CVE-2026-18650 - Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This is

CVE-2026-18401 - The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength con

CVE-2026-11368 - The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer w

CVE-2026-70368 - A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when hand

CVE-2026-70367 - A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when co

CVE-2026-17070 - Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Pr

CVE-2026-14337 - Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vu

CVE-2026-70373 - Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in s

CVE-2026-70372 - Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-c

CVE-2026-70371 - Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user

CVE-2026-70370 - Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-cont

CVE-2026-70369 - Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interp

CVE-2026-63252 - In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retaine

CVE-2026-63248 - In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access

CVE-2026-62927 - In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch t

CVE-2026-61387 - In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe:

CVE-2026-60007 - In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable erro

CVE-2026-58080 - In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configu

CVE-2026-18809 - Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was

CVE-2026-18806 - External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research

CVE-2026-10710 - A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buff

CVE-2026-10709 - A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buff

CVE-2026-66884 - Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Autho

CVE-2026-66883 - Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc

CVE-2026-10050 - In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the pass

CVE-2026-18772 - Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allo

CVE-2026-15721 - Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultan

CVE-2026-14838 - Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informati

CVE-2026-14804 - Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc.

CVE-2026-14465 - Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUM

CVE-2026-14219 - URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics

CVE-2026-14202 - Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUM

CVE-2026-14194 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bili

CVE-2026-14192 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-14175 - Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Cons

CVE-2026-67243 - freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability.

CVE-2026-18759 - The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-p

CVE-2026-18755 - A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to

CVE-2026-18754 - The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web serve

CVE-2026-18753 - The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web serve

CVE-2026-64565 - In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffe

CVE-2026-64564 - In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's o

CVE-2026-64563 - In the Linux kernel, the following vulnerability has been resolved: rhashtable: clear stale iter->p

CVE-2026-64562 - In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS rig

CVE-2026-64561 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obs

CVE-2026-16623 - The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before

CVE-2026-16618 - The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking

CVE-2026-16548 - The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat

CVE-2026-16547 - The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download f

CVE-2026-16546 - The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation chec

CVE-2026-16536 - The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a u

CVE-2026-16296 - The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlit

CVE-2026-16295 - The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its a

CVE-2026-16293 - The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and e

CVE-2026-16070 - The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being

CVE-2026-16069 - The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coo

CVE-2026-16068 - The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global

CVE-2026-16056 - The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check i

CVE-2026-16035 - The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-facto

CVE-2026-15958 - The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization check

CVE-2026-15233 - The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputti

CVE-2026-14939 - The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address

CVE-2026-14872 - The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not pro

CVE-2026-14848 - The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscripti

CVE-2026-14824 - The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question

CVE-2026-14816 - The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization o

CVE-2026-12698 - The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may s

CVE-2026-11366 - The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one

CVE-2026-10526 - The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making ser

CVE-2026-68744 - A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-alloc

CVE-2026-18739 - A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuf

CVE-2026-18569 - A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is par

CVE-2026-16881 - A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile

CVE-2026-42169 - A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This fla

CVE-2026-18723 - A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown

CVE-2026-18722 - A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurv

CVE-2026-18721 - A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown pr

CVE-2026-14818 - A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP s

CVE-2026-8508 - An improper authentication vulnerability in the "social_login.cgi" CGI program in Zyxel WAX650S firm

CVE-2026-6837 - A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX65

CVE-2026-18720 - A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of

CVE-2026-17614 - A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.g

CVE-2026-18719 - A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2

CVE-2026-58045 - A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the

CVE-2026-58044 - A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding pro

CVE-2026-58042 - A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains

CVE-2026-58041 - A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#crea

CVE-2026-56846 - A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and

CVE-2026-56845 - An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds

CVE-2026-66326 - Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute

CVE-2026-66325 - Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke

CVE-2026-66322 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor

CVE-2026-66321 - Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all

CVE-2026-66318 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo

CVE-2026-66317 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor

CVE-2026-66316 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor

CVE-2026-66315 - Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ov

CVE-2026-66314 - Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unaut

CVE-2026-66313 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor

CVE-2026-66312 - Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code ov

CVE-2026-66311 - Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform

CVE-2026-66310 - External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker

CVE-2026-65804 - Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows

CVE-2026-65802 - External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker

CVE-2026-62870 - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a netw

CVE-2026-18686 - A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function

CVE-2026-18685 - A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the functio

CVE-2026-11836 - Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debu

CVE-2026-11835 - Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra

CVE-2026-67978 - An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (

CVE-2026-67673 - A stack-based buffer overflow vulnerability exists in the cmd_edl function of OreSat Firmware v1.0.

CVE-2026-48399 - Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability th

CVE-2026-48333 - Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu

CVE-2026-48331 - Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that

CVE-2026-48330 - Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a

CVE-2026-48326 - Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a

CVE-2026-48323 - Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a

CVE-2026-48317 - Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically

CVE-2026-18684 - A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function rem

CVE-2026-18667 - A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privi

CVE-2026-69249 - python-cryptography is a package designed to expose cryptographic primitives and recipes to Python d

CVE-2026-69248 - cryptography is a package designed to expose cryptographic primitives and recipes to Python develope

CVE-2026-69247 - cryptography is a package designed to expose cryptographic primitives and recipes to Python develope

CVE-2026-67977 - An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allow

CVE-2026-67975 - Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscri

CVE-2026-67974 - A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message han

CVE-2026-67973 - An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (

CVE-2026-67970 - Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to

CVE-2026-67969 - An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the

CVE-2026-67617 - Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content ta

CVE-2026-67616 - Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability

CVE-2026-48115 - Misskey is an open source, federated social media platform. All Misskey servers running versions 202

CVE-2026-47746 - Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to

CVE-2026-46714 - Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to

CVE-2026-46713 - Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to

CVE-2026-46712 - Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior t

CVE-2026-18682 - A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown c

CVE-2026-10849 - The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response

CVE-2026-69246 - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the req

CVE-2026-69245 - Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives

CVE-2026-69244 - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an

CVE-2026-69243 - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the

CVE-2026-69240 - Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dia

CVE-2026-67976 - The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-control

CVE-2026-67972 - An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where recei

CVE-2026-66065 - Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-

CVE-2026-52521 - A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary

CVE-2026-52520 - Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publis

CVE-2026-52102 - An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 all

CVE-2026-51775 - SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary co

CVE-2026-51190 - The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input t

CVE-2026-49132 - OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticate

CVE-2026-49131 - OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticate

CVE-2026-48113 - Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5,

CVE-2026-48063 - Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7

CVE-2026-48061 - Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0,

CVE-2026-41447 - FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attack

CVE-2026-18738 - Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauth

CVE-2026-18737 - Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to

CVE-2026-18736 - Shlink contains a server-side request forgery vulnerability that allows authenticated API key holder

CVE-2026-18733 - A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might

CVE-2026-18648 - A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function

CVE-2026-18647 - A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8f

CVE-2026-18646 - A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code

CVE-2026-18645 - A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function add_cont

CVE-2026-69198 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.

CVE-2026-69192 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to

CVE-2026-69185 - Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.

CVE-2026-68981 - Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API usi

CVE-2026-68980 - Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Para

CVE-2026-68979 - Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not e

CVE-2026-67599 - ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows a

CVE-2026-67598 - Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/ser

CVE-2026-66296 - Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows

CVE-2026-62354 - Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.

CVE-2026-58139 - The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any

CVE-2026-48031 - go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In v

CVE-2026-47211 - Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-

CVE-2026-18655 - Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ

CVE-2026-18654 - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1

CVE-2026-18644 - A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function

CVE-2026-18641 - A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to

CVE-2026-18632 - A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function

CVE-2026-18631 - A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the functio

CVE-2026-59913 - Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Auth

CVE-2026-59912 - Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Ac

CVE-2026-38447 - osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of

CVE-2026-38446 - A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitiza

CVE-2026-38444 - osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header displa

CVE-2026-18616 - A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the functio

CVE-2026-18615 - A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the functio

CVE-2026-18614 - A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo

CVE-2025-15631 - A cryptographic weakness exists in affected Omada devices where site credentials are protected using

CVE-2025-15630 - A race condition exists in the cloud-based Omada device adoption process when an attacker may be abl

CVE-2025-15629 - A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to

CVE-2025-15628 - Affected Omada devices rely on embedded certificates that are shared across deployments to establish

CVE-2025-15627 - A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded c

CVE-2025-15544 - A cryptographic weakness exists in the Omada device adoption process.  During adoption, authenticati

CVE-2026-61524 - WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module ins

CVE-2026-61523 - WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that

CVE-2026-40717 - Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link

CVE-2026-18613 - A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plu

CVE-2026-18612 - A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plug

CVE-2025-9291 - A certification validation weakness exists in communication between affected Omada devices and cloud

CVE-2026-69153 - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rul

CVE-2026-69152 - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior

CVE-2026-69151 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-69149 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-68945 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-68930 - Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handle

CVE-2026-68869 - Rejected reason: This CVE ID was assigned in error. Upon further review, the reported issue does not

CVE-2026-67612 - OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal tem

CVE-2026-67611 - OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with val

CVE-2026-67610 - OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client

CVE-2026-61372 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac

CVE-2026-41453 - Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allo

CVE-2026-41452 - Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that al

CVE-2026-39932 - OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree c

CVE-2026-39931 - OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configurat

CVE-2026-18718 - Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allow

CVE-2026-18610 - A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /

CVE-2026-18607 - A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN5

CVE-2026-18606 - A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is

CVE-2026-18605 - A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown funct

CVE-2026-18604 - A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This im

CVE-2026-18602 - A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-clien

CVE-2026-18477 - A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handl

CVE-2026-18243 - Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may

CVE-2026-18651 - A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs conn

CVE-2026-18568 - XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify

CVE-2026-18508 - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink ta

CVE-2026-18248 - @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and re

CVE-2026-15430 - Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, ve

CVE-2026-67609 - Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a

CVE-2026-9487 - XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml()

CVE-2026-9390 - XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed

CVE-2026-69097 - GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attacke

CVE-2026-69096 - OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.

CVE-2026-69095 - OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path travers

CVE-2026-69094 - Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_tempora

CVE-2026-69093 - Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.ph

CVE-2026-69092 - Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAM

CVE-2026-69091 - Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when confi

CVE-2026-69090 - Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing au

CVE-2026-69089 - Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes it

CVE-2026-69088 - Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::

CVE-2026-69087 - The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerabilit

CVE-2026-69086 - SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-

CVE-2026-69085 - SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint

CVE-2026-69084 - SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-su