CVE-2026-86180 - A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this

CVE-2026-86179 - A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of

CVE-2026-86172 - A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the fi

CVE-2026-86171 - A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown func

CVE-2026-85038 - The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & Mo

CVE-2026-84219 - The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it d

CVE-2026-84028 - The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribu

CVE-2026-75793 - The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting be

CVE-2026-18480 - The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer

CVE-2026-13159 - The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one

CVE-2026-86170 - A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown funct

CVE-2026-86168 - A security flaw has been discovered in code-projects Content Management System 1.0. The affected ele

CVE-2026-86167 - A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the

CVE-2026-86166 - A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedir

CVE-2026-86165 - A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL o

CVE-2026-86164 - A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an u

CVE-2026-86163 - A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unkno

CVE-2026-86218 - N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 202

CVE-2026-86162 - A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown f

CVE-2026-86161 - A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unk

CVE-2026-86160 - A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is a

CVE-2026-86159 - A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of

CVE-2026-75816 - The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Acco

CVE-2026-18056 - The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the acc

CVE-2026-16310 - The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version

CVE-2026-86153 - A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::Set

CVE-2026-86152 - A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::T

CVE-2026-86151 - A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77

CVE-2026-86150 - A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function

CVE-2026-76161 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-76160 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-86149 - A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing

CVE-2026-86148 - A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the functio

CVE-2026-86206 - A vulnerability in the N-central internal API access control filter allows unauthorised access to in

CVE-2026-86060 - RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin wit

CVE-2026-67281 - RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a new

CVE-2026-67279 - RouterOS SSH enters the connection protocol after a client-requested rekey even though user authenti

CVE-2026-67278 - MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including

CVE-2026-67277 - RouterOS accepts a "related" btest connection before the corresponding primary session has completed

CVE-2026-67276 - RouterOS does not compare the complete RSA public key when matching an SSH authentication request to

CVE-2026-86207 - An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only

CVE-2026-6554 - libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to imple

CVE-2026-6244 - libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the im

CVE-2026-31912 - libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of

CVE-2026-31911 - libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode.

CVE-2026-18313 - rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ

CVE-2026-18238 - The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly

CVE-2026-0799 - In BPF instructions that load/store a value from/to a scratch memory register the register index is

CVE-2026-82752 - Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attack

CVE-2026-86197 - Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that all

CVE-2026-86196 - Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in

CVE-2026-86195 - grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the Invitatio

CVE-2026-86194 - Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name acros

CVE-2026-86193 - grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management

CVE-2026-86192 - SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getA

CVE-2026-86191 - SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeVie

CVE-2026-86190 - WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns

CVE-2026-86189 - WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenti

CVE-2026-86188 - AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthen

CVE-2026-86187 - WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic

CVE-2026-86186 - AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attacker

CVE-2026-86185 - Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsi

CVE-2026-86184 - Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login

CVE-2026-15550 - The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versi

CVE-2026-12843 - The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.

CVE-2026-10196 - The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPr

CVE-2025-9049 - The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification

CVE-2025-15647 - CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function whe

CVE-2025-15614 - ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when proce

CVE-2026-86178 - Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and commen

CVE-2026-86177 - Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task crea

CVE-2026-86176 - NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints

CVE-2026-86175 - NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL A

CVE-2026-86174 - Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public

CVE-2026-86173 - MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handl

CVE-2026-86169 - Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path whe

CVE-2026-86124 - AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that bin

CVE-2026-86123 - SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection

CVE-2026-86122 - Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated u

CVE-2026-86121 - Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment v

CVE-2026-86120 - APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGu

CVE-2026-86119 - Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in t

CVE-2026-86118 - gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, al

CVE-2026-86117 - Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler

CVE-2026-86116 - Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpo

CVE-2026-86115 - Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme n

CVE-2026-86114 - Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user ro

CVE-2026-86113 - BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough functi

CVE-2026-86112 - BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite

CVE-2026-86111 - BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, al

CVE-2026-76573 - The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site S

CVE-2024-11080 - The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticat

CVE-2026-85414 - The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cust

CVE-2026-83625 - The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-81543 - The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in

CVE-2026-75586 - The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scri

CVE-2026-75018 - The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions

CVE-2026-84937 - The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape us

CVE-2026-84936 - The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-

CVE-2026-84935 - The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check

CVE-2026-84934 - The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its aut

CVE-2026-84931 - The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode att

CVE-2026-84930 - The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly valida

CVE-2026-84927 - The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on o

CVE-2026-84926 - The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Googl

CVE-2026-84901 - The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its

CVE-2026-84899 - The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute b

CVE-2026-84898 - The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before

CVE-2026-84896 - The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-styl

CVE-2026-84745 - The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the use

CVE-2026-84225 - The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collabora

CVE-2026-84221 - The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it

CVE-2026-84022 - The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode a

CVE-2026-84021 - The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before out

CVE-2026-83544 - The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute

CVE-2026-83543 - The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching

CVE-2026-82846 - The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings b

CVE-2026-82304 - The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using

CVE-2026-81424 - The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled

CVE-2026-81423 - The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL befor

CVE-2026-81404 - The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before r

CVE-2026-81348 - The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to

CVE-2026-78438 - The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con

CVE-2026-78362 - The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential

CVE-2026-78150 - The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the po

CVE-2026-78149 - The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected be

CVE-2026-77830 - The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored C

CVE-2026-77826 - The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook

CVE-2026-4361 - The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and

CVE-2026-3853 - The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_s

CVE-2026-19887 - The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up

CVE-2026-19861 - The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly s

CVE-2026-19858 - The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform au

CVE-2026-19769 - The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to

CVE-2026-18843 - The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Si

CVE-2026-18406 - The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is

CVE-2026-16649 - The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Fi

CVE-2026-15984 - The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Para

CVE-2026-15247 - The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check be

CVE-2026-14975 - The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to

CVE-2025-15694 - The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its se

CVE-2025-15693 - The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided

CVE-2026-8625 - The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnera

CVE-2026-8623 - The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnera

CVE-2026-86145 - PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace

CVE-2026-83628 - The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, an

CVE-2026-83627 - The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulner

CVE-2026-77263 - The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu

CVE-2026-77233 - The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu

CVE-2026-18404 - The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site S

CVE-2026-13447 - The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versio

CVE-2025-14945 - The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to St

CVE-2026-86144 - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate

CVE-2026-86143 - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes n

CVE-2026-86142 - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xm

CVE-2026-86141 - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a str

CVE-2026-86140 - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

CVE-2026-86139 - In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

CVE-2026-86138 - In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-bas

CVE-2026-86137 - In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds rea

CVE-2026-86100 - Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote fil

CVE-2026-52777 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP objec

CVE-2026-52775 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest developm

CVE-2026-52774 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler refl

CVE-2026-52773 - YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archi

CVE-2026-52772 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still ap

CVE-2026-52771 - YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::

CVE-2026-52770 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listin

CVE-2026-52769 - YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/f

CVE-2026-52767 - YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureSe

CVE-2026-52766 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki ac

CVE-2026-52763 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/r

CVE-2026-52762 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Ser

CVE-2026-86098 - ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_e

CVE-2026-86097 - PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_

CVE-2026-86096 - PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::star

CVE-2026-86095 - Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attnam

CVE-2026-48019 - Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vuln

CVE-2026-86091 - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing

CVE-2026-86090 - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipient

CVE-2026-82684 - Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization

CVE-2026-77393 - In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which pe

CVE-2026-76925 - A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `o

CVE-2026-75925 - Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker

CVE-2026-46636 - Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::ch

CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-m

CVE-2026-85704 - A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f1

CVE-2026-85703 - A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.

CVE-2026-85702 - A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca92

CVE-2026-85701 - A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10e

CVE-2026-82712 - Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request for

CVE-2026-79426 - An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6

CVE-2026-79423 - An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seac

CVE-2026-77847 - Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded cred

CVE-2026-75439 - An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF compon

CVE-2026-75438 - Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of servic

CVE-2026-53769 - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before vers

CVE-2026-50894 - easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the backgroun

CVE-2025-67066 - SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary

CVE-2022-26961 - Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/bac

CVE-2026-85786 - Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote atta

CVE-2026-85643 - A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_q

CVE-2026-79391 - No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client co

CVE-2026-79390 - Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT com

CVE-2026-79389 - Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker

CVE-2026-71626 - An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the

CVE-2026-71625 - An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the Res

CVE-2026-71624 - An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models

CVE-2026-71622 - SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensi

CVE-2026-63464 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before v

CVE-2026-61699 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revoca

CVE-2026-55513 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before v

CVE-2026-55512 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before v

CVE-2026-53932 - laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1

CVE-2026-53604 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the we

CVE-2026-53603 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operat

CVE-2026-53602 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two re

CVE-2026-85781 - Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CS

CVE-2026-85639 - A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown c

CVE-2026-85638 - A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/us

CVE-2026-85637 - A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the functio

CVE-2026-81939 - A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and arc

CVE-2026-80119 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80118 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80117 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80116 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80115 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80114 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80113 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80112 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-78839 - An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrar

CVE-2026-78328 - A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Manage

CVE-2026-78327 - An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulner

CVE-2026-71620 - File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitr

CVE-2026-9317 - Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that a

CVE-2026-85769 - A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM

CVE-2026-85656 - An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.

CVE-2026-85654 - Improper neutralization of special elements used in a template engine in the CDK generator in Amazon

CVE-2026-85636 - A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown f

CVE-2026-84890 - undici's decompress interceptor decompresses response bodies according to the untrusted Content-Enco

CVE-2026-82538 - ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository

CVE-2026-80913 - In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean

CVE-2026-80912 - In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed cl

CVE-2026-80911 - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error

CVE-2026-80910 - In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro:

CVE-2026-80909 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message

CVE-2026-80908 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message

CVE-2026-80907 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min siz

CVE-2026-80906 - In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transpor

CVE-2026-80905 - In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_h