CVE-2026 records published in August 2026
This page lists the 12,071 CVE-2026 records published in August 2026, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 20 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.
- Critical
- 1,78414.8% of these records
- Listed in CISA KEV
- 200.2% of these records
- Reported exploited
- 670.6% of these records
- Detection signal
- 670.6% of these records
- Exploit code
- 2382.0% of these records
- Actionable vendor fix
- 9,97582.6% of these records
Figures as of 2026-10-24 13:48 UTC. Records published in August 2026 have had from about two months to about three months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2026-83596 | WebKitGTK opentypeverticaldata findfeature buffer overflow | 8.8CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-83524 | RedPort Optimizer wXa-223 System Clock datetime.php exec command injection | 9.4CNA v4.0 | 3.2% | 2026-08-31 | |
| CVE-2026-83497 | Unrestricted Java deserialization in OpenSearch SQL Plugin Cursor Pagination | 8.7CNA v4.0 | 1.0% | 2026-08-31 | Fix |
| CVE-2026-83492 | WordPress Kubio AI Website Builder denial of service | 6.9CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82971 | QVidium Opera11 CGI script net_tr.cgi command injection | 10.0CNA v4.0 | 3.3% | 2026-08-31 | |
| CVE-2026-82970 | WP Cookie Notice for GDPR, CCPA and ePrivacy Consent WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.5% | 2026-08-31 | Reported exploitedFix |
| CVE-2026-82957 | hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82954 | Dokploy settings application.ts writeTraefikConfigInPath path traversal | 9.4CNA v4.0 | 1.0% | 2026-08-31 | |
| CVE-2026-82922 | ShopEx ECShop flow.php flow_update_cart SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82921 | ShopEx ECShop pack.php check_img_type unrestricted upload | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82919 | cu silicon edit endpoint views.py create_app missing authentication | 6.9CNA v4.0 | 0.7% | 2026-08-31 | |
| CVE-2026-82914 | kishan0725 Hospital-Management-System search.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82909 | QuantumNous new-api Revoked API Token token session expiration | 5.3CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82908 | MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow | 9.3CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82906 | sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication | 6.3CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82905 | sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82882 | Devtron missing authorization via webhook API token endpoint | 8.7CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82881 | Aix-DB stored cross-site scripting via Markdown | 5.1CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82880 | YaCy Search Server XML external entity injection via Parsers | 8.7CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82879 | DataEase Access Control Bypass via Share Tickets | 5.3CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82878 | DataEase Missing Object-Level Authorization on Geographic, Linkage and Chart endpoints | 5.3CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82877 | ILIAS arbitrary file read via SOAP addFile | 7.1CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82876 | Phison PS3111-S11 Controller Firmware signature verification Bypass | 9.3CNA v4.0 | 0.1% | 2026-08-31 | |
| CVE-2026-82875 | ToolJet authorization bypass via organizationId | 5.1CNA v4.0 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-82874 | ToolJet Cross-Tenant authorization bypass via tooljet-db | 9.4CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82873 | ToolJet Cross-workspace Schema Disclosure via Export | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82872 | ToolJet Cross-Workspace authorization bypass | 7.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82871 | ToolJet Cross-Organization Data Read via Database Routes | 8.2CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82870 | ToolJet Cross-Tenant Database Manipulation | 7.0CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82869 | ToolJet Database privilege escalation via join_tables | 8.2CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82868 | @pdfme/schemas cross-site scripting via SVG | 5.3CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82867 | @pdfme/schemas cross-site scripting via Select | 5.3CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82866 | @pdfme/common SSRF via Unvalidated URL Fetch | 8.9CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82865 | pdfme schemas cross-site scripting via i18n Label | 2.1CNA v4.0 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-82864 | pdfme pdf-lib denial of service via decompression bomb | 7.1CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82863 | @hulumi/baseline CloudTrail Selector tampering Detection | 8.7CNA v4.0 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-82862 | Hulumi Helper Script Shadowing via Workspace files | 8.6CNA v4.0 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-82861 | @hulumi/policies SecureBucket Parent Spoof Bypass | 8.7CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82860 | @hulumi/policies Admin Policy Bypass | 9.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82859 | hulumi SCP Template Tag-on-Create Bypass | 9.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82858 | @hulumi/drift Unsafe Execute Plan Acceptance | 9.3CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82857 | hulumi privilege escalation via IAM Policy | 9.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82856 | @hulumi/policies OIDC Trust Policy Bypass | 9.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82855 | @hulumi/policies Evidence Validation Bypass | 9.3CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82854 | Nodemailer SMTP command injection via envelope.size | 9.3CNA v4.0 | 2.0% | 2026-08-31 | Fix |
| CVE-2026-82853 | Nodemailer SMTP command injection via CRLF | 6.9CNA v4.0 | 1.0% | 2026-08-31 | Fix |
| CVE-2026-82852 | MapSVG WordPress plugin server side request forgery (SSRF) | 5.4CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-82838 | pretix Venueless default webserver configuration with incorrect CSP | 6.4CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82835 | caoqianming django-vue-admin file access control | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82834 | Doccano bulk-delete endpoint improper access control | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82833 | Doccano project example detail endpoint improper access control | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82821 | FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference | 5.3CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82820 | FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow | 5.3CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82818 | dibo-software diboot Tenant Resource Assignment resource access control | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82817 | dibo-software diboot Tenant Administrator Management API admin access control | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82816 | dibo-software diboot AI Session endpoint ai-session authorization | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82815 | MegaEase EaseProbe Middleware server.go realIP access control | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82813 | BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity | 5.3CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82811 | Toggl OÜ Toggl Track Extension postMessage origin validation | 5.3CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82810 | extension.vn 2FA Authenticator Extension background service worker information disclosure | 4.8CNA v4.0 | 0.1% | 2026-08-31 | |
| CVE-2026-82809 | vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82808 | Inbox Foundry ActiveInbox Extension Google OAuth client secret hard-coded credentials | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82807 | ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management | 9.3CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82805 | Typora Mermaid Rendering cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82803 | armink struct2json JSON deserialization null pointer dereference | 6.9CNA v4.0 | 0.7% | 2026-08-31 | |
| CVE-2026-82802 | NASA earthdata-search granules search endpoint server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82801 | NASA earthdata-search scale endpoint handler.js scaleImage server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82797 | Samsung Open Source rlottie uncontrolled recursion | 5.5CNA v3.1 | 0.1% | 2026-08-31 | |
| CVE-2026-82727 | ash-project ash_phoenix information disclosure through error messages | 2.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82726 | ash-project AshPhoenix tenant subdomain resolution vulnerability | 6.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82725 | ash-project ash_phoenix insecure direct object reference | 2.3CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82724 | ash-project ash_phoenix broken access control in AshPhoenix SubdomainHook | 7.6CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82722 | ash-project ash_admin resource exhaustion | 8.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82703 | Edimax BR-6214K asp_setPing endpoint ping.asp system os command injection | 5.1CNA v4.0 | 2.9% | 2026-08-31 | |
| CVE-2026-82702 | Edimax BR-6214K asp_WlanMP endpoint wlanMP.asp system os command injection | 5.1CNA v4.0 | 2.9% | 2026-08-31 | |
| CVE-2026-82701 | code-projects Online Shopping System Search Functionality action.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82700 | code-projects Online Shopping System Newsletter Subscription offersmail.php cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82699 | sambitraj Student Management System Password aca.sql cleartext storage | 5.1CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82698 | sambitraj Student-Management-System aca.sql default password | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82697 | sambitraj Student-Management-System session_start cookie httponly flag | 6.3CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82696 | itsourcecode Sales and Inventory System inv_searchfrm.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82695 | Tenda AC18 Telnet telnet missing authentication | 10.0CNA v4.0 | 1.4% | 2026-08-31 | |
| CVE-2026-82694 | Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication | 10.0CNA v4.0 | 1.4% | 2026-08-31 | |
| CVE-2026-82693 | Tenda AC1206 Web UI telnet TendaTelnet missing authentication | 10.0CNA v4.0 | 1.4% | 2026-08-31 | |
| CVE-2026-82692 | D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | 9.4CNA v4.0 | 3.3% | 2026-08-31 | |
| CVE-2026-82691 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection | 9.4CNA v4.0 | 3.6% | 2026-08-31 | |
| CVE-2026-82690 | D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | 9.4CNA v4.0 | 3.6% | 2026-08-31 | Emerging Threats |
| CVE-2026-82689 | D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection | 9.4CNA v4.0 | 3.3% | 2026-08-31 | |
| CVE-2026-82688 | D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection | 9.4CNA v4.0 | 3.6% | 2026-08-31 | |
| CVE-2026-82681 | ash-project ash_admin query-parameter injection in AshAdmin row-action links | 2.0CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82680 | D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write | 8.7CNA v4.0 | 0.8% | 2026-08-31 | |
| CVE-2026-82679 | diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82678 | diem-project diem Administrative console actions.class.php executeCommand os command injection | 5.1CNA v4.0 | 2.2% | 2026-08-31 | |
| CVE-2026-82677 | valkey-io valkey Module Timer module.c moduleTimerHandler double free | 4.8CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82673 | ash-project ash_admin path traversal in AshAdmin file uploads via unsanitized client filename | 8.3CNA v4.0 | 0.8% | 2026-08-31 | Fix |
| CVE-2026-82671 | IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management | 4.6CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82670 | IObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management | 4.8CNA v4.0 | 0.1% | 2026-08-31 | |
| CVE-2026-82669 | klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service | 6.9CNA v4.0 | 0.7% | 2026-08-31 | Fix |
| CVE-2026-82668 | klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection | 6.9CNA v4.0 | 2.2% | 2026-08-31 | Fix |
| CVE-2026-82667 | yaojingang GEOFlow HTTP endpoint resolver server-side request forgery | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | 5.1CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross-site scripting | 5.3CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82662 | Nodemailer TLS certificate validation bypass | 8.3CNA v4.0 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-82661 | Nodemailer CRLF injection via List-* Header Comments | 5.3CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82660 | Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess | 5.3CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82659 | nodemailer File Read and SSRF via raw option | 7.1CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82631 | valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use-after-free | 2.1CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82630 | PowerJob transport endpoint server-side request forgery | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82629 | jeecgboot jeewx-boot doUpload endpoint unrestricted file upload | 5.1CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82628 | Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management | 9.3CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82625 | code-projects Simple Inventory System User Registration register.php cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82624 | code-projects Simple Inventory System database backup file information disclosure | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82623 | open62541 history backend use-after-free | 6.9CNA v4.0 | 0.7% | 2026-08-31 | |
| CVE-2026-82622 | code-projects Employee Leave Managing System employee profile update cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82621 | Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82620 | Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82619 | Systerel S2OPC subscription_mgr.c use-after-free | 5.3CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82618 | Systerel S2OPC string array range writing out-of-bounds read | 5.3CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82616 | TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow | 9.4CNA v4.0 | 0.9% | 2026-08-31 | |
| CVE-2026-82615 | itsourcecode Online Medicine Delivery System password recovery SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82614 | Online Medicine Delivery System product category filter SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82613 | itsourcecode Online Medicine Delivery System Product Search index.php loadResultList SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82612 | itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82611 | Online Medicine Delivery System customer login SQL injection | 6.9CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82610 | itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication SQL injection | 6.9CNA v4.0 | 0.6% | 2026-08-31 | |
| CVE-2026-82609 | itsourcecode Sales and Inventory System inv_edit.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-82608 | Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds | 5.3CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82607 | Cozmoslabs Profile Builder avatar upload handler unrestricted file upload | 6.9CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82605 | BareBones BBEdit Lasso Language Tokenizer infinite loop | 5.3CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82604 | BareBones BBEdit Java Language recursion | 5.3CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82603 | SeaCMS Comment Cache member.php del_pl path traversal | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82602 | SeaCMS ass.php authorization | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82601 | SeaCMS err.php cross-site scripting | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82600 | SeaCMS zyapi.php SQL injection | 6.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82599 | SeaCMS Avatar upload member.php unlink path traversal | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-82598 | SeaCMS template search.php parseIf code injection | 6.9CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-82597 | TOTOLINK NR1800X cstecgi.cgi setUssd command injection | 5.3CNA v4.0 | 1.8% | 2026-08-31 | |
| CVE-2026-82596 | LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption | 4.8CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-82580 | ash-project ash_ai information disclosure through error messages | 5.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82579 | ash-project ash_ai infinite loop | 6.0CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82564 | ash-project ash_ai insecure direct object reference | 7.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82398 | pypdf PDF stream parser vulnerability | 6.9CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-82397 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | 7.5CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | 5.4CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82395 | Sulu: Media move/update authorization bypass (IDOR) | 5.3CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82394 | Sulu preview link manager missing authorization | 5.3CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82393 | pnpm tarball package resolver path traversal | 7.5CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82392 | pnpm virtual store linker path traversal | 7.1CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-82346 | HP ImageDiags potential escalation of privilege | 7.0CNA v4.0 | 0.1% | 2026-08-31 | Fix |
| CVE-2026-82229 | WordPress Social Login and Register plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82228 | SiteGround Security WordPress plugin 2FA bypass vulnerability | 8.1CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82226 | Tickera WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.6% | 2026-08-31 | Exploit codeFix |
| CVE-2026-82225 | RegistrationMagic WordPress plugin broken authentication | 7.4CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-82224 | SliceWP WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-82221 | RegistrationMagic WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Exploit codeFix |
| CVE-2026-82217 | Eclipse Theia path traversal | 8.8CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-81892 | EasyCorp EasyAdminBundle EasyAdmin custom-action dispatcher bypasses access_control on other routes | 8.1CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81891 | elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) | 8.1CNA v3.1 | 0.9% | 2026-08-31 | Fix |
| CVE-2026-81890 | elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections | 5.4CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents` fallback | 8.6CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-81888 | Hono OAuth providers OAuth state check cross-site request forgery | 5.4CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-81887 | Livewire DOM-based cross-site scripting during client-side state handling | 5.1CNA v4.0 | 0.7% | 2026-08-31 | Fix |
| CVE-2026-81853 | ash-project ash_admin insecure direct object reference | 2.3CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81852 | ash-project ash_admin AshAdmin ships a hard-coded CSP nonce, allowing nonce-based CSP bypass | 2.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-81780 | Hash Form WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.5% | 2026-08-31 | Exploit codeFix |
| CVE-2026-81779 | Newspapers X WordPress theme Input vulnerability improper input validation | 10.0CNA v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-81778 | Kalles Addons WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2026-08-31 | |
| CVE-2026-81768 | Super Store Finder WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81765 | Tailored Tools WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81764 | Email Essentials WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81763 | Throws SPAM Away WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81762 | Booking and Rental Manager WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81758 | OwnerRez API WordPress plugin broken access control | 6.3CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81756 | Smart Marketing SMS and Newsletters Forms WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81624 | Red Hat Undertow WebSocket container denial of service | 7.5CNA v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-81315 | ash-project ash_ai origin validation error | 7.4CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81298 | LeadConnector WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81297 | Fluent Forms Pro Add On Pack WordPress plugin privilege escalation | 7.5CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81296 | Fluent Forms Pro Add On Pack WordPress plugin broken access control | 7.5CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81293 | WP Data Access WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81291 | Uncode WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81290 | Email Subscribers and Newsletters WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81287 | Charitable WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81280 | Print Barcode Labels for your WooCommerce products/orders WordPress plugin sensitive data exposure | 6.5CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-81278 | Post SMTP WordPress plugin beta.1 - settings Change vulnerability | 5.4CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-81267 | Mozilla Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS | 5.4CISA ADP v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-79750 | MCPHub authenticated horizontal IDOR: Any non-admin user executes tools on other users' MCP servers | 7.7CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-79749 | MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation | 7.6CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-79748 | MCPHub: Authenticated non-admin user achieves RCE | 9.9CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-79747 | MCPHub OpenAPI proxy server-side request forgery | 7.1CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-79746 | MCPHub: Server-scoped bearer key gains access to an entire group via partial server matching | 8.1CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-79745 | MCPHub: Missing authorization on Built-in Prompt and Resource CRUD | 7.1CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-79744 | MCPHub system config API missing authorization | 8.8CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-79743 | MCPHub: Path traversal via Malicious MCPB Manifest Name | 6.9CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-79483 | FastGPT chat histories API NoSQL injection | 5.3CISA ADP v3.1 | 0.4% | 2026-08-31 | Exploit code |
| CVE-2026-79408 | MetaGPT An OS command injection | 9.8CISA ADP v3.1 | 2.1% | 2026-08-31 | |
| CVE-2026-79407 | SPO extension of MetaGPT path traversal | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-78422 | zbus_polkit subject UID authorization check race condition | 7.3CNA v4.0 | 0.1% | 2026-08-31 | Fix |
| CVE-2026-78079 | Joomla extension joomshaper.com Privileged file upload Bypass via content spoofing in Helix Ultimate | 5.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-78078 | Joomla extension joomshaper.com Privileged file upload Bypass via content spoofing in Helix Ultimate | 8.9CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-78077 | JoomShaper Helix Ultimate MegaMenu layout inputs stored cross-site scripting | 8.6CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-78076 | JoomShaper Helix Ultimate MegaMenu settings missing authorization | 5.1CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-78075 | JoomShaper Helix Ultimate blog image arbitrary file deletion | 5.1CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-78074 | miniOrange Joomla extensions improper access control | 8.8CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-77975 | Ebyte NA111-M cleartext storage of sensitive information | 7.1CNA v4.0 | 0.2% | 2026-08-31 | |
| CVE-2026-77966 | Ebyte NA111-M missing authorization | 8.7CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-77956 | ash-project ash_ai EEx template evaluation of prompt content in AshAi enables remote code execution | 8.9CNA v4.0 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-77850 | ash-project ash_admin stored XSS in AshAdmin relationship typeahead | 8.4CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-77353 | Wallos: ICalendar injection via CRLF in Subscription Name/Notes Export | 4.6CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-77352 | Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) | 4.3CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-77351 | Wallos: SSRF via Unvalidated User-Level SMTP host in Email Notification settings | 3.5CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-77348 | Wallos incomplete fix for unauthenticated httpoxy SSRF still reachable | 8.2CNA v3.1 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-77013 | Icollect WordPress plugin unauthenticated user and Term creation via Unrestricted Method Dispatch | 5.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-76986 | Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue | 6.1CISA ADP v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-76985 | Apache Wicket: XSS in Palette via getAdditionalAttributes | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-76984 | Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-76983 | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-76982 | Apache Wicket: XSS in Button via its model object | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-76763 | Red Hat SmallRye GraphQL number scalar coercion denial of service | 7.5CNA v3.1 | 0.8% | 2026-08-31 | Fix |
| CVE-2026-76133 | Ebyte NA111-M use of a broken or risky cryptographic algorithm | 9.3CNA v4.0 | 0.4% | 2026-08-31 | |
| CVE-2026-75802 | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel | 5.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-75760 | ash-project ash_ai information disclosure through error messages | 7.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-75757 | ash-project ash_admin cookie reliance without validation | 8.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-75594 | getkirby Kirby media handler path traversal | 8.2CNA v4.0 | 0.8% | 2026-08-31 | Fix |
| CVE-2026-75592 | Kirby: Access to image files outside of the site root via path traversal in the media handling | 6.9CNA v4.0 | 0.7% | 2026-08-31 | Fix |
| CVE-2026-75460 | XueZhiSi Open Source Exam System teacher user list endpoint privilege escalation | 6.5CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-75458 | XueZhiSi Open Source Exam System teacher user deletion endpoint privilege escalation | 8.1CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-75133 | Keep Backup Daily WordPress plugin sensitive information exposure via kbd_cron_process | 8.7CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-75132 | WAPT server SQL injection via /API/v3/hosts endpoint | 7.1CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-74010 | bbPress WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-73819 | Ebyte NA111-M weak authentication | 9.3CNA v4.0 | 0.5% | 2026-08-31 | |
| CVE-2026-72001 | Pangolin authentication bypass via Share-Link endpoint | 8.6CNA v4.0 | 0.5% | 2026-08-31 | Exploit codeFix |
| CVE-2026-71415 | Kirby: File upload permissions are not checked during processing of chunk data | 7.1CNA v4.0 | 0.4% | 2026-08-31 | Fix |
| CVE-2026-71378 | Apache Wicket: Cross-site request forgery protection bypass in ResourceIsolationRequestCycleListener | 4.6CISA ADP v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-71257 | Apache Wicket multipart file upload handling resource exhaustion | 7.5v3.1 | 0.8% | 2026-08-31 | Fix |
| CVE-2026-70449 | Apache Wicket: Path traversal in resource style/variation/locale | 5.3CISA ADP v3.1 | 0.9% | 2026-08-31 | Fix |
| CVE-2026-68951 | GROWI incorrect authorization | 6.9CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-66047 | ProfilePress WordPress plugin unauthenticated arbitrary plugin installation RCE | 9.2CNA v4.0 | 0.9% | 2026-08-31 | Reported exploitedFix |
| CVE-2026-62993 | Smarty fetch function server-side request forgery | 6.9CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-61641 | Wallos: OIDC account takeover via email-based account linking without `email_verified` check | 8.1CNA v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configuration | 8.5CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-61639 | Wallos: Zip Slip path traversal in database restore writes files to webroot | 8.5CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-61638 | Wallos: SSRF via Test Email Notification unvalidated SMTP host/port | 8.2CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-59111 | Command injection vulnerability in eObčanka-Identifikace | 9.3CNA v3.1 | 1.3% | 2026-08-31 | Fix |
| CVE-2026-58574 | Dell PowerStore 500T missing authentication | 9.8CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-58301 | Apache Shiro: Server-side POST request may be steered to an alternate host | 5.9CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-54600 | Wallos: Unauthenticated database replacement via import endpoint on fresh install | 8.2CNA v4.0 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-54599 | Wallos: OIDC state parameter never validated login CSRF / account takeover | 7.5CNA v4.0 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-54598 | Missing authentication for critical function in Wallos | 7.5CNA v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-54179 | Laravel-Backpack CRUD base64 image uploads vulnerability | 4.4CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-53620 | GROWI insecure direct object reference | 5.3CNA v4.0 | 0.3% | 2026-08-31 | |
| CVE-2026-53553 | Goploy: Arbitrary file read via path traversal in /deploy/fileDiff allows Remote Server Compromise | 7.7CNA v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-53552 | Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers | 9.6CNA v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-53508 | oasdiff git-revision load path server-side request forgery | 6.0CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-53507 | oasdiff-action server-side request forgery | 8.3CNA v4.0 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-52730 | Xibo CMS module settings form missing authorization | 4.3CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-51740 | TOTOLINK T6 process termination function vulnerability | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51739 | TOTOLINK T6 cloud update check function vulnerability | 5.9CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-51738 | TOTOLINK T6 device configuration reset function vulnerability | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51737 | TOTOLINK T6 clearTracerouteLog function improper access control | 5.3CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-51736 | TOTOLINK T6 clearSyslog function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51735 | TOTOLINK T6 showSyslog function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51734 | TOTOLINK T6 informSlaveUpdate function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51733 | TOTOLINK T6 FirmwareUpgrade function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51732 | TOTOLINK T6 delWiFiScheduleCfg function improper access control | 5.3CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-51731 | TOTOLINK T6 delVlanCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51730 | TOTOLINK T6 delWiFiAclRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51729 | TOTOLINK T6 delDevice function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51728 | TOTOLINK T6 UploadFirmwareFile function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51727 | TOTOLINK T6 SystemSettings function improper access control | 5.3CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-51726 | TOTOLINK T6 delParentalRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51725 | TOTOLINK T6 NTPSyncWithHost function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51724 | TOTOLINK T6 delSmartQosCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51723 | TOTOLINK T6 UploadCustomModule function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51722 | TOTOLINK T6 setWiFiRepeaterCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51721 | TOTOLINK T6 setPairCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51720 | TOTOLINK T6 delIpPortFilterRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51719 | TOTOLINK T6 delUrlFilterRules function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51718 | TOTOLINK T6 delStaticDhcpRules function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51717 | TOTOLINK T6 setOpModeCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51716 | TOTOLINK T6 delPortForwardRules function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51715 | TOTOLINK T6 delMacFilterRules function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51714 | TOTOLINK T6 setRoamingCfg function improper access control | 5.9CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-51713 | TOTOLINK T6 setManualDialCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51712 | TOTOLINK T6 setApWiFiSchCfg function improper access control | 5.9CISA ADP v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-51711 | TOTOLINK T6 setWiFiWpsStart function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51710 | TOTOLINK T6 parental control rules vulnerability | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51709 | TOTOLINK T6 setWiFiBasicCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51708 | TOTOLINK T6 WPS configuration vulnerability | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51706 | TOTOLINK T6 setSmartQosCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51705 | TOTOLINK T6 setWiFiMeshName function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51704 | TOTOLINK T6 Wi-Fi mesh configuration vulnerability | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51703 | TOTOLINK T6 Wi-Fi schedule configuration vulnerability | 5.4CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51702 | TOTOLINK T6 setIpPortFilterRules function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51701 | TOTOLINK T6 setMacFilterRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51700 | TOTOLINK T6 setWiFiAdvancedCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51699 | TOTOLINK T6 setDmzCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51698 | TOTOLINK T6 setUrlFilterRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51697 | TOTOLINK T6 IPTV configuration vulnerability | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51696 | TOTOLINK T6 setPortForwardRules function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51695 | TOTOLINK T6 dynamic DNS configuration vulnerability | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51694 | TOTOLINK T6 static DHCP rules vulnerability | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51693 | TOTOLINK T6 setVpnPassCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51692 | TOTOLINK T6 setWiFiGuestCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51691 | TOTOLINK T6 upload setting vulnerability | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51690 | TOTOLINK T6 setWanCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51689 | TOTOLINK T6 firmware upgrade workflow vulnerability | 9.1CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51688 | TOTOLINK T6 Wi-Fi signal power setting vulnerability | 7.5CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51687 | TOTOLINK T6 setWiFiEasyGuestCf function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51686 | TOTOLINK T6 setWiFiEasyCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51684 | TOTOLINK T6 setStorageCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51683 | TOTOLINK T6 setLanCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51681 | TOTOLINK T6 setRemoteCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51680 | TOTOLINK T6 setLedCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51679 | TOTOLINK T6 setPasswordCfg function improper access control | 9.1CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51678 | TOTOLINK T6 setSyslogCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51677 | TOTOLINK T6 setUPnPCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51676 | TOTOLINK T6 setAccessDeviceCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51675 | TOTOLINK T6 setWanIeCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51674 | TOTOLINK T6 setScheduleCfg function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51673 | TOTOLINK T6 setNtpCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51672 | TOTOLINK T6 getRoamingCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51671 | TOTOLINK T6 getCloudDownloadStatus function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51670 | TOTOLINK T6 getSlaveUpdate function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-31 | |
| CVE-2026-51669 | TOTOLINK T6 getPairCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51668 | TOTOLINK T6 setLanguageCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | |
| CVE-2026-51667 | TOTOLINK T6 getWiFiIpMacTable function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51666 | TOTOLINK T6 setWizardCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-51153 | TaskRunHandler.post in web/handlers/task.py in QD stored cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-08-31 | |
| CVE-2026-51152 | /har/test endpoint in QD server-side request forgery | 9.1CISA ADP v3.1 | 0.7% | 2026-08-31 | |
| CVE-2026-50199 | Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh | 4.3CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-50198 | Wallos: Cross-user subscription cost inference via replacement_subscription_id | 4.3CNA v3.1 | 0.3% | 2026-08-31 | Fix |
| CVE-2026-49003 | Unauthenticated RCE vulnerability in ZTE ZXDU68 S202 Product | 9.6CNA v3.1 | 2.4% | 2026-08-31 | |
| CVE-2026-40465 | Nokia NSP redirect URL parameter open redirect | 5.3CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-40464 | A stored cross-site scripting (XSS) vulnerability in Nokia NSP | 5.4CISA ADP v3.1 | 0.2% | 2026-08-31 | |
| CVE-2026-40463 | An Insufficient Role-based access control vulnerability in WaveSuite | 7.6CISA ADP v3.1 | 0.3% | 2026-08-31 | |
| CVE-2026-38577 | Tenda HG21 admin account hard-coded credentials | 9.8CISA ADP v3.1 | 0.5% | 2026-08-31 | Exploit code |
| CVE-2026-21827 | HCL Connections is vulnerable to an information disclosure | 3.1CNA v3.1 | 0.2% | 2026-08-31 | |
| CVE-2026-19953 | URI punycode host encoding improper equivalence validation | 6.5CISA ADP v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-19873 | HTML::FormFu versions for Perl allow resource exhaustion | 7.5CISA ADP v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-19702 | OS command injection in TÜBİTAK BİLGEM's Pardus Boot Repair | 7.8CNA v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-19616 | Information disclosure in TBC Technology's KitLogistic | 7.5CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-19410 | Google Cloud Build Comment Control Bypass via Webhook Suppression | 9.4CNA v4.0 | 0.1% | 2026-08-31 | Fix |
| CVE-2026-17615 | Red Hat RESTEasy SourceProvider XML external entity injection | 7.5CNA v3.1 | 0.6% | 2026-08-31 | Fix |
| CVE-2026-14697 | Zephyr IPv6 neighbor solicitation handling memory leak | 6.5CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-14696 | zephyrproject zephyr ethernet bridge RX packet leak enables denial of service | 6.5CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-14368 | Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser | 5.4CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-14367 | zephyrproject zephyr I3C IBI work-node free-list data race between ISR and workqueue thread | 3.1CNA v3.1 | 0.1% | 2026-08-31 | Fix |
| CVE-2026-14366 | zephyrproject zephyr SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt | 6.4CNA v3.1 | 0.2% | 2026-08-31 | Fix |
| CVE-2026-13732 | Red Hat Enterprise Linux 10 gdb: Gdb: Out-of-bounds write in stabs parser read_member_functions | 7.0CNA v3.1 | 0.1% | 2026-08-31 | Fix |
| CVE-2026-12894 | quarkus-qute ReflectionValueResolver server-side template injection | 8.8CNA v3.1 | 0.5% | 2026-08-31 | Fix |
| CVE-2026-5956 | SQLi in Ankara Hosting's Site Management Panel | 8.8CNA v3.1 | 0.4% | 2026-08-31 | |
| CVE-2026-82658 | Admidio broken access control via profile_function.php | 5.3CNA v4.0 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-82657 | Admidio authentication bypass via RSS feeds | 8.7CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82656 | Admidio path traversal via Photo ZIP Download | 2.1CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-82655 | Admidio SQL injection via relation_type_list | 8.7CNA v4.0 | 0.6% | 2026-08-30 | Fix |
| CVE-2026-82654 | SiYuan stored XSS via block name | 9.3CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-82653 | SiYuan stored XSS via confirmDialog | 9.3CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-82652 | SiYuan information disclosure via Publish Access | 6.9CNA v4.0 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-82651 | SiYuan missing authorization via /history and /repo/diff | 6.9CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82650 | SiYuan path traversal via /API/template/render | 5.9CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-82649 | SiYuan local privilege escalation via uncontrolled search path | 7.0CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-82648 | WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address | 7.1CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82647 | WWBN AVideo cross-site request forgery via sendEmail.json.php | 5.3CNA v4.0 | 0.1% | 2026-08-30 | |
| CVE-2026-82646 | WWBN AVideo unauthenticated reflected XSS via url2Embed.json.php | 5.3CNA v4.0 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-82645 | AVideo Unauthenticated Stream credential disclosure via Forgeable Token | 9.2CNA v4.0 | 0.2% | 2026-08-30 | |
| CVE-2026-82644 | WWBN AVideo brute-force Rate Limiting Bypass via Missing User-Agent | 8.7CNA v4.0 | 0.4% | 2026-08-30 | |
| CVE-2026-82643 | WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php | 6.9CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82642 | Readest EPUB sanitizer cross-site scripting | 8.8CNA v3.1 | 0.7% | 2026-08-30 | Fix |
| CVE-2026-82641 | Keploy Unauthenticated TLS key exposure | 8.8CNA v4.0 | 0.6% | 2026-08-30 | Fix |
| CVE-2026-82640 | browser-use web-ui Cleartext API Key Storage | 6.8CNA v4.0 | 0.1% | 2026-08-30 | |
| CVE-2026-82639 | NextChat OpenAI API key disclosure | 8.7CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82638 | jina-ai reader server-side request forgery via disabled private-address guard | 8.7CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82637 | browser-use web-ui browser settings path validation path traversal | 6.9CNA v4.0 | 0.4% | 2026-08-30 | |
| CVE-2026-82636 | Qubes OS OS command injection | 7.9CNA v3.1 | 1.9% | 2026-08-30 | Fix |
| CVE-2026-82635 | Pake arbitrary file write via unsanitized download_file filename | 8.8CNA v3.1 | 0.6% | 2026-08-30 | Fix |
| CVE-2026-82634 | Frappe Framework Development Branch incorrect authorization via Jinja Template Preview endpoint | 7.1CNA v4.0 | 0.4% | 2026-08-30 | |
| CVE-2026-82633 | Dolibarr missing authorization on REST Users Groups endpoint | 5.3CNA v4.0 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-82595 | D-Link DIR-825M System command execution formSysCmd sub_456CF4 command injection | 5.3CNA v4.0 | 4.4% | 2026-08-30 | Fix |
| CVE-2026-82594 | LogNet grpc-spring-boot-starter Annotation Processing improper authorization | 2.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82593 | D-Link DIR-825M LTE firmware upgrade handler stack-based buffer overflow | 9.4CNA v4.0 | 0.9% | 2026-08-30 | Fix |
| CVE-2026-82592 | D-Link DIR-825M Disk Formatting handler endpoint formDiskFormat sub_46725C stack-based overflow | 9.4CNA v4.0 | 0.9% | 2026-08-30 | Exploit codeFix |
| CVE-2026-82591 | Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow | 4.8CNA v4.0 | 0.2% | 2026-08-30 | |
| CVE-2026-82590 | Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion | 5.3CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82589 | Open5GS N1-N2 message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service | 5.3CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82588 | Open5GS Transfer endpoint namf-handler.c null pointer dereference | 5.3CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82587 | Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption | 5.3CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82556 | Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery | 5.3CNA v4.0 | 0.4% | 2026-08-30 | |
| CVE-2026-82555 | TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values | 6.3CNA v4.0 | 0.7% | 2026-08-30 | |
| CVE-2026-82554 | SourceCodester Queue Management System add_customer.php cross-site scripting | 5.3CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82553 | Student Management System student dashboard improper authorization | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82552 | Linux Foundation Magma gNB Termination ngap_amf.c denial of service | 5.3CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82551 | Linux Foundation Magma NGSetup ngap_amf_handlers.c state issue | 6.9CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82550 | Linux Foundation Magma NGSetupRequest input validation | 6.9CNA v4.0 | 0.7% | 2026-08-30 | |
| CVE-2026-82549 | Linux Foundation Magma SecurityModeComplete integrity check | 6.9CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82548 | Linux Foundation Magma InitialUEMessage information disclosure | 6.9CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82547 | Linux Foundation Magma Registration Complete message amf_fsm.cpp improper authentication | 6.9CNA v4.0 | 0.8% | 2026-08-30 | |
| CVE-2026-82545 | itsourcecode Sales and Inventory System sup_searchfrm.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82544 | wger-project wger Password Reset gym.py reset_user_password cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2026-08-30 | |
| CVE-2026-82543 | vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition | 6.9CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-82542 | Tenda HG10 Boa Web Server formIPv6Routing buffer overflow | 10.0CNA v4.0 | 1.1% | 2026-08-30 | |
| CVE-2026-82541 | itsourcecode Sales and Inventory System sup_edit.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82540 | itsourcecode Sales and Inventory System cust_searchfrm.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82539 | TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption | 9.4CNA v4.0 | 0.8% | 2026-08-30 | |
| CVE-2026-82488 | Beetel 450TC3 user management cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82487 | Beetel 450TC3 password recovery | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82486 | SiteServer SSCMS Agent Installation Workflow access control | 2.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82485 | itsourcecode Sales and Inventory System pro_edit.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82484 | itsourcecode Sales and Inventory System emp_searchfrm.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-30 | |
| CVE-2026-82483 | Coppermine Photo Gallery hidden album update endpoint cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-82482 | coppermine-gallery Coppermine Photo Gallery edit_profile endpoint profile.php cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-82480 | NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow | 5.3CNA v4.0 | 0.4% | 2026-08-30 | |
| CVE-2026-82479 | NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow | 5.3CNA v4.0 | 0.4% | 2026-08-30 | |
| CVE-2026-82478 | NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow | 6.9CNA v4.0 | 0.5% | 2026-08-30 | |
| CVE-2026-82367 | ash-project ash_graphql session data exposure | 2.3CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-81766 | Really Simple Security plugin installer privilege escalation | 6.6CISA ADP v3.1 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-81660 | Groundhogg WordPress plugin unauthenticated stored XSS via web form Dropdown/Radio field | 8.8CISA ADP v3.1 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-81643 | ash-project ash_graphql incorrect authorization | 2.3CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-81636 | ash-project ash_graphql resource exhaustion | 8.7CNA v4.0 | 0.6% | 2026-08-30 | Fix |
| CVE-2026-81633 | ash-project ash_graphql unhandled KeyError in AshGraphql relay node resolution crashes queries | 6.9CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-81322 | ash-project ash_cloak cloaked plaintext leaks through a non-sensitive action argument in AshCloak | 2.1CNA v4.0 | 0.1% | 2026-08-30 | Fix |
| CVE-2026-81319 | ash-project ash_cloak unsafe deserialization of decrypted terms enables node DoS in AshCloak | 5.9CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-81318 | ash-project ash_sql incorrect authorization | 2.1CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-81316 | ash-project ash_sql same-named aggregates with differing filters are conflated in AshSql | 2.1CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-80227 | ash-project ash_sql SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql | 2.1CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-80223 | ash-project ash_graphql incorrect authorization | 7.1CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-78699 | ash-project ash_postgres unchecked return value | 7.2CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-78693 | ash-project ash_graphql information disclosure through error messages | 6.9CNA v4.0 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-78691 | ash-project ash_sql unescaped backslash allows LIKE wildcard injection in AshSql string search | 2.1CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-78364 | MW WP Form WordPress plugin Editor+ stored XSS via Inquiry data List | 3.5CISA ADP v3.1 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-78228 | ash-project ash_oban unbounded handle_error recursion enables denial of service in AshOban triggers | 5.9CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-78038 | ash-project ash_oban job argument injection via :args overrides primary_key and tenant in AshOban | 5.9CNA v4.0 | 0.4% | 2026-08-30 | Fix |
| CVE-2026-77970 | ash-project ash_paper_trail cleartext storage of sensitive information | 5.9CNA v4.0 | 0.1% | 2026-08-30 | Fix |
| CVE-2026-77846 | ash-project ash_sqlite JSON path injection via unescaped get_path segments in AshSqlite | 2.1CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-77831 | ash-project ash_paper_trail algorithmic complexity | 2.1CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-77454 | ash-project ash_sql incorrect authorization | 5.9CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-76585 | Customer Reviews for WooCommerce WordPress plugin unauthenticated stored XSS via comment parameter | 8.8CISA ADP v3.1 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-75847 | ash-project ash_paper_trail cleartext storage of sensitive information | 5.9CNA v4.0 | 0.1% | 2026-08-30 | Fix |
| CVE-2026-75759 | Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc | 7.6CNA v4.0 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-56718 | AJCloud AJY IPC Firmware path traversal via jdbhttpd | 8.7CNA v4.0 | 0.9% | 2026-08-30 | Exploit codeFix |
| CVE-2026-19722 | WPvivid Backup and Migration WordPress plugin arbitrary file write | 6.6CISA ADP v3.1 | 0.3% | 2026-08-30 | Fix |
| CVE-2026-15980 | MyHome Core WordPress plugin authentication bypass to account takeover via activation Token | 9.8CNA v3.1 | 0.5% | 2026-08-30 | Fix |
| CVE-2026-14835 | SOGO Add Script to Individual Pages Header Footer WordPress plugin stored XSS | 6.8CISA ADP v3.1 | 0.2% | 2026-08-30 | |
| CVE-2026-14307 | Geotargeting WP AJAX response handler reflected cross-site scripting | 7.1CISA ADP v3.1 | 0.2% | 2026-08-30 | Fix |
| CVE-2026-82562 | qs array-limit bypass via bracket-key comma parsing | 6.3CNA v4.0 | 0.5% | 2026-08-29 | Fix |
| CVE-2026-82481 | mirage cohttp path traversal | 8.7CNA v4.0 | 0.7% | 2026-08-29 | Fix |
| CVE-2026-82477 | Heimdall server-side request forgery | 5.8CNA v3.1 | 0.5% | 2026-08-29 | Fix |
| CVE-2026-82476 | Memos SSRF via Omitted CGNAT Address Range | 6.9CNA v4.0 | 0.4% | 2026-08-29 | |
| CVE-2026-82475 | iFlytek astron-agent Workflow Hijacking via Missing Ownership Check | 8.6CNA v4.0 | 0.4% | 2026-08-29 | |
| CVE-2026-82474 | Sudo Intercept Policy Bypass via execveat | 8.5CNA v4.0 | 0.1% | 2026-08-29 | Fix |
| CVE-2026-82473 | KubeEdge CloudCore missing authentication on Node Task endpoints | 8.8CNA v4.0 | 0.6% | 2026-08-29 | |
| CVE-2026-82472 | Documenso Unauthenticated file upload via /API/files/upload-pdf | 8.7CNA v4.0 | 0.8% | 2026-08-29 | Fix |
| CVE-2026-82470 | Rodauth TOTP Code Reuse via Drift window | 5.1CNA v4.0 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-82469 | Rodauth authentication bypass via jwt_refresh | 5.1CNA v4.0 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-82468 | Rodauth CSRF Protection Bypass via Content-Type | 4.9CNA v4.0 | 0.2% | 2026-08-29 | Fix |
| CVE-2026-82467 | Rodauth open redirect via Return-to Path | 4.9CNA v4.0 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-82466 | Rodauth authentication bypass via webauthn_login | 9.4CNA v4.0 | 0.6% | 2026-08-29 | Fix |
| CVE-2026-82465 | pac4j pac4j-saml Session Destruction via Unsigned LogoutRequest | 6.9CNA v4.0 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-82464 | pac4j pac4j-core open redirect via Backslash Logout | 5.3CNA v4.0 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-82463 | pac4j pac4j-core authorization bypass via Reversed Profile Type Check | 8.6CNA v4.0 | 0.6% | 2026-08-29 | Fix |
| CVE-2026-82462 | pac4j pac4j-oidc authentication bypass via Access Token Substitution | 6.9CNA v4.0 | 0.2% | 2026-08-29 | Fix |
| CVE-2026-82461 | pac4j pac4j-oidc privilege escalation via Unverified Keycloak Access Token | 8.6CNA v4.0 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-82460 | coderaiser cloudcmd Cloud Commander directory traversal via REST and Markdown | 9.3CNA v4.0 | 0.9% | 2026-08-29 | Fix |
| CVE-2026-82457 | su-exec privilege escalation via Numeric User ID | 8.5CNA v4.0 | 0.2% | 2026-08-29 | |
| CVE-2026-82456 | argocd-mcp authentication bypass via Unauthenticated HTTP | 10.0CNA v4.0 | 1.7% | 2026-08-29 | NucleiFix |
| CVE-2026-82454 | Omnivore before android- authentication bypass via Apple Sign-in | 9.3CNA v4.0 | 0.4% | 2026-08-29 | |
| CVE-2026-82453 | rust-iot-platform Cleartext Password Storage via User Model | 8.7CNA v4.0 | 0.5% | 2026-08-29 | |
| CVE-2026-82452 | rust-iot-platform authentication bypass via Missing Request Guards | 9.3CNA v4.0 | 0.8% | 2026-08-29 | |
| CVE-2026-82451 | Formwork stored XSS via Referer header | 5.3CNA v4.0 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-82450 | BookStack remote code execution via Book Cover | 8.7CNA v4.0 | 1.0% | 2026-08-29 | Fix |
| CVE-2026-82449 | Cockpit CMS Account Enumeration via Auth Timing | 6.9CNA v4.0 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-82448 | Shinobi before commit 5a76c74f arbitrary Database Query Execution via Hard-coded Child Node Key | 9.3CNA v4.0 | 0.7% | 2026-08-29 | |
| CVE-2026-82447 | Skyvern sandbox escape via TextPromptBlock | 8.7CNA v4.0 | 0.8% | 2026-08-29 | Fix |
| CVE-2026-82424 | PHPGurukul Student Information System student_edit1.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-29 | |
| CVE-2026-82423 | macrozheng mall Payment Status endpoint paySuccess behavioral workflow | 5.3CNA v4.0 | 0.4% | 2026-08-29 | |
| CVE-2026-82422 | itsourcecode Sales and Inventory System emp_del.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-29 | |
| CVE-2026-82421 | itsourcecode Sales and Inventory System emp_edit.php SQL injection | 5.3CNA v4.0 | 0.3% | 2026-08-29 | |
| CVE-2026-82417 | ljharb qs qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property | 6.3CNA v4.0 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-82364 | macrozheng mall Order Submission submit race condition | 2.3CNA v4.0 | 0.3% | 2026-08-29 | |
| CVE-2026-81346 | Frontend Admin by DynamiApps WordPress plugin Subscriber+ arbitrary Membership Plan deletion | 4.3CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-81342 | MasterStudy LMS WordPress plugin unauthenticated open redirect | 4.7CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-81200 | MasterStudy LMS WordPress plugin Instructor+ Cross-Tenant order Billing PII disclosure via IDOR | 2.7CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-81026 | MasterStudy LMS WordPress plugin unauthenticated Payment bypass via PayPal IPN | 4.8CISA ADP v3.1 | 0.2% | 2026-08-29 | Fix |
| CVE-2026-80725 | Linux kernel GRO BIG TCP aggregation vulnerability | 9.8CNA v3.1 | 0.5% | 2026-08-29 | Fix |
| CVE-2026-80488 | WP Ultimate CSV Importer WordPress plugin Admin+ SQLi via AIOSEO import fields | 4.1CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-80311 | WP Full Pay Stripe Payment Forms insecure direct object reference | 4.3CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-77786 | Rank Math SEO WordPress plugin Editor+ Core settings modification via fix-site-seo Ability | 4.9CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-77704 | Booking for Appointments and Events Calendar appointment status update incorrect authorization | 2.7CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-77012 | Icollect WordPress plugin unauthenticated arbitrary file read, SSRF and path traversal file write | 9.3CISA ADP v3.1 | 0.3% | 2026-08-29 | |
| CVE-2026-77010 | HEL Online Classroom plugin meeting join REST API improper access control | 6.5CISA ADP v3.1 | 0.3% | 2026-08-29 | |
| CVE-2026-77008 | HEL Online Classroom: AI-powered Online Classrooms plugin settings improper access control | 6.5CISA ADP v3.1 | 0.4% | 2026-08-29 | |
| CVE-2026-77007 | HEL Online Classroom plugin REST API settings route information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2026-08-29 | |
| CVE-2026-76586 | BookingPress - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation | 7.5CISA ADP v3.1 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-76548 | User Profile Builder front-end file upload feature authentication bypass | 8.2CISA ADP v3.1 | 0.3% | 2026-08-29 | Fix |
| CVE-2026-76547 | Profile Builder WordPress plugin Admin+ PHP object injection via Import/Export | 6.6CISA ADP v3.1 | 0.4% | 2026-08-29 | Exploit codeFix |
| CVE-2026-76546 | Profile Builder WordPress plugin Contributor+ stored XSS via Format Date shortcode | 6.8CISA ADP v3.1 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-75807 | SAML Single Sign On WordPress plugin unauthenticated authentication bypass | 7.5CNA v3.1 | 0.4% | 2026-08-29 | Fix |
| CVE-2026-41012 | Cloud Foundry bosh-vsphere-cpi-release BOSH vSphere CPI Improper Cert Validation | 7.7CNA v3.1 | 0.1% | 2026-08-29 | |
| CVE-2026-19430 | CatFolders Document Gallery Pro WordPress plugin unauthenticated missing authorization | 5.3CISA ADP v3.1 | 0.2% | 2026-08-29 | Fix |
| CVE-2026-18234 | MStore API WordPress plugin Subscriber+ arbitrary order Payment bypass via Wallet | 6.5CISA ADP v3.1 | 0.2% | 2026-08-29 | Fix |
| CVE-2026-18233 | MStore API WordPress plugin Subscriber+ arbitrary order Completion | 6.5CISA ADP v3.1 | 0.2% | 2026-08-29 | Fix |
| CVE-2026-17522 | Newsletters WordPress plugin arbitrary plugin option update via CSRF | 5.4CISA ADP v3.1 | 0.1% | 2026-08-29 | Fix |
| CVE-2026-17520 | Newsletters WordPress plugin unauthenticated API access via Predictable API Key | 4.8CISA ADP v3.1 | 0.1% | 2026-08-29 | Fix |
| CVE-2026-16947 | Total Processing Card Payments for WooCommerce server-side request forgery | 9.1CISA ADP v3.1 | 0.2% | 2026-08-29 | Reported exploited |
| CVE-2026-16600 | SmartAIPress WordPress plugin server-side request forgery | 7.7CISA ADP v3.1 | 0.2% | 2026-08-29 | |
| CVE-2026-16259 | Uix UserCenter WordPress plugin unauthenticated privilege escalation | 9.8CISA ADP v3.1 | 0.3% | 2026-08-29 | |
| CVE-2026-16061 | Rest Routes custom tables REST route SQL injection | 8.6CISA ADP v3.1 | 0.3% | 2026-08-29 | |
| CVE-2026-15369 | Custom User Registration Fields for WooCommerce WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.4% | 2026-08-29 | Reported exploitedFix |
| CVE-2026-14494 | Sigma Forms Pro WordPress plugin remote code execution | 9.8CNA v3.1 | 0.7% | 2026-08-29 | Fix |
| CVE-2026-10522 | MemberHero frontend registration privilege escalation | 9.8CISA ADP v3.1 | 0.3% | 2026-08-29 | |
| CVE-2026-82343 | GNOME GIMP PSD file loader out-of-bounds read | 6.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82333 | multer vulnerable to denial of service via oversized array index in field names | 7.5CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82330 | Gimp: Heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check | 6.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82329 | JFrog Artifactory improper authentication | 9.8CNA v3.1 | 14.4% | 2026-08-28 | KEVNucleiEmerging ThreatsExploit codeKCVFix |
| CVE-2026-82328 | Gimp: Heap out-of-bounds read in ico loader via unvalidated used_clrs palette count | 6.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82327 | Red Hat Enterprise Linux 10 libsolv: Libsolv: Out-of-bounds write in repo_write | 5.5CNA v3.1 | 0.2% | 2026-08-28 | |
| CVE-2026-82324 | Gimp: Heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0 | 6.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82306 | StarRocks Query Detail Endpoint Returns Every User's Query History | 6.5CNA v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-82291 | HeyForm Reflects any Origin in CORS Responses While allowing Credentials | 8.1CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-82290 | Chainlit Feedback Endpoints Missing Ownership Validation | 6.0CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82289 | Gitingest Prefix-Based Git Host Check enables Request Forgery and token disclosure | 8.3CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82288 | AUTOMATIC1111 stable-diffusion-webui stable Diffusion WebUI credential disclosure | 8.7CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82287 | Rybbit Reflects any Origin in CORS Responses While allowing Credentials | 8.6CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82286 | gpt-crawler arbitrary file write via outputFileName parameter | 8.8CNA v4.0 | 0.5% | 2026-08-28 | Exploit code |
| CVE-2026-82285 | BISHENG unauthenticated server-side request forgery via Workflow Report Callback | 8.8CNA v4.0 | 0.5% | 2026-08-28 | |
| CVE-2026-82284 | Quivr Chat Endpoints Missing Ownership Validation | 8.6CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82283 | VoltAgent Memory API Handlers Missing Ownership Checks | 8.6CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82282 | Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers | 8.8CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82281 | Kotaemon Missing Ownership Check in Conversation functions | 9.1CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82280 | Quivr Prompt Endpoints Missing Ownership Validation | 7.1CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82279 | HyperDX Team Management Operations Missing Role-Based Access Control | 7.2CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82278 | BISHENG Authenticated arbitrary Python code execution via Workflow run_once | 8.7CNA v4.0 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-82277 | argoproj argo-rollouts Argo Rollouts Dashboard Unauthenticated Mutating Operations | 9.3CNA v4.0 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-82276 | StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate | 5.3CNA v3.1 | 0.4% | 2026-08-28 | |
| CVE-2026-82275 | Qwen-Agent arbitrary file read via Caller-Supplied Document Path | 8.7CNA v4.0 | 0.5% | 2026-08-28 | |
| CVE-2026-82274 | Twenty open redirect via OAuth Propagator Callback | 5.3CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82273 | Mastra Memory API Thread Ownership Check is a No-op when mapUserToResourceId is Unset | 7.1CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82272 | Immich Locked Assets Remain Readable through Albums and Shared Links | 7.1CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82271 | R2R Missing Ownership Check allows Modifying other Users' Conversations | 7.1CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82270 | Portkey AI Gateway server-side request forgery via /v1/proxy/* | 8.7CNA v4.0 | 0.5% | 2026-08-28 | |
| CVE-2026-82269 | Gophish Account Lockout and Forced Password Change Bypassable via API Key | 8.6CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82268 | Qwen-Agent server-side request forgery via Caller-Supplied Document URL | 8.7CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82267 | Komodo Resource Identifier Disclosure and Audit Log Pollution before Permission Check | 5.3CNA v4.0 | 0.3% | 2026-08-28 | |
| CVE-2026-82266 | Redpanda Admin API Unauthenticated Superuser Access via Default Configuration | 9.3CNA v4.0 | 0.6% | 2026-08-28 | |
| CVE-2026-82265 | Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure | 6.9CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82264 | Duplicacy path traversal during Restore via Unsanitized Snapshot Paths | 6.1CNA v4.0 | 0.7% | 2026-08-28 | |
| CVE-2026-82263 | Logto server-side request forgery via OIDC SSO Connector Issuer URL | 8.2CNA v4.0 | 0.5% | 2026-08-28 | |
| CVE-2026-82262 | Logto server-side request forgery via webhook test endpoint | 8.2CNA v4.0 | 0.5% | 2026-08-28 | |
| CVE-2026-82261 | SvelteKit CPU exhaustion via remote form deserialization | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82260 | SvelteKit memory exhaustion via remote form deserialization | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82259 | SvelteKit denial of service via form | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82258 | SvelteKit Cross-user data disclosure via query.batch | 4.8NVD v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-82257 | SvelteKit prototype pollution via File Input | 5.3CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82256 | SvelteKit denial of service via Remote form | 6.9CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82255 | gitoxide HTTP credential leak via Redirect | 7.6CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82254 | gitoxide denial of service via gix-pack | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82253 | gitoxide path traversal via Submodule Name Validation Bypass | 8.7CNA v4.0 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-82252 | gitoxide Repository Boundary Violation via symlinked .gitmodules | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82251 | gitoxide path traversal via Submodule Name | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82250 | gitoxide gix-packetline denial of service | 7.1CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82249 | gitoxide Credential Helper protocol field injection | 2.3CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82248 | gitoxide path traversal via symlink following | 6.0CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82247 | gitoxide HTTP Basic credential leak via URL parsing | 8.7CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82246 | Budibase Server SSRF via Query Import | 7.1CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-82245 | Budibase missing authorization License Management | 7.2CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82244 | Budibase remote code execution via plugin eval | 9.4CNA v4.0 | 0.9% | 2026-08-28 | Fix |
| CVE-2026-82243 | Budibase Server SSRF with credential leakage | 8.3CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82242 | Budibase Cross-Application resource injection via missing authorization | 8.3CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82241 | Budibase backend-core SSRF via incomplete default blacklist | 7.1CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82240 | Budibase privilege escalation via User Update API | 8.6CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82239 | Budibase authorization bypass via datasources/query | 8.6CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82238 | filebrowser race condition via TUS concurrent PATCH uploads | 2.3CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-82237 | filebrowser Stale Share Link via File Rename | 2.3CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-82236 | filebrowser File Browser Share Link Exposure via file deletion | 2.3CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82235 | filebrowser denial of service via named pipes | 8.2CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82234 | SiYuan SSRF via DNS-Rebinding TOCTOU | 8.4CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82233 | SiYuan path traversal via asset.upload | 6.9CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82227 | WPBulky WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82222 | GiveWP WordPress plugin remote code execution (RCE) | 10.0CNA v3.1 | 2.3% | 2026-08-28 | Reported exploitedNucleiExploit codeFix |
| CVE-2026-82220 | Forminator WordPress plugin Other vulnerability type vulnerability | 5.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82181 | Le-yan|Medical Practice Management System Sensitive Data in URL | 6.8CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-82123 | WordPress Loops and Logic reflected XSS | 6.5CNA v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-82112 | houtini-ai houtini-lm code_task_files index.ts path traversal | 5.1CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82111 | iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal | 5.3CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-82090 | getpocket Pocket cross-site scripting | 9.2CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-82089 | wallabag android-app cross-site scripting | 8.8CNA v4.0 | 0.5% | 2026-08-28 | |
| CVE-2026-82082 | Green-Computing|NUMail OS command injection | 9.3CNA v4.0 | 2.0% | 2026-08-28 | Fix |
| CVE-2026-82081 | wallabag server-side request forgery | 6.4CNA v3.1 | 0.2% | 2026-08-28 | |
| CVE-2026-82078 | PaperCut NG/MF unsafe reflection | 9.4CNA v4.0 | 63.5% | 2026-08-28 | KEVMetasploitExploit codeKCVFix |
| CVE-2026-82021 | NousResearch hermes-agent Hermes Agent MCP Catalog Supply Chain RCE via Mutable Branch Reference | 9.0CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82020 | NousResearch hermes-agent Hermes Agent Credential Store Overwrite via File-Write tool | 7.6CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-82018 | IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf file | 6.8CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-82017 | IGEL OS 12 / 11 Boot Registry parameter injection via Unsigned Configuration Area | 8.6CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-81849 | Path traversal in the aws:downloadContent plugin in amazon-ssm-agent | 8.7CNA v4.0 | 0.9% | 2026-08-28 | Fix |
| CVE-2026-81777 | Essential Addons for Elementor WordPress plugin bypass vulnerability vulnerability | 5.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-81767 | Simple Payment WordPress plugin broken access control | 7.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81761 | WpEvently WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81760 | JetEngine WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81759 | WpEvently WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81757 | Rank Math SEO WordPress plugin remote code execution (RCE) | 7.2CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-81733 | WWBN AVideo CSRF via myLiveControls.save.json.php | 5.1CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-81732 | WWBN AVideo information disclosure via report4.json.php | 6.9CNA v4.0 | 0.6% | 2026-08-28 | |
| CVE-2026-81578 | PaperCut NG/MF missing authentication for critical function | 8.8CNA v4.0 | 85.6% | 2026-08-28 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2026-81533 | MongoDB BI Connector ODBC Driver Memory-Safety issue when Parsing Oversized LIMIT Values | 6.0CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-81532 | BI Connector ODBC Driver Improper Bounds Checking on Cursor Name leading to memory corruption | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-81520 | MongoDB Connector for BI Unbounded Authentication Negotiation leading to Connection Exhaustion | 8.7CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-81518 | BI Connector Optional Client Certificate Verification allows Unauthenticated Connections | 8.7CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81517 | MongoDB Connector for BI improper error handling of Log Write Failures may cause Loss of SQL service | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-81490 | MongoDB BI Connector schema sampling improper error handling | 8.3CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-81341 | wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records | 6.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81299 | WP Job Portal WordPress plugin insecure direct object references (IDOR) | 4.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81285 | Smush Image Compression and Optimization WordPress plugin denial of service Attack | 7.5CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-81284 | ACF Extended WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-81020 | wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record | 7.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-81019 | wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record | 7.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80724 | Linux kernel vmclock PTP driver vulnerability | 8.8CNA v3.1 | 0.2% | 2026-08-28 | Exploit codeFix |
| CVE-2026-80723 | Linux kernel reserved-memory device tree parsing vulnerability | 8.4CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80722 | Linux kernel mac80211 TWT setup vulnerability | 8.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80721 | Linux kernel Bluetooth ISO socket vulnerability | 8.8CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80720 | Linux kernel iomap I/O end splitting deadlock | 7.5CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80719 | Linux kernel multi-gen LRU memcg reparenting vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80718 | In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80717 | Linux kernel SCTP INIT parameter parsing vulnerability | 7.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-80716 | Linux kernel ALSA PCM drain vulnerability | 7.8CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80715 | Linux kernel igc Ethernet driver NAPI vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80714 | Linux kernel IPVS connection synchronization vulnerability | 9.8CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-80713 | Linux kernel io_uring task restrictions vulnerability | 8.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80712 | Linux kernel spi-qpic-snand driver vulnerability | 8.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80711 | Linux kernel max17040 fuel gauge driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80710 | Linux kernel DASD format-check buffer vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80709 | Linux kernel zcrypt EP11 CPRB processing vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80708 | Linux kernel zcrypt CCA clear key import information disclosure | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80707 | Linux kernel J1939 transport receive buffer vulnerability | 7.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-80706 | Linux kernel Softing CAN firmware loader vulnerability | 7.8CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80705 | Linux kernel amdgpu display phantom plane allocation vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80704 | Linux kernel AMD display driver null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80703 | Linux kernel amdkfd debug trap interface incorrect authorization | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80702 | Linux kernel vmwgfx resource management vulnerability | 7.8CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80701 | Linux kernel vmwgfx cursor plane vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80700 | Linux kernel vmwgfx buffer object copy vulnerability | 7.8CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80699 | Linux kernel KVM arm64 vgic vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80698 | Linux kernel IDXD workqueue, engine and group teardown double free | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80697 | Linux kernel EROFS page cache sharing null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80696 | Linux kernel LTC4282 hwmon driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80695 | Linux kernel SHT3X hwmon driver denial of service | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80694 | Linux kernel mtk_eth_soc ethernet driver denial of service | 9.8CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-80693 | Linux kernel idpf interrupt vector allocation vulnerability | 9.3CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80692 | Linux kernel Bluetooth HCI sync connection callbacks use-after-free | 8.8CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80691 | Linux kernel SCSI target iblock persistent reservation vulnerability | 7.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80690 | Linux kernel UFS RPMB list initialization null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80689 | Linux kernel mmiotrace logging functions null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80688 | Linux kernel RISC-V unaligned access speed probe vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80687 | Linux kernel IOMMUFD vDEVICE allocation deadlock | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80686 | Linux kernel migrate_device crash | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80685 | Linux kernel page snapshot for order-1 folios vulnerability | 7.1CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80684 | Linux kernel KVM s390 PCI AIBV allocation null pointer dereference | 9.3CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80683 | Linux kernel Bluetooth SCO connection reference counting vulnerability | 8.8CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80682 | Linux kernel RISC-V vmemmap alignment vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80681 | Linux kernel vxlan driver use-after-free | 9.8CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-80680 | Linux kernel amd-mp2 I2C driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80679 | Linux kernel s390 DASD space release null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80678 | Linux kernel i.MX I2C slave registration null pointer dereference | 8.4CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80677 | Linux kernel driver core sync-state check vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80676 | Linux kernel VMBUS driver override handling use-after-free | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80675 | Linux kernel libbpf signed loader vulnerability | 7.1CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80674 | Linux kernel NTFS attribute list validation vulnerability | 9.8CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80673 | Linux kernel NTFS attribute list parsing vulnerability | 9.8CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80672 | Linux kernel NTFS logfile restart area parsing vulnerability | 8.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80671 | Linux kernel perf sched register_pid buffer overflow | 9.3CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80670 | Linux kernel perf tools CPU topology resolution vulnerability | 9.1CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80669 | Linux kernel BPF LSM xfrm_decode_session hook denial of service | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80668 | Linux kernel netfilter conntrack expectation handling vulnerability | 9.8CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80667 | Linux kernel mlx5 LAG MPESW driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80666 | Linux kernel Bluetooth SCO socket deadlock | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80665 | Linux kernel KVM arm64 nested virtualization denial of service | 7.1CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80664 | Linux kernel netfilter xt_nat target null pointer dereference | 7.3CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80663 | Linux kernel intel-speed-select tool vulnerability | 7.1CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80662 | Linux kernel CXL RAS capability handling vulnerability | 7.1CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80661 | Linux kernel UFS driver tracing vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80660 | Linux kernel occ hwmon driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80659 | Linux kernel vub300 MMC driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80658 | Linux kernel rockchip dw_dp driver null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80657 | Linux kernel amdxdna accelerator driver null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80656 | Linux kernel HFS+ B-tree node parsing vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80655 | Linux kernel ZynqMP power management driver race condition | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80654 | Linux kernel Xilinx SoC mailbox driver use-after-free | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80653 | Linux kernel hisi_sas v3 hardware driver vulnerability | 8.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80652 | Linux kernel ccp PDH export handling denial of service | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80651 | Linux kernel ccp sev-dev-tsm driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80650 | Linux kernel atomisp gc2235 camera sensor driver use-after-free | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80649 | Linux kernel ARM SCMI power domain driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80648 | Linux kernel SpacemiT pin control driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80647 | Linux kernel HNS RoCE completion queue vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80646 | Linux kernel IPv6 device statistics vulnerability | 7.5CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80645 | Linux kernel RapidIO tsi721 doorbell handling vulnerability | 8.1CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80644 | Linux kernel OCFS2 journal denial of service | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80643 | Linux kernel igen6 EDAC driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80642 | Linux kernel Live Update FLB subsystem use-after-free | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80641 | Linux kernel wlcore Wi-Fi driver cipher configuration vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80640 | Linux kernel CXL fwctl driver buffer overflow | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80639 | Linux kernel CXL test emulation driver buffer overflow | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80638 | Linux kernel OCFS2 refcount tree out-of-bounds write | 8.8CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-80637 | Linux kernel netfilter SYNPROXY timestamp handling vulnerability | 7.5CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80636 | Linux kernel netfilter connection tracking extensions vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80635 | Linux kernel wcn36xx Wi-Fi driver out-of-bounds read | 8.8CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80634 | Linux kernel netfilter flowtable bridge VLAN handling vulnerability | 9.8CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80633 | Linux kernel IOMMUFD DMA-BUF handling vulnerability | 8.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80632 | Linux kernel mt7996 Wi-Fi driver null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80631 | Linux kernel Btrfs LZO decompression vulnerability | 7.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80630 | Linux kernel fq_codel queueing discipline vulnerability | 9.8CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-80629 | Linux kernel OcteonTX2 NPC driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80628 | Linux kernel ALSA sequencer OSS emulation race condition | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80627 | Linux kernel MIPS memory attribute region walker out-of-bounds write | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80626 | Linux kernel powerpc perf subsystem vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80625 | Linux kernel HNS RoCE driver bonding resources memory leak | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80624 | Linux kernel cs42l43 firmware loading vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80623 | Linux kernel CoreSight ETE power management vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80622 | Linux kernel tlclk driver use-after-free | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80621 | Linux kernel dwc PCI driver null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80620 | Linux kernel PCI MSI-X region unmapping vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80619 | Linux kernel AppArmor profile replacement use-after-free | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80618 | Linux kernel amdkfd doorbell and MMIO buffer objects vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80617 | Linux kernel airoha heap-based buffer overflow | 9.8CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80616 | Linux kernel ieee802154 driver vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80615 | Linux kernel tunnel destination metadata buffer overflow | 8.2CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-80614 | Linux kernel emac driver null pointer dereference | 7.5CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80613 | Linux kernel veth XDP driver vulnerability | 7.8CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-80612 | Linux kernel lightweight tunnel encapsulation vulnerability | 9.8CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80611 | Linux kernel ACPI low power idle vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80610 | Linux kernel ENETC driver divide-by-zero | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80609 | Linux kernel qede driver vulnerability | 9.8CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80608 | Linux kernel amdxdna accelerator driver use-after-free | 8.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80607 | Linux kernel BTF kprobe argument parsing denial of service | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80606 | Linux kernel Xe GPU userptr driver vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80605 | Linux kernel picoLCD HID driver null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80604 | Linux kernel HID core report handling out-of-bounds read | 8.8CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80603 | Linux kernel netfilter IRC conntrack helper out-of-bounds read | 9.1CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-80602 | Linux kernel AMD LBR performance monitoring vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80601 | Linux kernel batman-adv driver use-after-free | 8.8CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80600 | Linux kernel BATMAN-adv ARP table handling use-after-free | 9.8CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-80599 | Linux kernel batman-adv driver out-of-bounds access | 8.1CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-80598 | Linux kernel ntfs3 LZNT decompression out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80597 | Linux kernel vmu-flash MTD driver initialization null pointer dereference | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80596 | Linux kernel ims-pcu sysfs attribute exposure denial of service | 8.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80595 | Linux kernel ims-pcu device response handling out-of-bounds read | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80594 | Linux kernel ims-pcu CDC union descriptor parsing denial of service | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80593 | Linux kernel asus_atk0110 hwmon ACPI package parsing out-of-bounds read | 8.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80592 | Linux kernel DAMON mtier sample module vulnerability | – | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80591 | Linux kernel f2fs listxattr vulnerability | 7.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-80590 | Linux kernel IP fragment reassembly vulnerability | 8.6CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-79996 | User Registration and Membership WordPress plugin privilege escalation | 7.2CISA ADP v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-79995 | User Registration and Membership WordPress plugin Pending email Change Cancellation via IDOR | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-79706 | Breeze Cache WordPress plugin unauthenticated file creation via Cache path traversal | 5.3CISA ADP v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-79615 | Quiz And Survey Master WordPress plugin Cross-Quiz Question Bank and Answer key disclosure | 2.7CISA ADP v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-78238 | Tsuyoshi Saito SOY Gallery cross-site scripting | 4.8CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-78073 | Joomla extension j2commerce.com reflected XSS attribute in All Video Share | 5.3CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-78072 | Joomla Extension Jefferson49 Unauthenticated blind SQLi in Sexy Polling Reloaded | 8.7CNA v4.0 | 0.4% | 2026-08-28 | |
| CVE-2026-78071 | Joomla extension digital-peak.com Authenticated, privileged stored XSS in DP Calendar | 7.5CNA v4.0 | 0.4% | 2026-08-28 | Exploit code |
| CVE-2026-78070 | Joomla extension digital-peak.com Authenticated, privileged blind SQL injection in DP Calendar | 6.9CNA v4.0 | 0.4% | 2026-08-28 | Exploit code |
| CVE-2026-78032 | Tsuyoshi Saito SOY CMS deserialization of untrusted data | 9.3CNA v4.0 | 0.6% | 2026-08-28 | |
| CVE-2026-77939 | Flextype CMS RCE via POST /API/v1/query endpoint | 7.1CNA v4.0 | 0.6% | 2026-08-28 | |
| CVE-2026-77838 | Tsuyoshi Saito SOY Calendar cross-site scripting | 4.8CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-77701 | WCFM Marketplace WordPress plugin unauthenticated Refund request creation on Guest orders | 5.3CISA ADP v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-77586 | MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output | 8.5CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-77365 | Optimole WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-77218 | PLANET GS-4210-16P2S V3 stack buffer overflow via dispatcher.cgi Credential Handlers | 6.9CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-77217 | PLANET GS-4210-16P2S V3 stack buffer overflow and null pointer dereference | 6.9CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-77184 | MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output | 5.6CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-77078 | multer vulnerable to denial of service via crafted multipart field names | 7.5CNA v3.1 | 0.5% | 2026-08-28 | Exploit codeFix |
| CVE-2026-77063 | multer vulnerable to file size limit bypass via async fileFilter race condition | 3.7CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-77037 | multer vulnerable to denial of service via file descriptor leak on aborted uploads | 7.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-76798 | MongoSQL Transition Readiness Tool improper output encoding in Generated HTML Reports | 6.9CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-76797 | MongoSQL Transition Readiness Tool improper neutralization of Formula Elements in Generated Reports | 5.8CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-76794 | MongoDB BI Connector Transition Readiness Report generated HTML report cross-site scripting | 4.8CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-76651 | Pre-Authentication Multipart Boundary buffer overflow in HTTP service in TP-Link TL-WR841N | 5.3CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-76650 | TP-Link System TL-WR841N v14 A null pointer dereference | 5.3CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-76649 | TP-Link System TL-WR841N v14 A null pointer dereference | 5.3CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-76581 | WPMU DEV Dashboard WordPress plugin authentication bypass to Administrator | 9.8CNA v3.1 | 0.4% | 2026-08-28 | Reported exploitedExploit codeFix |
| CVE-2026-76053 | TranslatePress WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-75758 | elixir-lang elixir uncontrolled recursion | 5.9CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-75486 | Snyk sweater-comb Synk Sweater Comb command injection via .vervet.yaml Branch Name | 8.5CNA v4.0 | 2.3% | 2026-08-28 | Fix |
| CVE-2026-75126 | PLANET GS-4210-16P2S V3 stack buffer overflow via dispatcher.cgi Standard Handlers | 6.9CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-75125 | PLANET GS-4210-16P2S V3 null pointer dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post | 6.9CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-75124 | PLANET GS-4210-16P2S V3 memory corruption via dispatcher.cgi _readHttpParam | 8.7CNA v4.0 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-75123 | PLANET GS-4210-16P2S V3 command injection via dispatcher.cgi web_smtp_test_post | 8.6CNA v4.0 | 1.5% | 2026-08-28 | Fix |
| CVE-2026-75122 | PLANET GS-4210-16P2S V3 command injection via httpuploadcert.cgi | 8.6CNA v4.0 | 0.9% | 2026-08-28 | Fix |
| CVE-2026-75121 | PLANET GS-4210-16P2S V3 command injection via dispatcher.cgi web_vlan_membership_edit_dialog_post | 8.6CNA v4.0 | 1.5% | 2026-08-28 | Fix |
| CVE-2026-75118 | TP-Link Systems TL-MR100 http_gdpr_decrypt Pre-authentication stack-based buffer overflow | 8.7CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-73827 | Tsuyoshi Saito SOY Calendar cross-site scripting | 4.8CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-73209 | Open-Xchange OX Dovecot Pro uncontrolled recursion | 6.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-73208 | Open-Xchange OX Dovecot Pro improper authentication | 7.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-72984 | Microsoft Edge (Chromium-based) remote code execution | 8.8CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-70331 | Microsoft Edge for iOS spoofing | 5.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-70309 | Microsoft Edge (Chromium-based) security feature bypass | 5.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-66798 | Microsoft Edge (Chromium-based) remote code execution | 4.3CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-66324 | Microsoft Edge (Chromium-based) spoofing | 6.5CNA v3.1 | 0.9% | 2026-08-28 | Fix |
| CVE-2026-66323 | Microsoft Edge (Chromium-based) remote code execution | 5.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-62904 | Microsoft Edge (Chromium-based) information disclosure | 5.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-58616 | Copilot Chat (Microsoft Edge) information disclosure | 4.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-58107 | Ericsson CodeChecker authenticated remote denial of service | 5.5CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-58106 | Ericsson CodeChecker ldlogger GCC log tool out-of-bounds write | 2.0CNA v4.0 | 0.2% | 2026-08-28 | |
| CVE-2026-56854 | golang.org/x/crypto/ssh authentication callbacks incorrect authorization | 7.5CISA ADP v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-56100 | SpringBlade privilege escalation via Exposed Feign endpoint | 8.6CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55891 | PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI | 0.0CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55867 | Graylog token revocation endpoint insecure direct object reference | 5.3CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55860 | Org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server | 5.9CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-55859 | MariaDB Connector/R2DBC character set handling improper output encoding | 5.9CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55858 | MariaDB Connector/J character set handling vulnerability | 5.9CNA v3.1 | 0.9% | 2026-08-28 | Fix |
| CVE-2026-55857 | MariaDB Connector/J PAM dialog authentication information disclosure | 5.9CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55856 | MariaDB Connector/J initial handshake authentication information disclosure | 5.9CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55855 | MariaDB Connector/Node.js Buffer parameter escaping SQL injection | 6.5CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55854 | MariaDB Connector/Node.js PAM dialog authentication information disclosure | 5.9CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55848 | MapFish Print has XXE that allows reading arbitrary files of certain types | 8.6CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55841 | Graylog FortiGate syslog parser vulnerability | 7.5CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55834 | pocket-id pocket ID: Open redirect on the OIDC /authorize page | 4.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55785 | free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA | 3.7CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55784 | free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI | 7.5CNA v3.1 | 0.4% | 2026-08-28 | |
| CVE-2026-55779 | Silverstripe Versioned: XSS in archive admin restore | 5.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-55764 | Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55763 | Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits | 8.7CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55696 | PrivateBin attachment download link cross-site scripting | 4.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55678 | Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset | 6.9CNA v4.0 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-55673 | PowSyBl: Command injection in LocalCommandExecutor-s | 7.1CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55634 | Pimcore: Remote code execution via DataObject Class-Definition Field Name | 9.9CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-55584 | phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers | 7.5CNA v3.1 | 1.9% | 2026-08-28 | Exploit codeFix |
| CVE-2026-55569 | aqua archive extraction link following | 6.6CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | 4.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55565 | Yamcs: Authenticated remote code execution | 9.9CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-55559 | Yamcs: Remote code execution via instance-template argument YAML injection (createInstance) | 9.8CNA v3.1 | 0.8% | 2026-08-28 | Exploit codeFix |
| CVE-2026-55552 | Yamcs: Unauthenticated directory traversal | 7.5CNA v3.1 | 0.5% | 2026-08-28 | NucleiFix |
| CVE-2026-55549 | Yamcs: Reflected XSS in the URL of the Authorize endpoint | 6.5CNA v3.1 | 1.3% | 2026-08-28 | NucleiFix |
| CVE-2026-55547 | Yamcs role and privilege enumeration endpoints missing authorization | 4.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-55545 | Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce | 6.5CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55521 | Yamcs: Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API | 8.8CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55520 | Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching | 7.1CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55511 | Yamcs: Authenticated RCE | 9.1CNA v3.1 | 0.7% | 2026-08-28 | Exploit codeFix |
| CVE-2026-55509 | WsgiDAV: Blind SQL injection in the MySQL provider | 8.8CNA v4.0 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55485 | piccolo-orm piccolo_admin piccolo Admin: Privilege escalation admin to superuser | 8.8CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55484 | ALOS HTTP request path sanitizer denial of service | 7.5CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55425 | Graylog system catalog titles endpoint information disclosure | 5.0CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55378 | shriyanss js-recon JS Recon: Command injection in PR Branch Checker workflow | 9.3CNA v4.0 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-55248 | plone.app.portlets vulnerable to denial of service via RSS feed portlet | 9.1CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55247 | plone.app.event vulnerable to denial of service via iCalendar import | 9.1CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55245 | Bifrost URL fetch validation server-side request forgery | 8.7CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55220 | Pimcore Hotspotimage data object insecure deserialization | 9.3CNA v4.0 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-55215 | MariaDB Connector/Node.js TLS handshake authentication information disclosure | 7.5CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55108 | KubeVela Terraform remote loader DoS via unbounded file read | 8.5CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-55068 | free5GC NRF NF registration improper input validation | 9.3CNA v4.0 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-55067 | Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment | 5.0CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-55066 | Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id | 7.1CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-55065 | Vikunja: Improper authorization and authorization bypass | 8.1CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-55064 | Vikunja project hierarchy permission check missing authorization | 4.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-54788 | DataDog dd-trace-rs datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS | 7.5CNA v3.1 | 0.8% | 2026-08-28 | Fix |
| CVE-2026-54766 | Vikunja: Project duplication bypasses write-permission check on the target parent project | 5.3CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-54755 | Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV | 9.6CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-54754 | Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid | 9.6CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-54746 | Hatchet: Cross-tenant write/DoS to other tenants' workers | 6.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-54745 | Kubeflow Pipelines frontend proxy route server-side request forgery | 10.0CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-52687 | Open-Xchange OX Dovecot Pro denial of service | 6.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-52681 | Open-Xchange OX Dovecot Pro and CE Sieve CPU accounting denial of service | 3.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-51665 | TOTOLINK T6 getTracerouteCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51664 | TOTOLINK T6 getTelnetCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51663 | TOTOLINK T6 getWiFiApcliScan function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-28 | |
| CVE-2026-51662 | TOTOLINK T6 getCloudSrvCheckStatus function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51661 | TOTOLINK T6 getPortForwardRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51660 | TOTOLINK T6 getIpPortFilterRules function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51659 | TOTOLINK T6 getUrlFilterRules function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51658 | TOTOLINK T6 DMZ configuration endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51657 | TOTOLINK T6 syslog configuration endpoint improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51656 | TOTOLINK T6 VPN passthrough endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51655 | TOTOLINK T6 MAC filter endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51654 | TOTOLINK T6 schedule configuration endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51653 | TOTOLINK T6 storage configuration endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51652 | TOTOLINK T6 UPnP configuration endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51651 | TOTOLINK T6 Smart QoS endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51650 | TOTOLINK T6 remote management endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51649 | TOTOLINK T6 diagnostic configuration endpoint improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51648 | TOTOLINK T6 WAN information endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51647 | TOTOLINK T6 cloud remote control status endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51646 | TOTOLINK T6 parental control endpoint improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51645 | TOTOLINK T6 administrative password endpoint improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-28 | |
| CVE-2026-51644 | TOTOLINK T6 cloud remote control endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51643 | TOTOLINK T6 NTP configuration endpoint improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51642 | TOTOLINK T6 mesh routing endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51641 | TOTOLINK T6 mesh configuration endpoint improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51640 | TOTOLINK T6 mesh neighbor endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51639 | TOTOLINK T6 AP Wi-Fi scheduling endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51638 | TOTOLINK T6 guest Wi-Fi configuration endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51637 | TOTOLINK T6 mesh portal endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51636 | TOTOLINK T6 Wi-Fi ACL rules endpoint improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51635 | TOTOLINK T6 Wi-Fi scheduling endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51634 | TOTOLINK T6 Wi-Fi configuration endpoint improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51633 | TOTOLINK T6 getWiFiEasyGuestCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51632 | TOTOLINK T6 getWiFiAdvancedCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51631 | TOTOLINK T6 getStaticDhcpRules function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51630 | TOTOLINK T6 getDdnsCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51629 | TOTOLINK T6 getStaticDhcpRules function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51628 | TOTOLINK T6 getGenerateWiFiWpsPin function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51627 | TOTOLINK T6 getIptvCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51626 | TOTOLINK T6 getWiFiWpsCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51625 | TOTOLINK T6 getWiFiEasyCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51624 | TOTOLINK T6 getStationMacByIp function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51623 | TOTOLINK T6 getDdnsStatus function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51622 | TOTOLINK T6 getWanCfg function improper access control | 9.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51621 | TOTOLINK T6 getInitCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51620 | TOTOLINK T6 getNetInfoCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51619 | TOTOLINK T6 getOnlineClient function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51618 | TOTOLINK T6 getWizardCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51617 | TOTOLINK T6 getSysStatusCfg function improper access control | 7.5CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51616 | TOTOLINK T6 getWanIeCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51615 | TOTOLINK T6 getLanCfg function improper access control | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-51614 | TOTOLINK T6 getAccessDeviceCfg function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51613 | TOTOLINK T6 getDeviceInfo function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51611 | TOTOLINK T6 startSlaveReboot function improper access control | 9.8CISA ADP v3.1 | 0.6% | 2026-08-28 | |
| CVE-2026-51610 | TOTOLINK T6 RebootSystem function improper access control | 4.3CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-51376 | BitChat for iOS mesh gossip cache denial of service | 6.5CISA ADP v3.1 | 0.4% | 2026-08-28 | Exploit code |
| CVE-2026-50980 | DNS lookup/management component of oPanel cross-site scripting | 6.1CISA ADP v3.1 | 0.4% | 2026-08-28 | Exploit code |
| CVE-2026-50979 | Osbil Technology oPanel curl tool command injection | 8.1CISA ADP v3.1 | 1.9% | 2026-08-28 | Exploit code |
| CVE-2026-42395 | Open-Xchange OX Dovecot Pro crash | 4.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-42393 | Open-Xchange OX Dovecot Pro information disclosure | 3.1CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-42392 | Open-Xchange OX Dovecot Pro uninitialized memory use | 4.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-42391 | Open-Xchange OX Dovecot Pro denial of service | 7.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-42008 | Open-Xchange OX Dovecot Pro improper authentication | 4.3CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-42007 | Open-Xchange OX Dovecot Pro use-after-free | 9.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-40541 | Synology Chat Server cross-site scripting | 9.0CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-40205 | Open-Xchange OX Dovecot Pro improper authentication | 5.9CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-40204 | Open-Xchange OX Dovecot Pro improper access control | 3.1CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-40203 | Open-Xchange OX Dovecot Pro information disclosure | 3.7CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-40019 | Open-Xchange OX Dovecot CE infinite loop | 5.9CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-40018 | Open-Xchange OX Dovecot Pro SQL injection | 7.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-40017 | Open-Xchange OX Dovecot Pro denial of service | 6.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-40015 | Open-Xchange OX Dovecot Pro out-of-bounds read | 4.3CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-40014 | Open-Xchange OX Dovecot Pro denial of service | 6.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-40013 | Open-Xchange OX Dovecot Pro buffer underflow | 4.3CNA v3.1 | 0.9% | 2026-08-28 | Fix |
| CVE-2026-39071 | Spiffy Plugin event title field stored cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-39070 | Bit Assist call-to-action feature stored cross-site scripting | 4.8CISA ADP v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-38822 | openNDS OS command injection | 7.6CNA v3.1 | 2.3% | 2026-08-28 | Fix |
| CVE-2026-38821 | openNDS A heap-based buffer overflow | 7.1CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-38820 | openNDS OS command injection | 8.3CNA v3.1 | 2.9% | 2026-08-28 | Fix |
| CVE-2026-38819 | openNDS memory leak | 5.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-38725 | PrestaShop xipblog module comment form stored cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-38638 | relibc with_argv function denial of service | 7.5CISA ADP v3.1 | 0.6% | 2026-08-28 | |
| CVE-2026-38636 | relibc seekdir function denial of service | 7.5CISA ADP v3.1 | 0.6% | 2026-08-28 | |
| CVE-2026-38093 | file_picker Android openFileStream implementation path traversal | 3.3CISA ADP v3.1 | 0.2% | 2026-08-28 | |
| CVE-2026-37751 | killSessionSync function An OS command injection | 9.8CISA ADP v3.1 | 2.9% | 2026-08-28 | |
| CVE-2026-37736 | OWASP json-sanitizer JsonSanitizer.sanitize function resource exhaustion | 7.5CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-37710 | Omeka S v.4.2.0 cross-site scripting | 6.1CISA ADP v3.1 | 0.5% | 2026-08-28 | |
| CVE-2026-37237 | vLLM denial of service | 7.5CISA ADP v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-37236 | grpc-gateway ServeMux.ServeHTTP method override header improper access control | 9.8CISA ADP v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-33607 | Open-Xchange OX Dovecot Pro denial of service | 4.3CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-33606 | Open-Xchange OX Dovecot Pro CRLF injection | 4.8CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-33605 | Open-Xchange OX Dovecot Pro crash | 7.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-33604 | Open-Xchange OX Dovecot Pro injection | 5.9CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-33263 | Open-Xchange OX Dovecot Pro file descriptor leak | 4.3CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-27852 | Open-Xchange OX Dovecot Pro denial of service | 7.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-22056 | Denial of service vulnerability in StorageGRID (formerly StorageGRID Webscale) | 2.3CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-19423 | Ultimate Member - unauthenticated privilege escalation via Role field on Profile forms | 8.1CISA ADP v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-19412 | Hard-coded credentials vulnerability in CP Plus CP-XR-DE21-S Router | 8.7CNA v4.0 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-19295 | IBM Langflow flow build process vulnerability | 9.9CNA v3.1 | 3.3% | 2026-08-28 | MetasploitExploit codeFix |
| CVE-2026-19294 | IBM Langflow private flow access insecure direct object reference | 6.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-19286 | IBM Langflow A2A endpoint code injection | 9.8CNA v3.1 | 0.8% | 2026-08-28 | Exploit codeFix |
| CVE-2026-19084 | Shared Files featured image file path handler vulnerability | 7.5CISA ADP v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-18983 | One User Avatar User Profile Picture WordPress plugin stored cross-site scripting | 7.5CNA v3.1 | 0.7% | 2026-08-28 | Fix |
| CVE-2026-18978 | LiteSpeed Cache WordPress plugin unauthenticated stored cross-site scripting via comment content | 7.2CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-18918 | Eclipse Lyo OAuth 1.0 session-fixation chain | 9.1CNA v4.0 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-18904 | IBM Langflow OSS user identifier namespace insecure direct object reference | 8.2CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-18899 | IBM Langflow OSS path traversal | 7.5CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-18891 | IBM Langflow OSS authentication bypass | 8.2CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-18729 | IBM Langflow code injection | 8.8CNA v3.1 | 1.9% | 2026-08-28 | MetasploitExploit codeFix |
| CVE-2026-18545 | IBM Langflow server-side request forgery | 4.3CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-18527 | IBM Application Runtime Expert for i ARE GUI session fixation | 9.9CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-18393 | Red Hat Enterprise Linux AI 3 ffmpeg: Ffmpeg: Heap buffer overflow in tdsc_load_cursor | 5.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-18324 | Forminator Forms WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-17203 | IBM Administration Runtime Expert for i improper authentication | 7.5CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-16821 | IBM AIX and PowerVM VIOS format string | 7.0CNA v3.1 | 0.1% | 2026-08-28 | Fix |
| CVE-2026-16759 | Tutor LMS WordPress plugin unauthenticated remote code execution | 6.5CNA v3.1 | 0.6% | 2026-08-28 | Reported exploitedFix |
| CVE-2026-16654 | Avada (Fusion) Builder WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-15798 | Smart Slider 3 WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-15603 | morgan vulnerable to Log Forging via unescaped Unicode line separators | 5.3CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-14567 | WP User Frontend WordPress plugin unauthenticated user email and Phone disclosure via user directory | 5.3CISA ADP v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-14558 | WP User Frontend WordPress plugin Editor+ PHP object injection via AI form Builder | 7.2CISA ADP v3.1 | 0.5% | 2026-08-28 | Fix |
| CVE-2026-13761 | Pegasystems Pega Platform denial of service | 8.8CNA v4.0 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-13735 | Zephyr WireGuard receive handler vulnerability | 3.7CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-13734 | Zephyr WireGuard receive handler vulnerability | 6.5CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-12514 | Shared Files WordPress plugin unauthenticated limited file upload | 5.3CISA ADP v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-12513 | Shared Files WordPress plugin unauthenticated arbitrary file deletion via path traversal | 6.8CISA ADP v3.1 | 0.3% | 2026-08-28 | Exploit codeFix |
| CVE-2026-9548 | Synology Chat Server cross-site scripting | 6.5CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-9491 | Synology Chat Server server-side request forgery | 4.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-6286 | Booking for Appointments and Events Calendar WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-6176 | Customer Reviews for WooCommerce WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-6128 | All-in-One WP Migration Unlimited Extension WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-5953 | Reflected XSS in Ceviz Informatics's Web Design | 6.1CNA v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-5934 | WP Rocket WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2026-08-28 | Fix |
| CVE-2026-5800 | Reflected XSS in Dayneks Software's E-Commerce Platform | 6.1CNA v3.1 | 0.3% | 2026-08-28 | |
| CVE-2026-5510 | GiveWP WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-5097 | wpForo Forum WordPress plugin unauthenticated SQL injection via referer parameter | 7.5CNA v3.1 | 0.6% | 2026-08-28 | Fix |
| CVE-2026-5096 | Everest Forms WordPress plugin unauthenticated server-side request forgery | 5.3CNA v3.1 | 0.4% | 2026-08-28 | Fix |
| CVE-2026-4378 | Stored XSS in Akıllı Ticaret's E-Commerce Pack | 5.4CNA v3.1 | 0.2% | 2026-08-28 | Fix |
| CVE-2026-4246 | ElementsKit Pro WordPress plugin unauthenticated stored cross-site scripting via s parameter | 6.1CNA v3.1 | 0.4% | 2026-08-28 | Fix |