CVE-2026 list

CVE-2026 records published in May 2026

Page two of seven: records 1,001 to 2,000 of the 6,293 published in May 2026, newest first. The first page carries the figures for May 2026.

CVE-2026 records published in May 2026, newest first: records 1,001 to 2,000 of 6,293
CVE Summary CVSS EPSS Published Signals
CVE-2026-45997Linux kernel SCSI disk driver vulnerability5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45996Linux kernel imx SPI driver use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45995Linux kernel io_uring/zcrx use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45994Linux kernel ibmasm driver out-of-bounds read7.1v3.10.1%2026-05-27Fix
CVE-2026-45993Linux kernel LoongArch syscall dispatch table vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45991Linux kernel UDF partition descriptor table out-of-bounds write7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45990Linux kernel SLUB krealloc integer overflow5.5v3.10.1%2026-05-27Fix
CVE-2026-45989Linux kernel devicetree unittest PCI probe use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45988Linux kernel rxrpc RESPONSE packet decryption vulnerability9.8CNA v3.10.5%2026-05-27Fix
CVE-2026-45987Linux kernel nested SVM interrupt shadow sync vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45986Linux kernel ccree crypto MAC digest memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45985Linux kernel ext4 direct I/O block allocation vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45984Linux kernel GFS2 inline data write path use-after-free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45983Linux kernel NFS server idmap lookup vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45982Linux kernel ACPICA address space dispatch null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45981Linux kernel s390 channel subsystem subchannel allocation memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45980Linux kernel amdxdna accelerator job scheduling use-after-free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45979Linux kernel amdgpu command submission parser vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45978Linux kernel Greybus lights driver null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45977Linux kernel fbnic firmware log vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45976Linux kernel amdgpu RAS initialization memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45975In the Linux kernel, the following vulnerability has been resolved: ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd struct ublksrv_ctrl_cmd is part of the io_uring_sqe, which may lie in userspace-mapped memory. It's racy to access its fields with normal loads, as userspace may write to them5.5v3.10.1%2026-05-27Fix
CVE-2026-45974Linux kernel Btrfs quota enable vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45973Linux kernel mlx5 RDMA driver LAG teardown denial of service5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45972Linux kernel SMB client file open use-after-free9.8CNA v3.10.3%2026-05-27Fix
CVE-2026-45971Linux kernel BPF program signature verification vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45970Linux kernel bonding ALB receive path use-after-free7.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45969Linux kernel PlayStation controller driver null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45968Linux kernel cpuidle ladder governor null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45967Linux kernel BPF instruction array map vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45966Linux kernel AppArmor Unix socket revalidation null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45965Linux kernel AppArmor rawdata symlink resolution null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45964Linux kernel SUNRPC GSS message allocation memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45963Linux kernel nau8821 codec jack detection work null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45962Linux kernel ublk control command SQE128 handling vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45961Linux kernel GFS2 mount error handling memory leak5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45960Linux kernel hfsplus kernel panic5.5v3.10.1%2026-05-27Fix
CVE-2026-45959Linux kernel CCP crypto driver cleanup null pointer dereference7.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45958Linux kernel Exynos VIDI ioctl EDID handling null pointer dereference7.1CNA v3.10.2%2026-05-27Fix
CVE-2026-45957Linux kernel RCU read-side unlock softirq handling out-of-bounds read7.1v3.10.1%2026-05-27Fix
CVE-2026-45956Linux kernel Exynos VIDI ioctl context lookup use-after-free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45955Linux kernel md-llbitmap suspend and resume handling vulnerability7.1CNA v3.10.2%2026-05-27Fix
CVE-2026-45954Linux kernel au1200fb framebuffer driver probe memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45953Linux kernel raid5 llbitmap stripe handling denial of service5.5v3.10.1%2026-05-27Fix
CVE-2026-45952Linux kernel fbnic Ethernet driver MTU handling vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45951Linux kernel BPF pseudo BTF ID refcounting use-after-free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45950Linux kernel StarFive AES AEAD driver memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45949Linux kernel hwrng core thread management race condition4.7NVD v3.10.1%2026-05-27Fix
CVE-2026-45948Linux kernel ext4 extent shifting memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45947Linux kernel amdgpu ACPI XCC enumeration memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45946Linux kernel ab8500 power supply driver use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45945Linux kernel Intel VT-d PASID entry replacement race condition8.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45944In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry When tearing down a context entry, the current implementation zeros the entire 128-bit entry using multiple 64-bit writes. This creates a window where the hardware ca7.5CNA v3.10.1%2026-05-27Fix
CVE-2026-45943Linux kernel EROFS ztailpacking decompression null pointer dereference7.1NVD v3.10.2%2026-05-27Fix
CVE-2026-45942Linux kernel ext4 block group bitmap accounting race condition7.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45941Linux kernel Infineon I2C TPM driver memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45940Linux kernel stmmac Ethernet driver vulnerability5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45939Linux kernel NI USB GPIB driver memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45938Linux kernel pm8916_lbc use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45937Linux kernel Inside Secure EIP93 crypto driver denial of service5.5v3.10.1%2026-05-27Fix
CVE-2026-45936Linux kernel Goldfish power supply driver use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45935Linux kernel ntfs3 index log replay out-of-bounds read7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45934Linux kernel btrfs chunk allocation vulnerability5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45933Linux kernel BPF verifier register linking vulnerability7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45932Linux kernel BPF tcx and netkit detach vulnerability7.3CNA v3.10.2%2026-05-27Fix
CVE-2026-45931Linux kernel accel/amdxdna crash7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45930Linux kernel MCTP netlink neighbor responses vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45929Linux kernel ovpn use-after-free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45928Linux kernel Wave5 video codec driver memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45927Linux kernel BPF map hash calculation time-of-check time-of-use race condition4.7v3.10.1%2026-05-27Fix
CVE-2026-45926Linux kernel Rust PWM driver memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45925Linux kernel thermal device tree lookup memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45924Linux kernel ksmbd file removal path improper locking5.5v3.10.1%2026-05-27Fix
CVE-2026-45923In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - us5.5v3.10.2%2026-05-27Fix
CVE-2026-45922Linux kernel mlx5 RDMA driver memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45921Linux kernel parsers memory leak5.5v3.10.1%2026-05-27Fix
CVE-2026-45920Linux kernel ext4 double free7.8v3.10.1%2026-05-27Fix
CVE-2026-45919Linux kernel real-time scheduler load balancing infinite loop5.5v3.10.1%2026-05-27Fix
CVE-2026-45918Linux kernel OpenVPN TCP transport null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45917Linux kernel IPVS destination cache race condition5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45916Linux kernel sbs-battery power supply driver use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45915Linux kernel FAT filesystem rmdir integer underflow5.5v3.10.2%2026-05-27Fix
CVE-2026-45914Linux kernel ibmpex hwmon sensor store use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45913In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: always update mdb_n_entries for vlan contexts syzbot triggered a warning[1] about the number of mdb entries in a context. It turned out that there are multiple ways to trigger that warning today (some got added5.5v3.10.2%2026-05-27Fix
CVE-2026-45912Linux kernel ext4 extent status tree vulnerability5.5v3.10.1%2026-05-27Fix
CVE-2026-45911Linux kernel cdns3 USB role switching null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45910Linux kernel RXE queue pair timer race condition7.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45909Linux kernel MediaTek clock gate driver vulnerability7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45908Linux kernel accel/amdxdna memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45907Linux kernel mlx5e devlink and netdev locking deadlock5.5v3.10.1%2026-05-27Fix
CVE-2026-45906Linux kernel pf1550 power supply driver use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45905Linux kernel xfrm ICMP route lookup race condition4.7v3.10.1%2026-05-27Fix
CVE-2026-45904Linux kernel EEH PCI hotplug locking vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45903Linux kernel BPF helper memory access checks out-of-bounds read7.1v3.10.2%2026-05-27Fix
CVE-2026-45902Linux kernel bq256xx power supply driver use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45901Linux kernel nf_tables reset locking vulnerability5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45900Linux kernel DPAA2 CAAM driver memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45899Linux kernel ext4 extent status tree vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45898In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removing work_list The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expectation that queue_wo9.8CNA v3.10.5%2026-05-27Fix
CVE-2026-45897Linux kernel nftables counter vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45896Linux kernel intel-dg MTD driver vulnerability7.8v3.10.2%2026-05-27Fix
CVE-2026-45895Linux kernel quota freeze synchronization vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45894Linux kernel VT-d PASID table teardown vulnerability7.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45893Linux kernel AppArmor policy table parser out-of-bounds read7.1NVD v3.10.1%2026-05-27Fix
CVE-2026-45892Linux kernel ext4 extent status tree vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45891Linux kernel hns3 double free7.8v3.10.1%2026-05-27Fix
CVE-2026-45890Linux kernel xen-netback queue configuration denial of service5.5v3.10.1%2026-05-27Fix
CVE-2026-45889Linux kernel MPTCP receive buffer growth divide by zero5.5v3.10.2%2026-05-27Fix
CVE-2026-45888Linux kernel md raid1 driver memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45887Linux kernel af_unix stream connect memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45886Linux kernel bpf_xdp_store_bytes helper vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45885Linux kernel cpcap battery driver use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45884Linux kernel AppArmor per-CPU buffer cache integer underflow5.5v3.10.2%2026-05-27Fix
CVE-2026-45883Linux kernel sca3000 IIO driver memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45882Linux kernel pm8916_bms_vm use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45881Linux kernel MediaTek SVS debug interface memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45880Linux kernel PCI P2PDMA mmap handling vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45879Linux kernel bq25980 power supply driver use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45878Linux kernel amdkfd debug address watch vulnerability7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45877Linux kernel intel-ish-hid ISHTP bus driver null pointer dereference5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45876Linux kernel arm64 guarded control stack improper error handling5.5v3.10.2%2026-05-27Fix
CVE-2026-45875Linux kernel Arizona MFD driver memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45874Linux kernel Freescale imx8qm-hsio PHY driver null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45873Linux kernel netfilter nft_set_rbtree vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45872Linux kernel smartpqi SCSI driver memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45871Linux kernel st33zp24 TPM driver vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45870Linux kernel SUNRPC auth_gss XDR decoding memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45869Linux kernel wm97xx power supply driver null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45868Linux kernel pinctrl-single GPIO function vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45867Linux kernel act8945a power supply driver use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45866Linux kernel CAIF serial line discipline use-after-free7.8v3.10.2%2026-05-27Fix
CVE-2026-45865Linux kernel MCTP I2C driver vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45864Linux kernel NTFS3 file write infinite loop5.5v3.10.2%2026-05-27Fix
CVE-2026-45863Linux kernel dw memory leak5.5v3.10.2%2026-05-27Fix
CVE-2026-45862In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush cache for PASID table before using it When writing the address of a freshly allocated zero-initialized PASID table to a PASID directory entry, do that after the CPU cache flush for this PASID table, not before it7.8CNA v3.10.1%2026-05-27Fix
CVE-2026-45861Linux kernel GFS2 quota data shrinker use-after-free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45860Linux kernel nf_conncount connection tracking vulnerability7.5CNA v3.10.7%2026-05-27Fix
CVE-2026-45859Linux kernel nfnetlink_queue GSO segmentation vulnerability7.5CNA v3.10.6%2026-05-27Fix
CVE-2026-45858Linux kernel ext4 extent zeroing vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45857Linux kernel csiostor null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45856Linux kernel RDMA uverbs post send out-of-bounds read7.1CNA v3.10.2%2026-05-27Fix
CVE-2026-45855Linux kernel libata SCSI command queuing vulnerability5.5v3.10.2%2026-05-27Fix
CVE-2026-45854Linux kernel EIP93 crypto engine algorithm registration denial of service5.5v3.10.2%2026-05-27Fix
CVE-2026-45853Linux kernel amdgpu GMC memory range allocation out-of-bounds write7.8v3.10.2%2026-05-27Fix
CVE-2026-45852Linux kernel RDMA rxe shared receive queue double free7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-45851Linux kernel EFI unaccepted memory table out-of-bounds read7.1v3.10.2%2026-05-27Fix
CVE-2026-45850Linux kernel IPVS IPv6 checksum validation vulnerability5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45849Linux kernel ocelot improper locking5.5v3.10.1%2026-05-27Fix
CVE-2026-45848Linux kernel AppArmor socket mediation null pointer dereference5.5v3.10.2%2026-05-27Fix
CVE-2026-45847Linux kernel IPIP tunnel forward path reachable assertion5.5v3.10.2%2026-05-27Fix
CVE-2026-45846Linux kernel bareudp tunnel driver null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45845Linux kernel taprio null pointer dereference5.5v3.10.1%2026-05-27Fix
CVE-2026-45844Linux kernel arp_tables IEEE1394 support vulnerability5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45843Linux kernel SLIP header decompression vulnerability8.2CNA v3.10.5%2026-05-27Fix
CVE-2026-45842Linux kernel SLIP driver null pointer dereference5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45841Linux kernel netfilter OSF fingerprint matching divide by zero5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45840In the Linux kernel, the following vulnerability has been resolved: openvswitch: cap upcall PID array size and pre-size vport replies The vport netlink reply helpers allocate a fixed-size skb with nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID array via ovs_vport_get_upcall_p5.5NVD v3.10.1%2026-05-27Fix
CVE-2026-45839Linux kernel BPF CO-RE relocation out-of-bounds read7.8NVD v3.10.2%2026-05-27Fix
CVE-2026-45838Linux kernel BPF cgroup storage null pointer dereference5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-45837Linux kernel BPF arena allocator use-after-free7.8v3.10.1%2026-05-27Fix
CVE-2026-45719Budibase: CouchDB Reduce injection via Unsanitized Calculation parameter in V1 Views API6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-45718Budibase row action trigger incorrect authorization5.4CNA v3.10.2%2026-05-27Fix
CVE-2026-45717Budibase datasource update endpoint missing authorization8.8CNA v3.10.4%2026-05-27Fix
CVE-2026-45716Budibase: Builder-to-admin privilege escalation via onboardUsers endpoint without SMTP Configuration8.8CNA v3.10.5%2026-05-27Fix
CVE-2026-45715Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration7.7CNA v3.10.4%2026-05-27Fix
CVE-2026-45571go-git path traversal5.4CNA v3.10.3%2026-05-27Fix
CVE-2026-45570go-git SSH transport command builder vulnerability2.3CNA v4.00.4%2026-05-27Fix
CVE-2026-45548Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation7.7CNA v3.10.4%2026-05-27Fix
CVE-2026-45335WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage5.4CNA v3.10.3%2026-05-27Fix
CVE-2026-45322OS command injection in Microsoft UFO Shell Action Replay via Stored Session JSON7.8CNA v3.12.1%2026-05-27
CVE-2026-45152uniget-org cli uniget: Command injection in tool.Check leading to arbitrary code execution7.8CNA v3.10.9%2026-05-27Fix
CVE-2026-45137Solana Foundation Anchor improper input validation8.2CNA v3.10.4%2026-05-27Fix
CVE-2026-45136claude-code-cache-fix vulnerable to local code execution8.6CNA v4.00.2%2026-05-27Fix
CVE-2026-45134LangChain LangSmith SDK prompt pull method deserialization of untrusted data7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-45108Himmelblau: Authentication bypass8.4CNA v3.10.4%2026-05-27Fix
CVE-2026-45104OSGeo MapServer SLD rule parser null pointer dereference7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-45102OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion9.9CNA v3.10.5%2026-05-27Fix
CVE-2026-45090Dalfox: Unauthenticated remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)7.5CNA v3.10.4%2026-05-27Fix
CVE-2026-45089Dalfox: Unauthenticated arbitrary File Create/Append via `output` option in Dalfox Server Mode8.2CNA v3.10.4%2026-05-27Fix
CVE-2026-45088Dalfox: Unauthenticated arbitrary file read with Out-of-Band Exfiltration7.5CNA v3.10.4%2026-05-27Fix
CVE-2026-45087Dalfox: Unauthenticated remote code execution via `found-action` in Dalfox Server Mode10.0CNA v3.11.4%2026-05-27MetasploitExploit codeFix
CVE-2026-45083intranda goobi-viewer-core Goobi viewer: Unauthenticated Solr Streaming Expression Proxy9.8CNA v3.10.7%2026-05-27Fix
CVE-2026-45081Frappe HR: Permission bypass in HRMS Leave Details API6.5CNA v3.10.3%2026-05-27Fix
CVE-2026-45061Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/API/plugin`)7.7CNA v3.10.4%2026-05-27Fix
CVE-2026-45047Bird-lg-go has a Fatal Out-of-Memory (OOM) denial of service via Unbounded JSON Decoding7.5CNA v3.10.6%2026-05-27Fix
CVE-2026-45046Gryph Agents Payload Filter fails to Strip Tool Payload for Sensitive Content5.5CNA v3.10.2%2026-05-27Fix
CVE-2026-45027LabRedesCefetRJ WeGIA login.php vulnerability5.9CNA v3.10.2%2026-05-27Fix
CVE-2026-45022go-git commit signature verification vulnerability7.0CNA v4.00.2%2026-05-27Fix
CVE-2026-44988LibVNCServer LibVNCClient Tight decoder out-of-bounds write8.8CNA v3.10.4%2026-05-27Fix
CVE-2026-44972Datadog GuardDog scan output vulnerability5.0CNA v3.10.2%2026-05-27
CVE-2026-44971Datadog GuardDog remote project scanning server-side request forgery8.2CNA v3.10.3%2026-05-27
CVE-2026-44902opentelemetry-js prometheus exporter process crash via malformed HTTP request7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-44888leiweibau Pi.Alert unauthenticated RCE via Python Config file injection in SaveConfigFile (Interger)9.8CNA v3.10.6%2026-05-27Fix
CVE-2026-44887leiweibau Pi.Alert unauthenticated RCE via Python Config file injection in SaveConfigFile (Path)9.8CNA v3.11.0%2026-05-27Fix
CVE-2026-44886Pi.Alert: Web interface vulnerable to unauthenticated blind SQL injection8.7CNA v4.00.4%2026-05-27Fix
CVE-2026-44839RabbitMQ: Unsanitized vhost names allow for XSS in management UI5.6CNA v4.00.2%2026-05-27Fix
CVE-2026-44838RabbitMQ MQTT Topic Permission authorization bypass5.3CNA v4.00.2%2026-05-27Fix
CVE-2026-44830Dataojitori Nocturne Memory HTTP/SSE transport missing authentication8.7CNA v4.00.3%2026-05-27Fix
CVE-2026-44724Systeminformation vulnerable to Linux command injection in networkInterfaces7.8CNA v3.11.2%2026-05-27Fix
CVE-2026-44720OpenLearnX: Critical authentication bypass6.9CNA v4.00.3%2026-05-27Fix
CVE-2026-44713mcdope pam_usb TMUX socket path handling OS command injection8.8CNA v3.10.2%2026-05-27Fix
CVE-2026-44712mcdope pam_usb pamusb-conf and pamusb-agent OS command injection8.2CNA v3.10.2%2026-05-27Fix
CVE-2026-44711mcdope pam_usb pad directory link following7.9CNA v3.10.2%2026-05-27Fix
CVE-2026-44710mcdope pam_usb UDisks device fields null pointer dereference4.6CNA v3.10.3%2026-05-27Fix
CVE-2026-44709mcdope pam_usb pamusb-pinentry OS command injection7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-44681Authlib: Open redirect in Authlib OIDC Implicit/Hybrid Authorization6.1CNA v3.10.3%2026-05-27Fix
CVE-2026-44660UltraJSON: Memory leak in ujson.dump on Write failure8.7CNA v4.00.6%2026-05-27Fix
CVE-2026-44635Kysely: JSON-path traversal injection7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-44590Sherlock: Command injection via pull_request_target in validate_modified_targets.yml9.3CNA v3.11.3%2026-05-27Exploit codeFix
CVE-2026-44521elFinder: SQL injection MySQL Volume driver (elFinderVolumeMySQL)8.8CNA v3.10.4%2026-05-27Fix
CVE-2026-44483RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)8.2CNA v3.10.5%2026-05-27Fix
CVE-2026-44475Ella Core: UE Security Capability bypass on NGAP PathSwitchRequest6.1CNA v3.10.2%2026-05-27Fix
CVE-2026-44474Ella Core: Handover failures during concurrent Security Mode command3.7CNA v3.10.2%2026-05-27Fix
CVE-2026-44473Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-44460FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret7.4CNA v3.10.4%2026-05-27Fix
CVE-2026-44378Botan: Quadratic complexity decoding BER indefinite length encodings6.9CNA v4.00.5%2026-05-27Fix
CVE-2026-44353Streamlink: Arbitrary local file read via file:// URI in HLS and DASH6.5CNA v3.10.5%2026-05-27Fix
CVE-2026-44346BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml8.8CNA v3.10.5%2026-05-27Fix
CVE-2026-44345BentoML: Dockerfile command injection via docker.base_image8.8CNA v3.10.5%2026-05-27Fix
CVE-2026-44330free5GC NEF PFD management API incorrect authorization10.0CNA v3.10.4%2026-05-27Fix
CVE-2026-44329free5GC SMF UPI management interface missing authentication10.0CNA v3.10.6%2026-05-27Fix
CVE-2026-44328free5GC SMF UPI node link management null pointer dereference8.2CNA v3.10.5%2026-05-27Fix
CVE-2026-44327free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler10.0CNA v3.10.5%2026-05-27Fix
CVE-2026-44326free5GC NEF traffic influence API missing authorization9.4CNA v3.10.5%2026-05-27Fix
CVE-2026-44325free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family7.5CNA v3.10.7%2026-05-27Fix
CVE-2026-44324free5GC UDR subscription data API vulnerability6.5CNA v3.10.7%2026-05-27Fix
CVE-2026-44323free5GC: UDR nudr-dr delete amf-subscriptions panics on missing subsId when UE state exists4.3CNA v3.10.4%2026-05-27Fix
CVE-2026-44322free5GC NEF PFD management API null pointer dereference7.5CNA v3.10.7%2026-05-27Fix
CVE-2026-44321free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools7.5CNA v3.10.6%2026-05-27Fix
CVE-2026-44320free5GC NEF callback API missing authentication7.3CNA v3.10.4%2026-05-27Fix
CVE-2026-44319free5GC: NEF crashes7.5CNA v3.10.7%2026-05-27Fix
CVE-2026-44318free5GC BSF subscription management race condition6.5CNA v3.10.3%2026-05-27Fix
CVE-2026-44317free5GC PCF policy authorization API null pointer dereference6.5CNA v3.10.6%2026-05-27Fix
CVE-2026-44316free5GC PCF SM policy control API null pointer dereference7.5CNA v3.10.7%2026-05-27Fix
CVE-2026-44315free5GC NEF PFD management API missing authorization9.4CNA v3.10.5%2026-05-27Fix
CVE-2026-44247Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size6.8CNA v3.10.3%2026-05-27Fix
CVE-2026-42879FacturaScripts: Authenticated remote code execution (RCE) via GIF Image upload in Product Images6.3CNA v3.10.3%2026-05-27Exploit code
CVE-2026-42878FacturaScripts: Unauthenticated phpinfo Disclosure via Installer endpoint in FacturaScripts5.3CNA v3.10.9%2026-05-27Nuclei
CVE-2026-42877FacturaScripts: Stored XSS via product reference in sales/purchases5.4CNA v3.10.2%2026-05-27
CVE-2026-42791Erlang OTP OCSP responder certificate validity period not checked in public_key6.3CNA v4.00.3%2026-05-27Fix
CVE-2026-42790Erlang OTP improper certificate validation7.6CNA v4.00.5%2026-05-27Fix
CVE-2026-42789Erlang OTP Non-CA certificate accepted as intermediate issuer in public_key path validation7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-42762VikBooking Hotel Booking Engine and PMS WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42761Active Products Tables for WooCommerce WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-27Fix
CVE-2026-42760Backup and Staging by WP Time Capsule WordPress plugin broken authentication7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-42759Affiliate Super Assistent WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42758WebinarIgnition WordPress plugin privilege escalation9.8CNA v3.10.5%2026-05-27Exploit codeFix
CVE-2026-42757WebinarIgnition WordPress plugin arbitrary file deletion9.9CNA v3.10.5%2026-05-27Fix
CVE-2026-42756Ludwig You QuickWebP path traversal9.9CNA v3.10.5%2026-05-27Fix
CVE-2026-42755TableOn WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-27Fix
CVE-2026-42754Favicon WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42753WCFM Membership WordPress plugin broken access control7.3CNA v3.10.3%2026-05-27Fix
CVE-2026-42751Booking Manager WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-05-27Fix
CVE-2026-42750WPComplete WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-05-27Fix
CVE-2026-42749themeisle Disable Comments for Any Post Types (Remove comments) authentication bypass7.1CNA v3.10.4%2026-05-27Fix
CVE-2026-42748WPify Woo Czech WordPress plugin arbitrary file upload9.9CNA v3.10.5%2026-05-27Fix
CVE-2026-42747Easy Form Builder WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-27Fix
CVE-2026-42746Smart Online Order for Clover WordPress plugin sensitive data exposure7.3CNA v3.10.3%2026-05-27Fix
CVE-2026-42745Smart Online Order for Clover WordPress plugin broken authentication7.3CNA v3.10.4%2026-05-27Fix
CVE-2026-42744Ads by WPQuads WordPress plugin bypass vulnerability vulnerability6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-42740Tainacan WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-27Fix
CVE-2026-42739Advanced IP Blocker WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42738Smart Online Order for Clover WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42737VikBooking Hotel Booking Engine and PMS WordPress plugin arbitrary file deletion8.6CNA v3.10.5%2026-05-27Fix
CVE-2026-42736BP Better Messages WordPress plugin insecure direct object references (IDOR)7.5CNA v3.10.4%2026-05-27Fix
CVE-2026-42735KiviCare WordPress plugin broken authentication8.2CNA v3.10.4%2026-05-27Fix
CVE-2026-42734Geo Mashup WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42733WPCS WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42732Ads by WPQuads WordPress plugin broken authentication6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-42731miniorange otp verification WordPress plugin privilege escalation9.8CNA v3.10.5%2026-05-27Fix
CVE-2026-42730MasterStudy LMS WordPress plugin SQL injection8.5CNA v3.10.4%2026-05-27Fix
CVE-2026-42729PropertyHive WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42728HT Contact Form 7 WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42727Active Products Tables for WooCommerce WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-27Fix
CVE-2026-42726AWP Classifieds WordPress plugin broken access control6.5CNA v3.10.3%2026-05-27Fix
CVE-2026-42725Checkout Files Upload for WooCommerce WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-42553Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker7.1CNA v4.00.5%2026-05-27Fix
CVE-2026-42459free5GC UDM Subscriber Data Management service information disclosure7.7CNA v4.00.4%2026-05-27Fix
CVE-2026-42328Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth6.2CNA v3.10.2%2026-05-27Fix
CVE-2026-42280auth0.js improper permission Checking in Auth.js SDK7.1CNA v3.10.3%2026-05-27Fix
CVE-2026-42197RELATE vulnerable to stored XSS via Unprivileged User Profile8.7CNA v3.10.4%2026-05-27
CVE-2026-42184Tauri: Origin Confusion allows Remote pages to Invoke Local-Only IPC commands6.1CNA v4.00.4%2026-05-27Fix
CVE-2026-42083free5GC PCF SM policy control API missing authentication8.2CNA v3.10.5%2026-05-27Fix
CVE-2026-42082free5GC: Missing Concurrent NAS SMC Validation during NGAP Handover3.7CNA v3.10.3%2026-05-27Fix
CVE-2026-42081free5GC: UE Security Capability bypass on NGAP PathSwitchRequest6.1CNA v3.10.3%2026-05-27Fix
CVE-2026-41704Cloud Foundry Foundation BOSH Director compromised VM can make arbitrary blobstore deletes6.8CNA v4.00.1%2026-05-27Fix
CVE-2026-41009Cloud Foundry Foundation BOSH Director local Blobstore may allow arbitrary reads/deletes4.3CNA v4.00.1%2026-05-27Fix
CVE-2026-40852MB connect line mbNET/mbNET.rokey command injection via malicious configuration7.2CNA v3.10.7%2026-05-27Fix
CVE-2026-40851MB connect line mbNET/mbNET.rokey command injection via USB8.4CNA v3.10.2%2026-05-27Fix
CVE-2026-40850MB connect line mbCONNECT24 unauthenticated SQLi in getAccountData function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40849MB connect line mbCONNECT24 authenticated SQLi in user_alarmprofile view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40848MB connect line mbCONNECT24 authenticated SQLi in tag view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40847MB connect line mbCONNECT24 authenticated SQLi in system_tag view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40846MB connect line mbCONNECT24 authenticated SQLi in system view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40845MB connect line mbCONNECT24 authenticated SQLi in devices_configuration view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40844MB connect line mbCONNECT24 authenticated SQLi in dashboard view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40843MB connect line mbCONNECT24 authenticated SQLi in alarming view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40842MB connect line mbCONNECT24 authenticated SQLi in getWidgetTags function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40841MB connect line mbCONNECT24 authenticated SQLi in getProjectTags function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40840MB connect line mbCONNECT24 authenticated SQLi in VerifyCreateLicences function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40839MB connect line mbCONNECT24 authenticated SQLi in getComponentScalings function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40838MB connect line mbCONNECT24 authenticated SQLi in getDeviceScalings function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40837MB connect line mbCONNECT24 authenticated SQLi in getProjectScalings function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40836MB connect line mbCONNECT24 authenticated SQLi in inmessage model7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40835MB connect line mbCONNECT24 authenticated SQLi in saveObjectFromData function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40834MB connect line mbCONNECT24 authenticated SQLi in saveDashboardLayout function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40833MB connect line mbCONNECT24 authenticated SQLi in saveDashboardLayout function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40832MB connect line mbCONNECT24 authenticated SQLi in getDevicegroups function7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40831MB connect line mbCONNECT24 authenticated SQLi in Easy view7.1CNA v4.00.4%2026-05-27Fix
CVE-2026-40830MB connect line mbCONNECT24 authenticated SQLi in UpdateParam function7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40829MB connect line mbCONNECT24 authenticated SQLi in UpdateParam function7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40828MB connect line mbCONNECT24 authenticated SQLi in DeleteSysLogEntry function7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40827MB connect line mbCONNECT24 authenticated SQLi in _RemoveRequest function7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40826MB connect line mbCONNECT24 authenticated SQLi in dsgvo_contracts view6.9CNA v4.00.5%2026-05-27Fix
CVE-2026-40825MB connect line mbCONNECT24 authenticated SQLi in accountstatus view7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40824MB connect line mbCONNECT24 authenticated SQLi in accountstatus view7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40823MB connect line mbCONNECT24 authenticated SQLi in DevSerialReset function7.0CNA v4.00.4%2026-05-27Fix
CVE-2026-40822MB connect line mbCONNECT24 authenticated SQLi in DevSerialReset function6.9CNA v4.00.5%2026-05-27Fix
CVE-2026-40821MB connect line mbCONNECT24 authenticated SQLi in getAccountByID function6.9CNA v4.00.5%2026-05-27Fix
CVE-2026-40819MB connect line mbCONNECT24 unauthenticated SQLi in sync_data24 task8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40818MB connect line mbCONNECT24 unauthenticated SQLi in _mb24confi_getDevice function function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40817MB connect line mbCONNECT24 unauthenticated SQLi in getAlarmProfiles function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40816MB connect line mbCONNECT24 unauthenticated SQLi in _mb24confi_getTagAlarm function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40815MB connect line mbCONNECT24 unauthenticated SQLi in _mb24api_getUserAccount function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40814MB connect line mbCONNECT24 unauthenticated SQLi in _mb24confi_getTagAlarm function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40813MB connect line mbCONNECT24 unauthenticated SQLi in getLiveValues8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40812MB connect line mbCONNECT24 unauthenticated SQLi in getLiveValues function8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40811MB connect line mbCONNECT24 unauthenticated SQLi in ssoabstractservice8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-40810MB connect line mbCONNECT24 unauthenticated SQLi in userinfo endpoint8.7CNA v4.00.5%2026-05-27Fix
CVE-2026-38945Raynet rvia version command injection7.8CISA ADP v3.11.2%2026-05-27
CVE-2026-38931creatorsofcode simplephp admin config module stored cross-site scripting5.4CISA ADP v3.10.2%2026-05-27
CVE-2026-38930OpenRapid RapidCMS menu page cookie parameter SQL injection6.5CISA ADP v3.10.4%2026-05-27
CVE-2026-38808uzy-ssm-mall v1.1.0 SQL injection5.3CISA ADP v3.10.4%2026-05-27
CVE-2026-38807kvf-admin v1.0.0 insecure permissions8.8CISA ADP v3.10.5%2026-05-27
CVE-2026-38427Tasmota JPEG fetch function heap-based buffer overflow7.3CISA ADP v3.10.4%2026-05-27Exploit code
CVE-2026-38426arendst Tasmota v.15.3.0.3 and buffer overflow7.3CISA ADP v3.10.6%2026-05-27Exploit code
CVE-2026-38422arendst Tasmota v.15.3.0.3 and buffer overflow7.3CISA ADP v3.10.7%2026-05-27Exploit code
CVE-2026-37713Dolibarr ERP/CRM commonobject.class.php code injection7.3CISA ADP v3.10.5%2026-05-27
CVE-2026-37712Dolibarr ERP/CRM cronjob.class.php code injection7.3CISA ADP v3.10.5%2026-05-27
CVE-2026-37711Dolibarr ERP/CRM actions_addupdatedelete.inc.php code injection7.3CISA ADP v3.10.5%2026-05-27
CVE-2026-36540Netis AC1200 Router NC21 skk_set.cgi endpoint command injection7.3CISA ADP v3.11.3%2026-05-27
CVE-2026-36539Netis AC1200 Router NC21 skk_get.cgi endpoint information disclosure7.3CISA ADP v3.10.4%2026-05-27
CVE-2026-36538Netis AC1200 Router NC21 /etc/shadow.sample hard-coded credentials7.3CISA ADP v3.10.3%2026-05-27
CVE-2026-36045Picoclaw is vulnerable to OS command injection via the ExecTool component7.3CISA ADP v3.11.8%2026-05-27
CVE-2026-36044Pensar Apex smart_enumerate tool OS command injection8.8CNA v3.12.4%2026-05-27
CVE-2026-35090Authentication bypass in Slican telephone exchanges9.3CNA v4.00.6%2026-05-27Fix
CVE-2026-35089Slican IPx weak credentials8.7CNA v4.00.6%2026-05-27Fix
CVE-2026-35087Authentication bypass in Slican telephone exchanges9.3CNA v4.00.6%2026-05-27Fix
CVE-2026-33552Northern.tech Mender Enterprise Server improper privilege management3.7CISA ADP v3.10.3%2026-05-27
CVE-2026-31266Craft CMS migrate endpoint missing authorization7.3CISA ADP v3.10.4%2026-05-27Exploit code
CVE-2026-30498Jason2605 AdminPanel delete.php endpoint cross-site request forgery6.3CISA ADP v3.10.1%2026-05-27Exploit code
CVE-2026-23679libusb null pointer dereference in parse_interface5.5NVD v3.10.2%2026-05-27Fix
CVE-2026-21785HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy4.0CNA v3.10.1%2026-05-27
CVE-2026-9759Null pointer dereference in Wireshark5.5CNA v3.10.1%2026-05-27Fix
CVE-2026-9739Google MCP Toolbox for Databases vulnerable to DNS rebinding attacks9.4CNA v4.00.2%2026-05-27Fix
CVE-2026-9712pretix insecure direct object reference3.8CNA v4.00.4%2026-05-27Fix
CVE-2026-9704Keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT6.8CNA v3.10.6%2026-05-27Fix
CVE-2026-9689Keycloak services has improper validation of Consistency within Input4.2CNA v3.10.4%2026-05-27Fix
CVE-2026-9674Jenkins Multijob Plugin has a cross-site request forgery (CSRF)4.3CISA ADP v3.10.3%2026-05-27Fix
CVE-2026-9632UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow8.7CNA v4.00.8%2026-05-27
CVE-2026-9631UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow8.7CNA v4.00.8%2026-05-27
CVE-2026-9628UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow8.7CNA v4.00.8%2026-05-27
CVE-2026-9627UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow8.7CNA v4.00.8%2026-05-27
CVE-2026-9617PostgreSQL Anonymizer: Malicious column name allows SQL injection via anon.k_anonymity function6.8CNA v3.10.4%2026-05-27Fix
CVE-2026-9609QianFox FoxCMS Admin.php edit password recovery5.1CNA v4.00.4%2026-05-27
CVE-2026-9608QianFox FoxCMS Administrator Backend edit cross-site scripting4.8CNA v4.00.4%2026-05-27
CVE-2026-9607itsourcecode Courier Management System parcel_list.php SQL injection5.3CNA v4.00.3%2026-05-27
CVE-2026-9606itsourcecode Courier Management System manage_user.php SQL injection6.9CNA v4.00.4%2026-05-27
CVE-2026-9312GitHub Enterprise Server upload endpoint server-side request forgery9.2CNA v4.00.6%2026-05-27Fix
CVE-2026-9236CM Ad Changer WordPress plugin cross-site request forgery to Campaign deletion4.3CNA v3.10.2%2026-05-27Fix
CVE-2026-9208Tanium addressed an unauthorized code execution vulnerability in Connect8.8CNA v3.10.7%2026-05-27Fix
CVE-2026-9207Tanium addressed an unauthorized code execution vulnerability in Connect8.8CNA v3.10.7%2026-05-27Fix
CVE-2026-9200Query Shortcode WordPress plugin local file inclusion7.5CNA v3.10.8%2026-05-27
CVE-2026-9156Tanium addressed a denial of service vulnerability in Tanium Server6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-9035IBM Aspera High-Speed Transfer Endpoint and Server asperahttpd path traversal6.5CNA v3.10.5%2026-05-27Fix
CVE-2026-9022Splide Carousel Block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27Fix
CVE-2026-9014WP Promoter WordPress plugin missing authorization unauthenticated Statistics reset5.3CNA v3.10.5%2026-05-27
CVE-2026-8994Login with NEAR WordPress plugin authentication bypass via account parameter8.1CNA v3.10.7%2026-05-27
CVE-2026-8943GoStats for WordPress plugin cross-site request forgery via gostats_manage function4.3CNA v3.10.2%2026-05-27
CVE-2026-8942MetaMagic SEO WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.2%2026-05-27
CVE-2026-8941CDN Linker lite WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.2%2026-05-27
CVE-2026-8939Search Simple Fields WordPress plugin cross-site request forgery to plugin settings update4.3CNA v3.10.2%2026-05-27
CVE-2026-8938auto making JSON-LD WordPress plugin cross-site request forgery to plugin Certification settings4.3CNA v3.10.2%2026-05-27
CVE-2026-8911WP AutoBuzz WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.2%2026-05-27
CVE-2026-8906WP Promoter WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.2%2026-05-27
CVE-2026-8903Two-factor authentication WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-05-27
CVE-2026-8899Auto Thumbnails WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8898Events In City WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8897Shortcode Buddy WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8894iWR Tooltip WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8891BitForm WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8887Listen Shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8886hk_shortcode WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8884Instant-Quote.co Quotation Page WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-05-27
CVE-2026-8877Responsive Video Embedder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8875Easy Prism Syntax Highlighter WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8873Content Slideshow WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27Fix
CVE-2026-8872Animate Your Content WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-05-27
CVE-2026-8871Formidable Kinetic WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8870Team Master WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8869Mutual Funds Data WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8868Single Mailchimp WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8867Post Categories Gallery WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8866jQuery googleslides WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8847Dideo WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8846Tuxquote WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8845Islamic Database WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8844Responsive Check WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8842Google+ Link Name WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8837WP Iframe Geo Style for Amazon affiliates WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8832WPCode WordPress plugin remote code execution8.8CNA v3.11.2%2026-05-27Exploit codeFix
CVE-2026-8787Firebase Support and Chat Management WordPress plugin privilege escalation8.8CNA v3.10.5%2026-05-27Fix
CVE-2026-8760Login with OTP WordPress plugin unauthenticated authentication bypass via OTP brute force9.8CNA v3.11.1%2026-05-27Fix
CVE-2026-8716GitLab CI ref type resolution vulnerability4.3CNA v3.10.3%2026-05-27Fix
CVE-2026-8708Genzel breadcrumbs WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-05-27
CVE-2026-8707NS Product icon badge WordPress plugin reflected cross-site scripting via PHP_SELF6.1CNA v3.10.4%2026-05-27
CVE-2026-8703Endless Scroll WordPress plugin [improper neutralization of input during web page generation]6.4CNA v3.10.3%2026-05-27
CVE-2026-8702GBI To Print WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8701GNTT Post Title Ticker WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8698Cryptocurrency Prijsvergelijking Widget WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8606Server-side request forgery in GitHub Enterprise Server via Advisory Package URL endpoint7.0CNA v4.00.7%2026-05-27Fix
CVE-2026-8450HTTP::Daemon versions for Perl allow OS command injection via send_file9.1CISA ADP v3.12.6%2026-05-27Fix
CVE-2026-8405IBM Guardium Data Protection is affected by exposure of sensitive information6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-8364Gladinet Triofox missing authentication for Critical functions9.8CNA v3.10.5%2026-05-27Fix
CVE-2026-8363Gladinet Triofox stack-based buffer overflow in WOSDeviceDropFolder.dll9.8CNA v3.10.5%2026-05-27Fix
CVE-2026-8362Gladinet Triofox stack-based buffer overflow in WOSDefaultHttpModule.dll9.8CNA v3.10.5%2026-05-27Fix
CVE-2026-8361Gladinet Triofox path traversal in WOSDefaultHttpModule.dll7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-8360Gladinet Triofox unchecked return value to null pointer dereference DOS7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-8359Gladinet Triofox WOSHttpStatusModule.dll null Function Pointer Call DoS7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-8180IBM Aspera High-Speed Transfer Endpoint and Server asperahttpd null pointer dereference7.5CNA v3.10.5%2026-05-27Fix
CVE-2026-8179IBM Aspera High-Speed Transfer Server asperahttpd stack-based buffer overflow8.8CNA v3.10.6%2026-05-27Fix
CVE-2026-8175IBM Aspera High-Speed Transfer Server asperahttpd heap-based buffer overflow9.8CNA v3.10.9%2026-05-27Fix
CVE-2026-8143Booking Calendar Event Calendar WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-05-27Fix
CVE-2026-8054Unauthenticated SQL injection in dotCMS Publish Audit API10.0CNA v4.01.6%2026-05-27NucleiExploit codeFix
CVE-2026-8048My Email Shortcode WordPress plugin [improper neutralization of input during web page generation]6.4CNA v3.10.3%2026-05-27
CVE-2026-8042Github Shortcode WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-8040faq shortocde WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-7876IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration authentication bypass9.1NVD v3.10.5%2026-05-27Fix
CVE-2026-7618EnvíaloSimple: Email Marketing y Newsletters WordPress plugin SQL injection4.9CNA v3.10.5%2026-05-27Fix
CVE-2026-7614Old Posts Highlighter WordPress plugin cross-site request forgery to settings update4.3CNA v3.10.2%2026-05-27
CVE-2026-7528IBM Langflow file upload denial of service7.1CNA v3.10.4%2026-05-27Fix
CVE-2026-7524IBM Langflow archive extraction path traversal9.8CNA v3.10.9%2026-05-27Fix
CVE-2026-7493Appointment Booking Calendar WordPress plugin denial of service5.3CNA v3.10.4%2026-05-27Fix
CVE-2026-7365IBM Operations Analytics - Log Analysis information disclosure8.4CNA v3.10.2%2026-05-27Fix
CVE-2026-7254IBM OPENBMC open BMC denial of service5.3CISA ADP v3.10.4%2026-05-27Fix
CVE-2026-6957Path traversal in Mattermost Legal Hold plugin8.0CNA v3.10.5%2026-05-27Fix
CVE-2026-6938IBM Db2 remote object storage upload authorization bypass6.5CNA v3.10.2%2026-05-27Fix
CVE-2026-6936IBM i is affected by a denial of service vulnerability []6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-6713Incorrect authorization in GitLab5.3CNA v3.10.5%2026-05-27Fix
CVE-2026-6565Style Kits Advanced Theme Styles for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27Fix
CVE-2026-6287ShopLentor WordPress plugin stored cross-site scripting5.4CNA v3.10.2%2026-05-27Fix
CVE-2026-6268EventPress reflected cross-site scripting7.1CISA ADP v3.10.3%2026-05-27Fix
CVE-2026-6169affiliate-toolkit WordPress plugin authenticated (Editor+) remote code execution7.2CNA v3.11.1%2026-05-27
CVE-2026-6053IBM Db2 range partitioned tables denial of service5.5CNA v3.10.1%2026-05-27Fix
CVE-2026-6052IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables6.5CNA v3.10.2%2026-05-27Fix
CVE-2026-6051IBM Db2 statement heap denial of service5.5CNA v3.10.2%2026-05-27Fix
CVE-2026-5516IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability4.4CNA v3.10.3%2026-05-27Fix
CVE-2026-5515IBM App Connect Enterprise is vulnerable to a confidential disclosure5.5CNA v3.10.1%2026-05-27Fix
CVE-2026-5509Arbitrary command injection via Browser Developer console in TP-Link Archer BE450 and BE72008.5CNA v4.05.2%2026-05-27Fix
CVE-2026-5296Missing authorization in GitLab4.3CNA v3.10.3%2026-05-27Fix
CVE-2026-5065IBM Controller hard-coded credentials8.8CNA v3.10.3%2026-05-27Fix
CVE-2026-4888WPEverest Everest Forms test email function missing authorization4.3CNA v3.10.3%2026-05-27Fix
CVE-2026-4868Authorization bypass through user-controlled key in GitLab8.2CNA v3.10.5%2026-05-27Fix
CVE-2026-4410IBM WebSphere Application Server denial of service4.8CNA v3.10.5%2026-05-27Fix
CVE-2026-4392TeamSpeak 3 Server clientek Handshake assertion6.9CNA v4.00.6%2026-05-27Fix
CVE-2026-4391TeamSpeak 3 Server ECC Key heap-based overflow6.9CNA v4.00.7%2026-05-27Fix
CVE-2026-4390TeamSpeak 3 Server Connection State Management process_resend_queue use-after-free5.3CNA v4.00.4%2026-05-27Exploit codeFix
CVE-2026-3897Livemesh Addons for Beaver Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-3896Livemesh SiteOrigin Widgets WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-3895WPBakery Page Builder Addons by Livemesh WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-05-27
CVE-2026-3676IBM Cloud APM, Base Private improper quantity validation6.5CNA v3.10.4%2026-05-27Fix
CVE-2026-3623IBM Netezza Performance Server Replication Services privilege escalation7.8CNA v3.10.2%2026-05-27Fix
CVE-2026-3375LiteSpeed Cache WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-05-27Fix
CVE-2026-3366IBM InfoSphere Optim Test Data Fabrication is affected by arbitrary file read7.5CNA v3.10.6%2026-05-27Fix
CVE-2026-3349MinhNhut Link Gateway WordPress plugin reflected cross-site scripting via URL parameter6.1CNA v3.10.4%2026-05-27
CVE-2026-3348MinhNhut Link Gateway WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-05-27
CVE-2026-3279Enable jQuery Migrate Helper WordPress plugin unauthorized access6.5CNA v3.10.4%2026-05-27
CVE-2026-3012Samba: Group policy certificate enrollment uses HTTP:// without validation6.8NVD v3.10.2%2026-05-27Fix
CVE-2026-3001Gutenverse WordPress plugin reflected cross-site scripting via s parameter6.1CNA v3.10.6%2026-05-27NucleiFix
CVE-2026-2607IBM MQ Operator sensitive information in log files5.1CNA v3.10.1%2026-05-27Fix
CVE-2026-2601Missing authorization in GitLab4.3CNA v3.10.3%2026-05-27Fix
CVE-2026-2340Samba: Vfs_worm does not block directory modification6.5CNA v3.10.9%2026-05-27Fix
CVE-2026-2288myLinksDump WordPress plugin stored cross-site scripting4.8CNA v3.10.2%2026-05-27
CVE-2026-2280rexCrawler WordPress plugin authenticated (Administrator+) stored cross-site scripting via settings4.8CNA v3.10.2%2026-05-27
CVE-2026-2255Hitachi Vantara Pentaho DATA Integration And Analytics insufficiently protected credentials4.3CNA v3.10.2%2026-05-27Fix
CVE-2026-2254Hitachi Vantara Pentaho Data Integration and Analytics incorrect permission assignment6.3CNA v3.10.2%2026-05-27Fix
CVE-2026-2253Hitachi Vantara Pentaho Data Integration and Analytics XML external entity injection7.7CNA v3.10.2%2026-05-27Fix
CVE-2026-2237Synology Storage Manager sensitive query strings6.2CNA v3.10.1%2026-05-27Fix
CVE-2026-2030WPBakery Page Builder Addons by Livemesh WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-05-27
CVE-2026-1933Samba: Missing access check on reparse point operations6.5NVD v3.10.9%2026-05-27Fix
CVE-2026-1718IBM Db2 autonomous transaction procedures denial of service7.1CNA v3.10.4%2026-05-27Fix
CVE-2026-1402Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.5%2026-05-27Fix
CVE-2026-1248IBM Business Automation Workflow information leak4.3CISA ADP v3.10.2%2026-05-27Fix
CVE-2026-48905Joomla! Framework [20260520] Inadequate content filtering within the cleanAttributes filter code6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-48904Joomla! Core [20260514] privilege escalation through com_users webservice endpoints8.2CNA v4.00.5%2026-05-26Fix
CVE-2026-48903Joomla! Framework [20260519] Inadequate content filtering within the checkAttribute filter code6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-48902Joomla! Core [20260518] Transport encryption downgrade for password and username reset links9.8CISA ADP v3.10.3%2026-05-26Fix
CVE-2026-48901Joomla! Core [20260517] Incorrect Cache Key Construction for InputFilter objects7.5CISA ADP v3.10.4%2026-05-26Fix
CVE-2026-48900Joomla! Core [20260516] Incorrect Access Control in com_scheduler6.4CNA v4.00.3%2026-05-26Fix
CVE-2026-48899Joomla! Core [20260515] Incorrect Access Control in sample data plugins5.3CNA v4.00.4%2026-05-26Fix
CVE-2026-48898Joomla! Core [20260513] privilege escalation through com_users batch task8.2CNA v4.00.5%2026-05-26Fix
CVE-2026-48897Joomla! Core [20260512] MFA authentication bypass8.2CNA v4.00.4%2026-05-26Fix
CVE-2026-48896Joomla! Core [20260511] MFA authentication bypass8.2CNA v4.00.4%2026-05-26Fix
CVE-2026-48864Libsolv: Heap buffer overflow in libsolv repopagestore7.8CNA v3.10.3%2026-05-26Fix
CVE-2026-48710Kludex Starlette HTTP request smuggling6.5CNA v3.17.1%2026-05-26KEVNucleiExploit codeKCVFix
CVE-2026-48697Pavel-odintsov Fastnetmon improper certificate validation7.4v3.10.2%2026-05-26
CVE-2026-48696Pavel-odintsov Fastnetmon buffer overflow6.2v3.10.1%2026-05-26Fix
CVE-2026-48695Pavel-odintsov Fastnetmon OS command injection8.1v3.11.1%2026-05-26Fix
CVE-2026-48694Pavel-odintsov Fastnetmon command injection8.1v3.10.2%2026-05-26Fix
CVE-2026-48693Pavel-odintsov Fastnetmon link following5.5v3.10.1%2026-05-26
CVE-2026-48692Pavel-odintsov Fastnetmon missing authentication8.1v3.10.2%2026-05-26
CVE-2026-48691Pavel-odintsov Fastnetmon heap-based buffer overflow9.8v3.10.3%2026-05-26Fix
CVE-2026-48690Pavel-odintsov Fastnetmon heap-based buffer overflow7.1v3.10.1%2026-05-26Fix
CVE-2026-48689Pavel-odintsov Fastnetmon heap-based buffer overflow9.8v3.10.7%2026-05-26Fix
CVE-2026-48688Pavel-odintsov Fastnetmon out-of-bounds read7.5v3.10.3%2026-05-26Fix
CVE-2026-48687Pavel-odintsov Fastnetmon OS command injection9.8v3.11.6%2026-05-26Fix
CVE-2026-48686Pavel-odintsov Fastnetmon buffer overflow9.8v3.10.6%2026-05-26Fix
CVE-2026-48685Pavel-odintsov Fastnetmon improper length parameter handling6.5v3.10.3%2026-05-26Fix
CVE-2026-48684Pavel-odintsov Fastnetmon out-of-bounds read6.5v3.10.3%2026-05-26Fix
CVE-2026-48683FastNetMon Community Edition NetFlow v9 flowset processor out-of-bounds read6.5CISA ADP v3.10.4%2026-05-26Fix
CVE-2026-48593Unbounded range expansion in cron describe causes memory exhaustion in oban_web5.9CNA v4.00.5%2026-05-26Fix
CVE-2026-48592Missing authorization check on save-job event handler in oban_web5.3CNA v4.00.6%2026-05-26Fix
CVE-2026-48136When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions4.1CNA v3.10.3%2026-05-26
CVE-2026-48135A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation.5.3CNA v3.10.4%2026-05-26
CVE-2026-48134When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to disr5.6CNA v3.10.3%2026-05-26
CVE-2026-48133When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.7.5CNA v3.10.5%2026-05-26
CVE-2026-48132The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service (temporary interruption of VPN negot8.1CNA v3.10.4%2026-05-26
CVE-2026-48131The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality).8.1CNA v3.10.4%2026-05-26
CVE-2026-48126Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir8.2CNA v3.10.5%2026-05-26Fix
CVE-2026-47728Bugsink: Project scoping missing in sourcemap and debug-file lookup4.3CNA v3.10.3%2026-05-26Fix
CVE-2026-47716Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known3.1CNA v3.10.2%2026-05-26Fix
CVE-2026-47715Bugsink: Issue event views can show an event from another project if its UUID is known3.1CNA v3.10.2%2026-05-26Fix
CVE-2026-47672epa4all-client REST API missing authentication6.5CNA v3.10.2%2026-05-26
CVE-2026-47202Kavita: Pre-Auth account takeover9.3CNA v4.00.2%2026-05-26Fix
CVE-2026-46740Mojolicious::Plugin::Statsd versions for Perl allowed metric injections5.3CISA ADP v3.10.4%2026-05-26Fix
CVE-2026-46624Twenty: SQL injection via the timeZone field9.9CNA v3.10.7%2026-05-26
CVE-2026-46620e107 comment moderation cross-site request forgery6.5CNA v3.10.2%2026-05-26Fix
CVE-2026-46431Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *4.3CNA v3.10.3%2026-05-26Fix
CVE-2026-46430Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS4.3CNA v3.10.2%2026-05-26Fix
CVE-2026-46368luci-app-https-dns-proxy authenticated command injection via setInitAction8.7CNA v4.07.8%2026-05-26Exploit code
CVE-2026-45836Linux kernel Bluetooth L2CAP driver null pointer dereference5.5NVD v3.10.1%2026-05-26Fix
CVE-2026-45835Linux kernel Bluetooth L2CAP driver null pointer dereference5.5NVD v3.10.2%2026-05-26Fix
CVE-2026-45834Linux kernel Bluetooth L2CAP driver null pointer dereference5.5NVD v3.10.1%2026-05-26Fix
CVE-2026-45728Algernon: Single-file mode unconditionally enables debug mode7.5CNA v3.10.4%2026-05-26Fix
CVE-2026-45721Algernon: Handler.lua discovery walks parent directories above the server root9.0CNA v3.10.7%2026-05-26Fix
CVE-2026-45575Improper verification of cryptographic signature in com.oviva.telematik:epa4all-client7.4CNA v3.10.2%2026-05-26Fix
CVE-2026-45574Oviva epa4all-client improper certificate validation8.1CNA v3.10.2%2026-05-26Fix
CVE-2026-45413MaxKB: Unsalted MD5 Password Hashing6.9CNA v4.00.1%2026-05-26Fix
CVE-2026-45412MaxKB: Unauthenticated SSRF via Workflow Template Import6.3CNA v4.00.4%2026-05-26Fix
CVE-2026-45298Dozzle: Pre-auth SSRF with response-body reflection8.6CNA v3.11.6%2026-05-26NucleiFix
CVE-2026-45247Mirasvit Full Page Cache Warmer deserialization of untrusted data9.3CNA v4.02.1%2026-05-26KEVEmerging ThreatsExploit codeFix
CVE-2026-45082Karakeep has a SSRF Protection Bypass via Redirect Handling7.6CNA v3.10.4%2026-05-26Fix
CVE-2026-44985Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication8.7CNA v4.00.2%2026-05-26Fix
CVE-2026-44983Servo smallbitvec capacity calculation heap buffer overflow7.3CNA v3.10.2%2026-05-26Fix
CVE-2026-44966Velocity.js: Prototype pollution in #set path assignment8.3CNA v3.10.6%2026-05-26
CVE-2026-44905Vanetza: Remote denial of service via Uncaught OER Encoding Exception in Cryptographic Verification7.5CNA v3.10.3%2026-05-26
CVE-2026-44903Prometheus: Stored XSS5.1CNA v4.00.2%2026-05-26Fix
CVE-2026-44900epa4all-client has a VAU Signature bypass8.1CNA v3.10.2%2026-05-26Fix
CVE-2026-44899Mistune Image Directive CSS injection4.7CNA v3.10.3%2026-05-26Fix
CVE-2026-44898Mistune TOC Anchor injection XSS6.1CNA v3.10.3%2026-05-26Fix
CVE-2026-44897Mistune Heading ID attribute injection XSS6.1CNA v3.10.3%2026-05-26Fix
CVE-2026-44896Mistune: XSS via unescaped figclass/figwidth in Figure directive5.3CNA v4.00.3%2026-05-26Fix
CVE-2026-44895GitLab MCP Server SSE transport missing authentication9.2CNA v4.00.6%2026-05-26Fix
CVE-2026-44847MaxKB: Webhook Trigger authentication bypass7.5CNA v3.10.5%2026-05-26Fix
CVE-2026-44844eml_parser has recursion DoS via nested message/rfc822 attachments6.3CNA v4.00.4%2026-05-26Fix
CVE-2026-44843LangChain: Unsafe deserialization of attacker-controlled LangChain objects8.2CNA v3.10.4%2026-05-26Fix
CVE-2026-44837view_component system test entrypoint vulnerability5.9CNA v3.10.4%2026-05-26Fix
CVE-2026-44836view_component preview route exposed dangerous method6.5CNA v3.10.4%2026-05-26Fix
CVE-2026-44833Snipe-IT: Open redirect5.9CNA v3.10.2%2026-05-26Fix
CVE-2026-44832Snipe-IT: Privilege escalation via API Permissions Assignment8.7CNA v4.00.4%2026-05-26Fix
CVE-2026-44831Snipe-IT: XSS vulnerability in component notes4.8CNA v3.10.3%2026-05-26Fix
CVE-2026-44788SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)5.9CNA v3.10.4%2026-05-26Fix
CVE-2026-44776Kavita: IDOR in /API/Download/*5.9CNA v4.00.4%2026-05-26Fix
CVE-2026-44775Kavita: No authentication at /API/Reader/image6.9CNA v4.00.4%2026-05-26Fix
CVE-2026-44749Information disclosure vulnerability in SAP Gateway4.3CNA v3.10.3%2026-05-26Fix
CVE-2026-44730OpenCTI: Privilege escalation7.2CNA v3.10.5%2026-05-26Fix
CVE-2026-44729Twenty: Stored cross-site scripting8.7CNA v3.10.4%2026-05-26
CVE-2026-44728@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input8.2CNA v3.10.2%2026-05-26Fix
CVE-2026-44723vowpal_wabbit vowpal Wabbit: Shell injection5.0CNA v3.10.6%2026-05-26
CVE-2026-44708Mistune Math Plugin XSS Escape Bypass6.1CNA v3.10.3%2026-05-26Fix
CVE-2026-44707Chatwoot: Pre-account takeover via OAuth on Unconfirmed Accounts6.8CNA v3.10.5%2026-05-26Fix
CVE-2026-44706Chatwoot: SQL injection in Conversation/Contact Filter API via Custom Attribute Values8.5CNA v3.10.3%2026-05-26Exploit codeFix
CVE-2026-44680MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys7.6CNA v3.11.3%2026-05-26Exploit codeFix
CVE-2026-44669Faction: Stored XSS in Assessment Attachment Filename Preview Rendering8.7CNA v3.10.4%2026-05-26Fix
CVE-2026-44668Faction: Unauthenticated Read, Modify, and Delete of Boilerplate templates9.8CNA v3.10.7%2026-05-26Fix
CVE-2026-44667Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering8.7CNA v3.10.4%2026-05-26Fix
CVE-2026-44502Bugsink: SSRF bypass in `validate_webhook_url`4.3CNA v3.10.4%2026-05-26Fix
CVE-2026-44469Incorrect default permissions in CODESYS Development System7.0v3.10.1%2026-05-26Fix
CVE-2026-44468Incorrect default permissions in CODESYS Development System8.5CNA v4.00.1%2026-05-26Fix
CVE-2026-44451Lumiverse: TSX component sandbox escape via DOM ref and string-split identifier bypass9.3CNA v3.10.4%2026-05-26Fix
CVE-2026-44450Lumiverse: RCE via MCP stdio argument injection9.9CNA v3.10.7%2026-05-26Fix
CVE-2026-44449Lumiverse: SMB `exists` basename injection via smbclient `!cmd` escape9.1CNA v3.10.9%2026-05-26Fix
CVE-2026-44444Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan9.1CNA v3.10.7%2026-05-26Fix
CVE-2026-44443Lumiverse: Sign-up nonce race condition allows unauthorized account registration4.8CNA v3.10.2%2026-05-26Fix
CVE-2026-44410ZTE ZXUniPOS NDS-LTE business logic flaw3.8CNA v3.10.2%2026-05-26
CVE-2026-44314Traccar: Missing edit authorization on device image upload allows read-only users to write files5.3CNA v4.00.3%2026-05-26Fix
CVE-2026-44214eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields5.8CNA v3.10.3%2026-05-26Fix
CVE-2026-44213opentelemetry-dotnet-contrib improper certificate validation6.5CNA v3.10.2%2026-05-26Fix
CVE-2026-44209Banks: Critical remote code execution (RCE) via Jinja2 SSTI7.5CNA v3.10.7%2026-05-26Fix
CVE-2026-43988Vanetza: Remote denial of service via uncaught exception in ASN.1/OER Parsing7.5CNA v3.10.3%2026-05-26
CVE-2026-43982Algernon: Path traversal file write via savein8.7CNA v4.00.5%2026-05-26Fix
CVE-2026-43981Algernon: Race condition in handle shared LState8.2CNA v4.00.3%2026-05-26Fix
CVE-2026-43936e107 remote file fetcher server-side request forgery4.3CNA v3.10.3%2026-05-26Fix
CVE-2026-43935e107 password reset host header injection8.1CNA v3.10.5%2026-05-26Fix
CVE-2026-43934e107 comment editor insecure direct object reference6.5CNA v3.10.3%2026-05-26Fix
CVE-2026-42785OpenKM remote code execution via Administrative Scripting8.6CNA v4.01.2%2026-05-26Exploit codeFix
CVE-2026-42497Archive::Tar hardlink extraction vulnerability7.5NVD v3.10.5%2026-05-26Fix
CVE-2026-42496Archive::Tar symlink extraction vulnerability9.1NVD v3.10.4%2026-05-26Fix
CVE-2026-42448Magic Wormhole file receive path traversal3.5CNA v3.10.3%2026-05-26Fix
CVE-2026-42425OpenKM Unrestricted SQL Execution via DatabaseQuery8.6CNA v4.00.9%2026-05-26Exploit codeFix
CVE-2026-42337MaxKB: Broken access control in MaxKB OSS URL Fetch API5.3CNA v4.00.4%2026-05-26Fix
CVE-2026-42336MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch5.1CNA v4.00.3%2026-05-26Fix
CVE-2026-42335MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy6.3CNA v4.00.4%2026-05-26Fix
CVE-2026-42015Red Hat Enterprise Linux 10 off-by-one error5.3CNA v3.10.9%2026-05-26Fix
CVE-2026-42013Red Hat Enterprise Linux 10 improper certificate validation8.2CNA v3.10.6%2026-05-26Fix
CVE-2026-42012Red Hat Enterprise Linux 10 improper certificate validation7.1CNA v3.10.5%2026-05-26Fix
CVE-2026-41917OpenKM local file inclusion via Admin Scripting6.9CNA v4.00.6%2026-05-26Exploit codeFix
CVE-2026-41401libyang heap use-after-free Write in XML Metadata Parsing6.9CNA v4.00.6%2026-05-26Fix
CVE-2026-41164Nuts Foundation nuts-node insufficient verification of data authenticity4.4CNA v3.10.1%2026-05-26Fix
CVE-2026-40564Apache Flink Kubernetes Operator FlinkSessionJob jarURI server-side request forgery6.5v3.10.5%2026-05-26Exploit codeFix
CVE-2026-40384Joomla! Core [20260510] path traversal in com_media webservice endpoint5.9CNA v4.00.5%2026-05-26Fix
CVE-2026-40383Joomla! Core [20260509] LFI in HTMLView layout parameter7.5CNA v4.00.6%2026-05-26Fix
CVE-2026-40034gitoxide command injection via Partial .gitmodules Override in gix-submodule7.3CNA v4.00.7%2026-05-26Fix
CVE-2026-40033FreeRDP Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass8.6CNA v4.01.1%2026-05-26Fix
CVE-2026-39661SW Core WordPress plugin local file inclusion7.5CNA v3.10.5%2026-05-26
CVE-2026-39655Mayosis Core WordPress plugin broken access control5.3CNA v3.10.3%2026-05-26
CVE-2026-39642Nyla WordPress theme arbitrary shortcode execution vulnerability5.3CNA v3.10.3%2026-05-26
CVE-2026-38587ONLYOFFICE DocSpace REST API endpoints information disclosure4.3CISA ADP v3.10.3%2026-05-26
CVE-2026-36239PbootCMS site configuration code injection4.3CISA ADP v3.10.2%2026-05-26Exploit code
CVE-2026-35223Joomla! Core [20260508] Improper access check in com_config webservice endpoints8.6CNA v4.00.5%2026-05-26Fix
CVE-2026-35222Joomla! Core [20260507] Authenticated blind SQLi in com_tags6.9CNA v4.00.5%2026-05-26Fix
CVE-2026-35221Joomla! Core [20260506] Authenticated blind SQLi in com_finder6.9CNA v4.00.5%2026-05-26Fix
CVE-2026-35220Joomla! Core [20260505] CSRF in user activation endpoint4.6CNA v4.00.1%2026-05-26Fix
CVE-2026-30895Joomla! Core [20260504] XSS in readmore links6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-30894Joomla! Core [20260503] XSS in com_contenthistory6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-27427Geo Mashup WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-05-26Fix
CVE-2026-27331WpTravelly WordPress plugin broken access control6.3CNA v3.10.3%2026-05-26Fix
CVE-2026-25901Joomla! Core [20260502] XSS in com_associations6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-25900Joomla! Core [20260501] XSS in feed modules6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-25713MediaArea MediaInfoLib ID3v2 parsing functionality heap-based buffer overflow7.8CNA v3.10.2%2026-05-26
CVE-2026-25444WpBookingly WordPress plugin broken access control4.3CNA v3.10.3%2026-05-26Fix
CVE-2026-25426Taxi Booking Manager for WooCommerce WordPress plugin broken access control5.3CNA v3.10.2%2026-05-26Fix
CVE-2026-25112Genetec RabbitMQ incorrect permission assignment7.8CNA v3.10.1%2026-05-26Fix
CVE-2026-25104MediaArea MediaInfoLib LXF parsing functionality heap-based buffer overflow7.8CNA v3.10.2%2026-05-26
CVE-2026-24638RepairBuddy WordPress plugin broken access control4.3CNA v3.10.2%2026-05-26Fix
CVE-2026-24590Paid Videochat Turnkey Site WordPress plugin broken access control5.3CNA v3.10.2%2026-05-26Fix
CVE-2026-24520Tiktok Feed WordPress plugin broken access control4.3CNA v3.10.2%2026-05-26Fix
CVE-2026-24212NVIDIA Isaac Launchable cleartext transmission of sensitive information7.5CNA v3.10.7%2026-05-26Fix
CVE-2026-24201NVIDIA Virtual GPU Manager out-of-bounds write5.8CNA v3.10.1%2026-05-26Fix
CVE-2026-24200NVIDIA Virtual GPU Manager use-after-free7.0CNA v3.10.2%2026-05-26Fix
CVE-2026-24199NVIDIA GeForce race condition4.7CNA v3.10.1%2026-05-26Fix
CVE-2026-24198NVIDIA GeForce race condition5.6CNA v3.10.2%2026-05-26Fix
CVE-2026-24197NVIDIA GeForce insecure default initialization6.5CNA v3.10.2%2026-05-26Fix
CVE-2026-24196NVIDIA GeForce out-of-bounds read7.1CNA v3.10.2%2026-05-26Fix
CVE-2026-24195NVIDIA Guest driver improper input validation7.1CNA v3.10.2%2026-05-26Fix
CVE-2026-24194NVIDIA GeForce improper preservation of permissions7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-24193NVIDIA GeForce out-of-bounds write7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-24192NVIDIA GeForce incorrect numeric conversion7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-24191NVIDIA GeForce time-of-check time-of-use race condition7.8CNA v3.10.1%2026-05-26Fix
CVE-2026-24190NVIDIA GeForce missing authorization7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-24187NVIDIA GeForce use-after-free8.8CNA v3.10.2%2026-05-26Fix
CVE-2026-24182NVIDIA GeForce improper locking6.5CNA v3.10.1%2026-05-26Fix
CVE-2026-24162NVIDIA Merlin Transformers4Rec deserialization of untrusted data7.8CNA v3.10.4%2026-05-26Fix
CVE-2026-9605GNU LibreDWG Dwgbmp utility bits.c bit_read_RC heap-based overflow6.9CNA v4.00.6%2026-05-26Fix
CVE-2026-9604JeecgBoot AiragModelController access control5.3CNA v4.00.4%2026-05-26Fix
CVE-2026-9603SourceCodester eDoc Doctor Appointment System delete-session.php authorization6.9CNA v4.00.5%2026-05-26
CVE-2026-9584code-projects Project Management System Login chk.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9583SourceCodester CET Automated Grading System with AI Predictive Analytics information disclosure5.3CNA v4.00.4%2026-05-26
CVE-2026-9582SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery5.3CNA v4.00.2%2026-05-26
CVE-2026-9581JeecgBoot add access control5.3CNA v4.00.4%2026-05-26Fix
CVE-2026-9580JeecgBoot selectDepart LoginController.selectDepart access control6.9CNA v4.00.5%2026-05-26Fix
CVE-2026-9579JeecgBoot SysUser userEdit user.getUsername access control5.3CNA v4.00.4%2026-05-26Fix
CVE-2026-9575itsourcecode Student Transcript Processing System index.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9574itsourcecode Student Transcript Processing System trans.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9573itsourcecode Student Transcript Processing System index.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9572GPAC MP4Box media.c Media_GetSample memory leak5.5v3.10.2%2026-05-26
CVE-2026-9568ThingsBoard YAML provision getGatewayDockerComposeFile code injection2.3CNA v4.00.3%2026-05-26
CVE-2026-9567GPAC MP4Box isom_intern.c MergeFragment null pointer dereference4.8CNA v4.00.2%2026-05-26
CVE-2026-9566teableio teable Sign-up LoginPage.tsx cross-site scripting5.3CNA v4.00.5%2026-05-26Fix
CVE-2026-9565haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection5.3CNA v4.01.8%2026-05-26
CVE-2026-9564SourceCodester Hospitals Patient Records Management System view_patient page cross-site scripting4.8CNA v4.00.4%2026-05-26
CVE-2026-9562sambitraj STUDENT-management-SYSTEM Dashboard access control6.9CNA v4.00.5%2026-05-26
CVE-2026-9560OpenVPN Connect OS command injection9.4CNA v4.00.4%2026-05-26Exploit codeFix
CVE-2026-9552Das Parking Management System 停车场管理系统 Search API endpoint SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9551Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9550Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform path traversal6.9CNA v4.00.7%2026-05-26
CVE-2026-9544Shenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9543Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection9.3CNA v4.03.3%2026-05-26Emerging Threats
CVE-2026-9542CodeAstro Leave Management System add_staff.php SQL injection5.3CNA v4.00.3%2026-05-26
CVE-2026-9541Squirrel Cnut file sqobject.cpp ReadObject heap-based overflow5.3v3.10.2%2026-05-26
CVE-2026-9540Vllm-project vLLM OpenAI-compatible Serving Path denial of service6.9CNA v4.00.7%2026-05-26
CVE-2026-9538Archive::Tar versions for Perl allow memory exhaustion7.5NVD v3.10.4%2026-05-26Fix
CVE-2026-9534Totolink CA750-PoE setting cstecgi.cgi setWiFiWpsConfig os command injection5.3CNA v4.01.8%2026-05-26Emerging Threats
CVE-2026-9533Totolink CA750-PoE setting cstecgi.cgi recvUpgradeNewFw os command injection5.3CNA v4.01.8%2026-05-26Emerging Threats
CVE-2026-9532Totolink CA750-PoE setting cstecgi.cgi setUploadUserData os command injection5.3CNA v4.01.8%2026-05-26Emerging Threats
CVE-2026-9531Totolink CA750-PoE setting cstecgi.cgi setUpgradeUboot os command injection5.3CNA v4.01.8%2026-05-26Emerging Threats
CVE-2026-9530GNU LibreDWG Dwgbmp utility decode.c read_2004_compressed_section out-of-bounds4.8CNA v4.00.2%2026-05-26Fix
CVE-2026-9529GNU LibreDWG Dwggrep utility dwggrep.c match_BLOCK_HEADER null pointer dereference4.8CNA v4.00.2%2026-05-26Fix
CVE-2026-9528itsourcecode Electronic Judging System delete_judge.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9527itsourcecode Electronic Judging System judges.php cross-site scripting5.3CNA v4.00.4%2026-05-26
CVE-2026-9526itsourcecode Electronic Judging System edit_team.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9525itsourcecode Electronic Judging System edit_judge.php SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9524xianrendzw EasyReport REST endpoint execute SQL injection5.3CNA v4.00.3%2026-05-26
CVE-2026-9523Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform SQL injection6.9CNA v4.00.4%2026-05-26
CVE-2026-9521fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input6.3CNA v4.00.5%2026-05-26Fix
CVE-2026-9520blitz-js blitz Sign-in LoginForm.tsx cross-site scripting5.3CNA v4.00.4%2026-05-26
CVE-2026-9519stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross-site scripting5.3CNA v4.00.4%2026-05-26
CVE-2026-9518hemant6488 CodeIgniter-StudentManagementSystem Students Controller cross-site scripting5.3CNA v4.00.4%2026-05-26
CVE-2026-9517hemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control6.9CNA v4.00.5%2026-05-26
CVE-2026-9515Totolink CA750-PoE setting cstecgi.cgi setUnloadUserData os command injection5.3CNA v4.01.8%2026-05-26Emerging Threats
CVE-2026-9496pacote is vulnerable to denial of service (DoS) via the addGitSha function8.7CNA v4.00.6%2026-05-26Fix
CVE-2026-9495@koa/router has an Access Control Bypass6.9CNA v4.00.6%2026-05-26Fix
CVE-2026-9170IBM HTTP Server code injection9.8CISA ADP v3.10.9%2026-05-26Fix
CVE-2026-8890code100x Mobile API authentication bypass via header spoofing8.8CNA v4.00.6%2026-05-26
CVE-2026-8856IBM HTTP Server denial of service7.7CNA v3.10.3%2026-05-26Fix
CVE-2026-8855IBM HTTP Server code injection8.1CNA v3.10.8%2026-05-26Fix
CVE-2026-8854IBM HTTP Server mod_mem_cache module denial of service7.5CNA v3.10.5%2026-05-26Fix
CVE-2026-8852IBM HTTP Server mod_fastcgi module denial of service6.2CNA v3.10.3%2026-05-26Fix
CVE-2026-8850IBM HTTP Server mod_ibm_upload module null pointer dereference7.5CNA v3.10.5%2026-05-26Fix
CVE-2026-8835IBM HTTP Server Administration Server vulnerability7.3CNA v3.10.3%2026-05-26Fix
CVE-2026-8834IBM HTTP Server Administration Server heap-based buffer overflow8.0CNA v3.10.3%2026-05-26Fix
CVE-2026-8676silabs.com Simplicity SDK authentication bypass by spoofing8.8CNA v3.10.3%2026-05-26Fix
CVE-2026-8647Crypt::ScryptKDF random_bytes function vulnerability4.8CISA ADP v3.10.3%2026-05-26Fix
CVE-2026-8633IBM WebSphere Application Server Web Server Plug-ins code injection9.8CNA v3.10.9%2026-05-26Fix
CVE-2026-8620IBM WebSphere Application Server Web Server Plug-ins HTTP request smuggling7.5CNA v3.10.4%2026-05-26Fix
CVE-2026-8479Hitachi Energy RTU500 series CMU firmware null pointer dereference6.9CNA v4.00.2%2026-05-26Fix
CVE-2026-8174Zoho Mail wordpress plugin cross-site request forgery5.7CNA v3.10.7%2026-05-26Fix
CVE-2026-8047Out-of-bounds write in CODESYS Control8.7CNA v4.00.6%2026-05-26Fix
CVE-2026-8046Incorrect authorization in CODESYS Control7.2CNA v4.00.5%2026-05-26Fix
CVE-2026-7454WRL File Parsing memory corruption in Autodesk 3ds Max7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-7453WRL File Parsing memory exhaustion in Autodesk 3ds Max5.5CNA v3.10.2%2026-05-26Fix
CVE-2026-7452WRL File Parsing memory corruption in Autodesk 3ds Max7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-7451TIF File Parsing out-of-bounds write in Autodesk 3ds Max7.8CNA v3.10.2%2026-05-26Fix
CVE-2026-7450PAR File Parsing null pointer dereference in Autodesk 3ds Max5.5CNA v3.10.2%2026-05-26Fix
CVE-2026-7374Red Hat Container Native Virtualization KubeVirt has a link following9.9CNA v3.10.8%2026-05-26Fix
CVE-2026-7310Hitachi Energy MACH HiDraw heap-based buffer overflow4.4CNA v4.00.1%2026-05-26Fix
CVE-2026-7251Eppendorf BioFlo 320 use of hard-coded password9.3CNA v4.00.7%2026-05-26Fix
CVE-2026-5260Red Hat Enterprise Linux 10 gnutls: Gnutls: Information disclosure8.2CNA v3.10.9%2026-05-26Fix
CVE-2026-4795Zyxel GS1200-5v3 firmware missing authorization6.5CNA v3.10.3%2026-05-26Fix
CVE-2026-4480Samba: Samba: Remote code execution in printing subsystem via unescaped job description9.8NVD v3.113.9%2026-05-26Reported exploitedNucleiExploit codeFix
CVE-2026-4051IBM Engineering Lifecycle Management Jazz Foundation remote code execution7.2CNA v3.10.5%2026-05-26Fix
CVE-2026-3660IBM Engineering Lifecycle Management Jazz Foundation is vulnerable to authentication bypass9.8CNA v3.10.6%2026-05-26Fix
CVE-2026-3603IBM Engineering Lifecycle Management Jazz Foundation XML external entity injection7.1CNA v3.10.4%2026-05-26Fix
CVE-2026-3314Hitachi Ops Center Analyzer password fields information disclosure4.6CNA v3.10.2%2026-05-26Fix
CVE-2026-2264Server-side request forgery and Credential Exfiltration in Google Cloud Apigee9.2CNA v4.00.4%2026-05-26Fix
CVE-2026-48852PuTTY reachable assertion3.7CNA v3.10.4%2026-05-25Fix
CVE-2026-48851PuTTY UI misrepresentation3.1CNA v3.10.3%2026-05-25Fix
CVE-2026-48850PuTTY double free5.9v3.10.3%2026-05-25Fix
CVE-2026-48849Roundcube Webmail cross-site scripting4.4CNA v3.10.3%2026-05-25Exploit codeFix
CVE-2026-48848Roundcube Webmail cross-site scripting7.2CNA v3.10.4%2026-05-25Fix
CVE-2026-48847Roundcube Webmail incorrect resource transfer3.7CNA v3.10.5%2026-05-25Fix
CVE-2026-48846Roundcube Webmail incorrect resource transfer6.5CNA v3.10.5%2026-05-25Fix
CVE-2026-48845Roundcube Webmail incorrect resource transfer6.5CNA v3.10.4%2026-05-25Fix
CVE-2026-48844Roundcube Webmail incorrect control flow7.5CNA v3.10.5%2026-05-25Fix
CVE-2026-48843Roundcube Webmail server-side request forgery7.2CNA v3.10.5%2026-05-25Fix
CVE-2026-48842Roundcube Webmail SQL injection8.1CNA v3.10.9%2026-05-25Reported exploitedExploit codeFix
CVE-2026-48837Unlimited Elements For Elementor WordPress plugin SQL injection8.5CNA v3.10.4%2026-05-25Fix
CVE-2026-48589Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow0.0CNA v4.00.5%2026-05-25Fix
CVE-2026-47077Unbounded body accumulation in HTTP/3 response loop in hackney8.2CNA v4.00.7%2026-05-25Fix
CVE-2026-47076SSRF allowlist bypass via percent-encoded host in hackney6.9CNA v4.00.2%2026-05-25Fix
CVE-2026-47075CR/LF injection in query parameter in hackney6.8CNA v4.00.4%2026-05-25Fix
CVE-2026-47073Unbounded memory consumption in WebSocket client in hackney8.7CNA v4.00.8%2026-05-25Fix
CVE-2026-47072CRLF injection in WebSocket upgrade request in hackney6.9CNA v4.00.5%2026-05-25Fix
CVE-2026-47071SOCKS5 TLS upgrade ignores caller timeout in hackney8.2CNA v4.00.7%2026-05-25Fix
CVE-2026-47070Hackney: Cross-origin Redirect leaks Authorization, Cookie, and Request Body6.0CNA v4.00.3%2026-05-25Fix
CVE-2026-47069CRLF injection in cookie domain/path options in hackney2.1CNA v4.00.4%2026-05-25Fix
CVE-2026-47067Atom table exhaustion via unrecognized URL schemes in hackney8.7CNA v4.00.7%2026-05-25Fix
CVE-2026-47066Infinite loop in Alt-Svc header parser in hackney8.7CNA v4.00.7%2026-05-25Fix
CVE-2026-46745Apache Airflow FAB provider: LDAP Filter injection in FAB Auth Manager _search_ldap reachable5.3CISA ADP v3.10.8%2026-05-25Fix
CVE-2026-45438Smart Coupons for WooCommerce WordPress plugin broken access control7.5CNA v3.10.4%2026-05-25Fix
CVE-2026-45435WP Activity Log WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-05-25Fix
CVE-2026-45361Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook8.1CISA ADP v3.10.8%2026-05-25Fix
CVE-2026-45249Apache ECharts: XSS in Lines series tooltip rendering6.1CISA ADP v3.10.9%2026-05-25Fix
CVE-2026-45217Stripe Payment Gateway for WooCommerce WordPress plugin broken authentication6.5CNA v3.10.5%2026-05-25Fix
CVE-2026-45216Smart Manager WordPress plugin privilege escalation8.8CNA v3.10.4%2026-05-25Fix
CVE-2026-45209MyCryptoCheckout WordPress plugin broken access control7.5CNA v3.10.4%2026-05-25Fix
CVE-2026-44598Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)5.1CNA v4.00.5%2026-05-25Fix
CVE-2026-43828Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default5.9CNA v4.00.3%2026-05-25Fix
CVE-2026-43827Apache Shiro: Session fixation: New session is not created after login by default5.9CNA v4.00.5%2026-05-25Fix
CVE-2026-42797Apache Syncope: JexlContextBuilder information disclosure4.9CISA ADP v3.10.6%2026-05-25Fix
CVE-2026-42782Apache Syncope: Post-auth RCE via Groovy static7.2v3.10.7%2026-05-25Fix
CVE-2026-42776Sunshine Photo Cart WordPress plugin broken access control6.3CNA v3.10.3%2026-05-25Fix
CVE-2026-42774JetEngine WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-25Fix
CVE-2026-42773eMagicOne Store Manager WordPress plugin SQL injection9.3CNA v3.10.4%2026-05-25
CVE-2026-42763SePay Gateway WordPress plugin sensitive data exposure6.5CNA v3.10.3%2026-05-25Fix
CVE-2026-41863VMware Spring AI Anthropic Skills API file writer path traversal6.5CNA v3.10.4%2026-05-25Fix
CVE-2026-40127Authorization bypass through user-controlled key in OutSystems Lifetime5.3CNA v4.00.4%2026-05-25Fix
CVE-2026-39436CformsII WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2026-05-25Fix
CVE-2026-32389NanoCare WordPress theme broken access control5.4CNA v3.10.3%2026-05-25Fix
CVE-2026-27768Genetec Security Center SQL injection6.6CNA v3.10.4%2026-05-25Fix
CVE-2026-27398RSVP and Event Management WordPress plugin broken access control5.3CNA v3.10.3%2026-05-25Fix
CVE-2026-27357WP Search Analytics WordPress plugin broken access control5.3CNA v3.10.3%2026-05-25Fix
CVE-2026-27346B2BKing WordPress plugin broken access control4.9CNA v3.10.3%2026-05-25Fix
CVE-2026-25193Gallagher Command Centre Server some sensitive information in log files8.1CNA v3.10.1%2026-05-25Fix
CVE-2026-24937Broadcast Live Video WordPress plugin remote code execution (RCE)7.2CNA v3.10.4%2026-05-25Fix
CVE-2026-24597Organization chart WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-05-25Fix
CVE-2026-24592Auto Affiliate Links WordPress plugin broken access control5.3CNA v3.10.2%2026-05-25Fix
CVE-2026-24586Newses WordPress theme broken access control5.4CNA v3.10.3%2026-05-25Fix
CVE-2026-24582FlexTable WordPress plugin broken access control4.3CNA v3.10.2%2026-05-25Fix
CVE-2026-24574Export WP Page to Static HTML/CSS WordPress plugin cross-site request forgery (CSRF)6.5CNA v3.10.1%2026-05-25Fix
CVE-2026-24554WPSubscription WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.1%2026-05-25Fix
CVE-2026-24546GamiPress WordPress plugin broken access control5.3CNA v3.10.3%2026-05-25Fix
CVE-2026-24545QR Redirector WordPress plugin broken access control4.3CNA v3.10.2%2026-05-25Fix
CVE-2026-24527Autoship Cloud for WooCommerce Subscription Products WordPress plugin broken access control4.3CNA v3.10.2%2026-05-25Fix
CVE-2026-9514Totolink CA750-PoE setting cstecgi.cgi setNetworkDiag os command injection5.3CNA v4.01.8%2026-05-25Emerging Threats
CVE-2026-9513Totolink CA750-PoE setting cstecgi.cgi NTPSyncWithHost os command injection5.3CNA v4.01.8%2026-05-25
CVE-2026-9512Totolink CA750-PoE setting cstecgi.cgi setPasswordCfg os command injection5.3CNA v4.01.8%2026-05-25
CVE-2026-9511Totolink CA750-PoE setting cstecgi.cgi setWebWlanIdx os command injection5.3CNA v4.01.8%2026-05-25
CVE-2026-9504GNU LibreDWG Dwggrep utility dwggrep.c bit_convert_TU out-of-bounds4.8CNA v4.00.2%2026-05-25Fix
CVE-2026-9503GNU LibreDWG DWG file decode.c dwg_next_entity null pointer dereference4.8CNA v4.00.2%2026-05-25Fix
CVE-2026-9502GNU LibreDWG Dwgread utility decode.c decompress_R2004_section heap-based overflow4.8CNA v4.00.2%2026-05-25Fix
CVE-2026-9501GNU LibreDWG Dwgread utility decode.c decompress_R2004_section assertion4.8CNA v4.00.2%2026-05-25Fix
CVE-2026-9500GNU LibreDWG Dwgread utility decode.c read_2004_compressed_section heap-based overflow4.8CNA v4.00.2%2026-05-25
CVE-2026-9498Dromara lamp-cloud Message Template Handler server-side template injection5.3CNA v4.00.4%2026-05-25
CVE-2026-9497changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization5.3CNA v4.00.4%2026-05-25
CVE-2026-9490Acer Care Center creates a Named Pipe with a weak Security Descriptor6.8CNA v4.00.1%2026-05-25Exploit codeFix
CVE-2026-9489Acer NitrorSense V3 NitroSense V3: Local privilege escalation (LPE)8.5CNA v4.00.2%2026-05-25
CVE-2026-9486SourceCodester Student Grades Management System cross-site request forgery5.3CNA v4.00.2%2026-05-25
CVE-2026-9485SourceCodester Student Grades Management System students.php cross-site scripting5.1CNA v4.00.3%2026-05-25
CVE-2026-9484SourceCodester Student Grades Management System classroom.php improper authorization5.3CNA v4.00.4%2026-05-25
CVE-2026-9483SourceCodester Student Grades Management System grades.php improper authorization5.3CNA v4.00.3%2026-05-25
CVE-2026-9482Edimax EW-7438RPn formSDHCP stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9481Edimax EW-7438RPn formStats stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9480Edimax EW-7438RPn formrefresh stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9479Edimax EW-7438RPn formLogout stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9478Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9477Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9476Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9475Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9474yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in SQL injection6.9CNA v4.00.4%2026-05-25
CVE-2026-9473c-rick jimeng-mcp api.ts generateVideo path traversal5.3CNA v4.00.4%2026-05-25
CVE-2026-9472dazeb markdown-downloader index.ts create_subdirectory path traversal5.3CNA v4.00.4%2026-05-25
CVE-2026-9471yashpokharna2555 StudentManagementSystem student.php cross-site scripting5.1CNA v4.00.3%2026-05-25
CVE-2026-9470yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in SQL injection6.9CNA v4.00.4%2026-05-25
CVE-2026-9469yashpokharna2555 StudentManagementSystem success.php SQL injection6.9CNA v4.00.4%2026-05-25
CVE-2026-9468dazeb cline-mcp-memory-bank index.ts handleInitializeMemoryBank path traversal5.3CNA v4.00.4%2026-05-25
CVE-2026-9467debugmcp mcp-debugger server.ts handleGetSourceContext path traversal5.3CNA v4.00.5%2026-05-25
CVE-2026-9466Tiandy Easy7 Integrated Management Platform API endpoint updateUserPassword password recovery6.9CNA v4.00.5%2026-05-25
CVE-2026-9465Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp SQL injection6.9CNA v4.00.4%2026-05-25
CVE-2026-9464YunaiV yudao-cloud Admin API endpoint create IotDataSinkHttpConfig server-side request forgery5.1CNA v4.00.4%2026-05-25
CVE-2026-9463Edimax EW-7438RPn formLicence stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9462Edimax EW-7438RPn formWpsProxyEnable stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9461Edimax EW-7438RPn formRadius stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9460Edimax EW-7438RPn formAccept stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9459Edimax EW-7438RPn formConnectionSetting stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9458Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9457Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9456Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9455Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9454Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9453FoundDream miniclawd SkillsLoader skills-loader.ts which command injection6.9CNA v4.02.1%2026-05-25
CVE-2026-9452FoundDream miniclawd exec.ts ExecTool.execute os command injection6.9CNA v4.02.1%2026-05-25
CVE-2026-9451code-projects Employee Management System applyleaveprocess.php SQL injection5.3CNA v4.00.3%2026-05-25
CVE-2026-9450code-projects Employee Management System psubmit.php SQL injection5.3CNA v4.00.3%2026-05-25
CVE-2026-9449code-projects Employee Management System changepassemp.php SQL injection5.3CNA v4.00.3%2026-05-25
CVE-2026-9448code-projects Employee Management System applyleave.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9447SourceCodester Simple POS and Inventory System search.php SQL injection6.9CNA v4.00.4%2026-05-25
CVE-2026-9446SourceCodester Simple POS and Inventory System edit_customer.php SQL injection5.1CNA v4.00.3%2026-05-25
CVE-2026-9445SourceCodester Simple POS and Inventory System file extension addproduct.php unrestricted upload5.3CNA v4.00.3%2026-05-25
CVE-2026-9444SourceCodester Simple POS and Inventory System GET parameter deleteproduct.php delete SQL injection5.1CNA v4.00.3%2026-05-25
CVE-2026-9443Edimax BR-6478AC POST request formL2TPSetup buffer overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9442Edimax BR-6478AC POST request formiNICSiteSurvey buffer overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9441Edimax BR-6478AC POST request formiNICbasic command injection5.3CNA v4.02.4%2026-05-25Emerging Threats
CVE-2026-9440Edimax BR-6478AC POST request formAccept command injection5.3CNA v4.02.4%2026-05-25Emerging Threats
CVE-2026-9439Edimax BR-6675nD stainfo command injection5.3CNA v4.02.4%2026-05-25
CVE-2026-9438yashpokharna2555 StudentManagementSystem courseDel.php resource injection5.3CNA v4.00.4%2026-05-25
CVE-2026-9437DTStack Taier REST API Runtime.exec os command injection5.3CNA v4.02.4%2026-05-25
CVE-2026-9436Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection9.3CNA v4.03.5%2026-05-25
CVE-2026-9435Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9434Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9433Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9432Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9431Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9430Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9429Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9428Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9427Edimax EW-7438RPn webs formWlSiteSurvey stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9426Edimax EW-7438RPn formHwSet stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9425Edimax EW-7438RPn formWlanMP stack-based overflow8.7CNA v4.00.8%2026-05-25
CVE-2026-9424Edimax EW-7438RPn Content-Type formWlanMP os command injection5.3CNA v4.02.4%2026-05-25
CVE-2026-9423Edimax BR-6675nD POST request mp command injection5.1CNA v4.03.4%2026-05-25
CVE-2026-9422KLiK SocialMediaWebsite HTTP POST request parameter injection6.9CNA v4.00.5%2026-05-25
CVE-2026-9421KLiK SocialMediaWebsite file upload.inc.php uniqid unrestricted upload6.9CNA v4.00.5%2026-05-25
CVE-2026-9420KLiK SocialMediaWebsite HTTP GET request parameter injection5.3CNA v4.00.4%2026-05-25
CVE-2026-9419code-projects Employee Management System empproject.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9418code-projects Employee Management System changepassemp.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9417code-projects Employee Management System myprofileup.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9416code-projects Employee Management System myprofile.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9415code-projects Employee Management System eloginwel.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9414SourceCodester Indian Invoicing System add_order.php cross-site scripting5.1CNA v4.00.3%2026-05-25
CVE-2026-9413SourceCodester Indian Invoicing System category.php cross-site scripting5.3CNA v4.00.4%2026-05-25
CVE-2026-9412SourceCodester Indian Invoicing System Backend endpoint access control5.3CNA v4.00.3%2026-05-25
CVE-2026-9411SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php SQL injection5.3CNA v4.00.3%2026-05-25
CVE-2026-9410Sushmi-pal Invoice-System Profile Workflow profile improper authorization5.3CNA v4.00.3%2026-05-25
CVE-2026-9409Sushmi-pal Invoice-System User Management user improper authorization5.3CNA v4.00.3%2026-05-25
CVE-2026-9408Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9407Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9406Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9405Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection9.3CNA v4.03.3%2026-05-25
CVE-2026-9274Information exposure vulnerability in CP-Plus Wi-Fi Camera5.2CNA v4.00.1%2026-05-25Fix
CVE-2026-9078Mozilla Firefox iOS RTL Domain Rendering issue in Link Preview5.4CISA ADP v3.10.3%2026-05-25Fix
CVE-2026-9058Improper certificate verification in Szafir SDK9.3CNA v4.00.4%2026-05-25Fix
CVE-2026-8652NEC Platforms Aterm MR51FN OS command injection8.5CNA v4.01.4%2026-05-25
CVE-2026-8376Perl regular expression compiler buffer overflow9.8NVD v3.10.5%2026-05-25Fix
CVE-2026-7766Path traversal in Kenik cameras8.3CNA v4.00.3%2026-05-25Fix
CVE-2026-6059NEC Platforms Aterm WX1800HP cross-site scripting4.8CNA v4.00.3%2026-05-25
CVE-2026-5223Rust Project Cargo crates in third party registries can override the cached source of other crates6.5CNA v4.00.4%2026-05-25Fix
CVE-2026-5222Cargo can be coerced to share credentials between registries2.3CNA v4.00.5%2026-05-25Fix
CVE-2026-4915Mattermost server panic via outgoing webhook responses6.5CNA v3.10.4%2026-05-25Fix
CVE-2026-2651Missing authorization Validation in MLflow/MLflow9.0CNA v3.00.5%2026-05-25Fix
CVE-2026-48832SPIP cookie.php open redirect3.5CNA v3.10.3%2026-05-24Fix
CVE-2026-48831WineHQ Wine incorrect resource transfer7.3CNA v4.00.2%2026-05-24
CVE-2026-48829GNU SASL null pointer dereference7.5CNA v3.10.6%2026-05-24Fix
CVE-2026-9404Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection9.3CNA v4.03.3%2026-05-24
CVE-2026-9403Edimax BR-6675nD POST request formWlSiteSurvey buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9402Edimax BR-6675nD POST request formWlanMP command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9401Edimax BR-6675nD POST request formWanTcpipSetup buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9400Edimax BR-6675nD POST request formUSBStorage command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9399Edimax BR-6675nD POST request formsetPPPoE buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9398Besen BS20 EV Charging Station BLE/WiFi authentication replay2.3CNA v4.00.4%2026-05-24
CVE-2026-9397Besen BS20 EV Charging Station OTA update installation improper authorization9.2CNA v4.00.8%2026-05-24
CVE-2026-9396Besen BS20 EV Charging Station Firmware Version Check UI layer6.3CNA v4.00.4%2026-05-24
CVE-2026-9395Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials5.1CNA v4.00.2%2026-05-24
CVE-2026-9394Besen BS20 EV Charging Station Bluetooth Low Energy weak password2.3CNA v4.00.3%2026-05-24
CVE-2026-9393H3C Magic B0 aspForm Edit_BasicSSID_5G buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9389Tenda F456 L7Im frmL7ImForm buffer overflow8.7CNA v4.00.8%2026-05-24Emerging Threats
CVE-2026-9388Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection9.3CNA v4.03.3%2026-05-24
CVE-2026-9387Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection9.3CNA v4.03.3%2026-05-24
CVE-2026-9386Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection9.3CNA v4.03.3%2026-05-24
CVE-2026-9385Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection9.3CNA v4.03.3%2026-05-24
CVE-2026-9384Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection9.3CNA v4.03.3%2026-05-24
CVE-2026-9383itsourcecode Electronic Judging System login.php SQL injection6.9CNA v4.00.4%2026-05-24
CVE-2026-9382Edimax BR-6675nD POST request formPPTPSetup buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9381Edimax BR-6675nD POST request formPPPoESetup buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9380Edimax BR-6675nD POST request formL2TPSetup buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9379Edimax BR-6675nD POST request formWpsStart command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9378Edimax BR-6675nD POST request formHwSet command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9377SourceCodester SUP Online Shopping productedit.php cross-site scripting4.8CNA v4.00.4%2026-05-24
CVE-2026-9376JPress UCenter Article Submission endpoint doWriteSave improper authorization5.3CNA v4.00.3%2026-05-24
CVE-2026-9374yangzongzhuan RuoYi-Vue Common upload endpoint upload FileUploadUtils.upload unrestricted upload5.3CNA v4.00.3%2026-05-24
CVE-2026-9373JeecgBoot OpenAPI endpoint call improper authentication6.3CNA v4.00.5%2026-05-24
CVE-2026-9372ItzCrazyKns Vane Model Provider API route.ts server-side request forgery6.9CNA v4.00.5%2026-05-24
CVE-2026-9371ItzCrazyKns Vane API route.ts missing authentication6.3CNA v4.00.5%2026-05-24
CVE-2026-9370jasypt-spring-boot Uses a One-Way Hash without a Salt6.3CNA v4.00.3%2026-05-24
CVE-2026-9369NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparison4.8CNA v4.00.3%2026-05-24Fix
CVE-2026-9368NousResearch hermes-agent Environment variable code_execution_tool.py execute_code sandbox6.9CNA v4.00.6%2026-05-24Fix
CVE-2026-9367NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection6.9CNA v4.03.2%2026-05-24
CVE-2026-9366NousResearch hermes-agent prompt_builder.py _scan_context_content injection6.9CNA v4.00.5%2026-05-24Fix
CVE-2026-9365Ettercap GG dissector ec_gg.c FUNC_DECODER heap-based overflow6.3CNA v4.00.5%2026-05-24
CVE-2026-9364Projectworlds Online Art Gallery Shop adminHome.php SQL injection6.9CNA v4.00.4%2026-05-24
CVE-2026-9363Edimax EW-7438RPn POST request formEZCHNwlanSetu formEZCHNwlanSetup command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9362Edimax EW-7438RPn setting formConnectionSetting command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9361Edimax EW-7438RPn POST request formAccep formAccept command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9360Edimax EW-7438RPn POST request formwlencrypt24g buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9359Edimax EW-7438RPn POST request formHwSet command injection5.3CNA v4.02.4%2026-05-24
CVE-2026-9358postcss-selector-parser AST Serialization container.js toString recursion5.3CNA v4.00.6%2026-05-24Fix
CVE-2026-9357vBulletin login cross-site scripting5.1CNA v4.00.4%2026-05-24
CVE-2026-9356SourceCodester Hospitals Patient Records Management System manage_history.php SQL injection6.9CNA v4.00.4%2026-05-24
CVE-2026-9355SourceCodester Hospitals Patient Records Management System Master.php SQL injection6.9CNA v4.00.4%2026-05-24
CVE-2026-9354NousResearch hermes-agent Slack Agent/Mattermost agent escape output6.9CNA v4.00.6%2026-05-24
CVE-2026-9353NousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injection6.9CNA v4.00.5%2026-05-24Fix
CVE-2026-9352NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure6.9CNA v4.00.5%2026-05-24
CVE-2026-9351NousResearch hermes-agent read_file tool file_tools.py _is_blocked_device path traversal6.9CNA v4.00.8%2026-05-24
CVE-2026-9350NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization6.9CNA v4.00.5%2026-05-24
CVE-2026-9349Cal.com cal.diy getServerSideProps function information disclosure6.9CNA v4.00.5%2026-05-24
CVE-2026-9348Edimax EW-7438RPn webs mp stack-based overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9347Edimax EW-7438RPn webs formWizSurvey os command injection5.3CNA v4.03.1%2026-05-24
CVE-2026-9346Edimax EW-7438RPn webs formWirelessTbl buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9345Edimax EW-7438RPn webs formWizSurvey buffer overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-9344Edimax EW-7438RPn webs formWpsStart stack-based overflow8.7CNA v4.00.8%2026-05-24
CVE-2026-4372HuggingFace Transformers vulnerable to remote code execution7.8CNA v3.00.6%2026-05-24Fix
CVE-2026-3515Argument injection in PrefectHQ/prefect8.5CNA v3.00.5%2026-05-24
CVE-2026-46300Linux kernel skbuff coalescing out-of-bounds write7.8CNA v3.12.4%2026-05-23Reported exploitedExploit codeFix
CVE-2026-43503Linux kernel skbuff fragment transfer helpers improper resource control8.8CNA v3.12.0%2026-05-23Exploit codeFix
CVE-2026-9343Edimax EW-7438RPn webs formWpsStart os command injection5.3CNA v4.03.1%2026-05-23
CVE-2026-9342SourceCodester Hospitals Patient Records Management System view_history.php SQL injection5.3CNA v4.00.3%2026-05-23
CVE-2026-9306QuantumNous new-api Midjourney Image Relay endpoint relay-router.go GetByOnlyMJId authorization6.3CNA v4.00.5%2026-05-23
CVE-2026-9305QuantumNous new-api self endpoint topup.go SearchAllTopUps SQL injection5.3CNA v4.00.3%2026-05-23
CVE-2026-9304calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery2.3CNA v4.00.3%2026-05-23
CVE-2026-9303calcom cal.diy cross-site request forgery5.3CNA v4.00.2%2026-05-23
CVE-2026-9302546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection5.3CNA v4.00.4%2026-05-23
CVE-2026-9301omec-project amf NGReset message memory corruption5.3CNA v4.00.4%2026-05-23Fix
CVE-2026-9300omec-project amf NGSetupRequest memory corruption5.3CNA v4.00.4%2026-05-23Fix
CVE-2026-9299omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption5.3CNA v4.00.4%2026-05-23Fix
CVE-2026-9298omec-project amf PathSwitchRequest memory corruption5.3CNA v4.00.4%2026-05-23
CVE-2026-9297Edimax BR-6428NS POST request formWlbasic command injection5.3CNA v4.02.4%2026-05-23
CVE-2026-9296Edimax BR-6428NS POST request formWlanM system command injection5.3CNA v4.02.4%2026-05-23
CVE-2026-9295Edimax BR-6428NS POST request formWirelessTbl buffer overflow8.7CNA v4.00.8%2026-05-23
CVE-2026-9294Edimax BR-6428NS POST request formWanTcpipSetup buffer overflow8.7CNA v4.00.8%2026-05-23
CVE-2026-9284WooCommerce PayPal Payments WordPress plugin information disclosure8.2CNA v3.10.5%2026-05-23Fix
CVE-2026-6898WishList Member WordPress plugin missing authorization authenticated Generate API Secret Key8.8CNA v3.10.4%2026-05-23Fix
CVE-2026-6897Wishlist Member WordPress plugin missing authorization authenticated arbitrary plugin options update8.8CNA v3.10.4%2026-05-23Fix
CVE-2026-6895WishList Member WordPress plugin missing authorization8.8CNA v3.10.5%2026-05-23Fix
CVE-2026-6419WishList Member WordPress plugin privilege escalation8.8CNA v3.10.4%2026-05-23Fix
CVE-2026-48700LXQt PCManFM-Qt improper control of dynamic code9.3CNA v4.00.2%2026-05-22
CVE-2026-47280Microsoft Azure Resource Manager elevation of privilege10.0CNA v3.10.9%2026-05-22Fix
CVE-2026-46727ruby-lang Ruby race condition8.1CNA v3.10.5%2026-05-22Fix
CVE-2026-46598Invoking pathological inputs can lead to client panic in golang.org/x/Crypto/ssh/agent5.3CISA ADP v3.10.5%2026-05-22Fix
CVE-2026-46597Invoking byte arithmetic causes underflow and panic in golang.org/x/Crypto/ssh7.5CISA ADP v3.10.6%2026-05-22Fix
CVE-2026-46595Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/Crypto/ssh10.0CISA ADP v3.10.5%2026-05-22Fix