CVE-2026-50085 - The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards th

CVE-2026-50084 - The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer

CVE-2026-50083 - The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is

CVE-2026-50082 - The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address

CVE-2026-50026 - Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of

CVE-2026-50020 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-50011 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-50010 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-50009 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-48748 - Netty is a network application framework for development of protocol servers and clients. Starting i

CVE-2026-48059 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-48043 - Netty is a network application framework for development of protocol servers and clients. In netty-c

CVE-2026-48006 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-47691 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-47190 - IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, an

CVE-2026-47182 - Frappe is a full-stack web application framework. Prior to version 16.17.4, any authenticated user c

CVE-2026-46690 - unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sende

CVE-2026-45833 - A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a

CVE-2026-45832 - All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database

CVE-2026-45831 - The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaD

CVE-2026-45830 - A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows

CVE-2026-44976 - Frappe is a full-stack web application framework. Prior to version 16.17.4, any user can modify any

CVE-2026-44975 - Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authen

CVE-2026-44967 - OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP

CVE-2026-44208 - Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, lack of va

CVE-2026-44207 - Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, an IDOR vu

CVE-2026-44206 - Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema

CVE-2026-40677 - The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a ma

CVE-2026-8694 - Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthent

CVE-2026-7368 - The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid c

CVE-2026-6853 - Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe

CVE-2026-6211 - Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc.

CVE-2026-54133 - jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem

CVE-2026-53787 - Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary fil

CVE-2026-53722 - Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <Nu

CVE-2026-53721 - Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 a

CVE-2026-47739 - Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, stored XSS

CVE-2026-47244 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-47210 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerabilit

CVE-2026-47209 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in b

CVE-2026-47208 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox br

CVE-2026-47141 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-w

CVE-2026-47140 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangero

CVE-2026-47139 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding pub

CVE-2026-47137 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gw

CVE-2026-47135 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-

CVE-2026-47131 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call

CVE-2026-46340 - Netty is a network application framework for development of protocol servers and clients. In version

CVE-2026-45674 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-45673 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-45536 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-45416 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-44894 - Netty is a network application framework for development of protocol servers and clients. NoQuicToke

CVE-2026-44893 - Netty is a network application framework for development of protocol servers and clients. In netty-c

CVE-2026-44205 - Frappe is a full-stack web application framework. Prior to version 15.106.0, a stored XSS vulnerabil

CVE-2026-41581 - Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a

CVE-2026-10557 - The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical

CVE-2026-54102 - Rejected reason: Reserved but no longer needed.

CVE-2026-54101 - Rejected reason: Reserved but no longer needed.

CVE-2026-49993 - Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpa

CVE-2026-47200 - Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.

CVE-2026-46342 - Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6

CVE-2026-45670 - Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpa

CVE-2026-45669 - Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 an

CVE-2026-1836 - The system stores the username and password from the login form after submitting the request. This c

CVE-2026-12066 - A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the functio

CVE-2026-12065 - A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This

CVE-2026-11967 - MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execu

CVE-2026-11879 - MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execu

CVE-2017-20240 - Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions us

CVE-2026-49347 - Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket p

CVE-2026-48485 - Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentio

CVE-2026-47197 - Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discor

CVE-2026-47196 - Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user i

CVE-2026-47195 - Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands chec

CVE-2026-9266 - A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux fir

CVE-2026-11849 - The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnera

CVE-2026-11848 - The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Authentication vulnera

CVE-2026-50645 - There is no restriction on the amount of attachment headers that a message can contain when being de

CVE-2026-50634 - A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to proce

CVE-2026-50633 - A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can

CVE-2026-50632 - A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lea

CVE-2026-50631 - A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Toke

CVE-2026-50630 - A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the

CVE-2026-50629 - The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log

CVE-2026-50628 - A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP addres

CVE-2026-50627 - The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of inc

CVE-2026-50623 - An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF.

CVE-2026-49875 - Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory w

CVE-2026-48914 - A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly

CVE-2026-11847 - The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal v

CVE-2026-11846 - The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File D

CVE-2026-11845 - The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injecti

CVE-2026-11844 - The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Rea

CVE-2026-12058 - The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.

CVE-2026-11535 - An unauthorized access vulnerability exists in the PcSuite APP. The vulnerability can be exploited b

CVE-2026-9271 - Vulnerability Title

CVE-2026-9269 - The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not saniti

CVE-2026-12060 - Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, all

CVE-2026-12059 - The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, all

CVE-2026-45169 - Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, an

CVE-2026-44892 - Netty is a network application framework for development of protocol servers and clients. Prior to v

CVE-2026-48613 - SQL injection vulnerability in phpBB profile field migration due to improper handling of user-suppli

CVE-2026-48612 - Improper state verification in the OAuth implementation could allow an attacker to manipulate the au

CVE-2026-48611 - Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth i

CVE-2026-48610 - Under certain network configurations, a malicious actor with access to network could exploit an Impr

CVE-2026-47370 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-47369 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-47368 - A malicious actor with access to the network could exploit a Path Traversal vulnerability found in c

CVE-2026-47367 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-47366 - Improper verification of access permissions when modifying permissions through the Administration Co

CVE-2026-47365 - Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows

CVE-2026-20746 - Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorize

CVE-2026-9125 - The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_ur

CVE-2026-45170 - Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and con

CVE-2026-11933 - A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert

CVE-2026-49482 - ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5

CVE-2026-10676 - Rejected reason: This CVE Record has been rejected by the Zephyr Project CNA. Subsequent analysis de

CVE-2026-47238 - ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal auth

CVE-2026-45418 - ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authentic

CVE-2026-45060 - ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p

CVE-2026-42846 - ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's

CVE-2026-6250 - An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to impr

CVE-2026-49060 - Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege E

CVE-2026-45174 - Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potent

CVE-2026-45173 - Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit

CVE-2026-45172 - Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior

CVE-2026-45171 - Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses

CVE-2026-44890 - Netty is a network application framework for development of protocol servers and clients. In netty-c

CVE-2026-44250 - Netty is a network application framework for development of protocol servers and clients. In netty-c

CVE-2026-44249 - Netty is a network application framework for development of protocol servers and clients. In netty-h

CVE-2026-42653 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-42647 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-39494 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-12035 - Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacke

CVE-2026-12034 - Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior

CVE-2026-12033 - Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacke

CVE-2026-12032 - Inappropriate implementation in Passwords in Google Chrome on Android prior to 149.0.7827.115 allowe

CVE-2026-12031 - Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a

CVE-2026-12030 - Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote atta

CVE-2026-12029 - Use after free in Video in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacke

CVE-2026-12028 - Use after free in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker

CVE-2026-12027 - Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote a

CVE-2026-12026 - Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote at

CVE-2026-12025 - Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allow

CVE-2026-12024 - Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remot

CVE-2026-12023 - Use after free in GPU in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who

CVE-2026-12022 - Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who

CVE-2026-12020 - Use after free in Autofill in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker

CVE-2026-12019 - Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allowe

CVE-2026-12018 - Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a l

CVE-2026-12017 - Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.115 allowed a remote

CVE-2026-12016 - Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote a

CVE-2026-12015 - Use after free in Autofill in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who ha

CVE-2026-12014 - Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local net

CVE-2026-12013 - Rejected reason: Determined not a vulnerability

CVE-2026-12012 - Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileg

CVE-2026-12011 - Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attac

CVE-2026-12010 - Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote att

CVE-2026-12009 - Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7

CVE-2026-12008 - Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attac

CVE-2026-12007 - Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker

CVE-2026-53819 - OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows

CVE-2026-53818 - OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature

CVE-2026-53817 - OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that al

CVE-2026-53816 - OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event

CVE-2026-53815 - OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions tha

CVE-2026-53814 - OpenClaw before 2026.5.20 contains a privilege escalation vulnerability where hook-triggered agent r

CVE-2026-53813 - OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading wh

CVE-2026-53812 - OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control th

CVE-2026-53811 - OpenClaw before 2026.5.7 contains a privilege escalation vulnerability in the Matrix allowFrom featu

CVE-2026-53810 - OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extensio

CVE-2026-53809 - OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allo

CVE-2026-53808 - OpenClaw before 2026.5.6 contains an approval policy bypass vulnerability in the Skill Workshop appl

CVE-2026-53807 - OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive call

CVE-2026-53806 - OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX s

CVE-2026-50245 - Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no

CVE-2026-50005 - Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to si

CVE-2026-41005 - Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a

CVE-2026-53782 - Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers w

CVE-2026-53781 - Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to

CVE-2026-49973 - Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows u

CVE-2026-49949 - CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent a

CVE-2026-46622 - SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authe

CVE-2026-46489 - SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload

CVE-2026-45802 - FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and us

CVE-2026-45175 - Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within

CVE-2026-12038 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-53702 - A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad)

CVE-2026-53701 - An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser

CVE-2026-52860 - Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-comple

CVE-2026-52859 - Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() fu

CVE-2026-52858 - Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completi

CVE-2026-48547 - KanaDojo contains a command injection vulnerability that allows an attacker with pull request access

CVE-2026-47250 - mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to

CVE-2026-47189 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47188 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47181 - PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection v

CVE-2026-47177 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47176 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47175 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47174 - In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build wo

CVE-2026-47173 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47172 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47171 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47170 - Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-ho

CVE-2026-47169 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47167 - Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnera

CVE-2026-47163 - Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to

CVE-2026-47162 - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injecti

CVE-2026-46519 - mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to

CVE-2026-45178 - Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within i

CVE-2026-45177 - Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its int

CVE-2026-45176 - Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within

CVE-2026-11774 - An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In s

CVE-2025-46315 - A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 2

CVE-2025-46313 - A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1.

CVE-2025-46308 - An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4

CVE-2025-46293 - This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15

CVE-2025-43339 - An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tah

CVE-2025-43278 - This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15

CVE-2025-31272 - The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may

CVE-2025-30459 - A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia

CVE-2025-30431 - The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonom

CVE-2025-24284 - This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed i

CVE-2025-24268 - A parsing issue in the handling of directory paths was addressed with improved path validation. This

CVE-2025-24165 - A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia

CVE-2026-49261 - MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11

CVE-2026-48546 - KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute ar

CVE-2026-47157 - aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted serve

CVE-2026-46698 - Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds

CVE-2026-46697 - Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds

CVE-2026-3329 - A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user ac

CVE-2026-11986 - A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative u

CVE-2026-49982 - tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a

CVE-2026-44705 - tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package conta

CVE-2026-44496 - Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on th

CVE-2026-44495 - Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1

CVE-2026-44494 - Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the A

CVE-2026-44492 - Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios

CVE-2026-44490 - Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios

CVE-2026-44489 - Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nest

CVE-2026-44488 - Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.

CVE-2026-44487 - Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’

CVE-2026-44486 - Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’

CVE-2026-11945 - PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by cr

CVE-2026-9648 - The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS cli

CVE-2026-7870 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified li

CVE-2026-7787 - IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive i

CVE-2026-53777 - Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server t