CVEs published October 23, 2026
500 CVEs were published on October 23, 2026: 39 critical, 171 high.
- Published
- 500
- Critical
- 39
- High
- 171
- Medium
- 102
- Low
- 21
- Unrated
- 167
- Now in CISA KEV
- 0
- Fix available
- 397
Most affected products
- Linux
- 217
- Zimbra Collaboration Suite
- 17
- MervinPraison PraisonAI · praisonai
- 12
- CGM CLININET
- 11
- intranda goobi-viewer-core
- 11
- Eclipse Foundation Eclipse KeyPont - GOSE
- 9
- nodejs node
- 9
- Part-DB-server
- 9
- baserproject basercms
- 8
- zephyrproject zephyr
- 7
Critical 39
- CVE-2026-115931Arbitrary file read and backend crash through unrestricted provider method callsGitroomHQ postiz-app
- CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime · wasmtime
- CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime · wasmtime
- CVE-2026-115812Relative path traversal during model archive extraction in Amazon Web Services Multi Model ServerAWS multi-model-server
- CVE-2026-53942Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKENconda infrastructure
- CVE-2026-55486Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSintranda goobi-viewer-core
- CVE-2026-46652Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerintranda goobi-viewer-core
- CVE-2026-46651Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerintranda goobi-viewer-core
- CVE-2026-53921odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)openwrt odhcpd
- CVE-2026-112848WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerabilityAivahThemes Hostme
- CVE-2026-112854WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerabilityaxiomthemes Holistic Center
- CVE-2026-112847WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerabilityThemeREX ZenSoul
- CVE-2026-112846WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerabilityThemeREX Group Save Life
- CVE-2026-112851WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerabilityThemeREX Group HotLock
- CVE-2026-112853WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerabilityaxiomthemes Hallelujah
- CVE-2026-112856WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerabilityThemeREX Group Vagabonds
- CVE-2026-112857WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerabilityaxiomthemes Reprizo
- CVE-2026-112858WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerabilityaxiomthemes Rhodos
- CVE-2026-112859WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerabilityThemeREX Group Little Birdies
- CVE-2026-112855WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerabilityaxiomthemes Redy
- CVE-2026-99079net/mlx5e: Prevent stale XSK buffer release on refill retryLinux
- CVE-2026-99078net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retryLinux
- CVE-2026-98959btrfs: fix xattr replace when multiple xattrs are packed in the same itemLinux
- CVE-2026-57116PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocationMervinPraison PraisonAI · praisonai
- CVE-2026-115727AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_serverFosowl AgenticSeek
- CVE-2026-107685WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackersagentjido req_llm · req_llm
- CVE-2026-25784bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysopHallo Welt! BlueSpice
- CVE-2025-30054Local Privilege Escalation in CGM CLININETCGM CLININET
- CVE-2025-30050Remote Code Execution in CGM CLININETCGM CLININET
- CVE-2025-30047Remote Code Execution via Java Deserialization in CGM CLININETCGM CLININET
- CVE-2025-30046Remote Code Execution in CGM CLININETCGM CLININET
- CVE-2026-112860WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerabilityxnau webdesign Participants Database
- CVE-2026-112862WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerabilityxnau webdesign Participants Database
- CVE-2026-63244Authentication Bypass VulnerabilityWizLearn Technologies Pte. Learning Management System
- CVE-2026-55981Firmware verification vulnerabilityCreative Labs Creative Sound Blaster Katana V2, V2X, SE
- CVE-2026-94267Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionAdvanced Custom Fields: Extended
- CVE-2026-54630Part-DB: Authenticated RCE via .phar attachment upload served from public/mediaPart-DB-server
- CVE-2026-115547Command Execution via Admin Console Input in Okta Access GatewayOkta Access Gateway
- CVE-2026-19677Authentication Bypass Leading to Server-Side Command ExecutiononPhase Forms
High 171
- CVE-2026-115938Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCEcraftcms cms
- GHSA-F2HQ-32VH-53CCpostal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded wordspostal-mime
- CVE-2026-115937Unauthenticated payment reuse allows unpaid orders to be marked as paidcraftcms commerce-mollie
- CVE-2026-115935Control panel only API response emulation replaces "securityKey" and reaches server RCEcraftcms cms
- CVE-2026-115895Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executioncapricorn86 happy-dom · happy-dom
- CVE-2026-115887graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of servicegraphql-hive graphql-scalars · graphql-scalars
- CVE-2026-65825OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenantsopen-reception appointment-booking-software
- CVE-2026-65824OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookieopen-reception appointment-booking-software
- CVE-2026-58202OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`open-reception appointment-booking-software
- CVE-2026-115778Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffertwisted
- CVE-2026-115776Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffertwisted
- CVE-2026-115775Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Treetwisted
- CVE-2026-79982Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet sizezephyrproject zephyr
- CVE-2026-79979Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frameszephyrproject zephyr
- CVE-2026-79977WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyrzephyrproject zephyr
- CVE-2026-19741OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)zephyrproject zephyr
- CVE-2026-115586virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)pypa virtualenv · virtualenv
- CVE-2026-115585pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)py-pdf pypdf · pypdf
- CVE-2026-115580pypdf: Possible long runtimes for large xref table header limitspy-pdf pypdf · pypdf
- CVE-2026-115572pypdf: Possible long runtimes for repeated references to the same missing objectpy-pdf pypdf · pypdf
- CVE-2026-91093HP One Agent Software – Security UpdateHP One Agent Software
- CVE-2026-112342Tandoor Recipes < 2.7.0 Cross-Space Permission Cache PoisoningTandoor Recipes
- CVE-2026-115570Electron: Mitigation for compromised eMudhra intermediate certificateselectron
- CVE-2026-115863ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message.ConnMan
- CVE-2026-110975Autotune: kruize/autotune: kruize/autotune: datasources credential disclosurekruize-autotune
- CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the cnodejs node
- CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.revnodejs node
- CVE-2026-87901Improper sanitization in the registration module allows reflected Cross-Site Scripting.phpBB
- CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 anodejs node
- CVE-2026-57845Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builderhuggingface datasets
- CVE-2026-54668Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)kitodo-production
- CVE-2026-58497Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsolo-dot-io Uni-CLI · @zenalexa/unicli
- CVE-2026-39902Cacti: Authenticated RCE on Data Inputcacti
- CVE-2026-102786Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5phoca.cz Phoca Gallery extension for Joomla
- CVE-2026-55459Goobi viewer: OpenID JWT audience not enforced by the verifierintranda goobi-viewer-core
- CVE-2026-55457Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassintranda goobi-viewer-core
- CVE-2026-115478obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-115477obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTPThe-40-Thieves obsidian-tc · obsidian-tc
- CVE-2026-115457baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Commentsbaserproject basercms
- CVE-2026-114624baserCMS: PHP object injection via unguarded unserialize() in the widget-area entitybaserproject basercms
- CVE-2026-114622baserCMS: Encoded path traversal bypass in the theme file APIbaserproject basercms
- CVE-2026-114621baserCMS: SQL injection in the admin panel and admin APIbaserproject basercms
- CVE-2026-114357DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)DJI CrystalSky ZS600C
- CVE-2026-114356DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorizationDJI CrystalSky ZS600C
- CVE-2026-114355DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as rootDJI CrystalSky ZS600C
- CVE-2026-93640Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo ConfigurationZimbra Collaboration Suite
- CVE-2026-115481baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file uploadbaserproject basercms
- CVE-2026-114354DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as rootDJI CrystalSky ZS600C
- CVE-2026-50057Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo PermissionsZimbra Collaboration Suite
- CVE-2026-114353DJI CrystalSky ZS600C USB-gadget backdoor allows root command executionDJI CrystalSky ZS600C
- CVE-2026-50056Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionZimbra Collaboration Suite
- CVE-2026-93639Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationZimbra Collaboration Suite
- CVE-2026-55826Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Pluginstape-io gtm-server-side-wordpress-plugin
- CVE-2026-93631Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account LinkingZimbra Collaboration Suite
- CVE-2026-53918odhcpd DHCPv6 IA dangling first pointer use-after-freeopenwrt odhcpd
- CVE-2026-53920odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosureopenwrt odhcpd
- CVE-2026-50053Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL ParametersZimbra Collaboration Suite
- CVE-2026-10632Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterZimbra Collaboration Suite
- CVE-2026-112849WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerabilityAivahThemes Hostme
- CVE-2026-112850WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerabilityAncoraThemes Your Dress
- CVE-2026-112852WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerabilityThemeREX Group Helion
- CVE-2026-112863WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerabilityHogash KALLYAS
- CVE-2026-115729@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypasspdfme common
- CVE-2026-115728@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsinghapijs @hapi/content · @hapi/content
- CVE-2026-99083ksmbd: fix heap out-of-bounds write in krb5_authenticate()Linux
- CVE-2026-99082KVM: x86: Use active memslots for the per-vCPU MMIO cacheLinux
- CVE-2026-55888XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversalflatpak xdg-desktop-portal
- CVE-2026-55889XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer keyflatpak xdg-desktop-portal
- CVE-2026-57210Heimdall: IP Spoofing via Unvalidated Forwarding Headersdadrus heimdall · https://github.com/dadrus/heimdall +1
- CVE-2026-57209Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Modedadrus heimdall · github.com/dadrus/heimdall
- CVE-2026-99081bnxt_en: fix DMA mapping length for padded small packetsLinux
- CVE-2026-99077ipv4: udp: Create exceptions before socket matchingLinux
- CVE-2026-99064cipso: adjust cached option offsets when removing CIPSOLinux
- CVE-2026-99059wireguard: noise: reject response consumption after intermediate initiationLinux
- CVE-2026-99056strparser: make sure __strp_recv isn't running before tearing down the parserLinux
- CVE-2026-99054tipc: destroy topsrv workqueues before closing connectionsLinux
- CVE-2026-99053tipc: hold a reference to nodes found by link nameLinux
- CVE-2026-99051fsverity: RCU-delay the freeing of struct fsverity_infoLinux
- CVE-2026-99050gpio: mpsse: fix race when arming the IRQ poll workerLinux
- CVE-2026-99046gve: fix XSK buffer leak on error descriptorLinux
- CVE-2026-99042io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6Linux
- CVE-2026-99032net/smc: protect clcsock lifetime in smc_getnameLinux
- CVE-2026-99030net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()Linux
- CVE-2026-99018riscv: entry: gate shadow call stack reload on sstatus.SPP, not tpLinux
- CVE-2026-99017riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITELinux
- CVE-2026-99016riscv: futex: untag the user pointer before the atomic accessLinux
- CVE-2026-99014Bluetooth: hci_sync: Fix command skb lifetime during scan setupLinux
- CVE-2026-99013Bluetooth: ISO: Reject concurrent BIS listener setupLinux
- CVE-2026-99012Bluetooth: ISO: Serialize concurrent connect callsLinux
- CVE-2026-99011Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()Linux
- CVE-2026-99006drm/i915/gem: Prevent overstepping exec array boundaryLinux
- CVE-2026-99002drm/vmwgfx: validate pitch coming from userspaceLinux
- CVE-2026-98999drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpinLinux
- CVE-2026-98995namespace: reset the old parent's ->overmount in mnt_change_mountpoint()Linux
- CVE-2026-98993namespace: don't inherit MNT_UMOUNT in clone_mnt()Linux
- CVE-2026-98991namespace: queue a mount only once for mount notificationsLinux
- CVE-2026-98988namespace: keep covered mounts covered in OPEN_TREE_NAMESPACELinux
- CVE-2026-98982namespace: don't let a pseudo dentry become the root of a mountLinux
- CVE-2026-98981namespace: unhash a dentry before detaching the mounts on itLinux
- CVE-2026-98980namei: don't reveal overmounted entries in refwalkLinux
- CVE-2026-98978namespace: never expire a locked mountLinux
- CVE-2026-98976namespace: keep the lock on a mount that a propagated copy is moved beneathLinux
- CVE-2026-98975xfs: stop exchanging reflink flags when exchanging mappingsLinux
- CVE-2026-98974xfs: fix exchange-range-to-eof file size exchangeLinux
- CVE-2026-98968amt: send the relay's General Query directly from the receive pathLinux
- CVE-2026-98965ice: Restore Ordered MMIO Writes for Tx DoorbellsLinux
- CVE-2026-98964nvmet: use the local P2P device on metadata allocation failureLinux
- CVE-2026-98952pfcp: make sure the SEID is linear before reading itLinux
- CVE-2026-98945HID: steam: Rearrange teardown sequenceLinux
- CVE-2026-98944HID: steam: Refactor registrationLinux
- CVE-2026-63120PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File WriteAiven-Open pghoard
- CVE-2026-98941ext4: don't enable large folios on encrypted inodesLinux
- CVE-2026-98932EDAC/altera: Fix use-after-free in error pathsLinux
- CVE-2026-57117PraisonAI: Compute-bridged file tools allow shell command injectionMervinPraison PraisonAI · praisonai
- CVE-2026-57146PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by defaultMervinPraison PraisonAI
- CVE-2026-57144PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailableMervinPraison PraisonAI
- CVE-2026-57142PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yamlMervinPraison PraisonAI
- CVE-2026-57121PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform APIMervinPraison PraisonAI · praisonai-platform
- CVE-2026-98927KVM: arm64: nv: Fix life cycle of the nested_mmus arrayLinux
- CVE-2026-57114PraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingMervinPraison PraisonAI · praisonai
- CVE-2026-57113PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletionMervinPraison PraisonAI · praisonai
- CVE-2026-56840PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous toolsMervinPraison PraisonAI · praisonai
- CVE-2026-56838PraisonAI recipe.run_stream skips dangerous-tool policy enforcementMervinPraison PraisonAI · praisonai
- CVE-2026-56837PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missingMervinPraison PraisonAI · praisonai
- CVE-2026-56836PraisonAI recipe serve Typer command bypasses the non-localhost authentication guardMervinPraison PraisonAI · praisonai
- CVE-2026-56835PraisonAI Slack app_mention bypasses configured user/channel authorizationMervinPraison PraisonAI · praisonai
- CVE-2026-56834PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storageMervinPraison PraisonAI · praisonai
- CVE-2026-56833PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversalMervinPraison PraisonAI · praisonai
- CVE-2026-56832PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvalsMervinPraison PraisonAI · praisonai
- CVE-2026-98911dpaa2-switch: fix the error path in dpaa2_switch_rx()Linux
- CVE-2026-98899netfilter: ipset: mark the rcu locked areas properlyLinux
- CVE-2026-112904Vvveb: Path Traversal in nextRestore() and nextBackup()givanz Vvveb
- CVE-2026-98895net/mlx5: HWS, Handle destroying table that has a miss tableLinux
- CVE-2026-98889wifi: iwlwifi: mvm: fix sched scan IE sizingLinux
- CVE-2026-98870ksmbd: remove stale channels from all sessions on teardownLinux
- CVE-2026-115726Aider through 0.86.2 Command Execution via Repository .aider.conf.yml SettingsAider-AI aider
- CVE-2026-115723Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletiondavenardella snap7
- CVE-2026-16762Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qtqt
- CVE-2026-89320HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrityEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-25716BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking usersHallo Welt! BlueSpice
- CVE-2025-30052Authentication Bypass via IP Spoofing in CGM CLININET rsyncdCGM CLININET
- CVE-2025-30049Use of Unsalted MD5 Password Hashes in CGM CLININETCGM CLININET
- CVE-2025-30045Code Injection in CGM CLININETCGM CLININET
- CVE-2025-30043Missing Authentication in CGM CLININETCGM CLININET
- CVE-2026-112835WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRentCar
- CVE-2026-112837WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerabilityRuben Garcia GamiPress
- CVE-2026-112359WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerabilityAmauri.IO WPMobile.App
- CVE-2026-112838WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRentCar
- CVE-2026-75775Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands wASUS Router
- CVE-2026-93489Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket…ASUS Router
- CVE-2026-75779Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS ASUS Router
- CVE-2026-94268Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionAdvanced Custom Fields: Extended
- CVE-2026-94262Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update ActionAdvanced Custom Fields: Extended
- CVE-2026-113500LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display OptimizationLiteSpeed Cache
- CVE-2026-113499LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS RewritingLiteSpeed Cache
- CVE-2026-111982Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email ChangeUser Profile Builder
- CVE-2026-109936Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render FilterOtter Blocks
- CVE-2026-107858Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development ServerGoogle Agent Development Kit (ADK) for Java
- CVE-2026-109198Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration ParameterCleanTalk Anti-Spam – Complete Spam Protection
- CVE-2026-115497Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parametercodepeople Music Store – WordPress eCommerce
- CVE-2026-86055Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account TakeoverPart-DB-server
- CVE-2026-115546Authentication Source Verification Issue in Okta Access GatewayOkta Access Gateway
- CVE-2026-19678Server-Side Request Forgery (SSRF) Leading to Internal Solr Data DisclosureonPhase Forms
- CVE-2026-115486Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoningRed Hat Enterprise Linux
- CVE-2026-115484Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msgRed Hat Enterprise Linux
- CVE-2025-45528An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF
- CVE-2026-106763An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and…@justice8096/sagemath-mcp-server
- CVE-2026-106764An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.@rog0x/mcp-git-tools
- CVE-2026-106765An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.@rog0x/mcp-docker-tools
- CVE-2026-50787e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php.
- CVE-2026-52356An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execut
Medium, low and unrated 290
- GHSA-H4FR-CMH5-QR62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootfallow · @fallow-cli/fallow-node +3
- GHSA-8C8M-P3M8-CJG8Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientnodemailer
- GHSA-M943-M63M-W62WNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientnodemailer
- GHSA-85X2-Q946-CP5HNodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not namenodemailer
- CVE-2026-115801Kakao khaiii JSON Config File Linear.cpp open out-of-boundsKakao khaiii
- GHSA-XMJ3-9GF7-H52Wsetuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Descriptionsetuptools
- CVE-2026-115897Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyyahoo serialize-javascript · serialize-javascript
- GHSA-7XGJ-8392-5Q4RFastMCP: Post-transform component authorization is skipped on direct callsfastmcp · fastmcp-slim
- GHSA-VQQP-X5QM-5QP4FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorifastmcp · fastmcp-slim
- CVE-2026-115892Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typebytecodealliance wasmtime · wasmtime
- CVE-2026-115886MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsmlflow
- CVE-2026-115885LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputlangchain-ai langgraph · langgraph-cli
- CVE-2026-115883LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storeslangchain-ai langgraph · langchain-ai langgraph-checkpoi… +3
- CVE-2026-113951If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetesApple Container
- CVE-2026-75525OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenantopen-reception appointment-booking-software
- CVE-2026-115800UbiquitousLearning mllm Convertor __init__.py load_model path traversalUbiquitousLearning mllm
- CVE-2026-75524OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agentopen-reception appointment-booking-software
- CVE-2026-115877Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Valuetwisted
- CVE-2026-83813Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validationtwisted
- CVE-2026-115774Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCHtwisted
- CVE-2026-113877HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressionsHTTP-Headers-ActionPack
- CVE-2026-115797Tenda F6 Web Management cleartext transmissionTenda F6
- CVE-2026-79981DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofingzephyrproject zephyr
- CVE-2026-79980Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNSzephyrproject zephyr
- CVE-2026-79978Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read pathzephyrproject zephyr
- CVE-2026-115796Tenda F6 Web Management cross-site request forgeryTenda F6
- CVE-2026-115845Incomplete validation in the run_script Python sandbox in AWS MCP ServerAWS MCP Server
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootfallow-rs fallow · @fallow-cli fallow-node +6
- CVE-2026-115813Server-side request forgery in the model download path in Amazon Web Services Multi Model ServerAWS multi-model-server
- CVE-2026-115567Tokio: Race condition in `tokio::time::Interval`tokio-rs tokio · tokio
- CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the nodejs node
- CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(nodejs node
- CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allnodejs node
- CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connectsnodejs node
- CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central nodejs node
- CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.nodejs node
- CVE-2026-115810Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URLTandoorRecipes recipes
- CVE-2026-49442Cacti: User Enumeration via Error Messagescacti
- CVE-2026-46531Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)cacti
- CVE-2026-55222Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrapilbers isar
- CVE-2026-55465Goobi viewer: Solr injection via unvalidated region parameter in spatial searchintranda goobi-viewer-core
- CVE-2026-55463Goobi viewer: WebSocket endpoints lack server-side authentication and origin validationintranda goobi-viewer-core
- CVE-2026-112333GFI Archiver < 15.14 Stored XSS via MailInsights.aspxGFI Software GFI Archiver
- CVE-2026-55444Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parametersintranda goobi-viewer-core
- CVE-2026-46347Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Resetintranda goobi-viewer-core
- CVE-2026-46346Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Resetintranda goobi-viewer-core
- CVE-2026-55442Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injectionintranda goobi-viewer-core
- CVE-2026-115786Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionZimbra Collaboration Suite
- CVE-2026-115785Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressZimbra Collaboration Suite
- CVE-2026-114623baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosurebaserproject basercms
- CVE-2026-57207NetBox MCP Server: HTTP transport exposes all NetBox data without authenticationnetboxlabs netbox-mcp-server
- CVE-2026-57208Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindentireio cli · github.com/entireio/cli
- CVE-2026-115480baserCMS: Public Web API mail-form submission bypasses image CAPTCHAbaserproject basercms
- CVE-2026-115479baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipientsbaserproject basercms
- CVE-2026-93638Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme ParameterZimbra Collaboration Suite
- CVE-2026-93636Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameZimbra Collaboration Suite
- CVE-2026-93634Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File RecordsZimbra Collaboration Suite
- CVE-2026-93633Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet CharactersZimbra Collaboration Suite
- CVE-2026-93630Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname CanonicalizationZimbra Collaboration Suite
- CVE-2026-55606odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()openwrt odhcpd
- CVE-2026-115754serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function bodyyahoo serialize-javascript · serialize-javascript
- CVE-2026-93629Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer IdentityZimbra Collaboration Suite
- CVE-2026-93628Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee ResponseZimbra Collaboration Suite
- CVE-2026-93627Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST OrganizerZimbra Collaboration Suite
- CVE-2026-115752Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIconsignalk-server
- CVE-2026-115751mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostnameagentfront mcp-from-openapi
- CVE-2026-115750mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirectsagentfront mcp-from-openapi
- CVE-2026-115749hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Importhydra-ecosystem hydra-ray-launcher
- CVE-2026-115730i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrli18next-http-backend
- CVE-2026-99087dm-integrity: fix NULL pointer dereference when the 'R' flag is usedLinux
- CVE-2026-99086dm-integrity: validate the superblock on resumeLinux
- CVE-2026-99085sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF schedulerLinux
- CVE-2026-99084readdir: take no inode lock on an immutable directoryLinux
- CVE-2026-55190Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event importeventschedule
- CVE-2026-99080fs: Free any excess xarray nodes in clear_inode()Linux
- CVE-2026-99076ipv6: udp: Create exceptions before socket matchingLinux
- CVE-2026-99075rust_binder: reschedule node refcount update on thread exitLinux
- CVE-2026-99074ipv4: stop PMTU walk when nexthop group shrinksLinux
- CVE-2026-99073ipv4: stop exception dump when nexthop group shrinksLinux
- CVE-2026-99072ipv4: stop route notification sizing when nexthop group shrinksLinux
- CVE-2026-99071ipv4: do not warn on route notification size raceLinux
- CVE-2026-99070ipv6: do not warn on route notification size raceLinux
- CVE-2026-99069Input: ati_remote2 - fix type confusion in device attribute handlersLinux
- CVE-2026-99068ALSA: ctxfi: Fix memory leakage when clearing DAO input mappersLinux
- CVE-2026-99067btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()Linux
- CVE-2026-99066can: dev: init_can_skb(): restore skb header initializationLinux
- CVE-2026-99065cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()Linux
- CVE-2026-99063dm ioctl: don't let data_start run past the bufferLinux
- CVE-2026-99062vsock/virtio: account only unread bytes in read_skb()Linux
- CVE-2026-99061wifi: brcmfmac: fix P2P device removal race in brcmf_detach()Linux
- CVE-2026-99060wifi: mt76: mt7603: initialize global station WCIDLinux
- CVE-2026-99058workqueue: Fix NULL current_pwq deref in chained work checkLinux
- CVE-2026-99057xen/netfront: don't leak the skb when xennet_fill_frags() failsLinux
- CVE-2026-99055tcp: reject net_iov in zerocopy receive mapping hintsLinux
- CVE-2026-99052selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_optsLinux
- CVE-2026-99049gpio: xilinx: fix runtime PM leak on request error pathLinux
- CVE-2026-99048gve: fix napi_disable deadlock when attempting to disable XSK poolsLinux
- CVE-2026-99047gve: fix XSK buffer leak when rings are stoppedLinux
- CVE-2026-99045ibmveth: h_free logical LAN on open-fail after registerLinux
- CVE-2026-99044ice: fix use-after-free in dynamic port cleanupLinux
- CVE-2026-99043ice: fix metadata_dst refcount handling on representor teardownLinux
- CVE-2026-99041ip6_gre: remove obsolete ERSPAN PMTU updateLinux
- CVE-2026-99040KEYS: Fix add_key() race with keyring restrictionLinux
- CVE-2026-99039memstick: core: wait for request completion before freeing cardLinux
- CVE-2026-99038memstick: rtsx_usb_ms: complete requests after eject instead of dropping themLinux
- CVE-2026-99037dm-crypt: reject the lmk IV mode with AEAD ciphersLinux
- CVE-2026-99036dm: fix reading free memory in do_resumeLinux
- CVE-2026-99035mmc: mtk-sd: Cancel request timeout work on removeLinux
- CVE-2026-99034mmc: sdhci-sprd: disable runtime PM on removeLinux
- CVE-2026-99033net/packet: guard the ll header push in packet_rcv_spkt()Linux
- CVE-2026-99031net: bridge: avoid recursive multicast port cleanupLinux
- CVE-2026-99029net: sparx5: free the matchall entry on destroyLinux
- CVE-2026-99028net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stopLinux
- CVE-2026-99027net: team: stop reusing skb after queue overrideLinux
- CVE-2026-99026net: team: free skb when broadcast has no txable portLinux
- CVE-2026-55422conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboardconda-forge.github.io
- CVE-2026-99025openvswitch: fix soft lockup in the netlink flow dumpLinux
- CVE-2026-99024optee: register TEE devices only once fully initializedLinux
- CVE-2026-99023power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()Linux
- CVE-2026-99022regulator: ltc3676: don't read the write-only HRST and CLIRQ registersLinux
- CVE-2026-99021regulator: of: fill in supply names in of_regulator_bulk_get_all()Linux
- CVE-2026-99020regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4Linux
- CVE-2026-99019scsi: ch: Do not keep references to data transfer element devicesLinux
- CVE-2026-99015Bluetooth: hci_sock: Serialize dead-device detachmentLinux
- CVE-2026-99010Bluetooth: RFCOMM: free the skb when the DLC has no ownerLinux
- CVE-2026-99009Bluetooth: RFCOMM: connect the session socket without rfcomm_mutexLinux
- CVE-2026-99008Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdownLinux
- CVE-2026-99007drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAINLinux
- CVE-2026-99005drm/i915/gt: Unmask interrupts only when ACTIVE is trueLinux
- CVE-2026-99004drm/imagination: Size page table preallocation by device addressLinux
- CVE-2026-99003drm/panthor: validate userspace queue count against initialized firmware slot countLinux
- CVE-2026-99001drm/xe/i2c: cancel the client work on removeLinux
- CVE-2026-99000drm/xe: Fix shrinker accounting double-subtraction on nested external pinsLinux
- CVE-2026-98998drm/bridge: th1520-dw-hdmi: Fix remove() callbackLinux
- CVE-2026-98997drm/amdgpu/userq: only accept doorbell BOs as queue doorbellLinux
- CVE-2026-98996fs: don't silently unmount busy mountsLinux
- CVE-2026-98994statmount: read the parent of an unmounted mount under mount_lockLinux
- CVE-2026-98992namespace: don't copy an unmounted mount treeLinux
- CVE-2026-98990namespace: check a submount for references right before unmounting itLinux
- CVE-2026-98989namespace: check a recursive bind mount for mount namespace loopsLinux
- CVE-2026-98987namespace: look at the topmost mount for a mount namespace fileLinux
- CVE-2026-98986namespace: remove the fsnotify marks of a mount namespace in process contextLinux
- CVE-2026-98985namespace: check the mounts before reading their parents in pivot_root()Linux
- CVE-2026-98984dcache: don't put a mountpoint on a dentry that's being removedLinux
- CVE-2026-98983unshare: don't drop active namespace references that were never takenLinux
- CVE-2026-98979namespace: refuse an automount below a mount that is in no namespaceLinux
- CVE-2026-98977namespace: handle mount locking for automounts correctlyLinux
- CVE-2026-98973drm/bridge: Fix unlocked list_del in drm_bridge_add()Linux
- CVE-2026-98972cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()Linux
- CVE-2026-98971gpio: exar: initialize the ID before registering its cleanupLinux
- CVE-2026-98970drm/vc4: Free the BO cache size list on teardownLinux
- CVE-2026-98969net/sched: em_text: reject unterminated algo before autoloadLinux
- CVE-2026-98967cxgb4/ch_ktls: disable softirqs around tid_list erasesLinux
- CVE-2026-98966bonding: fix the program leak when XDP is replacedLinux
- CVE-2026-98963btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endioLinux
- CVE-2026-98962btrfs: free iov when btrfs_uring_read_extent() failsLinux
- CVE-2026-98961btrfs: unlock inode and extent in caller when io_uring read extent failsLinux
- CVE-2026-98960btrfs: don't stash io_uring encoded data across -EAGAINLinux
- CVE-2026-98958wifi: mt76: account non-AQL frames per peer rather than per linkLinux
- CVE-2026-98957wifi: mt76: mt7915: disable rx napi when removing deviceLinux
- CVE-2026-98956ASoC: adau1372: allow sleepy powerdown GPIOsLinux
- CVE-2026-98955flow_dissector: avoid u16 truncation of skb->len when computing thoffLinux
- CVE-2026-98954net: always dissect GSO packets in __virtio_net_hdr_to_skb()Linux
- CVE-2026-98953devlink: fix devlink_rel reference leak when notify work is pendingLinux
- CVE-2026-98951riscv: ptrace: Zero-initialize regset buffers before copyinLinux
- CVE-2026-98950flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()Linux
- CVE-2026-98949drm/imagination: Fix reference and vm_bo handling in remap()Linux
- CVE-2026-98948mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()Linux
- CVE-2026-98947vsock: Fix memory leak in vmci_transport_recv_dgram_cb()Linux
- CVE-2026-98946drm/vc4: Disable the V3D interrupt across runtime suspendLinux
- CVE-2026-54711PGHoard: Password written to debug logAiven-Open pghoard · pghoard
- CVE-2026-98942sched_ext: Build the cid tables privately and publish them with RCULinux
- CVE-2026-98940ASoC: qcom: lpass-cpu: use DAI table index for playback constraintsLinux
- CVE-2026-98939x86/mm: Drop unnecessary PMD page copy when freeingLinux
- CVE-2026-98938rust: irq: pass RegistrationInner as cookie to request_irqLinux
- CVE-2026-98937perf/core: Check kernel access when kernel callchains are requestedLinux
- CVE-2026-98936wifi: ath11k: reset ar->num_stations on hardware startLinux
- CVE-2026-98935rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leakLinux
- CVE-2026-98934ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()Linux
- CVE-2026-98933usb: hub: use shorter 120ms post resume hold for SS root hubsLinux
- CVE-2026-98931mtd: spinand: fix NULL pointer dereference with no ECC engineLinux
- CVE-2026-98930KVM: s390: Fix IRQ injection with SIGP Stop and Store StatusLinux
- CVE-2026-98929macsec: initialize SecY before registering the netdeviceLinux
- CVE-2026-98928KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2Linux
- CVE-2026-98926drm/amd/display: Remove sink usage from DPMSLinux
- CVE-2026-98925bpf, sockmap: Fix self-redirect copied_seq double-countingLinux
- CVE-2026-98924fs: avoid repeated scans in evict_inodes()Linux
- CVE-2026-98923arm64: io: Reject non-user protection in ioremap_prot()Linux
- CVE-2026-98922net: emac: move setting of netops to fix crashLinux
- CVE-2026-98921ovl: fix UAF in ovl_do_mkdir() debug printLinux
- CVE-2026-98920netfs: Fix missing alloc tagging of direct mempool allocationsLinux
- CVE-2026-98919drm/xe: harden adjust_idledly() against divide-by-zero and overflowLinux
- CVE-2026-98918mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()Linux
- CVE-2026-98917parisc: Increase kernel stack size to 32kbLinux
- RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-timecrypto-bigint
- CVE-2026-98916wifi: nl80211: check link is beaconing for color changeLinux
- CVE-2026-98915media: video-i2c: use vb2_video_unregister_device on driver removalLinux
- CVE-2026-98914drm/amdgpu: cap ATOM command table nesting depthLinux
- CVE-2026-98913net: thunderx: fix PTP device ref leak in nicvf_probe()Linux
- CVE-2026-98912ALSA: seq: oss: Reject reads that cannot fit the next eventLinux
- CVE-2026-98910drm/amdkfd: Unwind debug trap enable on copy_to_user failureLinux
- CVE-2026-98909net: cpsw_new: unregister devlink on port registration failureLinux
- CVE-2026-98908net: microchip: sparx5: clean up PSFP resources on flower setup failureLinux
- CVE-2026-98907btrfs: protect sb_write_pointer() with invalidate lockLinux
- CVE-2026-98906net: lan966x: restore RX state on reload failureLinux
- CVE-2026-98905drm/amdkfd: Properly acquire queue buffers in CRIU restoreLinux
- CVE-2026-98904mailbox: imx: Use devm_pm_runtime_enable()Linux
- CVE-2026-98903mailbox: imx: Add a channel shutdown fieldLinux
- CVE-2026-98902md/raid5: let stripe batch bm_seq comparison wrap-safeLinux
- CVE-2026-98901ksmbd: fix lease break and ack state handlingLinux
- CVE-2026-98900xen/gntalloc: validate grant count before allocationLinux
- CVE-2026-98898drm/amd/pm/si: Don't schedule thermal work when queue isn't initializedLinux
- CVE-2026-98897ksmbd: don't hold ci->m_lock while waiting for a lease break ackLinux
- CVE-2026-98896thunderbolt: Keep the domain reference while processing hotplugLinux
- CVE-2026-98894drm/amd/ras: reset CPER ring on corrupt entry sizeLinux
- CVE-2026-98893firmware: arm_scmi: Validate SENSOR_UPDATE payload sizeLinux
- CVE-2026-98892firmware: arm_scmi: Validate BASE_ERROR_EVENT payload sizeLinux
- CVE-2026-98891wifi: mac80211: validate deauth frame length before reason accessLinux
- CVE-2026-98890wifi: libertas: reject short monitor TX framesLinux
- CVE-2026-98888arm64: kprobes: Allow reentering kprobes while single-steppingLinux
- CVE-2026-98887wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFOLinux
- CVE-2026-98886drm/gma500: return errors from Oaktrail HDMI I2C readsLinux
- CVE-2026-98885ima: return error early if file xattr cannot be changedLinux
- CVE-2026-98884mmc: core: Add validation for host-provided max_segsLinux
- CVE-2026-98883serial: 8250_port: recognize UPIO_AULinux
- CVE-2026-98882media: chips-media: wave5: Add range checks for dec_output_infoLinux
- CVE-2026-98881net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()Linux
- CVE-2026-98880ntfs3: handle set_blocksize failuresLinux
- CVE-2026-98879isofs: handle set_blocksize failuresLinux
- CVE-2026-98878irqchip/gic-v5: Immediately exec priority drop following activateLinux
- CVE-2026-98877irqchip/gic-v4: Don't advertise VLPIs if no ITS is probedLinux
- CVE-2026-98876host1x: bus: Fix missing ops null check in error teardownLinux
- CVE-2026-98875drm/nouveau/gsp: add SEC2 to GA100 chip tableLinux
- CVE-2026-98874wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetectLinux
- CVE-2026-98873netfilter: nf_conntrack_expect: zero at allocation timeLinux
- CVE-2026-98872freevxfs: don't BUG() on unknown typed-extent typeLinux
- CVE-2026-98871crypto: ccp - Fix possible deadlock in SEV init failure pathLinux
- CVE-2026-115725Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_idchatwoot
- CVE-2026-115724VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment ProviderVideoLAN VLC for Android
- CVE-2026-115722RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Headerdiegonehab rply
- CVE-2026-95620Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qtqt
- CVE-2026-94263Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success MessageAdvanced Custom Fields: Extended
- CVE-2026-111965Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA BypassProfile Builder
- CVE-2026-105963Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentselixir-plug plug · elixir-plug plug_crypto +2
- CVE-2026-89319JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89318JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)Eclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89317JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)Eclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89316LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertionEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89315JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffixEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89314Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89313JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2026-89312AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEclipse Foundation Eclipse KeyPont - GOSE
- CVE-2025-58403Reflected Cross-Site Scripting (XSS) in CGM CLININETCGM CLININET
- CVE-2025-30053Missing Authentication in CGM CLININETCGM CLININET
- CVE-2025-30051Insecure File Permissions in CGM CLININETCGM CLININET
- CVE-2026-115657KNIME Analytics Platform logs credentials of configured proxy when used as an executorKNIME Analytics Platform
- CVE-2026-112821WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerabilityKnit Pay
- CVE-2026-112825WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerabilityMagepeople Car Rental Manager
- CVE-2026-4952Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystemVertiGIS WebOrderSystem
- CVE-2026-4951Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystemVertiGIS WebOrderSystem
- CVE-2026-4950Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystemVertiGIS WebOrderSystem
- CVE-2026-63243Firmware verification vulnerabilityCreative Labs Creative Sound Blaster Katana V2, V2X, SE
- CVE-2026-94264Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode AttributesAdvanced Custom Fields: Extended
- CVE-2026-113501LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice DismissalLiteSpeed Cache
- CVE-2026-113472Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media UploadDepicter — Popup & Slider Builder
- CVE-2026-112230Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type ParameterPopup Builder
- CVE-2026-112219Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST RouteDownload Monitor
- CVE-2026-111966Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode AttributeUser Profile Builder
- CVE-2026-111738Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-optionSpeed Optimizer
- CVE-2026-111737Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL ListsSpeed Optimizer
- CVE-2026-110537Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk ActionEssential Addons for Elementor
- CVE-2026-110510Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title TagEssential Addons for Elementor
- CVE-2026-109935Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST APIOtter Blocks
- CVE-2026-109934Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST APIOtter Blocks
- CVE-2026-109933Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style AttributesOtter Blocks
- CVE-2026-55835Lookyloo: Potential sub-system DoS due to parameter missmatch in notificationlookyloo
- CVE-2026-86020Part-DB: Spreadsheet Formula Injection in XLSX Part ExportsPart-DB-server
- CVE-2026-86019Part-DB: Attachment Size Limit Bypass via API Base64 UploadPart-DB-server
- CVE-2026-86018Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment DownloadsPart-DB-server
- CVE-2026-59188Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment ViewerPart-DB-server
- CVE-2026-55600Part-DB: Stored HTML injection in BOM validation results via unescaped Part namePart-DB-server
- CVE-2026-54631Part-DB: Hardcoded APP_SECRET enables forged remember-me cookiePart-DB-server
- CVE-2026-90458OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service.OpenStack Ironic
- CVE-2026-54615Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)Part-DB-server
- CVE-2026-89419OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in otherOpenStack Ironic
- CVE-2026-115638OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka aOpenStack Ironic
- CVE-2026-115537gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirectgedelumbung HospitalManagement
- CVE-2026-115536gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scriptinggedelumbung HospitalManagement
- CVE-2026-115485Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuioRed Hat Enterprise Linux
- CVE-2026-115535gedelumbung HospitalManagement Settings sistem.php simpan cross site scriptinggedelumbung HospitalManagement