CVEs published October 16, 2026
474 CVEs were published on October 16, 2026: 52 critical, 175 high.
- Published
- 474
- Critical
- 52
- High
- 175
- Medium
- 217
- Low
- 14
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 174
Most affected products
- Mattermost
- 15
- Apache Software Foundation Apache Kylin
- 12
- zstd-safe
- 12
- FreeRDP
- 10
- Red Hat Enterprise Linux
- 8
- Text-CSV_XS
- 8
- Wheels
- 8
- IBM i
- 7
- MariaDB server · mariadb +2
- 7
- J4Care dcm4chee-arc-light
- 6
Critical 52
- CVE-2026-111823Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.mage-ai
- CVE-2026-110759Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseText-CSV_XS
- CVE-2026-110757Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combineText-CSV_XS
- CVE-2026-110756Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in printText-CSV_XS
- CVE-2026-110753Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getlineText-CSV_XS
- CVE-2026-96620Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Executionanthropics claude-agent-sdk-python · claude-agent-sdk
- CVE-2026-108709Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)Apache Software Foundation Apache Kylin
- CVE-2026-102608ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)zoneminder
- CVE-2026-68573Apache Kylin: Unauthenticated Metastore CleanupApache Software Foundation Apache Kylin
- CVE-2026-111711Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()Netcore NR256CN
- CVE-2026-111708WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signupcanove whaticket-community
- CVE-2026-111704LangChat through commit 2a6285a Missing Authentication on REST API Controllerslangchat
- CVE-2026-111693DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentialsdatabufflabs databuff
- CVE-2026-111692DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secretdatabufflabs databuff
- CVE-2026-111691WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Headerwimoor-erp wimoor
- CVE-2026-111690Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypasssuyuan32 simple-admin-core
- CVE-2026-111687WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpointrachelos we-mp-rss
- CVE-2026-111675Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeoverxiaochong0302 course-tencent-cloud
- CVE-2026-111673IceCMS through 4.1.5 Missing Authentication via /User Administrative EndpointsThecosy IceCMS
- CVE-2026-111663Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutationchaskiq
- CVE-2026-111643Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollbackl429609201 misaka_danmu_server
- CVE-2026-111641FastapiAdmin through 3.0 Authentication Bypass via Auto-Login EndpointsFastapiAdmin
- CVE-2026-111636OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session SecretOpenBMB StaffDeck
- CVE-2026-111626Webreaper Damselfly through 4.5.3 Missing Authentication on REST API ControllersWebreaper Damselfly
- CVE-2026-49868RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap readRIOT-OS RIOT
- CVE-2026-102693RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSIDRIOT-OS RIOT
- CVE-2026-102692RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory accessRIOT-OS RIOT
- CVE-2026-85748MariaDB: Use-after-free with a large number of SYS_REFCURSOR'sMariaDB server · mariadb +2
- CVE-2026-85746MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollectionsMariaDB server · mariadb +2
- CVE-2026-92262MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.MariaDB server · mariadb +2
- CVE-2026-57169Dockhand: Unauthenticated container exec via WebSocket upgradeFinsys dockhand
- CVE-2026-44977countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session contextcountly-server
- CVE-2026-105279J4Care dcm4che Missing Authentication for Critical FunctionJ4Care dcm4chee-arc-light
- CVE-2026-97851J4Care dcm4che Missing AuthorizationJ4Care dcm4chee-arc-light
- CVE-2026-107617Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded CredentialsGuangzhou Juan IoT Technology Co. EseeCloud App · Guangzhou…
- CVE-2026-18516Improper Encoding or Escaping of Output in Crafty ControllerArcadia Technology Crafty Controller
- CVE-2026-64959Apache Kylin: Missing authentication on certain cache API endpointsApache Software Foundation Apache Kylin
- CVE-2026-64610Apache Kylin: Redis unsafe Java deserializationApache Software Foundation Apache Kylin
- CVE-2026-63619Apache Kylin: Missing authorization and path-confinement on system meta dumpApache Software Foundation Apache Kylin
- CVE-2026-111391SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filtersgl-project sglang
- CVE-2026-111472SQL injection in TSG ProfleetTSG Profleet
- CVE-2026-94169WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerabilityTheme-one The Grid
- CVE-2026-94388WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerabilityhalfdata Green Popups
- CVE-2026-104730Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parametersunshinephotocart Sunshine Photo Cart – Client Photo Galler…
- CVE-2026-103768ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachmentelextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2026-89079Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filterjfarthing84 Theme My Login
- CVE-2026-104798My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attributejoedolson My Calendar – Accessible Event Manager
- CVE-2026-109515MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameterproperfraction MailOptin – Popup, Optin Forms & Email Newsl…
- CVE-2026-109219Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameterkitae-park Mang Board
- CVE-2026-111444Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an applicationWheels
- CVE-2026-26846Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the Ut
- CVE-2026-95182An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening craf
High 175
- CVE-2026-110758Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespaceText-CSV_XS
- CVE-2026-110755Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getlineText-CSV_XS
- CVE-2026-110752Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragmentText-CSV_XS
- CVE-2026-111044Disabled Sunshine clients can bypass revocation with a derived client certificateLizardByte Sunshine
- CVE-2026-62439Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerabilityRed Hat Enterprise Linux
- CVE-2026-108372LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown fileshuangruiteng loopx · loopx
- CVE-2026-49410OpenHuman /auth/telegram CSRF allows attacker-controlled session implantationtinyhumansai openhuman
- CVE-2026-96627Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1
- CVE-2026-68498jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of serviceFasterXML jackson-core
- CVE-2026-96626Arcane: Container-registry credential exfiltration via URL repoint + test to attacker hostgetarcaneapp arcane
- CVE-2026-108374ERPNext: Unauthorised status modification due to missing validationfrappe erpnext
- CVE-2026-102834JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSbytedeco javacv · org.bytedeco:javacv
- CVE-2026-108743Apache Kylin: spark job OS command injectionApache Software Foundation Apache Kylin
- CVE-2026-30971ZoneMinder: Authenticated RCE via command injection in monitor Device Pathzoneminder
- CVE-2026-69080Apache Kylin: Broken Access Control in QuerySQLBlacklistControllerApache Software Foundation Apache Kylin
- CVE-2026-69077Apache Kylin: JobController allows unauthorized cross-project manipulationApache Software Foundation Apache Kylin
- CVE-2026-69076Apache Kylin: Unauthorized cross-project job discardApache Software Foundation Apache Kylin
- CVE-2026-68572Apache Kylin: Unauthorized SQL execution to Spark SQL envApache Software Foundation Apache Kylin
- CVE-2026-102607ZoneMinder: Authenticated OS Command Injection (RCE) via Export Featurezoneminder
- CVE-2026-59970Tandoor Recipes: Blind SSRF via AI provider URL (api_base)TandoorRecipes recipes
- CVE-2026-61726Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe contentTandoorRecipes recipes
- CVE-2026-59963Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpointsTandoorRecipes recipes
- CVE-2026-102917IBM i is Affected By An Improper Privilege Management VulnerabilityIBM i
- CVE-2026-111723LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins APILingGuoAI LingGuo-Drama
- CVE-2026-111722LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id APILingGuoAI LingGuo-Drama
- CVE-2026-111719Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/queryroncoo-pay
- CVE-2026-111718AipexBase through commit 690adb9 SQL Injection via /api/data/invokekuafuai aipexbase
- CVE-2026-111710Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoSNetcore NR256CN
- CVE-2026-11170699AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcelvastxie 99AI
- CVE-2026-111702ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Basessugarforever chat-ollama
- CVE-2026-81452Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.Dell Alienware Command Center
- CVE-2026-111701OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object APIOtterMind Nubase
- CVE-2026-111700WebVella ERP through 1.8.8 SQL Injection via EQL Query APIWebVella-ERP
- CVE-2026-111698HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRechargeroinli HUIZHI-ChargeOS-cloud
- CVE-2026-111697HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIsroinli HUIZHI-ChargeOS-cloud
- CVE-2026-111696data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwordsshaiwz data-platform-open
- CVE-2026-111695Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource APIshaiwz data-platform-open
- CVE-2026-111686IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynumThecosy IceCMS
- CVE-2026-111685IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynumThecosy IceCMS
- CVE-2026-111684Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Serviceabsmach magistrala
- CVE-2026-111682EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keyssmartloli EFAK
- CVE-2026-111681EFAK through 5.1.0 Privilege Escalation via /api/users REST APIsmartloli EFAK
- CVE-2026-111680APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query ParameterAPIParkLab APIPark
- CVE-2026-111671Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpointsdata-infra cube-studio
- CVE-2026-111669ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BYizhaorui Zr.Admin.NET
- CVE-2026-111651Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadControllerrisesoft-y9 Digital-Infrastructure
- CVE-2026-111650ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard APIHoshinoSuzumi chronoframe
- CVE-2026-111649Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpointrocboss paopao-ce
- CVE-2026-111646SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/previewjavahuang SurveyKing
- CVE-2026-111642FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege EscalationFastapiAdmin
- CVE-2026-111639bbs-go through 4.4.6 Account Takeover via Google One Tap Loginmlogclub bbs-go
- CVE-2026-111638sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keysmoul sshportal
- CVE-2026-111634Helical Insight through 7.0.0 SQL Injection via /executeDatasourcehelicalinsight
- CVE-2026-111633ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing KeySeriaWei ZKEACMS
- CVE-2026-111627HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creationhestiacp
- CVE-2026-111622smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUria466350665 smart-sso
- CVE-2026-111619FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.phpzyx0814 FilePress
- CVE-2026-111615Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpointgz-yami mall4cloud
- CVE-2026-111614DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentialsdevlive-community DataCap
- CVE-2026-111613AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/testalldatacenter alldata
- CVE-2026-111612netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuthqaiu netdisk-fast-download
- CVE-2026-111607Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigsjeequan jeepay
- CVE-2026-111606Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPChcengineering Huly Platform
- CVE-2026-111605Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileControllerdromara Jpom
- CVE-2026-102551Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handlingFreeRTOS-Plus-TCP
- CVE-2026-109588Numeric truncation in the MPU buffer authorization check in FreeRTOS-KernelFreeRTOS-Kernel
- CVE-2026-109587Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-KernelFreeRTOS-Kernel
- CVE-2026-86047MariaDB: Insufficient quoting in mariadb-dump and SHOW commandsMariaDB server · mariadb +2
- CVE-2026-97380MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privilegesMariaDB server · mariadb +2
- CVE-2026-86009Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not controlMailu
- CVE-2026-86008Mailu domain managers can take over higher-privileged accountsMailu
- CVE-2026-77474dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-openDicklesworthstone destructive_command_guard
- CVE-2026-41582countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Filescountly-server
- CVE-2026-42270countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exceptioncountly-server
- CVE-2026-42269countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletioncountly-server
- CVE-2026-92263SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restoreCodeWithCJ SparkyFitness
- CVE-2026-68906libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDUmz-automation libiec61850
- CVE-2026-68907libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer argumentsmz-automation libiec61850
- CVE-2026-48741libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoSmz-automation libiec61850
- CVE-2026-48503libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileReadmz-automation libiec61850
- CVE-2026-102941gomarkdown/markdown IsSafeURL panics on short URLsgomarkdown markdown · github.com/gomarkdown/markdown
- CVE-2026-77630pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsingpupnp
- CVE-2026-96424Incorrect Permission Assignment for Critical Resource in lomiri-download-managerUBports lomiri-download-manager
- CVE-2026-57488pupnp: Integer truncation in HTTP Content-Length parsing enables request smugglingpupnp
- CVE-2026-57487libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully bufferedpupnp
- CVE-2026-57486pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributespupnp
- CVE-2026-55543TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` filehelge17 tuxguitar
- CVE-2026-95859libp2p-rust: Gossipsub GRAFT topics unbounded growthrust-libp2p
- CVE-2026-105667J4Care dcm4che Missing Authentication for Critical FunctionJ4Care dcm4chee-arc-light
- CVE-2026-101021J4Care dcm4che Inefficient Algorithmic ComplexityJ4Care dcm4chee-arc-light
- CVE-2026-105273J4Care dcm4che Loop with Unreachable Exit ConditionJ4Care dcm4chee-arc-light
- CVE-2026-107621J4Care dcm4che Loop with Unreachable Exit ConditionJ4Care dcm4chee-arc-light
- CVE-2026-111413WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityaThemeArt Theme Helper
- CVE-2026-107564gocsaf/csaf: csaf_provider prone to uncontrolled resource consumptiongocsaf Development Community csaf_provider
- CVE-2026-111396WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerabilityLiquid Web / StellarWP Advanced Post Manager
- CVE-2026-111399WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-105958Spice-server: spice: heap oob read/write via unchecked migration data offsetsRed Hat Enterprise Linux
- CVE-2026-68571Apache Kylin: JDBC URL Whitelist Verification BypassApache Software Foundation Apache Kylin
- CVE-2026-63618Apache Kylin: Low-Privilege Config ExposureApache Software Foundation Apache Kylin
- CVE-2026-105959Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncationRed Hat Enterprise Linux
- CVE-2026-107648WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameterswitcorp WP Sessions Time Monitoring Full Automatic
- CVE-2026-109119Missing Authorization in rdiffwebikus-soft rdiffweb
- CVE-2026-14452Open redirect and XSS via reset_url parameterCheckmk
- CVE-2026-96768GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Bodysoftaculous GoSMTP Pro
- CVE-2026-101300Server-Side Request Forgery in Wegow PDF exportWegow Technologies Wegow
- CVE-2026-92766Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameterappsbd Vitepos – Point of Sale (POS) for WooCommerce
- CVE-2026-109224SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in CommentSureCart – Ecommerce Made Easy For Selling Physical Product…
- CVE-2026-111311DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpointsamuelgallegos DoubleScale CRM | All-in-One CRM – Sales, Mu…
- CVE-2026-14177User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce InfrastructureIKAS Technology ikas E-Commerce Infrastructure
- CVE-2026-75903Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentialsmanuelgalan Vulnity Security
- CVE-2026-87111User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer HeaderWPEverest User Registration PRO – Custom Registration Form,…
- CVE-2026-16453Mattermost SAML RelayState forgery allows unauthorized team membershipMattermost
- CVE-2026-97296WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerabilityRocketgenius Gravity Forms
- CVE-2026-96339WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerabilityHouzez.co Houzez
- CVE-2026-104715Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypassRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-92115WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Actionopajaap WP Photo Album Plus
- CVE-2026-97640WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)smub WPConsent – Cookie Banner & Cookie Consent for Privacy…
- CVE-2026-109193HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute ValueHivePress – Business Directory, Listings & Classified Ads P…
- CVE-2026-107768TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markerscozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-92553YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extensionyaycommerce YaySMTP – WP Mail SMTP with Email Logs, Trackin…
- CVE-2026-110701CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parametercodepeople CP Multi View Events Calendar
- CVE-2026-110135OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceOTP Login & Register Woocommerce
- CVE-2026-110015Salon Booking System < 10.31.9 - Administrator Account Creation via CSRFSalon Booking System
- CVE-2026-100186User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Fieldcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-85659PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameterontraport PilotPress
- CVE-2026-104932Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruptionjohnny5 Search Regex
- CVE-2026-109513NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Routewpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2026-107764SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sinkgpriday SiteOrigin CSS
- CVE-2026-111122SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspectorgpriday SiteOrigin CSS
- CVE-2026-89051Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Contentjohndarrel Hide My WP Ghost – Security & Firewall
- CVE-2026-109447User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]cozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-10389610Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path10Web Booster – Website speed optimization, Cache & Page Sp…
- CVE-2026-109232Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAXwordpresschef Salon Booking System – Appointment Booking fo…
- CVE-2026-95809Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameteroptiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B…
- CVE-2026-95686Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameteroptiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B…
- CVE-2026-104000Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}croixhaug Simply Schedule Appointments
- CVE-2026-103999Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Uploadthemefic Ultra Addons for Contact Form
- CVE-2026-96570Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parametermagazine3 Schema & Structured Data for WP & AMP
- CVE-2026-109221Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mappingtrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-107659Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPTwpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-110590Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpointklarnaplugin Klarna for WooCommerce
- CVE-2026-107746FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameterteamfunnelkit FunnelKit – Funnel Builder Plugin for WooComm…
- CVE-2026-111114Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameterposimyththemes Nexter Extension – Security, Performance, Co…
- CVE-2026-109998Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAXkitae-park Mang Board
- CVE-2026-109400InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability SettingInstaWP Connect – 1-click WP Staging & Migration
- CVE-2026-103525FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameterswpmanageninja FluentCart A New Era of eCommerce – Faster, L…
- CVE-2026-103895miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace Statecyberlord92 miniOrange OTP Login, Verification and SMS Noti…
- CVE-2026-111451Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Wheels CLI
- CVE-2026-111447Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being savWheels
- CVE-2026-107758Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Commentsextendthemes Colibri Page Builder
- CVE-2026-109207RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URLthemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2026-104745Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameterwpcodefactory Customer Email Verification for WooCommerce
- CVE-2026-97339Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker FilterComplianz GDPR/CCPA Cookie Consent Banner
- CVE-2026-93953Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalationsoftaculous Backuply – Backup, Restore, Migrate and Clone
- CVE-2026-109990Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Contentgijo Flying Scripts: Delay JavaScript to Improve Site Speed…
- CVE-2026-111446Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it Wheels
- CVE-2026-111445Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).Wheels
- CVE-2026-109813Shared Hard-coded Root CA Private KeyMoxa AIG-302 Series
- CVE-2026-105228ISPSoft Out-of-Bounds Read VulnerabilityDeltaww ISPSoft
- CVE-2026-105227ISPSoft Out-of-Bounds Read VulnerabilityDeltaww ISPSoft
- CVE-2026-111389Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validationfrappe hrms
- CVE-2026-111387Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpointnezhahq nezha
- CVE-2026-111384Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocketnezhahq nezha
- CVE-2026-111383Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocketnezhahq nezha
- CVE-2026-111382FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 CombineFreeRDP
- CVE-2026-111381FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 ParserFreeRDP
- CVE-2026-111380FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple BackendsFreeRDP
- CVE-2026-111379FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3FreeRDP
- CVE-2026-111378FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame ParserFreeRDP
- CVE-2026-111377FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel ReassemblyFreeRDP
- CVE-2025-66969Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
- CVE-2026-106705ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.
- CVE-2026-46472An issue was discovered in GStreamer gst-plugins-good before 1.28.2.
- CVE-2026-88755Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf
- CVE-2026-95183An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack v
Medium, low and unrated 247
- CVE-2026-89096Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statdRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-89088Parted: parted: denial of service via heap buffer overflow during fat16 resizeRed Hat Enterprise Linux
- CVE-2026-89085Parted: parted: heap-based buffer overflow via crafted fat32 filesystem imageRed Hat Enterprise Linux
- CVE-2026-110754Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getlineText-CSV_XS
- CVE-2026-111802Nautilus: nautilus: arbitrary file deletion via trash symlinkRed Hat Enterprise Linux
- CVE-2026-17591Libarchive: libarchive: use-after-free via aliased mac metadata copyRed Hat Hardened Images · Red Hat Enterprise Linux
- CVE-2026-62438Gimp: gimp: paa integer overflow out-of-bounds readRed Hat Enterprise Linux
- CVE-2026-96628Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`getarcaneapp arcane · github.com/getarcaneapp/arcane/bac… +1
- CVE-2026-96542EA Javelin Anticheat Installer Local Privilege EscalationElectronic Arts EA Javelin Anticheat
- CVE-2026-64862Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMSfrappe hrms
- CVE-2026-55796Frappe HR: SQL Injection in HRMS Salary Payments via ECS Reportfrappe hrms
- CVE-2026-108373ERPNext: Unauthorised access to financial data due to missing validationfrappe erpnext
- CVE-2026-59966Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex PatternsTandoorRecipes recipes
- CVE-2026-17068IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File SystemIBM i
- CVE-2026-17073IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File SystemIBM i
- CVE-2026-17275IBM i is Affected by an Improper Validation VulnerabilityIBM i
- CVE-2026-17488IBM i is Affected By An Improper Authentication Vulnerability in SST / DSTIBM i
- CVE-2026-17491IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSHIBM i
- CVE-2026-111793Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.Openwave Messaging (Ireland) Limited Webtop Media Transcoder
- CVE-2026-85977Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decodingRed Hat Hardened Images · Red Hat Enterprise Linux +1
- CVE-2026-85231Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decodingRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-107674IBM i is Affected by a Denial of Service in Digital Certificate ManagerIBM i
- CVE-2026-109838IBM Db2 Genius Hub Improper verification of cryptographic signatureIBM Db2 Genius Hub
- CVE-2026-89098Nfs-utils: nfs-utils: denial of service via assertion failure in fsiddRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-111721Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scopingjingsewu open-wes
- CVE-2026-111720fish-island-backend through commit 7c61b78 SSRF via /api/web/parselhccong fish-island-backend
- CVE-2026-111717Arkon through 0.9.2 Missing Authorization via Skills Versions APInduckmink arkon
- CVE-2026-111716Arkon through 0.9.2 Broken Access Control via Sources By-ID Routesnduckmink arkon
- CVE-2026-111715Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood APInduckmink arkon
- CVE-2026-111714tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purgeAmauriC tarteaucitron.js
- CVE-2026-111713tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation MismatchAmauriC tarteaucitron.js
- CVE-2026-111712Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path PrefixNetcore NR256CN
- CVE-2026-111709WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketIdcanove whaticket-community
- CVE-2026-11170799AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosurevastxie 99AI
- CVE-2026-111705Fuint through commit 57ec018 IDOR via bookId in myBookDetailfushengqian fuint
- CVE-2026-111703yshop-crm through 2.1.3 IDOR via CRM customer by-id endpointsguchengwuyue yshop-crm
- CVE-2026-111699Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookieniefy wx-api
- CVE-2026-111694qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpointsqiantongtech qKnow
- CVE-2026-111689XBoot through 3.3.4 Authorization Bypass via getByDepartmentId EndpointExrick xboot
- CVE-2026-111688Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter ParameterExrick xboot
- CVE-2026-111683Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack APIallegro ralph
- CVE-2026-111679Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ipsEKKOLearnAI ekko-studio
- CVE-2026-111678Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP ParsingAdri van Os antiword
- CVE-2026-111677Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.cAdri van Os antiword
- CVE-2026-111676Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpointfaveosuite faveo-helpdesk
- CVE-2026-111674Tbed through 20240319 Missing Authorization via setImgFileName EndpointHello-hao Tbed
- CVE-2026-111672Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpointsdata-infra cube-studio
- CVE-2026-111670ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Moduleclickvisual
- CVE-2026-111668AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics APIbeizhu-1209 AIHelms
- CVE-2026-111667REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpointgetrebuild rebuild
- CVE-2026-111666Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports APIsteedos-platform
- CVE-2026-111665Piranha CMS through 12.2 Missing Authorization in Manager Language APIPiranhaCMS Piranha CMS
- CVE-2026-111664Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-urlsafing portmaster
- CVE-2026-111662Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpointchaskiq
- CVE-2026-111661waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpointwayn111 waynboot-mall
- CVE-2026-111660waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaidwayn111 waynboot-mall
- CVE-2026-111659Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submitwayn111 waynboot-mall
- CVE-2026-111658SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels APISiteServer SSCMS
- CVE-2026-111657BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpointbeikeshop
- CVE-2026-111656ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management EndpointszhimaAi chatwiki
- CVE-2026-111655ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.editzoujingli think-plugs-admin
- CVE-2026-111654FastBee through 2.1.0 IDOR via /iot/group By-ID Endpointskerwincui FastBee
- CVE-2026-11165353AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id53AIHub
- CVE-2026-111652Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment3xxx engineercms
- CVE-2026-111648BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameterbuild-admin buildadmin
- CVE-2026-111647PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}PickMall lilishop
- CVE-2026-111645MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpointzmister2016 MrDoc
- CVE-2026-111644Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routesl429609201 misaka_danmu_server
- CVE-2026-111640DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogskuaifan dootask
- CVE-2026-111637NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields EndpointBlair2004 NexoPOS
- CVE-2026-111635Helical Insight through 7.0.0 Path Traversal via /getExternalResourcehelicalinsight
- CVE-2026-111632Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_idaureuserp
- CVE-2026-111631Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions10up Distributor
- CVE-2026-111630abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversationscolinin abp-next-admin
- CVE-2026-111629IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIsIoTSharp
- CVE-2026-11162810up Distributor before 2.3.2 PHP Object Injection via set_meta()10up Distributor
- CVE-2026-11162510up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action10up Distributor
- CVE-2026-111624Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR HubsUmbraco-CMS
- CVE-2026-111623Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuancejoey-zhou xiaozhi-esp32-server-java
- CVE-2026-111621TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}TDuckCloud tduck-survey-form
- CVE-2026-111620O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download EndpointO2OA
- CVE-2026-111618CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpointscoaidev CoAI
- CVE-2026-111617WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket EndpointsMGdaasLab WHartTest
- CVE-2026-111616Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting APIOqtane Framework
- CVE-2026-111611roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpointsroncoo-education
- CVE-2026-111610B3log Solo through 4.4.0 Missing Authorization in ArticleConsoleb3log Solo
- CVE-2026-111609PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscriptionPKP Open Journal Systems
- CVE-2026-111608Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}jeequan jeepay
- CVE-2026-111604eladmin through 2.7 Broken Access Control via /api/users Update and Deleteelunez eladmin
- CVE-2026-111603PlayEdu through 2.3 Missing Authorization via Student CourseController EndpointsPlayEdu
- CVE-2026-111392SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generatesgl-project sglang
- CVE-2026-109839IBM Db2 Genius Hub Missing Cryptographic StepIBM Db2 Genius Hub
- CVE-2026-102552Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolverFreeRTOS-Plus-TCP
- CVE-2026-80092Microsoft Identity Web Elevation of Privilege Vulnerabilitymicrosoft-identity-web
- CVE-2026-109461Microsoft Authentication Library (MSAL) for Node.js Information Disclosure VulnerabilityMicrosoft Identity Client for NodeJS · @azure/msal-node
- CVE-2026-59962Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor RecipesTandoorRecipes recipes
- CVE-2026-59967Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImportTandoorRecipes recipes
- CVE-2026-62362PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpointPBH-BTN PeerBanHelper
- CVE-2026-85745MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.MariaDB server · mariadb +2
- CVE-2026-85985MariaDB: Unauthorized file access via CONNECT engine UDFsMariaDB server · mariadb +2
- CVE-2026-102923SparkyFitness: SSRF via unvalidated custom_url in AI service settingsCodeWithCJ SparkyFitness
- CVE-2026-68908libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send pathmz-automation libiec61850
- CVE-2026-57446libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handlemz-automation libiec61850
- CVE-2026-111581Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus methodRed Hat Enterprise Linux
- CVE-2026-96425Incorrect Permission Assignment for Critical Resource in lomiri-download-managerUBports lomiri-download-manager
- CVE-2026-55862pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflowpupnp
- CVE-2026-57447Discourse Doc Categories: Doc category index refresh leaks private topic titlesdiscourse-doc-categories
- CVE-2026-55836Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)open-zaak
- CVE-2026-54657Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to tokenopen-zaak
- CVE-2026-111728Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings5rahim Seanime
- CVE-2026-107777Thermo Fisher Torrent Suite Software Path TraversalThermo Fisher Torrent Suite Software
- CVE-2026-105664Guangzhou Juan IoT Technology EseeCloud Observable Response DiscrepancyGuangzhou Juan IoT Technology Co. EseeCloud App · Guangzhou…
- CVE-2026-97858Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object AttributesGuangzhou Juan IoT Technology Co. EseeCloud App · Guangzhou…
- CVE-2026-110805Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged uDevolutions Server
- CVE-2026-110804Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authentiDevolutions Server
- CVE-2026-110806Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permisDevolutions Server
- CVE-2026-110287Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general EdiDevolutions Server
- CVE-2026-90821Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerArcadia Technology Crafty Controller
- CVE-2026-97470Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Rolethemefic Tourfic – AI Powered Travel Booking, Hotel Booking…
- CVE-2026-110896WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerabilityWP Chill Passster
- CVE-2026-111400WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack Addons for Elementor
- CVE-2026-111409WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerabilityYITH PayPal Express Checkout for WooCommerce
- CVE-2026-110903WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-110900WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerabilityLiquid Web / StellarWP BookIt
- CVE-2026-110901WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerabilityWPMU DEV SmartCrawl
- CVE-2026-110380WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerabilityArraytics WP Event Solution
- CVE-2026-111405WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-111397WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-111555Luksmeta: missing slot-range validation permits out-of-gap device i/oRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- RUSTSEC-2026-0391Data from an abandoned stream leaks into the next stream on a reused contextzstd
- RUSTSEC-2026-0392Uninitialized memory exposed by `write::Decoder` on a corrupt legacy framezstd
- RUSTSEC-2026-0393Out-of-bounds read when training a dictionary from inconsistent sample sizeszstd
- RUSTSEC-2026-0395Use-after-free with `CParameter::StableInBuffer`zstd-safe
- RUSTSEC-2026-0396`Seekable` reads a NULL or out-of-bounds seek tablezstd-safe
- RUSTSEC-2026-0397`OutBuffer::around_pos` exposes uninitialized memoryzstd-safe
- RUSTSEC-2026-0398`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the endzstd-safe
- RUSTSEC-2026-0399Use-after-free through `init_using_cdict` and `init_using_ddict`zstd-safe
- RUSTSEC-2026-0400Use-after-free of a dictionary after a one-shot call on a context with an open streamzstd-safe
- RUSTSEC-2026-0401Out-of-bounds read in `train_from_buffer` when sample sizes overflowzstd-safe
- RUSTSEC-2026-0402Heap buffer overflow in `CCtx::try_clone` on a multithreaded contextzstd-safe
- RUSTSEC-2026-0403Uninitialized memory exposed when streaming decompression of a legacy frame failszstd-safe
- RUSTSEC-2026-0404Double free in `DCtx::try_clone`zstd-safe
- RUSTSEC-2026-0405Out-of-bounds read with an out-of-range `InBuffer::pos`zstd-safe
- RUSTSEC-2026-0406Use-after-free when changing a multithreaded context with an unfinished framezstd-safe
- RUSTSEC-2026-0410WebAssembly allocator shim corrupts memory on allocation failurezstd-sys
- CVE-2026-111390Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table APIerupts erupt
- CVE-2026-110029Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachmentSqueeze
- CVE-2026-109930MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API KeyMAIO
- CVE-2026-109118Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffwebikus-soft rdiffweb
- CVE-2026-106030Missing Authorization in NordVPN for WindowsNord Security NordVPN
- CVE-2026-107649Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameterliedekef Events Made Easy
- CVE-2026-110703GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attributepaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-15575Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's CostifierSFM Software Technologies Costifier
- CVE-2026-15219IDOR in SFM Software's CostifierSFM Software Technologies Costifier
- CVE-2026-104003Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tabproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-104726Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attributejeroenpeters1986 Name Directory
- CVE-2026-93681Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-96870SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameterbrainstormforce SureDash – Community, Courses & Member Dash…
- CVE-2026-100108Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Settingmaxfoundry Social Share Buttons
- CVE-2026-100106FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameterdamian-gora FiboSearch – Ajax Search for WooCommerce
- CVE-2026-18799Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing usersMattermost
- CVE-2026-16251Mattermost local image proxy allows server memory exhaustion via unbounded image response bufferingMattermost
- CVE-2026-18256Private team metadata disclosure via the team search APIMattermost
- CVE-2026-18223Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel accessMattermost
- CVE-2026-19076Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer tokenMattermost
- CVE-2026-18560Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statusMattermost
- CVE-2026-19600Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attemptsMattermost
- CVE-2026-19621Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread readsMattermost
- CVE-2026-19603Private channel ID disclosure via user status endpointsMattermost
- CVE-2026-18795Missing server side validation allowed user to quarantine a DM and GM postMattermost
- CVE-2026-19867Uncapped mention keys in user notification properties allow CPU exhaustion during post processingMattermost
- CVE-2026-19601Disclosure of AD/LDAP bind password via Test ConnectionMattermost
- CVE-2026-18551Mattermost guest account privilege escalation via member roles APIMattermost
- CVE-2026-19541Outgoing OAuth connection client secret exposure during connection validationMattermost
- CVE-2026-110366WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerabilityGemini Labs Site Reviews
- CVE-2026-15222User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_namewpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-109401WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Emailsmub WP Mail Logging
- CVE-2026-110252WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Importetruel WPeMatico RSS Feed Fetcher
- CVE-2026-19798WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpointstusharimran WP Map Block – Google Maps, OpenStreetMap, Mapb…
- CVE-2026-109382WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Toolbilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connec…
- CVE-2026-104755WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpointaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2026-109388HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form ShortcodeHivePress – Business Directory, Listings & Classified Ads P…
- CVE-2026-110290WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attributeajay WebberZone Top 10 — Popular Posts
- CVE-2026-111069GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Fieldpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-107770Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' actiontigroumeow Photo Engine
- CVE-2026-110664Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notescodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2026-111178WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parametermurgroland WP Booking System – Booking Calendar
- CVE-2026-107646HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Scriptrealmag777 HUSKY – Products Filter for WooCommerce Professi…
- CVE-2026-110191Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsProduct Delivery Date for WooCommerce
- CVE-2026-110179affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameteraffiliate-toolkit
- CVE-2026-110039Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisiteSmush
- CVE-2026-110014Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusSalon Booking System
- CVE-2026-110013Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenSalon Booking System
- CVE-2026-110012Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcomingSalon Booking System
- CVE-2026-109982MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI MigrationMB Custom Post Types & Custom Taxonomies
- CVE-2026-105974Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetVisual Form Builder
- CVE-2026-105973Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationVisual Form Builder
- CVE-2026-103696Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' ParameterMobile builder
- CVE-2026-74923Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_iconsDocument Gallery
- CVE-2026-92427Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret DisclosureCoinsnap Bitcoin Crowdfunding
- CVE-2026-91830Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment CookieSubscribe to Comments
- CVE-2026-91833WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' ParameterWX Subscribe 微信支付付费订阅
- CVE-2026-88963Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-109414Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operatorappsbd Vitepos – Point of Sale (POS) for WooCommerce
- CVE-2026-104001Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Metarilwis Slim SEO – AI SEO Plugin, Lightweight, Fast & Automa…
- CVE-2026-12272Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constantdaext Lightweight Cookie Notice – Cookie Banner for Cookie…
- CVE-2026-93767Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' ParameterTainacan
- CVE-2026-103480Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attributethemefic Tourfic – AI Powered Travel Booking, Hotel Booking…
- CVE-2026-107748User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parametercozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2026-110017Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attributefullworks Quick PayPal Payments: Payment Button & Form
- CVE-2026-100158SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Fieldelvinhaci SQL Chart Builder
- CVE-2026-111458ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formattingadulau ssldump
- CVE-2026-103481Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parametermpol Gwolle Guestbook
- CVE-2026-110019Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flowniklaslindemann Bulk Page Generator – LPagery
- CVE-2026-103911Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_blockwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-109191Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTMLextendthemes Image Hub – Free Images from Unsplash, Pixabay…
- CVE-2026-110721NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Routewpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2026-111106Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parametergetwpfunnels Mail Mint – Email Marketing, Automation & WooC…
- CVE-2026-109512Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameterkitae-park Mang Board
- CVE-2026-101335Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tagswpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-96562Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callbackwpmudev Broken Link Checker
- CVE-2026-111450Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Wheels
- CVE-2026-111449Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Wheels
- CVE-2026-111448Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.Wheels
- CVE-2026-89280Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…
- CVE-2026-104769Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>asadkn Debloat – Remove Unused CSS, Optimize JS
- CVE-2026-103518FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keyswpmanageninja FluentCart A New Era of eCommerce – Faster, L…
- CVE-2026-77829Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Contentgoratech Cooked – Recipe Management
- CVE-2026-93535WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attributewppool Dark Mode – Improve Accessibility with AI Powered Da…
- CVE-2026-111443Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in productionWheels
- CVE-2026-111442Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potenBackdropCMS Backdrop
- CVE-2026-109812Missing Authorization on Secret EndpointsMoxa AIG-302 Series
- CVE-2026-100159Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headersays-pro Popup Box – Create Countdown, Coupon, Video, Contac…
- CVE-2026-111388Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authenticationfrappe
- CVE-2026-111386Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfignezhahq nezha
- CVE-2026-111385Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Toolsnezhahq nezha
- CVE-2026-111376FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZEFreeRDP
- CVE-2026-111375FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window TitleFreeRDP
- CVE-2026-111374FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequestFreeRDP
- CVE-2026-111373FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket PingFreeRDP
- CVE-2026-111237Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injectionUltralytics FastSAM
- CVE-2026-111212ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injectionImprintLab Medical-SAM-Adapter
- CVE-2026-111210bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgerybitcoinj
- CVE-2025-52097Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting u
- CVE-2025-55640A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Servic
- CVE-2025-55653GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c).
- CVE-2026-46471An issue was discovered in GStreamer gst-plugins-good before 1.28.2.