CVE-2026-78281 - Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

CVE-2026-78276 - Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78275 - Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78274 - Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78273 - Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.

CVE-2026-78271 - Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.

CVE-2026-78261 - Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.

CVE-2026-78260 - Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

CVE-2026-78257 - Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

CVE-2026-75020 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i

CVE-2026-75005 - Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin

CVE-2026-74848 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Ap

CVE-2026-59355 - In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs

CVE-2026-59354 - In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynami

CVE-2026-32566 - Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.6

CVE-2026-32564 - Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

CVE-2026-32550 - Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

CVE-2026-32479 - Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.

CVE-2026-27330 - Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

CVE-2026-78333 - The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submit

CVE-2026-78139 - The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription be

CVE-2026-78138 - The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX actio

CVE-2026-78137 - The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on

CVE-2026-78125 - The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its

CVE-2026-77991 - Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager

CVE-2026-77990 - Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla

CVE-2026-77989 - Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events M

CVE-2026-77035 - Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form

CVE-2026-77034 - Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in J

CVE-2026-77018 - The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s

CVE-2026-77017 - The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s

CVE-2026-77016 - The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user'

CVE-2026-76549 - The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF chec

CVE-2026-59278 - JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted package

CVE-2026-59275 - A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the

CVE-2026-59274 - The UnZipTransformer does not limit decompressed entry size or entry count when processing archives.

CVE-2026-59271 - When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cle

CVE-2026-59270 - Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an a

CVE-2026-47894 - Spring Cloud Config Server native environment repository allows exposure of configuration files outs

CVE-2026-47893 - A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive use

CVE-2026-47892 - A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerab

CVE-2026-47891 - A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not corr

CVE-2026-47890 - Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Event

CVE-2026-47889 - A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies with

CVE-2026-47888 - A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framewo

CVE-2026-47887 - A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and

CVE-2026-47886 - Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulner

CVE-2026-47885 - The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMe

CVE-2026-47884 - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has

CVE-2026-47883 - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching pa

CVE-2026-47881 - Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physic

CVE-2026-47880 - A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound compo

CVE-2026-47879 - Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for d

CVE-2026-47878 - DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Bas

CVE-2026-47877 - Spring Security Authorization Server's default consent page renders user-controlled values without H

CVE-2026-47875 - Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are v

CVE-2026-47864 - SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.O

CVE-2026-47849 - Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation

CVE-2026-19715 - The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access

CVE-2026-19454 - The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check b

CVE-2026-19225 - The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to net

CVE-2026-19223 - The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network adminis

CVE-2026-16569 - The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugi

CVE-2026-16568 - The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugi

CVE-2026-16567 - The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issui

CVE-2026-13416 - The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputt

CVE-2026-13415 - The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing se

CVE-2026-13414 - The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX act

CVE-2023-27508 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-27503 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-23544 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22446 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22445 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22437 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22434 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22433 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22430 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22426 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22423 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22420 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22364 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22352 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22343 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22328 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2023-22289 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2026-81491 - A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_

CVE-2026-16895 - A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JS

CVE-2026-81486 - A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the

CVE-2026-81485 - A security vulnerability has been detected in danielpopamd linkedin-ads-mcp 1.0.0. Affected by this

CVE-2026-19398 - An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local  a

CVE-2026-81421 - A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element i

CVE-2026-80183 - In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can l

CVE-2026-47874 - The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, c

CVE-2026-47863 - In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled

CVE-2026-47862 - An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultTy

CVE-2026-47861 - An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbo

CVE-2026-47860 - An attacker who can publish to a queue consumed by an application that has enabled message decompres

CVE-2026-47859 - RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6

CVE-2026-47857 - In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled

CVE-2026-47856 - Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserial

CVE-2026-47852 - A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malici

CVE-2026-47851 - Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in t

CVE-2026-47850 - Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root wh

CVE-2026-47845 - In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when

CVE-2026-81203 - A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affect

CVE-2026-80158 - A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module

CVE-2026-75340 - The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlin

CVE-2026-75338 - disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Con

CVE-2026-75336 - Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json a

CVE-2026-75332 - Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.down

CVE-2026-75330 - The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server

CVE-2026-69129 - KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluste

CVE-2026-65956 - KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the S

CVE-2026-47666 - Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Pe

CVE-2026-47665 - Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Pe

CVE-2026-21808 - HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which incr

CVE-2026-21807 - HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protecti

CVE-2026-18823 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2025-62341 - HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compr

CVE-2026-81202 - A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function creat

CVE-2026-77611 - SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authent

CVE-2026-77368 - SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resu

CVE-2026-77317 - SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, t

CVE-2026-77298 - SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3

CVE-2026-75333 - yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are dire

CVE-2026-75331 - tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /i

CVE-2026-75329 - The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no aut

CVE-2026-75328 - In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController

CVE-2026-65930 - LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerabili

CVE-2026-65647 - Improper symlink resolution before file access in Plesk allows remote authenticated users to execute

CVE-2026-65646 - Improper neutralization of special elements in in Plesk's DNS zone management functionality allows r

CVE-2026-65642 - Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows

CVE-2026-65641 - A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the s

CVE-2026-64632 - A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter servi

CVE-2026-63360 - LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting v

CVE-2026-61617 - Wings is the server control plane for the Pterodactyl game-server management panel. In versions up t

CVE-2026-58070 - A vulnerability that records guest OS processing credentials in cleartext in a support log on the gu

CVE-2026-55182 - LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert tran

CVE-2026-45694 - LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox applica

CVE-2026-43621 - Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-

CVE-2026-21810 - HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack o

CVE-2026-21809 - HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive e

CVE-2026-16809 - LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the surve

CVE-2026-79921 - amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker

CVE-2026-77573 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-77507 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-75415 - AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java re

CVE-2026-75414 - In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the

CVE-2026-75413 - DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authenti

CVE-2026-75411 - JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow mo

CVE-2026-75364 - Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET han

CVE-2026-75363 - An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the

CVE-2026-62326 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-62249 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-61792 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-61790 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-55228 - Weblate is a web-based continuous localization platform used to manage software translations. In ver

CVE-2026-55227 - Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up obj

CVE-2026-52473 - An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter

CVE-2026-52103 - A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of

CVE-2026-39275 - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to ex

CVE-2026-15973 - LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Surve

CVE-2025-61480 - An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically

CVE-2025-61479 - An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically

CVE-2025-61478 - An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically

CVE-2025-51679 - An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can

CVE-2025-51675 - An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (P

CVE-2026-79939 - Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Fo

CVE-2026-79938 - Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnera

CVE-2026-77652 - A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer

CVE-2026-77508 - Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the acco

CVE-2026-75601 - Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Th

CVE-2026-75334 - The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The

CVE-2026-75327 - In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocContro

CVE-2026-74774 - Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulne

CVE-2026-74771 - Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Con

CVE-2026-74770 - Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special El

CVE-2026-71172 - Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF)

CVE-2026-71054 - Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Ja

CVE-2026-68863 - Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerabil

CVE-2026-68861 - Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special El

CVE-2026-68000 - The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size

CVE-2026-67275 - Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy

CVE-2026-66003 - Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version

CVE-2026-60004 - Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation

CVE-2026-56547 - The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchroniz

CVE-2026-54245 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, th

CVE-2026-49809 - Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Spe

CVE-2026-47848 - In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Net

CVE-2026-47844 - In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated req

CVE-2026-47843 - In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor

CVE-2026-47842 - Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV gen

CVE-2026-47834 - Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are acc

CVE-2026-46371 - Fleet is an open-source device management platform built on osquery. In versions up to and including

CVE-2026-46370 - Fleet is an open-source device management platform built on osquery. In versions up to and including

CVE-2026-46369 - Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus

CVE-2026-26449 - In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server

CVE-2026-26448 - Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the

CVE-2026-26447 - Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE co

CVE-2026-26446 - Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP c

CVE-2026-26445 - stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames

CVE-2025-70340 - A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below

CVE-2025-70293 - An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in f

CVE-2025-70290 - An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS

CVE-2026-79940 - Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an

CVE-2026-75466 - libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When proce

CVE-2026-75325 - DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/d

CVE-2026-71171 - Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special

CVE-2026-70419 - Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special

CVE-2026-63179 - Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and

CVE-2026-51106 - An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/per

CVE-2026-48786 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, th

CVE-2026-41262 - Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, th

CVE-2026-36851 - Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and networ

CVE-2026-19485 - A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Searc

CVE-2025-61165 - An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI

CVE-2025-61164 - Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.

CVE-2025-61163 - Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with unt

CVE-2025-61162 - Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user in

CVE-2026-76784 - Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections in the local

CVE-2026-58474 - whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that

CVE-2026-54256 - Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and

CVE-2026-47841 - An application using Spring Security's WebAuthn support may be vulnerable to user verification bypas

CVE-2026-47837 - Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webh

CVE-2026-47836 - The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server t

CVE-2026-32639 - Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and

CVE-2026-32593 - Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and

CVE-2025-56798 - Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14

CVE-2025-29419 - CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.

CVE-2023-42179 - Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key deri

CVE-2026-80153 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-35445 - Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1

CVE-2026-32258 - Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Fr

CVE-2026-32257 - Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Pr

CVE-2020-15878 - An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can

CVE-2020-15876 - An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can

CVE-2020-15874 - An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can

CVE-2026-81036 - Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in

CVE-2026-81035 - Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/t

CVE-2026-81034 - Netmaker disables certificate verification on the connection to the configured mail server. The send

CVE-2026-81033 - Automatisch reveals whether an address is registered through the response to its forgot-password req

CVE-2026-81032 - NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon star

CVE-2026-81031 - IDURAR ERP CRM changes the password of whichever account a request names rather than the account mak

CVE-2026-81030 - Mage AI does not confine the paths accepted by its browser-items API to the project directory. Brows

CVE-2026-81029 - OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued to

CVE-2026-81028 - ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix compa

CVE-2026-81027 - one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a r

CVE-2026-80428 - ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnera

CVE-2026-80427 - bestzip builds the argument list for the system zip utility without separating options from operands

CVE-2026-80426 - FiftyOne renders a dataset field's description as markup. The sidebar field-information component at