CVEs published October 2, 2026
398 CVEs were published on October 2, 2026: 41 critical, 187 high.
- Published
- 398
- Critical
- 41
- High
- 187
- Medium
- 161
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 286
Most affected products
- Apache Software Foundation Apache Thrift
- 61
- yeswiki
- 35
- Legion of the Bouncy Castle bc-csharp
- 21
- Repasat application
- 16
- ZcashFoundation zebra
- 14
- Google Chrome
- 11
- MISP
- 8
- TryGhost Ghost · ghost
- 8
- UTMStack
- 7
- Apache Software Foundation Apache Directory LDAP API
- 6
Critical 41
- CVE-2026-84411MikroTik RouterOS Integer UnderflowMikroTik RouterOS
- CVE-2026-95102Monta monta.app Missing Authentication for Critical Functionmonta.app
- CVE-2026-75937OS Command Injection in Digi Accelerated Linux (DAL OS)Digi International IX Family · Digi International EX Fa… +10
- CVE-2026-82042UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilterUTMStack
- CVE-2026-104019OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified StudioAWS sagemaker-distribution
- CVE-2026-103956Missing authentication for critical function in Loom for AWSAWS loom
- CVE-2023-54405H3C CVM Unauthenticated File Upload via fileUpload/upload TokenH3C CVM
- CVE-2026-102795Apache Traffic Server: SNI to Host header matching policy is not properly enforcedApache Software Foundation Apache Traffic Server
- CVE-2026-104849Tinypool: Prototype Pollution Gadget to RCE in run() optionstinylibs tinypool · tinypool
- CVE-2026-104848Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Executiontinylibs tinypool · tinypool
- CVE-2026-103630Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via Google Chrome
- CVE-2026-103626Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engiGoogle Chrome
- CVE-2026-103628Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandboxGoogle Chrome
- CVE-2026-103648Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloaderdemsking image-downloader
- CVE-2026-104846Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)lxsmnsyc seroval · seroval
- CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayGitLab AI Gateway
- CVE-2026-19652Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' ParameterDiviEngine Divi Membership
- CVE-2026-83632Apache Thrift: C++ THttpTransport grows its line buffer without boundApache Software Foundation Apache Thrift
- CVE-2026-104611Tenda AC9 POST Request fast_setting_internet_set stack-based overflowTenda AC9
- CVE-2026-104610Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflowTenda HG7 · Tenda HG9 +1
- CVE-2026-104467YesWiki before 4.6.7 Authorization Bypass via Public API Modeyeswiki
- CVE-2026-91135Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)Apache Software Foundation Apache Thrift
- CVE-2026-86325A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface.Moxa MGate MB3170 Series · Moxa MGate MB3270 Series
- CVE-2026-103877Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elementsApache Software Foundation Apache Directory LDAP API
- CVE-2026-94541WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameteramauric WPMobile.App – Android and iOS App Builder
- CVE-2026-97637JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Responseparorrey JSON API Auth
- CVE-2026-63569MTI/A0 DHAgreement does not validate the peer's ephemeral valueLegion of the Bouncy Castle bc-csharp
- CVE-2026-93029There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.Webpros cPanel · Webpros WP Squared
- CVE-2026-93697There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.Webpros cPanel · Webpros WP Squared
- CVE-2026-93698Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.Webpros cPanel · Webpros WP Squared
- CVE-2026-15896Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path ParameterWebRehab Super Forms – Drag & Drop Form Builder
- CVE-2026-19660Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' ParameterDiviEngine Divi Membership
- CVE-2026-14378DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flowdplugins DevKit Pro
- CVE-2026-104480Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membershipDiscord libdave
- CVE-2026-51898sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
- CVE-2026-51904SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.
- CVE-2026-51906In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write
- CVE-2026-51911vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).
- CVE-2026-51915TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.
- CVE-2026-51918FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().
- CVE-2026-51922agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).
High 187
- CVE-2026-104478Formwork before 2.3.13 Path Traversal via BackupController Download and Deletegetformwork formwork
- CVE-2026-104476Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archivebackdrop
- CVE-2026-104433Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readStringkvcache-ai Mooncake
- CVE-2026-105050PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation PeaZip
- CVE-2026-94591Armatura LLC Armatura One Use of Hard-coded Cryptographic KeyArmatura One
- CVE-2026-94592Armatura LLC Armatura One Use of Hard-coded CredentialsArmatura One
- CVE-2026-94593Armatura LLC Armatura One Insertion of Sensitive Information into Log FileArmatura One
- CVE-2026-97363Monta monta.app Improper Restriction of Excessive Authentication Attemptsmonta.app
- CVE-2026-97212Monta monta.app Insufficient Session Expirationmonta.app
- CVE-2026-82045UTMStack < 11.2.16 JPQL Injection via searchPropertyValuesUTMStack
- CVE-2026-104873LangGraph SDK custom auth silently ignores actions= on resource decoratorslangchain-ai langgraph · langgraph-sdk
- CVE-2026-82039UTMStack < 11.2.16 SQL Injection via searchGroupsByFilterUTMStack
- CVE-2026-104988Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subjectRed Hat Certificate System · Red Hat Enterprise Linux
- CVE-2026-104991Phproject < 1.8.7 Missing Authorization via Issues REST APIAlanaktion phproject
- CVE-2026-39718WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerabilityWebriti Wallstreet
- CVE-2026-103958Server-side request forgery in the tool server and remote agent connection handling in Loom for AWSAWS loom
- CVE-2026-96940Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2020-37278Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFileWeaver e-Bridge
- CVE-2014-125130CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.phpDamjan CodeArt Google MP3 Audio Player
- CVE-2026-104861probe-image-size: Quadratic-time Denial of Service in the SVG Parsernodeca probe-image-size · probe-image-size
- CVE-2026-104859Nx: OS command injection in the @nx/docker release pipelinenrwl nx · @nx/docker
- CVE-2026-59265Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeoverApache Software Foundation Apache OpenOffice
- CVE-2026-102626LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attributeLimeSurvey
- CVE-2026-104854Nx daemon and plugin worker sockets are accessible to other local usersnrwl nx · nx
- CVE-2026-104851fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Executionfsspec filesystem_spec · fsspec
- CVE-2026-103631Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox viaGoogle Chrome
- CVE-2026-103623Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandboxGoogle Chrome
- CVE-2026-103622Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cGoogle Chrome
- CVE-2026-103624Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-103625Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-104912MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute DataMISP
- CVE-2026-96613Missing Authorization in Meari IoT Cloud Platform OpenAPI ServiceMeari IoT Cloud Platform OpenAPI Service
- CVE-2026-104847ProseMirror: XSS vulnerability in prosemirror-view's paste handlingprosemirror-view
- CVE-2026-104908MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingMISP
- CVE-2026-104845Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationlxsmnsyc seroval · seroval
- CVE-2026-94483Next.js: Server-Side Request Forgery in Image Optimizationvercel next.js · next
- CVE-2026-104026In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs.Meta Platforms Sapling SCM
- CVE-2026-94422xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escapexdg-dbus-proxy · Fedora +1
- CVE-2026-93875JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' ParameterCrocoblock JetAppointment
- CVE-2026-85215SQL Injection in GG Soft's PaperworkGG Soft Software Services Paperwork
- CVE-2026-61374Apache Thrift: Java TSaslTransport post-auth data-frame missing size limitApache Software Foundation Apache Thrift
- CVE-2026-63772Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform countApache Software Foundation Apache Thrift
- CVE-2026-66055Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)Apache Software Foundation Apache Thrift
- CVE-2026-66081Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messagesApache Software Foundation Apache Thrift
- CVE-2026-66837Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string lengthApache Software Foundation Apache Thrift
- CVE-2026-66858Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)Apache Software Foundation Apache Thrift
- CVE-2026-66859Apache Thrift: c_glib multiplexed processor crashes on a message it cannot routeApache Software Foundation Apache Thrift
- CVE-2026-104733User Impersonation/Authorization Bypass in XMPP Server ejabberdProcessOne ejabberd
- CVE-2026-83663Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)Apache Software Foundation Apache Thrift
- CVE-2026-83745Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)Apache Software Foundation Apache Thrift
- CVE-2026-85476Apache Thrift: c_glib `read_all` spins when the underlying read returns 0Apache Software Foundation Apache Thrift
- CVE-2026-96289Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guardApache Software Foundation Apache Thrift
- CVE-2026-96287Apache Thrift: Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)Apache Software Foundation Apache Thrift
- CVE-2026-96286Apache Thrift: Perl servers end `serve()` when serving one connection failsApache Software Foundation Apache Thrift
- CVE-2026-96277Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exceptionApache Software Foundation Apache Thrift
- CVE-2026-94658Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)Apache Software Foundation Apache Thrift
- CVE-2026-94657Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size boundApache Software Foundation Apache Thrift
- CVE-2026-94656Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size boundApache Software Foundation Apache Thrift
- CVE-2026-94655Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadraticApache Software Foundation Apache Thrift
- CVE-2026-94654Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frameApache Software Foundation Apache Thrift
- CVE-2026-94653Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)Apache Software Foundation Apache Thrift
- CVE-2026-94648Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size boundApache Software Foundation Apache Thrift
- CVE-2026-94646Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)Apache Software Foundation Apache Thrift
- CVE-2026-94637Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frameApache Software Foundation Apache Thrift
- CVE-2026-94636Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used upApache Software Foundation Apache Thrift
- CVE-2026-90440Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny serviceApache Software Foundation Apache Thrift
- CVE-2026-87117Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element specApache Software Foundation Apache Thrift
- CVE-2026-86537Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny serviceApache Software Foundation Apache Thrift
- CVE-2026-104472YesWiki before 4.6.7 Missing Authorization via Attachment Download Handleryeswiki
- CVE-2026-104471YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Importyeswiki
- CVE-2026-104469YesWiki before 4.6.7 Session Fixation via Login in AuthController.phpyeswiki
- CVE-2026-104464YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameteryeswiki
- CVE-2026-104463YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inboxyeswiki
- CVE-2026-104462YesWiki before 4.6.7 SQL Injection via nuagetag tags parameteryeswiki
- CVE-2026-104460YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearchyeswiki
- CVE-2026-104458YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addressesyeswiki
- CVE-2026-104457YesWiki before 4.6.7 SQL Injection via filtertags filterN parameteryeswiki
- CVE-2026-104456YesWiki before 4.6.7 Second-Order SQL Injection via ACL Usernameyeswiki
- CVE-2026-104450YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Actionyeswiki
- CVE-2026-104449YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_ficheyeswiki
- CVE-2026-104448YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handleryeswiki
- CVE-2026-104447YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateActionyeswiki
- CVE-2026-104445YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofingyeswiki
- CVE-2026-104444YesWiki before 4.6.7 Authorization Bypass via Comments API editCommentyeswiki
- CVE-2026-104443YesWiki before 4.6.7 Scope Bypass via Triples Delete APIyeswiki
- CVE-2026-86535Apache Thrift: A JSON member name can stall the Node server's event loop indefinitelyApache Software Foundation Apache Thrift
- CVE-2026-104439YesWiki before 4.6.7 User Enumeration via Lost-Password Flowyeswiki
- CVE-2026-104438YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actionsyeswiki
- CVE-2026-104437Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output HandlingZcashFoundation zebra · zebrad
- CVE-2026-104435Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without OutputZcashFoundation zebra · zebrad +1
- CVE-2026-104434Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPCZcashFoundation zebra · zebra-rpc +1
- CVE-2026-104431Zebra before 6.0.0 Denial of Service via Synchronous Script FFI VerificationZcashFoundation zebra
- CVE-2026-104430Zebra 4.5.0 Consensus Split via P2SH Sigop OvercountZcashFoundation zebra
- CVE-2026-104427Zebra before 6.1.0 Chain Stall via Stale parent_error_map EntryZcashFoundation zebra
- CVE-2026-104426Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value CheckZcashFoundation zebra
- CVE-2026-104423Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof VerificationZcashFoundation zebra
- CVE-2026-104422Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig RewriteZcashFoundation zebra
- CVE-2026-104418Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation FilesTryGhost Ghost · ghost
- CVE-2026-104416Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin APITryGhost Ghost · ghost
- CVE-2026-104414Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo ResponsesTryGhost Ghost · ghost
- CVE-2026-104413Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card ImagesTryGhost Ghost · ghost
- CVE-2026-104411Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File UploadsTryGhost Ghost · ghost
- CVE-2026-104410SiYuan before 3.8.5 Information Disclosure via /api/export/previewsiyuan-note siyuan
- CVE-2026-82459Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit processApache Software Foundation Apache Thrift
- CVE-2026-82458Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes availableApache Software Foundation Apache Thrift
- CVE-2026-96288Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)Apache Software Foundation Apache Thrift
- CVE-2026-96292Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)Apache Software Foundation Apache Thrift
- CVE-2026-96294Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connectionApache Software Foundation Apache Thrift
- CVE-2026-61373Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocationApache Software Foundation Apache Thrift
- CVE-2026-96990Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size boundApache Software Foundation Apache Thrift
- CVE-2026-94642Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exceptionApache Software Foundation Apache Thrift
- CVE-2026-94644Apache Thrift: PHP `TJSONProtocol` string/number readers have no size boundApache Software Foundation Apache Thrift
- CVE-2026-94645Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop boundApache Software Foundation Apache Thrift
- CVE-2026-94650Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)Apache Software Foundation Apache Thrift
- CVE-2026-94651Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse errorApache Software Foundation Apache Thrift
- CVE-2026-85493Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)Apache Software Foundation Apache Thrift
- CVE-2026-85494Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)Apache Software Foundation Apache Thrift
- CVE-2026-86326An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify thMoxa MGate MB3170 Series · Moxa MGate MB3270 Series
- CVE-2026-91137Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elementsApache Software Foundation Apache Thrift
- CVE-2026-93925Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol idApache Software Foundation Apache Thrift
- CVE-2026-93926Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error pathApache Software Foundation Apache Thrift
- CVE-2026-94633Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name lengthApache Software Foundation Apache Thrift
- CVE-2026-94634Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by defaultApache Software Foundation Apache Thrift
- CVE-2026-103885Apache Directory LDAP API: Denial of service via crafted telephone number valuesApache Software Foundation Apache Directory LDAP API
- CVE-2026-103880Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwordsApache Software Foundation Apache Directory LDAP API
- CVE-2026-103878Apache Directory LDAP API: Injection of plaintext responses during StartTLSApache Software Foundation Apache Directory LDAP API
- CVE-2026-103552Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoderApache Software Foundation Apache Directory LDAP API
- CVE-2026-94639Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)Apache Software Foundation Apache Thrift
- CVE-2026-87920W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Contentboldgrid W3 Total Cache
- CVE-2026-102731Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decodeApache Software Foundation Apache Directory LDAP API
- CVE-2026-94635Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned nameApache Software Foundation Apache Thrift
- CVE-2026-80298SQL Injection in HAVELSAN's Sef - AI Chatbot PlatformHAVELSAN Sef - AI Chatbot Platform
- CVE-2026-80443Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot PlatformHAVELSAN Sef - AI Chatbot Platform
- CVE-2026-18036NTRU leaks private key information by reducing secret values with a non-constant-time integer divisionLegion of the Bouncy Castle BC-JAVA
- CVE-2026-95670No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirectmihdan No External Links
- CVE-2026-93756Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Previewsmub Smash Balloon Social Post Feed – Simple Social Feeds f…
- CVE-2026-100107Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)extendthemes Kubio AI Page Builder
- CVE-2026-96871Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameterkitae-park Mang Board
- CVE-2026-97342JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Actionjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-103426Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' ParameterRelevanssi Premium
- CVE-2026-96566Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parametersatollo Newsletter – Send awesome emails from WordPress
- CVE-2026-100182Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editorwpchill Download Monitor
- CVE-2026-97641Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Contentcomesio Relevanssi – A Better Search
- CVE-2026-102772CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Fieldjtsternberg CMB2
- CVE-2026-95817DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Contentapasionados DoFollow Case by Case
- CVE-2026-97336CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Typejtsternberg CMB2
- CVE-2026-96567MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)websoudan MW WP Form
- CVE-2026-96578GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Contentcreative-solutions-1 GSpeech TTS – WordPress Text To Speech…
- CVE-2026-97663Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Nameivole Customer Reviews for WooCommerce
- CVE-2026-17507MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range senderLegion of the Bouncy Castle BC-JAVA
- CVE-2026-103604Quadratic-time escaping when converting X.509 distinguished names to stringsLegion of the Bouncy Castle bc-csharp
- CVE-2026-103603Unbounded HSS public key level count allows huge array allocation during signature verificationLegion of the Bouncy Castle bc-csharp
- CVE-2026-103602Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hostsLegion of the Bouncy Castle bc-csharp
- CVE-2026-103601CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag checkLegion of the Bouncy Castle bc-csharp
- CVE-2026-103600Unbounded ASN.1 nesting depth causes process-terminating stack overflowLegion of the Bouncy Castle bc-csharp
- CVE-2026-63578Unbounded PBE iteration count when decrypting PKCS#8 private keysLegion of the Bouncy Castle bc-csharp
- CVE-2026-63577Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefixLegion of the Bouncy Castle bc-csharp
- CVE-2026-63576URI name constraints checked against a mis-parsed hostLegion of the Bouncy Castle bc-csharp
- CVE-2026-63575PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration countLegion of the Bouncy Castle bc-csharp
- CVE-2026-63574Unbounded allocation from OpenPGP signature and user attribute subpacket lengthsLegion of the Bouncy Castle bc-csharp
- CVE-2026-63573Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrapLegion of the Bouncy Castle bc-csharp
- CVE-2026-63572Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 filesLegion of the Bouncy Castle bc-csharp
- CVE-2026-63571Attribute certificate path validation does not verify the attribute certificate's signatureLegion of the Bouncy Castle bc-csharp
- CVE-2026-63570Pkcs12Store.GetCertificateChain loops forever on cyclic issuer linksLegion of the Bouncy Castle bc-csharp
- CVE-2026-63568Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustionLegion of the Bouncy Castle bc-csharp
- CVE-2026-63567IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)Legion of the Bouncy Castle bc-csharp
- CVE-2026-63566DTLS handshake reassembler allocates buffer from unchecked 24-bit lengthLegion of the Bouncy Castle bc-csharp
- CVE-2026-16001IesEngine stream-mode MAC forgery via length-dependent KDF splitLegion of the Bouncy Castle bc-csharp
- CVE-2026-16000KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is usedLegion of the Bouncy Castle bc-csharp
- CVE-2026-15999AES-CCM decryption accepts zero or out-of-range tag length, bypassing authenticationLegion of the Bouncy Castle bc-csharp
- CVE-2026-102565BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameterbookingalgorithms BA Book Everything
- CVE-2026-91828OMGF < 6.3.11 - Unauthenticated DoS via do_optimizeOMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
- CVE-2026-92174SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parametergpriday SiteOrigin Widgets Bundle
- CVE-2026-90438Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submissionkstover Ninja Forms – Contact Form Builder with Calculators…
- CVE-2026-15897Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & LoginWebRehab Super Forms – Drag & Drop Form Builder
- CVE-2026-92820Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File UploadSaturdayDrive Ninja Forms - File Uploads
- CVE-2026-10026CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code ExecutionCTX Feed Pro
- CVE-2026-93367Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)wp-buy Visitor Traffic Real Time Statistics pro
- CVE-2026-103098GV-Eye Sensitive information exposure in URL query parameter VulnerabilityGeoVision GV-Eye
- CVE-2026-103097GV-Eye Relay Payment API Key VulnerabilityGeoVision GV-Eye
- CVE-2026-103096GV-Eye Hardcoded API Key VulnerabilityGeoVision GV-Eye
- CVE-2026-51901SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.
- CVE-2026-51907In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write ima
- CVE-2026-51914TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.
- CVE-2026-51916TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/know
- CVE-2026-51917FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.
- CVE-2026-67989crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition
Medium, low and unrated 170
- CVE-2026-105030Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard APIrajnandan1 kener
- CVE-2026-105029UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpointuvdesk support-center-bundle · uvdesk community-skeleton
- CVE-2026-104479Shopclass before 6.2.0 Stored XSS via Listing Description Fieldmindstellar shopclass
- CVE-2026-104477Showdown through 2.1.0 XSS via unescaped quote in href and src attributesshowdownjs showdown
- CVE-2026-104475IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Uploadidurar-erp-crm
- CVE-2026-104474OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Updatelitespeedtech openlitespeed
- CVE-2026-105051Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sysIrdeto Denuvo Anti-Tamper
- CVE-2026-105049Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLZilliz Attu
- CVE-2026-105048The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).Zilliz Attu
- CVE-2026-105046Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.Kentico Xperience
- CVE-2026-94594Armatura LLC Armatura One Insertion of Sensitive Information into Log FileArmatura One
- CVE-2026-105043MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cMathWorks Simulink
- CVE-2026-93474Monta monta.app Insufficiently Protected Credentialsmonta.app
- CVE-2026-104055Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charmCanonical postgresql-operator
- CVE-2026-104874Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionaio-libs multidict · multidict
- CVE-2026-82044UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdfUTMStack
- CVE-2026-82043UTMStack < 11.2.16 Account Enumeration via Password Reset EndpointUTMStack
- CVE-2026-82041UTMStack < 11.2.16 Missing Authorization via Command WebSocketUTMStack
- CVE-2026-103918@orpc/zod: Prototype injection in smart coercionmiddleapi orpc · @orpc/zod
- CVE-2026-82040UTMStack < 11.2.16 SSRF via IdentityProviderServiceUTMStack
- CVE-2026-103036@orpc/json-schema: Prototype injection in smart coercionmiddleapi orpc
- CVE-2026-104994Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root.aquasec Trivy
- CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeopen-telemetry opentelemetry-js-contrib · @opentelemetr… +15
- CVE-2026-104871Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windowsangular-cli · @angular/ssr
- CVE-2026-12392RPC secret disclosure via vendor data endpoint in Canonical MAASCanonical MAAS
- CVE-2026-103957Server-side request forgery in the OAuth2 discovery handling in Loom for AWSAWS loom
- CVE-2026-19856All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search QueryAll in One SEO
- CVE-2026-104855Wasmtime: Preemption and traps during bulk operations enable breaking internal VM statebytecodealliance wasmtime · wasmtime
- CVE-2026-104853Nx: Path traversal in nx migrate package-migrations extractionnrwl nx · nx
- CVE-2026-104914MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated ViewMISP
- CVE-2026-103627Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTMLGoogle Chrome
- CVE-2026-103629Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML pageGoogle Chrome
- CVE-2026-103621Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTGoogle Chrome
- CVE-2026-104910MISP Information Disclosure via Related Events Listing Bypassing Per-Event AuthorizationMISP
- CVE-2026-101104Missing Authorization in Meari IoT Cloud Platform OpenAPI ServiceMeari IoT Cloud Platform OpenAPI Service
- CVE-2026-104907MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline HandlerMISP
- CVE-2026-104906MISP TAXII Object Viewer Stored XSS via Unescaped JSON OutputMISP
- CVE-2026-104844PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionpostcss-selector-parser
- CVE-2026-104843uv: Path traversal on Windows through wheel extractionastral-sh uv · uv
- CVE-2026-94484Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of servicevercel next.js · next
- CVE-2026-94485Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypassvercel next.js · next
- CVE-2026-104901MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked ServerMISP
- CVE-2026-94543Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applicationsvercel next.js · next
- CVE-2026-104900MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview IndexMISP
- CVE-2026-94544Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesvercel next.js · next
- CVE-2026-94486Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpointvercel next.js · next
- CVE-2026-104638onetwothreeneth HospitalManagementSystem sessions.php improper authenticationonetwothreeneth HospitalManagementSystem
- CVE-2026-39717WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-39601WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerabilityWPdevelop Booking Calendar
- CVE-2026-39600WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerabilityMehul Gohil Aculect AI Companion
- CVE-2026-39444WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerabilityPublishPress Series
- CVE-2026-104637onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted uploadonetwothreeneth HospitalManagementSystem
- CVE-2026-39439WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerabilityKiera Howe WebSamurai
- CVE-2026-32585WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerabilityAirano MCP Bridge
- CVE-2026-32584WordPress Smart One Click Setup – Complete Demo Import & Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerabilityChiranjit Hazarika Smart One Click Setup – Complete Demo Im…
- CVE-2026-104625CodeAstro Simple Loan Management System index.php sql injectionCodeAstro Simple Loan Management System
- CVE-2026-5782Reflected XSS in MRV Technology's TurkHotspotMRV Technology Foreign Trade Ltd. TurkHotspot
- CVE-2026-104614CodeAstro Simple Pharmacy Management System delete.php sql injectionCodeAstro Simple Pharmacy Management System
- CVE-2026-104721Logback: Incomplete protection against CVE-2026-19880QOS.CH Sarl Logback-classic
- CVE-2026-104613CodeAstro Simple Pharmacy Management System view.php sql injectionCodeAstro Simple Pharmacy Management System
- CVE-2026-66054Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSizeApache Software Foundation Apache Thrift
- CVE-2026-104612SourceCodester Student Result Management System Announcement new_announcement.php cross site scriptingSourceCodester Student Result Management System
- CVE-2026-11795User Enumeration in Softtr's E-Commerce PackSofttr Informatics Trading Limited Company E-Commerce Pack
- CVE-2026-102797WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerabilityThemeREX Group ThemeREX Addons
- CVE-2026-102798WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerabilityThemeREX Group ThemeREX Addons
- CVE-2026-66331Apache Thrift: Buffered transport reads are not accounted against MaxMessageSizeApache Software Foundation Apache Thrift
- CVE-2026-85209IDOR in AVEZ Electronics's LMSAVEZ Electronics Communication Training and Consultancy Tra…
- CVE-2026-94652Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling backApache Software Foundation Apache Thrift
- CVE-2026-94638Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`Apache Software Foundation Apache Thrift
- CVE-2026-92834Apache Thrift: C++ WebSocket server transport does not read a full request lengthApache Software Foundation Apache Thrift
- CVE-2026-104609onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injectiononetwothreeneth HospitalManagementSystem
- CVE-2026-86536Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScriptApache Software Foundation Apache Thrift
- CVE-2026-104473YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpagesyeswiki · yeswiki/yeswiki
- CVE-2026-104470YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameteryeswiki
- CVE-2026-104468YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordActionyeswiki
- CVE-2026-104466YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attributeyeswiki
- CVE-2026-104465YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handleryeswiki
- CVE-2026-104461YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileFieldyeswiki
- CVE-2026-104459YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handleyeswiki
- CVE-2026-104455YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Actionyeswiki
- CVE-2026-104454YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpointyeswiki
- CVE-2026-104453YesWiki before 4.6.7 CSRF Tag Deletion via admintag Actionyeswiki
- CVE-2026-104452YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handleryeswiki
- CVE-2026-104451YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandleryeswiki
- CVE-2026-104446YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handleryeswiki
- CVE-2026-104442YesWiki before 4.6.7 Unauthenticated SSRF via syndication Actionyeswiki
- CVE-2026-104441YesWiki before 4.6.7 Unauthenticated SSRF via valeur Actionyeswiki
- CVE-2026-104440YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameteryeswiki
- CVE-2026-104436Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator LengthZcashFoundation zebra · ZcashFoundation zebra-chain +2
- CVE-2026-104432Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks ResponseZcashFoundation zebra
- CVE-2026-104429Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx MessagesZcashFoundation zebra
- CVE-2026-104428Zebra before 11.0.0 Denial of Service via getblock Verbosity 2ZcashFoundation zebra
- CVE-2026-104425Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed TransactionsZcashFoundation zebra
- CVE-2026-104424Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplateZcashFoundation zebra
- CVE-2026-104421Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes LockoutZcashFoundation zebra
- CVE-2026-104420Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped BlocksZcashFoundation zebra
- CVE-2026-104419Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks HashesZcashFoundation zebra
- CVE-2026-104417Ghost 1.20.0 before 6.64.0 Path Traversal via Locale SettingTryGhost Ghost · ghost
- CVE-2026-104415Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin APITryGhost Ghost · ghost
- CVE-2026-104412Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role AssignmentTryGhost Ghost · ghost
- CVE-2026-103763SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfosiyuan-note siyuan
- CVE-2026-103762SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpointssiyuan-note siyuan
- CVE-2026-85088Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not matchApache Software Foundation Apache Thrift
- CVE-2026-85087Apache Thrift: Python ≥3.12 host-name check silently becomes a no-opApache Software Foundation Apache Thrift
- CVE-2026-85086Apache Thrift: Perl TLS client disables certificate verification by defaultApache Software Foundation Apache Thrift
- CVE-2026-85483Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream endApache Software Foundation Apache Thrift
- CVE-2026-97876Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base addressGNU grub2
- CVE-2026-104606itsourcecode Online Admission System Project confirm.php sql injectionitsourcecode Online Admission System Project
- CVE-2026-59668Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59667Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59666Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59665Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59662Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59664Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59663Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-104403WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerabilityThimPress LearnPress
- CVE-2026-95662Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59661Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59660Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59659Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-94180WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerabilityMonetizemore Advanced Ads
- CVE-2026-94405WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerabilityShahjada Download Manager
- CVE-2026-97652WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Keyveronalabs WP Statistics – Simple, privacy-friendly Google…
- CVE-2026-85492All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathnamesmub All in One SEO – AI SEO Plugin to Boost SEO Rankings &…
- CVE-2026-59673Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59672Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-59671Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-95512Freetype: freetype: denial of service via repeated subroutine allocations in cid font loaderRed Hat Hardened Images · Red Hat build of OpenJDK 11 ELS +1
- CVE-2026-59670Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-80337Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot PlatformHAVELSAN Sef - AI Chatbot Platform
- CVE-2026-80464API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot PlatformHAVELSAN Sef - AI Chatbot Platform
- CVE-2026-59669Multiple vulnerabilities in the Repasat applicationRepasat application
- CVE-2026-91784Argument Injection leading to arbitrary process termination in gotopcjbassi gotop
- CVE-2026-94432Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' ParameterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-97338Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Namecodename065 Download Manager
- CVE-2026-97634Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameterstellarwp Event Tickets and Registration
- CVE-2026-96647Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameterwebilia Listdom: AI-powered Business Directory with Classif…
- CVE-2026-102002Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widgetthemeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2026-12951MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameterwcmp MultiVendorX – WooCommerce Multivendor Marketplace AI…
- CVE-2026-93880Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholderwpsoul Greenshift – animation and page builder blocks
- CVE-2026-17508Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry pointsLegion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1
- CVE-2026-97219MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' ParameterMStore API
- CVE-2026-92924Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_dataUnlimited Elements for Elementor
- CVE-2026-91020WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amountWebToffee Gift Cards for WooCommerce
- CVE-2026-90987Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied PriceEasy PayPal & Stripe Buy Now Button
- CVE-2026-90952WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST APIWP Edit Password Protected
- CVE-2026-85005Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing AuthorizationPopup Maker WP
- CVE-2026-84740The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterThe Events Calendar
- CVE-2026-79618WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated FormWP User Frontend
- CVE-2026-1661WP Mail Logging < 1.17.0 - Unauthenticated HTML InjectionWP Mail Logging
- CVE-2026-13413CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL MatchCMP – Coming Soon & Maintenance
- CVE-2026-97318Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' ParameterGiveaways and Contests by RafflePress
- CVE-2026-97317Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway PageGiveaways and Contests by RafflePress
- CVE-2026-94298BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content ParameterBuildKit
- CVE-2026-91023Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featuredMotors
- CVE-2026-91022Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge ColorMotors
- CVE-2026-85016Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library ParameterUnlimited Elements for Elementor
- CVE-2026-13718Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab ContentTabs Responsive
- CVE-2026-90988Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenumRequest a Quote
- CVE-2026-85004Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connectPopup Maker
- CVE-2026-81740Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment CallbackPaytm Payment Gateway
- CVE-2026-78471Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Nameoptimizingmatters Autoptimize
- CVE-2026-84925Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' ParameterThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2026-104123SourceCodester Online Reviewer Management System btn_functions.php activity sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-104120modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgerymodelcontextprotocol mcp-server-fetch · modelcontextprotoco…
- CVE-2026-104054calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorizationcalcom cal.diy
- CVE-2026-104053itsourcecode Pet Shop Management System admin_reservefilter.php sql injectionitsourcecode Pet Shop Management System
- CVE-2026-21140Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.Samsung Mobile Devices
- CVE-2026-104052itsourcecode Pet Shop Management System admin_reject_completed.php sql injectionitsourcecode Pet Shop Management System
- CVE-2026-51899In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule