CVE-2026-16399 - Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 a

CVE-2026-16398 - Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thun

CVE-2026-16397 - Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fix

CVE-2026-16396 - Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.

CVE-2026-16395 - Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thund

CVE-2026-16394 - Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Th

CVE-2026-16393 - Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Fir

CVE-2026-16392 - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox

CVE-2026-16391 - Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox

CVE-2026-16390 - Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153,

CVE-2026-16389 - Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerabilit

CVE-2026-16388 - Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thu

CVE-2026-16387 - Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firef

CVE-2026-16386 - Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi

CVE-2026-16385 - Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi

CVE-2026-16384 - Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi

CVE-2026-16383 - Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Fir

CVE-2026-16382 - Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153

CVE-2026-16381 - Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox

CVE-2026-16380 - Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thund

CVE-2026-16379 - Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefo

CVE-2026-16378 - Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Fire

CVE-2026-16377 - Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox

CVE-2026-16376 - Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and

CVE-2026-16375 - Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153,

CVE-2026-16374 - Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firef

CVE-2026-16373 - Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed

CVE-2026-16372 - Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefo

CVE-2026-16371 - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,

CVE-2026-16370 - Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and

CVE-2026-16369 - Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 1

CVE-2026-16368 - Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed

CVE-2026-16367 - Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability wa

CVE-2026-16366 - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 a

CVE-2026-16365 - Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thu

CVE-2026-16364 - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed i

CVE-2026-16363 - JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox

CVE-2026-16362 - Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Fi

CVE-2026-16361 - Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory c

CVE-2026-16360 - Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these

CVE-2026-16359 - Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Fir

CVE-2026-16358 - Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1

CVE-2026-16357 - Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153

CVE-2026-16356 - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was

CVE-2026-16355 - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox

CVE-2026-16354 - Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox

CVE-2026-16353 - Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153

CVE-2026-16352 - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was

CVE-2026-16351 - Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed

CVE-2026-16350 - Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in F

CVE-2026-16349 - Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox

CVE-2026-65009 - OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResou

CVE-2026-65008 - Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData

CVE-2026-65007 - The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation an

CVE-2026-64628 - Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where

CVE-2026-64627 - Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema dis

CVE-2026-60080 - Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Ap

CVE-2026-59845 - A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as

CVE-2026-59844 - A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an ar

CVE-2026-59843 - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in

CVE-2026-59842 - A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 pub

CVE-2026-1617 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-16461 - A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used

CVE-2026-64606 - Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypas

CVE-2026-64609 - Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is

CVE-2026-64608 - Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deseria

CVE-2026-62415 - Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Jo

CVE-2026-1771 - The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val

CVE-2026-1372 - The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all ve

CVE-2026-15370 - A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed

CVE-2026-15145 - The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is v

CVE-2026-8593 - Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3

CVE-2026-3183 - Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authent

CVE-2026-8082 - The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter bef

CVE-2026-14185 - The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its

CVE-2026-14184 - The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user iden

CVE-2026-14183 - The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its

CVE-2026-13694 - The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token on

CVE-2026-13693 - The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path

CVE-2026-11767 - The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact f

CVE-2026-3182 - Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transm

CVE-2026-16266 - Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expa

CVE-2026-15927 - A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT h

CVE-2026-15812 - A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version

CVE-2026-15811 - A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. Th

CVE-2026-15782 - The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

CVE-2026-13439 - The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege

CVE-2023-37507 - HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus thei

CVE-2026-15156 - The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is v

CVE-2023-37508 - HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attack

CVE-2026-59776 - Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or b

CVE-2026-16336 - A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/tri

CVE-2026-6952 - A post-authentication command injection vulnerability in the "LogServer" field of the syslog compone

CVE-2026-63729 - The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers suc

CVE-2026-16334 - A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability af

CVE-2026-16332 - A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /

CVE-2026-16331 - A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function

CVE-2026-16330 - A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function

CVE-2026-16329 - A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file

CVE-2026-63728 - Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can s

CVE-2026-55833 - Netty is a network application framework for development of protocol servers and clients. Prior to 4

CVE-2026-55831 - Netty is a network application framework for development of protocol servers and clients. Prior to 4

CVE-2026-16327 - A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing o

CVE-2026-15905 - Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentia

CVE-2026-15904 - Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker

CVE-2026-15903 - Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacke

CVE-2026-15902 - Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute

CVE-2026-15901 - Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to pote

CVE-2026-15900 - Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker

CVE-2026-15899 - Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote att

CVE-2026-64626 - AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vul

CVE-2026-64625 - AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped

CVE-2026-64624 - FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line opt

CVE-2026-57852 - Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauth

CVE-2026-57495 - AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior

CVE-2026-57494 - AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to ver

CVE-2026-55550 - NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is a

CVE-2026-55544 - NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP c

CVE-2026-52656 - An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C an

CVE-2026-51385 - An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to exec

CVE-2026-51031 - FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the

CVE-2026-51025 - Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker

CVE-2026-47255 - AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to versio

CVE-2026-47144 - Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vul

CVE-2026-47134 - ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.

CVE-2026-47133 - ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.

CVE-2026-47128 - nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55

CVE-2026-44510 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43620. Reason:

CVE-2026-16324 - A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is

CVE-2026-12900 - The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerab

CVE-2024-51316 - The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name fun

CVE-2024-51315 - The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of

CVE-2024-51314 - The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of

CVE-2024-51312 - The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of

CVE-2026-64651 - The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Pr

CVE-2026-64650 - The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drive

CVE-2026-58624 - Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for cl

CVE-2026-56624 - Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java librar

CVE-2026-56623 - Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library

CVE-2026-56452 - Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for

CVE-2026-55219 - Paymenter is a free and open-source webshop solution for management of hosting services. In versions

CVE-2026-53596 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version

CVE-2026-53595 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version

CVE-2026-53594 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Mana

CVE-2026-47198 - Paymenter is a free and open-source webshop solution for management of hosting services. In versions

CVE-2026-47130 - NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 hav

CVE-2026-47129 - NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 hav

CVE-2026-44585 - Paymenter is a free and open-source webshop solution for management of hosting services. In versions

CVE-2026-44584 - Paymenter is a free and open-source webshop solution for management of hosting services. In versions

CVE-2026-44583 - Paymenter is a free and open-source webshop solution for management of hosting services. In versions

CVE-2026-44509 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43619. Reason:

CVE-2026-44508 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason:

CVE-2026-44507 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43617. Reason:

CVE-2026-13381 - VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in

CVE-2026-13380 - VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP response

CVE-2024-51313 - The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of

CVE-2024-51311 - The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of

CVE-2026-63767 - ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserializa

CVE-2026-63766 - GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where AS

CVE-2026-53593 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version

CVE-2026-53592 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollu

CVE-2026-53591 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version

CVE-2026-44231 - RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6

CVE-2026-44230 - RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but n

CVE-2026-44229 - RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 an

CVE-2026-16337 - Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.

CVE-2026-15788 - BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not dete

CVE-2026-64619 - FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allo

CVE-2026-64194 - Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer cha

CVE-2026-64193 - Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. N

CVE-2026-63771 - Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate c

CVE-2026-63770 - Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler tha

CVE-2026-63769 - Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url metho

CVE-2026-63768 - cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback end

CVE-2026-63731 - HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated

CVE-2026-63730 - HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated

CVE-2026-63108 - Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute featu

CVE-2026-63107 - LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the RES

CVE-2026-62414 - Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla ext

CVE-2026-61901 - Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop

CVE-2026-61900 - Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.

CVE-2026-61425 - Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gri

CVE-2026-61424 - Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.1

CVE-2026-60034 - Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Jooml

CVE-2026-60033 - Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Jooml

CVE-2026-60032 - Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joom

CVE-2026-60031 - Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla

CVE-2026-60030 - Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder

CVE-2026-60029 - Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joom

CVE-2026-60028 - Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joom

CVE-2026-60027 - Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder

CVE-2026-60026 - Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 -

CVE-2026-48389 - DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability

CVE-2026-12341 - This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unautho

CVE-2026-8170 - The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to saf

CVE-2026-8169 - ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the privileged debug-mo

CVE-2026-64612 - A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng

CVE-2026-55639 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the

CVE-2026-55626 - xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session

CVE-2026-48812 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version

CVE-2026-46715 - Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0'

CVE-2026-45295 - FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version

CVE-2026-44228 - RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, p

CVE-2026-44227 - RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, p

CVE-2026-39878 - Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the

CVE-2026-34239 - Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the mai

CVE-2026-26483 - Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in th

CVE-2026-64207 - In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO bac

CVE-2026-64206 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendin

CVE-2026-64205 - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state m

CVE-2026-64192 - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF_MAP_TYPE_INODE_

CVE-2026-64191 - In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block tra

CVE-2026-64190 - In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer der

CVE-2026-64189 - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race betw

CVE-2026-64188 - In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpo

CVE-2026-64187 - In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committ

CVE-2026-58484 - Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentMa

CVE-2026-58482 - Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented featu

CVE-2026-58481 - Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime`

CVE-2026-58414 - Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentMa

CVE-2026-58413 - Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentMa

CVE-2026-55645 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the

CVE-2026-55238 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the

CVE-2026-54538 - xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the

CVE-2026-54051 - Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandb

CVE-2026-50743 - A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and u

CVE-2026-47276 - In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `properties_parse()` allows an

CVE-2026-47275 - In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in `nni_mqttv5_msg_decode_connect

CVE-2026-46701 - Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE ser

CVE-2026-46555 - WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a

CVE-2026-44978 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulne

CVE-2026-44178 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vu

CVE-2026-42218 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerabi

CVE-2026-42210 - Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for

CVE-2026-41521 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerabili

CVE-2026-41252 - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp,

CVE-2026-40187 - In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote C

CVE-2026-39879 - Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/

CVE-2026-39385 - Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could

CVE-2026-35591 - libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvip

CVE-2026-35590 - libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips ve

CVE-2026-35217 - NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription ent

CVE-2026-35048 - The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configurati

CVE-2026-33328 - libvips is a fast image processing library with low memory needs. On 32-bit systems in versions befo

CVE-2026-33327 - libvips is a fast image processing library with low memory needs. The `vipsload` operation in versio

CVE-2026-32825 - dataCycle is a data management system for centrally storing, managing, searching, finding, and distr

CVE-2026-32824 - dataCycle is a data management system for centrally storing, managing, searching, finding, and distr

CVE-2026-32823 - dataCycle is a data management system for centrally storing, managing, searching, finding, and distr

CVE-2026-32821 - dataCycle is a data management system for centrally storing, managing, searching, finding, and distr

CVE-2026-32820 - dataCycle is a data management system for centrally storing, managing, searching, finding, and distr