CVE-2026-65818 - Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privil

CVE-2026-62916 - Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorize

CVE-2026-62906 - Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows

CVE-2026-18330 - A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A L

CVE-2026-18167 - A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4.

CVE-2026-85224 - A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part o

CVE-2026-85223 - A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functio

CVE-2026-64200 - There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64199 - There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64198 - There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64197 - There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64196 - There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied

CVE-2026-64195 - There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-su

CVE-2026-9745 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without vali

CVE-2026-9744 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS

CVE-2026-9736 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject dat

CVE-2026-9036 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS

CVE-2026-8862 - IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the appl

CVE-2026-85458 - Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.

CVE-2026-85222 - A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unkn

CVE-2026-85208 - A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affecte

CVE-2026-85063 - node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prio

CVE-2026-85062 - Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior t

CVE-2026-85061 - MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanit

CVE-2026-84185 - A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing a

CVE-2026-82521 - parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from

CVE-2026-82520 - parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no li

CVE-2026-77465 - toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.

CVE-2026-71429 - stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal mem

CVE-2026-63376 - toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler

CVE-2026-85207 - A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an u

CVE-2026-85053 - Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote

CVE-2026-85052 - Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attack

CVE-2026-85051 - Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to e

CVE-2026-85050 - Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote

CVE-2026-85049 - Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute

CVE-2026-85048 - Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who

CVE-2026-85047 - Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82

CVE-2026-85046 - Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute ar

CVE-2026-85045 - Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute ar

CVE-2026-85044 - Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a r

CVE-2026-85043 - Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to b

CVE-2026-85042 - Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to exec

CVE-2026-82527 - R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to in

CVE-2026-53728 - Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6,

CVE-2026-44506 - Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1

CVE-2026-19795 - Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during dese

CVE-2026-85396 - rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fail

CVE-2026-85395 - UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL

CVE-2026-85394 - python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepti

CVE-2026-85393 - node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during

CVE-2026-85392 - Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user

CVE-2026-85391 - Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows u

CVE-2026-85390 - Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notificati

CVE-2026-85389 - Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API

CVE-2026-85388 - Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helpe

CVE-2026-85205 - A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affec

CVE-2026-85028 - Creation of a temporary file in a directory with insecure permissions in the FPGA management tool in

CVE-2026-82526 - R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attacke

CVE-2026-82302 - Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via

CVE-2026-82299 - Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorr

CVE-2026-82298 - Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly

CVE-2026-78596 - Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization

CVE-2026-78595 - Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862)

CVE-2026-78593 - An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticate

CVE-2026-78583 - Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipula

CVE-2026-49456 - Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper e

CVE-2026-49455 - Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher in

CVE-2026-33630 - c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-

CVE-2026-15431 - A potential security vulnerability has been identified in the HP Support Assistant for versions pri

CVE-2026-85187 - A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affe

CVE-2026-85012 - Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthe

CVE-2026-84968 - An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthen

CVE-2026-83959 - Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in

CVE-2026-82024 - LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that a

CVE-2026-82023 - LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability

CVE-2026-63219 - GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.

CVE-2026-58400 - GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.

CVE-2026-85309 - Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorr

CVE-2026-85308 - Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows

CVE-2026-85307 - Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allow

CVE-2026-85306 - Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress

CVE-2026-85305 - Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. Th

CVE-2026-85304 - Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Wid

CVE-2026-85303 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-85302 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-85242 - PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retriev

CVE-2026-85186 - A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this

CVE-2026-84849 - Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

CVE-2026-84848 - Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

CVE-2026-84847 - Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

CVE-2026-84836 - Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

CVE-2026-84834 - Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

CVE-2026-84814 - Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.

CVE-2026-84813 - Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

CVE-2026-84812 - Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

CVE-2026-84779 - Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 v

CVE-2026-84778 - Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 vers

CVE-2026-84777 - Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

CVE-2026-84776 - Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.

CVE-2026-84774 - Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

CVE-2026-84773 - Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

CVE-2026-84769 - Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

CVE-2026-84768 - Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

CVE-2026-84767 - Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

CVE-2026-84766 - Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

CVE-2026-84765 - Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

CVE-2026-84763 - Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

CVE-2026-84762 - Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.

CVE-2026-84761 - Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.

CVE-2026-84758 - Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

CVE-2026-84757 - Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.

CVE-2026-84756 - Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.

CVE-2026-84755 - Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

CVE-2026-84754 - Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

CVE-2026-84753 - Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

CVE-2026-84752 - Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.

CVE-2026-84736 - In the current development version of Eclipse aeriOS, for which no official release has yet been pub

CVE-2026-84238 - Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versi

CVE-2026-84215 - Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.

CVE-2026-81776 - Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.

CVE-2026-81773 - Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions

CVE-2026-81300 - Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.

CVE-2026-81295 - Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.

CVE-2026-81292 - Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.

CVE-2026-81282 - Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versi

CVE-2026-81281 - Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.

CVE-2026-75602 - OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-down

CVE-2026-85239 - A vulnerability in MISP's event template handling allowed an authenticated user with permission to c

CVE-2026-85238 - MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configurat

CVE-2026-85237 - A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacke

CVE-2026-85236 - A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The

CVE-2026-85138 - A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file w

CVE-2026-85137 - A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf o

CVE-2026-84967 - A component of the MongoDB extension for Visual Studio Code does not neutralize special characters i

CVE-2026-84966 - An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driv

CVE-2026-84965 - An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can

CVE-2026-84964 - A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver

CVE-2026-84963 - An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library

CVE-2026-84962 - An unauthorized user with key vault write access may cause an authorized client to issue arbitrary a

CVE-2026-83961 - ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege es

CVE-2026-82525 - Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that all

CVE-2026-75036 - A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evalu

CVE-2026-75035 - A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector nami

CVE-2026-75034 - A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for

CVE-2026-71963 - Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulner

CVE-2026-57445 - Gardens v2 is a modular governance framework that enables communities to create and manage multiple

CVE-2026-55658 - Gardens v2 is a modular governance framework that enables communities to create and manage multiple

CVE-2026-53924 - Gardens v2 is a modular governance framework that enables communities to create and manage multiple

CVE-2026-53720 - pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32

CVE-2026-50554 - Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID

CVE-2026-48486 - Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (Po

CVE-2026-85230 - A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configurat

CVE-2026-85227 - MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering

CVE-2026-85226 - MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calcu

CVE-2026-85221 - MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$v

CVE-2026-85216 - MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication component

CVE-2026-85214 - vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users

CVE-2026-85213 - Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints

CVE-2026-85212 - CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServic

CVE-2026-85211 - Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects

CVE-2026-85210 - Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, al

CVE-2026-85199 - Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in t

CVE-2026-85183 - Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowin

CVE-2026-85182 - vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to t

CVE-2026-85181 - CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side ke

CVE-2026-85180 - Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenti

CVE-2026-85179 - Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch

CVE-2026-85178 - Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKey

CVE-2026-85177 - CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystem

CVE-2026-85176 - DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to

CVE-2026-85135 - A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMe

CVE-2026-84989 - ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717,

CVE-2026-84971 - Improper handling of an unexpected value size in the decryption path of a client-side encryption lib

CVE-2026-84970 - A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON

CVE-2026-84969 - A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a s

CVE-2026-75033 - A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on

CVE-2026-71404 - A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name f

CVE-2026-71403 - A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a Use

CVE-2026-63694 - Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of

CVE-2026-56128 - pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules

CVE-2026-56127 - pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Ed

CVE-2026-56126 - pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring

CVE-2026-35160 - Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of

CVE-2026-85110 - A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of th

CVE-2026-85109 - A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of

CVE-2026-84815 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-82180 - In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate

CVE-2026-80515 - In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects ev

CVE-2026-6071 - A remote code execution security issue exists in the affected products when parsing DOE files that c

CVE-2025-12737 - The administrative operations within the Carbon Console do not adequately validate specific user-sup

CVE-2026-9854 - A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools c

CVE-2026-9853 - A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the

CVE-2026-9852 - A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data t

CVE-2026-85175 - SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath

CVE-2026-85174 - SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file wh

CVE-2026-85173 - n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights

CVE-2026-85172 - n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request

CVE-2026-85171 - n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi,

CVE-2026-85170 - n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo no

CVE-2026-85169 - n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI

CVE-2026-85168 - n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in th

CVE-2026-85167 - n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsea

CVE-2026-85166 - n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline wor

CVE-2026-85165 - n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free identifiers

CVE-2026-85164 - WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set

CVE-2026-85163 - AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG pars

CVE-2026-85162 - AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/s

CVE-2026-85161 - AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.

CVE-2026-85160 - AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerabili

CVE-2026-85159 - AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin

CVE-2026-85158 - AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbe

CVE-2026-85157 - WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php end

CVE-2026-85156 - WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthen

CVE-2026-85155 - WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php

CVE-2026-85154 - WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a

CVE-2026-85150 - A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occ

CVE-2026-85124 - @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash

CVE-2026-85107 - A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the functi

CVE-2026-85106 - A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchL

CVE-2026-85105 - A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _s

CVE-2026-85100 - A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is

CVE-2026-85093 - Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user fi

CVE-2026-85092 - LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW w

CVE-2026-85091 - zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate()

CVE-2026-85090 - FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV4

CVE-2026-85089 - FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Ses

CVE-2026-85084 - Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source Tize

CVE-2026-85040 - A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is

CVE-2026-85031 - A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of th

CVE-2026-85030 - A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. Th

CVE-2026-85022 - A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the func

CVE-2026-85021 - A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of

CVE-2026-84832 - SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged RE

CVE-2026-84831 - SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi

CVE-2026-84830 - SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows a

CVE-2026-82918 - XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software

CVE-2026-80757 - In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permiss

CVE-2026-80756 - In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy

CVE-2026-80755 - In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission va

CVE-2026-80754 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55

CVE-2026-80753 - In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a mo

CVE-2026-80752 - In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver

CVE-2026-80751 - In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initia

CVE-2026-80750 - In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaini

CVE-2026-80749 - In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of

CVE-2026-80748 - In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteratio

CVE-2026-80747 - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check fo

CVE-2026-80746 - In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix di

CVE-2026-80745 - In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNE