CVE-2026-77001 - The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does no

CVE-2026-77000 - The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was act

CVE-2026-76793 - The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an a

CVE-2026-76789 - The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authori

CVE-2026-19222 - The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restri

CVE-2026-19221 - The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to n

CVE-2026-19093 - The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to

CVE-2026-18052 - The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the

CVE-2026-16738 - The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incomi

CVE-2026-16612 - The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected prod

CVE-2026-16260 - The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escap

CVE-2026-14187 - The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its cou

CVE-2026-76074 - The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPr

CVE-2026-76057 - The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPr

CVE-2026-75027 - The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to

CVE-2026-19883 - The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of da

CVE-2026-77781 - Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

CVE-2026-9052 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-76069 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-73323 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-53541 - OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumen

CVE-2026-53525 - WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 0.3.1 through 4.9.0,

CVE-2026-53524 - WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0,

CVE-2026-53499 - FORT Validator is a Resource Public Key Infrastructure (RPKI) relying-party validator that produces

CVE-2026-49360 - Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.

CVE-2026-48106 - Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterpr

CVE-2026-48105 - Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterpr

CVE-2026-48050 - Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go

CVE-2026-47735 - Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-

CVE-2026-34949 - Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could

CVE-2026-34948 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the

CVE-2026-11805 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11615 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11609 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11418 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-53531 - RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s

CVE-2026-53530 - RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the publ

CVE-2026-53529 - LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API coul

CVE-2026-53528 - LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in

CVE-2026-53527 - LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerabil

CVE-2026-53509 - CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060

CVE-2026-53497 - CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is ac

CVE-2026-53487 - Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can

CVE-2026-53468 - Typemill is a flat-file, Markdown-based content management system designed for informational documen

CVE-2026-49849 - xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xSho

CVE-2026-43980 - Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a8

CVE-2026-34836 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in a

CVE-2026-34741 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows

CVE-2026-33333 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive informati

CVE-2026-33240 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-

CVE-2026-33047 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a

CVE-2026-31936 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthor

CVE-2026-77811 - Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a r

CVE-2026-77415 - JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expre

CVE-2026-77414 - JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js en

CVE-2026-77413 - JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js

CVE-2026-77354 - kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.s

CVE-2026-77220 - PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting fun

CVE-2026-77219 - GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an

CVE-2026-76905 - kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.co

CVE-2026-76904 - GeoTools is an open source Java library that provides tools for geospatial data. Starting in version

CVE-2026-69238 - There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allo

CVE-2026-69237 - There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allo

CVE-2026-69236 - There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that

CVE-2026-69235 - There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that

CVE-2026-69234 - There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and

CVE-2026-69233 - There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that

CVE-2026-69232 - There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that

CVE-2026-69231 - There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that

CVE-2026-69230 - There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that

CVE-2026-69229 - There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allo

CVE-2026-69228 - There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior th

CVE-2026-69225 - There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.

CVE-2026-69224 - There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier

CVE-2026-68508 - Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.ins

CVE-2026-67619 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64679 - Atlantis is a self-hosted golang application that listens for Terraform pull request events via webh

CVE-2026-63421 - Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packag

CVE-2026-63135 - YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS

CVE-2026-62316 - Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t

CVE-2026-62283 - Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezh

CVE-2026-61824 - Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt a

CVE-2026-61539 - Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and

CVE-2026-59989 - Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in pha

CVE-2026-55185 - Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go a

CVE-2026-55168 - Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links

CVE-2026-54457 - TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation,

CVE-2026-53656 - FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior t

CVE-2026-53572 - KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgres

CVE-2026-50538 - LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15

CVE-2026-45271 - Picotls is a TLS protocol library that allows users select different crypto backends based on their

CVE-2026-45099 - Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu o

CVE-2026-44517 - Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDir

CVE-2026-31880 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S

CVE-2026-31803 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected

CVE-2026-30890 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S

CVE-2026-30865 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S

CVE-2026-30826 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S

CVE-2026-77810 - In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain ac

CVE-2026-76876 - Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated at

CVE-2026-74252 - Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.

CVE-2026-67362 - Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-

CVE-2026-67361 - Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in

CVE-2026-67360 - Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-

CVE-2026-67359 - Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1

CVE-2026-67358 - Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.2

CVE-2026-62960 - Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server

CVE-2026-50290 - SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value

CVE-2026-50288 - SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new

CVE-2026-30866 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can ac

CVE-2026-30819 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S

CVE-2026-27490 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are acces

CVE-2026-27463 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of

CVE-2026-27462 - Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different respo

CVE-2026-77795 - A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the functio

CVE-2026-63466 - Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.forma

CVE-2026-63462 - Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared

CVE-2026-63004 - Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon a

CVE-2026-56875 - Rejected reason: reserved but not needed

CVE-2026-55850 - Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage

CVE-2026-54682 - DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with

CVE-2026-54681 - DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method i

CVE-2026-54134 - OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc

CVE-2026-54073 - VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.2

CVE-2026-54071 - BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/

CVE-2026-53762 - VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-de

CVE-2026-35163 - OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc

CVE-2026-77237 - Missing queue-set type validation in xQueueAddToSet() in the FreeRTOS-Kernel before 11.3.1 might all

CVE-2026-77236 - Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might

CVE-2026-77235 - Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.

CVE-2026-77234 - Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-e

CVE-2026-71862 - Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime,

CVE-2026-71494 - Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10

CVE-2026-71493 - Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10

CVE-2026-70656 - Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime,

CVE-2026-62677 - Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio

CVE-2026-62676 - Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio

CVE-2026-62675 - Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio

CVE-2026-62674 - Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio

CVE-2026-55241 - Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime,

CVE-2026-41451 - UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerabilit

CVE-2026-41450 - UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerabilit

CVE-2026-41449 - UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerabilit

CVE-2026-27875 - Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incid

CVE-2026-17252 - A stack-based out-of-bounds write vulnerability exists in the login request handling functionality o

CVE-2026-17251 - A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of  TL-MR6

CVE-2026-17250 - A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400

CVE-2026-9324 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9321 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9244 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9012 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-74583 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastm

CVE-2026-74582 - In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hard_hea

CVE-2026-74581 - In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib

CVE-2026-74580 - In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata

CVE-2026-69701 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-69099 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-63726 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-57835 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-53991 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-53974 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-39909 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11938 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11902 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11830 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11427 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2023-7344 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2023-7336 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2023-7310 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2021-4482 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2021-4476 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2021-4475 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2019-25725 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2019-25715 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2017-20232 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-75933 - Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and s

CVE-2026-75932 - Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom doma

CVE-2026-75928 - The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes

CVE-2026-69502 - Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate

CVE-2026-54789 - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x H

CVE-2026-49114 - In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the

CVE-2026-22681 - OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticat

CVE-2025-3127 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2025-2795 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-77815 - to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collap

CVE-2026-77814 - is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent direct

CVE-2026-77812 - DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth Low E

CVE-2026-77087 - Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attack

CVE-2026-75501 - Rejected reason: Vendor could not replicate the vul, and reporter is unavailable to comment.

CVE-2026-63343 - Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image c

CVE-2026-63125 - Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, pr

CVE-2026-62941 - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an ins

CVE-2026-62940 - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an i

CVE-2026-62867 - Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation

CVE-2026-62313 - Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enfor

CVE-2026-55622 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati

CVE-2026-55621 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati

CVE-2026-50278 - iccDEV provides a set of libraries and tools for working with ICC color management profiles. Version

CVE-2026-48769 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file w

CVE-2026-48756 - Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateC

CVE-2026-48755 - Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation

CVE-2026-48754 - Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createD

CVE-2026-48753 - Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upl

CVE-2026-48752 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted

CVE-2026-48751 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots

CVE-2026-48750 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output`

CVE-2026-48749 - Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted

CVE-2026-47753 - Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateI

CVE-2026-77806 - SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited i

CVE-2026-75946 - A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to

CVE-2026-15580 - vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authent

CVE-2026-77780 - Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero

CVE-2026-77028 - Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parame

CVE-2026-76613 - Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.

CVE-2026-76612 - Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1

CVE-2026-76611 - Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery elemen

CVE-2026-75115 - Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.

CVE-2026-59654 - Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped glo

CVE-2026-77776 - Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header

CVE-2026-77775 - Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url requ

CVE-2026-77759 - Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM

CVE-2026-77029 - Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

CVE-2026-59318 - In Spring AI's tool calling support, the per-request tool list is advertised to the model as a bound

CVE-2026-59308 - In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between dif

CVE-2026-59279 - The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on t

CVE-2026-19848 - The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fi

CVE-2026-18356 - The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its

CVE-2026-17559 - The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths wh

CVE-2026-16650 - The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square pa

CVE-2026-15150 - The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment ga

CVE-2026-15046 - The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative act

CVE-2026-13176 - The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on e

CVE-2026-77769 - The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboar

CVE-2026-77768 - The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returne

CVE-2026-77767 - Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an a

CVE-2026-77763 - The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync de

CVE-2026-77761 - A parser state isolation vulnerability in misp-stix could cause data from a previously processed STI

CVE-2026-77686 - A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file ht

CVE-2026-77683 - A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the functi

CVE-2026-77086 - SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall end

CVE-2026-59296 - Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag

CVE-2026-15576 - Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote

CVE-2026-14208 - Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C

CVE-2026-77755 - A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled ST

CVE-2026-77751 - A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 i

CVE-2026-77681 - A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is

CVE-2026-59323 - An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerab

CVE-2026-48590 - XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML

CVE-2026-47827 - Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute a

CVE-2026-47080 - XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML