CVEs published October 19, 2026
440 CVEs were published on October 19, 2026: 30 critical, 131 high.
- Published
- 440
- Critical
- 30
- High
- 131
- Medium
- 252
- Low
- 21
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 266
Most affected products
- Apache Software Foundation Apache Camel
- 39
- python-pillow Pillow · pillow
- 27
- Cpanel-JSON-XS
- 15
- IBM MQ Operator · IBM MQ Advanced container images
- 15
- Apache Software Foundation Apache Answer
- 13
- Apache Software Foundation Apache Kylin
- 9
- IBM Concert
- 9
- craftcms cms
- 8
- aio-libs aiohttp · aiohttp
- 7
- diem-project diem
- 7
Critical 30
- CVE-2026-112371H3C Magic NX15 RPC esps write code injectionH3C Magic NX15
- CVE-2026-112370H3C Magic NX15 usrlist sub_416874 os command injectionH3C Magic NX15
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow Pillow · pillow
- CVE-2026-112403Pillow: Heap buffer overflow in ImagingJpegDecodepython-pillow Pillow · pillow
- CVE-2026-112398Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpython-pillow Pillow · pillow
- CVE-2026-112393Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow Pillow · pillow
- CVE-2026-112780Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@getgrav grav
- CVE-2026-112779Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypassgetgrav grav-plugin-api
- CVE-2026-112776Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutationscraftcms cms
- CVE-2026-109437Cognition < 0.13.0 Unauthenticated RCE via Local Shell BackendCognicellAI Cognition
- CVE-2026-110685Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tagCpanel-JSON-XS
- CVE-2026-112377CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay AttackCCC-Attestation attested-tls-poc
- CVE-2026-107188Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionEptura Archibus
- CVE-2026-111862Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeRankMath Rank Math SEO PRO
- CVE-2026-111058Mercury: Unauthenticated Remote Code Execution via /api/kernelsmljar mercury · mercury
- CVE-2026-111057Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmljar mercury · mercury
- CVE-2026-109432Camunda Expression Injection via orQueries RCECamunda
- CVE-2026-112296FlyCms through commit edfdf724 Default Super Administrator Credentialssunkaifei FlyCms
- CVE-2026-112292CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rulesoperacle checkcle
- CVE-2026-71253Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSONApache Software Foundation Apache Johnzon
- CVE-2026-78162Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)Apache Software Foundation Apache Camel
- CVE-2026-90910Apache Answer: Reaction API authorization bypass for restricted contentApache Software Foundation Apache Answer
- CVE-2026-108771Apache Kylin: unauthenticated broadcast API and polymorphic deserializationApache Software Foundation Apache Kylin
- CVE-2026-110887WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerabilityHivePress
- CVE-2026-111406WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-103091Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)Google SAM
- CVE-2026-102503Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)Google SAM
- CVE-2026-108983GV-ASManager Web Server Command Injection VulnerabilityGeoVision GV-ASManager
- CVE-2026-107081SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.p
- CVE-2026-107083SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_
High 131
- CVE-2026-105453IBM Sterling Connect:Direct for Unix Improper Privilege ManagementIBM Sterling Connect Direct for Unix
- CVE-2026-107366Langflow OSS Authorization Bypass Through User-Controlled KeyIBM Langflow OSS
- CVE-2026-107400Security Vulnerability identified in IBM TRIRIGA - GWT Mock AuthenticationIBM TRIRIGA Application Platform
- CVE-2026-109126IBM Verify Identity Access and IBM Security Verify Access Hard-coded CredentialsIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-112373H3C Magic NX15 usrlist sub_416874 stack-based overflowH3C Magic NX15
- CVE-2026-112897Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripspython-pillow Pillow · pillow
- CVE-2026-112896Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readpython-pillow Pillow · pillow
- CVE-2026-112895Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)python-pillow Pillow · pillow
- CVE-2026-112894Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)python-pillow Pillow · pillow
- CVE-2026-112893Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython-pillow Pillow · pillow
- CVE-2026-112261Gimp: gimp: use-after-free in xcf loader via prop_selected_pathRed Hat Enterprise Linux
- CVE-2026-112258Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channelsRed Hat Enterprise Linux
- CVE-2026-112257Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)Red Hat Enterprise Linux
- CVE-2026-112892Pillow: MSP RLE decoder expands a tiny file into unbounded memorypython-pillow Pillow · pillow
- CVE-2026-112406Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclepython-pillow Pillow · pillow
- CVE-2026-112360Netis EAP930 CGI Endpoint debug return200 backdoorNetis EAP930
- CVE-2026-112405Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0python-pillow Pillow · pillow
- CVE-2026-112404Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelspython-pillow Pillow · pillow
- CVE-2026-105815Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210TP-Link Systems Tapo C210
- CVE-2026-112402Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformpython-pillow Pillow · pillow
- CVE-2026-112397Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagepython-pillow Pillow · pillow
- CVE-2026-112392Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagespython-pillow Pillow · pillow
- CVE-2026-112400Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSpython-pillow Pillow · pillow
- CVE-2026-112399Pillow: APNG background disposal allocates full canvas before decompression bomb checkpython-pillow Pillow · pillow
- CVE-2026-53995MLflow 3.17.1 and prior Path Traversal via Trace ID APImlflow
- CVE-2026-76788Stack out-of-bounds write in the OSDP Control Panel reply parserzephyrproject zephyr
- CVE-2026-112390Pillow: Infinite loop in MIC n_frames when the embedded TIFFpython-pillow Pillow · pillow
- CVE-2026-71169Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability.Dell Application Store
- CVE-2026-82166Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability.Dell Application Store
- CVE-2026-71170Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability.Dell Application Store
- CVE-2026-112260Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsingRed Hat Enterprise Linux
- CVE-2026-112782Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Servicegetgrav grav
- CVE-2026-112781Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directivesgetgrav grav
- CVE-2026-112777Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCEcraftcms cms
- CVE-2026-112775Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-passwordcraftcms cms
- CVE-2026-112774Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layoutcraftcms cms
- CVE-2026-112773Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injectioncraftcms cms
- CVE-2026-112772Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injectioncraftcms cms
- CVE-2026-112771Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filterscraftcms cms
- CVE-2026-112770Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callablecraftcms cms
- CVE-2026-110688Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parseCpanel-JSON-XS
- CVE-2026-110687Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmpCpanel-JSON-XS
- CVE-2026-110684Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringifyCpanel-JSON-XS
- CVE-2026-110682Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parseCpanel-JSON-XS
- CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithreadCpanel-JSON-XS
- CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in…Cpanel-JSON-XS
- CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parseCpanel-JSON-XS
- CVE-2026-110677Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hvCpanel-JSON-XS
- CVE-2026-110676Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignumCpanel-JSON-XS
- CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hvCpanel-JSON-XS
- CVE-2026-110673Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tagCpanel-JSON-XS
- CVE-2026-110672Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hvCpanel-JSON-XS
- CVE-2026-105810Authenticated Local Stack Overflow in TP-Link Tapo C320WSTP-Link Systems Tapo C320WS
- CVE-2026-3295IBM Cloud Pak System Cross-Site ScriptingIBM Cloud Pak System
- CVE-2026-111759markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-it
- CVE-2026-111755follow-redirects sensitiveHeaders regex escaping can expose credential headersfollow-redirects
- CVE-2026-6719IBM Concert Software Use of Insufficiently Random ValuesIBM Concert
- CVE-2026-111066AIOHTTP: File descriptor exhaustion in multipart requestsaio-libs aiohttp · aiohttp
- CVE-2026-111064aiohttp server lacks an initial request/header timeoutaio-libs aiohttp · aiohttp
- CVE-2026-10572IBM MQ Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-10574IBM MQ Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-10743IBM MQ Race ConditionIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12148IBM MQ Deserialization of Untrusted DataIBM MQ Operator · IBM MQ Advanced container images
- CVE-2025-10149Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverWSO2 Identity Server as Key Manager · WSO2 Open Banking… +3
- CVE-2026-12665IBM MQ Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-107187Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive TablesEptura Archibus
- CVE-2026-107186Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session ReuseEptura Archibus
- CVE-2026-103038PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP hostStreamSoft PingTools Network Utilities
- CVE-2026-112158MikroTik RouterOS ipt_SAME.ko same_check integer overflowMikroTik RouterOS
- CVE-2026-112368Unbounded Recursion in phongo_bson_visit_document/visit_array:MongoDB PHP Driver
- CVE-2026-111045CLI Bridge: High-severity sandbox escape via dangling symlinkanshupriyan cli-bridge
- CVE-2026-107571Incorrect Default Permissions in hMailServerProgressive Robot hMailServer
- CVE-2026-107569Unchecked Input for Loop Condition in hMailServerProgressive Robot hMailServer
- CVE-2026-107567Use of Less Trusted Source in hMailServerProgressive Robot hMailServer
- CVE-2026-112366Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patternsmicromatch picomatch
- CVE-2026-112309@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methodsairjp73 @rvf/set-get
- CVE-2026-112308crewai-tools through 1.15.28 SSRF via SeleniumScrapingToolcrewAIInc crewai-tools
- CVE-2026-112307sqlparse through 0.6.0 PHP Code Injection via output_format='php'andialbrecht sqlparse
- CVE-2026-112306NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFieldsnocobase
- CVE-2026-112305Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Overridesemaphoreui Semaphore UI
- CVE-2026-112304docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()Mindee docTR
- CVE-2026-109431Camunda Missing Authorization in Task Sub-ResourcesCamunda
- CVE-2026-112287Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Modulekrayin laravel-crm
- CVE-2026-112286Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpointskrayin laravel-crm
- CVE-2026-112279rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2rdesktop
- CVE-2026-112278rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcacherdesktop
- CVE-2026-112277rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_planerdesktop
- CVE-2026-112270SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idxsgl-project sglang
- CVE-2026-112269SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrationssgl-project sglang
- CVE-2026-112266SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matchingsgl-project sglang
- CVE-2026-112265LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verificationlangbot-app LangBot
- CVE-2026-112264BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env KeysBentoML
- CVE-2026-112263Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formattingalexpasmantier television
- CVE-2026-112262RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectorsrisingwavelabs risingwave
- CVE-2026-111915Yank Note before 3.93.1 Path Traversal via /api/help Endpointpurocean Yank Note
- CVE-2026-8168Denial-of-service vulnerability in the SVG parser and renderer impacts Qtqt
- CVE-2026-103314Stackrox: stackrox: saml response replay allows multiple central authentication tokensRed Hat Advanced Cluster Security for Kubernetes
- CVE-2026-88900Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code ExecutionApache Software Foundation Apache Camel
- CVE-2026-88901Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by defaultApache Software Foundation Apache Camel
- CVE-2026-85251Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect TargetsApache Software Foundation Apache Camel
- CVE-2026-85250Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource OptionApache Software Foundation Apache Camel
- CVE-2026-83531Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control MessagesApache Software Foundation Apache Camel
- CVE-2026-80344Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery AddressApache Software Foundation Apache Camel
- CVE-2026-80343Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingApache Software Foundation Apache Camel
- CVE-2026-80312Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open ProcessorsApache Software Foundation Apache Camel
- CVE-2026-79986Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outsideApache Software Foundation Apache Camel
- CVE-2026-79985Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outsideApache Software Foundation Apache Camel
- CVE-2026-79984Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outsideApache Software Foundation Apache Camel
- CVE-2026-79983Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outsideApache Software Foundation Apache Camel
- CVE-2026-78165Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis PayloadsApache Software Foundation Apache Camel
- CVE-2026-78164Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headersApache Software Foundation Apache Camel
- CVE-2026-64943Apache Answer: API keys logged in plaintext during authenticationApache Software Foundation Apache Answer
- CVE-2026-112188MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name ResolutionMISP
- CVE-2026-108762Apache Kylin: delete metadata backup path-confinement bypassApache Software Foundation Apache Kylin
- CVE-2026-111398WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerabilityPT Norther Lights Production MapSVG
- CVE-2026-111408WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerabilityExpressTech Quiz And Survey Master
- CVE-2026-110379WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerabilityAys Pro Quiz Maker
- CVE-2026-112178MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access ControlMISP
- CVE-2026-13695SQL Injection in the Integratec ApplicationIntegratec
- CVE-2026-104679VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.Yamaha VOCALOID6 Editor
- CVE-2026-112161Lack of integrity checks in Mobatek’s MobaXtermMobatek MobaXterm
- CVE-2026-16460Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalizationRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-76740HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerabilityHewlett Packard Enterprise HPE Compute Scale-up Server 3… +2
- CVE-2026-112082sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of servicesgl-project SGLang
- CVE-2026-108120path traversal inKoozali - SME Serverkoozali SME Server
- CVE-2026-111440JDBC LogFactory 任意类加载/构造导致潜在 RCEopenGauss-server openGauss-connector-jdbc
- CVE-2026-111441HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写openGauss-server
- CVE-2026-108984GV-ASManager Web Server Buffer Overflow VulnerabilityGeoVision GV-ASManager
- CVE-2025-52290A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cau
- CVE-2026-107082Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and
- CVE-2026-107084Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_hi
Medium, low and unrated 279
- CVE-2026-8355IBM ContextForge MCP Gateway is affected by server-side request forgeryIBM ContextForge MCP Gateway
- CVE-2025-36061TS4500 Tape Library Denial of ServiceIBM Storage TS4500 Library
- CVE-2025-36069TS4500 Tape Library Insufficient Session ExpirationIBM Storage TS4500 Library
- CVE-2025-36252TS4500 Tape Library Insufficient Session ExpirationIBM Storage TS4500 Library
- CVE-2026-19178TS4500 Tape Library Race ConditionIBM Storage TS4500 Library
- CVE-2026-77684Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of servicezephyrproject zephyr
- CVE-2026-19595Zephyr RTIO syscall verifier validates output parameters for read instead of write accesszephyrproject zephyr
- CVE-2026-112372H3C Magic NX15 upload importprofile path traversalH3C Magic NX15
- CVE-2026-112991MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()misp-modules
- CVE-2026-112901Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutespython-pillow Pillow · pillow
- CVE-2026-112898Pillow: Image.quantize() with empty palette leaks uninitialized stack memorypython-pillow Pillow · pillow
- CVE-2026-112361Dolibarr CSP document.php protection mechanismDolibarr
- CVE-2026-112891Pillow: Quadratic GIF comment copying during savepython-pillow Pillow · pillow
- CVE-2026-105814Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210TP-Link Systems Tapo C210
- CVE-2026-112401Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()python-pillow Pillow · pillow
- CVE-2026-112358TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgeryTiBillet Lespass
- CVE-2026-112396Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferpython-pillow Pillow · pillow
- CVE-2026-112302kiwilan php-archive Extraction ArchiveZip.php extract path traversalkiwilan php-archive
- CVE-2026-112395Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)python-pillow Pillow · pillow
- CVE-2026-111946Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag headerPlack-Middleware-ETag
- CVE-2026-112394Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizepython-pillow Pillow · pillow
- CVE-2026-112301orbitale imagemagick-php Command.php font os command injectionorbitale imagemagick-php
- CVE-2026-112391Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()python-pillow Pillow · pillow
- CVE-2026-76787NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sumzephyrproject zephyr
- CVE-2026-112300DiffSK configobj __init__.py _sectionmarker redosDiffSK configobj
- CVE-2026-112299smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgerysmrealms smr
- CVE-2026-111766markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledmarkdown-it
- CVE-2026-112297ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgeryptbsare anx-calibre-manager
- CVE-2026-112254agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgeryagit8or1 clientst0r
- CVE-2026-112778Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotationstraefik
- CVE-2026-112769Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypassparse-community parse-server
- CVE-2026-112768Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Updateparse-community parse-server
- CVE-2026-112252Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injectionWuxi Wubang Security Software Wubang Five-in-One Safety Pro…
- CVE-2026-112259Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette importRed Hat Enterprise Linux
- CVE-2026-112251antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirectantoinersx clawhost
- CVE-2026-112249grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scriptinggrandnode2
- CVE-2026-109434Sleipnir Browser < 3.9.0 Fullscreen Address Bar SpoofingFenrir Sleipnir Mobile for Android
- CVE-2026-110686Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hvCpanel-JSON-XS
- CVE-2026-110674Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hvCpanel-JSON-XS
- CVE-2026-112248grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversalgrandnode2
- CVE-2026-11319TickTick Android 8.2.2.0 Path Traversal via ShareReceiveActivityTickTick Limited TickTick for Android
- CVE-2026-55644Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that originelement-hq element-x-ios
- CVE-2023-38375IBM Cloud Pak System Cross-Site ScriptingIBM Cloud Pak System
- CVE-2026-3161IBM Cloud Pak System Risky Cryptographic AlgorithmIBM Cloud Pak System
- CVE-2026-4418IBM Cloud Pak System HTML InjectionIBM Cloud Pak System
- CVE-2026-111757Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonojs hono · hono
- CVE-2026-1501IBM Concert Software Improper Certificate ValidationIBM Concert
- CVE-2026-1510IBM Concert Software Improper Clearing of Heap MemoryIBM Concert
- CVE-2026-3303IBM Concert Software Permissive Cross-domain Security PolicyIBM Concert
- CVE-2026-3628IBM Concert Software Information DisclosureIBM Concert
- CVE-2026-4405IBM Concert Software Use of Web Browser Cache Containing Sensitive InformationIBM Concert
- CVE-2026-4413IBM Concert Software Cross-Site ScriptingIBM Concert
- CVE-2026-112247Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scriptingWuxi Wubang Security Software Five-in-One Safety Production…
- CVE-2026-6930IBM Concert Software Risky Cryptographic AlgorithmIBM Concert
- CVE-2026-15661IBM Concert Software Improper Output Neutralization for LogsIBM Concert
- CVE-2026-111750AIOHTTP: Pure-Python parser request smugglingaio-libs aiohttp · aiohttp
- CVE-2026-111749AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesaio-libs aiohttp · aiohttp
- CVE-2026-111748AIOHTTP: Absolute-form request targets can spoof Request.schemeaio-libs aiohttp · aiohttp
- CVE-2026-112195FusionPBX Dialplan Editor dialplan.php os command injectionFusionPBX
- CVE-2024-4412Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsWSO2 Enterprise Integrator · WSO2 API Manager +8
- CVE-2026-111065AIOHTTP: Connector pool exhaustion via Max-Age overflowaio-libs aiohttp · aiohttp
- CVE-2025-13173Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationWSO2 API Control Plane · WSO2 Universal Gateway +7
- CVE-2025-13591Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryWSO2 Identity Server · WSO2 Carbon Abstract OTP Authenti… +1
- CVE-2026-112193Webkul Aureus ERP UserForm.php weak passwordWebkul Aureus ERP
- CVE-2026-111063AIOHTTP: Secure attribute not enforced for shared cookieaio-libs aiohttp · aiohttp
- CVE-2026-14511IBM MQ Denial of ServiceIBM MQ
- CVE-2026-11828IBM MQ Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-11829IBM MQ Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-11831IBM MQ Heap-based Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12155IBM MQ Deserialization of Untrusted DataIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12343IBM MQ Denial of ServiceIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12350IBM MQ Deserialization of Untrusted DataIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12660IBM MQ Path TraversalIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12669IBM MQ Out-of-bounds ReadIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12727IBM MQ Buffer OverflowIBM MQ Operator · IBM MQ Advanced container images
- CVE-2026-12670IBM MQ Denial of ServiceIBM MQ Operator · IBM MQ Advanced container images
- CVE-2025-7203Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of CredentialsWSO2 Universal Gateway · WSO2 Traffic Manager +6
- CVE-2026-111061russh agent server converts constraint records into unbounded never-rolled-back tasksEugeny russh · russh
- CVE-2026-112190Webkul Aureus ERP composer.json insertion of sensitive information into debugging codeWebkul Aureus ERP
- CVE-2025-7043Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionWSO2 API Manager · WSO2 Universal Gateway +2
- CVE-2025-6623Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and RedirectionWSO2 API Manager · WSO2 Universal Gateway +4
- CVE-2026-112159JumpServer Template Rendering os command injectionJumpServer
- CVE-2026-111059Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLmljar mercury · mercury
- CVE-2026-111056FOSSBilling: Unauthenticated client account enumeration via guest signup endpointFOSSBilling
- CVE-2026-111053FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_existsFOSSBilling
- CVE-2026-111046FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensionsFOSSBilling
- CVE-2026-112157MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumptionMemTensor memmy-agent
- CVE-2026-12254Netskope Client Captive Portal WebView Persistence allowing SWG bypass issueNetskope Client
- CVE-2026-107566Missing Authorization in hMailServerProgressive Robot hMailServer
- CVE-2026-107568Missing Authorization in hMailServerProgressive Robot hMailServer
- CVE-2026-112153vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injectionvraj404 Criminal-Management-System
- CVE-2026-112363Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfounclecode crawl4ai
- CVE-2026-112310docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRefdocling-project docling-core
- CVE-2026-112303GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLsGDevelop
- CVE-2026-112152vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injectionvraj404 Criminal-Management-System
- CVE-2026-109433Camunda Broken Access Control via CockpitCamunda
- CVE-2026-112151vraj404 Criminal Management System Submission Form home.php sql injectionvraj404 Criminal Management System
- CVE-2026-86375Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability.Dell Application Installer,
- CVE-2026-112329Sensei LMS 4.26.4 Broken Access Control via save_new_messageAutomattic Sensei LMS
- CVE-2026-112150vraj404 Criminal-Management-System search.php sql injectionvraj404 Criminal-Management-System
- CVE-2026-112328Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAXAutomattic Sensei LMS
- CVE-2026-112149vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted uploadvraj404 Criminal-Management-System
- CVE-2026-112147ai-genius-automations octoally index.ts information disclosureai-genius-automations octoally
- CVE-2026-112146D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentialsD-Link E15 · D-Link M32 +2
- CVE-2026-112295FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_updatesunkaifei FlyCms
- CVE-2026-112294FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpointsunkaifei FlyCms
- CVE-2026-112293BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment APIBoxyHQ saas-starter-kit
- CVE-2026-112291Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task APIFlarum Extension Manager
- CVE-2026-112290MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-itemMI6 Intelligence Community UI Kit canary web components
- CVE-2026-112289Koalixcrm through 1.14.0 Stored XSS via Task Title in Django AdminKoalixSwitzerland koalixcrm
- CVE-2026-112288Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebindingkrayin laravel-crm
- CVE-2026-112285Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later OrdersThelia
- CVE-2026-112284libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGRxqq libaribcaption
- CVE-2026-112283libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_pointsVideoLAN libbluray
- CVE-2026-112282VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_pointVideoLAN libbluray
- CVE-2026-112281libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csinkoriyama aribb24
- CVE-2026-112280libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_bodynkoriyama aribb24
- CVE-2026-112276Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm ColormapNetpbm
- CVE-2026-112275Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_imageNetpbm
- CVE-2026-112274libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::initlibtins
- CVE-2026-112273libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_namelibtins
- CVE-2026-112272libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parseremersion libdisplay-info
- CVE-2026-112271libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parseremersion libdisplay-info
- CVE-2026-112268sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routessgl-project sglang-router
- CVE-2026-112267SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Workersgl-project sglang
- CVE-2026-111939Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creationfrappe helpdesk
- CVE-2026-111938Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_logfrappe crm
- CVE-2026-111937Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Recordsfrappe crm
- CVE-2026-111936Sigma File Manager through 2.2.0 SSRF via Extension Download Commandsaleksey-hoffman Sigma File Manager
- CVE-2026-111935NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysiscodexu NoteGen
- CVE-2026-111925Mopidy before 4.0.5 Path Traversal via File Backend library.lookupMopidy
- CVE-2026-111899KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl FetchTomBursch kitchenowl
- CVE-2026-111883Locust through 2.46.7 CSRF via Web UI /stop and /stats/resetlocustio locust
- CVE-2026-112145speaches-ai speaches Pyannote Diarization Model Loading pyannote_diarization.py PyannoteDiarizationModelManager._load_fn externally-controlled input to select classes or codespeaches-ai speaches
- CVE-2026-112144satya-vinay Events-Management-System project.sql file accesssatya-vinay Events-Management-System
- CVE-2026-111828WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerabilityMamunur Rashid Classified Listing
- CVE-2026-112222WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerabilitySurfer
- CVE-2026-111829WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerabilityWP Mailster
- CVE-2026-110902WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerabilityLiquid Web / StellarWP Event Tickets
- CVE-2026-110008@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback@fastify/oauth2
- CVE-2026-112143satya-vinay Events-Management-System missing authenticationsatya-vinay Events-Management-System
- CVE-2026-112142satya-vinay Events-Management-System Registration-Delete dodelete.php sql injectionsatya-vinay Events-Management-System
- CVE-2026-111845WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerabilityYITH WooCommerce Product Bundles
- CVE-2026-112141satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injectionsatya-vinay Events-Management-System
- CVE-2026-111831WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerabilityWP ManageNinja FluentForm
- CVE-2026-110363WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-111836WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerabilityWP ManageNinja FluentCommunity
- CVE-2026-111414WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2026-111410WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerabilityE2Pdf.com e2pdf
- CVE-2026-112214Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parserRed Hat Enterprise Linux
- CVE-2026-111839WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerabilityVideoWhisper.com Broadcast Live Video
- CVE-2026-112199WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerabilityYITH WooCommerce Wishlist
- CVE-2026-112140llSourcell Doctor-Dignity chat_module.py _get_lib_module code injectionllSourcell Doctor-Dignity
- CVE-2026-112139subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injectionsubhajitkhan online-clinic-management-system
- CVE-2026-112210Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.serviceRed Hat Enterprise Linux
- CVE-2026-112138diem-project diem dmCodeEditor actions.class.php join path traversaldiem-project diem
- CVE-2026-112108ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflowztxz16 fastllm
- CVE-2026-112107ztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflowztxz16 fastllm
- CVE-2026-91858Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is PresentApache Software Foundation Apache Camel
- CVE-2026-112106TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validationTufayelLUS TikTok-Video-Downloader-PHP
- CVE-2026-85317Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token CacheApache Software Foundation Apache Camel
- CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path MatchingApache Software Foundation Apache Camel
- CVE-2026-85315Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer ExceptionsApache Software Foundation Apache Camel
- CVE-2026-85314Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)Apache Software Foundation Apache Camel
- CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetApache Software Foundation Apache Camel
- CVE-2026-85312Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action HeaderApache Software Foundation Apache Camel
- CVE-2026-85300Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File PermissionsApache Software Foundation Apache Camel
- CVE-2026-85301Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss ClaimApache Software Foundation Apache Camel
- CVE-2026-85296Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateApache Software Foundation Apache Camel
- CVE-2026-85260Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by DefaultApache Software Foundation Apache Camel
- CVE-2026-85257Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer ExceptionsApache Software Foundation Apache Camel
- CVE-2026-85254Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name CasingApache Software Foundation Apache Camel
- CVE-2026-85249Apache Camel: Camel-Tika Header Injection via Unfiltered Document MetadataApache Software Foundation Apache Camel
- CVE-2026-85248Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature InstanceApache Software Foundation Apache Camel
- CVE-2026-85247Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a TruststoreApache Software Foundation Apache Camel
- CVE-2026-85246Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer ExceptionsApache Software Foundation Apache Camel
- CVE-2026-85245Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetApache Software Foundation Apache Camel
- CVE-2026-85243Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message StructureApache Software Foundation Apache Camel
- CVE-2026-84181Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject ReuseApache Software Foundation Apache Camel
- CVE-2026-84180Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer ExceptionsApache Software Foundation Apache Camel
- CVE-2026-84178Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code FlowApache Software Foundation Apache Camel
- CVE-2026-112105GlitterWare Passy TLS main.dart MyHttpOverrides certificate validationGlitterWare Passy
- CVE-2026-84176Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionApache Software Foundation Apache Camel
- CVE-2026-112104eremef bandcamp-player Remote Control Server database.ts missing authenticationeremef bandcamp-player
- CVE-2026-78163Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File DisclosureApache Software Foundation Apache Camel
- CVE-2026-112103f3-factory fatfree-core HTTP Client web.php _curl certificate validationf3-factory fatfree-core
- CVE-2026-112102AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injectionAXA Group NLP.js
- CVE-2026-86589Apache Answer: User Center integration does not revoke first-login sessions after central account suspensionApache Software Foundation Apache Answer
- CVE-2026-79633Apache Answer: Missing Authorization Allows Mutations of Non-Public ContentApache Software Foundation Apache Answer
- CVE-2026-79624Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session RevocationApache Software Foundation Apache Answer
- CVE-2026-79620Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question MetadataApache Software Foundation Apache Answer
- CVE-2026-79613Apache Answer: Disclosure of Comments on Non-Public Content Through Public ProfilesApache Software Foundation Apache Answer
- CVE-2026-76994Apache Answer: Exposure of Hidden Question Metadata Through Public Answer ProfilesApache Software Foundation Apache Answer
- CVE-2026-71563Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public QuestionsApache Software Foundation Apache Answer
- CVE-2026-68482Apache Answer: Improper Authorization in Question Invite User LookupApache Software Foundation Apache Answer
- CVE-2026-67249Apache Answer: Email Code Purpose Confusion May Allow Account TakeoverApache Software Foundation Apache Answer
- CVE-2026-64945Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questionsApache Software Foundation Apache Answer
- CVE-2026-112101BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationBlackBeltTechnology pi-agent-dashboard
- CVE-2026-112192MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only SettingsMISP
- CVE-2026-64944Apache Answer: Stored XSS via unsanitized HTML in imported question contentApache Software Foundation Apache Answer
- CVE-2026-108837Apache Kylin: Potential computed-column resource exhaustionApache Software Foundation Apache Kylin
- CVE-2026-108833Apache Kylin: default startup profile miss security settingsApache Software Foundation Apache Kylin
- CVE-2026-108823Apache Kylin: Potential unauthenticated job metadata replacementApache Software Foundation Apache Kylin
- CVE-2026-108780Apache Kylin: Potential JDBC source configuration validation issueApache Software Foundation Apache Kylin
- CVE-2026-108776Apache Kylin: tables/names SparkSQL injectionApache Software Foundation Apache Kylin
- CVE-2026-108766Apache Kylin: missing JDBC-config authorizationApache Software Foundation Apache Kylin
- CVE-2026-112184MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form LabelsMISP
- CVE-2026-108764Apache Kylin: job-driver UI proxy SSRFApache Software Foundation Apache Kylin
- CVE-2026-112183MISP CSS Injection via Remote Tag Colour in Event PreviewMISP
- CVE-2026-112100DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injectionDeepPavlov
- CVE-2026-110898WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2026-111407WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS
- CVE-2026-112098DeepPavlov Config Reference Resolver params.py resolve code injectionDeepPavlov
- CVE-2026-112180MISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsMISP
- CVE-2026-112179MISP Event Synchronization Exposes Non-Exportable Tags on Remote InstancesMISP
- CVE-2026-112097SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scriptingSourceCodester Inventory System
- CVE-2026-112096SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scriptingSourceCodester Inventory System
- CVE-2026-112095SourceCodester Inventory System Product Management products_handler.php save cross site scriptingSourceCodester Inventory System
- CVE-2026-111438check_hba_replication 认证与访问控制绕过openGauss-server
- CVE-2026-112094michaelrsweet mxml mxml-file.c mxml_load_data use after freemichaelrsweet mxml
- CVE-2026-111439pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块openGauss-server
- CVE-2026-112093subhajitkhan online-clinic-management-system feedback.php cross site scriptingsubhajitkhan online-clinic-management-system
- CVE-2026-112092subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scriptingsubhajitkhan online-clinic-management-system
- CVE-2026-112091Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosureDav-ee dairy-management-system
- CVE-2026-112090Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injectionDav-ee dairy-management-system
- CVE-2026-94294App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.phpApp Builder
- CVE-2026-94272Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX ActionsSnap Finance
- CVE-2026-94231TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and ModificationTrueBooker
- CVE-2026-94230TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX ActionsTrueBooker
- CVE-2026-94229TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' ParameterTrueBooker
- CVE-2026-94228TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_dataTrueBooker
- CVE-2026-91831Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name SettingSubscribe to Comments
- CVE-2026-86791iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation ForgeryiPOSpays Payment Gateway for WooCommerce
- CVE-2026-74922Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature BypassDocument Gallery
- CVE-2026-74921Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode AttributesDocument Gallery
- CVE-2026-110034Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount CodeSalon Booking System
- CVE-2026-106010BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation ForgeryBDM Digital Payment Gateway
- CVE-2026-103311Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared SecretCoinbase Commerce Payment Gateway for WooCommerce
- CVE-2026-112089Dav-ee dairy-management-system delete.php mysqli_query sql injectionDav-ee dairy-management-system
- CVE-2026-112088Dav-ee dairy-management-system add.php mysqli_query sql injectionDav-ee dairy-management-system
- CVE-2026-112087itsourcecode Online Cake Ordering System confirm.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2026-112086ESPnet Inference Model inference_model.py build_model deserializationESPnet
- CVE-2026-94273Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_paymentSnap Finance
- CVE-2026-106014Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback ForgeryGateway for Vantiv on WC
- CVE-2026-89286FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log FileFormFlow for GoHighLevel
- CVE-2026-91047ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' ParameterElementsReady Addons for Elementor
- CVE-2026-91046ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing AuthorizationElementsReady Addons for Elementor
- CVE-2026-106933Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG UploadBlaze Demo Importer
- CVE-2026-106028ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon CreationActiveTrail for WooCommerce
- CVE-2026-76739HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modificationHewlett Packard Enterprise HPE Compute Scale-up Server 3… +1
- CVE-2026-112083sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of servicesgl-project SGLang
- CVE-2026-112081hankcs HanLP Model Config Loading reflection.py hanlp.load deserializationhankcs HanLP
- CVE-2026-108121Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of ServiceKoozali SME Server
- CVE-2026-112080LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injectionLlamaChinese Llama-Chinese
- CVE-2026-112079hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserializationhankcs HanLP
- CVE-2026-112078RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injectionRVC-Project Retrieval-based-Voice-Conversion-WebUI
- CVE-2026-112077radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanismradareorg radare2
- CVE-2026-112076alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgeryalexta69 MeTube
- CVE-2026-112075unslothai unsloth sentence_transformer.py externally-controlled input to select classes or codeunslothai unsloth
- CVE-2026-112074Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflowTencent ncnn
- CVE-2026-112073Tencent ncnn MatMul matmul.cpp matmul_transb out-of-boundsTencent ncnn
- CVE-2026-112045donetick History Deletion model.go CanDeleteHistory improper authorizationdonetick
- CVE-2026-112044dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authenticationdotnet eShop
- CVE-2026-112043calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorizationcalcom cal.com · calcom cal.diy
- CVE-2026-112042diem-project diem dmWidget dmBaseLinkTag.php text cross site scriptingdiem-project diem
- CVE-2026-112041diem-project diem dmString.php random weak prngdiem-project diem
- CVE-2026-112040diem-project diem Sign-In BasedmUserActions.class.php redirectdiem-project diem
- CVE-2026-112039diem-project diem Administrative Console actions.class.php append cross site scriptingdiem-project diem
- CVE-2026-112038diem-project diem Version Check Service dmAdminCtrl.js html cross site scriptingdiem-project diem
- CVE-2026-112037diem-project diem Google Analytics Client gapi.class.php certificate validationdiem-project diem
- CVE-2026-112036Artifex MuPDF Signature Locking pdf-xref.c free_char_list double freeArtifex MuPDF
- CVE-2026-112035aircheng-org iWebShop-5 simple.php send_message_mobile password recoveryaircheng-org iWebShop-5
- CVE-2026-112034aircheng-org iWebShop-5 Login Redirect _userInfo.php redirectaircheng-org iWebShop-5
- CVE-2026-112033aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgeryaircheng-org iWebShop-5
- CVE-2025-55654A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial
- CVE-2025-55667A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attacke
- CVE-2025-60480A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c354
- CVE-2025-60482A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-maste
- CVE-2026-38671Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed ve