CVE-2026-16647 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page

CVE-2026-84835 - Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Co

CVE-2026-84808 - Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet

CVE-2026-84807 - Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability

CVE-2026-84806 - Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that a

CVE-2026-84805 - Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for lo

CVE-2026-84804 - Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities,

CVE-2026-84803 - SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an

CVE-2026-84802 - Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in Asse

CVE-2026-84801 - Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl end

CVE-2026-84800 - Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in Asset

CVE-2026-84799 - Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations i

CVE-2026-84798 - Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in

CVE-2026-84797 - Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsControlle

CVE-2026-84796 - Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutatio

CVE-2026-84795 - Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to p

CVE-2026-84794 - Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when f

CVE-2026-84793 - Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability

CVE-2026-84792 - Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-index

CVE-2026-84781 - Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

CVE-2026-84780 - Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.

CVE-2026-84775 - Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.

CVE-2026-84772 - Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

CVE-2026-84771 - Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versio

CVE-2026-84770 - Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.

CVE-2026-84764 - Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versi

CVE-2026-84760 - Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

CVE-2026-84759 - Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

CVE-2026-84217 - Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows A

CVE-2026-83562 - Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

CVE-2026-82223 - Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

CVE-2026-81775 - Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

CVE-2026-81774 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore

CVE-2026-81772 - Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.

CVE-2026-81771 - Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.

CVE-2026-81770 - Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.

CVE-2026-81769 - Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation

CVE-2026-81294 - Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

CVE-2026-81289 - Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar

CVE-2026-81288 - Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versi

CVE-2026-81286 - Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

CVE-2026-81283 - Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.

CVE-2026-66652 - Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request F

CVE-2026-82958 - In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity

CVE-2026-32773 - There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious

CVE-2026-19219 - In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog

CVE-2026-18672 - In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied s

CVE-2026-84175 - In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels

CVE-2026-53683 - reset_password.html parses query string parameters and uses the 'url' parameter as a redirection tar

CVE-2026-75528 - The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Commen

CVE-2026-23591 - Rejected reason: Withdrawn by requester.

CVE-2026-23590 - Rejected reason: Withdrawn by requester.

CVE-2026-23589 - Rejected reason: Withdrawn by requester.

CVE-2026-23588 - Rejected reason: Withdrawn by requester.

CVE-2026-23587 - Rejected reason: Withdrawn by requester.

CVE-2026-23586 - Rejected reason: Withdrawn by requester.

CVE-2026-23585 - Rejected reason: Withdrawn by requester.

CVE-2026-23584 - Rejected reason: Withdrawn by requester.

CVE-2026-23583 - Rejected reason: Withdrawn by requester.

CVE-2026-14828 - Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and A

CVE-2025-7963 - The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the s

CVE-2026-82883 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-3850 - The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` par

CVE-2026-82183 - The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion retur

CVE-2026-82182 - The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user s

CVE-2026-81807 - The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before r

CVE-2026-81737 - The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by u

CVE-2026-81583 - The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when

CVE-2026-81432 - The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on som

CVE-2026-81428 - The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user

CVE-2026-81427 - The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-e

CVE-2026-81426 - The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-e

CVE-2026-81199 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorizati

CVE-2026-81198 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify owners

CVE-2026-81197 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a R

CVE-2026-81196 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify owners

CVE-2026-81195 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorizati

CVE-2026-81194 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify author

CVE-2026-80467 - The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role subm

CVE-2026-79621 - The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthentica

CVE-2026-78657 - The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletio

CVE-2026-78151 - The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returnin

CVE-2026-77792 - The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field val

CVE-2026-77788 - The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updat

CVE-2026-77787 - The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk met

CVE-2026-77785 - The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permi

CVE-2026-77784 - The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit th

CVE-2026-77783 - The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it ren

CVE-2026-77782 - The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password prote

CVE-2026-77764 - The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking f

CVE-2026-74927 - The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one

CVE-2026-19723 - The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properl

CVE-2026-19719 - The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape

CVE-2026-19704 - The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database quer

CVE-2026-19453 - The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the acco

CVE-2026-19251 - The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approv

CVE-2026-19116 - The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from b

CVE-2026-16983 - The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of

CVE-2026-16966 - The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status che

CVE-2026-15232 - The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or

CVE-2026-14357 - The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and in

CVE-2026-14215 - The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require aut

CVE-2026-12865 - The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters be

CVE-2026-12526 - The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the reques

CVE-2025-15664 - The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly e

CVE-2025-15663 - The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly e

CVE-2026-9055 - The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerab

CVE-2025-46418 - Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

CVE-2024-35585 - Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

CVE-2026-3851 - The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content fe

CVE-2026-19754 - Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileg

CVE-2026-84442 - A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability

CVE-2026-84441 - A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some un

CVE-2026-14982 - The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficie

CVE-2026-14957 - In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that

CVE-2026-84715 - FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSu

CVE-2026-84485 - APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authe

CVE-2026-84484 - ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function

CVE-2026-84438 - A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the

CVE-2026-84437 - A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function o

CVE-2026-84431 - A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the fu

CVE-2026-82968 - A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a

CVE-2026-84702 - facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers

CVE-2026-84701 - NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create p

CVE-2026-84700 - PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the cl

CVE-2026-84699 - Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local ac

CVE-2026-84698 - PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a fo

CVE-2026-84697 - Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16

CVE-2026-84696 - Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique comm

CVE-2026-84695 - BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload

CVE-2026-84694 - Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands exec

CVE-2026-84430 - A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects

CVE-2026-84427 - A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of

CVE-2026-84425 - A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of

CVE-2026-84359 - Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had c

CVE-2026-84358 - Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote

CVE-2026-84357 - Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attack

CVE-2026-84356 - UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker

CVE-2026-84355 - Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attac

CVE-2026-84354 - Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attac

CVE-2026-84353 - Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a

CVE-2026-84352 - Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attac

CVE-2026-84351 - Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attack

CVE-2026-84350 - Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leverag

CVE-2026-84349 - Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had

CVE-2026-84348 - Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker t

CVE-2026-84347 - Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execut

CVE-2026-84335 - Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacke

CVE-2026-84334 - Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed

CVE-2026-84333 - Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attack

CVE-2026-84332 - Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote att

CVE-2026-84331 - Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker w

CVE-2026-84330 - UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a r

CVE-2026-84329 - Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed

CVE-2026-84328 - Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacke

CVE-2026-84327 - Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a

CVE-2026-84326 - Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to ex

CVE-2026-84325 - Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote a

CVE-2026-84324 - Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute

CVE-2026-84323 - Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacke

CVE-2026-81928 - Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data w

CVE-2026-84483 - WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json

CVE-2026-84482 - WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_d

CVE-2026-84481 - WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugi

CVE-2026-84480 - WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, al

CVE-2026-84479 - WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely o

CVE-2026-84478 - WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allo

CVE-2026-84477 - AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowin

CVE-2026-84476 - WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers

CVE-2026-84423 - A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file

CVE-2026-84208 - AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Loca

CVE-2026-84642 - The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular e

CVE-2026-84641 - A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted I

CVE-2026-84640 - A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This v

CVE-2026-84639 - Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. Th

CVE-2026-84637 - Malicious calendar invitations could use file URI attachments to launch local or network-hosted exec

CVE-2026-84375 - js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalM

CVE-2026-84374 - Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, i

CVE-2026-84373 - Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mo

CVE-2026-84372 - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 un

CVE-2026-84289 - A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the

CVE-2026-84288 - A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function

CVE-2026-83549 - Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command I

CVE-2026-83548 - A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to

CVE-2026-76851 - A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that a

CVE-2026-75604 - Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and

CVE-2026-19118 - A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server

CVE-2026-18730 - A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that a

CVE-2023-54391 - Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in

CVE-2026-84470 - A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch A

CVE-2026-84371 - ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp

CVE-2026-84370 - SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG

CVE-2026-84369 - SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG

CVE-2026-84368 - joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 an

CVE-2026-84367 - joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 an

CVE-2026-84366 - Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/co

CVE-2026-84365 - Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 u

CVE-2026-84364 - Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.

CVE-2026-84363 - Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.

CVE-2026-84361 - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious

CVE-2026-84311 - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PD

CVE-2026-84310 - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PD

CVE-2026-84287 - A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown fu

CVE-2026-73783 - Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could all

CVE-2026-73782 - A format string vulnerability exists in the command line interface of AOS-CX that could lead to unau

CVE-2026-73781 - A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote

CVE-2026-73780 - A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a

CVE-2026-73779 - Vulnerabilities have been identified in the operating system of AOS-CX switches that could potential

CVE-2026-73778 - A vulnerability exists in the Credential Manager component that may allow for unauthorized administr

CVE-2026-73777 - Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially a

CVE-2026-73776 - A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Succes

CVE-2026-73775 - Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low p

CVE-2026-73774 - A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead

CVE-2026-73773 - An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Succe

CVE-2026-73772 - Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unaut

CVE-2026-73771 - An authentication vulnerability exists in the AOS-CX management interface and API that may allow imp

CVE-2026-73770 - An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could

CVE-2026-73768 - A vulnerability exists in the command line interface of AOS-CX that may allow for improper processin

CVE-2026-73767 - Authenticated command injection vulnerabilities exist in the command line interface of AOS-CX. Succe

CVE-2026-73766 - Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote

CVE-2026-73765 - Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitati

CVE-2026-73764 - Vulnerabilities have been identified in the operating system of AOS-CX switches that could potential

CVE-2026-73763 - A vulnerability exists in a management component that could allow an unauthenticated adjacent attack

CVE-2026-73762 - A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to

CVE-2026-73761 - An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could l

CVE-2026-73760 - An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vuln

CVE-2026-73759 - Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-

CVE-2026-73758 - A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation c

CVE-2026-73757 - A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote

CVE-2026-73756 - A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain

CVE-2026-73755 - A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation c

CVE-2026-73754 - Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploita

CVE-2026-73753 - Exploitation through affected command-line operations could allow an authenticated low-privileged us

CVE-2026-73752 - An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successfu

CVE-2026-73751 - An authenticated user with low-privileged access could submit crafted input through the web-based ma

CVE-2026-73750 - Vulnerabilities exist in the authentication module that may improperly process malformed or truncate

CVE-2026-73749 - Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malfo

CVE-2026-73524 - Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows

CVE-2026-71981 - Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attacker

CVE-2026-63435 - Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prio

CVE-2026-84309 - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PD

CVE-2026-84308 - phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar

CVE-2026-84307 - Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un

CVE-2026-78608 - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CA

CVE-2026-78607 - Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to informatio

CVE-2026-78606 - Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and d

CVE-2026-78605 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch c

CVE-2026-78603 - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrec

CVE-2026-78597 - Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credenti

CVE-2026-78592 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana ca