CVE-2026-63094 - SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that al

CVE-2026-63093 - Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attack

CVE-2026-51083 - Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x b

CVE-2026-51082 - A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE

CVE-2026-51081 - A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmo

CVE-2026-16089 - A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs b

CVE-2026-16017 - A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/r

CVE-2026-12705 - Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool

CVE-2026-9592 - SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay

CVE-2026-7488 - Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce a

CVE-2026-51080 - libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External

CVE-2026-16072 - A flaw was found in the organization management component of Keycloak. A delegated administrator wit

CVE-2026-16016 - A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run

CVE-2026-16015 - A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the func

CVE-2025-60357 - AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via

CVE-2024-42214 - HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server.

CVE-2024-23578 - HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin reso

CVE-2024-23577 - HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header a

CVE-2024-23575 - HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages th

CVE-2024-23574 - HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-

CVE-2024-23573 - HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that ma

CVE-2024-23572 - HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may

CVE-2024-23571 - HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate cachi

CVE-2024-23570 - HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack tec

CVE-2024-23569 - HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protectio

CVE-2024-23568 - HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the applicati

CVE-2024-23567 - HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows applica

CVE-2024-23566 - HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha impl

CVE-2024-23565 - HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail l

CVE-2024-23564 - HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the

CVE-2026-8396 - Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS a

CVE-2026-7189 - Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's

CVE-2026-16014 - A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unkno

CVE-2026-13410 - Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The defa

CVE-2026-13082 - GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method cr

CVE-2026-16013 - A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760.

CVE-2026-16009 - A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown

CVE-2026-15943 - A flaw was found in the Keycloak keycloak-services component, which handles the management of identi

CVE-2026-9602 - Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Matterm

CVE-2026-8075 - Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for h

CVE-2026-59695 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-59694 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-59252 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-16008 - A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts

CVE-2026-22104 - Improper access control in Hashtopolis server web-interface chunk activity component for versions pr

CVE-2026-62764 - Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but

CVE-2026-9656 - The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Se

CVE-2026-15380 - A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task sched

CVE-2026-15379 - The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user t

CVE-2026-9810 - The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user,

CVE-2026-13402 - The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of m

CVE-2026-12393 - The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order

CVE-2026-11966 - The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability chec

CVE-2026-11961 - The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the members

CVE-2026-11575 - The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticit

CVE-2026-10525 - The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data b

CVE-2019-25764 - **UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC

CVE-2026-15982 - The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for Word

CVE-2026-15094 - The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'c

CVE-2026-60060 - Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin

CVE-2026-58317 - Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term pro

CVE-2026-41993 - Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks p

CVE-2026-21770 - HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which coul

CVE-2026-15759 - The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordP

CVE-2026-15457 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-15349 - The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerabl

CVE-2026-15161 - The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in

CVE-2026-14503 - The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

CVE-2026-13765 - The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vul

CVE-2026-13352 - The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C

CVE-2026-8616 - The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of dat

CVE-2026-15395 - The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored C

CVE-2026-15160 - The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all vers

CVE-2026-15159 - The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Referenc

CVE-2026-11324 - The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerab

CVE-2026-62387 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin

CVE-2026-62386 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through t

CVE-2026-62241 - clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-de

CVE-2026-62238 - OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint cross

CVE-2026-62237 - Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex

CVE-2026-62236 - grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the lo

CVE-2026-62235 - Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-n

CVE-2026-62234 - Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users

CVE-2026-62233 - grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and

CVE-2026-62232 - Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin wher

CVE-2026-62231 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key

CVE-2026-62230 - Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rul

CVE-2026-62229 - OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob match

CVE-2026-62228 - OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that a

CVE-2026-62227 - OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser s

CVE-2026-62226 - OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act

CVE-2026-62225 - OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command di

CVE-2026-62224 - OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom

CVE-2026-62223 - OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval

CVE-2026-62222 - OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of unt

CVE-2026-62221 - OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickCla

CVE-2026-62220 - OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass no

CVE-2026-62219 - OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allow

CVE-2026-62218 - OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair

CVE-2026-62217 - OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals

CVE-2026-62216 - OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A low

CVE-2026-62215 - OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas resp

CVE-2026-62214 - OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability

CVE-2026-62213 - OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound reques

CVE-2026-62212 - OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. W

CVE-2026-62211 - OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the traject

CVE-2026-62210 - OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs

CVE-2026-62209 - OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack

CVE-2026-62208 - OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affe

CVE-2026-62207 - OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-t

CVE-2026-62206 - OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderatio

CVE-2026-62205 - OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in

CVE-2026-62203 - OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host ex

CVE-2026-62202 - OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated

CVE-2026-62201 - OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-

CVE-2026-44251 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-40106 - Wazuh is a free and open source platform used for threat prevention, detection, and response. Versio

CVE-2026-2594 - The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version

CVE-2026-14956 - The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an

CVE-2026-54340 - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there i

CVE-2026-39359 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-34150 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-33754 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-33434 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-44453 - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is

CVE-2026-44452 - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2

CVE-2026-44436 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44435 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44434 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44433 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44182 - Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like

CVE-2026-44181 - Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like

CVE-2026-43978 - wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can

CVE-2026-43977 - wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated

CVE-2026-15997 - Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM al

CVE-2026-14253 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11740 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-62826 - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of

CVE-2026-59117 - Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code o

CVE-2026-58643 - Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admi

CVE-2026-58598 - Concurrent execution using shared resource with improper synchronization ('race condition') in Windo

CVE-2026-57077 - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan i

CVE-2026-57076 - YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an

CVE-2026-57075 - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table

CVE-2026-53412 - Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom

CVE-2026-53411 - A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation proces

CVE-2026-45368 - Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underly

CVE-2026-45334 - Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content

CVE-2026-44180 - Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like

CVE-2026-44177 - Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, K

CVE-2026-44176 - Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check th

CVE-2026-44175 - Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did n

CVE-2026-44174 - Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate

CVE-2026-14782 - The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL

CVE-2026-13713 - YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node f

CVE-2026-61378 - A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a divisio

CVE-2026-60073 - An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of

CVE-2026-57896 - An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger ke

CVE-2026-55173 - WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS comman

CVE-2026-53410 - A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation proces

CVE-2026-53409 - Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authentica

CVE-2026-44023 - Docling Core defines core data types and transformations for the document processing application Doc

CVE-2026-44019 - Docling Core defines core data types and transformations for the document processing application Doc

CVE-2026-38158 - A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 all

CVE-2026-36425 - An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x242

CVE-2026-33731 - WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook h

CVE-2026-33692 - WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenti

CVE-2026-11889 - SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a pri

CVE-2024-34268 - EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was

CVE-2024-32389 - Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 al

CVE-2024-32387 - An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacke

CVE-2024-32386 - Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_2020080313204

CVE-2024-32385 - An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacke

CVE-2026-63397 - remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL sch

CVE-2026-63089 - WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time l

CVE-2026-62994 - CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to requ

CVE-2026-62963 - Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidire

CVE-2026-62309 - CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the

CVE-2026-62299 - CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 re

CVE-2026-62290 - cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and

CVE-2026-61718 - bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6

CVE-2026-61389 - An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger k

CVE-2026-60140 - An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger ke

CVE-2026-60063 - An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger k

CVE-2026-55629 - Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/servic

CVE-2026-54728 - bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1

CVE-2026-49998 - Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic

CVE-2026-44982 - CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/re

CVE-2026-44981 - CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI rout

CVE-2026-15449 - A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects ha

CVE-2026-15422 - The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately val

CVE-2026-15352 - A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). T

CVE-2026-54526 - Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on

CVE-2026-53536 - Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/

CVE-2026-53535 - Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync featur

CVE-2026-47089 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to us

CVE-2026-47088 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in neste

CVE-2026-47087 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked

CVE-2026-47086 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can by

CVE-2026-47085 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur

CVE-2026-47084 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypasse

CVE-2026-47083 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user

CVE-2026-47082 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skip

CVE-2026-47081 - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE f

CVE-2026-46515 - Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was

CVE-2026-46514 - Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in

CVE-2026-46513 - Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API t

CVE-2026-46512 - Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply ac

CVE-2026-46404 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation

CVE-2026-46378 - Dasel is a command-line tool and library for querying, modifying, and transforming data structures.

CVE-2026-46377 - Dasel is a command-line tool and library for querying, modifying, and transforming data structures.

CVE-2026-46353 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation coul

CVE-2026-46351 - BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference ses

CVE-2026-46338 - PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 unti

CVE-2026-46687 - Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing inter

CVE-2026-46686 - Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user searc

CVE-2026-46341 - The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, craw

CVE-2026-46336 - Manyfold is an open source, self-hosted web application for managing a collection of 3d models, part

CVE-2026-45336 - HireFlow is a web-based interview management system for managing candidates, scheduling interviews,

CVE-2026-44970 - dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTr

CVE-2026-44969 - dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_to

CVE-2026-44968 - dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_comma

CVE-2026-15945 - A flaw was found in the group search functionality of the Keycloak server's administrative API. When

CVE-2026-15737 - AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for bui

CVE-2021-27137 - An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UP

CVE-2026-9046 - A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store

CVE-2026-6511 - During an internal security assessment, a potential improper access control vulnerability was discov

CVE-2026-63088 - stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unau

CVE-2026-63087 - Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote a

CVE-2026-63086 - text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability

CVE-2026-63085 - Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that

CVE-2026-57074 - XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse f

CVE-2026-57073 - HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse

CVE-2026-55548 - Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpo

CVE-2026-55407 - Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Pri

CVE-2026-55406 - Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Pri

CVE-2026-50012 - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache

CVE-2026-47751 - Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests

CVE-2026-47729 - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic corre

CVE-2026-46621 - Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python

CVE-2026-46562 - Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate use

CVE-2026-45795 - The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0,

CVE-2026-45612 - rz-libdemangle is a Rizin library for demangling symbols. Prior to 6bf56d3, the Rust demangler in sr

CVE-2026-45576 - zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `z

CVE-2026-45568 - zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Pyth

CVE-2026-45367 - HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J

CVE-2026-45325 - Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.034

CVE-2026-44632 - Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability ex

CVE-2026-44596 - Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token

CVE-2026-44595 - Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, lis