CVE-2026-48548 - Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the C

CVE-2026-80589 - In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer w

CVE-2026-80588 - In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocate

CVE-2026-80587 - In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some inc

CVE-2026-80586 - In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS field

CVE-2026-80585 - In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTF

CVE-2026-80584 - In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer

CVE-2026-80583 - In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-tx-macro: F

CVE-2026-80582 - In the Linux kernel, the following vulnerability has been resolved: drm/shmem_helper: Check VMA bou

CVE-2026-80581 - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Continue t

CVE-2026-80580 - In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output

CVE-2026-80579 - In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode befo

CVE-2026-80578 - In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desync

CVE-2026-80577 - In the Linux kernel, the following vulnerability has been resolved: drm/panthor: skip zero-sized fi

CVE-2026-80576 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IB

CVE-2026-80575 - In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate

CVE-2026-80574 - In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array ou

CVE-2026-80573 - In the Linux kernel, the following vulnerability has been resolved: Input: iforce - validate input

CVE-2026-80572 - In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer

CVE-2026-80571 - In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attes

CVE-2026-80570 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero re

CVE-2026-80569 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound t

CVE-2026-80568 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s

CVE-2026-80567 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propaga

CVE-2026-80566 - In the Linux kernel, the following vulnerability has been resolved: Input: hynitron_cstxxx - valida

CVE-2026-80565 - In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in

CVE-2026-80564 - In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due t

CVE-2026-80563 - In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fi

CVE-2026-80562 - In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use raw_spinlock_

CVE-2026-80561 - In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe de

CVE-2026-80560 - In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restor

CVE-2026-80559 - In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device

CVE-2026-80558 - In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid os

CVE-2026-80557 - In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode

CVE-2026-80556 - In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-f

CVE-2026-80555 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory

CVE-2026-80554 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number

CVE-2026-80553 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing

CVE-2026-80552 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for

CVE-2026-80551 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDA

CVE-2026-80550 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bound

CVE-2026-80549 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup

CVE-2026-80548 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expa

CVE-2026-80547 - In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw

CVE-2026-80546 - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB l

CVE-2026-80545 - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB

CVE-2026-80544 - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB

CVE-2026-80543 - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA o

CVE-2026-80542 - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL point

CVE-2026-80541 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE

CVE-2026-80540 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD decode imag

CVE-2026-80539 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disallow multiple F

CVE-2026-80538 - In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfs_

CVE-2026-80537 - In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcou

CVE-2026-80536 - In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log it

CVE-2026-80535 - In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when del

CVE-2026-80534 - In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in

CVE-2026-80533 - In the Linux kernel, the following vulnerability has been resolved: xfs: don't walk off the end of

CVE-2026-80532 - In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infini

CVE-2026-80531 - In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in

CVE-2026-80530 - In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink

CVE-2026-80529 - In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recove

CVE-2026-80528 - In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while us

CVE-2026-80527 - In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_ca

CVE-2026-80526 - In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values

CVE-2026-80525 - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refre

CVE-2026-80524 - In the Linux kernel, the following vulnerability has been resolved: optee: ffa: Add NULL check in o

CVE-2026-80523 - In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clo

CVE-2026-80522 - In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->crypt

CVE-2026-80521 - In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in un

CVE-2026-80520 - In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when

CVE-2026-80519 - In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cl

CVE-2026-75062 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the defaul

CVE-2026-74754 - In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM

CVE-2026-74753 - In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as g

CVE-2026-74752 - In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH stat

CVE-2026-74751 - In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen rea

CVE-2026-74750 - In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto fre

CVE-2026-74749 - In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on gr

CVE-2026-74748 - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount

CVE-2026-74747 - In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent

CVE-2026-74746 - In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish G

CVE-2026-74745 - In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when

CVE-2026-74744 - In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom

CVE-2026-74743 - In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroo

CVE-2026-74742 - In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to w

CVE-2026-74741 - In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer der

CVE-2026-74740 - In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU

CVE-2026-74739 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash t

CVE-2026-74738 - In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an

CVE-2026-74737 - In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nu

CVE-2026-74736 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-

CVE-2026-74735 - In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session re

CVE-2026-74734 - In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointe

CVE-2026-54556 - Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HT

CVE-2026-54553 - Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI a

CVE-2026-54550 - IzPack is a widely used tool for packaging applications on the Java platform as cross-platform insta

CVE-2026-54548 - kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SS

CVE-2026-54523 - Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1

CVE-2026-54511 - LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog p

CVE-2026-13481 - The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME

CVE-2026-13480 - The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsy

CVE-2026-13479 - The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_c

CVE-2026-7487 - GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 bef

CVE-2026-79902 - A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW im

CVE-2026-77801 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2

CVE-2026-75960 - Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credential

CVE-2026-75896 - Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institu

CVE-2026-73108 - RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability i

CVE-2026-73102 - RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard

CVE-2026-3035 - GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 bef

CVE-2026-19271 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i

CVE-2026-18252 - GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 bef

CVE-2026-15990 - The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up t

CVE-2026-15387 - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 bef

CVE-2026-12717 - An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery

CVE-2025-10903 - GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 be

CVE-2026-79619 - On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-cre

CVE-2026-77658 - A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network

CVE-2026-12587 - The vulnerability allows the unauthorised generation of physical access QR codes due to the use of h

CVE-2026-63041 - Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerabil

CVE-2026-15985 - The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentica

CVE-2026-80206 - NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgre

CVE-2026-80205 - NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.fin

CVE-2026-80204 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in

CVE-2026-80203 - The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSup

CVE-2026-77557 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability

CVE-2026-77554 - A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit

CVE-2026-77553 - A malicious actor with access to the network and low privileges could exploit an Improper Access Con

CVE-2026-77552 - A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit

CVE-2026-77551 - A malicious actor with access to the network and under certain conditions could exploit an Improper

CVE-2026-77550 - A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequen

CVE-2026-77549 - A malicious actor with access to the network and under certain conditions could exploit an Improper

CVE-2026-77548 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77547 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77546 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77532 - A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability f

CVE-2026-5092 - The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cros

CVE-2026-3235 - The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver

CVE-2026-18080 - The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerabl

CVE-2026-80350 - OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a sma

CVE-2026-80349 - TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header

CVE-2026-80348 - TarsWeb enforces its per-application roles by calling AuthService from individual controller methods

CVE-2026-80347 - mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround a

CVE-2026-80346 - StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every

CVE-2026-77545 - A malicious actor with access to the network, low privileges and under certain conditions could expl

CVE-2026-77543 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77542 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77541 - A malicious actor with access to the network and high privileges could exploit an Improper Access Co

CVE-2026-77540 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77539 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77538 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability

CVE-2026-77537 - A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit

CVE-2026-77536 - A malicious actor with access to the network and low privileges could exploit an Improper Access Con

CVE-2026-77535 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77534 - A malicious actor with access to the network and low privileges could exploit an Improper Access Con

CVE-2026-59683 - The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system

CVE-2026-59682 - Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0

CVE-2026-2388 - The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-19042 - A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.8

CVE-2026-18794 - The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory re

CVE-2026-16444 - Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.8

CVE-2026-80237 - EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authent

CVE-2026-80236 - Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated

CVE-2026-80235 - EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthe

CVE-2026-80234 - CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. U

CVE-2026-80233 - CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File U

CVE-2026-77533 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-19538 - The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol po

CVE-2026-19401 - Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a spe

CVE-2026-19197 - A user with organization administrator permissions can delete dashboard snapshots belonging to other

CVE-2026-18916 - Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP quer

CVE-2026-18664 - When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly com

CVE-2026-9668 - With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass

CVE-2026-78237 - Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into t

CVE-2026-78236 - An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to a

CVE-2026-75977 - The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Coo

CVE-2026-6178 - The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_b

CVE-2026-18884 - The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby'

CVE-2026-58108 - The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of

CVE-2026-3002 - The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable

CVE-2026-18431 - The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and inclu

CVE-2026-18331 - The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin

CVE-2026-15366 - A control logic defect in a specific built-in webpage of Kids Mode allows users to view local galler

CVE-2026-15365 - A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification a

CVE-2026-79654 - A flaw was found in Katello where the Content View History API does not properly enforce authorizati

CVE-2026-78146 - The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is th

CVE-2026-77790 - The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter befo

CVE-2026-77789 - The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscr

CVE-2026-77758 - The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that

CVE-2026-77757 - The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.

CVE-2026-77754 - The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of o

CVE-2026-77695 - The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly veri

CVE-2026-77694 - The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkou

CVE-2026-77693 - The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the use

CVE-2026-75798 - The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its a

CVE-2026-75797 - The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it

CVE-2026-74930 - The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is be

CVE-2026-74929 - The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes

CVE-2026-74928 - The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its impo

CVE-2026-74851 - The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its

CVE-2026-58097 - mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buff

CVE-2026-58096 - LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the

CVE-2026-58095 - mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for

CVE-2026-58094 - The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.

CVE-2026-58093 - The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After rea

CVE-2026-19760 - The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Sit

CVE-2026-19718 - The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin Word

CVE-2026-19226 - The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget setti

CVE-2026-19220 - The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabl

CVE-2026-19094 - The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query

CVE-2026-16986 - The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side

CVE-2026-16984 - The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates

CVE-2026-15203 - Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine

CVE-2026-14550 - The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a r

CVE-2026-14216 - The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require aut

CVE-2026-14212 - The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that a

CVE-2026-13406 - The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or

CVE-2026-13404 - The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or

CVE-2026-13172 - The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by sta

CVE-2026-9805 - SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without

CVE-2026-9252 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9250 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9146 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-80216 - Rejected reason: duplicate record

CVE-2026-80214 - LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated

CVE-2026-80202 - Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), wh

CVE-2026-80201 - Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allo

CVE-2026-80200 - Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handl

CVE-2026-80199 - Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthe

CVE-2026-80198 - Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and ex

CVE-2026-80197 - Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add a

CVE-2026-80196 - Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remai

CVE-2026-80195 - Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team upd

CVE-2026-80194 - Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController expo

CVE-2026-80193 - Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller

CVE-2026-80192 - @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7

CVE-2026-80191 - GROWI applies its page-viewer permission check to attachment requests only when the request carries

CVE-2026-80189 - LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor

CVE-2026-76149 - CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written t

CVE-2026-76148 - CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the

CVE-2026-73335 - Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL S

CVE-2026-58092 - In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the pri

CVE-2026-58091 - The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If lock

CVE-2026-58090 - The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messag

CVE-2026-58089 - When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach P

CVE-2026-57171 - Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc

CVE-2026-57170 - Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc

CVE-2026-54467 - On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on

CVE-2026-52776 - Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions befo