CVE-2026-23934 - An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sendin

CVE-2026-23933 - In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written

CVE-2026-23931 - The frontend validatate.api.exists action can be exploited by authenticated users to extract plainte

CVE-2026-23930 - An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by send

CVE-2026-23929 - Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps.

CVE-2026-23922 - The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak

CVE-2026-1199 - Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests

CVE-2026-18751 - External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue af

CVE-2026-16309 - Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies E

CVE-2026-75855 - ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint'

CVE-2026-75854 - ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-pro

CVE-2026-75853 - ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforc

CVE-2026-75852 - ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB

CVE-2026-75851 - ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the

CVE-2026-75850 - ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and t

CVE-2026-75846 - ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability

CVE-2026-75845 - ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_ser

CVE-2026-75844 - ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DA

CVE-2026-75843 - ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor th

CVE-2026-75842 - ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD

CVE-2026-75841 - ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function tha

CVE-2026-75840 - ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandb

CVE-2026-75839 - ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object referen

CVE-2026-75838 - DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where

CVE-2026-75837 - Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required sec

CVE-2026-75836 - The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.1

CVE-2026-75835 - Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerabili

CVE-2026-75834 - Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss()

CVE-2026-75833 - The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before v

CVE-2026-75832 - The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in

CVE-2026-75831 - Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media

CVE-2026-75830 - grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path tra

CVE-2026-75829 - grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, al

CVE-2026-75828 - Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function

CVE-2026-75827 - Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare

CVE-2026-75774 - A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unk

CVE-2026-75107 - Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append

CVE-2026-74908 - Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only

CVE-2026-74907 - Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.p

CVE-2026-74906 - SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-

CVE-2026-74905 - SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP

CVE-2026-74904 - SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kerne

CVE-2026-74903 - SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBloc

CVE-2026-74902 - SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flo

CVE-2026-5224 - Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technolog

CVE-2026-15585 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN

CVE-2026-75773 - A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the functio

CVE-2026-75627 - Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unaut

CVE-2026-75626 - SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s

CVE-2026-19608 - A flaw was found in the group policy provider of Keycloak authorization services, which is used to m

CVE-2026-19447 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2024-14046 - A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function

CVE-2026-18929 - Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processi

CVE-2026-43971 - Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directi

CVE-2024-14045 - A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of

CVE-2026-34884 - SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking

CVE-2026-15371 - Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the

CVE-2026-75091 - The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera

CVE-2026-15748 - The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up

CVE-2026-75151 - A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0.

CVE-2026-11801 - The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all

CVE-2026-75094 - A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /

CVE-2026-75093 - A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Te

CVE-2026-75090 - A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the

CVE-2026-75089 - A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue

CVE-2026-75088 - A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unkno

CVE-2026-75087 - A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown fu

CVE-2026-75086 - A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element

CVE-2026-75082 - A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of

CVE-2026-75081 - A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the f

CVE-2026-75080 - A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0.

CVE-2026-75079 - A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnera

CVE-2026-9693 - Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membersh

CVE-2026-75587 - Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a d

CVE-2026-75078 - A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This af

CVE-2026-67961 - An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mech

CVE-2026-67919 - An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.ja

CVE-2026-42164 - Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call

CVE-2026-42162 - Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certai

CVE-2026-38165 - A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration

CVE-2026-9859 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce Permissi

CVE-2026-9816 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMe

CVE-2026-75077 - A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by

CVE-2026-71424 - Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers

CVE-2026-69148 - MLflow is an open source AI engineering platform for agents, large language models, and machine lear

CVE-2026-69146 - MLflow is an open source AI engineering platform for agents, large language models, and machine lear

CVE-2026-67960 - An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.

CVE-2026-67918 - Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensi

CVE-2026-67868 - A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter hand

CVE-2026-67854 - SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

CVE-2026-65351 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65349 - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.

CVE-2026-65347 - The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, m

CVE-2026-65346 - An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1

CVE-2026-65343 - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.

CVE-2026-65341 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.

CVE-2026-65340 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65339 - A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.

CVE-2026-65338 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.

CVE-2026-65337 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65336 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65335 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65334 - A memory corruption issue was addressed with improved state management. This issue is fixed in Safar

CVE-2026-65333 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65332 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65331 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65330 - The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS

CVE-2026-65329 - An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.

CVE-2026-64849 - MLflow is an open source AI engineering platform for agents, large language models, and machine lear

CVE-2026-64788 - The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS

CVE-2026-64787 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-64784 - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Sa

CVE-2026-64782 - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari

CVE-2026-64781 - The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18

CVE-2026-64780 - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and

CVE-2026-64779 - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari

CVE-2026-64778 - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and

CVE-2026-64760 - An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10

CVE-2026-64715 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-63178 - Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/us

CVE-2026-56677 - 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint i

CVE-2026-54385 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-51977 - An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically

CVE-2026-45791 - Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.updat

CVE-2026-45790 - Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organizati

CVE-2026-43795 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.

CVE-2026-43794 - A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari

CVE-2026-43667 - A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.

CVE-2026-42163 - Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Lear

CVE-2026-28984 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.

CVE-2026-11817 - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organi

CVE-2026-10080 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSoc

CVE-2026-75531 - Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observabl

CVE-2026-75529 - Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality

CVE-2026-75483 - powerlevel10k fails to neutralize control characters in the package.json version field when renderin

CVE-2026-75482 - SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that j

CVE-2026-75481 - SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when u

CVE-2026-75480 - OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-lev

CVE-2026-75479 - JimuReport contains an authentication bypass vulnerability in the report folder template listing end

CVE-2026-75111 - Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoi

CVE-2026-75110 - MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is en

CVE-2026-75109 - Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the

CVE-2026-75108 - Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN end

CVE-2026-75106 - OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an em

CVE-2026-75105 - phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary

CVE-2026-75104 - Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing atta

CVE-2026-75103 - Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allow

CVE-2026-73560 - vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMu

CVE-2026-73410 - Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outbo

CVE-2026-71518 - Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download rou

CVE-2026-68765 - hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePas

CVE-2026-67967 - Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary

CVE-2026-67966 - Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activ

CVE-2026-67965 - An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the

CVE-2026-67926 - An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Param

CVE-2026-67925 - Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrar

CVE-2026-67917 - zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup res

CVE-2026-66795 - A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto

CVE-2026-65976 - Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a conne

CVE-2026-65974 - ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0,

CVE-2026-65832 - Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthe

CVE-2026-65822 - ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0,

CVE-2026-65640 - WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file uploa

CVE-2026-64657 - Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector

CVE-2026-63409 - Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malic

CVE-2026-54356 - Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/u

CVE-2026-54336 - JumpServer is an open source bastion host and an operation and maintenance security audit system. Fr

CVE-2026-47698 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.j

CVE-2026-47686 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbo

CVE-2026-47683 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in l

CVE-2026-44846 - JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr

CVE-2026-44845 - JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr

CVE-2026-40506 - OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php inter

CVE-2026-39255 - Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execut

CVE-2026-39254 - Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execut

CVE-2026-35219 - Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/s

CVE-2026-34789 - FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/Prope

CVE-2026-34399 - FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCA

CVE-2026-34398 - FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mo

CVE-2026-19589 - Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow uni

CVE-2026-75014 - A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability aff

CVE-2026-75013 - A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function se

CVE-2026-75012 - A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by th

CVE-2026-74234 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-71858 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attack

CVE-2026-71553 - ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api

CVE-2026-71486 - vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completi

CVE-2026-71472 - A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such a

CVE-2026-70495 - A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad pe

CVE-2026-68005 - An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via

CVE-2026-68004 - An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitra

CVE-2026-67678 - File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute ar

CVE-2026-63670 - ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() c

CVE-2026-63669 - ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module'

CVE-2026-63667 - ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export

CVE-2026-57485 - Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P

CVE-2026-57233 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress functi

CVE-2026-54758 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs

CVE-2026-52886 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the back

CVE-2026-19650 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.

CVE-2026-19478 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.

CVE-2026-75011 - A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the fil

CVE-2026-74238 - TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpac

CVE-2026-71693 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-66792 - A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a use

CVE-2026-60107 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-60106 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-50776 - Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote atta

CVE-2026-50775 - A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the

CVE-2026-50774 - An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Ma

CVE-2026-50773 - An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to ex

CVE-2026-45698 - Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.

CVE-2026-17639 - Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condi

CVE-2026-12553 - HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticat

CVE-2026-74254 - Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Pag

CVE-2026-74253 - Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in

CVE-2026-73523 - COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c tha

CVE-2026-73522 - COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthentic

CVE-2026-73424 - Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel ada

CVE-2026-71980 - Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the d

CVE-2026-71979 - INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f,

CVE-2026-71491 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlpars

CVE-2026-68520 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in

CVE-2026-68519 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run(

CVE-2026-62982 - Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_m

CVE-2026-59903 - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2

CVE-2026-59902 - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2

CVE-2026-59894 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.p

CVE-2026-59893 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/key

CVE-2026-54284 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction an

CVE-2026-51346 - SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote att

CVE-2026-50772 - An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via

CVE-2026-50771 - Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to

CVE-2026-50770 - An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges

CVE-2026-50769 - The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Inj

CVE-2026-50768 - File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a r

CVE-2026-48053 - Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoin

CVE-2026-46345 - compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 a

CVE-2026-33437 - Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P

CVE-2026-9771 - The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On bu

CVE-2026-68518 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_

CVE-2026-68517 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins gu

CVE-2026-61666 - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driv

CVE-2026-40145 - A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deploymen

CVE-2026-12630 - Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in g

CVE-2026-12629 - The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrup

CVE-2026-12519 - The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev()

CVE-2026-75060 - In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP too

CVE-2026-75059 - In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible

CVE-2026-75058 - In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers