CVE-2026-18858 - IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privilege

CVE-2026-18658 - IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.

CVE-2026-18567 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a r

CVE-2022-35499 - In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site

CVE-2022-35497 - In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible

CVE-2026-9186 - IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only

CVE-2026-9138 - IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitr

CVE-2026-8447 - IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the

CVE-2026-85700 - Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, al

CVE-2026-85699 - jina-ai reader contains a server-side request forgery vulnerability where URL validation is performe

CVE-2026-85698 - Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader

CVE-2026-85697 - Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to

CVE-2026-85696 - SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded

CVE-2026-85695 - FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allow

CVE-2026-85694 - LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract

CVE-2026-85693 - Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows auth

CVE-2026-85692 - Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side

CVE-2026-85691 - MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /

CVE-2026-85690 - Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attacke

CVE-2026-85689 - llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/reso

CVE-2026-85688 - TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the

CVE-2026-85687 - surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the

CVE-2026-85686 - ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compa

CVE-2026-85685 - AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill t

CVE-2026-85684 - marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler t

CVE-2026-85676 - Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on eve

CVE-2026-85675 - OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_

CVE-2026-85674 - aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git

CVE-2026-85673 - LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API mult

CVE-2026-85672 - zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the

CVE-2026-85671 - QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_ba

CVE-2026-85670 - tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokeni

CVE-2026-85669 - potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/cod

CVE-2026-85668 - Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vuln

CVE-2026-85667 - xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints

CVE-2026-85666 - OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side reque

CVE-2026-85665 - Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing atta

CVE-2026-85664 - Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_constructio

CVE-2026-85663 - Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods th

CVE-2026-85662 - Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that

CVE-2026-85661 - excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unse

CVE-2026-85660 - cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with

CVE-2026-85651 - Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operatio

CVE-2026-85650 - Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert chann

CVE-2026-85626 - git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters

CVE-2026-85625 - sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, a

CVE-2026-85624 - Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList pr

CVE-2026-85623 - goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without secur

CVE-2026-85622 - AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket con

CVE-2026-85621 - LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ

CVE-2026-85620 - Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validatio

CVE-2026-85619 - AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in autho

CVE-2026-85618 - ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows a

CVE-2026-85608 - Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the

CVE-2026-85607 - Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (mess

CVE-2026-85606 - firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_par

CVE-2026-85605 - Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthen

CVE-2026-82729 - Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to

CVE-2026-82728 - Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remo

CVE-2026-81859 - CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to t

CVE-2026-81832 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-6958 - Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web

CVE-2026-19727 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-19205 - Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Fo

CVE-2026-14466 - It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vuln

CVE-2026-85522 - A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability i

CVE-2026-85517 - A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unk

CVE-2026-77818 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-52691 - ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command (

CVE-2026-19081 - Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Acce

CVE-2026-19057 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-12483 - The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up

CVE-2026-85649 - (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vu

CVE-2026-85516 - A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is

CVE-2026-85514 - A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown fun

CVE-2026-85513 - A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert

CVE-2026-82309 - Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per

CVE-2026-74237 - GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools I

CVE-2026-74236 - GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic f

CVE-2026-74235 - GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maint

CVE-2026-18198 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-85617 - snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete func

CVE-2026-85616 - Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance

CVE-2026-85615 - Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getL

CVE-2026-85614 - OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the

CVE-2026-85613 - OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon

CVE-2026-85612 - OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the

CVE-2026-85611 - OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in th

CVE-2026-85610 - OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated

CVE-2026-85609 - Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vuln

CVE-2026-85604 - Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in t

CVE-2026-85603 - Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As ac

CVE-2026-85602 - The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA v

CVE-2026-85601 - Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the D

CVE-2026-85600 - Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vul

CVE-2026-85599 - Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem]

CVE-2026-85598 - Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing

CVE-2026-85597 - Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerab

CVE-2026-85596 - Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress

CVE-2026-85595 - Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypas

CVE-2026-85594 - Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ing

CVE-2026-85593 - phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::con

CVE-2026-85592 - phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoi

CVE-2026-85591 - phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control pa

CVE-2026-85590 - phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authenticati

CVE-2026-85589 - phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard

CVE-2026-85588 - phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export

CVE-2026-85587 - phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-p

CVE-2026-85586 - phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in

CVE-2026-85585 - SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurr

CVE-2026-85584 - SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic

CVE-2026-85583 - SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-r

CVE-2026-85582 - SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-ser

CVE-2026-85581 - SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/u

CVE-2026-85580 - SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handl

CVE-2026-85579 - SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2)

CVE-2026-85578 - SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoin

CVE-2026-85577 - AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin

CVE-2026-19080 - Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account

CVE-2026-19051 - Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retriev

CVE-2026-19043 - Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functio

CVE-2026-18957 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-85534 - A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input st

CVE-2026-85512 - A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vu

CVE-2026-84428 - fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowerca

CVE-2026-84045 - The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a cli

CVE-2026-79707 - A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) v

CVE-2026-4644 - A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versi

CVE-2026-27347 - Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured

CVE-2026-85547 - A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF prote

CVE-2026-85546 - MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit func

CVE-2026-85541 - DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated

CVE-2026-85540 - DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers

CVE-2026-85184 - @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by m

CVE-2026-84504 - fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the

CVE-2026-84469 - fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthi

CVE-2026-84044 - The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal p

CVE-2026-84043 - The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify th

CVE-2026-82923 - The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or n

CVE-2026-81666 - An integer overflow was found in Corosync's handling of membership commit token messages. The length

CVE-2026-76169 - fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix t

CVE-2026-27086 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-13148 - Missing release of memory after effective lifetime vulnerability in Softing smartLink allows resourc

CVE-2026-85538 - An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes fr

CVE-2026-85533 - An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without ver

CVE-2026-85528 - Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver vers

CVE-2026-85525 - Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a r

CVE-2026-85311 - Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Config

CVE-2026-81665 - A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembl

CVE-2026-81302 - PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a loc

CVE-2026-57777 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-32480 - Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Confi

CVE-2026-27432 - Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allow

CVE-2026-15937 - Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the

CVE-2026-85229 - ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-

CVE-2026-85197 - A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can ex

CVE-2026-80190 - Apache Allura: stored XSS via SVN code repositories.  Git repositories are not known to be affected.

CVE-2026-6217 - Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online

CVE-2026-85094 - The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin ru

CVE-2026-85085 - The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView

CVE-2026-84146 - The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capa

CVE-2026-84066 - The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.

CVE-2026-82194 - The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user s

CVE-2026-82193 - The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user s

CVE-2026-82186 - The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination param

CVE-2026-81347 - The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-c

CVE-2026-81270 - Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: t

CVE-2026-80438 - The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrato

CVE-2026-80181 - Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affect

CVE-2026-80180 - Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from

CVE-2026-79632 - The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in o

CVE-2026-79631 - The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to

CVE-2026-79630 - The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a c

CVE-2026-74853 - The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may r

CVE-2026-71216 - PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves

CVE-2026-70403 - XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the

CVE-2026-69657 - XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the cr

CVE-2026-66840 - XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sp

CVE-2026-62928 - XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injec

CVE-2026-19224 - The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting

CVE-2026-17517 - The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view

CVE-2026-16281 - The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can ed

CVE-2026-15354 - The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,

CVE-2025-15691 - The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on

CVE-2026-85509 - FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-f

CVE-2026-85508 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc

CVE-2026-85507 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc

CVE-2026-85506 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_

CVE-2026-85505 - ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_en

CVE-2026-85504 - FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long

CVE-2026-85409 - A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the funct

CVE-2026-85408 - A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function o

CVE-2026-85407 - A vulnerability was found in Eleveo Quality Management 9.7.0. This issue affects some unknown proces

CVE-2026-11613 - The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up t

CVE-2026-85406 - A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknow

CVE-2026-85405 - A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the f

CVE-2026-85403 - A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknow

CVE-2026-85402 - A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affe

CVE-2026-85401 - A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is som

CVE-2026-85399 - A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by th

CVE-2026-85398 - A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the fun

CVE-2026-85149 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-85148 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-85147 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-85146 - SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un

CVE-2026-75754 - Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-co

CVE-2026-85397 - A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the fu

CVE-2026-85383 - A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unk

CVE-2026-85382 - A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601ef

CVE-2026-45200 - Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to c

CVE-2026-45197 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-85381 - A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d

CVE-2026-85380 - A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601

CVE-2026-85379 - A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf4

CVE-2026-67402 - An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs t

CVE-2026-67398 - Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8

CVE-2026-67397 - Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to ex

CVE-2026-49509 - Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue

CVE-2026-85456 - MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the S

CVE-2026-85455 - MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four

CVE-2026-85454 - MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegr

CVE-2026-85453 - MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, al

CVE-2026-85452 - MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeG

CVE-2026-85451 - MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSle

CVE-2026-85450 - MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server t

CVE-2026-85449 - MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE

CVE-2026-85448 - MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in p

CVE-2026-85447 - MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validat

CVE-2026-85446 - MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where

CVE-2026-85445 - MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() fu

CVE-2026-85444 - MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isC

CVE-2026-85443 - MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLo

CVE-2026-85442 - MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesW

CVE-2026-85441 - MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in C

CVE-2026-85440 - MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommP

CVE-2026-85439 - MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::

CVE-2026-85438 - MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dime

CVE-2026-85437 - MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string dec

CVE-2026-85436 - MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPkt

CVE-2026-85435 - MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on th

CVE-2026-85434 - MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbo

CVE-2026-85433 - MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing

CVE-2026-85432 - MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowi

CVE-2026-85431 - MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerab

CVE-2026-85430 - MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that ac

CVE-2026-85429 - MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather t

CVE-2026-85428 - MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB

CVE-2026-85427 - MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allow

CVE-2026-85426 - MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names w

CVE-2026-85425 - MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable