CVE-2026-10772 - Rejected reason: ** DUPLICATE ** This CVE Record has been rejected by the Zephyr Project CNA. CVE-20

CVE-2025-71404 - better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) v

CVE-2025-71403 - better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic

CVE-2025-71402 - better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-sessi

CVE-2026-18536 - Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data:

CVE-2026-6453 - The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and i

CVE-2026-18435 - The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to

CVE-2026-18344 - The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Script

CVE-2026-18062 - The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to

CVE-2026-18059 - The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensi

CVE-2026-17605 - The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerabl

CVE-2026-17580 - The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywher

CVE-2026-17571 - The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo

CVE-2026-17555 - The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_da

CVE-2026-16685 - The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Sh

CVE-2026-16684 - The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fa

CVE-2026-16635 - The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, a

CVE-2026-16614 - The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulner

CVE-2026-16144 - The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote C

CVE-2026-16091 - The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plug

CVE-2026-16090 - The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plug

CVE-2026-16087 - The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to se

CVE-2026-15964 - The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthent

CVE-2026-15951 - The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in

CVE-2026-15950 - The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

CVE-2026-15662 - The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable

CVE-2026-15649 - The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Si

CVE-2026-15645 - The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Si

CVE-2026-15644 - The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Si

CVE-2026-15601 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-15450 - The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file de

CVE-2026-15052 - The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vul

CVE-2026-15018 - The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'f

CVE-2026-13458 - The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag

CVE-2026-11995 - The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder p

CVE-2026-10782 - The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions

CVE-2025-14073 - The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosu

CVE-2026-2916 - The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in al

CVE-2026-15988 - The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to

CVE-2025-14469 - The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up

CVE-2026-15932 - The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket

CVE-2026-15368 - The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login

CVE-2026-15262 - The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fiel

CVE-2026-15244 - The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory

CVE-2026-15234 - The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode a

CVE-2026-14840 - The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and

CVE-2026-14839 - The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status

CVE-2026-14836 - The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit o

CVE-2026-14823 - The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authori

CVE-2026-14822 - The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorizati

CVE-2026-14596 - The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supp

CVE-2026-14561 - The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time

CVE-2026-14315 - The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorizati

CVE-2026-14309 - The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-tim

CVE-2026-14292 - The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title befor

CVE-2026-14214 - The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict wh

CVE-2026-14197 - The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before

CVE-2026-14195 - The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handle

CVE-2026-13729 - The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on som

CVE-2026-13725 - The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not valid

CVE-2026-13604 - The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by

CVE-2026-13596 - The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a us

CVE-2026-13329 - The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capabili

CVE-2026-13158 - The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded duri

CVE-2026-13157 - The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during

CVE-2026-12966 - The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requeste

CVE-2026-12696 - The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field bef

CVE-2026-11882 - The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth a

CVE-2026-10827 - The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style a

CVE-2025-15669 - The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display

CVE-2026-3141 - The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a mis

CVE-2026-7623 - The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulne

CVE-2026-15414 - The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in vers

CVE-2026-15403 - The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection vi

CVE-2026-15006 - The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin f

CVE-2026-13362 - The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scr

CVE-2026-9044 - An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vul

CVE-2026-54909 - pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while

CVE-2026-54787 - sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does

CVE-2026-54785 - gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official

CVE-2026-54768 - WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user f

CVE-2026-53573 - GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.

CVE-2026-45377 - Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0

CVE-2026-45376 - Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0

CVE-2026-45330 - Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0

CVE-2026-34641 - Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code

CVE-2026-68771 - ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node tha

CVE-2026-52371 - A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.

CVE-2026-52232 - A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F

CVE-2026-52134 - An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows at

CVE-2026-51953 - An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management mo

CVE-2026-45086 - Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0

CVE-2026-68770 - sentence-transformers contains a security control bypass vulnerability that allows attackers to achi

CVE-2026-65981 - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using

CVE-2026-51785 - An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary co

CVE-2026-50986 - PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF

CVE-2026-38713 - TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300

CVE-2026-38710 - TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in th

CVE-2026-38708 - TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300

CVE-2025-69948 - SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_gro

CVE-2025-69946 - SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via

CVE-2026-65841 - Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit

CVE-2026-62999 - Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-

CVE-2026-62959 - Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when

CVE-2026-62324 - Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodi

CVE-2026-55825 - Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can

CVE-2026-53599 - REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedE

CVE-2026-53551 - free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (A

CVE-2026-53510 - Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates atta

CVE-2026-38711 - TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300

CVE-2026-18394 - Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow re

CVE-2026-57232 - Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed

CVE-2026-55824 - Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the cr

CVE-2026-53505 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:pr

CVE-2026-53504 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filt

CVE-2026-53503 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:co

CVE-2026-53502 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader decodes

CVE-2026-53501 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC valid

CVE-2026-53500 - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES

CVE-2026-25552 - Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote att

CVE-2026-18481 - Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might a

CVE-2026-18321 - Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd

CVE-2026-55100 - hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src

CVE-2026-54737 - @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash d

CVE-2026-54729 - DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks.

CVE-2026-54725 - vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods

CVE-2026-34497 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johns

CVE-2026-34495 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-34490 - Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on And

CVE-2026-21662 - Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employe

CVE-2026-67822 - Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSID

CVE-2026-58048 - Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root

CVE-2026-58047 - HTTP Smuggling in cPanel allows potential leak of credentials.

CVE-2026-54707 - OnionShare is an open source tool that lets you securely and anonymously share files, host websites,

CVE-2026-54706 - OnionShare is an open source tool that lets you securely and anonymously share files, host websites,

CVE-2026-52856 - Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVE-2026-52855 - Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVE-2026-67607 - LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-1114

CVE-2026-59232 - Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenti

CVE-2026-59231 - Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows au

CVE-2026-56571 - HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, nul

CVE-2026-56570 - HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive inf

CVE-2026-56569 - HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposur

CVE-2026-56568 - HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vul

CVE-2026-56567 - HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the publi

CVE-2026-52857 - Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVE-2026-18141 - A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (

CVE-2026-17566 - pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-s

CVE-2026-17351 - The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assist

CVE-2026-17350 - The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4

CVE-2026-17349 - /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, wh

CVE-2026-17348 - In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; t

CVE-2026-17347 - The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an ex

CVE-2026-17346 - The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pg

CVE-2026-16504 - Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a de

CVE-2026-16503 - Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is publishe

CVE-2026-10686 - Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop

CVE-2025-62347 - HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected

CVE-2026-67350 - Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthentic

CVE-2026-51301 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51299 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51289 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51288 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51287 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51286 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51285 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51284 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51283 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51282 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51281 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51280 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51279 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51278 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51277 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51276 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51265 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51264 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51262 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51258 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51257 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51256 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51255 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51253 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51250 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51249 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51248 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51247 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51246 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51245 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51243 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51242 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51241 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51240 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51239 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51238 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51237 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51236 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51234 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51233 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51232 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51231 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51230 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51229 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-18446 - fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI a

CVE-2026-10685 - The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth

CVE-2026-65636 - Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) all

CVE-2026-28145 - Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allow

CVE-2026-28144 - Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retri

CVE-2026-9611 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-68577 - Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID

CVE-2026-68576 - Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID

CVE-2026-68575 - Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID

CVE-2026-68574 - Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID

CVE-2026-18358 - A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is

CVE-2026-17592 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-17561 - Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecom

CVE-2026-15227 - Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenti

CVE-2026-46594 - A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Po

CVE-2026-46593 - A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neu

CVE-2025-67651 - A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers script

CVE-2025-67650 - An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Im

CVE-2025-67649 - A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neut

CVE-2026-64607 - HttpClient based on the classic i/o model fails to correctly release the underlying connection back

CVE-2026-62391 - The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server

CVE-2026-44615 - Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authe

CVE-2026-17567 - The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo

CVE-2026-16843 - Some Hikvision Networking Products are vulnerable to authenticated command execution due to insuffic

CVE-2026-18437 - The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to

CVE-2026-18436 - The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and inclu

CVE-2026-15722 - A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_fro

CVE-2026-11770 - A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search

CVE-2026-10079 - A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubern

CVE-2026-65313 - A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations

CVE-2026-65311 - The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an

CVE-2026-65310 - ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes

CVE-2026-65309 - ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords usi

CVE-2026-18218 - A flaw was found in the TokenManager component of the Keycloak identity management service. When an

CVE-2026-18217 - A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access

CVE-2026-18215 - Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a s

CVE-2026-18214 - Keycloak allows users to log in using Google accounts and can be configured to only allow users from

CVE-2026-18211 - A flaw was found in the secure-client-uris client policy executor within Keycloak core services. Thi

CVE-2026-18209 - A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC)

CVE-2026-18208 - A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keyclo

CVE-2026-18206 - A flaw was found in the keycloak-services component of Keycloak, which provides identity and access

CVE-2026-18203 - A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management

CVE-2026-16105 - A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certai

CVE-2026-8155 - The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private

CVE-2026-18452 - DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauth

CVE-2026-16236 - The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up

CVE-2026-15381 - The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter be