CVE-2026-80742 - In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte

CVE-2026-80741 - In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read

CVE-2026-80740 - In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when

CVE-2026-80739 - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is

CVE-2026-80738 - In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_p

CVE-2026-80737 - In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize

CVE-2026-80736 - In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth grou

CVE-2026-80735 - In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by

CVE-2026-80734 - In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping

CVE-2026-80733 - In the Linux kernel, the following vulnerability has been resolved: net: remove WARN_ON_ONCE() from

CVE-2026-80732 - In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge

CVE-2026-80731 - In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-

CVE-2026-80730 - In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing

CVE-2026-80729 - In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: initialise work

CVE-2026-80728 - In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix apertur

CVE-2026-80727 - In the Linux kernel, the following vulnerability has been resolved: x86/mce: Set up the polling tim

CVE-2026-80726 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear ro

CVE-2026-80465 - A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), M

CVE-2026-80254 - Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited

CVE-2026-80253 - An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker

CVE-2026-79679 - Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Serv

CVE-2026-78304 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-78080 - Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid

CVE-2026-78069 - Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2S

CVE-2026-78065 - Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDO

CVE-2026-78064 - Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in

CVE-2026-78000 - Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2S

CVE-2026-77999 - Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirm

CVE-2026-76642 - util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running

CVE-2026-76178 - A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the

CVE-2026-76177 - Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint

CVE-2026-76176 - SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to impro

CVE-2026-76175 - SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list

CVE-2026-76174 - Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_

CVE-2026-74769 - Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vuln

CVE-2026-74768 - Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (

CVE-2026-73600 - Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnera

CVE-2026-71224 - A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses al

CVE-2026-71222 - A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk

CVE-2026-71221 - A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value fro

CVE-2026-71220 - A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field

CVE-2026-71219 - A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c

CVE-2026-68860 - Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layou

CVE-2026-3852 - The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortc

CVE-2026-3416 - The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG)

CVE-2026-2573 - The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for Wo

CVE-2026-17539 - RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short interval

CVE-2026-15933 - OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticate

CVE-2026-15926 - Rejected reason: Red Hat Product Security has determined that this CVE ID is not needed

CVE-2021-43614 - Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to reso

CVE-2021-43613 - An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashe

CVE-2021-38489 - HDD password plaintext is stored in a UEFI variable.

CVE-2026-84888 - A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the f

CVE-2026-84887 - A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unk

CVE-2026-84886 - A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is

CVE-2026-84885 - A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function o

CVE-2026-84851 - An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remo

CVE-2026-84394 - fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting

CVE-2026-66049 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-66048 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-84857 - A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file s

CVE-2026-84856 - A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the functio

CVE-2026-84852 - A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affec

CVE-2026-84452 - Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models

CVE-2026-84292 - fast-uri serializes the port component of a URI without validating it. When recomposing the authorit

CVE-2026-82524 - UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated ad

CVE-2026-78662 - Previously, a channel registered in the mux's chanList is not usable until it is established. A mali

CVE-2026-75137 - UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows loca

CVE-2026-75136 - UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows

CVE-2026-75135 - UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows loca

CVE-2026-75134 - SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability

CVE-2026-56855 - Previously, after a channel has been established, a malicious peer could send crafted messages that

CVE-2023-20577 - A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enabl

CVE-2023-20576 - Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM dat

CVE-2026-84841 - A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects

CVE-2026-84840 - A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of

CVE-2026-84839 - A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some

CVE-2026-84382 - HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in

CVE-2026-84381 - HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in

CVE-2026-19117 - Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against

CVE-2026-84833 - A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Af

CVE-2026-84380 - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx

CVE-2026-84379 - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in s

CVE-2026-84378 - HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent

CVE-2026-84377 - LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versi

CVE-2026-82522 - libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allo

CVE-2026-77125 - A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group managemen

CVE-2026-77124 - In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/scr

CVE-2026-77123 - Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read

CVE-2026-77122 - An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories

CVE-2026-77121 - A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM f

CVE-2026-66786 - A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-

CVE-2026-55221 - Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up t

CVE-2026-53706 - PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to versi

CVE-2026-53671 - PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to versi

CVE-2026-53670 - PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to versi

CVE-2026-53649 - Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a lo

CVE-2026-49833 - DSpace open source software is a repository application which provides durable access to digital res

CVE-2026-49832 - DSpace open source software is a repository application which provides durable access to digital res

CVE-2026-49831 - DSpace open source software is a repository application which provides durable access to digital res

CVE-2026-49830 - DSpace open source software is a repository application which provides durable access to digital res

CVE-2026-49249 - Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up t

CVE-2026-84811 - agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, al

CVE-2026-84810 - claude-skill-antivirus fails to analyze executable files when scanning local skill directories, read

CVE-2026-84809 - Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis

CVE-2026-84376 - Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured no

CVE-2026-82404 - TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decodi

CVE-2026-79756 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4

CVE-2026-79755 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4

CVE-2026-79754 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. From version 1.6.19 to

CVE-2026-55421 - Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commi

CVE-2026-53636 - Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commi

CVE-2026-53635 - Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commi

CVE-2026-52833 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5

CVE-2026-52832 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5

CVE-2026-52831 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4

CVE-2026-45730 - Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0

CVE-2026-20355 - Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption fun

CVE-2026-20354 - Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption fun

CVE-2026-20281 - A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Vide

CVE-2026-20280 - As part of Cisco's ongoing commitment to proactive security and product quality, the&nbsp;Cisco IOS

CVE-2026-20279 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So

CVE-2026-20278 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So

CVE-2026-20277 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So

CVE-2026-20276 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So

CVE-2026-20275 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So

CVE-2026-20274 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So

CVE-2026-20212 - A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an u

CVE-2026-84838 - A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to e

CVE-2026-84837 - A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing th

CVE-2026-84677 - Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, desc

CVE-2026-84676 - Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job confi

CVE-2026-84675 - OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able

CVE-2026-84674 - Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers w

CVE-2026-84673 - Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's

CVE-2026-84672 - Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra

CVE-2026-84671 - Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary loca

CVE-2026-84670 - Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can b

CVE-2026-84669 - A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Ite

CVE-2026-84668 - Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider

CVE-2026-84667 - Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration thr

CVE-2026-84666 - Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plu

CVE-2026-84665 - Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard lin

CVE-2026-84664 - Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configurati

CVE-2026-84663 - A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v

CVE-2026-84662 - Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through

CVE-2026-84661 - A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier c

CVE-2026-84660 - A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier c

CVE-2026-84659 - Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check i

CVE-2026-84658 - Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` anno

CVE-2026-84657 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item

CVE-2026-84656 - A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers wi

CVE-2026-84655 - Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects

CVE-2026-84654 - In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.5

CVE-2026-84653 - Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not

CVE-2026-84652 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a us

CVE-2026-84651 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating a

CVE-2026-84650 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from dese

CVE-2026-84649 - In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c

CVE-2026-84648 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log rec

CVE-2026-84647 - In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.5

CVE-2026-84646 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field value

CVE-2026-84645 - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their conf

CVE-2026-78689 - Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list p

CVE-2026-78410 - A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pi

CVE-2026-78409 - The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the conf

CVE-2026-78408 - The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file des

CVE-2026-78222 - A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() c

CVE-2026-77180 - When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exi

CVE-2026-66842 - BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrat

CVE-2026-66362 - Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection

CVE-2026-63020 - A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacke

CVE-2026-53611 - Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary

CVE-2026-53600 - async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar

CVE-2026-19475 - An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-333

CVE-2026-18329 - Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access

CVE-2026-18058 - The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired wit

CVE-2026-14199 - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (syn

CVE-2026-12704 - When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of

CVE-2026-8151 - The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks

CVE-2026-83547 - The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings

CVE-2026-83533 - The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was

CVE-2026-82955 - In the current development version of Eclipse aeriOS, which has not yet had an official release, the

CVE-2026-82884 - The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored

CVE-2026-82293 - Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized re

CVE-2026-81571 - The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form fie

CVE-2026-79991 - Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumen

CVE-2026-79990 - Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumen

CVE-2026-79989 - The vulnerability allows any authenticated user to change their own password without providing the c

CVE-2026-78609 - Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modi

CVE-2026-78604 - Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local p

CVE-2026-78602 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic M

CVE-2026-78601 - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CA

CVE-2026-78600 - Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access vi

CVE-2026-78599 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kiban

CVE-2026-78598 - Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information dis

CVE-2026-78594 - Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial

CVE-2026-78591 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kiban

CVE-2026-78590 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kiban

CVE-2026-78588 - Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of s

CVE-2026-78587 - Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload op

CVE-2026-78586 - Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser

CVE-2026-78584 - Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disc

CVE-2026-78153 - The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before

CVE-2026-77794 - The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity m

CVE-2026-77793 - The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid re

CVE-2026-77009 - The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console,

CVE-2026-4357 - The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files vi

CVE-2026-2811 - The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insuf

CVE-2026-2688 - The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardc

CVE-2026-19698 - The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against

CVE-2026-17563 - The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirem

CVE-2026-14326 - The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating app

CVE-2026-14255 - A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncont

CVE-2026-10821 - The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redir

CVE-2025-9314 - The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload

CVE-2025-8945 - The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but thi

CVE-2025-15692 - The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description settin

CVE-2025-15490 - The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing una

CVE-2025-15489 - The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowi

CVE-2025-15485 - The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its RES

CVE-2025-15481 - The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script

CVE-2025-13398 - Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were

CVE-2024-7956 - A vulnerability exists in the affected products that allows a threat actor to gain access to user’s

CVE-2024-3773 - The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its sh

CVE-2023-3360 - The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, wh

CVE-2026-81269 - Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affect

CVE-2026-81205 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i

CVE-2026-81201 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-81168 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected P

CVE-2026-81167 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-81166 - Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. Th

CVE-2026-81165 - Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects B

CVE-2026-81164 - Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affect

CVE-2026-81162 - Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Edi

CVE-2026-81161 - Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allow

CVE-2026-81160 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-81159 - Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This

CVE-2026-81158 - Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affe

CVE-2026-76782 - Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

CVE-2026-76759 - Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

CVE-2026-76758 - Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*.

CVE-2026-76757 - Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

CVE-2026-76756 - Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

CVE-2026-76755 - Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*.

CVE-2026-73478 - Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Di

CVE-2026-73477 - Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affe

CVE-2026-73476 - Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privile

CVE-2026-73475 - Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue

CVE-2026-73474 - Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Re