CVE-2026-13839 - Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke

CVE-2026-13838 - Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke

CVE-2026-13837 - Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke

CVE-2026-13836 - Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke

CVE-2026-13835 - Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacke

CVE-2026-13834 - Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed

CVE-2026-13833 - Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker

CVE-2026-13832 - Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had

CVE-2026-13831 - Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacke

CVE-2026-13830 - Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attac

CVE-2026-13829 - Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.78

CVE-2026-13828 - Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote

CVE-2026-13827 - Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to

CVE-2026-13826 - Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed

CVE-2026-13825 - Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to poten

CVE-2026-13824 - Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remo

CVE-2026-13823 - Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com

CVE-2026-13822 - Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowe

CVE-2026-13821 - Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execut

CVE-2026-13820 - Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker

CVE-2026-13819 - Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker

CVE-2026-13818 - Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote a

CVE-2026-13817 - Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a

CVE-2026-13816 - Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.

CVE-2026-13815 - Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute

CVE-2026-13814 - Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin

CVE-2026-13813 - Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 all

CVE-2026-13812 - Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.

CVE-2026-13811 - Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute a

CVE-2026-13810 - Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a rem

CVE-2026-13809 - Side-channel information leakage in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 all

CVE-2026-13808 - Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowe

CVE-2026-13807 - Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker wh

CVE-2026-13806 - Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47

CVE-2026-13805 - Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to ex

CVE-2026-13804 - Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who h

CVE-2026-13803 - Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who

CVE-2026-13802 - Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin

CVE-2026-13801 - Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who

CVE-2026-13800 - Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a

CVE-2026-13799 - Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentia

CVE-2026-13798 - Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker

CVE-2026-13797 - Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 all

CVE-2026-13796 - Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who

CVE-2026-13795 - Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 all

CVE-2026-13794 - Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 15

CVE-2026-13793 - Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote atta

CVE-2026-13792 - Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker

CVE-2026-13791 - Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allo

CVE-2026-13790 - Side-channel information leakage in Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote

CVE-2026-13789 - Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp

CVE-2026-13788 - Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote att

CVE-2026-13787 - Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote att

CVE-2026-13786 - Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute

CVE-2026-13785 - Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker

CVE-2026-13784 - Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin

CVE-2026-13783 - Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin

CVE-2026-13782 - Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had

CVE-2026-13781 - Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a

CVE-2026-13780 - Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed

CVE-2026-13779 - Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote at

CVE-2026-13778 - Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to

CVE-2026-13777 - Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47

CVE-2026-13776 - Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com

CVE-2026-13775 - Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp

CVE-2026-13774 - Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinc

CVE-2025-71381 - Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not

CVE-2025-71374 - picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used

CVE-2025-71371 - picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.ru

CVE-2025-71368 - picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle fil

CVE-2025-71363 - picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allow

CVE-2025-71355 - Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing atta

CVE-2025-71352 - picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used i

CVE-2025-71350 - picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run fu

CVE-2025-71349 - picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle

CVE-2026-58450 - Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login tha

CVE-2026-58449 - txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body

CVE-2026-58448 - yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that all

CVE-2026-58447 - Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorizatio

CVE-2026-58446 - Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with

CVE-2026-57585 - MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out

CVE-2026-57204 - pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF

CVE-2026-52868 - An unauthenticated attacker can read worklist records from a directory outside the intended per-AE w

CVE-2026-52196 - Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to

CVE-2026-50254 - An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak m

CVE-2026-50003 - A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode wr

CVE-2026-37106 - An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via

CVE-2026-35505 - An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. I

CVE-2026-11541 - IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se

CVE-2026-10585 - A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed

CVE-2026-9132 - A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut

CVE-2026-9106 - A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAut

CVE-2026-44628 - An unauthenticated attacker can crash the worklist server with a single crafted query when the serve

CVE-2026-13207 - FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path no

CVE-2026-11594 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in

CVE-2026-10562 - An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improp

CVE-2025-36359 - IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expirati

CVE-2025-36336 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could all

CVE-2025-36333 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perfor

CVE-2025-36328 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sen

CVE-2025-36327 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass

CVE-2025-36324 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery

CVE-2025-36323 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This

CVE-2025-36321 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote a

CVE-2025-36320 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scriptin

CVE-2025-36319 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause

CVE-2025-12530 - IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear tex

CVE-2026-9836 - IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure

CVE-2026-9002 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a deni

CVE-2026-7874 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due

CVE-2026-7873 - IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command

CVE-2026-7871 - IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with

CVE-2026-7803 - IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio

CVE-2026-7663 - IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p

CVE-2026-3602 - IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integr

CVE-2026-13773 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in

CVE-2026-13772 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke

CVE-2026-13759 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje

CVE-2026-13449 - IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e

CVE-2026-12086 - IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevO

CVE-2026-12085 - IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.

CVE-2026-12084 - IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource

CVE-2026-11906 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 C

CVE-2026-11806 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil

CVE-2026-11714 - IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability

CVE-2026-11712 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in

CVE-2026-11708 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in

CVE-2026-11595 - IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive info

CVE-2026-11546 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re

CVE-2026-10564 - IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe

CVE-2026-10560 - IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil

CVE-2026-10546 - IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in

CVE-2026-10140 - IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows

CVE-2026-10134 - IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl

CVE-2026-10129 - IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass

CVE-2026-10109 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due

CVE-2025-36372 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 C

CVE-2026-58138 - Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit

CVE-2026-10513 - The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to a

CVE-2026-9263 - The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fai

CVE-2026-8864 - The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Cont

CVE-2026-58377 - JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low

CVE-2026-58376 - Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows

CVE-2026-58375 - JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the

CVE-2026-58373 - CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_quer

CVE-2026-58372 - SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObject

CVE-2026-58371 - SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Cont

CVE-2026-58370 - Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For t

CVE-2026-58369 - Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authenticati

CVE-2026-58176 - RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints un

CVE-2026-58174 - Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named p

CVE-2026-58173 - Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write fi

CVE-2026-58172 - Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability tha

CVE-2026-58171 - Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run ident

CVE-2026-58170 - Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal ident

CVE-2026-58169 - Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows

CVE-2026-58168 - DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privi

CVE-2026-58167 - Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext da

CVE-2026-58166 - OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that

CVE-2026-58165 - OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that

CVE-2026-49451 - The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common s

CVE-2026-10655 - The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP

CVE-2026-10654 - A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rf

CVE-2026-10653 - The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-h

CVE-2026-10652 - Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_

CVE-2026-48315 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera

CVE-2026-48314 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname

CVE-2026-48313 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname

CVE-2026-48307 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XS

CVE-2026-48286 - Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth

CVE-2026-48285 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF)

CVE-2026-48283 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with

CVE-2026-48282 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname

CVE-2026-48281 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera

CVE-2026-48277 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera

CVE-2026-48276 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with

CVE-2026-44948 - A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up t

CVE-2026-13455 - PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly c

CVE-2026-4360 - In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardl

CVE-2026-48192 - A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.

CVE-2026-44949 - A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handle

CVE-2026-44947 - A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher version

CVE-2026-27957 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27956 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27955 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27883 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27882 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27881 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-35098 - KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an

CVE-2026-35097 - KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the us

CVE-2026-35096 - KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and pas

CVE-2026-35095 - KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a

CVE-2026-14241 - Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti

CVE-2026-14178 - openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parse

CVE-2025-53648 - SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to

CVE-2026-8655 - Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredict

CVE-2026-8452 - Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or errone

CVE-2026-8451 - Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if N

CVE-2026-8403 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-6556 - @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path

CVE-2026-58374 - In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operati

CVE-2026-58116 - LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit

CVE-2026-58016 - A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gi

CVE-2026-58015 - A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authenti

CVE-2026-58014 - A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list fun

CVE-2026-58013 - A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the gi

CVE-2026-58012 - A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used wit

CVE-2026-58011 - A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd

CVE-2026-58010 - A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the g

CVE-2026-53433 - fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --list

CVE-2026-53432 - fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line len

CVE-2026-4629 - A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit

CVE-2026-47105 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-44946 - A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler di

CVE-2026-14209 - A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative u

CVE-2026-13474 - Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is

CVE-2026-12388 - A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manag

CVE-2026-10817 - Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if t

CVE-2026-10816 - Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP,

CVE-2026-8402 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-57082 - Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a no

CVE-2026-57081 - Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested ben

CVE-2026-57080 - Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-

CVE-2026-57079 - Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path t

CVE-2026-53692 - Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Because MD5

CVE-2026-53691 - An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers

CVE-2026-53690 - An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in t

CVE-2026-41053 - Incorrect authentication caching in the team member ship expansion of the Rancher Github authenticat

CVE-2026-14162 - Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo

CVE-2026-14161 - Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo

CVE-2026-13766 - DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers.

CVE-2026-54475 - Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVE-2026-53917 - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A

CVE-2026-53916 - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A

CVE-2026-52760 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-50750 - Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache

CVE-2026-50734 - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ

CVE-2026-49877 - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console

CVE-2026-49434 - Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ

CVE-2026-49432 - Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Sto

CVE-2026-13316 - A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and ht

CVE-2026-9711 - The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to S

CVE-2026-8141 - The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t

CVE-2026-6954 - Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability a

CVE-2026-6953 - HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an att

CVE-2026-13149 - brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exp

CVE-2026-12610 - A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due t

CVE-2026-12076 - Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline.  The vulnerabili

CVE-2026-10763 - PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack

CVE-2025-7406 - Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker