CVE-2026-12695 - The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password

CVE-2026-12376 - The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to t

CVE-2026-12251 - The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities

CVE-2026-63223 - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload valid

CVE-2026-63222 - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without

CVE-2026-63221 - CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()

CVE-2026-56673 - ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to

CVE-2026-56672 - ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file}

CVE-2026-56671 - ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2

CVE-2026-56670 - ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2

CVE-2026-63220 - CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure

CVE-2026-62323 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidat

CVE-2026-55502 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/p

CVE-2026-55499 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share

CVE-2026-55497 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbna

CVE-2026-55496 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/sea

CVE-2026-55495 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIV

CVE-2026-43833 - Full details and mitigation steps are currently restricted and will be published at a later date.

CVE-2026-43832 - Full details and mitigation steps are currently restricted and will be published at a later date.

CVE-2026-43831 - Full details and mitigation steps are currently restricted and will be published at a later date.

CVE-2026-43830 - Full details and mitigation steps are currently restricted and will be published at a later date.

CVE-2026-43829 - Full details and mitigation steps are currently restricted and will be published at a later date.

CVE-2026-6890 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-6889 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-18157 - A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the s

CVE-2026-14541 - An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider co

CVE-2026-14540 - A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool compon

CVE-2026-14539 - An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-

CVE-2026-14538 - An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql too

CVE-2026-14537 - Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versio

CVE-2026-58039 - A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files o

CVE-2026-66720 - The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC

CVE-2026-66421 - OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated

CVE-2026-66420 - MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that al

CVE-2026-66369 - The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single un

CVE-2026-66364 - The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauth

CVE-2026-66360 - The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mod

CVE-2026-66349 - The MMS server connection handler contains a flaw in its processing of BER-encoded request data. Wh

CVE-2026-65423 - An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a

CVE-2026-65421 - The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attack

CVE-2026-63550 - The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within co

CVE-2026-63362 - An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a re

CVE-2026-63035 - A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an

CVE-2026-63033 - A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body

CVE-2026-61893 - A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes T

CVE-2026-56758 - The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment.

CVE-2026-10031 - SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to

CVE-2026-68563 - A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevat

CVE-2026-68562 - A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a m

CVE-2026-64816 - RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File:

CVE-2026-63559 - An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a

CVE-2026-62845 - Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and

CVE-2026-62246 - Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a Te

CVE-2026-5846 - The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corr

CVE-2026-38709 - TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300

CVE-2026-18064 - An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) ap

CVE-2026-12562 - The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug int

CVE-2026-68503 - LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.15

CVE-2026-68502 - LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.15

CVE-2026-68501 - Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.

CVE-2026-68500 - Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.

CVE-2026-68499 - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's Str

CVE-2026-66803 - Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a ne

CVE-2026-66418 - OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent

CVE-2026-61526 - AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions

CVE-2026-55777 - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix syst

CVE-2026-55768 - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix syst

CVE-2026-54715 - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix syst

CVE-2026-52539 - Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environmen

CVE-2026-35847 - An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping

CVE-2025-69947 - SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

CVE-2025-69941 - SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=

CVE-2025-69938 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the param

CVE-2025-69937 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpo

CVE-2025-69936 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

CVE-2025-69935 - CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and reven

CVE-2025-69934 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=

CVE-2025-69933 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1

CVE-2025-69931 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?

CVE-2025-69930 - CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.

CVE-2025-65342 - code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city

CVE-2025-65341 - Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.

CVE-2025-65336 - Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price

CVE-2026-67594 - Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthen

CVE-2026-67550 - re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 valid

CVE-2026-67530 - WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhoo

CVE-2026-67529 - OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time

CVE-2026-67528 - OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/cust

CVE-2026-67527 - OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/wo

CVE-2026-67208 - Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remo

CVE-2026-67207 - Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController t

CVE-2026-67206 - Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController tha

CVE-2026-66756 - Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika:

CVE-2026-66755 - Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 thr

CVE-2026-65835 - Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, afte

CVE-2026-65834 - Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfig

CVE-2026-12946 - IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the

CVE-2026-11536 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability i

CVE-2026-10569 - IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevO

CVE-2025-51684 - CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sani

CVE-2026-66416 - Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attac

CVE-2026-66415 - Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that al

CVE-2026-66066 - Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2

CVE-2026-64870 - MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateSto

CVE-2026-61536 - Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3,

CVE-2026-59881 - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the

CVE-2026-51272 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-48499 - Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path

CVE-2026-18245 - Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allo

CVE-2026-18140 - Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62

CVE-2026-15978 - SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang

CVE-2026-15977 - SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return A

CVE-2026-15976 - SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace reposit

CVE-2026-15974 - SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completio

CVE-2026-15971 - SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a s

CVE-2026-15969 - SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickle

CVE-2026-14227 - An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to

CVE-2026-13444 - IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector

CVE-2026-13435 - IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the Pyt

CVE-2026-12943 - IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management sys

CVE-2026-12942 - IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the s

CVE-2026-12733 - IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper res

CVE-2026-12118 - IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to

CVE-2026-11904 - IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1

CVE-2026-10700 - IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its

CVE-2026-10695 - IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non

CVE-2026-10545 - IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an a

CVE-2026-10535 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid

CVE-2025-36374 - IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing

CVE-2025-0152 - IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6

CVE-2024-40683 - IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.

CVE-2024-25039 - IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6

CVE-2026-9322 - IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.

CVE-2026-66414 - Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthent

CVE-2026-62663 - Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4,

CVE-2026-54722 - DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks.

CVE-2026-54522 - MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1

CVE-2026-51295 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51294 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51293 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51292 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51291 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51290 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-13379 - The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause

CVE-2026-13117 - An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authe

CVE-2026-12996 - A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenti

CVE-2026-12945 - IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other user

CVE-2026-12940 - IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via e

CVE-2026-12932 - A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alph

CVE-2026-11885 - IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 throug

CVE-2026-11771 - OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one

CVE-2026-67596 - CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that a

CVE-2026-58222 - A security flaw combining LDAP filter injection and improper authorization checks was found in Samba

CVE-2026-58216 - An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password ch

CVE-2026-57862 - Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authentic

CVE-2026-52680 - Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when

CVE-2026-4978 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-48910 - A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsi

CVE-2026-44617 - LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name e

CVE-2026-44616 - LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search f

CVE-2026-44613 - Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration a

CVE-2026-28814 - Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows

CVE-2026-28813 - Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.

CVE-2026-28812 - UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attac

CVE-2026-28811 - Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommend

CVE-2026-28323 - SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This

CVE-2026-23985 - A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.

CVE-2026-23981 - An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user wit

CVE-2026-15658 - A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to

CVE-2026-15657 - A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext paym

CVE-2026-10842 - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.

CVE-2026-6540 - Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes,

CVE-2026-67349 - OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded

CVE-2026-67348 - Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoi

CVE-2026-67347 - Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulner

CVE-2026-67346 - Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability

CVE-2026-67345 - MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vul

CVE-2026-65635 - Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid m

CVE-2026-54885 - Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attac

CVE-2026-53431 - Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has

CVE-2026-41187 - Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOpe

CVE-2026-41186 - When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and

CVE-2026-16308 - IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus RES

CVE-2026-15435 - IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a

CVE-2026-14980 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site req

CVE-2026-14522 - IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a

CVE-2026-14519 - IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a

CVE-2026-12947 - IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potenti

CVE-2026-11980 - IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files

CVE-2026-11897 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of se

CVE-2026-11707 - IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte

CVE-2026-11383 - IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte

CVE-2025-36431 - IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through

CVE-2025-36298 - IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.

CVE-2026-67351 - Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password v

CVE-2026-60075 - Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the un

CVE-2026-60074 - Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that

CVE-2026-5219 - Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Co

CVE-2026-58218 - A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests wer

CVE-2026-57859 - e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization h

CVE-2026-56428 - The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability

CVE-2026-41709 - VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit t

CVE-2026-12722 - Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerc

CVE-2026-59310 - VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor

CVE-2026-59309 - VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A ma

CVE-2026-54368 - CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchE

CVE-2026-54367 - CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated

CVE-2026-54366 - CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows un

CVE-2026-54365 - CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll

CVE-2026-54364 - CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthentica

CVE-2026-54363 - CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthentic

CVE-2026-47876 - VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A m

CVE-2026-41703 - VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor w

CVE-2026-7260 - Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack a

CVE-2026-5582 - The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a

CVE-2026-18382 - A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resourc

CVE-2026-18381 - A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMe

CVE-2026-18378 - A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resourc

CVE-2026-17544 - Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corrup

CVE-2026-17543 - Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injecti

CVE-2026-15397 - The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all

CVE-2026-22622 - Improper input validation in one of the session management interface of Eaton's Tripp Lite series PA

CVE-2026-22621 - Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PA

CVE-2026-22620 - Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware

CVE-2026-18369 - A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP add

CVE-2026-18363 - A logic vulnerability in the password reset token validation routine implemented by osTicket in vers

CVE-2026-18362 - The IRIS web application in version 2.4.26 and possibly others does not protect its user authenticat

CVE-2026-18361 - The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc

CVE-2026-18360 - The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc

CVE-2026-16971 - The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation a

CVE-2026-16970 - The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which

CVE-2026-16969 - The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc

CVE-2022-4994 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emu

CVE-2026-18353 - PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim

CVE-2026-7849 - Due to improper neutralization of special elements, an unauthenticated remote attacker is able to in

CVE-2026-44108 - Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematur

CVE-2026-44107 - A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefor

CVE-2026-44106 - A privilege escalation vulnerability in the init-script for user-applications allows a low-privilege

CVE-2026-44105 - The credentials for the local user "user-app" may be exposed in log files, potentially enabling a lo

CVE-2026-44104 - The firmware update process for the basemodule of the charging controller only validates the CRC32 c

CVE-2026-44103 - An unauthenticated remote attacker can inject malicious firmware into the internal charging module b

CVE-2026-44102 - An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by su

CVE-2026-44101 - Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker

CVE-2026-44100 - The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points.

CVE-2026-44099 - A privilege escalation vulnerability in the system configuration allows a low-privileged local user

CVE-2026-44098 - This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via

CVE-2026-44097 - A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endp

CVE-2026-44096 - A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary

CVE-2026-44095 - A privilege escalation vulnerability in a script used for network configuration allows a low-privile

CVE-2026-44094 - An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with