CVEs published September 28, 2026
314 CVEs were published on September 28, 2026: 46 critical, 93 high. 1 is now in CISA KEV.
- Published
- 314
- Critical
- 46
- High
- 93
- Medium
- 161
- Low
- 14
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 184
Most affected products
- Apache Software Foundation Apache Roller
- 18
- jpadilla pyjwt · pyjwt
- 13
- axios
- 11
- zephyrproject zephyr
- 8
- Canonical LXD
- 7
- F&F Filipowski mH-DEVELOPER
- 7
- gz-yami mall4j
- 7
- SUSE Rancher
- 7
- FreePBX security-reporting
- 6
- Netcore NR289-GE
- 6
Critical 46
- CVE-2026-102361mall4j through 4.0 Missing Authentication in Password Update Endpointgz-yami mall4j
- CVE-2026-101264Ziroom ZHOME A0101 set_passwd command injectionZiroom ZHOME A0101
- CVE-2026-101263Ziroom ZHOME A0101 set_online_client command injectionZiroom ZHOME A0101
- CVE-2026-101262Ziroom ZHOME A0101 set_online_client command injectionZiroom ZHOME A0101
- CVE-2026-101261Ziroom ZHOME A0101 firstSetup_wifi command injectionZiroom ZHOME A0101
- CVE-2026-102334Nginx Proxy Manager through 2.16.0 Missing Brute-Force ProtectionNginxProxyManager nginx-proxy-manager
- CVE-2026-101260Ziroom ZHOME A0101 firstLogin command injectionZiroom ZHOME A0101
- CVE-2026-101187Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injectionZiroom ZHOME A0101
- CVE-2026-102268PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardjpadilla pyjwt · pyjwt
- CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerabilityAuthlib
- CVE-2026-101110Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6ordasoft.com Book Library (Free) extension for Joomla
- CVE-2026-100752Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9ordasoft.com Real Estate Manager (Free) extension for Joomla
- CVE-2026-101108Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8ordasoft.com Vehicle Manager (Free) extension for Joomla
- CVE-2026-49994Bluehood: Missing authentication on Bluehood API routes when web auth is enableddannymcc bluehood
- CVE-2026-101894@xhmikosr/decompress: Path traversal via symlink chainXhmikosR decompress · kevva decompress +2
- CVE-2026-86102WatchGuard AP Command Injection in Internal Management API Allows Command ExecutionWatchGuard AP
- CVE-2026-101891WatchGuard AP Improper Access Control in API Service Allows Unauthenticated AccessWatchGuard AP
- CVE-2026-101081D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflowD-Link DI-8400
- CVE-2026-88804Unauthenticated update of public UI settings leading to stored cross-site scripting in RancherSUSE Rancher
- CVE-2026-12342SailPoint IdentityIQ Improper Form Validation VulnerabilitySailPoint Technologies IdentityIQ
- CVE-2026-101077Netcore NR289-GE boa_temp process_request missing authenticationNetcore NR289-GE
- CVE-2026-101076Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injectionNetcore NR289-GE
- CVE-2026-101075Netcore NR289-GE Location Time location_time.cgi system os command injectionNetcore NR289-GE
- CVE-2026-101074Netcore NR289-GE Authentication boa password-check stack-based overflowNetcore NR289-GE
- CVE-2026-90924Default Admin Credentials in Innotim Software's Logsign SIEMInnotim Software, Telecommunications and Consultancy Trade…
- CVE-2026-101072Netcore NR289-GE CGI ap_ip.cgi system os command injectionNetcore NR289-GE
- CVE-2026-87799Arbitrary file write on LXD host via symlink in migration streamCanonical LXD
- CVE-2026-85185Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as rootCanonical LXD
- CVE-2026-85526Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXDCanonical LXD
- CVE-2026-73642Path Traversal in Dayforce ESS ExcelityDayforce ESS Excelity
- CVE-2026-73640Time-based SQL Injection in Dayforce ESS ExcelityDayforce ESS Excelity
- CVE-2026-81867Deserialization of Untrusted Data in Application Integration allows Remote Code ExecutionGoogle Cloud Application Integration
- CVE-2026-101039FAST FAC1900R devdiscover Service copy_msg_element stack-based overflowFAST FAC1900R
- CVE-2026-19759Incorrect Authorization in Application Integration allows Internal Stubby RPC ExecutionGoogle Cloud Application Integration
- CVE-2026-101038FAST FAC1200R MmtAtePrase stack-based overflowFAST FAC1200R
- CVE-2026-101037FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflowFAST FAC1200R
- CVE-2026-82384Apache Roller: Unauthenticated deserialization in the XML-RPC endpointApache Software Foundation Apache Roller
- CVE-2026-82377Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlersApache Software Foundation Apache Roller
- CVE-2026-82378Apache Roller: OAuth authorization endpoint trusts request-supplied identityApache Software Foundation Apache Roller
- CVE-2026-101009aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injectionaaPanel BaoTa
- CVE-2026-101008aaPanel BaoTa File Merge files.py merge_split_file command injectionaaPanel BaoTa
- CVE-2026-101007aaPanel BaoTa Database Backup database.py InputSql os command injectionaaPanel BaoTa
- CVE-2026-101002Netcore NBR200V2 Tools Ping network_tools system os command injectionNetcore NBR200V2
- CVE-2026-101001Netcore NBR200V2 Web Management network_tools eval os command injectionNetcore NBR200V2
- CVE-2026-101000Netcore NBR100V2 ACL unauthenticated.json uci.apply authorizationNetcore NBR100V2
- CVE-2026-100896TOTOLINK N150RT Web Management formWlSiteSurvey system os command injectionTOTOLINK N150RT
High 93
- CVE-2026-102365mall4j through 4.0 Missing Authorization in Admin User Address Endpointsgz-yami mall4j
- CVE-2026-102335Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_configNginxProxyManager nginx-proxy-manager
- CVE-2026-102296ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Responsezoneminder
- CVE-2026-101091SiYuan before v3.8.4 SQL Injection via Block Query Embedsiyuan-note siyuan
- CVE-2024-58386ZoneMinder 1.37.x Path Traversal via files viewzoneminder
- CVE-2024-42002Unsafe use of eval() method in ros2 topic hz toolOpen Source Robotics Foundation Robot Operating System
- CVE-2026-102281Nest: Remote process termination via a deeply nested microservice message patternnestjs nest · @nestjs/microservices
- CVE-2026-102278brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionjuliangruber brace-expansion · brace-expansion
- CVE-2026-102276brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionjuliangruber brace-expansion · brace-expansion
- CVE-2026-91096In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases beforFacebook proxygen
- CVE-2026-84895In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSeFacebook proxygen
- CVE-2026-102273PyJWT accepts public JWK containers as HMAC secretsjpadilla pyjwt · pyjwt
- CVE-2026-102272PyJWT BOM Bypassjpadilla pyjwt · pyjwt
- CVE-2026-102271PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardjpadilla pyjwt · pyjwt
- CVE-2026-102267PyJWT: PyJWKClient follows redirects when fetching JWKSjpadilla pyjwt · pyjwt
- CVE-2026-102266PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationjpadilla pyjwt · pyjwt
- CVE-2026-100392InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)InvoicePlane
- CVE-2026-100371InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password RecoveryInvoicePlane
- CVE-2026-101916@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizedgrpc-node · @grpc/grpc-js
- CVE-2026-18414Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validationzephyrproject zephyr
- CVE-2026-18413Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validationzephyrproject zephyr
- CVE-2026-16513Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel writezephyrproject zephyr
- CVE-2026-87741ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' ParameterBrainstorm Force ConvertPlus
- CVE-2026-102004VxWorks 7Wind River Systems VxWorks
- CVE-2026-93355LiteLLM Weak JWT Authentication via Email-Based User LookupBerriAI litellm
- CVE-2026-86950An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-102010Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_ifRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-97023Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/binRed Hat Enterprise Linux
- CVE-2026-84894In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidateMeta Platforms moxygen
- CVE-2026-55160Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringerstringer-rss stringer
- CVE-2026-55157Token Optimizer MCP: OS command injection in smart_user via username in get-user-infoooples token-optimizer-mcp · @ooples/token-optimizer-mcp
- CVE-2026-101909Axios: Prototype Pollution Gadget in axios toFormData Optionsaxios
- CVE-2026-75600FreePBX: Authenticated API generatedocs Host Command InjectionFreePBX security-reporting
- CVE-2026-54710FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)FreePBX security-reporting
- CVE-2026-54708Authenticated Remote Code Execution via Path Traversal in FreePBX Backup ModuleFreePBX security-reporting
- CVE-2026-54675FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang ModuleFreePBX security-reporting
- CVE-2026-54674Authenticated Command Injection in FreePBX UCP InterfaceFreePBX security-reporting
- CVE-2026-45562FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) ModuleFreePBX security-reporting
- CVE-2026-101907Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFaxios
- CVE-2026-101906Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Locationaxios
- CVE-2026-101905Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionaxios
- CVE-2026-101903Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)axios
- CVE-2026-101901Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initializationaxios
- CVE-2026-101898Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsaxios
- CVE-2026-87969WatchGuard AP Authenticated Command Injection in Diagnostic CLIWatchGuard AP
- CVE-2026-87114Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudoRed Hat OpenShift Container Platform · Pen Drive Powered by…
- CVE-2026-48100Payy: agg_agg trailing message slots are unconstrained and allow forged burn messagespolybase payy
- CVE-2026-55096SSRF via DNS-resolution gap in _validate_url_security (file download by URL)leshchenko1979 fast-mcp-telegram
- CVE-2026-54160Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKENnetworkupstools nut
- CVE-2026-85644XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array referenceXS-Parse-Keyword
- CVE-2026-88816DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyNameDBI
- CVE-2026-88805Session Not Revoked Server-Side on Logout in RancherSUSE Rancher
- CVE-2026-88808Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clustersSUSE Rancher
- CVE-2026-93348Unsloth Zoo Code Injection via model_type in config.jsonunslothai unsloth-zoo · unslothai unsloth
- CVE-2026-96538WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalationEnterpriseDB WarehousePG
- CVE-2026-4556macOS Exam4 Local Privilege Escalation via Command InjectionExtegrity Exam4
- CVE-2026-80357Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Dell Boot Optimized Server Storage
- CVE-2026-93538Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in FleetSUSE Rancher
- CVE-2026-90925Path Traversal in Innotim Software's Logsign SIEMInnotim Software, Telecommunications and Consultancy Trade…
- CVE-2026-90926Code Injection in Innotim Software's Logsign SIEMInnotim Software, Telecommunications and Consultancy Trade…
- CVE-2026-97335Incorrect authorization in LXD storage volume API allows reading volumes from other projectsCanonical LXD
- CVE-2026-86595SQLi in Iron Mountain's enVisionIron Mountain Archiving Services enVision
- CVE-2026-52748Missing authentication for backup functionality in Kaon AR2140XKaon AR2140
- CVE-2026-101292Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserializationRed Hat JBoss Enterprise Application Platform · Red Hat AMQ…
- CVE-2026-82323Improper Authorization in Enocta Educational's Enocta PlatformEnocta Educational Technologies Enocta Platform
- CVE-2026-12265Missing Authorization on HA Failover Config allows Complete Data DestructionZohocorp DDI Central
- CVE-2026-86330Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internalRed Hat Openshift Data Foundation
- CVE-2026-82928Undocumented access path in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-12264Authenticated File Write via HA Failover Config Upload leads to RCEZohocorp DDI Central
- CVE-2026-78424OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes NodesSUSE NeuVector
- CVE-2026-91043HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memoryelixir-mint mint · mint
- CVE-2026-101040Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of serviceRicoh SP 330DN · Ricoh SP +1
- CVE-2026-12267Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCEZohocorp DDI Central
- CVE-2026-81375Confused Deputy in Application Integration allows Internal File ReadGoogle Cloud Application Integration
- CVE-2026-12268Authenticated PowerShell Injection leads to RCEZohocorp DDI Central
- CVE-2026-91006Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)Apache Software Foundation Apache Karaf
- CVE-2026-12269Authenticated File Write to RCE via keepalived in DDI CentralZohocorp DDI Central
- CVE-2026-90979Apache Karaf: LDAP filter injection in JAAS LDAP login modulesApache Software Foundation Apache Karaf
- CVE-2026-94286Out-of-bounds read in libXtst's RECORD reply parserx.org libXtst
- CVE-2026-85134Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA PlusBimser Solution Software Trade eBA Plus Document and Workfl…
- CVE-2026-95104Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products.BUFFALO WSR-300HP · BUFFALO WEX-G300
- CVE-2026-86530BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally.BUFFALO WSR-300HP · BUFFALO WEX-G300
- CVE-2026-82379Apache Roller: WSSE digest authentication headers can be replayedApache Software Foundation Apache Roller
- CVE-2026-82380Apache Roller: CSRF protection bypass via self-generated salt validationApache Software Foundation Apache Roller
- CVE-2026-82383Apache Roller: Anonymous setup action allows frontpage configuration tamperingApache Software Foundation Apache Roller
- CVE-2026-82375Apache Roller: Server-side request forgery via entry trackback and enclosure URLsApache Software Foundation Apache Roller
- CVE-2026-82376Apache Roller: XML external entity processing in trackback response parserApache Software Foundation Apache Roller
- CVE-2026-82386Apache Roller: XML external entity processing in OPML bookmark importApache Software Foundation Apache Roller
- CVE-2026-82348Apache Roller: Cross-weblog resource tampering via unscoped authoring lookupsApache Software Foundation Apache Roller
- CVE-2026-100750Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomlaregularlabs.com Modules Anywhere (Pro) extension for Joomla
- CVE-2026-100751Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0regularlabs.com Tabs & Accordions (Free, Pro) extension for…
- CVE-2026-100908Eyeplus p2pcam HTTP stack-based overflowEyeplus
- CVE-2026-100902Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of inputBarco ClickShare CX-20 Gen2
Medium, low and unrated 175
- CVE-2026-101277Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted sourceTrusted Domain Project OpenDKIM
- CVE-2026-102367mall4j through 4.0 Insufficient Session Expiration via Token Refreshgz-yami mall4j
- CVE-2026-102366mall4j through 4.0 Unrestricted File Upload in Admin File Endpointsgz-yami mall4j
- CVE-2026-102364mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin APIgz-yami mall4j
- CVE-2026-102363mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Numbergz-yami mall4j
- CVE-2026-102362mall4j through 4.0 Missing Authentication in Product Review Deletiongz-yami mall4j
- CVE-2026-101265Intelbras TIP 125i Básico sensitive information in sourceIntelbras TIP
- CVE-2026-18747Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds readzephyrproject zephyr
- CVE-2026-18746NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhaustedzephyrproject zephyr
- CVE-2026-18417Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous errorzephyrproject zephyr
- CVE-2026-102333httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URLcle-b httpdbg
- CVE-2026-102332Dozzle before 11.1.2 Path Traversal via Log ZIP Downloadamir20 dozzle
- CVE-2026-102297ZoneMinder before 1.38.4 Incorrect Authorization in frames API indexzoneminder
- CVE-2026-101093Cotonti through 1.0.0 Cross-Site Request Forgery via User Group DeletionCotonti
- CVE-2026-101092SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImagessiyuan-note siyuan
- CVE-2026-101205FastStone Image Viewer PCX Decoder out-of-boundsFastStone Image Viewer
- CVE-2026-101204FastStone Image Viewer TGA Image FSViewer.exe out-of-boundsFastStone Image Viewer
- CVE-2026-101203FastStone Image Viewer 1bpp RLE Decoder out-of-bounds writeFastStone Image Viewer
- CVE-2026-101202FastStone Image Viewer TGA Image out-of-bounds writeFastStone Image Viewer
- CVE-2026-101188Netcore POWER13 ubus routerd.passwd_set password recoveryNetcore POWER13
- CVE-2026-102279Laravel: XSS in Debug Page Informationlaravel framework · laravel/framework
- CVE-2026-97027Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service filesRed Hat Enterprise Linux
- CVE-2026-97026Flatpak: flatpak: world-writable temporary child repositories in system-helper cache pathRed Hat Enterprise Linux
- CVE-2026-97025Flatpak: flatpak: world-readable oci authentication token in system-helper cache pathRed Hat Enterprise Linux
- CVE-2026-102277brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of servicejuliangruber brace-expansion · brace-expansion
- CVE-2026-102265PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerjpadilla pyjwt · pyjwt
- CVE-2026-102006VxWorks 7 Memory allocationWind River Systems VxWorks
- CVE-2026-102275PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionjpadilla pyjwt · pyjwt
- CVE-2026-91095In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStFacebook proxygen
- CVE-2026-102274PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Setjpadilla pyjwt · pyjwt
- CVE-2026-101146Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosureEleveo Quality Management
- CVE-2026-102270PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.jpadilla pyjwt · pyjwt
- CVE-2026-102269PyJWT: Non-canonical signature segments enable raw-token revocation bypassjpadilla pyjwt · pyjwt
- CVE-2026-102005VxWorks Memory AllocationWind River VxWorks
- CVE-2026-101145Eleveo Call Recording Software User Management userAddAction.do ldap injectionEleveo Call Recording Software
- CVE-2026-101918PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)jpadilla pyjwt · pyjwt
- CVE-2026-101917PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)jpadilla pyjwt · pyjwt
- CVE-2026-100370DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validationrhukster dom-sanitizer
- CVE-2026-101144Eleveo Call Recording Software Query Builder searchAction.do access controlEleveo Call Recording Software
- CVE-2026-18416Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)zephyrproject zephyr
- CVE-2026-18415Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frameszephyrproject zephyr
- CVE-2026-101915@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesgrpc-node · @grpc/grpc-js
- CVE-2026-101143Eleveo Quality Management QMBODownload information disclosureEleveo Quality Management
- CVE-2026-101914@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesgrpc-node · @grpc/grpc-js-xds
- CVE-2026-101142Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversalEleveo Quality Management
- CVE-2026-101141Eleveo Call Recording Software Play Audio audio.jsp cross site scriptingEleveo Call Recording Software
- CVE-2026-101139Webkul Bagisto Invoice Mass Status Update state authorizationWebkul Bagisto
- CVE-2026-13018Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perforGoogle Chrome
- CVE-2026-97686VxWorks 7 Memory Resource leakWind River VxWorks
- CVE-2026-101111Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6ordasoft.com Book Library (Free) extension for Joomla
- CVE-2026-101132DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversaldeepseek-harness
- CVE-2026-101109Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8ordasoft.com Vehicle Manager (Free) extension for Joomla
- CVE-2026-100753Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9ordasoft.com Real Estate Manager (Free) extension for Joomla
- CVE-2026-101131deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decisiondeepseek-ai deepseek-harness
- CVE-2026-101105code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injectioncode-projects Matrimonial System
- CVE-2026-101102deepseek-ai deepseek-harness Code Mode Sandbox run_code sandboxdeepseek-ai deepseek-harness
- CVE-2026-101913ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsbeaugunderson ip-address · ip-address
- CVE-2026-55156Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpointsooples token-optimizer-mcp · @ooples/token-optimizer-mcp
- CVE-2026-101912ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangebeaugunderson ip-address · ip-address
- CVE-2026-101911ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processbeaugunderson ip-address · ip-address
- CVE-2026-101910ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypassbeaugunderson ip-address · ip-address
- CVE-2026-101101ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exceptionag-ui-protocol ag-ui
- CVE-2026-101908Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsaxios
- CVE-2026-101100ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanupag-ui-protocol ag-ui
- CVE-2026-101904Axios: Header Injection via Inherited headers After Minimal Interceptoraxios
- CVE-2026-96740Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providersRed Hat StreamsHub Console for Apache Kafka® · Red Hat stre…
- CVE-2026-101902Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Methodaxios
- CVE-2026-101099ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional conditionag-ui-protocol ag-ui
- CVE-2026-101900Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersaxios
- CVE-2026-101098ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumptionag-ui-protocol ag-ui
- CVE-2026-101083PMWeb encryptionhelper.dll information disclosurePMWeb
- CVE-2026-101082PMWeb downloader.aspx path traversalPMWeb
- CVE-2026-88815DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpvDBI
- CVE-2026-101080Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversalTencent AI-Infra-Guard
- CVE-2026-101861Langflow Code Execution via eval() in Component Input Schemalangflow-ai langflow
- CVE-2026-101079agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decisionagentverus-scanner
- CVE-2026-101078deepseek-ai deepseek-harness Landlock Backend profiles.ts isolationdeepseek-ai deepseek-harness
- CVE-2026-91154Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of serviceMarcosCamara01 Ecommerce Template
- CVE-2026-97399One-byte overread in strncasecmp on Power8The GNU C Library glibc
- CVE-2026-93540Fleet applies namespace labels and annotations without the bundle's service account privilegesSUSE Rancher
- CVE-2026-101333Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpointRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-70413Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability.Dell Live Optics Collector
- CVE-2026-80359Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Dell Boot Optimized Server Storage
- CVE-2026-80358Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Dell Boot Optimized Server Storage
- CVE-2026-93539Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook ReceiverSUSE Rancher
- CVE-2026-101073Netcore NR289-GE CGI Dispatcher boa improper authenticationNetcore NR289-GE
- CVE-2026-101071Acrel Electric Unet Web Service Upload Endpoint upload unrestricted uploadAcrel Electric Unet Web Service
- CVE-2026-93537Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directorySUSE Rancher
- CVE-2026-87798LXD client recursive file pull allows directory escape via malicious VM agentCanonical LXD
- CVE-2026-86335LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local ReuseCanonical LXD
- CVE-2026-86334CLI Path Traversal via Content-Disposition in LXD Image Export/CopyCanonical LXD
- CVE-2026-15953Path Traversal During Project Archive ImportABB Protection and control IED manager
- CVE-2026-101070dbgate Files Endpoint runners.js files path traversaldbgate
- CVE-2026-73641Multiple Reflected XSS in Dayforce ESS ExcelityDayforce ESS Excelity
- CVE-2026-15952Improper Permission Assignment in Scheduler ServiceABB Protection and control IED manager
- CVE-2026-52749Improper Authentication in Kaon AR2140XKaon AR2140
- CVE-2026-101069dbgate Export databaseConnections.js exportModelSql path traversaldbgate
- CVE-2026-59563HMAC Confirmation Token Unbinding in zscaler-mcp-serverzscaler-mcp-server
- CVE-2026-101068dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversaldbgate
- CVE-2026-82326HTML Injection in Enocta Educational's Enocta PlatformEnocta Educational Technologies Enocta Platform
- CVE-2026-18825Origin validation error in the connect-xcors npm packagegithub.com/antono connect-cors
- CVE-2026-101067dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversaldbgate
- CVE-2026-101066dbgate Archive Link Creation archive.js createLink path traversaldbgate
- CVE-2026-82936Denial of Service in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-82935Use of End-of-Life components in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-82933Cleartext Transmission of Sensitive Information in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-82932Missing Firewall Configuration in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-82930Missing Authentication in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-82929Use of Shared Cryptographic Key in mH-DEVELOPERF&F Filipowski mH-DEVELOPER
- CVE-2026-101055Thinkware U3000 TCP Service GET_STATUS information disclosureThinkware U3000
- CVE-2026-101054Thinkware U3000 TCP Service wpa_supplicant.conf get_file access controlThinkware U3000
- CVE-2026-19444Kubernetes kubectl cp path traversal on Windows allows arbitrary file writesKubernetes
- CVE-2026-87752HTML Injection in Rolantis Information Technologies' AgentisRolantis Information Technologies Tourism Industry and Trad…
- CVE-2026-101053Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access controlThinkware U3000
- CVE-2026-94194Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediarieselixir-mint mint · mint
- CVE-2026-92103Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_sizeelixir-mint mint · mint
- CVE-2026-101052refly-ai refly JWT Token app.config.ts hard-coded credentialsrefly-ai refly
- CVE-2026-7171Stored Cross-Site Scripting (XSS) in TPVEnlanubeTPVEnlanube Cloud Web application
- CVE-2026-7172Stored Cross-Site Scripting (XSS) in TPVEnlanubeTPVEnlanube Cloud Web application
- CVE-2026-7170Stored Cross-Site Scripting (XSS) in TPVEnlanubeTPVEnlanube Cloud Web application
- CVE-2026-101036FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversalFLB-Music-Player
- CVE-2026-101035aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exceptionaligungr UERANSIM
- CVE-2026-101018dayrui XunruiCMS Group Editing Home.php group_all_edit sql injectiondayrui XunruiCMS
- CVE-2026-101017Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional conditionTrusted Domain Project OpenDMARC
- CVE-2026-94287Denial of service via unsigned underflow in libXpm's write pathx.org libXpm
- CVE-2026-94285Out-of-bounds read in libX11's byte-oriented codeset parserx.org libX11
- CVE-2026-101016Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional conditionTrusted Domain Project OpenDMARC
- CVE-2026-94284Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parserx.org libX11
- CVE-2026-94283Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parserx.org libX11
- CVE-2026-82915Path Traversal in Bimser Solution Software's eBA PlusBimser Solution Software Trade eBA Plus Document and Workfl…
- CVE-2026-101015Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in inputTrusted Domain Project OpenDMARC
- CVE-2026-86507Apache Roller: Stored XSS in comment moderation via comment author URLApache Software Foundation Apache Roller
- CVE-2026-82969Stored XSS in BİMSER's eBA PlusBimser Solution Software Trade eBA Plus Document and Workfl…
- CVE-2026-94282Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversionx.org libXi
- CVE-2026-101014Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-oneTrusted Domain Project OpenDMARC
- CVE-2026-101013mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-82381Apache Roller: Stored cross-site scripting in the authoring UIApache Software Foundation Apache Roller
- CVE-2026-82382Apache Roller: Reflected cross-site scripting in the frontpage directory parameterApache Software Foundation Apache Roller
- CVE-2026-101012mathurvishal CloudClassroom-PHP-Project makeresult.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-82385Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath filesApache Software Foundation Apache Roller
- CVE-2026-82387Apache Roller: Stored cross-site scripting via uploaded media content typeApache Software Foundation Apache Roller
- CVE-2026-82546Apache Roller: Stored cross-site scripting through incoming Trackback linksApache Software Foundation Apache Roller
- CVE-2026-91204Apache Roller: Stored javascript: URI in HTML commentsApache Software Foundation Apache Roller
- CVE-2026-91206Apache Roller: Reflected XSS in the optional LDAP comment authenticatorApache Software Foundation Apache Roller
- CVE-2026-101011aaPanel BaoTa Domain domainMod.py get_domain_status sql injectionaaPanel BaoTa
- CVE-2026-101010aaPanel BaoTa data.py getData sql injectionaaPanel BaoTa
- CVE-2026-92996Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_doneVerge3D Publishing and E-Commerce
- CVE-2026-89411Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntentPaymattic
- CVE-2026-88828Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application PasswordsBlacklist Manager
- CVE-2026-86838Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price ManipulationBookly
- CVE-2026-84744WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationWPForms
- CVE-2026-101006Frappe HR Permission Validation __init__.py get_attendance_requests authorizationFrappe HR
- CVE-2026-89300WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary RecipientsWP Verify API
- CVE-2026-93000SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via SearchSPS-Suite
- CVE-2026-89303Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' ParameterPost Voting System
- CVE-2026-101005October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgeryOctober CMS
- CVE-2026-101004notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authenticationnotionnext-org NotionNext
- CVE-2026-101003Cesanta Mongoose MQTT Broker main.c fn stack-based overflowCesanta Mongoose
- CVE-2026-100909OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgeryOctoberCMS · october/october
- CVE-2026-87723Untrusted Search Path (PATH Hijacking) in fuse-archiveGoogle fuse-archive
- CVE-2026-100907Eyeplus p2pcam Service snapshot information disclosureEyeplus
- CVE-2026-100906Eyeplus ONVIF Device GetUsers information disclosureEyeplus
- CVE-2026-100904amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scriptingamirsanni mini-inventory-and-sales-management-system
- CVE-2026-100903ООО НПО Ритм GEOritm REST API obj-groups missing authenticationООО НПО Ритм GEOritm
- CVE-2026-100901athlon1600 youtube-downloader stream.php stream server-side request forgeryathlon1600 youtube-downloader
- CVE-2026-100900DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgeryDevaslanPHP project-management
- CVE-2026-100899DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injectionDevaslanPHP project-management
- CVE-2026-100898DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injectionDevaslanPHP project-management
- CVE-2026-100897fuzui StudentInfo Password Change Endpoint moditypasswordstu authorizationfuzui StudentInfo
- CVE-2026-100895Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereferenceTrusted Domain Project OpenARC
- CVE-2026-100894mathurvishal CloudClassroom-PHP-Project updateguest.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100893Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgeryPrivoce VoceChat Server
- CVE-2026-100892aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruptionaligungr UERANSIM
- CVE-2026-100891Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding errorTrusted Domain Project OpenDMARC
- CVE-2026-100890Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereferenceTrusted Domain Project OpenDMARC