassian · mcp-atlassian
- CVE-2026-77270MCP Atlassian: Arbitrary File Read via Upload Attachment Toolssooperset mcp-atlassian · mcp-atlassian
- CVE-2026-95657dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scriptingdgtlmoon Changedetection.io
- CVE-2026-95624Tauri framework v2 malicious downgrade via allow_downgrades from frontend codetauri-plugin-updater
- CVE-2026-95656dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgerydgtlmoon changedetection.io
- CVE-2026-86056Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS)notepad-plus-plus
- CVE-2026-85288Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialognotepad-plus-plus
- CVE-2026-83600Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agentnetdata
- CVE-2026-83601Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds writenetdata
- CVE-2026-83602Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECKnetdata
- CVE-2026-84301FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requestslabring FastGPT
- CVE-2026-95818AT_SECURE program buffer overflow via $ORIGIN processingThe GNU C Library glibc
- CVE-2026-76805Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Modeprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2026-76802Nuclei: Arbitrary Command Execution via DAST Code Signature Bypassprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2026-76804Nuclei: Local File Read via Workflow File-Protocol Gate Bypassprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2026-76803Nuclei: Local File Read via MySQL Client Sandbox Bypassprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2026-86062LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentHKUDS LightRAG · lightrag-hku
- CVE-2026-85725LightRAG: Plaintext Passwords Compared Without Constant-Time FunctionHKUDS LightRAG · lightrag-hku
- CVE-2026-85709LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesHKUDS LightRAG · lightrag-hku
- CVE-2026-566829Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Headerdecolua 9router · 9router
- CVE-2026-86805AT_SECURE programs may load attacker-controlled code via $ORIGINThe GNU C Library glibc
- CVE-2026-86698Refresh tokens accepted as private repository credentials at the CDNhexpm
- CVE-2026-75517Novu: Cross-Environment Integration Manipulation (IDOR)novuhq novu · @novu api-service
- CVE-2026-90462Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorizationRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-75511Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLsnovuhq novu · @novu api-service
- CVE-2026-75510Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: schemenovuhq novu · @novu/js
- CVE-2026-88010Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracletraefik · github.com/traefik/traefik
- CVE-2026-77637Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scopecloudreve · github.com/cloudreve/Cloudreve +2
- CVE-2026-79913Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressescloudreve · github.com/cloudreve/Cloudreve +2
- CVE-2026-92706Dark Reader: Ability to request icon-like bitmap data from certain local web serversdarkreader
- CVE-2026-81883radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecoderadareorg radare2
- CVE-2026-81885radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parserradareorg radare2
- CVE-2026-81882radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parserradareorg radare2
- CVE-2026-81886radare2: Uncontrolled memory allocation in radare2 dmp64 parserradareorg radare2
- CVE-2026-81884radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parserradareorg radare2
- CVE-2026-81880radare2: Uncontrolled resource consumption in radare2 PEF loaderradareorg radare2
- CVE-2026-81879radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handlingradareorg radare2
- CVE-2026-81878radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parserradareorg radare2
- CVE-2026-81881radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parserradareorg radare2
- CVE-2026-95805MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restrictionMISP
- CVE-2026-95754MISP: Disabled-user check ineffective in pre-authentication TOTP login branchMISP
- CVE-2026-95703MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_nameMISP
- CVE-2026-95701MISP Path Traversal via Organization Name in Org-Statistics Logo CheckMISP
- CVE-2026-95698MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization NameMISP
- CVE-2026-95697MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization MetadataMISP
- CVE-2026-95501mtrano APENCMS Template weasel.php eval code injectionmtrano APENCMS
- CVE-2026-95693MISP Information Disclosure via Forged Upload PathMISP
- CVE-2026-95500JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted uploadJosephChuks php-file-manager-with-code-editor
- CVE-2026-94570CVE-2026-94570SGLang
- CVE-2026-95685MISP Missing Authorization on replaceSuggestionInReport Event Report ActionMISP
- CVE-2026-65112NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption.NVIDIA Infrastructure Controller
- CVE-2026-65117NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password.NVIDIA Infrastructure Controller
- CVE-2026-65115NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption.NVIDIA Infrastructure Controller
- CVE-2026-65129NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation.NVIDIA Infrastructure Controller
- CVE-2026-65127NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information dNVIDIA Infrastructure Controller
- CVE-2026-65126NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workfNVIDIA Infrastructure Controller
- CVE-2026-65125NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path.NVIDIA Infrastructure Controller
- CVE-2026-65124NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection.NVIDIA Infrastructure Controller
- CVE-2026-95683MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACLMISP
- CVE-2026-95682MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email ViewMISP
- CVE-2026-93342MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAXWebWizards MarketKing
- CVE-2026-93341MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAXWebWizards MarketKing
- CVE-2026-95679MISP Unauthenticated Blind SSRF via XML Body ProcessingMISP
- CVE-2026-95499JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted uploadJosephChuks php-file-manager-with-code-editor
- CVE-2026-95674MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validationMISP
- CVE-2026-95671MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/addMISP
- CVE-2026-95667MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive CredentialsMISP
- CVE-2026-95666Unbounded post ID array in the bulk reactions endpoint allows denial of serviceMattermost
- CVE-2026-95665MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSONMISP
- CVE-2026-95396sfturing hosp_order Public Search Handlers HospitalController.java cross site scriptingsfturing hosp_order
- CVE-2026-95661MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type ListMISP
- CVE-2026-95659MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind ThreadMISP
- CVE-2026-95658MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modulesMISP
- CVE-2026-95273dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversaldgtlmoon changedetection.io
- CVE-2026-95272dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversaldgtlmoon changedetection.io
- CVE-2026-95271dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authenticationdgtlmoon changedetection.io
- CVE-2026-95270dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancydgtlmoon changedetection.io
- CVE-2026-63279Out of bounds read in PICT image importThe Document Foundation LibreOffice
- CVE-2026-63278Package URLs can be used to exfiltrate arbitrary INI file values and environment variablesThe Document Foundation LibreOffice
- CVE-2026-63276Stack buffer overflow in CFF to Type 1 font conversionThe Document Foundation LibreOffice
- CVE-2026-63275Stack buffer overflow in CFF font hint handlingThe Document Foundation LibreOffice
- CVE-2026-63274Heap buffer overflow in PDF import stream handlingThe Document Foundation LibreOffice
- CVE-2026-63273Heap buffer overflow in PDF import encryption handlingThe Document Foundation LibreOffice
- CVE-2026-63272Heap buffer overflow in WMF text record importThe Document Foundation LibreOffice
- CVE-2026-95623Tauri framework v2 SSRF Protection Bypass via HTTP Redirectstauri-plugin-http
- CVE-2026-90990Livestatus injection via monitoring filter valuesCheckmk
- CVE-2026-92882Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responsesCheckmk
- CVE-2026-25262Write-what-where Condition in Primary BootloaderQualcomm Snapdragon
- CVE-2026-15095Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameterwahid0003 Product Feed Manager for WooCommerce – CTX Feed –…
- CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabledRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-9004WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameternofearinc WP-CRM System – Manage Clients and Projects
- CVE-2026-7622ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivationcodexpert ThumbPress – Compress Images, Manage Thumbnails,…
- CVE-2026-18345WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callbackwpusermanager WP User Manager – User Profile Builder & Memb…
- CVE-2025-1280BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File ReadSeaTheme BM Content Builder
- CVE-2025-14487Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameterkamleshyadav Handily
- CVE-2026-91092wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookietomdever wpForo Forum
- CVE-2026-1645Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Settingprasunsen Hostel
- CVE-2026-18439Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-4123RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Actionrwelephant01 RW Elephant Rental Inventory
- CVE-2025-14484Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameterkamleshyadav Image Buzz
- CVE-2025-14486PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameterkamleshyadav PixelPlay
- CVE-2026-16778Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Contentlivecomposer Live Composer – Free WordPress Website Builder
- CVE-2026-12995Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via 'file_field' Parameterhiroaki-miyashita Custom Field Template
- CVE-2026-74765Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycodeNet-IDN-Encode
- CVE-2026-88788Text Styler <= 1.1.1 - Contributor+ Stored XSSText Styler
- CVE-2026-93655Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameterwpdevelop Booking Calendar
- CVE-2026-85653Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameterajay Contextual Related Posts
- CVE-2026-93711Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_arrayDancer2
- CVE-2026-93709Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handlerDancer2
- CVE-2026-94492Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injectionYonyou U8cloud
- CVE-2026-76974Information Disclosure vulnerability in SAP Fiori LaunchpadSAP_SE SAP Fiori Launchpad
- CVE-2026-94491Yonyou KSOA search_list.jsp sql injectionYonyou KSOA
- CVE-2026-37603Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) thro
- CVE-2026-37604pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from th
- CVE-2026-75432An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scann
- CVE-2026-79311webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
- CVE-2026-79312webpy web.py 0.76 is vulnerable to Session Fixation.
- CVE-2026-79315A reflected cross-site scripting vulnerability exists in x-ui 0.3.2.
- CVE-2026-88339A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV).
- CVE-2026-88341A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files.
- CVE-2026-88350An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().