CVEs published September 30, 2026
636 CVEs were published on September 30, 2026: 67 critical, 302 high. 3 are now in CISA KEV.
- Published
- 636
- Critical
- 67
- High
- 302
- Medium
- 241
- Low
- 25
- Unrated
- 1
- Now in CISA KEV
- 3
- Fix available
- 253
Most affected products
- NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- 37
- Kiteworks Core
- 35
- NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- 34
- NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- 25
- JetBrains YouTrack
- 22
- Kiteworks Email Protection Gateway
- 22
- NVIDIA Virtual GPU Manager
- 14
- moodle
- 12
- Pexip Infinity
- 10
- Apache Software Foundation Apache MINA SSHD
- 8
Critical 67
- CVE-2026-101283iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attaesnet iperf3
- CVE-2026-101276iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees sesnet iperf3
- CVE-2026-92173Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculuMeta Platforms Meta Horizon OS
- CVE-2026-102105Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email Protection Gateway
- CVE-2026-102106Kiteworks Email Protection Gateway improper authenticationKiteworks Email Protection Gateway
- CVE-2026-102115Kiteworks Core Authentication Bypass in the Password Reset WorkflowKiteworks Core
- CVE-2026-102104Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email Protection Gateway
- CVE-2026-102103Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email Protection Gateway
- CVE-2026-102102Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email Protection Gateway
- CVE-2026-102149Kiteworks Email Protection Gateway Improper Access ControlKiteworks Email Protection Gateway
- CVE-2026-102147Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)Kiteworks Core
- CVE-2026-102095Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email Protection Gateway
- CVE-2026-102992piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envpiscinajs piscina · piscina
- CVE-2026-103547In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP chOpenBSD
- CVE-2026-100512WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerabilityHook & Filter Nested Pages
- CVE-2026-103475yii2-starter-kit through 4.2.0 Debug and Gii Module Exposureyii2-starter-kit
- CVE-2026-103473Deno 2.7.0 through 2.9.7 Command Injection via node:child_processdenoland deno
- CVE-2026-55107Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)elct9620 kobako · kobako
- CVE-2026-62308Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpointQuenary tugtainer
- CVE-2026-55494Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unsetQuenary tugtainer
- CVE-2026-55181Tugtainer: OIDC login remains accessible when OIDC_ENABLED is falseQuenary tugtainer
- CVE-2026-55176Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer tokenSoft-Machine-io security
- CVE-2026-75969PTZOptics Missing Authentication in Firmware UploadPTZOptics Move 4K · PTZOptics Link 4K +14
- CVE-2026-19445Use-after-free of a server-side SSLContext when sni_callback switches contextsPython Software Foundation CPython · libpython +2
- CVE-2026-103470In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalateInternet2 Grouper
- CVE-2026-102427Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16ordasoft.com OrdaSoft Joomla CCK
- CVE-2026-103395LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC ServiceModelTC LightLLM
- CVE-2026-76570Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1joomcode.com JCTables extension for Joomla
- CVE-2026-18782SQL Injection in Trex Digital Manufacturing's Trex MESTrex Digital Smart Manufacturing Systems Trex MES
- CVE-2026-93903LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."litespeedtech LiteSpeed Web Server
- CVE-2026-82307Multiple Vulnerabilities in Dolusoft Software's SOPLOGDolusoft Software Technologies SOPLOG
- CVE-2026-76504Cisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2026-97274WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerabilityminiOrange OAuth Single Sign On – SSO
- CVE-2026-97248WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerabilityBooking Activities Team Booking Activities
- CVE-2026-96822WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerabilityHossni Mubarak Books Gallery
- CVE-2026-96350WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerabilityEstatik
- CVE-2026-96349WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerabilitySiteSkite
- CVE-2026-94389WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerabilityAcyMailing Newsletter Team AcyMailing SMTP Newsletter
- CVE-2026-74865Authentication Bypass in sogo_yhnYunoHost-Apps sogo_yhn
- CVE-2026-74864Authentication Bypass in sogo_yhnYunoHost-Apps sogo_yhn
- CVE-2026-89238Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionApache Software Foundation Apache WSS4J
- CVE-2026-88920Apache WSS4J: SAML Sender-Vouches Authentication BypassApache Software Foundation Apache WSS4J
- CVE-2026-87830Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.Apache Software Foundation Apache WSS4J
- CVE-2026-77185Apache MINA SSHD: Asynchronous authentication can bypass signature verificationApache Software Foundation Apache MINA SSHD
- CVE-2026-94053Apache MINA SSHD: LDAP injection in sshd-ldapApache Software Foundation Apache MINA SSHD
- CVE-2026-94052Apache MINA SSHD: LDAP password authentication ineffectiveApache Software Foundation Apache MINA SSHD
- CVE-2026-102458DigiWin｜EasyFlow .NET - Missing AuthenticationDigiWin EasyFlow .NET
- CVE-2026-102455DigiWin｜EasyFlow .NET - Insecure DeserializationDigiWin EasyFlow .NET
- CVE-2026-102508Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeApache Software Foundation Apache PLC4X
- CVE-2026-97196WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerabilityLiquid Web / StellarWP GiveWP
- CVE-2026-75873Zella Theme < 2.6.3 - Unauthenticated Arbitrary File UploadZella Theme
- CVE-2026-102911zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injectionzosmaai pi-llm-wiki
- CVE-2026-103110Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute codePexip Infinity
- CVE-2026-103056AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTRbeenuar AiSOC
- CVE-2026-51856In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket
- CVE-2026-51857In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter w
- CVE-2026-51858In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an appr
- CVE-2026-51859bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:29
- CVE-2026-51861bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
- CVE-2026-51862DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).
- CVE-2026-51864DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_a
- CVE-2026-51866In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat
- CVE-2026-51867agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.
- CVE-2026-51869DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
- CVE-2026-51870DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
- CVE-2026-51871Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achiev
- CVE-2026-51872Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
High 302
- CVE-2026-103591DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/fileAsyncFuncAI deepwiki-open
- CVE-2026-92172Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horiMeta Platforms Meta Horizon OS
- CVE-2023-54403Yonyou U8 CRM Arbitrary File Read via getemaildata.phpYonyou U8 CRM
- CVE-2024-58387Inspur HCM Cloud Arbitrary File Read via file/download EndpointInspur Haiyue HCM Cloud
- CVE-2026-102108Kiteworks Email Protection Gateway deserialization of untrusted dataKiteworks Email Protection Gateway
- CVE-2026-102109Kiteworks Secure Data Forms SQL injectionKiteworks Secure Data Forms
- CVE-2023-54402iDocView SSRF via /doc/upload Endpoint Hardcoded TokeniDocView
- CVE-2026-102112Kiteworks Core Local Privilege EscalationKiteworks Core
- CVE-2026-102113Kiteworks Core Local Privilege EscalationKiteworks Core
- CVE-2026-102114Kiteworks Core OS Command InjectionKiteworks Core
- CVE-2026-102116Kiteworks Email Protection Gateway Path TraversalKiteworks Email Protection Gateway
- CVE-2026-102117Kiteworks Core Remote Code ExecutionKiteworks Core
- CVE-2026-102118Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege EscalationKiteworks Core
- CVE-2026-102119Kiteworks Email Protection Gateway Path TraversalKiteworks Email Protection Gateway
- CVE-2026-102120Kiteworks Core OS Command InjectionKiteworks Core
- CVE-2026-102121Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized ActorKiteworks Secure Data Forms
- CVE-2026-102123Kiteworks Core Path TraversalKiteworks Core
- CVE-2026-102125Kiteworks Core Sandbox EscapeKiteworks Core
- CVE-2026-102126Kiteworks Core Stored Cross-site Scripting (XSS)Kiteworks Core
- CVE-2026-102127Kiteworks Email Protection Gateway Improper Restriction of XML External Entity ReferenceKiteworks Email Protection Gateway
- CVE-2026-102128Kiteworks Email Protection Gateway Improper AuthenticationKiteworks Email Protection Gateway
- CVE-2026-102129Kiteworks Core Incorrect Privilege AssignmentKiteworks Core
- CVE-2026-102130Kiteworks Email Protection Gateway Remote Code ExecutionKiteworks Email Protection Gateway
- CVE-2026-102131Kiteworks Email Protection Gateway Improper Handling of Case SensitivityKiteworks Email Protection Gateway
- CVE-2026-102132Kiteworks Core Privilege Escalation through Improper Access ControlKiteworks Core
- CVE-2026-103000pypdf: Possible large memory usage when retrieving alphabetical page labelspy-pdf pypdf · pypdf
- CVE-2026-102101Kiteworks Core deserialization of untrusted dataKiteworks Core
- CVE-2026-102999pypdf: Possible long runtimes with large amount of embedded filespy-pdf pypdf · pypdf
- CVE-2026-102142Kiteworks Core Remote Code Execution through Server-Side Template InjectionKiteworks Core
- CVE-2026-102143Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous TypeKiteworks Email Protection Gateway
- CVE-2026-102100Kiteworks Core stored XSSKiteworks Core
- CVE-2026-102150Kiteworks Secure Data Forms Missing Authentication for Critical FunctionKiteworks Secure Data Forms
- CVE-2026-102998pypdf: Possible long runtimes when generating appearance streamspy-pdf pypdf · pypdf
- CVE-2026-102097Kiteworks Email Protection Gateway remote code executionKiteworks Email Protection Gateway
- CVE-2026-102096Kiteworks Core OS command injectionKiteworks Core
- CVE-2026-102099Kiteworks Core arbitrary file writeKiteworks Core
- CVE-2026-102094Kiteworks Email Protection Gateway unsafe reflectionKiteworks Email Protection Gateway
- CVE-2026-102093Kiteworks Core improper privilege managementKiteworks Core
- CVE-2026-102092Kiteworks Core stored XSSKiteworks Core
- CVE-2026-102997pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)py-pdf pypdf · pypdf
- CVE-2026-102091Kiteworks Secure Data Forms server-side request forgeryKiteworks Secure Data Forms
- CVE-2026-102098Kiteworks Core SQL InjectionKiteworks Core
- CVE-2026-102089Kiteworks Email Protection Gateway path traversalKiteworks Email Protection Gateway
- CVE-2026-102996pypdf: Possible large memory usage when parsing font datapy-pdf pypdf · pypdf
- CVE-2026-102995pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)py-pdf pypdf · pypdf
- CVE-2026-102994pypdf: Possible long runtimes/large memory usage when parsing indirect objectspy-pdf pypdf · pypdf
- CVE-2026-102993pypdf: Possible large memory usage when retrieving Roman page labelspy-pdf pypdf · pypdf
- CVE-2026-102990basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)patrickjuchli basic-ftp · basic-ftp
- CVE-2026-101885ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_pathzeroclaw-labs ZeroClaw
- CVE-2026-101884OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment OverrideOpenClaw Windows Node
- CVE-2026-101882OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.setOpenClaw Windows Node
- CVE-2026-101881OpenClaw Windows Node before 2026.7.1 Denial of ServiceOpenClaw Windows Node
- CVE-2026-101880OpenClaw Windows Node before 2026.7.1 Authorization BypassOpenClaw Windows Node
- CVE-2026-101879OpenClaw Windows Node before 2026.7.1-3 Missing AuthorizationOpenClaw Windows Node
- CVE-2026-102392WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerabilityThemeHigh Extra Product Options For WooCommerce | Custom Pr…
- CVE-2026-102391WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerabilityjetmonsters JetFormBuilder
- CVE-2026-102377WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerabilityPhoto Gallery by 10Web
- CVE-2026-102376WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Branda
- CVE-2026-100510WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerabilityPost and Page Builder by BoldGrid
- CVE-2026-97291WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerabilityMagazine3 Schema & Structured Data for WP & AMP
- CVE-2026-97290WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerabilitySayontan Sinha Photonic Gallery & Lightbox for Flickr, Smug…
- CVE-2026-97256WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerabilityGreg – SiteOrigin Page Builder by SiteOrigin
- CVE-2026-94171WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerabilityVillaTheme CURCY
- CVE-2026-55224MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/UninstallMineAdmin · mineadmin/mineadmin
- CVE-2026-55094Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)taskcluster
- CVE-2026-103474yii2-starter-kit through 4.2.0 Unrestricted File Upload RCEyii2-starter-kit
- CVE-2026-103472restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame BufferingCorvusoft restbed
- CVE-2026-103471restbed through 5.0.0 Denial of Service via Unbounded Header BufferingCorvusoft restbed
- CVE-2026-103446WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragmentsThe Wikimedia Foundation MediaWiki WikiLambda extension
- CVE-2026-53605Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grantpollen-robotics reachy-mini-os
- CVE-2026-87004Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verificationQuenary tugtainer
- CVE-2026-46711Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private networkSoft-Machine-io security
- CVE-2026-55177CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guarddfpc-coe CloudTAK · @tak-ps/cloudtak
- CVE-2026-102490Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packageZammad
- CVE-2026-102489Undisclosed RCE in Zammad v6.3 and higherZammad
- CVE-2026-19553SSLContext.wrap_bio() missing validation of server_hostname parameterPython Software Foundation CPython · libpython +2
- CVE-2026-103442MergeAccount PHP object injection via session-key substitutionThe Wikimedia Foundation MediaWiki CentralAuth extension
- CVE-2026-103441Unauthenticated arbitrary file deletion through Wikibase serialized entity parsingThe Wikimedia Foundation MediaWiki Wikibase extension
- CVE-2026-47496NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an outNVIDIA Virtual GPU Manager
- CVE-2026-47574NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheresNVIDIA Virtual GPU Manager
- CVE-2026-47544NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds rNVIDIA Virtual GPU Manager
- CVE-2026-47541NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds wNVIDIA Virtual GPU Manager
- CVE-2026-47536NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds rNVIDIA Virtual GPU Manager
- CVE-2026-47535NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read.NVIDIA Virtual GPU Manager
- CVE-2026-47521NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds rNVIDIA Virtual GPU Manager
- CVE-2026-47520NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds rNVIDIA Guest driver · NVIDIA Virtual GPU Manager
- CVE-2026-47519NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds rNVIDIA Guest driver · NVIDIA Virtual GPU Manager
- CVE-2026-47503NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest VM user may cause an ouNVIDIA Virtual GPU Manager
- CVE-2026-47499NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-NVIDIA Virtual GPU Manager
- CVE-2026-47498NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds writeNVIDIA Virtual GPU Manager
- CVE-2026-47497NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause imprNVIDIA Virtual GPU Manager
- CVE-2026-47495NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bNVIDIA Virtual GPU Manager
- CVE-2026-47493NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU reNVIDIA Virtual GPU Manager
- CVE-2026-47598NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged locaNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47596NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memoNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47582NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an out-of-bounds write.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47602NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver tNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47576NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-boundNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47554NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatureNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47580NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization isNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47601NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unpriNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47600NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operateNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47599NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause iNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47597NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module Resource Server where an unprivileNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47595NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memoNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47594NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47593NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged user can cause an out-of-boundNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47592NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47591NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memoNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47590NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47589NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47588NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a NVIDIA RTX, Quadro, NVS · NVIDIA GeForce +2
- CVE-2026-47587NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free.NVIDIA RTX, Quadro, NVS · NVIDIA GeForce +1
- CVE-2026-47585NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47583NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause type confusion.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47579The NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode driver through which a user might trigger a use-after-NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47578NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer siNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47577NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an incorrect comparison.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47575NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG escape handler where a local unprivileged attackerNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47573NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47572NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause type confusion.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47571NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypaNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47570NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47569NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a type confusion via a handleNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47563NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a NULL pointer dereference.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47561NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validatNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47560NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a use-after-freNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47559NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonginNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47558NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free oNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47556NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47553NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47552NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorizatiNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47551NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause a use-after-free.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47550NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged local user can supply an untruNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47548NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-boNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47545NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-boNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47540NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer uNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47530NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-boNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47528NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an access of an uniniNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47523NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-boNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47516NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user could cause a use-after-free.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47514NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47513NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47512NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47511NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47510NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an integer overfNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47508NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect conNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47507NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47505NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause a use-after-free.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47504NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47502NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer, where a guest user could cause an iNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47501NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47500NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference countsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47494NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47491NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47489NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-103432apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, apcupsd
- CVE-2026-100277In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signatureJetBrains YouTrack
- CVE-2026-100273In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code executionJetBrains YouTrack
- CVE-2026-100268In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templatesJetBrains YouTrack
- CVE-2026-100266In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted adJetBrains Hub
- CVE-2026-100262In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notificatioJetBrains YouTrack
- CVE-2026-100256In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projectsJetBrains IntelliJ IDEA
- CVE-2026-100255In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password resetJetBrains TeamCity
- CVE-2026-100254In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection JetBrains TeamCity
- CVE-2026-100253In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings JetBrains TeamCity
- CVE-2026-103398OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save PathLiquid-co OpenSave
- CVE-2026-103270LightLLM through 1.2.0 Missing Authentication on RL Control RoutesModelTC LightLLM
- CVE-2026-102984Astro: Malformed port in the Host header can crash the Node adapterwithastro astro · @astrojs/node
- CVE-2026-102717MQTT WebSocket setter ABI mismatch may disclose memory or cause a crashEclipse Foundation NetX Duo
- CVE-2026-47097AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export BundleAJA Video Systems HELO Plus
- CVE-2026-18783Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MESTrex Digital Smart Manufacturing Systems Trex MES
- CVE-2026-101295Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extractionAssisted Installer for Red Hat OpenShift Container Platform…
- CVE-2026-62097WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerabilityWPTasty Business Directory
- CVE-2026-102398WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilityPopup by Supsystic
- CVE-2026-102396WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityUltimate Maps by Supsystic
- CVE-2026-102395WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerabilitysupsystic Easy Google Maps
- CVE-2026-102385WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityKevin Stover Ninja Forms
- CVE-2026-100507WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityIf-So Dynamic Content Personalization
- CVE-2026-97293WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-97289WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerabilityExpressTech Quiz And Survey Master
- CVE-2026-97287WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerabilityLiquid Web / StellarWP Event Tickets
- CVE-2026-97272WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerabilityPremmerce Permalink Manager for WooCommerce
- CVE-2026-97271WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerabilityWPFunnels
- CVE-2026-97253WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityKreatura LayerSlider
- CVE-2026-97250WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2026-97245WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerabilitySureCart
- CVE-2026-97244WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerabilityWPFunnels Creator LMS
- CVE-2026-97241WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityPrecisionWP BackupEase
- CVE-2026-97240WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerabilityEsteban StifLi Backup Tools
- CVE-2026-97237WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2026-97235WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerabilityThemeREX Addons
- CVE-2026-97197WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2026-97077WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilitySpacetime Ad Inserter
- CVE-2026-97065WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerabilityHappyforms
- CVE-2026-96838WordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityYoOhw Studio Blacklist Manager – WooCommerce Anti-Fra…
- CVE-2026-96837WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerabilityBrainstorm Force CartFlows
- CVE-2026-96836WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerabilityMorteza Geransayeh Parsi Date
- CVE-2026-96833WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerabilityThemefic Ultimate Addons for Contact Form
- CVE-2026-96832WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerabilitykeywordrush Content Egg
- CVE-2026-96831WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerabilitythemifyme Themify Builder
- CVE-2026-96830WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerabilityNexcess GiveWP
- CVE-2026-96828WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerabilityVidish Category Discount Woocommerce
- CVE-2026-96827WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerabilityMelapress Admin Notices Manager
- CVE-2026-96823WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerabilityCusRev Customer Reviews for WooCommerce
- CVE-2026-96820WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerabilityawesomesupport Awesome Support
- CVE-2026-96819WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerabilitybobbingwide oik
- CVE-2026-96818WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerabilitymra13 / Team Tips and Tricks HQ WP Express Checkout
- CVE-2026-96817WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerabilityMakeCommerce.net MakeCommerce for WooCommerce
- CVE-2026-96816WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilityvendidero Trusted Shops Easy Integration for WooCommerce
- CVE-2026-96815WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerabilityappsbd Vitepos
- CVE-2026-96814WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityWP Titan Labs WooCommerce Product Table Lite
- CVE-2026-96352WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Ajax Search
- CVE-2026-96351WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerabilityRadiusTheme Classified Listing
- CVE-2026-96348WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerabilityBookly
- CVE-2026-96346WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerabilityweDevs WP ERP
- CVE-2026-96345WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerabilityEstatik
- CVE-2026-96344WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerabilityimpleCode eCommerce Product Catalog
- CVE-2026-96343WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerabilityweDevs WP ERP
- CVE-2026-95587WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerabilityHostinger Migrator
- CVE-2026-95531WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerabilityQuantumCloud Conversational Forms for ChatBot
- CVE-2026-94683WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerabilityJustin Nealey DesignSetGo
- CVE-2026-94678WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerabilityMat Lipe Go Live Update Urls
- CVE-2026-94677WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerabilityNexcess Kadence WooCommerce Email Designer
- CVE-2026-94499WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerabilitywpWax FormGent
- CVE-2026-94178WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerabilityJavier Carazo Import and export users and customers
- CVE-2026-94177WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerabilityRuben Garcia GamiPress
- CVE-2026-94123WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerabilitySyed Balkhi NextGEN Gallery
- CVE-2026-94122WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerabilityA WP Life Responsive Slider Gallery
- CVE-2026-94121WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability10Web Booster – Website speed optimization, Cache & Page Sp…
- CVE-2026-94120WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerabilityGravityKit GravityExport Lite for Gravity Forms
- CVE-2026-94115WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerabilityFatcatapps Easy Pricing Tables
- CVE-2026-94082WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerabilityFatcatapps Quiz Cat
- CVE-2026-94081WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilitylukeseager WordPress Persistent Login
- CVE-2026-94078WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilityGemini Labs Site Reviews
- CVE-2026-94076WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerabilitySEO Squirrly SEO Plugin by Squirrly SEO
- CVE-2026-93771WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerabilityWPFactory Cost of Goods for WooCommerce
- CVE-2026-93770WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerabilityVeronaLabs WP Statistics
- CVE-2026-93651WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerabilityDotstore Minimum and Maximum Quantity for WooCommerce
- CVE-2026-93624WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerabilitycodepeople Music Player for WooCommerce
- CVE-2026-93621WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-93514WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerabilityrainafarai Notification for Telegram
- CVE-2026-93512WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerabilityilGhera JW Player for WordPress
- CVE-2026-62085WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerabilityMelapress WP Activity Log
- CVE-2026-27371WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerabilityWPFunnels
- CVE-2026-95616Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensionsApache Software Foundation Apache WSS4J
- CVE-2026-103321MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview ImageMISP
- CVE-2026-92121Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceApache Software Foundation Apache WSS4J
- CVE-2026-85532Apache WSS4J: Insufficient Validation of Derived-Key ParametersApache Software Foundation Apache WSS4J
- CVE-2026-103242Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tagRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-62146Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socketRed Hat OpenShift Container Platform
- CVE-2026-10739Cato Networks SDP Client for Windows is vulnerable to Local Privilege EscalationCato Networks SDP Client
- CVE-2026-76992Uncontrolled Memory Allocation in CODESYS Gateway ClientCODESYS Development System · CODESYS Gateway +6
- CVE-2026-103239MISP Tag Collection Save Allows Privilege Escalation via Sibling Model InjectionMISP
- CVE-2026-103237MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant RowsMISP
- CVE-2026-93994Apache MINA SSHD: Repeated-publickey policy bypass on serverApache Software Foundation Apache MINA SSHD
- CVE-2026-10764Information disclosure in BVMS 4.5 up to 12.3IQSIGHT BVMS
- CVE-2026-94002Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesApache Software Foundation Apache MINA SSHD
- CVE-2026-79625Improper Synchronization in Monitoring in CODESYS Control RuntimeCODESYS Control RTE · CODESYS Control Win +15
- CVE-2026-103235MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary EventsMISP
- CVE-2026-102457DigiWin｜EasyFlow .NET - Arbitrary File ReadDigiWin EasyFlow .NET
- CVE-2026-102456DigiWin｜EasyFlow .NET - SQL InjectionDigiWin EasyFlow .NET
- CVE-2026-75098Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-designproductdesignerapp Product Designer App
- CVE-2026-97347Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerkazukiyanamoto Post Views Stats Counter
- CVE-2026-102454DigiWin｜EasyFlow .NET - Arbitrary File UploadDigiWin EasyFlow .NET
- CVE-2026-102511Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themApache Software Foundation Apache PLC4X
- CVE-2026-102510Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsApache Software Foundation Apache PLC4X
- CVE-2026-102509Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserApache Software Foundation Apache PLC4X
- CVE-2026-92873Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbPgpool Global Development Group Pgpool-II
- CVE-2026-92871A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of tPgpool Global Development Group Pgpool-II
- CVE-2026-6806Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parametersstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-92870A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termiPgpool Global Development Group Pgpool-II
- CVE-2026-92867An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination oPgpool Global Development Group Pgpool-II
- CVE-2026-97150When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP cbaserCMS Users Community BcAddonMigrator
- CVE-2026-89294Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parametercroixhaug Simply Schedule Appointments
- CVE-2026-92994Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage APIVerge3D Publishing and E-Commerce
- CVE-2026-91832WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRFWP Mobile Menu
- CVE-2026-89193Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML ParserRobin Image Optimizer
- CVE-2026-88797Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and ActivationVayu X
- CVE-2026-85573All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG UploadAll in One Files Upload
- CVE-2026-75823WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role EncryptionUser Frontend
- CVE-2026-103111PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arPCRE2
- CVE-2026-86134Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of ServiceWatchGuard Fireware OS
- CVE-2026-103109Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remPexip Infinity
- CVE-2026-103108Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a rePexip Infinity
- CVE-2026-103106Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service thPexip Infinity
- CVE-2026-103105Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacPexip Infinity
- CVE-2026-103104Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a rePexip Infinity
- CVE-2026-103102Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to triggePexip Infinity
- CVE-2026-96649Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)wpshuffle Frontend Post Submission Manager Lite – Guest Pos…
- CVE-2026-103101Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to Pexip Infinity
- CVE-2026-103100Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigPexip Infinity
- CVE-2026-103099Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a sPexip Infinity
- CVE-2026-103088Handlebars.java before 4.5.5 allows directory traversal.jknack handlebars.java
- CVE-2026-103087Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cgosub-io gosub-engine
- CVE-2026-103055AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secretbeenuar AiSOC
- CVE-2026-103054AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSPbeenuar AiSOC
- CVE-2026-51568modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
- CVE-2026-51570modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.
- CVE-2026-51852agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64.
- CVE-2026-51853agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__.
- CVE-2026-51860bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
Medium, low and unrated 267
- CVE-2026-103530decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgerydecolua 9Router
- CVE-2026-103592simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headerspecee simple-router
- CVE-2026-103590QloApps through 1.7.0 Reflected XSS via Length of Stay FieldsWebkul QloApps
- CVE-2026-103589QloApps through 1.7.0 Reflected XSS via Room Type EditorWebkul QloApps
- CVE-2026-103588QloApps through 1.7.0 Reflected XSS via exceptions fieldWebkul QloApps
- CVE-2026-103587QloApps through 1.7.0 Reflected XSS via Book Now Search ParametersWebkul QloApps
- CVE-2026-103585attacker-controlled javascript license URL via XSSThe Wikimedia Foundation MediaWiki MediaSearch extension
- CVE-2026-103584attacker-controlled javascript license URL via XSSThe Wikimedia Foundation MediaWiki CommonsMetadata extension
- CVE-2026-47096AJA HELO Plus < 2.1.7 Stored XSS via System Name ParameterAJA Video Systems HELO Plus
- CVE-2026-103001PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reusejpadilla pyjwt · pyjwt
- CVE-2026-102107Kiteworks Core user impersonation in a file-request featureKiteworks Core
- CVE-2026-102110Missing authentication on a Kiteworks appliance setup functionKiteworks Core
- CVE-2026-102111Kiteworks Core Improper Validation of Specified Quantity in InputKiteworks Core
- CVE-2026-102122Kiteworks Core Incorrect AuthorizationKiteworks Core
- CVE-2026-102124Kiteworks Core Missing Authentication for Critical FunctionKiteworks Core
- CVE-2026-102133Kiteworks Core Arbitrary File Write through Command InjectionKiteworks Core
- CVE-2026-102134Kiteworks Core Unprotected Alternate ChannelKiteworks Core
- CVE-2026-102135Kiteworks Email Protection Gateway Deserialization of Untrusted DataKiteworks Email Protection Gateway
- CVE-2026-102136Kiteworks Core Command Execution through Configuration InjectionKiteworks Core
- CVE-2026-102137Kiteworks Core Unrestricted Upload of File with Dangerous TypeKiteworks Core
- CVE-2026-102138Kiteworks Core Server-Side Request Forgery (SSRF)Kiteworks Core
- CVE-2026-102139Kiteworks Email Protection Gateway Incorrect AuthorizationKiteworks Email Protection Gateway
- CVE-2026-102140Kiteworks Core Insufficient Verification of Data AuthenticityKiteworks Core
- CVE-2026-102141Kiteworks Core Privilege Escalation through External Control of File Name or PathKiteworks Core
- CVE-2026-102144Kiteworks Email Protection Gateway Uncontrolled Resource ConsumptionKiteworks Email Protection Gateway
- CVE-2026-102146Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template InjectionKiteworks Email Protection Gateway
- CVE-2026-102145Kiteworks Core Server-Side Request Forgery through CRLF InjectionKiteworks Core
- CVE-2026-102090Kiteworks Core content injectionKiteworks Core
- CVE-2026-102991Mako: Path traversal via drive-letter URI on Windows in TemplateLookupsqlalchemy mako · mako
- CVE-2026-103548Improperly Stored CredentialsItron MV-90 xi
- CVE-2026-103387garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exceptiongarycourt uri-js
- CVE-2026-101883OpenClaw Windows Node through 2026.9.4 SSRF via canvas.presentOpenClaw Windows Node
- CVE-2026-103399Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue bodyRed Hat Enterprise Linux
- CVE-2026-102375WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerabilityOptimole
- CVE-2026-97265WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetEngine
- CVE-2026-102397WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerabilityUltimate Maps by Supsystic
- CVE-2026-103440pagetriagelist discloses suppressed reviewer usernamesThe Wikimedia Foundation MediaWiki PageTriage extension
- CVE-2026-103439Various rawParams() and escaped() updates to prevent XSS in Wikibase extensionThe Wikimedia Foundation MediaWiki Wikbase extension
- CVE-2026-103438Various rawParams() and escaped() updates to prevent XSS in Wikistories extensionThe Wikimedia Foundation MediaWiki Wikistories extension
- CVE-2026-103476yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-downloadyii2-starter-kit
- CVE-2026-103437ReadingLists imported metadata permits JavaScript URL XSSThe Wikimedia Foundation MediaWiki ReadingLists extension
- CVE-2026-103500Heap buffer overflow opening large emailMozilla Thunderbird
- CVE-2026-103445Stored XSS through PageForms #autoedit redirect linksThe Wikimedia Foundation MediaWiki Page_Forms extension
- CVE-2026-103241vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of servicevllm-project vLLM · vllm
- CVE-2026-103233AdithyaYelloju Restaurant-Management-System Admin Area admin authorizationAdithyaYelloju Restaurant-Management-System
- CVE-2026-103444Stored XSS through system messages in WikiForumThe Wikimedia Foundation MediaWiki WikiForum extension
- CVE-2026-103443API permits session-seeded javascript URL XSSThe Wikimedia Foundation MediaWiki Collection (Book) extens…
- CVE-2026-103232AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injectionAdithyaYelloju Restaurant-Management-System
- CVE-2026-103231AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injectionAdithyaYelloju Restaurant-Management-System
- CVE-2026-47539NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect numerNVIDIA Virtual GPU Manager
- CVE-2026-47562NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernelNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47531NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a null pointNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47526NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause a null pointer derefeNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47604NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another proNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47603NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another proNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47584NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker with local access could cause a NULL pNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47581NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47568NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47567NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47566NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak iNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47557NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a NULL pointer NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47555NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kerNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47549NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an unprivileged local user could cause a NULL pointeNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47534NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a divide by NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47517NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode driver where a local user may cause a null pointer dereferenNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47506NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occuNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47492NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper acceNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +3
- CVE-2026-47518NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission aNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47586NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel module where an attacker could cause a use-after-freeNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47565NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trigger a race conditionNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47547NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validaNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47546NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validaNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47543VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper inpuNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47542NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper inpNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47538NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds writNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47537NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47533NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47532NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-boNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47529NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write.NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47527NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds readNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47525NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47524NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-boNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47522NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper inpNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1
- CVE-2026-47515NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-47509NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-boundsNVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2
- CVE-2026-55174UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ bindingshrec UltrafastSecp256k1
- CVE-2026-103436apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and uapcupsd
- CVE-2026-103230AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injectionAdithyaYelloju Restaurant-Management-System
- CVE-2026-80490Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringifiedAlgorithm-AhoCorasick-XS
- CVE-2026-100280In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possibleJetBrains YouTrack
- CVE-2026-100279In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentialsJetBrains YouTrack
- CVE-2026-100278In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' commentsJetBrains YouTrack
- CVE-2026-100276In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the actionJetBrains YouTrack
- CVE-2026-100275In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possibleJetBrains YouTrack
- CVE-2026-100274In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification templateJetBrains YouTrack
- CVE-2026-100272In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read JetBrains YouTrack
- CVE-2026-100271In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from JetBrains YouTrack
- CVE-2026-100270In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configuratJetBrains YouTrack
- CVE-2026-100269In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassedJetBrains YouTrack
- CVE-2026-100267In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filtersJetBrains YouTrack
- CVE-2026-100265In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmationJetBrains Rider
- CVE-2026-100264In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server hostJetBrains YouTrack
- CVE-2026-100263In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possibleJetBrains YouTrack
- CVE-2026-100261In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permissionJetBrains YouTrack
- CVE-2026-100260In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password resetJetBrains YouTrack
- CVE-2026-100259In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only accessJetBrains YouTrack
- CVE-2026-100258In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settingsJetBrains YouTrack
- CVE-2026-100257In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF exportJetBrains YouTrack
- CVE-2026-103229AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injectionAdithyaYelloju Restaurant-Management-System
- CVE-2026-94545Satori-generated SVG has improper escapingvercel satori · vercel next +1
- CVE-2026-103397OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay SenderLiquid-co OpenSave
- CVE-2026-103396bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccountmlogclub bbs-go
- CVE-2026-103243LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpointsModelTC LightLLM
- CVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRFwithastro astro · @astrojs netlify +1
- CVE-2026-103227GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflowGPAC
- CVE-2026-103389MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation GraphMISP
- CVE-2026-103388MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source FieldMISP
- CVE-2026-103226Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflowArtifex Ghostscript
- CVE-2026-97259WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerabilityWP Hosting AS Pay with Vipps for WooCommerce
- CVE-2026-62084WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerabilityJeff Starr User Submitted Posts
- CVE-2026-103222Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflowC-Blosc2
- CVE-2026-103118GraphicsMagick WPG File wpg.c ExtractPostscript recursionGraphicsMagick
- CVE-2026-93547Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cellsvaadin · vaadin-spreadsheet-flow +1
- CVE-2026-91860Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Mergevaadin · vaadin-core +3
- CVE-2026-103117OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injectionOS4ED openSIS-Classic
- CVE-2026-86778Username Enumeration in Maksisoft Technology's Maksisoft GymMaksisoft Technology, IT, and Software Industry and Trade M…
- CVE-2026-103116OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injectionOS4ED openSIS-Classic
- CVE-2026-102399WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerabilityPhoto Gallery by Supsystic
- CVE-2026-102386WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerabilityJacob N. Breetvelt WP Photo Album Plus
- CVE-2026-102384WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerabilitySupreme Modules Lite
- CVE-2026-100513WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilityAman CF7 Views – Complete Entry Management for Contac…
- CVE-2026-100508WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerabilityWordPress.org Two Factor
- CVE-2026-97302WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerabilityThemeisle MPG
- CVE-2026-97301WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerabilityCool Plugins Cool Formkit Lite
- CVE-2026-97299WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityKnitPay Razorpay Payment Links for WooCommerce
- CVE-2026-97298WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerabilityKingAddons King Addons for Elementor
- CVE-2026-97292WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Tab Manager
- CVE-2026-97288WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerabilityJayson T Cote OAuth Server
- CVE-2026-97286WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerabilityWP Chill Strong Testimonials
- CVE-2026-97285WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerabilityNexcess The Events Calendar
- CVE-2026-97282WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerabilityRadiusTheme Review Schema
- CVE-2026-97279WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerabilityChouby Polylang
- CVE-2026-97270WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerabilityJustin Sternberg CMB2
- CVE-2026-97267WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerabilityminiOrange Prevent files / folders access
- CVE-2026-97266WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerabilityNexcess Virtue/Ascend/Pinnacle Toolkit
- CVE-2026-97262WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerabilityVisual Composer Website Builder
- CVE-2026-97261WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerabilityVillaTheme Notivo
- CVE-2026-97249WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-97247WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerabilityCreative Themes Blocksy Companion
- CVE-2026-97246WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerabilityShortPixel Image Optimizer
- CVE-2026-97243WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerabilityflexyma AllAble Connector
- CVE-2026-97242WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerabilityphuongwebo WEBO MCP
- CVE-2026-97239WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerabilityJose Conti MCP Content Manager Lite
- CVE-2026-97238WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock. Jetimpex JetEngine
- CVE-2026-97236WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerabilityThemeREX Addons
- CVE-2026-97079WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerabilityWebba Appointment Booking Webba Booking
- CVE-2026-97078WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerabilityBoldGrid Client Invoicing by Sprout Invoices
- CVE-2026-97074WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerabilityNewsletters, Email Marketing, SMS and Popups by Omnisend
- CVE-2026-97067WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerabilityShane Bishop EWWW Image Optimizer
- CVE-2026-97066WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerabilityNexcess GiveWP
- CVE-2026-96835WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerabilityKingAddons.com King Addons for Elementor
- CVE-2026-96834WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerabilityNexcess GiveWP
- CVE-2026-96829WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH The Plus Addons for Elementor Page Builder Lite
- CVE-2026-96825WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerabilityDavid Anderson / Team Updraft All In One WP Security & Fire…
- CVE-2026-96824WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerabilityenvato Template Kit – Import
- CVE-2026-96821WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerabilityMahmudul Hasan Arif FluentBoards
- CVE-2026-96450WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerabilitypixfort Core
- CVE-2026-96347WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerabilityBookly
- CVE-2026-96338WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs Profile Builder
- CVE-2026-94681WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerabilityTijmen Smit WP Store Locator
- CVE-2026-94674WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerabilitySweetCode Pixel Manager for WooCommerce
- CVE-2026-94673WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-94672WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability10up Safe SVG
- CVE-2026-94173WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerabilityStrategy11 Team Business Directory
- CVE-2026-94077WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability10up Safe SVG
- CVE-2026-94074WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-62083WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerabilityWPFunnels Creator LMS
- CVE-2026-62081WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerabilitywpdesk Flexible PDF Coupons
- CVE-2026-62080WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerabilityLeevio Happy Addons for Elementor
- CVE-2026-62079WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerabilityQode Qi Addons For Elementor
- CVE-2026-62078WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2026-27085WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerabilityBrainstorm Force Astra WordPress Theme
- CVE-2026-103115OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injectionOS4ED openSIS-Classic
- CVE-2026-92899Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceApache Software Foundation Apache WSS4J
- CVE-2026-10726Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validationCato Networks SDP Client
- CVE-2026-103012Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead @anthropic-ai/claude-code
- CVE-2026-103114OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injectionOS4ED openSIS-Classic
- CVE-2026-13720Editor can forge file-provisioning provenance on dashboards via the dashboard APIGrafana OSS · Grafana Enterprise
- CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list APIGrafana Enterprise · Grafana OSS
- CVE-2026-96342WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerabilityAmauri.IO WPMobile.App
- CVE-2026-103113OS4ED openSIS-Classic General Information Tab Student.php save action sql injectionOS4ED openSIS-Classic
- CVE-2026-93995Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the serverApache Software Foundation Apache MINA SSHD
- CVE-2026-93996Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line readApache Software Foundation Apache MINA SSHD
- CVE-2026-94029Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extensionApache Software Foundation Apache MINA SSHD
- CVE-2026-102588Moodle: csrf in xml grade importmoodle
- CVE-2026-102587Moodle: user list filters bypass profile field visibilitymoodle
- CVE-2026-102586Moodle: xss via password reset link due to insufficient username escapingmoodle
- CVE-2026-102585Moodle: group validation missing when enrolling user to coursemoodle
- CVE-2026-102584Moodle: missing capability check allows unauthorised grade penalty recalculationmoodle
- CVE-2026-102583Moodle: incorrect capability check in ai generate image web servicemoodle
- CVE-2026-102582Moodle: manual enrolment page accessible when plugin disabledmoodle
- CVE-2026-102581Moodle: xss in forum post templates due to insufficient escapingmoodle
- CVE-2026-102580Moodle: arbitrary class instantiation via report builder audience classnamemoodle
- CVE-2026-102579Moodle: user profile information disclosure via grade web servicemoodle
- CVE-2026-102578Moodle: sql injection in question bank web servicemoodle
- CVE-2026-102577Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypassmoodle
- CVE-2026-102459DigiWin｜EasyFlow .NET - Reflected Cross-site ScriptingDigiWin EasyFlow .NET
- CVE-2026-92712ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameterrockiger ReactPress – Create React App for WordPress
- CVE-2025-14564Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadahsangadit Viable URL Media Uploader
- CVE-2026-93908Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameterrameez_iqbal Real Estate Manager – Property Listing and Age…
- CVE-2026-92872Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.Pgpool Global Development Group Pgpool-II
- CVE-2026-93462A missing authentication for critical function vulnerability exists in baserCMS.baserCMS User Community baserCMS
- CVE-2026-6173Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameterboldthemes Bold Page Builder
- CVE-2026-16596WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameterwpdirectorykit WP Directory Kit
- CVE-2026-6170Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attributeboldthemes Bold Page Builder
- CVE-2026-6171Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attributeboldthemes Bold Page Builder
- CVE-2026-14876Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Blocknextendweb Smart Slider
- CVE-2026-11895HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Settingdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2026-88037Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service titleboldthemes Bold Page Builder
- CVE-2026-6172Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameterboldthemes Bold Page Builder
- CVE-2026-93464A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS.baserCMS User Community baserCMS
- CVE-2026-93460A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS.baserCMS User Community baserCMS
- CVE-2026-93463A cross-site scripting vulnerability via script validation bypass exists in baserCMS.baserCMS User Community baserCMS
- CVE-2026-92869An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.Pgpool Global Development Group Pgpool-II
- CVE-2026-92868An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificaPgpool Global Development Group Pgpool-II
- CVE-2026-97316Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect BypassBroken Link Notifier
- CVE-2026-96886Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV ExportCourse Booking System
- CVE-2026-94297Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term CreationMedia Library Organizer
- CVE-2026-94274YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST APIYayReviews
- CVE-2026-93580InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment WebhookInPost PL
- CVE-2026-92424Content Egg < 11.9.0 - Contributor+ Stored XSS via Import QueueContent Egg
- CVE-2026-91072EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration HandlerEWWW Image Optimizer
- CVE-2026-91051EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post MetaEWWW Image Optimizer
- CVE-2026-90953Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission CallbacksImage Optimizer
- CVE-2026-89190Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajaxRobin Image Optimizer
- CVE-2026-88791Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect RulesSafe Redirect Manager
- CVE-2026-87777Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget AttributeHostinger Reach
- CVE-2026-86789Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST RoutesConnections Business Directory
- CVE-2026-85576All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings UpdateAll in One Files Upload
- CVE-2026-85415Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URLAudio Player Block
- CVE-2026-85001EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle AttributeEmbedPress
- CVE-2026-83560New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key BypassNew User Approve
- CVE-2026-82127Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term FieldsSchema & Structured Data for WP & AMP
- CVE-2026-80333Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview RoutesSolace Extra
- CVE-2026-75824WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration DisabledUser Frontend
- CVE-2026-100143FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout EmailFluentCart A New Era of eCommerce
- CVE-2026-102913SourceCodester Car Driving School Management System Master.php save_enrollment sql injectionSourceCodester Car Driving School Management System
- CVE-2026-102912SourceCodester Online Leave Management System page reports sql injectionSourceCodester Online Leave Management System
- CVE-2026-102910SourceCodester Online Reviewer Management System exam-delete.php sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-102909SourceCodester Online Reviewer Management System btn_functions.php sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-102908SourceCodester Online Reviewer Management System questions-view.php sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-1029060xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection0xshariq github-mcp-server
- CVE-2026-102874HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injectionHKUDS AnyTool
- CVE-2026-86556An information disclosure vulnerability in ZTE U30 Air productZTE U30 Air
- CVE-2026-102847gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scriptinggedelumbung HospitalManagement
- CVE-2026-81310Image Scanner Driver for Linux contains a link following vulnerability.PFU Limited Image Scanner Driver for Linux
- CVE-2026-78229Image Scanner Driver for Linux contains an OS command injection vulnerability.PFU Limited Image Scanner Driver for Linux
- CVE-2026-102846gedelumbung HospitalManagement Configuration sistem.php simpan improper authorizationgedelumbung HospitalManagement
- CVE-2026-102845gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosuregedelumbung HospitalManagement
- CVE-2026-102844gedelumbung HospitalManagement laporan_data_pasien.php detail authorizationgedelumbung HospitalManagement
- CVE-2026-102843gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversalgedelumbung HospitalManagement
- CVE-2026-102842gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted uploadgedelumbung HospitalManagement
- CVE-2026-51936Zetetic SQLCipher before 4.15.0 allows SQL injection.Zetetic SQLCipher
- CVE-2026-103057AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpointsbeenuar AiSOC
- CVE-2026-103053AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action APIbeenuar AiSOC
- CVE-2026-102805Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflowNothings stb
- CVE-2026-102804Nothings stb stb_hexwave.h hexwave_init integer overflowNothings stb