CVE-2026-22575 - An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager

CVE-2026-20293 - A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UC

CVE-2026-16497 - NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause exce

CVE-2026-86853 - A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or externa

CVE-2026-86840 - The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability i

CVE-2026-86738 - Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to

CVE-2026-86737 - snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}

CVE-2026-86736 - snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling t

CVE-2026-86735 - snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUr

CVE-2026-86734 - Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{ac

CVE-2026-86733 - Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/

CVE-2026-86732 - Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index

CVE-2026-86731 - Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::a

CVE-2026-86730 - Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allow

CVE-2026-86729 - WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in

CVE-2026-86728 - AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php

CVE-2026-86727 - AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php t

CVE-2026-86726 - AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php tha

CVE-2026-86725 - AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerabili

CVE-2026-86724 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery

CVE-2026-86723 - AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerabil

CVE-2026-86722 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vul

CVE-2026-86721 - AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cook

CVE-2026-86720 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of l

CVE-2026-86719 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site r

CVE-2026-86718 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo

CVE-2026-86666 - A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function

CVE-2026-86600 - In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity t

CVE-2026-79574 - An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sendin

CVE-2026-79573 - L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/get

CVE-2026-79572 - An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.

CVE-2026-56101 - OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael

CVE-2026-16769 - An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/S

CVE-2026-16037 - Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. P

CVE-2026-16025 - Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Mon

CVE-2026-9040 - A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driv

CVE-2026-9034 - Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace

CVE-2026-86665 - A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the functio

CVE-2026-86135 - A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creati

CVE-2026-84282 - A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plu

CVE-2026-83527 - An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote

CVE-2026-7477 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-7476 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-79577 - An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the

CVE-2026-79576 - An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to

CVE-2026-79575 - The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instea

CVE-2026-79571 - Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows

CVE-2026-78837 - A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attacker

CVE-2026-70614 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-70613 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-61517 - Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the

CVE-2026-61516 - Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that

CVE-2026-5729 - Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architect

CVE-2026-33197 - AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List o

CVE-2026-18851 - Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8

CVE-2026-12745 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12744 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12651 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12650 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12648 - A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a

CVE-2026-12647 - A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe

CVE-2026-12646 - A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe

CVE-2026-12645 - A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe

CVE-2026-12387 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-12285 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-11891 - Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Archit

CVE-2026-0860 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kern

CVE-2026-0001 - Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver

CVE-2026-86644 - A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown co

CVE-2026-79379 - A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio

CVE-2026-79378 - An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmwar

CVE-2026-79377 - A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio

CVE-2026-79376 - An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firm

CVE-2026-78838 - A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitr

CVE-2026-74239 - XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windo

CVE-2026-73321 - XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that all

CVE-2026-73320 - XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows u

CVE-2026-73319 - XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler

CVE-2026-73318 - XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controll

CVE-2026-73317 - XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispat

CVE-2026-73316 - XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider th

CVE-2026-73315 - XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhoo

CVE-2026-73314 - XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handl

CVE-2026-73313 - XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA

CVE-2026-73312 - XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a

CVE-2026-73311 - XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attacker

CVE-2026-73310 - XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attack

CVE-2026-73309 - XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint t

CVE-2026-33920 - A cross-site request forgery vulnerability was discovered in the login functionality (both standard

CVE-2026-33391 - An access control vulnerability was discovered in the Smart Polling configuration functionality due

CVE-2026-33389 - An improper certificate/host key validation vulnerability was discovered in the Smart Polling functi

CVE-2026-33388 - An access control vulnerability was discovered in the Credentials Manager functionality due to insuf

CVE-2026-33387 - A template injection vulnerability was discovered in the Dashboards functionality due to improper va

CVE-2026-79603 - x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB f

CVE-2026-79602 - A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG()

CVE-2026-77106 - Cvlaunchd contained a missing authorization issue affecting command execution authorization. Softwar

CVE-2026-77105 - CommServe contained a cryptographic signature verification issue affecting privilege management. Sof

CVE-2026-77104 - CommServe contained a path traversal issue affecting information disclosure. Software customers upgr

CVE-2026-77103 - CommServe contained an authentication bypass issue affecting access authorization and information di

CVE-2026-77102 - CommServe contained a heap-based buffer overflow issue affecting service availability. Software cust

CVE-2026-77101 - CommServe contained a stack-based buffer overflow issue affecting service availability. Software cus

CVE-2026-77098 - Private Metrics Server contained an SQL injection condition affecting database operations. Software

CVE-2026-77097 - Private Metrics Server contained a missing authentication condition affecting metrics upload functio

CVE-2026-77092 - Content Extractor contained a deserialization of untrusted data issue affecting privilege management

CVE-2026-77091 - DataCube contained a path traversal issue affecting security feature enforcement. Software customers

CVE-2026-77089 - Command Center API contained an authentication bypass issue affecting privilege management. Software

CVE-2026-75021 - fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind

CVE-2026-62437 - When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devi

CVE-2026-19203 - A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty an

CVE-2026-12611 - A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never u

CVE-2026-11573 - Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML modul

CVE-2026-86714 - PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system co

CVE-2026-86713 - PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop p

CVE-2026-86712 - SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitizat

CVE-2026-86711 - electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handle

CVE-2026-80219 - Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.

CVE-2026-78234 - A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key

CVE-2026-77968 - A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list,

CVE-2026-76931 - The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

CVE-2026-74860 - A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulne

CVE-2026-3174 - The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification o

CVE-2026-2520 - The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to

CVE-2026-18021 - The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerab

CVE-2026-17509 - The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘el

CVE-2026-16502 - The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object

CVE-2026-12230 - The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vul

CVE-2026-77654 - Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall

CVE-2026-19614 - The API is prone to XML external entity (XXE) injection. By default, XML external entity support is

CVE-2026-9331 - The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized mod

CVE-2026-86590 - In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/res

CVE-2026-85400 - Backend administrators without system maintainer privileges were able to schedule any of the configu

CVE-2026-77132 - It has been discovered that several AJAX routes used for the backend localization wizard failed to p

CVE-2026-86597 - Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PD

CVE-2026-86550 - NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, all

CVE-2026-74859 - The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating arc

CVE-2026-71377 - Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosm

CVE-2026-71376 - OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus

CVE-2026-67367 - A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fle

CVE-2026-62654 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance m

CVE-2026-62653 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over

CVE-2026-62652 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware con

CVE-2026-62650 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorizati

CVE-2026-62649 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not

CVE-2026-62648 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL c

CVE-2026-62647 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generat

CVE-2026-62646 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is

CVE-2026-62645 - A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed

CVE-2026-58113 - A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V250

CVE-2026-50093 - A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), S

CVE-2026-34223 - A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC Click

CVE-2026-84820 - Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons

CVE-2026-84818 - Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

CVE-2026-84817 - Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

CVE-2026-81806 - Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side

CVE-2026-81802 - Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

CVE-2026-81798 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-81792 - Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce

CVE-2026-81790 - Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez

CVE-2026-81781 - Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting In

CVE-2026-76561 - A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificat

CVE-2026-71375 - Improper restriction of XML external entity reference vulnerability in Cosminexus Component Containe

CVE-2026-71374 - Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affec

CVE-2026-48888 - Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows

CVE-2026-86519 - A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown funct

CVE-2026-86518 - A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown

CVE-2026-86517 - A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the fu

CVE-2026-86516 - A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected eleme

CVE-2026-86515 - A security vulnerability has been detected in vgmstream up to r2117. Impacted is the function add_en

CVE-2026-86514 - A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of t

CVE-2026-86513 - A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability aff

CVE-2026-86512 - A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function C

CVE-2026-86511 - A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this vulnerability i

CVE-2026-75811 - Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a loca

CVE-2026-75810 - Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief syste

CVE-2026-75809 - Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosu

CVE-2026-75808 - Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to ca

CVE-2026-19397 - Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauth

CVE-2026-18023 - Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a loc

CVE-2026-16006 - Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver a

CVE-2026-16005 - Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrar

CVE-2026-16004 - Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read a

CVE-2026-16003 - Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an

CVE-2026-12962 - A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote us

CVE-2026-86510 - A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params

CVE-2026-86509 - A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of t

CVE-2026-82710 - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rul

CVE-2026-76977 - SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. A

CVE-2026-76971 - Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intel

CVE-2026-76969 - @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multit

CVE-2026-76968 - SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated lo

CVE-2026-76967 - SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally

CVE-2026-76963 - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform,

CVE-2026-76962 - SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain

CVE-2026-76961 - SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request For

CVE-2026-76960 - SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request For

CVE-2026-76959 - SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request For

CVE-2026-76958 - SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i

CVE-2026-66768 - SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked fro

CVE-2026-66767 - SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a

CVE-2026-58240 - SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application

CVE-2026-58234 - SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests c

CVE-2026-44766 - SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to

CVE-2026-44756 - A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Und

CVE-2026-86544 - knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code acti

CVE-2026-86543 - knowns versions before 0.30.0 serve the management API without authentication on all network interfa

CVE-2026-86542 - knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated a

CVE-2026-86541 - knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() func

CVE-2026-86540 - knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project co

CVE-2026-86539 - knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embeddin

CVE-2026-86538 - knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/prev

CVE-2026-86439 - knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing atta

CVE-2026-82758 - Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unau

CVE-2026-82757 - Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server all

CVE-2026-82756 - Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_serve

CVE-2026-82755 - Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2

CVE-2026-82754 - Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server

CVE-2026-82753 - Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication

CVE-2026-82586 - Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lu

CVE-2026-82584 - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter a

CVE-2026-81638 - Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an atta

CVE-2026-86438 - Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire a

CVE-2026-86437 - Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with o

CVE-2026-86436 - Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload end

CVE-2026-75650 - Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engi

CVE-2026-86287 - Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASC

CVE-2026-16028 - Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream

CVE-2026-86506 - In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof

CVE-2026-86505 - In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to Je

CVE-2026-86504 - In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev

CVE-2026-86503 - In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kuber

CVE-2026-86502 - In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server a

CVE-2026-86501 - In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log

CVE-2026-86500 - In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update

CVE-2026-86499 - In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any use

CVE-2026-86498 - In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed

CVE-2026-86497 - In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed

CVE-2026-86496 - In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters ex

CVE-2026-86495 - In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base

CVE-2026-86494 - In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links

CVE-2026-86493 - In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to crea

CVE-2026-86492 - In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub

CVE-2026-86491 - In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon

CVE-2026-86490 - In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled

CVE-2026-86489 - In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues a

CVE-2026-86488 - In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints expo

CVE-2026-86487 - In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard u

CVE-2026-86486 - In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secre

CVE-2026-86485 - In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webh

CVE-2026-86484 - In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stor

CVE-2026-86483 - In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was pos