CVE-2025-51678 - An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory add

CVE-2025-51677 - An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the

CVE-2026-9171 - IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial

CVE-2026-9135 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163

CVE-2026-9103 - IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due

CVE-2026-58195 - Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools i

CVE-2026-53712 - SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentic

CVE-2026-52746 - JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matchin

CVE-2026-50185 - RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to

CVE-2026-49835 - Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the globa

CVE-2026-48487 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _rea

CVE-2026-48045 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, Asyn

CVE-2026-47184 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCa

CVE-2026-47183 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIn

CVE-2026-47180 - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIn

CVE-2026-45703 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7,

CVE-2026-45309 - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the

CVE-2026-45162 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7,

CVE-2026-16073 - A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this iss

CVE-2026-9762 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when

CVE-2026-9202 - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user acco

CVE-2026-9198 - IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (

CVE-2026-50273 - Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Data

CVE-2026-48016 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /stor

CVE-2026-48015 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, SVG files are in the allowed

CVE-2026-48014 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition f

CVE-2026-48010 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser()

CVE-2026-48009 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user w

CVE-2026-48008 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with in

CVE-2025-59866 - The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Lea

CVE-2026-9588 - A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (10499

CVE-2026-9587 - An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104

CVE-2026-9586 - An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

CVE-2026-9585 - An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SM

CVE-2026-8297 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-63309 - SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing au

CVE-2026-63308 - Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files

CVE-2026-63307 - Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/conn

CVE-2026-63101 - Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthe

CVE-2026-57860 - ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the M

CVE-2026-54496 - ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard

CVE-2026-49216 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus co

CVE-2026-49215 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\Liv

CVE-2026-49212 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC comput

CVE-2026-49211 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Auto

CVE-2026-49210 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\Live

CVE-2026-49209 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\Live

CVE-2026-49208 - Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LivePr

CVE-2026-44722 - pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prio

CVE-2026-21764 - HCL DevOps Loop is affected by insufficient input validation that allows special characters where th

CVE-2026-21762 - HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce br

CVE-2026-21761 - HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper COR

CVE-2026-21760 - HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulne

CVE-2026-16108 - A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This comp

CVE-2026-16106 - A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. T

CVE-2026-16104 - A flaw was found in the authentication configuration endpoint of the keycloak-services component, wh

CVE-2026-16103 - A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for

CVE-2026-16093 - Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, su

CVE-2026-12694 - Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Func

CVE-2026-12693 - Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Pla

CVE-2026-12692 - Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentic

CVE-2026-12691 - Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platfor

CVE-2026-11763 - Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consul

CVE-2026-9537 - Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string compa

CVE-2026-63100 - Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-pri

CVE-2026-63099 - TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment

CVE-2026-63098 - TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows

CVE-2026-63097 - Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context en

CVE-2026-63096 - Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthentic

CVE-2026-63095 - Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server

CVE-2026-60025 - Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens

CVE-2026-60024 - Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Jo

CVE-2026-58149 - Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens

CVE-2026-58148 - Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 -

CVE-2026-15783 - A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut

CVE-2026-15343 - A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker w

CVE-2026-15007 - A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authent

CVE-2026-14871 - osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization (BOLA) leading to

CVE-2026-14741 - HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in p

CVE-2026-12715 - Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud P

CVE-2026-63094 - SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that al

CVE-2026-63093 - Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attack

CVE-2026-51083 - Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x b

CVE-2026-51082 - A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE

CVE-2026-51081 - A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmo

CVE-2026-16089 - A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs b

CVE-2026-16017 - A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/r

CVE-2026-12705 - Missing support for integrity check vulnerability in ABB KNX Update Tool (ABB), ABB KNX Update Tool

CVE-2026-9592 - SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay

CVE-2026-7488 - Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce a

CVE-2026-51080 - libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External

CVE-2026-16072 - A flaw was found in the organization management component of Keycloak. A delegated administrator wit

CVE-2026-16016 - A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run

CVE-2026-16015 - A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the func

CVE-2025-60357 - AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via

CVE-2024-42214 - HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server.

CVE-2024-23578 - HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin reso

CVE-2024-23577 - HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header a

CVE-2024-23575 - HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages th

CVE-2024-23574 - HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-

CVE-2024-23573 - HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that ma

CVE-2024-23572 - HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may

CVE-2024-23571 - HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate cachi

CVE-2024-23570 - HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack tec

CVE-2024-23569 - HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protectio

CVE-2024-23568 - HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the applicati

CVE-2024-23567 - HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows applica

CVE-2024-23566 - HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha impl

CVE-2024-23565 - HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail l

CVE-2024-23564 - HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the

CVE-2026-8396 - Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS a

CVE-2026-7189 - Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's

CVE-2026-16014 - A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unkno

CVE-2026-13410 - Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The defa

CVE-2026-13082 - GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method cr

CVE-2026-16013 - A vulnerability has been found in liftoff-sr CIPster up to 632336d414ef708a542377c1aa8d6fdb7c70a760.

CVE-2026-16009 - A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown

CVE-2026-15943 - A flaw was found in the Keycloak keycloak-services component, which handles the management of identi

CVE-2026-9602 - Mattermost Desktop App versions <=6.2 6.0.2 5.6.13.0 fail to validate payloads sent from the Matterm

CVE-2026-8075 - Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for h

CVE-2026-59695 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-59694 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-59252 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote c

CVE-2026-16008 - A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts

CVE-2026-22104 - Improper access control in Hashtopolis server web-interface chunk activity component for versions pr

CVE-2026-62764 - Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but

CVE-2026-9656 - The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Se

CVE-2026-15380 - A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task sched

CVE-2026-15379 - The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user t

CVE-2026-9810 - The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user,

CVE-2026-13402 - The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of m

CVE-2026-12393 - The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order

CVE-2026-11966 - The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability chec

CVE-2026-11961 - The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the members

CVE-2026-11575 - The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticit

CVE-2026-10525 - The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data b

CVE-2019-25764 - **UNSUPPORTED WHEN ASSIGNED**  Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC

CVE-2026-15982 - The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for Word

CVE-2026-15094 - The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'c

CVE-2026-60060 - Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin

CVE-2026-58317 - Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term pro

CVE-2026-41993 - Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks p

CVE-2026-21770 - HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which coul

CVE-2026-15759 - The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordP

CVE-2026-15457 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-15349 - The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerabl

CVE-2026-15161 - The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in

CVE-2026-14503 - The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

CVE-2026-13765 - The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vul

CVE-2026-13352 - The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C

CVE-2026-8616 - The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of dat

CVE-2026-15395 - The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored C

CVE-2026-15160 - The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all vers

CVE-2026-15159 - The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Referenc

CVE-2026-11324 - The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerab

CVE-2026-62387 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin

CVE-2026-62386 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through t

CVE-2026-62241 - clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-de

CVE-2026-62238 - OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint cross

CVE-2026-62237 - Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex

CVE-2026-62236 - grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the lo

CVE-2026-62235 - Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-n

CVE-2026-62234 - Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users

CVE-2026-62233 - grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and

CVE-2026-62232 - Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin wher

CVE-2026-62231 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key

CVE-2026-62230 - Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rul

CVE-2026-62229 - OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob match

CVE-2026-62228 - OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that a

CVE-2026-62227 - OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser s

CVE-2026-62226 - OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act

CVE-2026-62225 - OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command di

CVE-2026-62224 - OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom

CVE-2026-62223 - OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval

CVE-2026-62222 - OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of unt

CVE-2026-62221 - OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickCla

CVE-2026-62220 - OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass no

CVE-2026-62219 - OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allow

CVE-2026-62218 - OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair

CVE-2026-62217 - OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals

CVE-2026-62216 - OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A low

CVE-2026-62215 - OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas resp

CVE-2026-62214 - OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability

CVE-2026-62213 - OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound reques

CVE-2026-62212 - OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. W

CVE-2026-62211 - OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the traject

CVE-2026-62210 - OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs

CVE-2026-62209 - OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack

CVE-2026-62208 - OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affe

CVE-2026-62207 - OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-t

CVE-2026-62206 - OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderatio

CVE-2026-62205 - OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in

CVE-2026-62203 - OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host ex

CVE-2026-62202 - OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated

CVE-2026-62201 - OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-

CVE-2026-44251 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-40106 - Wazuh is a free and open source platform used for threat prevention, detection, and response. Versio

CVE-2026-2594 - The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version

CVE-2026-14956 - The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, an

CVE-2026-54340 - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there i

CVE-2026-39359 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-34150 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-33754 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-33434 - Wazuh is a free and open source platform used for threat prevention, detection, and response. In ver

CVE-2026-44453 - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is

CVE-2026-44452 - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2

CVE-2026-44436 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44435 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44434 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44433 - Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server

CVE-2026-44182 - Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like

CVE-2026-44181 - Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like

CVE-2026-43978 - wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can

CVE-2026-43977 - wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated

CVE-2026-15997 - Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM al

CVE-2026-14253 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-11740 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-62826 - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of

CVE-2026-59117 - Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code o

CVE-2026-58643 - Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admi

CVE-2026-58598 - Concurrent execution using shared resource with improper synchronization ('race condition') in Windo

CVE-2026-57077 - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan i

CVE-2026-57076 - YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an

CVE-2026-57075 - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table

CVE-2026-53412 - Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom

CVE-2026-53411 - A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation proces

CVE-2026-45368 - Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underly

CVE-2026-45334 - Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content

CVE-2026-44180 - Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like

CVE-2026-44177 - Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, K

CVE-2026-44176 - Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check th

CVE-2026-44175 - Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did n

CVE-2026-44174 - Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate

CVE-2026-14782 - The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL

CVE-2026-13713 - YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node f

CVE-2026-61378 - A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a divisio

CVE-2026-60073 - An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of

CVE-2026-57896 - An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger ke

CVE-2026-55173 - WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS comman

CVE-2026-53410 - A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation proces

CVE-2026-53409 - Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authentica

CVE-2026-44023 - Docling Core defines core data types and transformations for the document processing application Doc

CVE-2026-44019 - Docling Core defines core data types and transformations for the document processing application Doc

CVE-2026-38158 - A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 all

CVE-2026-36425 - An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x242

CVE-2026-33731 - WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook h

CVE-2026-33692 - WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenti

CVE-2026-11889 - SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a pri

CVE-2024-34268 - EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was

CVE-2024-32389 - Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 al