CVEs published September 24, 2026
552 CVEs were published on September 24, 2026: 34 critical, 185 high.
- Published
- 552
- Critical
- 34
- High
- 185
- Medium
- 148
- Low
- 12
- Unrated
- 173
- Now in CISA KEV
- 0
- Fix available
- 423
Most affected products
- Linux
- 234
- Botslab G980H
- 14
- discourse
- 9
- Altera Trusted Firmware
- 8
- IBM DataStage on Cloud Pak for Data
- 8
- Termix-SSH Termix
- 8
- Deltaww DIAEnergie
- 6
- docmost
- 6
- IBM PowerVM Hypervisor
- 6
- YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- 6
Critical 34
- CVE-2026-97230IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URLIO-Socket-SSL-SelfCertificate
- CVE-2026-81630Botslab G980H Dashcams Insufficient Verification of Data AuthenticityBotslab G980H
- CVE-2026-93291Improper certificate validation in Eufy Omni C20Eufy Omni C20
- CVE-2026-93289OS command injection in Eufy Omni C20, Omni X10 ProEufy Omni C20 · Eufy Omni X10 Pro
- CVE-2026-86860Unauthenticated Sensitive Data Disclosure in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-13016Unauthenticated SQL Injection in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-13249Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040Honeywell PD45 Industrial Printer
- CVE-2026-61741http4s-scala-xml has an XML External Entity (XXE) processing issuehttp4s-scala-xml · org.http4s:http4s-scala-xml_2.12 +2
- CVE-2026-61604ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassixofoundation ixo-blockchain · github.com/ixofoundation/… +6
- CVE-2026-61732Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM contextBitterSecurity Decepticon · BitterSecurity decepticon-co… +4
- CVE-2026-61742DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionbytebase dbhub · @bytebase/dbhub
- CVE-2026-97413RDMA/rtrs-srv: Fix integer underflow in process_read and process_writeLinux
- CVE-2026-79766Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/emailTermix-SSH Termix
- CVE-2026-93425Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as rootdokploy
- CVE-2026-93228svcrdma: Reject Write/Reply chunks with segcount 0Linux
- CVE-2026-93207SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entryLinux
- CVE-2026-97404In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.OpenStack Zaqar
- CVE-2026-81549DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-90481In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate pPortSwigger Burp Suite DAST
- CVE-2026-97360HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Enginerejetto hfs2
- CVE-2026-97359HFS2 2.4.0 RCE via Multipart Upload Filename Template Injectionrejetto hfs2
- CVE-2026-91187Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategydashbit nimble_zta · nimble_zta
- CVE-2026-19072Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipalRapid7 Velociraptor
- CVE-2026-12227Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parametervisualcomposer Visual Composer Website Builder
- CVE-2026-78312Path Traversal in DIAEnergieDeltaww DIAEnergie
- CVE-2026-78308Authentication Bypass in DIAEnergieDeltaww DIAEnergie
- CVE-2026-96891D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds writeD-Link DIR-825
- CVE-2026-97055SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secretsignoz
- CVE-2026-18467Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameterpaytiumsupport Paytium: Mollie payment forms & donations
- CVE-2026-51994mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from
- CVE-2026-51996An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getS
- CVE-2026-88351An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms.
- CVE-2026-88365minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.
- CVE-2026-88378QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().
High 185
- CVE-2026-85082Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenamesMaple Media Root Browser Classic
- CVE-2026-87722Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code ReviewGerrit
- CVE-2026-87721Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code ReviewGerrit
- CVE-2026-87720Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewGerrit
- CVE-2026-85491Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path aloneCatalyst-Seal
- CVE-2026-95699MrSteam iSteamX Improper Isolation or CompartmentalizationMrSteam iSteamX application · MrSteam iSteamX Hub
- CVE-2026-82585Botslab G980H Dashcams Cleartext Transmission of Sensitive InformationBotslab G980H
- CVE-2026-79959Botslab G980H Dashcams Use of Hard-coded CredentialsBotslab G980H
- CVE-2026-82708Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted DirectoryBotslab G980H
- CVE-2026-14443Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1aBrocade SANnav
- CVE-2026-88956Botslab G980H Dashcams Missing Authentication for Critical FunctionBotslab G980H
- CVE-2026-93354Taskview Community Missing Authentication via OAuth Dynamic Client RegistrationGimanh taskview-community
- CVE-2026-77967Botslab G980H Dashcams Authentication Bypass by Capture-replayBotslab G980H
- CVE-2026-85496Botslab G980H Dashcams Generation of Predictable Numbers or IdentifiersBotslab G980H
- CVE-2026-82566Botslab G980H Dashcams Insufficient session expirationBotslab G980H
- CVE-2026-84399Botslab G980H Dashcams Incorrect AuthorizationBotslab G980H
- CVE-2026-82372Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.aBrocade SANnav
- CVE-2026-82164Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability.Dell Trusted Device Client,
- CVE-2026-96883Type confusion in AWS pgcollection allows remote code executionAWS pgcollection
- CVE-2026-89325Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalationRapid7 Insight Agent
- CVE-2026-81473Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability.Dell Rugged Control Center
- CVE-2026-86859Unauthenticated Arbitrary Record Disclosure in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-81455Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability.Dell ThinOS
- CVE-2026-57440Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledStarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…
- CVE-2026-86858Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-82157Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability.Dell ThinOS
- CVE-2026-86857Authorization Bypass in ServiceNow AI PlatformServiceNow AI Platform
- CVE-2026-61823code16 Sharp vulnerable to stored XSS via iframe srcdoc Attributecode16 sharp · code16/sharp
- CVE-2026-13248Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command InterfaceHoneywell PD45 Industrial Printer
- CVE-2026-61825code16/sharp has a stored XSS via data-html-content Sanitizer Bypasscode16 sharp · code16/sharp
- CVE-2026-82371Plaintext exposure of sensitive authentication data in SANnav discovery service log filesBrocade SANnav
- CVE-2026-96749Heap out-of-bounds write via signed size overflow in BSON document encodingMongoDB Python Driver · pymongo
- CVE-2026-96748Connection redirection via percent-encoded delimiter injection in connection string hostsMongoDB Python Driver · pymongo
- CVE-2026-48070Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletiondocmost
- CVE-2026-77293TREK: Cross-user note-file deletion (IDOR / Broken Access Control)mauriceboe TREK
- CVE-2026-77294TREK: Server-Side Request Forgery via User-Configurable LLM Base URLmauriceboe TREK
- CVE-2026-61816zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMEzbateson mail-mime-parser · zbateson/mail-mime-parser
- CVE-2026-61815zbateson/mail-mime-parser has CRLF header injection via attachment filenamezbateson mail-mime-parser · zbateson/mail-mime-parser
- CVE-2026-71540Wazuh Manager cluster header parsing allows pre-authentication memory exhaustionwazuh
- CVE-2026-63645OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentialsopenobserve
- CVE-2026-61788@bytebase/dbhub's read-only mode does not prevent database writesbytebase dbhub · @bytebase/dbhub
- CVE-2026-85056ZITADEL: MFA bypass via session reuse in Login V2zitadel · github.com/zitadel/zitadel
- CVE-2026-61782@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadataweb-infra-dev rsdoctor · @rsdoctor/rspack-plugin
- CVE-2026-85057ZITADEL: Actions V1 sandbox escape: host file read via require()zitadel · github.com/zitadel/zitadel
- CVE-2026-57178social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingpython-social-auth social-core · social-auth-core
- CVE-2026-95985Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted WorkspacesAmazon Kiro IDE
- CVE-2026-91122Discourse: Chat MessageBus delivers read-restricted messages to unauthorized usersdiscourse
- CVE-2026-56744`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)bsv-blockchain @bsv/wallet-toolbox · bsv-blockchain @bsv… +4
- CVE-2026-91123Discourse: Reject literal backslash path separators in iframe src traversal guarddiscourse
- CVE-2026-91160OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event streamrmyndharis OpenWA
- CVE-2026-62368Snipe-IT: Stored XSS via Custom Field name in asset-list column headersgrokability snipe-it · snipe/snipe-it
- CVE-2026-63493Snipe-IT: 2FA bypass via the API token flowgrokability snipe-it · snipe/snipe-it
- CVE-2026-56738phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertionthorsten phpMyFAQ · phpmyfaq/phpmyfaq +1
- CVE-2026-63498Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APIgrokability snipe-it · snipe/snipe-it
- CVE-2026-94606authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStagegoauthentik authentik · authentik
- CVE-2026-94609authentik: Privilege Escalation to Superuser via Group Hierarchygoauthentik authentik · authentik
- CVE-2026-94611authentik: Stored credentials are readable with view permission alonegoauthentik authentik · authentik
- CVE-2026-94612authentik: Authentication bypass via assertion confusion in SAML sourcesgoauthentik authentik · authentik
- CVE-2026-94613authentik: Denial of Service via Document Type Declarations in SAML Messagesgoauthentik authentik · authentik
- CVE-2026-93543Out-of-bounds read in libXi's XI2 class parserx.org libXi
- CVE-2026-97520gfs2: move quota_init qc iterator incrementLinux
- CVE-2026-97513media: chips-media: wave5: Release m2m_ctx after Instance Removed from ListLinux
- CVE-2026-97509thunderbolt: Keep XDomain reference during the lifetime of a serviceLinux
- CVE-2026-97508thunderbolt: Set tb->root_switch to NULL when domain is stoppedLinux
- CVE-2026-97497drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_idLinux
- CVE-2026-97496drm/amdkfd: Fix OOB memory exposure in get_wave_state()Linux
- CVE-2026-97478virt: acrn: Fix irqfd use-after-free during eventfd shutdownLinux
- CVE-2026-97474wifi: iwlwifi: mld: purge async notifications upon nic errorLinux
- CVE-2026-97455ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()Linux
- CVE-2026-97454ACPICA: add boundary checks in acpi_ps_get_next_field()Linux
- CVE-2026-97452ACPICA: Prevent adding invalid referencesLinux
- CVE-2026-97451ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)Linux
- CVE-2026-97450ACPICA: validate handler object type in two placesLinux
- CVE-2026-97448ACPICA: Add validation for node in acpi_ns_build_normalized_path()Linux
- CVE-2026-97445ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()Linux
- CVE-2026-97444ACPICA: add boundary checks in two placesLinux
- CVE-2026-97442wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifiLinux
- CVE-2026-97438fs/ntfs3: validate index entry key boundsLinux
- CVE-2026-97437ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()Linux
- CVE-2026-97433nvme: validate FDP configuration descriptor sizesLinux
- CVE-2026-97429drm/amdkfd: fix UAF race in destroy_queue_cpschLinux
- CVE-2026-97428drm/amdgpu: harden FRU PIA parsing with bounded helpersLinux
- CVE-2026-97421RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()Linux
- CVE-2026-97417netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()Linux
- CVE-2026-97415btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREFLinux
- CVE-2026-97409nvme-fc: Do not cancel requests in io target before it is initializedLinux
- CVE-2026-93830net: stmmac: xgmac2: disable RBUE in default RX interrupt maskLinux
- CVE-2026-93827virtio-fs: avoid double-free on failed queue setupLinux
- CVE-2026-93826HID: hidpp: fix potential UAF in hidpp_connect_event()Linux
- CVE-2026-93817perf: Fix addr_filter_ranges lifetimeLinux
- CVE-2026-93816f2fs: validate inline dentry name lengths before conversionLinux
- CVE-2026-93813btrfs: tree-checker: validate INODE_REF's namelenLinux
- CVE-2026-79764Termix: Authenticated SSRF via `/homepage/proxy` — No Destination AllowlistTermix-SSH Termix
- CVE-2026-93810cachefiles: Fix double fputLinux
- CVE-2026-93806wifi: cfg80211: validate assoc response length before status and IE accessLinux
- CVE-2026-93801smb/client: zero-initialize stack-allocated cifs_open_info_dataLinux
- CVE-2026-93799wifi: iwlwifi: mvm: validate sta_id in BA window status notifLinux
- CVE-2026-93798btrfs: fix reloc root cleanup in merge_reloc_roots()Linux
- CVE-2026-93796wifi: iwlwifi: pcie: null RX pointers after freeLinux
- CVE-2026-93793wifi: iwlwifi: mvm: validate TX_CMD response layoutLinux
- CVE-2026-93790wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notifLinux
- CVE-2026-93787smb: client: bound dirent name against end of SMB response in cifs_filldirLinux
- CVE-2026-93786ksmbd: preserve VFS inherited POSIX ACL maskLinux
- CVE-2026-93782vhost-scsi: flush backend after device ioctlsLinux
- CVE-2026-93288netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet stateLinux
- CVE-2026-93287i2c: smbus: reject oversized block transfers in the common pathLinux
- CVE-2026-93284drm/pagemap: dma-unmap pages before handling migration errorsLinux
- CVE-2026-75907CVE-2026-75907Norwegian Cruise Line door access control
- CVE-2026-93282ksmbd: fix maximum allowed access checksLinux
- CVE-2026-93280greybus: audio: bound the topology section sizes against the fetched sizeLinux
- CVE-2026-93277RDMA/bnxt_re: Validate udata before executing commandsLinux
- CVE-2026-93265PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint nodeLinux
- CVE-2026-93262md/raid5-ppl: fix use-after-free in ppl_do_flush()Linux
- CVE-2026-93260powerpc/xive: propagate IPI init errors to prevent use-after-freeLinux
- CVE-2026-96746Heap buffer overflow via mid-scan command list growth in client topology monitoringMongoDB C Driver
- CVE-2026-93250vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()Linux
- CVE-2026-96750Shell script injection via server-supplied database name in Open MongoDB shellMongoDB Compass
- CVE-2026-96744Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for LaravelLaravel MongoDB
- CVE-2026-93237LoongArch: Add DIRECT_MAP_PHYSMEM_END definitionLinux
- CVE-2026-93229nfsd: add missing read barrier to rpc_status_get dumpit seqcount retryLinux
- CVE-2026-77581BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypassalam00000 bentopdf
- CVE-2026-93225phy: fsl-imx8mq-usb: fix typec switch leak on probe error pathLinux
- CVE-2026-93224svcrdma: Fix unmatched rn_unregister on failed acceptLinux
- CVE-2026-56739Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpointlogto-io logto
- CVE-2026-63203Logto: Account API can disclose stored third-party provider tokens without the identities scopelogto-io logto
- CVE-2026-93221nfsd: convert nfsd_net boolean flags to unsigned long flags wordLinux
- CVE-2026-56737phpMyFAQ's two-factor authentication login bypasses the password factorthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-58008Unchecked HKDF key-size input in EL3 causes a stack buffer overflowAltera Trusted Firmware
- CVE-2026-58007Unchecked SDM mailbox response address enables EL3 secure-memory corruptionAltera Trusted Firmware
- CVE-2026-58006Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory CorruptionAltera Trusted Firmware
- CVE-2026-58005Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3.Altera Trusted Firmware
- CVE-2026-58004Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware.Altera Trusted Firmware
- CVE-2026-13467Systemic Missing Address Validation in SiP SMC HandlersAltera Trusted Firmware
- CVE-2026-13466Unit Confusion in VAB AuthenticationAltera Trusted Firmware
- CVE-2026-13465EL3 Stack Buffer Overflow in FCS HKDF RequestAltera Trusted Firmware
- CVE-2026-97362HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Threadrejetto hfs2
- CVE-2026-90959Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theftRed Hat Ansible Automation Platform 2.6 for RHEL · Red H… +3
- CVE-2026-82094DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-82093DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-81552DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-81548DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-81547DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-81545DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-81539DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-77874IBM Enterprise Build of Quarkus is affected by multiple vulnerabilitiesIBM Enterprise Build of Quarkus
- CVE-2026-56736phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submissionthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-12559Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation ApplicationOpenText Vendor Invoice Management for SAP Solutions
- CVE-2026-97059DCMTK through 3.7.0 Heap Over-read via NumberOfFramesOFFIS DCMTK
- CVE-2026-97057redis-parser through 3.0.0 Denial of Service via Invalid Array LengthNodeRedis redis-parser
- CVE-2026-95521Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpmRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-95519Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)Red Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-88907SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDFTÜBİTAK ULAKBİM UlakPDF
- CVE-2026-96515Command Injection Vulnerability in Netlink ICT HG323RW RouterNetlink ICT Pvt Netlink ICT HG323RW Router
- CVE-2026-7169Uncontrolled Search Path Element in Evope CollectorEvope Collector
- CVE-2026-4638Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network MonitorPaessler PRTG Network Monitor
- CVE-2026-57590Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project OperationsApache Software Foundation Apache DolphinScheduler
- CVE-2026-78311SQL Injection in DIAEnergieDeltaww DIAEnergie
- CVE-2026-78309SQL Injection in DIAEnergieDeltaww DIAEnergie
- CVE-2026-97185Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset fileRed Hat Enterprise Linux
- CVE-2026-85682YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Routeyourownprogrammer YOP Poll
- CVE-2026-77193eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parametereesywp eesy_ID2WP – Publish InDesign HTML5
- CVE-2026-82077PaperCut NG/MF: Remote Code Execution via Scan2FaxPaperCut NG/MF
- CVE-2026-88843MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories WidgetMasterStudy LMS WordPress Plugin
- CVE-2026-80513wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile FieldswpForo Forum
- CVE-2026-14780PaperCut NG/MF: Remote Code Execution via Scripting SubsystemPaperCut NG/MF
- CVE-2026-97152Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an uncheckeNanomsg
- CVE-2026-97151mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document.mwilliamson mammoth.js
- CVE-2026-97056SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypasssignoz
- CVE-2026-51995An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-s
- CVE-2026-51997An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions
- CVE-2026-52001An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSour
- CVE-2026-88355An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr().
- CVE-2026-88357nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code.
- CVE-2026-88360libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images.
- CVE-2026-88361SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
- CVE-2026-88362MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c.
- CVE-2026-88366NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands.
- CVE-2026-88368NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function.
- CVE-2026-88369zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().
- CVE-2026-88372libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.
- CVE-2026-88373libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path.
- CVE-2026-88376Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create().
- CVE-2026-88382hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.
- CVE-2026-88388Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-
- CVE-2026-88390An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input contain
Medium, low and unrated 333
- CVE-2026-84283FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gateFluteCode Secure Folder
- CVE-2026-97636Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled keyApache Software Foundation Apache Airflow HashiCorp provider
- CVE-2026-14441Logic flaw in SANnav Java cache key handling object comparison handlingBrocade SANnav
- CVE-2026-14442Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1aBrocade SANnav
- CVE-2026-97368chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorizationchillzhuang SpringBlade
- CVE-2026-93353copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers9001 copyparty
- CVE-2026-87118Botslab G980H Dashcams Out-of-bounds WriteBotslab G980H
- CVE-2026-97366jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injectionjhen0409 react-native-debugger
- CVE-2026-75558Botslab G980H Dashcams Use of Hard-coded Cryptographic KeyBotslab G980H
- CVE-2026-84403Botslab G980H Dashcams Missing Authentication for Critical FunctionBotslab G980H
- CVE-2026-82716Botslab G980H Dashcams Insertion of Sensitive Information into Log FileBotslab G980H
- CVE-2026-97365chonkie-inc littrs lib.rs mount path traversalchonkie-inc littrs
- CVE-2026-88761Botslab G980H Dashcams Use of Weak CredentialsBotslab G980H
- CVE-2026-97326songxinjianqwe Chat chat-server ChatServer.java server-side request forgerysongxinjianqwe Chat
- CVE-2026-48543Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Descriptionkrayin laravel-crm
- CVE-2026-48542Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Fieldkrayin laravel-crm
- CVE-2026-48541Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Fieldkrayin laravel-crm
- CVE-2026-97325YunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirectYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-48540Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Titlekrayin laravel-crm
- CVE-2026-93290Use of Hard-coded Credentials in Eufy Omni C20Eufy Omni C20
- CVE-2026-97324YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorizationYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-97323YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversalYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-56792Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability.Dell Rugged Control Center
- CVE-2026-97322YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scriptingYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-48073Docmost: Page export can include restricted same-space attachments through forged attachmentIddocmost
- CVE-2026-52853Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNERdocmost
- CVE-2026-48072Docmost: Public image fileName path traversal leads to unauthorized local file readdocmost
- CVE-2026-97321YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injectionYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-52850Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spacesdocmost
- CVE-2026-65827Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of servicedocmost
- CVE-2026-96747Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryptionMongoDB Python Driver · pymongo
- CVE-2026-97320YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgeryYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-62286Dozzle label filters do not restrict container event and statistics streamsamir20 dozzle · github.com/amir20/dozzle
- CVE-2026-85738TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)liketrek TREK
- CVE-2026-77320TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)mauriceboe TREK
- CVE-2026-77321TREK MCP trip summary bypasses delegated OAuth read scopesmauriceboe TREK
- CVE-2026-93405Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)Foundry376 Mailspring
- CVE-2026-81508ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processingespressif esp-idf
- CVE-2026-61811Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustionwazuh
- CVE-2026-54461Habitica: Regex Injection / ReDoS in Member SearchHabitRPG habitica
- CVE-2026-61784xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSScstigler node-xhtml-purifier · xhtml-purifier
- CVE-2026-97233volotat Anagnorisis Media Filename PlaylistManager.js html cross site scriptingvolotat Anagnorisis
- CVE-2026-57179social-auth-core has a Session Fixation issuepython-social-auth social-core · social-auth-core
- CVE-2026-57177social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backendpython-social-auth social-core · social-auth-core
- CVE-2026-57176social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backendpython-social-auth social-core · social-auth-core
- CVE-2026-57175social-auth-core has an Improper Authentication issuepython-social-auth social-core · social-auth-core
- CVE-2026-91119Discourse: Encode action_code_who in mention URLsdiscourse
- CVE-2026-91121Discourse: Chat upload filenames rendered as raw HTML in excerptsdiscourse
- CVE-2026-97232volotat Anagnorisis page.html start_streaming path traversalvolotat Anagnorisis
- CVE-2026-91120Discourse: Stored HTML injection in video notification emailsdiscourse
- CVE-2026-91132Discourse: Wildcard iframe origin allowlist bypass via authority separatorsdiscourse
- CVE-2026-91133Discourse: Escape LIKE metacharacters in upload paths to prevent disclosurediscourse
- CVE-2026-91134Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlistdiscourse
- CVE-2026-84302Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewablesdiscourse
- CVE-2026-26054SumatraPDF: Heap out-of-bounds read in MOBI header parser.sumatrapdfreader sumatrapdf
- CVE-2026-91161OpenWA: VIEWER API keys can read WhatsApp group invite codesrmyndharis OpenWA
- CVE-2026-97231volotat Anagnorisis Socket.IO Connect app.py missing authenticationvolotat Anagnorisis
- CVE-2026-47132phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumerationthorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2026-94281Out-of-bounds read in libXi's XListInputDevices() class parsingx.org libXi
- CVE-2026-93545Out-of-bounds read in libXi's XListInputDevices()x.org libXi
- CVE-2026-93544Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsingx.org libXi
- CVE-2026-79763Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)Termix-SSH Termix
- CVE-2026-97521gfs2: fix quota init duplicate scanLinux
- CVE-2026-97519drm/xe: Fix null pointer dereference in devcoredump cleanupLinux
- CVE-2026-97518wifi: cfg80211: reject duplicate wiphy cipher suite entriesLinux
- CVE-2026-97517wifi: nl80211: reject beacons with bad HE operationLinux
- CVE-2026-97516wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()Linux
- CVE-2026-97515i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845Linux
- CVE-2026-97514media: chips-media: wave5: Fix Reports from Kernel Lock ValidatorLinux
- CVE-2026-97512spi: spi-qcom-qspi: Fix incomplete error handling in runtime PMLinux
- CVE-2026-97511wifi: mac80211: avoid out-of-bounds access in monitorLinux
- CVE-2026-97510thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()Linux
- CVE-2026-97507media: dm1105: fix missing error check for dma_alloc_coherentLinux
- CVE-2026-97506crypto: ixp4xx - fix buffer chain unwind on allocation failureLinux
- CVE-2026-97505PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()Linux
- CVE-2026-97504watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak riskLinux
- CVE-2026-97503genirq/proc: Size interrupt directory names for 10-digit interrupt numbersLinux
- CVE-2026-97502mmc: davinci: avoid NULL deref of host->data in IRQ handlerLinux
- CVE-2026-97501pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO directionLinux
- CVE-2026-97500wifi: rtw89: phy: check length before parsing PHY status IELinux
- CVE-2026-97499coresight: perf: Retrieve path and source from event dataLinux
- CVE-2026-97498drm/amdgpu/userq: pin mqd and fw object bo to avoid evictionLinux
- CVE-2026-97495drm/amdkfd: Check bounds on allocate_doorbellLinux
- CVE-2026-97494drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fwLinux
- CVE-2026-97493drm/amdgpu: Bound GPIO I2C table entry count from VBIOSLinux
- CVE-2026-97492wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not neededLinux
- CVE-2026-97491net/rds: Don't sleep inside rds_ib_conn_path_shutdownLinux
- CVE-2026-97490affs: handle set_blocksize failuresLinux
- CVE-2026-97489bfs: handle set_blocksize failuresLinux
- CVE-2026-97488qnx4: handle set_blocksize failuresLinux
- CVE-2026-97487jfs: handle set_blocksize failuresLinux
- CVE-2026-97486hpfs: handle set_blocksize failuresLinux
- CVE-2026-97485omfs: handle set_blocksize failuresLinux
- CVE-2026-97484usbip: vhci_hcd: fix NULL deref in status_show_vhciLinux
- CVE-2026-97483usb: core: hcd: fix possible deadlock in rh control transfersLinux
- CVE-2026-97482usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET logLinux
- CVE-2026-97481serial: 8250: fix possible ISR soft lockupLinux
- CVE-2026-97480tty: serial: 8250: protect against NULL uart->port.dev in registerLinux
- CVE-2026-97479driver core: Avoid warning when removing a device while its supplier is unbindingLinux
- CVE-2026-97477RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()Linux
- CVE-2026-97476rds: filter RDS_INFO_* getsockopt by caller's netnsLinux
- CVE-2026-97475thermal/drivers/tegra/soctherma: Switch to devm cooling device registrationLinux
- CVE-2026-97473powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()Linux
- CVE-2026-97472ipv6: addrconf: fix temp address generation after prefix deprecationLinux
- CVE-2026-97456ACPICA: Fix condition check in acpi_ps_parse_loop()Linux
- CVE-2026-97453ACPICA: validate byte_count in acpi_ps_get_next_package_length()Linux
- CVE-2026-97449ACPICA: Add package limit checks in parser functionsLinux
- CVE-2026-97447ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()Linux
- CVE-2026-97446ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()Linux
- CVE-2026-97443perf/ftrace: Fix WARNING in __unregister_ftrace_functionLinux
- CVE-2026-97441ata: ahci: fail probe if BAR too small for claimed portsLinux
- CVE-2026-97440net: qrtr: fix node refcount leak on ctrl packet alloc failureLinux
- CVE-2026-97439fs/ntfs3: preserve non-DOS attribute bits in system.dos_attribLinux
- CVE-2026-97436dpaa2-switch: rework FDB management on the bridge leave pathLinux
- CVE-2026-97435net: dsa: sja1105: flower: reject cross-chip redirectLinux
- CVE-2026-97434dpaa2-switch: fix handling of NAPI on the remove pathLinux
- CVE-2026-97432wifi: iwlwifi: mvm: fix P2P-Device binding handlingLinux
- CVE-2026-97431drm/amd/display: Avoid DPMS-on for phantom streamLinux
- CVE-2026-97430xhci: Prevent queuing new commands if xhci is inaccessibleLinux
- CVE-2026-97427drm/amd/pm: bound pp_dpm_set_pp_table() memcpyLinux
- CVE-2026-97426drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse errorLinux
- CVE-2026-97425drm/amdgpu: fix buffer overflow during vBIOS updateLinux
- CVE-2026-97424drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irqLinux
- CVE-2026-97423cxl/region: Validate partition index before array accessLinux
- CVE-2026-97422drm/amdkfd: fix SMI event cross-process information leakLinux
- CVE-2026-97420bpf: NUL-terminate replaced sysctl valueLinux
- CVE-2026-97419hsr: broadcast netlink notifications in the device's net namespaceLinux
- CVE-2026-97418ALSA: es18xx: check control allocation before private data setupLinux
- CVE-2026-97416btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()Linux
- CVE-2026-97414ASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()Linux
- CVE-2026-97412pds_core: quiesce DMA before freeing resourcesLinux
- CVE-2026-97411net: ibm: emac: mal: fix potential system hang in mal_remove()Linux
- CVE-2026-97410netconsole: take target_cleanup_list_lock in drop_netconsole_target()Linux
- CVE-2026-97408Bluetooth: L2CAP: validate connectionless PSM lengthLinux
- CVE-2026-97407ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmtLinux
- CVE-2026-93829smb: client: fix races in cifsd thread creationLinux
- CVE-2026-93828exfat: fix handling of damaged volume in exfat_create_upcase_table()Linux
- CVE-2026-93825spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()Linux
- CVE-2026-93824tls: reject the combination of TLS and sockmapLinux
- CVE-2026-93823drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctlLinux
- CVE-2026-93822PCI: iproc: Protect root bus removal with rescan lockLinux
- CVE-2026-93542Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()x.org libXi
- CVE-2026-93821PCI: altera: Protect root bus removal with rescan lockLinux
- CVE-2026-93820PCI: rockchip: Protect root bus removal with rescan lockLinux
- CVE-2026-93819PCI: mediatek: Protect root bus removal with rescan lockLinux
- CVE-2026-93818PCI: plda: Protect root bus removal with rescan lockLinux
- CVE-2026-93815net: au1000: move free_irq out of the close-time spinlocked sectionLinux
- CVE-2026-93814spi: core: Abort active target transfer on controller suspendLinux
- CVE-2026-93812ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattrLinux
- CVE-2026-93811ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handlingLinux
- CVE-2026-93809drm/amdgpu: flush pending RCU callbacks on module unloadLinux
- CVE-2026-93808ALSA: usb-audio: caiaq: validate EP1 reply lengthsLinux
- CVE-2026-93807wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphersLinux
- CVE-2026-93805wifi: cfg80211: validate rx/tx MLME callback frame lengths before accessLinux
- CVE-2026-93804wifi: mac80211: ibss: wait for in-flight TX on disconnectLinux
- CVE-2026-93803wifi: libipw: fix key index receive bound checksLinux
- CVE-2026-93802wifi: rsi: validate beacon length before fixed buffer copyLinux
- CVE-2026-93800btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()Linux
- CVE-2026-93797wifi: iwlwifi: mvm: fix an off-by-1 boundary checkLinux
- CVE-2026-93795blk-cgroup: fix leaks and online flag on radix_tree_insert failureLinux
- CVE-2026-93794smb/client: flush dirty data before punching a holeLinux
- CVE-2026-93792wifi: iwlwifi: mvm: fix a possible underflowLinux
- CVE-2026-93791wifi: iwlwifi: mvm: add a check on the tid coming from the firmwareLinux
- CVE-2026-93789wifi: iwlwifi: bound aligned TLV advance in FW parserLinux
- CVE-2026-93788wifi: iwlwifi: acpi: validate WGDS table revision indexLinux
- CVE-2026-93785cifs: validate idmap key payload lengthLinux
- CVE-2026-93784wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()Linux
- CVE-2026-93783Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frameLinux
- CVE-2026-93781scsi: core: Do not block on tag allocation in scsi_eh_lock_door()Linux
- CVE-2026-93286net: appletalk: fix NULL pointer dereference in aarp_send_ddp()Linux
- CVE-2026-93285f2fs: embed f2fs_gc_kthread in f2fs_sb_infoLinux
- CVE-2026-79762Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copyTermix-SSH Termix
- CVE-2026-79759Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host EndpointTermix-SSH Termix
- CVE-2026-93541Out-of-bounds read in libXi's XQueryDeviceState()X.org libXi
- CVE-2026-79761Termix: Command injection in SSH key deployment verificationTermix-SSH Termix
- CVE-2026-79758Termix: Authenticated users can read other users' host status and clear global SSH connectionsTermix-SSH Termix
- CVE-2026-93283i3c: master: Fix device_register() error pathLinux
- CVE-2026-93281wifi: rtw89: fix HE extended capability length checkLinux
- CVE-2026-93279staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdownLinux
- CVE-2026-93278staging: octeon: add missing napi_disable in cvm_oct_rx_shutdownLinux
- CVE-2026-93276phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulatorLinux
- CVE-2026-93275perf/x86/intel/pt: Fix stop/start with no updateLinux
- CVE-2026-93274pinctrl: bcm2835: Don't remove an unregistered GPIO chipLinux
- CVE-2026-93273regulator: tps6594: Fix device node reference leaks in multiphase loopLinux
- CVE-2026-93272remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3Linux
- CVE-2026-93271wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rateLinux
- CVE-2026-93270bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insnLinux
- CVE-2026-93269ext4: fix circular lock dependency in ext4_ext_migrateLinux
- CVE-2026-93268ext4: skip extra isize expansion during mount to prevent deadlockLinux
- CVE-2026-93267RDMA/core: Fix potential use after free in uverbs_free_dmah()Linux
- CVE-2026-93266arm64: RSI: fix field-spanning write warning in attestation token initLinux
- CVE-2026-93264RDMA/efa: Fix PBL chunk length computationLinux
- CVE-2026-93263clk: eswin: Zero-initialize stack-allocated clk_init_dataLinux
- CVE-2026-93261locking/lockdep: Fix NULL pointer dereference in __lock_set_class()Linux
- CVE-2026-93259powerpc/irq: Fix missing r2 clobber in PCREL inline assemblyLinux
- CVE-2026-93258ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()Linux
- CVE-2026-93257block: handle nogenerate/noverify properly in fs-integrityLinux
- CVE-2026-93256arm64: hibernate: mask DAIF before restoring hibernated kernelLinux
- CVE-2026-93255btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lockLinux
- CVE-2026-93254arm64: entry: Avoid unnecessary local_irq_disable() on kernel exitLinux
- CVE-2026-93253sched/isolation: Defer freeing of cpumask memblock memory to initcallLinux
- CVE-2026-93252ocfs2: fix circular locking dependency in ocfs2_init_acl()Linux
- CVE-2026-93251ACPI: bus: Introduce acpi_bus_get_primary_device()Linux
- CVE-2026-96745PHP object injection via unsuppressible __pclass class inference in command monitoring eventsMongoDB PHP Driver
- CVE-2026-93249spi: amlogic-spisg: Make sure clk_init_data is fully initializedLinux
- CVE-2026-93248drm/xe: don't WARN on kernel job timeout when device already wedgedLinux
- CVE-2026-93247Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereferenceLinux
- CVE-2026-93246octeontx2-af: fix out-of-bounds read setting MSI-X irq affinityLinux
- CVE-2026-93245apparmor: policy_int make sure list heads are initialized before fail pathLinux
- CVE-2026-79760Termix: Authenticated blind SSRF through notification channel test endpointsTermix-SSH Termix
- CVE-2026-97226DbGate files-style Endpoint files.js fs.readFile path traversalDbGate
- CVE-2026-76907LaSuite Doc: Public Documents Enumerationsuitenumerique docs
- CVE-2026-93244drm/sysfb: simpledrm: Improve stride validationLinux
- CVE-2026-93243mm/secretmem: properly account locked pagesLinux
- CVE-2026-93242scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()Linux
- CVE-2026-93241memcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is doneLinux
- CVE-2026-93240memcg: make the v1 soft limit knob inertLinux
- CVE-2026-93239arm64: mm: Fix the lockless page-table walk in show_pte()Linux
- CVE-2026-93238s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmapLinux
- CVE-2026-63630BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requestsalam00000 bentopdf
- CVE-2026-93236media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_commonLinux
- CVE-2026-93235f2fs: fix to zero post-EOF data when extending file sizeLinux
- CVE-2026-93234drm/gud: validate TV mode names before creating enum propertyLinux
- CVE-2026-93233drm/nouveau/dmem: fix callocated underflow on large folio splitLinux
- CVE-2026-93232mm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pagesLinux
- CVE-2026-93231lockd: fix swapped arguments in nlmsvc_match_ip()Linux
- CVE-2026-93230mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlierLinux
- CVE-2026-93227mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfnLinux
- CVE-2026-93226ipv6: use RCU iterator to dump route exceptionsLinux
- CVE-2026-96873Reflected XSS in CirrusSearch debug explain outputThe Wikimedia Foundation Mediawiki - CirrusSearch Extension
- CVE-2025-32000Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.HCL Software HCL Sametime
- CVE-2026-93223staging: media: tegra-video: fix of_node_put() on VIP parse errorsLinux
- CVE-2026-93222signal: avoid shared siginfo namespace rewritesLinux
- CVE-2026-67233RabbitMQ: Monitoring-tag user can DELETE shovelsrabbitmq-server · rabbitmq
- CVE-2026-93220sched_ext: Keep kick_sync waiting on the rq's own CPULinux
- CVE-2026-93219clocksource/drivers/timer-sun4i: Advertise a real minimum deltaLinux
- CVE-2026-93218mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmdLinux
- CVE-2026-93217mm/madvise: skip device-private PMDs in cold and pageout walksLinux
- CVE-2026-93216mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()Linux
- CVE-2026-93215cdx: Fix double free when sysfs file creation failsLinux
- CVE-2026-93214usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()Linux
- CVE-2026-93213of: fix out-of-bounds read in of_alias_scan() stem parserLinux
- CVE-2026-93212nfsd: guard nfsd_serv deref in nfsd_file_net_disposeLinux
- CVE-2026-93211nfsd: initialize DRC hash table before registering shrinkerLinux
- CVE-2026-93210smb: client: harden DFS cache against invalid target hintsLinux
- CVE-2026-93209Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skbLinux
- CVE-2026-93208kasan: fix cache shrink race with CPU hotplugLinux
- CVE-2026-93206PCI/proc: Use file_ns_capable() when checking config space read accessLinux
- CVE-2026-93205iommu/arm-smmu-v3: Manage teardown with devmLinux
- CVE-2026-92680Araxis Merge insufficiently protected credentialsAraxis Merge
- CVE-2026-97225DbGate JSON Runner runners.js code injectionDbGate
- CVE-2026-73064In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into trustedfirmware Mbed TLS
- CVE-2026-97224Excalidraw Imported File restore.ts cross site scriptingExcalidraw
- CVE-2026-77707TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render EngineHAVELSAN Liman Render Engine
- CVE-2026-65422A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generGenetec Security Center
- CVE-2026-77703SSH Host Key Verification Bypass in HAVELSAN's Liman Render EngineHAVELSAN Liman Render Engine
- CVE-2026-77825IBM ContextForge MCP Gateway is affected by path traversalIBM ContextForge MCP Gateway
- CVE-2026-6544Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-19492This Power System update is being released to addressIBM PowerVM Hypervisor
- CVE-2026-18870This Power System update is being released to addressIBM PowerVM Hypervisor
- CVE-2026-18857This Power System update is being released to addressIBM OPENBMC
- CVE-2026-18104IBM Db2 Mirror for i is vulnerable to obtain sensitive information []IBM Db2 Mirror for i
- CVE-2026-17511This Power System update is being released to addressIBM PowerVM Hypervisor
- CVE-2026-17504This Power System update is being released to addressIBM PowerVM Hypervisor
- CVE-2026-17503This Power System update is being released to addressIBM PowerVM Hypervisor
- CVE-2026-17413This Power System update is being released to addressIBM PowerVM Hypervisor
- CVE-2026-97062Aureus ERP 1.6.0 Stored XSS via SVG File UploadWebkul Aureus ERP
- CVE-2026-97061Black Candy through 3.2.1 Information Disclosure via Playlist Searchblackcandy-org Black Candy
- CVE-2026-77798Velociraptor Authenticated Denial of ServiceRapid7 Velociraptor
- CVE-2026-77797Velociraptor Prefetch parser out of boundsRapid7 Velociraptor
- CVE-2026-88916Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDFTÜBİTAK ULAKBİM UlakPDF
- CVE-2026-94416Aap-gateway: aap-gateway: authorization bypass via workload identity token forgeryRed Hat Ansible Automation Platform 2.6 for RHEL · Red Hat…
- CVE-2026-97182halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralizationhalo-dev Halo
- CVE-2026-19532Path Traversal in HAVELSAN's Liman MYSHAVELSAN Liman MYS
- CVE-2026-16302Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposurebrainstormforce Spectra Legacy – Gutenberg Blocks
- CVE-2026-4806Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Resetalexvtn Custom Thank You Page for WooCommerce
- CVE-2026-3253MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and DeletionMailerLite – Signup forms
- CVE-2026-97311Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorizationRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-79680Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server moduleqt
- CVE-2026-97179O2OA Cipher Connection CipherConnectionAction.java list information disclosureO2OA
- CVE-2026-4637Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network MonitorPaessler PRTG Network Monitor
- CVE-2026-18335Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-15731WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Contentmagazine3 WP Multilang – Translation and Multilingual Plugin
- CVE-2026-92905Denial of Service VulnerabilityZohocorp ManageEngine EventLog Analyzer · Zohocorp ManageEn…
- CVE-2026-78313Improper Access Control in DIAEnergieDeltaww DIAEnergie
- CVE-2026-78310Authorization Bypass Through User-Controlled Key in DIAEnergieDeltaww DIAEnergie
- CVE-2026-97181ezGlobal｜GPM LIGHT - Sensitive Data ExposureezGlobal GPM LIGHT
- CVE-2026-11744PaperCut Hive Embedded App for Ricoh: Javascript injectionPaperCut Hive
- CVE-2026-87739PaperCut MF/NG: User permissions are not evaluated on report generationPaperCut NG/MF
- CVE-2026-81645Out-of-bounds read vulnerability in the graphics module.Huawei HarmonyOS
- CVE-2026-93662Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' ParameterEvents Manager
- CVE-2026-93661Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOREvents Manager
- CVE-2026-89005WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to CategoryWPeMatico RSS Feed Fetcher
- CVE-2026-89004WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDORWPeMatico RSS Feed Fetcher
- CVE-2026-89002WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item PreviewWPeMatico RSS Feed Fetcher
- CVE-2026-88847MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record CreationMasterStudy LMS WordPress Plugin
- CVE-2026-88846MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration DisabledMasterStudy LMS WordPress Plugin
- CVE-2026-88845MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo ImportMasterStudy LMS WordPress Plugin
- CVE-2026-84151The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List WideningThe Post Grid
- CVE-2026-82850Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key DisclosureMasteriyo LMS
- CVE-2026-82849Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDORMasteriyo LMS
- CVE-2026-8219510Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion10Web Booster
- CVE-2026-80338CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed HandlerCMB2
- CVE-2026-74991WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntentWPForms
- CVE-2026-97177Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permissionRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-97176Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticatorRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-97155Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, doFabasoft Folio Client
- CVE-2026-96898yhx070424 ShopXO Ueditor Upload ueditor.php path traversalyhx070424 ShopXO
- CVE-2026-96892Edimax BR-6428nC goform websRedirect redirectEdimax BR-6428nC
- CVE-2026-96884MantisZip Preview MainWindow.UI.cs Path.Combine path traversalMantisZip
- CVE-2026-96882TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorizationTaleLin lin-cms-spring-boot
- CVE-2026-97149In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests.OpenStack Swift
- CVE-2026-96881TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorizationTaleLin lin-cms-spring-boot
- CVE-2026-96880TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorizationTaleLin lin-cms-spring-boot
- CVE-2026-96810huanzi-qch base-admin Add User CommonController.java save cross site scriptinghuanzi-qch base-admin
- CVE-2026-96803java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injectionjava110 MicroCommunity
- CVE-2026-96777Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionForma LMS
- CVE-2026-96774SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosureSPON Communications IP Network Audio Device XC-9603
- CVE-2026-96773Intelliants Subrion CMS Login Page login.php authorize redirectIntelliants Subrion CMS
- CVE-2026-96772Intelliants Subrion CMS actions.json assign-owner information disclosureIntelliants Subrion CMS
- CVE-2026-96764kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resourceskvcache-ai mooncake
- CVE-2026-96763kvcache-ai mooncake MountSegment Request Processing segment.cpp access controlkvcache-ai mooncake
- CVE-2026-88358simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded().
- CVE-2026-88359libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format().
- CVE-2026-88367NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization.
- CVE-2026-88370libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache().
- CVE-2026-88371ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function.
- CVE-2026-88377Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers.
- CVE-2026-88383libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind().
- CVE-2026-88384OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path.
- CVE-2026-88385Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing.
- CVE-2026-88386libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks.
- CVE-2026-88387LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfile