CVEs published November 5, 2026
468 CVEs were published on November 5, 2026: 38 critical, 172 high. 12 early warnings were posted.
- Published
- 468
- Critical
- 38
- High
- 172
- Medium
- 121
- Low
- 20
- Unrated
- 117
- Now in CISA KEV
- 0
- Fix available
- 364
- Early warnings
- 12
Most affected products
- Apache Software Foundation Apache OFBiz
- 46
- Samsung Semiconductor Exynos
- 34
- SuiteCRM
- 31
- kyverno
- 21
- signalwire freeswitch
- 21
- openemr
- 16
- Red Hat Build of Keycloak · Red Hat Single Sign-On
- 14
- tinyhumansai openhuman
- 10
- kubeflow pipelines
- 9
- TPC Software Matchpoint
- 7
Early warnings 12
- SZB-38f944c737DreamHost warns attackers accessed File Manager and stole customer FTP/SFTP credentialsDreamHost · File Manager
- SZB-fe91205eadPhishing campaign reportedly steals Microsoft and Google account credentialsMicrosoft · SharePoint
- SZB-2de54e00e4mSeven Software warns mSecure users after cyberattack reportedly exposed customer databasemSeven Software · mSecure Cloud
- SZB-f2f032fedbOpenSSH flaw reportedly allows login to password-disabled musl-based Linux accountsOpenSSH · sshd
- SZB-56bfa02295Trojanized CWP web server reportedly spreads CWPdoor Linux backdoorControl Web Panel · cwpsrv
- SZB-58fbd93471DigiCert warns of breach exposing customer data and identity documentsDigiCert
- SZB-e57f3ab75fCISA warns attackers are exploiting a patched high-severity WordPress flawWordPress · WordPress Core
- SZB-fefdc7390eAnthropic declines to fix Claude Dispatch flaw enabling remote command executionAnthropic · Claude Desktop and Claude Dispatch
- SZB-2b061c991aChainalysis says some information on all users was exposed in cyberattackChainalysis
- SZB-9fb3d806b5CERT-In flags backdoored ARTEX exposing 62 consoles to root accessARTEX
- SZB-646da66be3CISA adds Apple authentication flaw CVE-2024-27834 to KEV catalogApple · iOS, iPadOS, macOS, Safari, tvOS and watchOS
- SZB-c7e59b0d46OpenAI reports 948 Linux kernel privilege escalation flaws found by AI pipelineOpenAI · Linux kernel
Critical 38
- CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploadskubeflow pipelines
- CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint Android appTPC Software Matchpoint
- CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the MatchPoint APITPC Software Matchpoint
- CVE-2026-111489A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platformTPC Software Matchpoint
- CVE-2026-119757BTCPay Server < 2.4.2 LND Macaroon Credential File DisclosureBTCPay Server
- CVE-2026-48705MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)Project-MONAI MONAI · monai
- CVE-2026-85076Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)jhuckaby Cronicle
- CVE-2026-46350dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASSdcmjs-org dcmjs · dcmjs
- CVE-2026-102940OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignmentopenemr
- CVE-2026-116790FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITYsignalwire freeswitch
- CVE-2026-116779FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commandssignalwire freeswitch
- CVE-2026-116785FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handlingsignalwire freeswitch
- CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP InjectionSuiteCRM
- CVE-2026-71550SuiteCRM: LFI to RCE via AOW_WorkFlowSuiteCRM
- CVE-2026-123198LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>LMFDB
- CVE-2026-54143OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command executiontinyhumansai openhuman
- CVE-2026-54141OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`tinyhumansai openhuman
- CVE-2026-119344Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacksultravioletrs cocos
- CVE-2026-82907Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundApache Software Foundation Apache OFBiz
- CVE-2026-83542Apache OFBiz: Unauthenticated RCE via login-page widget injectionApache Software Foundation Apache OFBiz
- CVE-2026-117691Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-121489Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryApache Software Foundation org.apache.juneau:juneau-microse…
- CVE-2026-96677Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeApache Software Foundation org.apache.juneau:juneau-marshall
- CVE-2026-73117Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73116Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsApache Software Foundation org.apache.juneau:juneau-rest-cl…
Show all 38 entriesShow fewer entries
- CVE-2026-73101Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73100Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73099Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body overrideApache Software Foundation org.apache.juneau:juneau-rest-se…
- CVE-2026-73098Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingApache Software Foundation org.apache.juneau:juneau-marshall
- CVE-2026-100109Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userSecurity For WooCommerce
- CVE-2026-123025An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin…OPNsense os-acme-client
- CVE-2026-122992In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty…G4KLX DStarGateway
- CVE-2026-122313Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicykyverno
- CVE-2026-122311Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argumentkyverno
- CVE-2026-122310Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPathkyverno
- CVE-2026-122304Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loaderkyverno
- CVE-2026-122303Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicykyverno
- CVE-2026-122302Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Checkkyverno
High 172
- CVE-2026-113663AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command executionag2ai ag2 · ag2ai autogen
- CVE-2026-92698FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds readpavel-odintsov fastnetmon
- CVE-2026-92697FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds readpavel-odintsov fastnetmon
- CVE-2026-92693FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parserpavel-odintsov fastnetmon
- CVE-2026-93424FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deploymentspavel-odintsov fastnetmon
- CVE-2026-92695FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated framespavel-odintsov fastnetmon
- CVE-2026-88981Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpointskubeflow pipelines
- CVE-2026-88980Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the…kubeflow pipelines
- CVE-2026-88984Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelineskubeflow pipelines
- CVE-2026-122267MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz- headers, letting a presigned PUT URL be…Chainguard MinIO
- CVE-2026-58273Rucio: Authorisation Bypass on REST API endpoint for signing URLsrucio
- CVE-2026-111493Lack of authentication and authorization in the Images.ashx endpoint in MatchPointTPC Software Matchpoint
- CVE-2026-111492SQL injection in the push notification handler of the MatchPoint Android appTPC Software Matchpoint
- CVE-2026-33944Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameterdolibarr · dolibarr/dolibarr
- CVE-2026-111770Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anothermodelcontextprotocol typescript-sdk · @modelcontextprotocol…
- CVE-2026-111768Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationmodelcontextprotocol typescript-sdk · @modelcontextproto… +1
- CVE-2026-49272OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowoauthlib
- CVE-2026-77622Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderBishopFox sliver
- CVE-2026-112902Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagspython-pillow Pillow
- CVE-2026-114604GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segmentsardatan graphql-tools · @graphql-tools/utils
- CVE-2026-34157Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOriginswailsapp wails · github.com/wailsapp/wails/v2
- CVE-2026-114134Black: GitHub Action installs unvalidated required-version from pyproject.tomlpsf black · black
- CVE-2026-87008Code Graph RAG structural tools follow out-of-root symlinksvitali87 code-graph-rag
- CVE-2026-77604Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readvitali87 code-graph-rag
- CVE-2026-115573OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumerationopenemr
Show all 172 entriesShow fewer entries
- CVE-2026-104133OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallopenemr
- CVE-2026-103935OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attributeopenemr
- CVE-2026-104136OpenEMR: Arbitrary Patient Recall and Contact Detail Readopenemr
- CVE-2026-103938OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operationsopenemr
- CVE-2026-104137OpenEMR: Patient Data Search Without Sufficient ACLopenemr
- CVE-2026-110930Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer.OpenAI Codex Desktop for Windows
- CVE-2026-65983OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootopenemr
- CVE-2026-116782FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handlingsignalwire freeswitch
- CVE-2026-116783FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery datasignalwire freeswitch
- CVE-2026-19134A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.OpenText Directory Services
- CVE-2026-116788FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decodingsignalwire freeswitch
- CVE-2026-116784FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsingsignalwire freeswitch
- CVE-2026-116789FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS serversignalwire freeswitch
- CVE-2026-116786FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofiasignalwire freeswitch
- CVE-2026-116787FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Lengthsignalwire freeswitch
- CVE-2026-116567FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handlingsignalwire freeswitch
- CVE-2026-116570FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authenticationsignalwire freeswitch
- CVE-2026-116569FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsingsignalwire freeswitch
- CVE-2026-116568FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsingsignalwire freeswitch
- CVE-2026-44875In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows…Hewlett Packard Enterprise (HPE) HPE Cray Programming Envir…
- CVE-2026-115928FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound callssignalwire freeswitch
- CVE-2026-100363SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)SuiteCRM
- CVE-2026-123273ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG DecoderImageMagick
- CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_listSuiteCRM
- CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related RecordSuiteCRM
- CVE-2026-100361SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)SuiteCRM
- CVE-2026-100364SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership HijackSuiteCRM
- CVE-2026-100365SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated UserSuiteCRM
- CVE-2026-71548SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full…SuiteCRM
- CVE-2026-69134SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship ManagementSuiteCRM
- CVE-2026-69141SuiteCRM: SQL injection via search param in modules/Cases/controller.phpSuiteCRM
- CVE-2026-69142SuiteCRM: Authenticated SQL Injection in map_markers distance ParameterSuiteCRM
- CVE-2026-69140SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.phpSuiteCRM
- CVE-2026-69136SuiteCRM: Authenticated SQL Injection In handleAttachments functionSuiteCRM
- CVE-2026-69135SuiteCRM: Authenticated SQL Injection In Project ModuleSuiteCRM
- CVE-2026-69137SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureSuiteCRM
- CVE-2026-61648SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.phpSuiteCRM
- CVE-2026-61650SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizationSuiteCRM
- CVE-2026-61653SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phpSuiteCRM
- CVE-2026-63213SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMSuiteCRM
- CVE-2026-123208noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Serverlibnoname noname
- CVE-2026-123205accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsqlaccel-ppp
- CVE-2026-123202libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML namebakulf libnxml
- CVE-2026-123200VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length indexVRPN
- CVE-2026-123196Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadataauthorizerdev authorizer
- CVE-2026-61649SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal servicesSuiteCRM
- CVE-2026-63215SuiteCRM: Time-Based Blind SQL Injection via REST APISuiteCRM
- CVE-2026-94395Stack-based buffer overflow in SafeNet Authentication Client SIS token engineThalesgroup Safenet Authentication Client SIS token engine
- CVE-2026-63214SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest apiSuiteCRM
- CVE-2026-61651SuiteCRM: Authenticated SQL Injection in get_end_date function in Project ControllerSuiteCRM
- CVE-2026-63111SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronSuiteCRM
- CVE-2026-118494Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9jreviews.com JReviews component for Joomla
- CVE-2026-107129Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-107903Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-105607Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-115452Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9…tassos.gr Advanced Custom Fields extension for Joomla · tas…
- CVE-2026-123184Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository WritesAltium
- CVE-2026-107359Malformed Wi-Fi Beacon Causes Crash on WF200Silicon Labs WF200 FW
- CVE-2026-54912WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatchbytecodealliance wasm-micro-runtime
- CVE-2026-54914WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Bufferbytecodealliance wasm-micro-runtime
- CVE-2026-77439Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpointsimmich-app immich
- CVE-2026-112109Local privilege escalation in SafeNet Authentication Client SACSrvThalesgroup Safenet Authentication Client Service
- CVE-2026-97847Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain…Red Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesRed Hat AMQ Broker · Red Hat Build of Keycloak +4
- CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerRed Hat AMQ Broker · Red Hat Build of Keycloak +4
- CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed…Red Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-92855Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-120859PyMoDAQ before 5.3.10 Arbitrary Code Execution via Crafted HDF5, Dock Layout, and XML Settings FilesPyMoDAQ · pymodaq_data +2
- CVE-2026-82965Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsingRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-120499h5io before 0.2.6 Arbitrary Code Execution via read_hdf5h5io
- CVE-2026-76077ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()esa asn1scc
- CVE-2026-75614ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)esa asn1scc
- CVE-2026-49407OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growthtinyhumansai openhuman
- CVE-2026-54142OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approvaltinyhumansai openhuman
- CVE-2026-54146OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)tinyhumansai openhuman
- CVE-2026-119083GluonTS arbitrary file write during archive extractionAWS gluonts
- CVE-2026-49393OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer tokentinyhumansai openhuman
- CVE-2026-54145OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)tinyhumansai openhuman
- CVE-2026-54140OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitizationtinyhumansai openhuman
- CVE-2026-102739ESPectre: Unsafe Deserialization on .npz dataset leads to Code Executionfrancescopace espectre
- CVE-2026-123151Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tailRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-121997Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatchRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-121996Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression lengthRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-121995Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tailRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-121994Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply lengthRed Hat Enterprise Linux · Red Hat Hardened Images
- CVE-2026-114232Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accessRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-112208Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first loginRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-110932Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cacheRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-110931Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loopRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-107602Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loopRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-103112Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-107123Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsingRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-82413ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)ntopng
- CVE-2026-119345Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacksultravioletrs cocos
- CVE-2026-104269ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)owasp-modsecurity ModSecurity
- CVE-2026-73856ModSecurity: Response Body Inspection Bypassowasp-modsecurity ModSecurity
- CVE-2026-123158sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass…OpenBSD OpenSSH
- CVE-2026-102615HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSSheyform
- CVE-2026-102523MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITIONMariaDB server
- CVE-2026-70659stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor nameleejet stable-diffusion.cpp
- CVE-2026-121139Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authenticationRapid7 Metasploit Framework
- CVE-2026-107891musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to…musl -libc musl
- CVE-2026-123096anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Responseanacrolix torrent
- CVE-2026-123095mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlinesmpv-player mpv
- CVE-2026-122329SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoderlibsdl-org SDL_mixer
- CVE-2026-122328SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoderlibsdl-org SDL_mixer
- CVE-2026-115738SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL…Trellix DLP on-prem extensions
- CVE-2026-119744Cendio ThinLinc Improper Authentication via Web AccessCendio ThinLinc
- CVE-2026-71901Apache OFBiz: Dispatch arbitrary internal services on SFA componentApache Software Foundation Apache OFBiz
- CVE-2026-82904Apache OFBiz: Unbounded multi-form row count from a parameter nameApache Software Foundation Apache OFBiz
- CVE-2026-82910Apache OFBiz: renderLink compiles link parameters as FreeMarker sourceApache Software Foundation Apache OFBiz
- CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameterApache Software Foundation Apache OFBiz
- CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any pathApache Software Foundation Apache OFBiz
- CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEApache Software Foundation Apache OFBiz
- CVE-2026-84183Apache OFBiz: Content Manager VIEW-only RCE in updateLayoutApache Software Foundation Apache OFBiz
- CVE-2026-107912Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawRed Hat Exploit Intelligence · Red Hat OpenShift Serverl… +8
- CVE-2026-105321SQL Injection in Kobikom Telecommunications' KobikomKobikom Telecommunications and Informatics Services Kobikom
- CVE-2026-123059Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEclipse Foundation Eclipse BaSyx Helm Charts
- CVE-2026-104720Path Traversal in Kobikom Telecommunications' KobikomKobikom Telecommunications and Informatics Services Kobikom
- CVE-2026-123047Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEclipse Foundation Eclipse BaSyx Helm Charts
- CVE-2026-73095Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingApache Software Foundation org.apache.juneau:juneau-marshal…
- CVE-2026-118869An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on…SHIRASAGI Project SHIRASAGI
- CVE-2026-109408vault-java-driver: SslConfig silently disables requested TLS verificationio.github.jopenlibs:vault-java-driver
- CVE-2026-123033Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their…iXsystems TrueNAS SCALE
- CVE-2026-123029Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the…Wowza Streaming Engine
- CVE-2026-123014iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary…iTerm2
- CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…Gogs · gogs.io/gogs
- CVE-2026-118193GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameterstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2026-116617Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-93389LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via…litespeedtech LiteSpeed Cache
- CVE-2026-123010@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.twilio-labs netlify-okta-auth
- CVE-2026-122323Kyverno 1.11.0 before 1.19.2 Memory Exhaustion via Notary Signature Decompressionkyverno
- CVE-2026-122322Kyverno from 1.11.0 before 1.19.2 Memory Exhaustion via Notary Attestation Decompressionkyverno
- CVE-2026-122321Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypasskyverno
- CVE-2026-122320Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clonekyverno
- CVE-2026-122319Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panickyverno
- CVE-2026-122318Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificateskyverno
- CVE-2026-122316Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExistingkyverno
- CVE-2026-122315Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panickyverno
- CVE-2026-122314Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panickyverno
- CVE-2026-122312Kyverno 1.19.1 before 1.19.2 Namespace Isolation Bypass via APICall URLPath Query Stringkyverno
- CVE-2026-122309Kyverno before 1.19.2 Denial of Service via Unbounded CEL Policy Evaluation Costkyverno
- CVE-2026-122308Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequestkyverno
- CVE-2026-122307Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handlingkyverno
- CVE-2026-122306Kyverno before 1.19.2 Denial of Service via Exponential-Time Wildcard Matchingkyverno
- CVE-2026-122305Kyverno before 1.19.2 Denial of Service via Nested Variable Substitution Loopkyverno
Medium, low and unrated 258
- CVE-2026-123268libyal libvmdk Extent Data File libvmdk_extent_table.c libvmdk_extent_table_get_extent_data_file_path memory corruptionlibyal libvmdk
- CVE-2026-85068NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msgnetworkupstools nut
- GO-2026-6893Event type spoofing via UntrustedType in github.com/google/go-eventloggithub.com/google/go-eventlog
- GO-2026-6905Panic on negative member size in Reader.Read in github.com/blakesmith/argithub.com/blakesmith/ar
- GO-2026-6909Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/samlgithub.com/crewjam/saml
- GO-2026-6911SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-gogithub.com/mark3labs/mcp-go
- GO-2026-6906Netfoil doesn't decrement TTL in github.com/tinfoil-factory/netfoilgithub.com/tinfoil-factory/netfoil
- GO-2026-6907Arc has unauthenticated application log disclosure via `/api/v1/logs` in github.com/basekick-labs/arcgithub.com/basekick-labs/arc
- GO-2026-6894anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS in…github.com/anacrolix/torrent
- GO-2026-6891charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users in…github.com/charmbracelet/soft-serve
- GO-2026-6892charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories in github.com/charmbracelet/soft-servegithub.com/charmbracelet/soft-serve
- GO-2026-6895imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash in…github.com/imgproxy/imgproxy · github.com/imgproxy/imgpr… +2
- GO-2026-6897imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution in…github.com/imgproxy/imgproxy · github.com/imgproxy/imgpr… +2
- GO-2026-6898imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field in…github.com/imgproxy/imgproxy · github.com/imgproxy/imgpr… +2
- GO-2026-6836SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized in…github.com/siyuan-note/siyuan/kernel
- GO-2026-6838Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echogithub.com/labstack/echo/v4 · github.com/labstack/echo/v5
- GO-2026-6839Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echogithub.com/labstack/echo/v4 · github.com/labstack/echo/v5
- GO-2026-6840Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echogithub.com/labstack/echo/v4
- GO-2026-6841Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echogithub.com/labstack/echo/v5
- GO-2026-6842Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echogithub.com/labstack/echo/v4
- CVE-2026-102943Dagu MCP DAG specification read bypasses path containment and workspace isolationdagucloud dagu
- CVE-2026-68509FairEmail: Path traversal in shared attachment handling can write files outside the intended shared directoryM66B FairEmail
- CVE-2026-110390FlexNet Beacon Missing Authentication VulnerabilityFlexera FlexNet Beacon · Flexera FlexNet Manager Suite
- CVE-2026-92694FastNetMon: IPv6 host counters map iterated without lock, racing concurrent insertspavel-odintsov fastnetmon
- CVE-2026-88982Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook…kubeflow pipelines
Show all 258 entriesShow fewer entries
- CVE-2026-88979Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxykubeflow pipelines
- CVE-2026-88986Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responseskubeflow pipelines
- CVE-2026-88985Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API serverkubeflow pipelines
- CVE-2026-111495API keys, credentials, and configuration parameters embedded in the MatchPoint APKTPC Software Matchpoint
- CVE-2026-88983Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationkubeflow pipelines
- CVE-2026-112908filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a…tox-dev filelock · filelock
- CVE-2026-111491Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesTPC Software Matchpoint
- CVE-2026-112938filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local…tox-dev filelock · filelock
- CVE-2026-112907filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breaktox-dev filelock · filelock
- CVE-2026-112913filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databasetox-dev filelock · filelock
- CVE-2026-112910filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLtox-dev filelock · filelock
- CVE-2026-100395LXC: lxc-copy host-context hostname update follows symlinklxc
- CVE-2026-111769Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom…modelcontextprotocol typescript-sdk · @modelcontextproto… +1
- CVE-2026-111771Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another servicemodelcontextprotocol typescript-sdk · @modelcontextproto… +3
- CVE-2026-77463Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymentumputun remark42
- CVE-2026-81190KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRFkurrent-io KurrentDB
- CVE-2026-111062A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestEugeny russh
- CVE-2026-110802Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandboxaltair-graphql altair · altair-graphql altair-express-mi… +3
- CVE-2026-112899Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitpython-pillow Pillow
- CVE-2026-54442NationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRFNationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2026-62268borg extract might modify out-of-tree files when extracting maliciously crafted archivesborgbackup borg
- CVE-2026-111753Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)angular
- CVE-2026-119434Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffersilviucpp ezstd · ezstd
- CVE-2026-55458Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughcaddyserver caddy · github.com/caddyserver/caddy/v2
- CVE-2026-103021OpenEMR: Username Enumeration via Pre-Authentication User Settings Loadingopenemr
- CVE-2026-103020OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versionsopenemr
- CVE-2026-103019OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpointopenemr
- CVE-2026-104134OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)openemr
- CVE-2026-103939OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryopenemr
- CVE-2026-104138OpenEMR: Missing authorization on QRDA Category I/III download endpointsopenemr
- CVE-2026-104135OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthopenemr
- CVE-2026-76181Heap buffer overflow in dBASE index importThe Document Foundation LibreOffice
- CVE-2026-104139OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHIopenemr
- CVE-2026-18159A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.OpenText Directory Services
- CVE-2026-76580Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services…OpenText Directory Services
- CVE-2026-116780FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicingsignalwire freeswitch
- CVE-2026-116781FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsingsignalwire freeswitch
- CVE-2026-116571FreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header constructionsignalwire freeswitch
- CVE-2026-1339Open redirect vulnerability - UCMDB/Operations Bridge ManagerOpenText Universal Discovery and CMDB · OpenText Operations…
- CVE-2026-116572FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-namesignalwire freeswitch
- CVE-2026-116574FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequencessignalwire freeswitch
- CVE-2026-116573FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header usersignalwire freeswitch
- CVE-2026-100359SuiteCRM: Authenticated SQL Injection In action_get_end_date functionSuiteCRM
- CVE-2026-123272mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadatamark3labs mcp-go
- CVE-2026-123271ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicatordiillson ChatCLI
- CVE-2026-123135langgenius dify Sandbox Run init.py hard-coded credentialslanggenius dify
- CVE-2026-100362SuiteCRM: V8 OAuth2 Username EnumerationSuiteCRM
- CVE-2026-69145SuiteCRM: AOR Reports aor_fields.field SQL InjectionSuiteCRM
- CVE-2026-69144SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.phpSuiteCRM
- CVE-2026-123207LibreTV before v2.21.2 SSRF Protection Bypass via DNS RebindingLibreSpark LibreTV
- CVE-2026-123206EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:keyaozorae EdgeChat
- CVE-2026-123204Posta before v0.18.0 SSRF via Webhook URLgoposta posta
- CVE-2026-123203NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokensneuronsimulator NEURON
- CVE-2026-123201buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle APIjarun buku
- CVE-2026-123199eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attributebook-readers eBook-speaker
- CVE-2026-123197WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /fileswppconnect-server
- CVE-2026-116472ingress-nginx mirror-target self-DOSKubernetes ingress-nginx · SUSE Rancher Prime RKE2 ingress-…
- CVE-2026-63217SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data ExfiltrationSuiteCRM
- CVE-2026-63218SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPageSuiteCRM
- CVE-2026-115451Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15…tassos.gr Advanced Custom Fields extension for Joomla · tas…
- CVE-2026-107130Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0balbooa.com Gridbox extension for Joomla
- CVE-2026-121949Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypasssensiolabs symfony/html-sanitizer
- CVE-2026-112110Privileged file deletion in SafeNet Authentication Client SACSrvThalesgroup Safenet Authentication Client Service
- CVE-2026-102927HedgeDoc: Missing validation of incoming permission values on changehedgedoc
- CVE-2026-54913WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guestbytecodealliance wasm-micro-runtime
- CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokensRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-104867Immich calendar heatmap endpoint discloses cross-user activity through broken access controlimmich-app immich
- CVE-2026-75615ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decodersesa asn1scc
- CVE-2026-49405OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event datatinyhumansai openhuman
- CVE-2026-111253Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved…Red Hat Hardened Images
- CVE-2026-118517Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for…sensiolabs symfony/http-client
- CVE-2026-54144OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesturetinyhumansai openhuman
- CVE-2026-97371ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packetsntopng
- CVE-2026-85287HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Servicesysadminsmedia homebox
- CVE-2026-75599HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fieldssysadminsmedia homebox
- CVE-2026-85286HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delaysysadminsmedia homebox
- CVE-2026-123125Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypasssensiolabs symfony/validator
- CVE-2026-61813ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::downloadowasp-modsecurity ModSecurity
- CVE-2026-103932ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-matchowasp-modsecurity ModSecurity
- CVE-2026-119751Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blockskeywordrush Content Egg – Affiliate Product Importer & Pric…
- CVE-2026-70660stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the…leejet stable-diffusion.cpp
- CVE-2026-115740Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix…Trellix DLP on-prem extensions
- CVE-2026-115739Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to…Trellix DLP on-prem extensions
- CVE-2026-123094Huginn before 2026.11.05 Stored XSS via OAuth Service Display Namehuginn
- CVE-2026-122330Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()c-blosc2
- CVE-2026-122327Meelo through 3.13.1 Missing Authorization on Song, Track and Video EndpointsArthi-chaud Meelo
- CVE-2026-122326Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contentsChevereto
- CVE-2026-122325eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation APIfossasia eventyay-exhibition
- CVE-2026-122324SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetailsoss-apps SplitPro
- CVE-2026-122317SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Queryoss-apps SplitPro
- CVE-2026-123032OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authenticationOpenBMB Internet of Agents
- CVE-2026-66903Apache OFBiz: Authenticated Path Traversal in Catalog Image ManagementApache Software Foundation Apache OFBiz
- CVE-2026-68524Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition LoadingApache Software Foundation Apache OFBiz
- CVE-2026-64860espressif/mdns has Uncontrolled Recursion in mDNS Name Decompressionespressif esp-protocols
- CVE-2026-73577Apache OFBiz: Unauthenticated path-suffix view authorization bypassApache Software Foundation Apache OFBiz
- CVE-2026-73578Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impactApache Software Foundation Apache OFBiz
- CVE-2026-73580Apache OFBiz: Unauthenticated HR organization and employee disclosureApache Software Foundation Apache OFBiz
- CVE-2026-74841Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modeApache Software Foundation Apache OFBiz
- CVE-2026-76150Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImageApache Software Foundation Apache OFBiz
- CVE-2026-81734Apache OFBiz: Missing authorization - catalog quick-admin product writesApache Software Foundation Apache OFBiz
- CVE-2026-76152Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate servicesApache Software Foundation Apache OFBiz
- CVE-2026-81744Apache OFBiz: Authorization bypass - self-grant content OWNERApache Software Foundation Apache OFBiz
- CVE-2026-81808Apache OFBiz: Missing authorization - search-result bulk catalog mutationApache Software Foundation Apache OFBiz
- CVE-2026-81815Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBApache Software Foundation Apache OFBiz
- CVE-2026-81816Apache OFBiz: XML external entity injection (XXE)Apache Software Foundation Apache OFBiz
- CVE-2026-81828Apache OFBiz: Server-side request forgery in SurveyWrapperApache Software Foundation Apache OFBiz
- CVE-2026-82894Apache OFBiz: Content renderer runs a service name stored on the rowApache Software Foundation Apache OFBiz
- CVE-2026-82902Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafileApache Software Foundation Apache OFBiz
- CVE-2026-83538Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpersApache Software Foundation Apache OFBiz
- CVE-2026-123028itsourcecode Online Book Store admin_edit.php sql injectionitsourcecode Online Book Store
- CVE-2026-84728Apache OFBiz: Cross-tenant authorization bypass in mapped-domain loginApache Software Foundation Apache OFBiz
- CVE-2026-85627Apache OFBiz: Authenticated Code Execution VulnerabilityApache Software Foundation Apache OFBiz
- CVE-2026-76563HTML Injection in FileorbisFileorbis Informatics Services Trade Fileorbis
- CVE-2026-92887Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationApache Software Foundation Apache OFBiz
- CVE-2026-97355Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of ServiceApache Software Foundation Apache OFBiz
- CVE-2026-123024agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authenticationagentscope-ai AgentScope
- CVE-2026-97356Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication BypassApache Software Foundation Apache OFBiz
- CVE-2026-100168Apache OFBiz: Missing Authorization vulnerabilityApache Software Foundation Apache OFBiz
- CVE-2026-100228Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price ManipulationApache Software Foundation Apache OFBiz
- CVE-2026-105325Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationsApache Software Foundation Apache OFBiz
- CVE-2026-105330Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessApache Software Foundation Apache OFBiz
- CVE-2026-105461Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitiesApache Software Foundation Apache OFBiz
- CVE-2026-109129Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference ModificationApache Software Foundation Apache OFBiz
- CVE-2026-109837Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem AssociationApache Software Foundation Apache OFBiz
- CVE-2026-109856Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance ManipulationApache Software Foundation Apache OFBiz
- CVE-2026-109928Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account TakeoverApache Software Foundation Apache OFBiz
- CVE-2026-114229Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionApache Software Foundation Apache OFBiz
- CVE-2026-114233Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved OrdersApache Software Foundation Apache OFBiz
- CVE-2026-114235Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number ModificationApache Software Foundation Apache OFBiz
- CVE-2026-114271Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List ModificationApache Software Foundation Apache OFBiz
- CVE-2026-114272Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content DisclosureApache Software Foundation Apache OFBiz
- CVE-2026-114277Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local AccountsApache Software Foundation Apache OFBiz
- CVE-2026-123023agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorizationagentscope-ai AgentScope
- CVE-2026-123022agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injectionagentscope-ai AgentScope
- CVE-2026-123119Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports…sensiolabs symfony/http-client
- CVE-2026-123020eosphoros-ai DB-GPT Jinja2 Template init.py FileBasedSkill.get_prompt special elements in template engineeosphoros-ai DB-GPT
- CVE-2026-103866Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglingApache Software Foundation Apache Sling Engine
- CVE-2026-103864Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralizationApache Software Foundation Apache Sling Engine
- CVE-2026-103863Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper pathsApache Software Foundation Apache Sling Engine
- CVE-2026-95652Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatterTÜBİTAK BİLGEM Software Technologies Research Institute par…
- CVE-2026-123019eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphereeosphoros-ai DB-GPT
- CVE-2026-123018eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injectioneosphoros-ai DB-GPT
- CVE-2026-123036A flaw was found in ansible-core.Red Hat ansible-core
- CVE-2026-117679A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a…SHIRASAGI Project SHIRASAGI
- CVE-2026-112072vault-java-driver: stored deeply nested JSON kills every thread that reads itio.github.jopenlibs:vault-java-driver
- CVE-2026-107776Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount CouponDokan
- CVE-2026-123017GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server.GodotSteam
- CVE-2026-109150WP PageNavi Style <= 1.4 - Stored XSS via CSRFWP PageNavi Style
- CVE-2026-107787CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_mergeCatFolders
- CVE-2026-107786CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' SettingCatFolders
- CVE-2026-107775Dokan < 5.3.3 - Admin+ Cross-Site Vendor ActivationDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-107774Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact FormDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-107773Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST EndpointDokan: AI Powered WooCommerce Multivendor Marketplace Solut…
- CVE-2026-105971Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajaxCar Dealer (Dealership) and Vehicle sales
- CVE-2026-105259Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG UploadEasy Social Icons
- CVE-2026-100144IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' ParameterIVPAY payments
- CVE-2025-15702Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSSCloud Blocks
- CVE-2025-15701Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color SettingsEasy Social Icons
- CVE-2026-91049EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load AttributeEWWW Image Optimizer
- CVE-2026-90967Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOREssential Real Estate
- CVE-2026-90966Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajaxEssential Real Estate
- CVE-2026-90965Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image DisclosureEssential Real Estate
- CVE-2026-90964Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email SendingEssential Real Estate
- CVE-2026-90963Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Contact Disclosure via property_print_ajaxEssential Real Estate
- CVE-2026-88814YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race ConditionYITH WooCommerce Gift Cards
- CVE-2026-87856Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restriction BypassSubscriptions for WooCommerce
- CVE-2026-86795Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_listCommunity Events
- CVE-2026-86442WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDORWP Event Manager
- CVE-2026-85570Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key DisclosureTutor LMS
- CVE-2026-85351FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library ImportFV Flowplayer Video Player
- CVE-2026-85347FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox CaptionFV Flowplayer Video Player
- CVE-2026-85346FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser HandlersFV Flowplayer Video Player
- CVE-2026-19256All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute ForceAll In One Login
- CVE-2026-16304WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_idsWP Event Manager
- CVE-2026-120533Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profiledavidanderson Redux Framework
- CVE-2026-104812Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Keydavidanderson Redux Framework
- CVE-2026-120553Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode…ivole Customer Reviews for WooCommerce
- CVE-2026-123011STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.STMicroelectronics st-mems-android-linux-sensors-hal
- CVE-2026-122236OpenHands Landing missing authenticationOpenHands
- CVE-2026-122191itsourcecode Airline Reservation System manage_booked.php sql injectionitsourcecode Airline Reservation System
- CVE-2026-122190SourceCodester Online Food Ordering System Category Management add_category.php cross site scriptingSourceCodester Online Food Ordering System
- CVE-2026-122189OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-boundsOpenPPL ppl.nn
- CVE-2026-122188DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversalDeepGraphLearning KnowledgeGraphEmbedding
- CVE-2026-48173In the NAS message handler, improper validation of the length field in NAS message causes memory corruptionSamsung Semiconductor Exynos
- CVE-2026-48174In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service…Samsung Semiconductor Exynos
- CVE-2026-35494In the baseband, memory corruption during NAS packet processing can cause a denial of service.Samsung Semiconductor Exynos
- CVE-2026-48175Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.Samsung Semiconductor Exynos
- CVE-2026-48178Out of bound access in PPC due to race condition in global variable accessSamsung Semiconductor Exynos
- CVE-2026-48186Improper handling of messages before AS security activation can cause unexpected behaviorSamsung Semiconductor Exynos
- CVE-2026-68993A double free vulnerability in NPU driver due to improper pointer management (940)Samsung Semiconductor Exynos
- CVE-2026-68994A double free vulnerability in NPU driver due to improper pointer management (941)Samsung Semiconductor Exynos
- CVE-2026-48183Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissionsSamsung Semiconductor Exynos
- CVE-2026-68984In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.Samsung Semiconductor Exynos
- CVE-2026-69005Integer overflow in NPU driver parameter processing due to insufficient bounds checking.Samsung Semiconductor Exynos
- CVE-2026-68985In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes…Samsung Semiconductor Exynos
- CVE-2026-69006Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.Samsung Semiconductor Exynos
- CVE-2026-69068Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.Samsung Semiconductor Exynos Modem
- CVE-2026-69025In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial…Samsung Semiconductor Exynos
- CVE-2026-68990In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially…Samsung Semiconductor Exynos
- CVE-2026-68991In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to…Samsung Semiconductor Exynos
- CVE-2026-69002Incorrect authorization in Samsung framework services due to missing permission checksSamsung Semiconductor Exynos
- CVE-2026-69066Memory corruption in GPU driver due to improper validation of VMID reservation.Samsung Semiconductor Exynos
- CVE-2026-69050Out-of-bounds memory access in a device driver due to improper resource state tracking.Samsung Semiconductor Exynos
- CVE-2026-69043In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruptionSamsung Semiconductor Exynos
- CVE-2026-69044In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.Samsung Semiconductor Exynos
- CVE-2025-66366Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crashSamsung Semiconductor Exynos
- CVE-2026-33965An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.Samsung Semiconductor Exynos
- CVE-2025-66367Improper handling of NAS DLTransport messages may lead to a baseband crash.Samsung Semiconductor Exynos
- CVE-2025-66368Incorrect handling of SDP payload leads to a Denial of ServiceSamsung Semiconductor Exynos
- CVE-2026-33958Processing a malformed RRC Reconfiguration message leads to an out-of-bounds (OOB) access, resulting in a denial-of-service (DoS) condition.Samsung Semiconductor Exynos
- CVE-2026-33971In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service…Samsung Semiconductor Exynos
- CVE-2026-33969In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of…Samsung Semiconductor Exynos
- CVE-2026-33972In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.Samsung Semiconductor Exynos
- CVE-2026-48179In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of ServiceSamsung Semiconductor Exynos
- CVE-2026-48176A memory corruption vulnerability caused by improper validation of messagesSamsung Semiconductor Exynos
- CVE-2026-35495In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerabilitySamsung Semiconductor Exynos
- CVE-2026-122160myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control spheremyshell-ai AIlice
- CVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Responseparse-community parse-server
- CVE-2025-66365Incorrect handling of SIP packets leads to baseband crashesSamsung Semiconductor Exynos
- CVE-2026-122159Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.init path traversalEdge0-AI Audio8_TTS
- CVE-2026-122158InvoiceShelf MemberService.php create access controlInvoiceShelf
- CVE-2026-122157Purocean Yank Note Terminal index.ts checkPermission os command injectionPurocean Yank Note
- CVE-2025-66364Continuously sending control‑plane messages causes the baseband to crashes.Samsung Semiconductor Exynos
- CVE-2026-122154purocean Yank Note Settings Endpoint index.ts config.getAll information disclosurepurocean Yank Note
- CVE-2026-122151Presenton User Configuration user-config JSON.parse cross-site request forgeryPresenton
- CVE-2026-122146101arrowz fflate index.mjs unzipSync memory corruption101arrowz fflate
- CVE-2026-109849Incorrect privilege assignment issue exists in Hinemos.NTT DATA INTELLILINK Hinemos
- CVE-2026-122144nliautaud pico-content-editor cross-site request forgerynliautaud pico-content-editor
- CVE-2026-122052laspy LAS File lasreader.py memory allocationlaspy
- CVE-2026-106713An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…
- CVE-2026-106714Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid…
- CVE-2026-106715NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check.
- CVE-2026-106716ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView…