CVE-2026 records published in August 2026

This page lists the 12,071 CVE-2026 records published in August 2026, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 20 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.

Critical
1,78414.8% of these records
Listed in CISA KEV
200.2% of these records
Reported exploited
670.6% of these records
Detection signal
670.6% of these records
Exploit code
2382.0% of these records
Actionable vendor fix
9,97582.6% of these records

Figures as of 2026-10-24 13:48 UTC. Records published in August 2026 have had from about two months to about three months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.

CVE-2026 records published in August 2026, newest first: records 1 to 1,000 of 12,071
CVE Summary CVSS EPSS Published Signals
CVE-2026-83596WebKitGTK opentypeverticaldata findfeature buffer overflow8.8CNA v3.10.3%2026-08-31Fix
CVE-2026-83524RedPort Optimizer wXa-223 System Clock datetime.php exec command injection9.4CNA v4.03.2%2026-08-31
CVE-2026-83497Unrestricted Java deserialization in OpenSearch SQL Plugin Cursor Pagination8.7CNA v4.01.0%2026-08-31Fix
CVE-2026-83492WordPress Kubio AI Website Builder denial of service6.9CNA v4.00.4%2026-08-31Fix
CVE-2026-82971QVidium Opera11 CGI script net_tr.cgi command injection10.0CNA v4.03.3%2026-08-31
CVE-2026-82970WP Cookie Notice for GDPR, CCPA and ePrivacy Consent WordPress plugin arbitrary file upload10.0CNA v3.10.5%2026-08-31Reported exploitedFix
CVE-2026-82957hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery6.9CNA v4.00.5%2026-08-31
CVE-2026-82954Dokploy settings application.ts writeTraefikConfigInPath path traversal9.4CNA v4.01.0%2026-08-31
CVE-2026-82922ShopEx ECShop flow.php flow_update_cart SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82921ShopEx ECShop pack.php check_img_type unrestricted upload6.9CNA v4.00.5%2026-08-31
CVE-2026-82919cu silicon edit endpoint views.py create_app missing authentication6.9CNA v4.00.7%2026-08-31
CVE-2026-82914kishan0725 Hospital-Management-System search.php SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82909QuantumNous new-api Revoked API Token token session expiration5.3CNA v4.00.4%2026-08-31Fix
CVE-2026-82908MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow9.3CNA v4.00.2%2026-08-31
CVE-2026-82906sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication6.3CNA v4.00.6%2026-08-31
CVE-2026-82905sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery5.3CNA v4.00.4%2026-08-31
CVE-2026-82882Devtron missing authorization via webhook API token endpoint8.7CNA v4.00.6%2026-08-31
CVE-2026-82881Aix-DB stored cross-site scripting via Markdown5.1CNA v4.00.3%2026-08-31
CVE-2026-82880YaCy Search Server XML external entity injection via Parsers8.7CNA v4.00.6%2026-08-31
CVE-2026-82879DataEase Access Control Bypass via Share Tickets5.3CNA v4.00.4%2026-08-31Fix
CVE-2026-82878DataEase Missing Object-Level Authorization on Geographic, Linkage and Chart endpoints5.3CNA v4.00.3%2026-08-31Fix
CVE-2026-82877ILIAS arbitrary file read via SOAP addFile7.1CNA v4.00.6%2026-08-31Fix
CVE-2026-82876Phison PS3111-S11 Controller Firmware signature verification Bypass9.3CNA v4.00.1%2026-08-31
CVE-2026-82875ToolJet authorization bypass via organizationId5.1CNA v4.00.2%2026-08-31Fix
CVE-2026-82874ToolJet Cross-Tenant authorization bypass via tooljet-db9.4CNA v4.00.4%2026-08-31Fix
CVE-2026-82873ToolJet Cross-workspace Schema Disclosure via Export5.3CNA v4.00.3%2026-08-31
CVE-2026-82872ToolJet Cross-Workspace authorization bypass7.1CNA v4.00.5%2026-08-31Fix
CVE-2026-82871ToolJet Cross-Organization Data Read via Database Routes8.2CNA v4.00.4%2026-08-31Fix
CVE-2026-82870ToolJet Cross-Tenant Database Manipulation7.0CNA v4.00.4%2026-08-31Fix
CVE-2026-82869ToolJet Database privilege escalation via join_tables8.2CNA v4.00.4%2026-08-31Fix
CVE-2026-82868@pdfme/schemas cross-site scripting via SVG5.3CNA v4.00.3%2026-08-31Fix
CVE-2026-82867@pdfme/schemas cross-site scripting via Select5.3CNA v4.00.3%2026-08-31Fix
CVE-2026-82866@pdfme/common SSRF via Unvalidated URL Fetch8.9CNA v4.00.3%2026-08-31Fix
CVE-2026-82865pdfme schemas cross-site scripting via i18n Label2.1CNA v4.00.2%2026-08-31Fix
CVE-2026-82864pdfme pdf-lib denial of service via decompression bomb7.1CNA v4.00.4%2026-08-31Fix
CVE-2026-82863@hulumi/baseline CloudTrail Selector tampering Detection8.7CNA v4.00.2%2026-08-31Fix
CVE-2026-82862Hulumi Helper Script Shadowing via Workspace files8.6CNA v4.00.2%2026-08-31Fix
CVE-2026-82861@hulumi/policies SecureBucket Parent Spoof Bypass8.7CNA v4.00.4%2026-08-31Fix
CVE-2026-82860@hulumi/policies Admin Policy Bypass9.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82859hulumi SCP Template Tag-on-Create Bypass9.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82858@hulumi/drift Unsafe Execute Plan Acceptance9.3CNA v4.00.3%2026-08-31Fix
CVE-2026-82857hulumi privilege escalation via IAM Policy9.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82856@hulumi/policies OIDC Trust Policy Bypass9.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82855@hulumi/policies Evidence Validation Bypass9.3CNA v4.00.6%2026-08-31Fix
CVE-2026-82854Nodemailer SMTP command injection via envelope.size9.3CNA v4.02.0%2026-08-31Fix
CVE-2026-82853Nodemailer SMTP command injection via CRLF6.9CNA v4.01.0%2026-08-31Fix
CVE-2026-82852MapSVG WordPress plugin server side request forgery (SSRF)5.4CNA v3.10.2%2026-08-31Fix
CVE-2026-82838pretix Venueless default webserver configuration with incorrect CSP6.4CNA v4.00.4%2026-08-31
CVE-2026-82835caoqianming django-vue-admin file access control5.3CNA v4.00.4%2026-08-31
CVE-2026-82834Doccano bulk-delete endpoint improper access control5.3CNA v4.00.4%2026-08-31
CVE-2026-82833Doccano project example detail endpoint improper access control5.3CNA v4.00.3%2026-08-31
CVE-2026-82821FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference5.3CNA v4.00.6%2026-08-31
CVE-2026-82820FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow5.3CNA v4.00.6%2026-08-31
CVE-2026-82818dibo-software diboot Tenant Resource Assignment resource access control5.3CNA v4.00.3%2026-08-31
CVE-2026-82817dibo-software diboot Tenant Administrator Management API admin access control5.3CNA v4.00.3%2026-08-31
CVE-2026-82816dibo-software diboot AI Session endpoint ai-session authorization5.3CNA v4.00.4%2026-08-31
CVE-2026-82815MegaEase EaseProbe Middleware server.go realIP access control6.9CNA v4.00.5%2026-08-31
CVE-2026-82813BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity5.3CNA v4.00.2%2026-08-31
CVE-2026-82811Toggl OÜ Toggl Track Extension postMessage origin validation5.3CNA v4.00.2%2026-08-31
CVE-2026-82810extension.vn 2FA Authenticator Extension background service worker information disclosure4.8CNA v4.00.1%2026-08-31
CVE-2026-82809vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure5.3CNA v4.00.4%2026-08-31
CVE-2026-82808Inbox Foundry ActiveInbox Extension Google OAuth client secret hard-coded credentials6.9CNA v4.00.5%2026-08-31
CVE-2026-82807ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management9.3CNA v4.00.2%2026-08-31
CVE-2026-82805Typora Mermaid Rendering cross-site scripting5.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82803armink struct2json JSON deserialization null pointer dereference6.9CNA v4.00.7%2026-08-31
CVE-2026-82802NASA earthdata-search granules search endpoint server-side request forgery6.9CNA v4.00.5%2026-08-31
CVE-2026-82801NASA earthdata-search scale endpoint handler.js scaleImage server-side request forgery6.9CNA v4.00.5%2026-08-31
CVE-2026-82797Samsung Open Source rlottie uncontrolled recursion5.5CNA v3.10.1%2026-08-31
CVE-2026-82727ash-project ash_phoenix information disclosure through error messages2.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82726ash-project AshPhoenix tenant subdomain resolution vulnerability6.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82725ash-project ash_phoenix insecure direct object reference2.3CNA v4.00.4%2026-08-31Fix
CVE-2026-82724ash-project ash_phoenix broken access control in AshPhoenix SubdomainHook7.6CNA v4.00.4%2026-08-31Fix
CVE-2026-82722ash-project ash_admin resource exhaustion8.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82703Edimax BR-6214K asp_setPing endpoint ping.asp system os command injection5.1CNA v4.02.9%2026-08-31
CVE-2026-82702Edimax BR-6214K asp_WlanMP endpoint wlanMP.asp system os command injection5.1CNA v4.02.9%2026-08-31
CVE-2026-82701code-projects Online Shopping System Search Functionality action.php SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82700code-projects Online Shopping System Newsletter Subscription offersmail.php cross-site scripting5.3CNA v4.00.5%2026-08-31
CVE-2026-82699sambitraj Student Management System Password aca.sql cleartext storage5.1CNA v4.00.3%2026-08-31
CVE-2026-82698sambitraj Student-Management-System aca.sql default password6.9CNA v4.00.5%2026-08-31
CVE-2026-82697sambitraj Student-Management-System session_start cookie httponly flag6.3CNA v4.00.5%2026-08-31
CVE-2026-82696itsourcecode Sales and Inventory System inv_searchfrm.php SQL injection5.3CNA v4.00.3%2026-08-31
CVE-2026-82695Tenda AC18 Telnet telnet missing authentication10.0CNA v4.01.4%2026-08-31
CVE-2026-82694Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication10.0CNA v4.01.4%2026-08-31
CVE-2026-82693Tenda AC1206 Web UI telnet TendaTelnet missing authentication10.0CNA v4.01.4%2026-08-31
CVE-2026-82692D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection9.4CNA v4.03.3%2026-08-31
CVE-2026-82691D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection9.4CNA v4.03.6%2026-08-31
CVE-2026-82690D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection9.4CNA v4.03.6%2026-08-31Emerging Threats
CVE-2026-82689D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection9.4CNA v4.03.3%2026-08-31
CVE-2026-82688D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection9.4CNA v4.03.6%2026-08-31
CVE-2026-82681ash-project ash_admin query-parameter injection in AshAdmin row-action links2.0CNA v4.00.5%2026-08-31Fix
CVE-2026-82680D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write8.7CNA v4.00.8%2026-08-31
CVE-2026-82679diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload5.3CNA v4.00.4%2026-08-31
CVE-2026-82678diem-project diem Administrative console actions.class.php executeCommand os command injection5.1CNA v4.02.2%2026-08-31
CVE-2026-82677valkey-io valkey Module Timer module.c moduleTimerHandler double free4.8CNA v4.00.5%2026-08-31Fix
CVE-2026-82673ash-project ash_admin path traversal in AshAdmin file uploads via unsanitized client filename8.3CNA v4.00.8%2026-08-31Fix
CVE-2026-82671IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management4.6CNA v4.00.2%2026-08-31
CVE-2026-82670IObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management4.8CNA v4.00.1%2026-08-31
CVE-2026-82669klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service6.9CNA v4.00.7%2026-08-31Fix
CVE-2026-82668klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection6.9CNA v4.02.2%2026-08-31Fix
CVE-2026-82667yaojingang GEOFlow HTTP endpoint resolver server-side request forgery5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-82666yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-82665yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal5.1CNA v4.00.6%2026-08-31Fix
CVE-2026-82664yaojingang GEOFlow JSON-LD Theme HomeController.php cross-site scripting5.3CNA v4.00.6%2026-08-31Fix
CVE-2026-82662Nodemailer TLS certificate validation bypass8.3CNA v4.00.2%2026-08-31Fix
CVE-2026-82661Nodemailer CRLF injection via List-* Header Comments5.3CNA v4.00.3%2026-08-31Fix
CVE-2026-82660Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess5.3CNA v4.00.3%2026-08-31Fix
CVE-2026-82659nodemailer File Read and SSRF via raw option7.1CNA v4.00.3%2026-08-31Fix
CVE-2026-82631valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use-after-free2.1CNA v4.00.6%2026-08-31Fix
CVE-2026-82630PowerJob transport endpoint server-side request forgery6.9CNA v4.00.5%2026-08-31
CVE-2026-82629jeecgboot jeewx-boot doUpload endpoint unrestricted file upload5.1CNA v4.00.4%2026-08-31
CVE-2026-82628Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management9.3CNA v4.00.2%2026-08-31
CVE-2026-82625code-projects Simple Inventory System User Registration register.php cross-site scripting5.3CNA v4.00.5%2026-08-31
CVE-2026-82624code-projects Simple Inventory System database backup file information disclosure6.9CNA v4.00.5%2026-08-31
CVE-2026-82623open62541 history backend use-after-free6.9CNA v4.00.7%2026-08-31
CVE-2026-82622code-projects Employee Leave Managing System employee profile update cross-site scripting5.1CNA v4.00.3%2026-08-31
CVE-2026-82621Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization6.9CNA v4.00.5%2026-08-31
CVE-2026-82620Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking SQL injection5.3CNA v4.00.3%2026-08-31
CVE-2026-82619Systerel S2OPC subscription_mgr.c use-after-free5.3CNA v4.00.5%2026-08-31
CVE-2026-82618Systerel S2OPC string array range writing out-of-bounds read5.3CNA v4.00.5%2026-08-31
CVE-2026-82616TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow9.4CNA v4.00.9%2026-08-31
CVE-2026-82615itsourcecode Online Medicine Delivery System password recovery SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82614Online Medicine Delivery System product category filter SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82613itsourcecode Online Medicine Delivery System Product Search index.php loadResultList SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82612itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82611Online Medicine Delivery System customer login SQL injection6.9CNA v4.00.6%2026-08-31
CVE-2026-82610itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication SQL injection6.9CNA v4.00.6%2026-08-31
CVE-2026-82609itsourcecode Sales and Inventory System inv_edit.php SQL injection5.3CNA v4.00.3%2026-08-31
CVE-2026-82608Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds5.3CNA v4.00.4%2026-08-31Fix
CVE-2026-82607Cozmoslabs Profile Builder avatar upload handler unrestricted file upload6.9CNA v4.00.5%2026-08-31Fix
CVE-2026-82605BareBones BBEdit Lasso Language Tokenizer infinite loop5.3CNA v4.00.6%2026-08-31Fix
CVE-2026-82604BareBones BBEdit Java Language recursion5.3CNA v4.00.6%2026-08-31Fix
CVE-2026-82603SeaCMS Comment Cache member.php del_pl path traversal5.3CNA v4.00.4%2026-08-31
CVE-2026-82602SeaCMS ass.php authorization6.9CNA v4.00.5%2026-08-31
CVE-2026-82601SeaCMS err.php cross-site scripting5.3CNA v4.00.4%2026-08-31
CVE-2026-82600SeaCMS zyapi.php SQL injection6.9CNA v4.00.4%2026-08-31
CVE-2026-82599SeaCMS Avatar upload member.php unlink path traversal5.3CNA v4.00.4%2026-08-31
CVE-2026-82598SeaCMS template search.php parseIf code injection6.9CNA v4.00.5%2026-08-31
CVE-2026-82597TOTOLINK NR1800X cstecgi.cgi setUssd command injection5.3CNA v4.01.8%2026-08-31
CVE-2026-82596LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption4.8CNA v4.00.2%2026-08-31
CVE-2026-82580ash-project ash_ai information disclosure through error messages5.3CNA v4.00.5%2026-08-31Fix
CVE-2026-82579ash-project ash_ai infinite loop6.0CNA v4.00.5%2026-08-31Fix
CVE-2026-82564ash-project ash_ai insecure direct object reference7.1CNA v4.00.5%2026-08-31Fix
CVE-2026-82398pypdf PDF stream parser vulnerability6.9CNA v4.00.5%2026-08-31Fix
CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop7.5CNA v3.10.3%2026-08-31Fix
CVE-2026-82396Sulu: Stored XSS via media download inline-disposition override5.4CNA v3.10.3%2026-08-31Fix
CVE-2026-82395Sulu: Media move/update authorization bypass (IDOR)5.3CNA v4.00.4%2026-08-31Fix
CVE-2026-82394Sulu preview link manager missing authorization5.3CNA v4.00.6%2026-08-31Fix
CVE-2026-82393pnpm tarball package resolver path traversal7.5CNA v3.10.6%2026-08-31Fix
CVE-2026-82392pnpm virtual store linker path traversal7.1CNA v3.10.6%2026-08-31Fix
CVE-2026-82346HP ImageDiags potential escalation of privilege7.0CNA v4.00.1%2026-08-31Fix
CVE-2026-82229WordPress Social Login and Register plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-82228SiteGround Security WordPress plugin 2FA bypass vulnerability8.1CNA v3.10.4%2026-08-31Fix
CVE-2026-82226Tickera WordPress plugin PHP object injection9.8CNA v3.10.6%2026-08-31Exploit codeFix
CVE-2026-82225RegistrationMagic WordPress plugin broken authentication7.4CNA v3.10.4%2026-08-31Fix
CVE-2026-82224SliceWP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-82221RegistrationMagic WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Exploit codeFix
CVE-2026-82217Eclipse Theia path traversal8.8CNA v3.10.6%2026-08-31Fix
CVE-2026-81892EasyCorp EasyAdminBundle EasyAdmin custom-action dispatcher bypasses access_control on other routes8.1CNA v3.10.4%2026-08-31Fix
CVE-2026-81891elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)8.1CNA v3.10.9%2026-08-31Fix
CVE-2026-81890elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections5.4CNA v3.10.2%2026-08-31Fix
CVE-2026-81889elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents` fallback8.6CNA v3.10.6%2026-08-31Fix
CVE-2026-81888Hono OAuth providers OAuth state check cross-site request forgery5.4CNA v3.10.2%2026-08-31Fix
CVE-2026-81887Livewire DOM-based cross-site scripting during client-side state handling5.1CNA v4.00.7%2026-08-31Fix
CVE-2026-81853ash-project ash_admin insecure direct object reference2.3CNA v4.00.4%2026-08-31Fix
CVE-2026-81852ash-project ash_admin AshAdmin ships a hard-coded CSP nonce, allowing nonce-based CSP bypass2.1CNA v4.00.5%2026-08-31Fix
CVE-2026-81780Hash Form WordPress plugin arbitrary file upload10.0CNA v3.10.5%2026-08-31Exploit codeFix
CVE-2026-81779Newspapers X WordPress theme Input vulnerability improper input validation10.0CNA v3.10.5%2026-08-31Fix
CVE-2026-81778Kalles Addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-08-31
CVE-2026-81768Super Store Finder WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-81765Tailored Tools WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-81764Email Essentials WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-81763Throws SPAM Away WordPress plugin SQL injection9.3CNA v3.10.4%2026-08-31Fix
CVE-2026-81762Booking and Rental Manager WordPress plugin broken access control6.5CNA v3.10.3%2026-08-31Fix
CVE-2026-81758OwnerRez API WordPress plugin broken access control6.3CNA v3.10.3%2026-08-31Fix
CVE-2026-81756Smart Marketing SMS and Newsletters Forms WordPress plugin SQL injection9.3CNA v3.10.4%2026-08-31Fix
CVE-2026-81624Red Hat Undertow WebSocket container denial of service7.5CNA v3.10.6%2026-08-31
CVE-2026-81315ash-project ash_ai origin validation error7.4CNA v4.00.3%2026-08-31Fix
CVE-2026-81298LeadConnector WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-81297Fluent Forms Pro Add On Pack WordPress plugin privilege escalation7.5CNA v3.10.3%2026-08-31Fix
CVE-2026-81296Fluent Forms Pro Add On Pack WordPress plugin broken access control7.5CNA v3.10.3%2026-08-31Fix
CVE-2026-81293WP Data Access WordPress plugin SQL injection9.3CNA v3.10.4%2026-08-31Fix
CVE-2026-81291Uncode WordPress theme cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-81290Email Subscribers and Newsletters WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-81287Charitable WordPress plugin SQL injection8.5CNA v3.10.4%2026-08-31Fix
CVE-2026-81280Print Barcode Labels for your WooCommerce products/orders WordPress plugin sensitive data exposure6.5CNA v3.10.4%2026-08-31Fix
CVE-2026-81278Post SMTP WordPress plugin beta.1 - settings Change vulnerability5.4CNA v3.10.3%2026-08-31Fix
CVE-2026-81267Mozilla Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS5.4CISA ADP v3.10.3%2026-08-31Fix
CVE-2026-79750MCPHub authenticated horizontal IDOR: Any non-admin user executes tools on other users' MCP servers7.7CNA v3.10.4%2026-08-31Fix
CVE-2026-79749MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation7.6CNA v4.00.4%2026-08-31Fix
CVE-2026-79748MCPHub: Authenticated non-admin user achieves RCE9.9CNA v3.10.6%2026-08-31Fix
CVE-2026-79747MCPHub OpenAPI proxy server-side request forgery7.1CNA v3.10.3%2026-08-31Fix
CVE-2026-79746MCPHub: Server-scoped bearer key gains access to an entire group via partial server matching8.1CNA v3.10.4%2026-08-31Fix
CVE-2026-79745MCPHub: Missing authorization on Built-in Prompt and Resource CRUD7.1CNA v3.10.4%2026-08-31Fix
CVE-2026-79744MCPHub system config API missing authorization8.8CNA v3.10.6%2026-08-31Fix
CVE-2026-79743MCPHub: Path traversal via Malicious MCPB Manifest Name6.9CNA v4.00.5%2026-08-31Fix
CVE-2026-79483FastGPT chat histories API NoSQL injection5.3CISA ADP v3.10.4%2026-08-31Exploit code
CVE-2026-79408MetaGPT An OS command injection9.8CISA ADP v3.12.1%2026-08-31
CVE-2026-79407SPO extension of MetaGPT path traversal7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-78422zbus_polkit subject UID authorization check race condition7.3CNA v4.00.1%2026-08-31Fix
CVE-2026-78079Joomla extension joomshaper.com Privileged file upload Bypass via content spoofing in Helix Ultimate5.3CNA v4.00.4%2026-08-31
CVE-2026-78078Joomla extension joomshaper.com Privileged file upload Bypass via content spoofing in Helix Ultimate8.9CNA v4.00.4%2026-08-31
CVE-2026-78077JoomShaper Helix Ultimate MegaMenu layout inputs stored cross-site scripting8.6CNA v4.00.4%2026-08-31
CVE-2026-78076JoomShaper Helix Ultimate MegaMenu settings missing authorization5.1CNA v4.00.4%2026-08-31
CVE-2026-78075JoomShaper Helix Ultimate blog image arbitrary file deletion5.1CNA v4.00.4%2026-08-31
CVE-2026-78074miniOrange Joomla extensions improper access control8.8CNA v4.00.5%2026-08-31
CVE-2026-77975Ebyte NA111-M cleartext storage of sensitive information7.1CNA v4.00.2%2026-08-31
CVE-2026-77966Ebyte NA111-M missing authorization8.7CNA v4.00.4%2026-08-31
CVE-2026-77956ash-project ash_ai EEx template evaluation of prompt content in AshAi enables remote code execution8.9CNA v4.00.3%2026-08-31Fix
CVE-2026-77850ash-project ash_admin stored XSS in AshAdmin relationship typeahead8.4CNA v4.00.5%2026-08-31Fix
CVE-2026-77353Wallos: ICalendar injection via CRLF in Subscription Name/Notes Export4.6CNA v3.10.3%2026-08-31Fix
CVE-2026-77352Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)4.3CNA v3.10.3%2026-08-31Fix
CVE-2026-77351Wallos: SSRF via Unvalidated User-Level SMTP host in Email Notification settings3.5CNA v3.10.3%2026-08-31Fix
CVE-2026-77348Wallos incomplete fix for unauthenticated httpoxy SSRF still reachable8.2CNA v3.10.4%2026-08-31Fix
CVE-2026-77013Icollect WordPress plugin unauthenticated user and Term creation via Unrestricted Method Dispatch5.3CISA ADP v3.10.3%2026-08-31
CVE-2026-76986Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue6.1CISA ADP v3.10.6%2026-08-31Fix
CVE-2026-76985Apache Wicket: XSS in Palette via getAdditionalAttributes5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-76984Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-76983Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-76982Apache Wicket: XSS in Button via its model object5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-76763Red Hat SmallRye GraphQL number scalar coercion denial of service7.5CNA v3.10.8%2026-08-31Fix
CVE-2026-76133Ebyte NA111-M use of a broken or risky cryptographic algorithm9.3CNA v4.00.4%2026-08-31
CVE-2026-75802Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel5.1CNA v4.00.5%2026-08-31Fix
CVE-2026-75760ash-project ash_ai information disclosure through error messages7.1CNA v4.00.5%2026-08-31Fix
CVE-2026-75757ash-project ash_admin cookie reliance without validation8.3CNA v4.00.5%2026-08-31Fix
CVE-2026-75594getkirby Kirby media handler path traversal8.2CNA v4.00.8%2026-08-31Fix
CVE-2026-75592Kirby: Access to image files outside of the site root via path traversal in the media handling6.9CNA v4.00.7%2026-08-31Fix
CVE-2026-75460XueZhiSi Open Source Exam System teacher user list endpoint privilege escalation6.5CISA ADP v3.10.3%2026-08-31
CVE-2026-75458XueZhiSi Open Source Exam System teacher user deletion endpoint privilege escalation8.1CISA ADP v3.10.4%2026-08-31
CVE-2026-75133Keep Backup Daily WordPress plugin sensitive information exposure via kbd_cron_process8.7CNA v4.00.5%2026-08-31Fix
CVE-2026-75132WAPT server SQL injection via /API/v3/hosts endpoint7.1CNA v4.00.5%2026-08-31Fix
CVE-2026-74010bbPress WordPress plugin broken access control5.3CNA v3.10.3%2026-08-31Fix
CVE-2026-73819Ebyte NA111-M weak authentication9.3CNA v4.00.5%2026-08-31
CVE-2026-72001Pangolin authentication bypass via Share-Link endpoint8.6CNA v4.00.5%2026-08-31Exploit codeFix
CVE-2026-71415Kirby: File upload permissions are not checked during processing of chunk data7.1CNA v4.00.4%2026-08-31Fix
CVE-2026-71378Apache Wicket: Cross-site request forgery protection bypass in ResourceIsolationRequestCycleListener4.6CISA ADP v3.10.3%2026-08-31Fix
CVE-2026-71257Apache Wicket multipart file upload handling resource exhaustion7.5v3.10.8%2026-08-31Fix
CVE-2026-70449Apache Wicket: Path traversal in resource style/variation/locale5.3CISA ADP v3.10.9%2026-08-31Fix
CVE-2026-68951GROWI incorrect authorization6.9CNA v4.00.3%2026-08-31
CVE-2026-66047ProfilePress WordPress plugin unauthenticated arbitrary plugin installation RCE9.2CNA v4.00.9%2026-08-31Reported exploitedFix
CVE-2026-62993Smarty fetch function server-side request forgery6.9CNA v4.00.6%2026-08-31Fix
CVE-2026-61641Wallos: OIDC account takeover via email-based account linking without `email_verified` check8.1CNA v3.10.5%2026-08-31Fix
CVE-2026-61640Wallos: SSRF via OIDC Token/UserInfo URL Configuration8.5CNA v4.00.5%2026-08-31Fix
CVE-2026-61639Wallos: Zip Slip path traversal in database restore writes files to webroot8.5CNA v4.00.5%2026-08-31Fix
CVE-2026-61638Wallos: SSRF via Test Email Notification unvalidated SMTP host/port8.2CNA v4.00.5%2026-08-31Fix
CVE-2026-59111Command injection vulnerability in eObčanka-Identifikace9.3CNA v3.11.3%2026-08-31Fix
CVE-2026-58574Dell PowerStore 500T missing authentication9.8CNA v3.10.6%2026-08-31Fix
CVE-2026-58301Apache Shiro: Server-side POST request may be steered to an alternate host5.9CNA v4.00.5%2026-08-31Fix
CVE-2026-54600Wallos: Unauthenticated database replacement via import endpoint on fresh install8.2CNA v4.00.6%2026-08-31Fix
CVE-2026-54599Wallos: OIDC state parameter never validated login CSRF / account takeover7.5CNA v4.00.2%2026-08-31Fix
CVE-2026-54598Missing authentication for critical function in Wallos7.5CNA v3.10.5%2026-08-31Fix
CVE-2026-54179Laravel-Backpack CRUD base64 image uploads vulnerability4.4CNA v3.10.3%2026-08-31Fix
CVE-2026-53620GROWI insecure direct object reference5.3CNA v4.00.3%2026-08-31
CVE-2026-53553Goploy: Arbitrary file read via path traversal in /deploy/fileDiff allows Remote Server Compromise7.7CNA v3.10.5%2026-08-31Fix
CVE-2026-53552Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers9.6CNA v3.10.4%2026-08-31
CVE-2026-53508oasdiff git-revision load path server-side request forgery6.0CNA v4.00.5%2026-08-31Fix
CVE-2026-53507oasdiff-action server-side request forgery8.3CNA v4.00.5%2026-08-31Fix
CVE-2026-52730Xibo CMS module settings form missing authorization4.3CNA v3.10.3%2026-08-31Fix
CVE-2026-51740TOTOLINK T6 process termination function vulnerability9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51739TOTOLINK T6 cloud update check function vulnerability5.9CISA ADP v3.10.4%2026-08-31
CVE-2026-51738TOTOLINK T6 device configuration reset function vulnerability9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51737TOTOLINK T6 clearTracerouteLog function improper access control5.3CISA ADP v3.10.4%2026-08-31
CVE-2026-51736TOTOLINK T6 clearSyslog function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51735TOTOLINK T6 showSyslog function improper access control7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51734TOTOLINK T6 informSlaveUpdate function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51733TOTOLINK T6 FirmwareUpgrade function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51732TOTOLINK T6 delWiFiScheduleCfg function improper access control5.3CISA ADP v3.10.4%2026-08-31
CVE-2026-51731TOTOLINK T6 delVlanCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51730TOTOLINK T6 delWiFiAclRules function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51729TOTOLINK T6 delDevice function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51728TOTOLINK T6 UploadFirmwareFile function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51727TOTOLINK T6 SystemSettings function improper access control5.3CISA ADP v3.10.4%2026-08-31
CVE-2026-51726TOTOLINK T6 delParentalRules function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51725TOTOLINK T6 NTPSyncWithHost function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51724TOTOLINK T6 delSmartQosCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51723TOTOLINK T6 UploadCustomModule function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51722TOTOLINK T6 setWiFiRepeaterCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51721TOTOLINK T6 setPairCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51720TOTOLINK T6 delIpPortFilterRules function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51719TOTOLINK T6 delUrlFilterRules function improper access control7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51718TOTOLINK T6 delStaticDhcpRules function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51717TOTOLINK T6 setOpModeCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51716TOTOLINK T6 delPortForwardRules function improper access control7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51715TOTOLINK T6 delMacFilterRules function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51714TOTOLINK T6 setRoamingCfg function improper access control5.9CISA ADP v3.10.4%2026-08-31
CVE-2026-51713TOTOLINK T6 setManualDialCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51712TOTOLINK T6 setApWiFiSchCfg function improper access control5.9CISA ADP v3.10.4%2026-08-31
CVE-2026-51711TOTOLINK T6 setWiFiWpsStart function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51710TOTOLINK T6 parental control rules vulnerability9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51709TOTOLINK T6 setWiFiBasicCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51708TOTOLINK T6 WPS configuration vulnerability9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51706TOTOLINK T6 setSmartQosCfg function improper access control4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51705TOTOLINK T6 setWiFiMeshName function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51704TOTOLINK T6 Wi-Fi mesh configuration vulnerability4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51703TOTOLINK T6 Wi-Fi schedule configuration vulnerability5.4CISA ADP v3.10.3%2026-08-31
CVE-2026-51702TOTOLINK T6 setIpPortFilterRules function improper access control4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51701TOTOLINK T6 setMacFilterRules function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51700TOTOLINK T6 setWiFiAdvancedCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51699TOTOLINK T6 setDmzCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51698TOTOLINK T6 setUrlFilterRules function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51697TOTOLINK T6 IPTV configuration vulnerability9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51696TOTOLINK T6 setPortForwardRules function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51695TOTOLINK T6 dynamic DNS configuration vulnerability7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51694TOTOLINK T6 static DHCP rules vulnerability7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51693TOTOLINK T6 setVpnPassCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51692TOTOLINK T6 setWiFiGuestCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51691TOTOLINK T6 upload setting vulnerability9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51690TOTOLINK T6 setWanCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51689TOTOLINK T6 firmware upgrade workflow vulnerability9.1CISA ADP v3.10.6%2026-08-31
CVE-2026-51688TOTOLINK T6 Wi-Fi signal power setting vulnerability7.5CISA ADP v3.10.6%2026-08-31
CVE-2026-51687TOTOLINK T6 setWiFiEasyGuestCf function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51686TOTOLINK T6 setWiFiEasyCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51684TOTOLINK T6 setStorageCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51683TOTOLINK T6 setLanCfg function improper access control4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51681TOTOLINK T6 setRemoteCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51680TOTOLINK T6 setLedCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51679TOTOLINK T6 setPasswordCfg function improper access control9.1CISA ADP v3.10.6%2026-08-31
CVE-2026-51678TOTOLINK T6 setSyslogCfg function improper access control4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51677TOTOLINK T6 setUPnPCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51676TOTOLINK T6 setAccessDeviceCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51675TOTOLINK T6 setWanIeCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51674TOTOLINK T6 setScheduleCfg function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51673TOTOLINK T6 setNtpCfg function improper access control7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51672TOTOLINK T6 getRoamingCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51671TOTOLINK T6 getCloudDownloadStatus function improper access control7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51670TOTOLINK T6 getSlaveUpdate function improper access control9.8CISA ADP v3.10.6%2026-08-31
CVE-2026-51669TOTOLINK T6 getPairCfg function improper access control9.1CISA ADP v3.10.5%2026-08-31
CVE-2026-51668TOTOLINK T6 setLanguageCfg function improper access control7.5CISA ADP v3.10.5%2026-08-31
CVE-2026-51667TOTOLINK T6 getWiFiIpMacTable function improper access control4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51666TOTOLINK T6 setWizardCfg function improper access control4.3CISA ADP v3.10.3%2026-08-31
CVE-2026-51153TaskRunHandler.post in web/handlers/task.py in QD stored cross-site scripting5.4CISA ADP v3.10.2%2026-08-31
CVE-2026-51152/har/test endpoint in QD server-side request forgery9.1CISA ADP v3.10.7%2026-08-31
CVE-2026-50199Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh4.3CNA v3.10.3%2026-08-31Fix
CVE-2026-50198Wallos: Cross-user subscription cost inference via replacement_subscription_id4.3CNA v3.10.3%2026-08-31Fix
CVE-2026-49003Unauthenticated RCE vulnerability in ZTE ZXDU68 S202 Product9.6CNA v3.12.4%2026-08-31
CVE-2026-40465Nokia NSP redirect URL parameter open redirect5.3CISA ADP v3.10.3%2026-08-31
CVE-2026-40464A stored cross-site scripting (XSS) vulnerability in Nokia NSP5.4CISA ADP v3.10.2%2026-08-31
CVE-2026-40463An Insufficient Role-based access control vulnerability in WaveSuite7.6CISA ADP v3.10.3%2026-08-31
CVE-2026-38577Tenda HG21 admin account hard-coded credentials9.8CISA ADP v3.10.5%2026-08-31Exploit code
CVE-2026-21827HCL Connections is vulnerable to an information disclosure3.1CNA v3.10.2%2026-08-31
CVE-2026-19953URI punycode host encoding improper equivalence validation6.5CISA ADP v3.10.2%2026-08-31Fix
CVE-2026-19873HTML::FormFu versions for Perl allow resource exhaustion7.5CISA ADP v3.10.5%2026-08-31Fix
CVE-2026-19702OS command injection in TÜBİTAK BİLGEM's Pardus Boot Repair7.8CNA v3.10.5%2026-08-31Fix
CVE-2026-19616Information disclosure in TBC Technology's KitLogistic7.5CNA v3.10.2%2026-08-31Fix
CVE-2026-19410Google Cloud Build Comment Control Bypass via Webhook Suppression9.4CNA v4.00.1%2026-08-31Fix
CVE-2026-17615Red Hat RESTEasy SourceProvider XML external entity injection7.5CNA v3.10.6%2026-08-31Fix
CVE-2026-14697Zephyr IPv6 neighbor solicitation handling memory leak6.5CNA v3.10.2%2026-08-31Fix
CVE-2026-14696zephyrproject zephyr ethernet bridge RX packet leak enables denial of service6.5CNA v3.10.2%2026-08-31Fix
CVE-2026-14368Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser5.4CNA v3.10.2%2026-08-31Fix
CVE-2026-14367zephyrproject zephyr I3C IBI work-node free-list data race between ISR and workqueue thread3.1CNA v3.10.1%2026-08-31Fix
CVE-2026-14366zephyrproject zephyr SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt6.4CNA v3.10.2%2026-08-31Fix
CVE-2026-13732Red Hat Enterprise Linux 10 gdb: Gdb: Out-of-bounds write in stabs parser read_member_functions7.0CNA v3.10.1%2026-08-31Fix
CVE-2026-12894quarkus-qute ReflectionValueResolver server-side template injection8.8CNA v3.10.5%2026-08-31Fix
CVE-2026-5956SQLi in Ankara Hosting's Site Management Panel8.8CNA v3.10.4%2026-08-31
CVE-2026-82658Admidio broken access control via profile_function.php5.3CNA v4.00.3%2026-08-30Fix
CVE-2026-82657Admidio authentication bypass via RSS feeds8.7CNA v4.00.5%2026-08-30Fix
CVE-2026-82656Admidio path traversal via Photo ZIP Download2.1CNA v4.00.4%2026-08-30Fix
CVE-2026-82655Admidio SQL injection via relation_type_list8.7CNA v4.00.6%2026-08-30Fix
CVE-2026-82654SiYuan stored XSS via block name9.3CNA v4.00.4%2026-08-30Fix
CVE-2026-82653SiYuan stored XSS via confirmDialog9.3CNA v4.00.4%2026-08-30Fix
CVE-2026-82652SiYuan information disclosure via Publish Access6.9CNA v4.00.3%2026-08-30Fix
CVE-2026-82651SiYuan missing authorization via /history and /repo/diff6.9CNA v4.00.5%2026-08-30Fix
CVE-2026-82650SiYuan path traversal via /API/template/render5.9CNA v4.00.4%2026-08-30Fix
CVE-2026-82649SiYuan local privilege escalation via uncontrolled search path7.0CNA v4.00.2%2026-08-30Fix
CVE-2026-82648WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address7.1CNA v4.00.3%2026-08-30
CVE-2026-82647WWBN AVideo cross-site request forgery via sendEmail.json.php5.3CNA v4.00.1%2026-08-30
CVE-2026-82646WWBN AVideo unauthenticated reflected XSS via url2Embed.json.php5.3CNA v4.00.3%2026-08-30Fix
CVE-2026-82645AVideo Unauthenticated Stream credential disclosure via Forgeable Token9.2CNA v4.00.2%2026-08-30
CVE-2026-82644WWBN AVideo brute-force Rate Limiting Bypass via Missing User-Agent8.7CNA v4.00.4%2026-08-30
CVE-2026-82643WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php6.9CNA v4.00.3%2026-08-30
CVE-2026-82642Readest EPUB sanitizer cross-site scripting8.8CNA v3.10.7%2026-08-30Fix
CVE-2026-82641Keploy Unauthenticated TLS key exposure8.8CNA v4.00.6%2026-08-30Fix
CVE-2026-82640browser-use web-ui Cleartext API Key Storage6.8CNA v4.00.1%2026-08-30
CVE-2026-82639NextChat OpenAI API key disclosure8.7CNA v4.00.5%2026-08-30
CVE-2026-82638jina-ai reader server-side request forgery via disabled private-address guard8.7CNA v4.00.5%2026-08-30
CVE-2026-82637browser-use web-ui browser settings path validation path traversal6.9CNA v4.00.4%2026-08-30
CVE-2026-82636Qubes OS OS command injection7.9CNA v3.11.9%2026-08-30Fix
CVE-2026-82635Pake arbitrary file write via unsanitized download_file filename8.8CNA v3.10.6%2026-08-30Fix
CVE-2026-82634Frappe Framework Development Branch incorrect authorization via Jinja Template Preview endpoint7.1CNA v4.00.4%2026-08-30
CVE-2026-82633Dolibarr missing authorization on REST Users Groups endpoint5.3CNA v4.00.3%2026-08-30Fix
CVE-2026-82595D-Link DIR-825M System command execution formSysCmd sub_456CF4 command injection5.3CNA v4.04.4%2026-08-30Fix
CVE-2026-82594LogNet grpc-spring-boot-starter Annotation Processing improper authorization2.3CNA v4.00.3%2026-08-30
CVE-2026-82593D-Link DIR-825M LTE firmware upgrade handler stack-based buffer overflow9.4CNA v4.00.9%2026-08-30Fix
CVE-2026-82592D-Link DIR-825M Disk Formatting handler endpoint formDiskFormat sub_46725C stack-based overflow9.4CNA v4.00.9%2026-08-30Exploit codeFix
CVE-2026-82591Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow4.8CNA v4.00.2%2026-08-30
CVE-2026-82590Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion5.3CNA v4.00.5%2026-08-30Fix
CVE-2026-82589Open5GS N1-N2 message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service5.3CNA v4.00.5%2026-08-30Fix
CVE-2026-82588Open5GS Transfer endpoint namf-handler.c null pointer dereference5.3CNA v4.00.5%2026-08-30Fix
CVE-2026-82587Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption5.3CNA v4.00.5%2026-08-30Fix
CVE-2026-82556Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery5.3CNA v4.00.4%2026-08-30
CVE-2026-82555TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values6.3CNA v4.00.7%2026-08-30
CVE-2026-82554SourceCodester Queue Management System add_customer.php cross-site scripting5.3CNA v4.00.5%2026-08-30
CVE-2026-82553Student Management System student dashboard improper authorization5.3CNA v4.00.3%2026-08-30
CVE-2026-82552Linux Foundation Magma gNB Termination ngap_amf.c denial of service5.3CNA v4.00.5%2026-08-30
CVE-2026-82551Linux Foundation Magma NGSetup ngap_amf_handlers.c state issue6.9CNA v4.00.5%2026-08-30
CVE-2026-82550Linux Foundation Magma NGSetupRequest input validation6.9CNA v4.00.7%2026-08-30
CVE-2026-82549Linux Foundation Magma SecurityModeComplete integrity check6.9CNA v4.00.3%2026-08-30
CVE-2026-82548Linux Foundation Magma InitialUEMessage information disclosure6.9CNA v4.00.5%2026-08-30
CVE-2026-82547Linux Foundation Magma Registration Complete message amf_fsm.cpp improper authentication6.9CNA v4.00.8%2026-08-30
CVE-2026-82545itsourcecode Sales and Inventory System sup_searchfrm.php SQL injection5.3CNA v4.00.3%2026-08-30
CVE-2026-82544wger-project wger Password Reset gym.py reset_user_password cross-site request forgery5.3CNA v4.00.2%2026-08-30
CVE-2026-82543vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition6.9CNA v4.00.5%2026-08-30Fix
CVE-2026-82542Tenda HG10 Boa Web Server formIPv6Routing buffer overflow10.0CNA v4.01.1%2026-08-30
CVE-2026-82541itsourcecode Sales and Inventory System sup_edit.php SQL injection5.3CNA v4.00.3%2026-08-30
CVE-2026-82540itsourcecode Sales and Inventory System cust_searchfrm.php SQL injection5.3CNA v4.00.3%2026-08-30
CVE-2026-82539TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption9.4CNA v4.00.8%2026-08-30
CVE-2026-82488Beetel 450TC3 user management cross-site scripting5.1CNA v4.00.3%2026-08-30
CVE-2026-82487Beetel 450TC3 password recovery5.3CNA v4.00.3%2026-08-30
CVE-2026-82486SiteServer SSCMS Agent Installation Workflow access control2.3CNA v4.00.3%2026-08-30
CVE-2026-82485itsourcecode Sales and Inventory System pro_edit.php SQL injection5.3CNA v4.00.3%2026-08-30
CVE-2026-82484itsourcecode Sales and Inventory System emp_searchfrm.php SQL injection5.3CNA v4.00.3%2026-08-30
CVE-2026-82483Coppermine Photo Gallery hidden album update endpoint cross-site scripting5.1CNA v4.00.3%2026-08-30Fix
CVE-2026-82482coppermine-gallery Coppermine Photo Gallery edit_profile endpoint profile.php cross-site scripting5.1CNA v4.00.3%2026-08-30Fix
CVE-2026-82480NASA cFS cFE Software Bus cfe_sb_util.c CFE_SB_GetUserDataLength integer underflow5.3CNA v4.00.4%2026-08-30
CVE-2026-82479NASA cFS SBN TCP sbn_tcp_if.c OS_read buffer overflow5.3CNA v4.00.4%2026-08-30
CVE-2026-82478NASA Trick TCP Socket JSONVariableServerThread.cpp parse_request stack-based overflow6.9CNA v4.00.5%2026-08-30
CVE-2026-82367ash-project ash_graphql session data exposure2.3CNA v4.00.4%2026-08-30Fix
CVE-2026-81766Really Simple Security plugin installer privilege escalation6.6CISA ADP v3.10.4%2026-08-30Fix
CVE-2026-81660Groundhogg WordPress plugin unauthenticated stored XSS via web form Dropdown/Radio field8.8CISA ADP v3.10.5%2026-08-30Fix
CVE-2026-81643ash-project ash_graphql incorrect authorization2.3CNA v4.00.4%2026-08-30Fix
CVE-2026-81636ash-project ash_graphql resource exhaustion8.7CNA v4.00.6%2026-08-30Fix
CVE-2026-81633ash-project ash_graphql unhandled KeyError in AshGraphql relay node resolution crashes queries6.9CNA v4.00.5%2026-08-30Fix
CVE-2026-81322ash-project ash_cloak cloaked plaintext leaks through a non-sensitive action argument in AshCloak2.1CNA v4.00.1%2026-08-30Fix
CVE-2026-81319ash-project ash_cloak unsafe deserialization of decrypted terms enables node DoS in AshCloak5.9CNA v4.00.4%2026-08-30Fix
CVE-2026-81318ash-project ash_sql incorrect authorization2.1CNA v4.00.2%2026-08-30Fix
CVE-2026-81316ash-project ash_sql same-named aggregates with differing filters are conflated in AshSql2.1CNA v4.00.2%2026-08-30Fix
CVE-2026-80227ash-project ash_sql SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql2.1CNA v4.00.4%2026-08-30Fix
CVE-2026-80223ash-project ash_graphql incorrect authorization7.1CNA v4.00.4%2026-08-30Fix
CVE-2026-78699ash-project ash_postgres unchecked return value7.2CNA v4.00.2%2026-08-30Fix
CVE-2026-78693ash-project ash_graphql information disclosure through error messages6.9CNA v4.00.5%2026-08-30Fix
CVE-2026-78691ash-project ash_sql unescaped backslash allows LIKE wildcard injection in AshSql string search2.1CNA v4.00.2%2026-08-30Fix
CVE-2026-78364MW WP Form WordPress plugin Editor+ stored XSS via Inquiry data List3.5CISA ADP v3.10.2%2026-08-30Fix
CVE-2026-78228ash-project ash_oban unbounded handle_error recursion enables denial of service in AshOban triggers5.9CNA v4.00.2%2026-08-30Fix
CVE-2026-78038ash-project ash_oban job argument injection via :args overrides primary_key and tenant in AshOban5.9CNA v4.00.4%2026-08-30Fix
CVE-2026-77970ash-project ash_paper_trail cleartext storage of sensitive information5.9CNA v4.00.1%2026-08-30Fix
CVE-2026-77846ash-project ash_sqlite JSON path injection via unescaped get_path segments in AshSqlite2.1CNA v4.00.2%2026-08-30Fix
CVE-2026-77831ash-project ash_paper_trail algorithmic complexity2.1CNA v4.00.2%2026-08-30Fix
CVE-2026-77454ash-project ash_sql incorrect authorization5.9CNA v4.00.2%2026-08-30Fix
CVE-2026-76585Customer Reviews for WooCommerce WordPress plugin unauthenticated stored XSS via comment parameter8.8CISA ADP v3.10.5%2026-08-30Fix
CVE-2026-75847ash-project ash_paper_trail cleartext storage of sensitive information5.9CNA v4.00.1%2026-08-30Fix
CVE-2026-75759Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc7.6CNA v4.00.2%2026-08-30Fix
CVE-2026-56718AJCloud AJY IPC Firmware path traversal via jdbhttpd8.7CNA v4.00.9%2026-08-30Exploit codeFix
CVE-2026-19722WPvivid Backup and Migration WordPress plugin arbitrary file write6.6CISA ADP v3.10.3%2026-08-30Fix
CVE-2026-15980MyHome Core WordPress plugin authentication bypass to account takeover via activation Token9.8CNA v3.10.5%2026-08-30Fix
CVE-2026-14835SOGO Add Script to Individual Pages Header Footer WordPress plugin stored XSS6.8CISA ADP v3.10.2%2026-08-30
CVE-2026-14307Geotargeting WP AJAX response handler reflected cross-site scripting7.1CISA ADP v3.10.2%2026-08-30Fix
CVE-2026-82562qs array-limit bypass via bracket-key comma parsing6.3CNA v4.00.5%2026-08-29Fix
CVE-2026-82481mirage cohttp path traversal8.7CNA v4.00.7%2026-08-29Fix
CVE-2026-82477Heimdall server-side request forgery5.8CNA v3.10.5%2026-08-29Fix
CVE-2026-82476Memos SSRF via Omitted CGNAT Address Range6.9CNA v4.00.4%2026-08-29
CVE-2026-82475iFlytek astron-agent Workflow Hijacking via Missing Ownership Check8.6CNA v4.00.4%2026-08-29
CVE-2026-82474Sudo Intercept Policy Bypass via execveat8.5CNA v4.00.1%2026-08-29Fix
CVE-2026-82473KubeEdge CloudCore missing authentication on Node Task endpoints8.8CNA v4.00.6%2026-08-29
CVE-2026-82472Documenso Unauthenticated file upload via /API/files/upload-pdf8.7CNA v4.00.8%2026-08-29Fix
CVE-2026-82470Rodauth TOTP Code Reuse via Drift window5.1CNA v4.00.4%2026-08-29Fix
CVE-2026-82469Rodauth authentication bypass via jwt_refresh5.1CNA v4.00.4%2026-08-29Fix
CVE-2026-82468Rodauth CSRF Protection Bypass via Content-Type4.9CNA v4.00.2%2026-08-29Fix
CVE-2026-82467Rodauth open redirect via Return-to Path4.9CNA v4.00.3%2026-08-29Fix
CVE-2026-82466Rodauth authentication bypass via webauthn_login9.4CNA v4.00.6%2026-08-29Fix
CVE-2026-82465pac4j pac4j-saml Session Destruction via Unsigned LogoutRequest6.9CNA v4.00.3%2026-08-29Fix
CVE-2026-82464pac4j pac4j-core open redirect via Backslash Logout5.3CNA v4.00.3%2026-08-29Fix
CVE-2026-82463pac4j pac4j-core authorization bypass via Reversed Profile Type Check8.6CNA v4.00.6%2026-08-29Fix
CVE-2026-82462pac4j pac4j-oidc authentication bypass via Access Token Substitution6.9CNA v4.00.2%2026-08-29Fix
CVE-2026-82461pac4j pac4j-oidc privilege escalation via Unverified Keycloak Access Token8.6CNA v4.00.3%2026-08-29Fix
CVE-2026-82460coderaiser cloudcmd Cloud Commander directory traversal via REST and Markdown9.3CNA v4.00.9%2026-08-29Fix
CVE-2026-82457su-exec privilege escalation via Numeric User ID8.5CNA v4.00.2%2026-08-29
CVE-2026-82456argocd-mcp authentication bypass via Unauthenticated HTTP10.0CNA v4.01.7%2026-08-29NucleiFix
CVE-2026-82454Omnivore before android- authentication bypass via Apple Sign-in9.3CNA v4.00.4%2026-08-29
CVE-2026-82453rust-iot-platform Cleartext Password Storage via User Model8.7CNA v4.00.5%2026-08-29
CVE-2026-82452rust-iot-platform authentication bypass via Missing Request Guards9.3CNA v4.00.8%2026-08-29
CVE-2026-82451Formwork stored XSS via Referer header5.3CNA v4.00.4%2026-08-29Fix
CVE-2026-82450BookStack remote code execution via Book Cover8.7CNA v4.01.0%2026-08-29Fix
CVE-2026-82449Cockpit CMS Account Enumeration via Auth Timing6.9CNA v4.00.4%2026-08-29Fix
CVE-2026-82448Shinobi before commit 5a76c74f arbitrary Database Query Execution via Hard-coded Child Node Key9.3CNA v4.00.7%2026-08-29
CVE-2026-82447Skyvern sandbox escape via TextPromptBlock8.7CNA v4.00.8%2026-08-29Fix
CVE-2026-82424PHPGurukul Student Information System student_edit1.php SQL injection5.3CNA v4.00.3%2026-08-29
CVE-2026-82423macrozheng mall Payment Status endpoint paySuccess behavioral workflow5.3CNA v4.00.4%2026-08-29
CVE-2026-82422itsourcecode Sales and Inventory System emp_del.php SQL injection5.3CNA v4.00.3%2026-08-29
CVE-2026-82421itsourcecode Sales and Inventory System emp_edit.php SQL injection5.3CNA v4.00.3%2026-08-29
CVE-2026-82417ljharb qs qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property6.3CNA v4.00.4%2026-08-29Fix
CVE-2026-82364macrozheng mall Order Submission submit race condition2.3CNA v4.00.3%2026-08-29
CVE-2026-81346Frontend Admin by DynamiApps WordPress plugin Subscriber+ arbitrary Membership Plan deletion4.3CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-81342MasterStudy LMS WordPress plugin unauthenticated open redirect4.7CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-81200MasterStudy LMS WordPress plugin Instructor+ Cross-Tenant order Billing PII disclosure via IDOR2.7CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-81026MasterStudy LMS WordPress plugin unauthenticated Payment bypass via PayPal IPN4.8CISA ADP v3.10.2%2026-08-29Fix
CVE-2026-80725Linux kernel GRO BIG TCP aggregation vulnerability9.8CNA v3.10.5%2026-08-29Fix
CVE-2026-80488WP Ultimate CSV Importer WordPress plugin Admin+ SQLi via AIOSEO import fields4.1CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-80311WP Full Pay Stripe Payment Forms insecure direct object reference4.3CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-77786Rank Math SEO WordPress plugin Editor+ Core settings modification via fix-site-seo Ability4.9CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-77704Booking for Appointments and Events Calendar appointment status update incorrect authorization2.7CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-77012Icollect WordPress plugin unauthenticated arbitrary file read, SSRF and path traversal file write9.3CISA ADP v3.10.3%2026-08-29
CVE-2026-77010HEL Online Classroom plugin meeting join REST API improper access control6.5CISA ADP v3.10.3%2026-08-29
CVE-2026-77008HEL Online Classroom: AI-powered Online Classrooms plugin settings improper access control6.5CISA ADP v3.10.4%2026-08-29
CVE-2026-77007HEL Online Classroom plugin REST API settings route information disclosure7.5CISA ADP v3.10.4%2026-08-29
CVE-2026-76586BookingPress - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation7.5CISA ADP v3.10.4%2026-08-29Fix
CVE-2026-76548User Profile Builder front-end file upload feature authentication bypass8.2CISA ADP v3.10.3%2026-08-29Fix
CVE-2026-76547Profile Builder WordPress plugin Admin+ PHP object injection via Import/Export6.6CISA ADP v3.10.4%2026-08-29Exploit codeFix
CVE-2026-76546Profile Builder WordPress plugin Contributor+ stored XSS via Format Date shortcode6.8CISA ADP v3.10.4%2026-08-29Fix
CVE-2026-75807SAML Single Sign On WordPress plugin unauthenticated authentication bypass7.5CNA v3.10.4%2026-08-29Fix
CVE-2026-41012Cloud Foundry bosh-vsphere-cpi-release BOSH vSphere CPI Improper Cert Validation7.7CNA v3.10.1%2026-08-29
CVE-2026-19430CatFolders Document Gallery Pro WordPress plugin unauthenticated missing authorization5.3CISA ADP v3.10.2%2026-08-29Fix
CVE-2026-18234MStore API WordPress plugin Subscriber+ arbitrary order Payment bypass via Wallet6.5CISA ADP v3.10.2%2026-08-29Fix
CVE-2026-18233MStore API WordPress plugin Subscriber+ arbitrary order Completion6.5CISA ADP v3.10.2%2026-08-29Fix
CVE-2026-17522Newsletters WordPress plugin arbitrary plugin option update via CSRF5.4CISA ADP v3.10.1%2026-08-29Fix
CVE-2026-17520Newsletters WordPress plugin unauthenticated API access via Predictable API Key4.8CISA ADP v3.10.1%2026-08-29Fix
CVE-2026-16947Total Processing Card Payments for WooCommerce server-side request forgery9.1CISA ADP v3.10.2%2026-08-29Reported exploited
CVE-2026-16600SmartAIPress WordPress plugin server-side request forgery7.7CISA ADP v3.10.2%2026-08-29
CVE-2026-16259Uix UserCenter WordPress plugin unauthenticated privilege escalation9.8CISA ADP v3.10.3%2026-08-29
CVE-2026-16061Rest Routes custom tables REST route SQL injection8.6CISA ADP v3.10.3%2026-08-29
CVE-2026-15369Custom User Registration Fields for WooCommerce WordPress plugin privilege escalation9.8CNA v3.10.4%2026-08-29Reported exploitedFix
CVE-2026-14494Sigma Forms Pro WordPress plugin remote code execution9.8CNA v3.10.7%2026-08-29Fix
CVE-2026-10522MemberHero frontend registration privilege escalation9.8CISA ADP v3.10.3%2026-08-29
CVE-2026-82343GNOME GIMP PSD file loader out-of-bounds read6.1CNA v3.10.3%2026-08-28Fix
CVE-2026-82333multer vulnerable to denial of service via oversized array index in field names7.5CNA v3.10.5%2026-08-28Fix
CVE-2026-82330Gimp: Heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check6.1CNA v3.10.3%2026-08-28Fix
CVE-2026-82329JFrog Artifactory improper authentication9.8CNA v3.114.4%2026-08-28KEVNucleiEmerging ThreatsExploit codeKCVFix
CVE-2026-82328Gimp: Heap out-of-bounds read in ico loader via unvalidated used_clrs palette count6.1CNA v3.10.3%2026-08-28Fix
CVE-2026-82327Red Hat Enterprise Linux 10 libsolv: Libsolv: Out-of-bounds write in repo_write5.5CNA v3.10.2%2026-08-28
CVE-2026-82324Gimp: Heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=06.1CNA v3.10.3%2026-08-28Fix
CVE-2026-82306StarRocks Query Detail Endpoint Returns Every User's Query History6.5CNA v3.10.5%2026-08-28
CVE-2026-82291HeyForm Reflects any Origin in CORS Responses While allowing Credentials8.1CNA v3.10.6%2026-08-28Fix
CVE-2026-82290Chainlit Feedback Endpoints Missing Ownership Validation6.0CNA v4.00.3%2026-08-28
CVE-2026-82289Gitingest Prefix-Based Git Host Check enables Request Forgery and token disclosure8.3CNA v4.00.3%2026-08-28
CVE-2026-82288AUTOMATIC1111 stable-diffusion-webui stable Diffusion WebUI credential disclosure8.7CNA v4.00.4%2026-08-28
CVE-2026-82287Rybbit Reflects any Origin in CORS Responses While allowing Credentials8.6CNA v4.00.5%2026-08-28Fix
CVE-2026-82286gpt-crawler arbitrary file write via outputFileName parameter8.8CNA v4.00.5%2026-08-28Exploit code
CVE-2026-82285BISHENG unauthenticated server-side request forgery via Workflow Report Callback8.8CNA v4.00.5%2026-08-28
CVE-2026-82284Quivr Chat Endpoints Missing Ownership Validation8.6CNA v4.00.3%2026-08-28
CVE-2026-82283VoltAgent Memory API Handlers Missing Ownership Checks8.6CNA v4.00.3%2026-08-28
CVE-2026-82282Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers8.8CNA v4.00.4%2026-08-28
CVE-2026-82281Kotaemon Missing Ownership Check in Conversation functions9.1CNA v4.00.3%2026-08-28
CVE-2026-82280Quivr Prompt Endpoints Missing Ownership Validation7.1CNA v4.00.3%2026-08-28
CVE-2026-82279HyperDX Team Management Operations Missing Role-Based Access Control7.2CNA v4.00.3%2026-08-28
CVE-2026-82278BISHENG Authenticated arbitrary Python code execution via Workflow run_once8.7CNA v4.00.7%2026-08-28Fix
CVE-2026-82277argoproj argo-rollouts Argo Rollouts Dashboard Unauthenticated Mutating Operations9.3CNA v4.00.8%2026-08-28Fix
CVE-2026-82276StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate5.3CNA v3.10.4%2026-08-28
CVE-2026-82275Qwen-Agent arbitrary file read via Caller-Supplied Document Path8.7CNA v4.00.5%2026-08-28
CVE-2026-82274Twenty open redirect via OAuth Propagator Callback5.3CNA v4.00.3%2026-08-28
CVE-2026-82273Mastra Memory API Thread Ownership Check is a No-op when mapUserToResourceId is Unset7.1CNA v4.00.4%2026-08-28
CVE-2026-82272Immich Locked Assets Remain Readable through Albums and Shared Links7.1CNA v4.00.4%2026-08-28
CVE-2026-82271R2R Missing Ownership Check allows Modifying other Users' Conversations7.1CNA v4.00.3%2026-08-28
CVE-2026-82270Portkey AI Gateway server-side request forgery via /v1/proxy/*8.7CNA v4.00.5%2026-08-28
CVE-2026-82269Gophish Account Lockout and Forced Password Change Bypassable via API Key8.6CNA v4.00.4%2026-08-28
CVE-2026-82268Qwen-Agent server-side request forgery via Caller-Supplied Document URL8.7CNA v4.00.4%2026-08-28
CVE-2026-82267Komodo Resource Identifier Disclosure and Audit Log Pollution before Permission Check5.3CNA v4.00.3%2026-08-28
CVE-2026-82266Redpanda Admin API Unauthenticated Superuser Access via Default Configuration9.3CNA v4.00.6%2026-08-28
CVE-2026-82265Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure6.9CNA v4.00.4%2026-08-28
CVE-2026-82264Duplicacy path traversal during Restore via Unsanitized Snapshot Paths6.1CNA v4.00.7%2026-08-28
CVE-2026-82263Logto server-side request forgery via OIDC SSO Connector Issuer URL8.2CNA v4.00.5%2026-08-28
CVE-2026-82262Logto server-side request forgery via webhook test endpoint8.2CNA v4.00.5%2026-08-28
CVE-2026-82261SvelteKit CPU exhaustion via remote form deserialization8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-82260SvelteKit memory exhaustion via remote form deserialization8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-82259SvelteKit denial of service via form8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-82258SvelteKit Cross-user data disclosure via query.batch4.8NVD v3.10.2%2026-08-28Fix
CVE-2026-82257SvelteKit prototype pollution via File Input5.3CNA v4.00.4%2026-08-28Fix
CVE-2026-82256SvelteKit denial of service via Remote form6.9CNA v4.00.4%2026-08-28Fix
CVE-2026-82255gitoxide HTTP credential leak via Redirect7.6CNA v4.00.4%2026-08-28Fix
CVE-2026-82254gitoxide denial of service via gix-pack8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-82253gitoxide path traversal via Submodule Name Validation Bypass8.7CNA v4.00.7%2026-08-28Fix
CVE-2026-82252gitoxide Repository Boundary Violation via symlinked .gitmodules8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-82251gitoxide path traversal via Submodule Name8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-82250gitoxide gix-packetline denial of service7.1CNA v4.00.4%2026-08-28Fix
CVE-2026-82249gitoxide Credential Helper protocol field injection2.3CNA v4.00.3%2026-08-28Fix
CVE-2026-82248gitoxide path traversal via symlink following6.0CNA v4.00.3%2026-08-28Fix
CVE-2026-82247gitoxide HTTP Basic credential leak via URL parsing8.7CNA v4.00.4%2026-08-28Fix
CVE-2026-82246Budibase Server SSRF via Query Import7.1CNA v4.00.2%2026-08-28Fix
CVE-2026-82245Budibase missing authorization License Management7.2CNA v4.00.4%2026-08-28Fix
CVE-2026-82244Budibase remote code execution via plugin eval9.4CNA v4.00.9%2026-08-28Fix
CVE-2026-82243Budibase Server SSRF with credential leakage8.3CNA v4.00.3%2026-08-28Fix
CVE-2026-82242Budibase Cross-Application resource injection via missing authorization8.3CNA v4.00.4%2026-08-28Fix
CVE-2026-82241Budibase backend-core SSRF via incomplete default blacklist7.1CNA v4.00.3%2026-08-28Fix
CVE-2026-82240Budibase privilege escalation via User Update API8.6CNA v4.00.4%2026-08-28Fix
CVE-2026-82239Budibase authorization bypass via datasources/query8.6CNA v4.00.3%2026-08-28Fix
CVE-2026-82238filebrowser race condition via TUS concurrent PATCH uploads2.3CNA v4.00.2%2026-08-28
CVE-2026-82237filebrowser Stale Share Link via File Rename2.3CNA v4.00.2%2026-08-28
CVE-2026-82236filebrowser File Browser Share Link Exposure via file deletion2.3CNA v4.00.4%2026-08-28
CVE-2026-82235filebrowser denial of service via named pipes8.2CNA v4.00.5%2026-08-28Fix
CVE-2026-82234SiYuan SSRF via DNS-Rebinding TOCTOU8.4CNA v4.00.4%2026-08-28Fix
CVE-2026-82233SiYuan path traversal via asset.upload6.9CNA v4.00.4%2026-08-28Fix
CVE-2026-82227WPBulky WordPress plugin SQL injection8.5CNA v3.10.4%2026-08-28Fix
CVE-2026-82222GiveWP WordPress plugin remote code execution (RCE)10.0CNA v3.12.3%2026-08-28Reported exploitedNucleiExploit codeFix
CVE-2026-82220Forminator WordPress plugin Other vulnerability type vulnerability5.3CNA v3.10.3%2026-08-28Fix
CVE-2026-82181Le-yan|Medical Practice Management System Sensitive Data in URL6.8CNA v4.00.2%2026-08-28Fix
CVE-2026-82123WordPress Loops and Logic reflected XSS6.5CNA v3.10.3%2026-08-28
CVE-2026-82112houtini-ai houtini-lm code_task_files index.ts path traversal5.1CNA v4.00.4%2026-08-28
CVE-2026-82111iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal5.3CNA v4.00.5%2026-08-28Fix
CVE-2026-82090getpocket Pocket cross-site scripting9.2CNA v4.00.4%2026-08-28
CVE-2026-82089wallabag android-app cross-site scripting8.8CNA v4.00.5%2026-08-28
CVE-2026-82082Green-Computing|NUMail OS command injection9.3CNA v4.02.0%2026-08-28Fix
CVE-2026-82081wallabag server-side request forgery6.4CNA v3.10.2%2026-08-28
CVE-2026-82078PaperCut NG/MF unsafe reflection9.4CNA v4.063.5%2026-08-28KEVMetasploitExploit codeKCVFix
CVE-2026-82021NousResearch hermes-agent Hermes Agent MCP Catalog Supply Chain RCE via Mutable Branch Reference9.0CNA v4.00.3%2026-08-28Fix
CVE-2026-82020NousResearch hermes-agent Hermes Agent Credential Store Overwrite via File-Write tool7.6CNA v4.00.4%2026-08-28Fix
CVE-2026-82018IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf file6.8CNA v4.00.3%2026-08-28Fix
CVE-2026-82017IGEL OS 12 / 11 Boot Registry parameter injection via Unsigned Configuration Area8.6CNA v4.00.2%2026-08-28Fix
CVE-2026-81849Path traversal in the aws:downloadContent plugin in amazon-ssm-agent8.7CNA v4.00.9%2026-08-28Fix
CVE-2026-81777Essential Addons for Elementor WordPress plugin bypass vulnerability vulnerability5.3CNA v3.10.4%2026-08-28Fix
CVE-2026-81767Simple Payment WordPress plugin broken access control7.5CNA v3.10.3%2026-08-28Fix
CVE-2026-81761WpEvently WordPress plugin broken access control4.3CNA v3.10.3%2026-08-28Fix
CVE-2026-81760JetEngine WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-08-28Fix
CVE-2026-81759WpEvently WordPress plugin broken access control5.4CNA v3.10.3%2026-08-28Fix
CVE-2026-81757Rank Math SEO WordPress plugin remote code execution (RCE)7.2CNA v3.10.8%2026-08-28Fix
CVE-2026-81733WWBN AVideo CSRF via myLiveControls.save.json.php5.1CNA v4.00.2%2026-08-28
CVE-2026-81732WWBN AVideo information disclosure via report4.json.php6.9CNA v4.00.6%2026-08-28
CVE-2026-81578PaperCut NG/MF missing authentication for critical function8.8CNA v4.085.6%2026-08-28KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2026-81533MongoDB BI Connector ODBC Driver Memory-Safety issue when Parsing Oversized LIMIT Values6.0CNA v4.00.4%2026-08-28Fix
CVE-2026-81532BI Connector ODBC Driver Improper Bounds Checking on Cursor Name leading to memory corruption8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-81520MongoDB Connector for BI Unbounded Authentication Negotiation leading to Connection Exhaustion8.7CNA v4.00.4%2026-08-28Fix
CVE-2026-81518BI Connector Optional Client Certificate Verification allows Unauthenticated Connections8.7CNA v4.00.3%2026-08-28Fix
CVE-2026-81517MongoDB Connector for BI improper error handling of Log Write Failures may cause Loss of SQL service8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-81490MongoDB BI Connector schema sampling improper error handling8.3CNA v4.00.4%2026-08-28Fix
CVE-2026-81341wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records6.5CNA v3.10.3%2026-08-28Fix
CVE-2026-81299WP Job Portal WordPress plugin insecure direct object references (IDOR)4.3CNA v3.10.3%2026-08-28Fix
CVE-2026-81285Smush Image Compression and Optimization WordPress plugin denial of service Attack7.5CNA v3.10.5%2026-08-28Fix
CVE-2026-81284ACF Extended WordPress plugin broken access control4.3CNA v3.10.3%2026-08-28Fix
CVE-2026-81020wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record7.4CNA v3.10.4%2026-08-28Fix
CVE-2026-81019wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record7.4CNA v3.10.4%2026-08-28Fix
CVE-2026-80724Linux kernel vmclock PTP driver vulnerability8.8CNA v3.10.2%2026-08-28Exploit codeFix
CVE-2026-80723Linux kernel reserved-memory device tree parsing vulnerability8.4CNA v3.10.1%2026-08-28Fix
CVE-2026-80722Linux kernel mac80211 TWT setup vulnerability8.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80721Linux kernel Bluetooth ISO socket vulnerability8.8CNA v3.10.4%2026-08-28Fix
CVE-2026-80720Linux kernel iomap I/O end splitting deadlock7.5CNA v3.10.6%2026-08-28Fix
CVE-2026-80719Linux kernel multi-gen LRU memcg reparenting vulnerability–0.2%2026-08-28Fix
CVE-2026-80718In the Linux kernel, the following vulnerability has been resolved: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() In pcpu_create_chunk(), nr_pages is the total contiguous backing allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() uses it to set chunk7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80717Linux kernel SCTP INIT parameter parsing vulnerability7.5CNA v3.10.3%2026-08-28Fix
CVE-2026-80716Linux kernel ALSA PCM drain vulnerability7.8CNA v3.10.1%2026-08-28Fix
CVE-2026-80715Linux kernel igc Ethernet driver NAPI vulnerability–0.2%2026-08-28Fix
CVE-2026-80714Linux kernel IPVS connection synchronization vulnerability9.8CNA v3.10.5%2026-08-28Fix
CVE-2026-80713Linux kernel io_uring task restrictions vulnerability8.4CNA v3.10.2%2026-08-28Fix
CVE-2026-80712Linux kernel spi-qpic-snand driver vulnerability8.4CNA v3.10.2%2026-08-28Fix
CVE-2026-80711Linux kernel max17040 fuel gauge driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80710Linux kernel DASD format-check buffer vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80709Linux kernel zcrypt EP11 CPRB processing vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80708Linux kernel zcrypt CCA clear key import information disclosure–0.2%2026-08-28Fix
CVE-2026-80707Linux kernel J1939 transport receive buffer vulnerability7.5CNA v3.10.3%2026-08-28Fix
CVE-2026-80706Linux kernel Softing CAN firmware loader vulnerability7.8CNA v3.10.1%2026-08-28Fix
CVE-2026-80705Linux kernel amdgpu display phantom plane allocation vulnerability–0.2%2026-08-28Fix
CVE-2026-80704Linux kernel AMD display driver null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80703Linux kernel amdkfd debug trap interface incorrect authorization–0.2%2026-08-28Fix
CVE-2026-80702Linux kernel vmwgfx resource management vulnerability7.8CNA v3.10.1%2026-08-28Fix
CVE-2026-80701Linux kernel vmwgfx cursor plane vulnerability–0.2%2026-08-28Fix
CVE-2026-80700Linux kernel vmwgfx buffer object copy vulnerability7.8CNA v3.10.1%2026-08-28Fix
CVE-2026-80699Linux kernel KVM arm64 vgic vulnerability–0.2%2026-08-28Fix
CVE-2026-80698Linux kernel IDXD workqueue, engine and group teardown double free–0.2%2026-08-28Fix
CVE-2026-80697Linux kernel EROFS page cache sharing null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80696Linux kernel LTC4282 hwmon driver vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80695Linux kernel SHT3X hwmon driver denial of service–0.2%2026-08-28Fix
CVE-2026-80694Linux kernel mtk_eth_soc ethernet driver denial of service9.8CNA v3.10.5%2026-08-28Fix
CVE-2026-80693Linux kernel idpf interrupt vector allocation vulnerability9.3CNA v3.10.2%2026-08-28Fix
CVE-2026-80692Linux kernel Bluetooth HCI sync connection callbacks use-after-free8.8CNA v3.10.4%2026-08-28Fix
CVE-2026-80691Linux kernel SCSI target iblock persistent reservation vulnerability7.5CNA v3.10.4%2026-08-28Fix
CVE-2026-80690Linux kernel UFS RPMB list initialization null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80689Linux kernel mmiotrace logging functions null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80688Linux kernel RISC-V unaligned access speed probe vulnerability–0.2%2026-08-28Fix
CVE-2026-80687Linux kernel IOMMUFD vDEVICE allocation deadlock–0.2%2026-08-28Fix
CVE-2026-80686Linux kernel migrate_device crash–0.2%2026-08-28Fix
CVE-2026-80685Linux kernel page snapshot for order-1 folios vulnerability7.1CNA v3.10.2%2026-08-28Fix
CVE-2026-80684Linux kernel KVM s390 PCI AIBV allocation null pointer dereference9.3CNA v3.10.2%2026-08-28Fix
CVE-2026-80683Linux kernel Bluetooth SCO connection reference counting vulnerability8.8CNA v3.10.4%2026-08-28Fix
CVE-2026-80682Linux kernel RISC-V vmemmap alignment vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80681Linux kernel vxlan driver use-after-free9.8CNA v3.10.5%2026-08-28Fix
CVE-2026-80680Linux kernel amd-mp2 I2C driver vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80679Linux kernel s390 DASD space release null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80678Linux kernel i.MX I2C slave registration null pointer dereference8.4CNA v3.10.1%2026-08-28Fix
CVE-2026-80677Linux kernel driver core sync-state check vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80676Linux kernel VMBUS driver override handling use-after-free–0.2%2026-08-28Fix
CVE-2026-80675Linux kernel libbpf signed loader vulnerability7.1CNA v3.10.2%2026-08-28Fix
CVE-2026-80674Linux kernel NTFS attribute list validation vulnerability9.8CNA v3.10.6%2026-08-28Fix
CVE-2026-80673Linux kernel NTFS attribute list parsing vulnerability9.8CNA v3.10.6%2026-08-28Fix
CVE-2026-80672Linux kernel NTFS logfile restart area parsing vulnerability8.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80671Linux kernel perf sched register_pid buffer overflow9.3CNA v3.10.2%2026-08-28Fix
CVE-2026-80670Linux kernel perf tools CPU topology resolution vulnerability9.1CNA v3.10.7%2026-08-28Fix
CVE-2026-80669Linux kernel BPF LSM xfrm_decode_session hook denial of service–0.2%2026-08-28Fix
CVE-2026-80668Linux kernel netfilter conntrack expectation handling vulnerability9.8CNA v3.10.7%2026-08-28Fix
CVE-2026-80667Linux kernel mlx5 LAG MPESW driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80666Linux kernel Bluetooth SCO socket deadlock–0.2%2026-08-28Fix
CVE-2026-80665Linux kernel KVM arm64 nested virtualization denial of service7.1CNA v3.10.2%2026-08-28Fix
CVE-2026-80664Linux kernel netfilter xt_nat target null pointer dereference7.3CNA v3.10.1%2026-08-28Fix
CVE-2026-80663Linux kernel intel-speed-select tool vulnerability7.1CNA v3.10.1%2026-08-28Fix
CVE-2026-80662Linux kernel CXL RAS capability handling vulnerability7.1CNA v3.10.2%2026-08-28Fix
CVE-2026-80661Linux kernel UFS driver tracing vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80660Linux kernel occ hwmon driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80659Linux kernel vub300 MMC driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80658Linux kernel rockchip dw_dp driver null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80657Linux kernel amdxdna accelerator driver null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80656Linux kernel HFS+ B-tree node parsing vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80655Linux kernel ZynqMP power management driver race condition–0.2%2026-08-28Fix
CVE-2026-80654Linux kernel Xilinx SoC mailbox driver use-after-free–0.2%2026-08-28Fix
CVE-2026-80653Linux kernel hisi_sas v3 hardware driver vulnerability8.4CNA v3.10.2%2026-08-28Fix
CVE-2026-80652Linux kernel ccp PDH export handling denial of service–0.2%2026-08-28Fix
CVE-2026-80651Linux kernel ccp sev-dev-tsm driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80650Linux kernel atomisp gc2235 camera sensor driver use-after-free–0.2%2026-08-28Fix
CVE-2026-80649Linux kernel ARM SCMI power domain driver vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80648Linux kernel SpacemiT pin control driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80647Linux kernel HNS RoCE completion queue vulnerability–0.2%2026-08-28Fix
CVE-2026-80646Linux kernel IPv6 device statistics vulnerability7.5CNA v3.10.7%2026-08-28Fix
CVE-2026-80645Linux kernel RapidIO tsi721 doorbell handling vulnerability8.1CNA v3.10.4%2026-08-28Fix
CVE-2026-80644Linux kernel OCFS2 journal denial of service–0.2%2026-08-28Fix
CVE-2026-80643Linux kernel igen6 EDAC driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80642Linux kernel Live Update FLB subsystem use-after-free–0.2%2026-08-28Fix
CVE-2026-80641Linux kernel wlcore Wi-Fi driver cipher configuration vulnerability–0.2%2026-08-28Fix
CVE-2026-80640Linux kernel CXL fwctl driver buffer overflow–0.2%2026-08-28Fix
CVE-2026-80639Linux kernel CXL test emulation driver buffer overflow–0.2%2026-08-28Fix
CVE-2026-80638Linux kernel OCFS2 refcount tree out-of-bounds write8.8CNA v3.10.5%2026-08-28Fix
CVE-2026-80637Linux kernel netfilter SYNPROXY timestamp handling vulnerability7.5CNA v3.10.6%2026-08-28Fix
CVE-2026-80636Linux kernel netfilter connection tracking extensions vulnerability–0.2%2026-08-28Fix
CVE-2026-80635Linux kernel wcn36xx Wi-Fi driver out-of-bounds read8.8CNA v3.10.4%2026-08-28Fix
CVE-2026-80634Linux kernel netfilter flowtable bridge VLAN handling vulnerability9.8CNA v3.10.7%2026-08-28Fix
CVE-2026-80633Linux kernel IOMMUFD DMA-BUF handling vulnerability8.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80632Linux kernel mt7996 Wi-Fi driver null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80631Linux kernel Btrfs LZO decompression vulnerability7.5CNA v3.10.4%2026-08-28Fix
CVE-2026-80630Linux kernel fq_codel queueing discipline vulnerability9.8CNA v3.10.8%2026-08-28Fix
CVE-2026-80629Linux kernel OcteonTX2 NPC driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80628Linux kernel ALSA sequencer OSS emulation race condition7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80627Linux kernel MIPS memory attribute region walker out-of-bounds write–0.2%2026-08-28Fix
CVE-2026-80626Linux kernel powerpc perf subsystem vulnerability–0.2%2026-08-28Fix
CVE-2026-80625Linux kernel HNS RoCE driver bonding resources memory leak–0.2%2026-08-28Fix
CVE-2026-80624Linux kernel cs42l43 firmware loading vulnerability–0.2%2026-08-28Fix
CVE-2026-80623Linux kernel CoreSight ETE power management vulnerability–0.2%2026-08-28Fix
CVE-2026-80622Linux kernel tlclk driver use-after-free7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80621Linux kernel dwc PCI driver null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80620Linux kernel PCI MSI-X region unmapping vulnerability–0.2%2026-08-28Fix
CVE-2026-80619Linux kernel AppArmor profile replacement use-after-free7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80618Linux kernel amdkfd doorbell and MMIO buffer objects vulnerability–0.2%2026-08-28Fix
CVE-2026-80617Linux kernel airoha heap-based buffer overflow9.8CNA v3.10.7%2026-08-28Fix
CVE-2026-80616Linux kernel ieee802154 driver vulnerability–0.2%2026-08-28Fix
CVE-2026-80615Linux kernel tunnel destination metadata buffer overflow8.2CNA v3.10.5%2026-08-28Fix
CVE-2026-80614Linux kernel emac driver null pointer dereference7.5CNA v3.10.6%2026-08-28Fix
CVE-2026-80613Linux kernel veth XDP driver vulnerability7.8CNA v3.10.1%2026-08-28Fix
CVE-2026-80612Linux kernel lightweight tunnel encapsulation vulnerability9.8CNA v3.10.6%2026-08-28Fix
CVE-2026-80611Linux kernel ACPI low power idle vulnerability–0.2%2026-08-28Fix
CVE-2026-80610Linux kernel ENETC driver divide-by-zero–0.2%2026-08-28Fix
CVE-2026-80609Linux kernel qede driver vulnerability9.8CNA v3.10.7%2026-08-28Fix
CVE-2026-80608Linux kernel amdxdna accelerator driver use-after-free8.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80607Linux kernel BTF kprobe argument parsing denial of service–0.2%2026-08-28Fix
CVE-2026-80606Linux kernel Xe GPU userptr driver vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80605Linux kernel picoLCD HID driver null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80604Linux kernel HID core report handling out-of-bounds read8.8CNA v3.10.4%2026-08-28Fix
CVE-2026-80603Linux kernel netfilter IRC conntrack helper out-of-bounds read9.1CNA v3.10.6%2026-08-28Fix
CVE-2026-80602Linux kernel AMD LBR performance monitoring vulnerability–0.2%2026-08-28Fix
CVE-2026-80601Linux kernel batman-adv driver use-after-free8.8CNA v3.10.4%2026-08-28Fix
CVE-2026-80600Linux kernel BATMAN-adv ARP table handling use-after-free9.8CNA v3.10.7%2026-08-28Fix
CVE-2026-80599Linux kernel batman-adv driver out-of-bounds access8.1CNA v3.10.4%2026-08-28Fix
CVE-2026-80598Linux kernel ntfs3 LZNT decompression out-of-bounds read7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80597Linux kernel vmu-flash MTD driver initialization null pointer dereference–0.2%2026-08-28Fix
CVE-2026-80596Linux kernel ims-pcu sysfs attribute exposure denial of service8.4CNA v3.10.2%2026-08-28Fix
CVE-2026-80595Linux kernel ims-pcu device response handling out-of-bounds read–0.2%2026-08-28Fix
CVE-2026-80594Linux kernel ims-pcu CDC union descriptor parsing denial of service–0.2%2026-08-28Fix
CVE-2026-80593Linux kernel asus_atk0110 hwmon ACPI package parsing out-of-bounds read8.4CNA v3.10.2%2026-08-28Fix
CVE-2026-80592Linux kernel DAMON mtier sample module vulnerability–0.2%2026-08-28Fix
CVE-2026-80591Linux kernel f2fs listxattr vulnerability7.8CNA v3.10.2%2026-08-28Fix
CVE-2026-80590Linux kernel IP fragment reassembly vulnerability8.6CNA v3.10.6%2026-08-28Fix
CVE-2026-79996User Registration and Membership WordPress plugin privilege escalation7.2CISA ADP v3.10.5%2026-08-28Fix
CVE-2026-79995User Registration and Membership WordPress plugin Pending email Change Cancellation via IDOR4.3CISA ADP v3.10.3%2026-08-28Fix
CVE-2026-79706Breeze Cache WordPress plugin unauthenticated file creation via Cache path traversal5.3CISA ADP v3.10.3%2026-08-28Fix
CVE-2026-79615Quiz And Survey Master WordPress plugin Cross-Quiz Question Bank and Answer key disclosure2.7CISA ADP v3.10.3%2026-08-28Fix
CVE-2026-78238Tsuyoshi Saito SOY Gallery cross-site scripting4.8CNA v4.00.2%2026-08-28
CVE-2026-78073Joomla extension j2commerce.com reflected XSS attribute in All Video Share5.3CNA v4.00.4%2026-08-28
CVE-2026-78072Joomla Extension Jefferson49 Unauthenticated blind SQLi in Sexy Polling Reloaded8.7CNA v4.00.4%2026-08-28
CVE-2026-78071Joomla extension digital-peak.com Authenticated, privileged stored XSS in DP Calendar7.5CNA v4.00.4%2026-08-28Exploit code
CVE-2026-78070Joomla extension digital-peak.com Authenticated, privileged blind SQL injection in DP Calendar6.9CNA v4.00.4%2026-08-28Exploit code
CVE-2026-78032Tsuyoshi Saito SOY CMS deserialization of untrusted data9.3CNA v4.00.6%2026-08-28
CVE-2026-77939Flextype CMS RCE via POST /API/v1/query endpoint7.1CNA v4.00.6%2026-08-28
CVE-2026-77838Tsuyoshi Saito SOY Calendar cross-site scripting4.8CNA v4.00.2%2026-08-28
CVE-2026-77701WCFM Marketplace WordPress plugin unauthenticated Refund request creation on Guest orders5.3CISA ADP v3.10.3%2026-08-28Fix
CVE-2026-77586MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output8.5CNA v4.00.4%2026-08-28Fix
CVE-2026-77365Optimole WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-08-28Fix
CVE-2026-77218PLANET GS-4210-16P2S V3 stack buffer overflow via dispatcher.cgi Credential Handlers6.9CNA v4.00.6%2026-08-28Fix
CVE-2026-77217PLANET GS-4210-16P2S V3 stack buffer overflow and null pointer dereference6.9CNA v4.00.6%2026-08-28Fix
CVE-2026-77184MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output5.6CNA v4.00.3%2026-08-28Fix
CVE-2026-77078multer vulnerable to denial of service via crafted multipart field names7.5CNA v3.10.5%2026-08-28Exploit codeFix
CVE-2026-77063multer vulnerable to file size limit bypass via async fileFilter race condition3.7CNA v3.10.2%2026-08-28Fix
CVE-2026-77037multer vulnerable to denial of service via file descriptor leak on aborted uploads7.5CNA v3.10.3%2026-08-28Fix
CVE-2026-76798MongoSQL Transition Readiness Tool improper output encoding in Generated HTML Reports6.9CNA v4.00.3%2026-08-28Fix
CVE-2026-76797MongoSQL Transition Readiness Tool improper neutralization of Formula Elements in Generated Reports5.8CNA v4.00.4%2026-08-28Fix
CVE-2026-76794MongoDB BI Connector Transition Readiness Report generated HTML report cross-site scripting4.8CNA v4.00.2%2026-08-28Fix
CVE-2026-76651Pre-Authentication Multipart Boundary buffer overflow in HTTP service in TP-Link TL-WR841N5.3CNA v4.00.4%2026-08-28Fix
CVE-2026-76650TP-Link System TL-WR841N v14 A null pointer dereference5.3CNA v4.00.3%2026-08-28Fix
CVE-2026-76649TP-Link System TL-WR841N v14 A null pointer dereference5.3CNA v4.00.3%2026-08-28Fix
CVE-2026-76581WPMU DEV Dashboard WordPress plugin authentication bypass to Administrator9.8CNA v3.10.4%2026-08-28Reported exploitedExploit codeFix
CVE-2026-76053TranslatePress WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.8%2026-08-28Fix
CVE-2026-75758elixir-lang elixir uncontrolled recursion5.9CNA v4.00.2%2026-08-28Fix
CVE-2026-75486Snyk sweater-comb Synk Sweater Comb command injection via .vervet.yaml Branch Name8.5CNA v4.02.3%2026-08-28Fix
CVE-2026-75126PLANET GS-4210-16P2S V3 stack buffer overflow via dispatcher.cgi Standard Handlers6.9CNA v4.00.6%2026-08-28Fix
CVE-2026-75125PLANET GS-4210-16P2S V3 null pointer dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post6.9CNA v4.00.6%2026-08-28Fix
CVE-2026-75124PLANET GS-4210-16P2S V3 memory corruption via dispatcher.cgi _readHttpParam8.7CNA v4.00.7%2026-08-28Fix
CVE-2026-75123PLANET GS-4210-16P2S V3 command injection via dispatcher.cgi web_smtp_test_post8.6CNA v4.01.5%2026-08-28Fix
CVE-2026-75122PLANET GS-4210-16P2S V3 command injection via httpuploadcert.cgi8.6CNA v4.00.9%2026-08-28Fix
CVE-2026-75121PLANET GS-4210-16P2S V3 command injection via dispatcher.cgi web_vlan_membership_edit_dialog_post8.6CNA v4.01.5%2026-08-28Fix
CVE-2026-75118TP-Link Systems TL-MR100 http_gdpr_decrypt Pre-authentication stack-based buffer overflow8.7CNA v4.00.4%2026-08-28Fix
CVE-2026-73827Tsuyoshi Saito SOY Calendar cross-site scripting4.8CNA v4.00.2%2026-08-28
CVE-2026-73209Open-Xchange OX Dovecot Pro uncontrolled recursion6.5CNA v3.10.4%2026-08-28Fix
CVE-2026-73208Open-Xchange OX Dovecot Pro improper authentication7.4CNA v3.10.3%2026-08-28Fix
CVE-2026-72984Microsoft Edge (Chromium-based) remote code execution8.8CNA v3.10.8%2026-08-28Fix
CVE-2026-70331Microsoft Edge for iOS spoofing5.4CNA v3.10.4%2026-08-28Fix
CVE-2026-70309Microsoft Edge (Chromium-based) security feature bypass5.4CNA v3.10.2%2026-08-28Fix
CVE-2026-66798Microsoft Edge (Chromium-based) remote code execution4.3CNA v3.10.8%2026-08-28Fix
CVE-2026-66324Microsoft Edge (Chromium-based) spoofing6.5CNA v3.10.9%2026-08-28Fix
CVE-2026-66323Microsoft Edge (Chromium-based) remote code execution5.4CNA v3.10.4%2026-08-28Fix
CVE-2026-62904Microsoft Edge (Chromium-based) information disclosure5.4CNA v3.10.4%2026-08-28Fix
CVE-2026-58616Copilot Chat (Microsoft Edge) information disclosure4.4CNA v3.10.3%2026-08-28Fix
CVE-2026-58107Ericsson CodeChecker authenticated remote denial of service5.5CNA v4.00.4%2026-08-28Fix
CVE-2026-58106Ericsson CodeChecker ldlogger GCC log tool out-of-bounds write2.0CNA v4.00.2%2026-08-28
CVE-2026-56854golang.org/x/crypto/ssh authentication callbacks incorrect authorization7.5CISA ADP v3.10.4%2026-08-28Fix
CVE-2026-56100SpringBlade privilege escalation via Exposed Feign endpoint8.6CNA v4.00.5%2026-08-28Fix
CVE-2026-55891PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI0.0CNA v3.10.5%2026-08-28Fix
CVE-2026-55867Graylog token revocation endpoint insecure direct object reference5.3CNA v4.00.6%2026-08-28Fix
CVE-2026-55860Org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server5.9CNA v3.10.2%2026-08-28Fix
CVE-2026-55859MariaDB Connector/R2DBC character set handling improper output encoding5.9CNA v3.10.5%2026-08-28Fix
CVE-2026-55858MariaDB Connector/J character set handling vulnerability5.9CNA v3.10.9%2026-08-28Fix
CVE-2026-55857MariaDB Connector/J PAM dialog authentication information disclosure5.9CNA v3.10.4%2026-08-28Fix
CVE-2026-55856MariaDB Connector/J initial handshake authentication information disclosure5.9CNA v3.10.4%2026-08-28Fix
CVE-2026-55855MariaDB Connector/Node.js Buffer parameter escaping SQL injection6.5CNA v3.10.5%2026-08-28Fix
CVE-2026-55854MariaDB Connector/Node.js PAM dialog authentication information disclosure5.9CNA v3.10.4%2026-08-28Fix
CVE-2026-55848MapFish Print has XXE that allows reading arbitrary files of certain types8.6CNA v3.10.5%2026-08-28Fix
CVE-2026-55841Graylog FortiGate syslog parser vulnerability7.5CNA v3.10.6%2026-08-28Fix
CVE-2026-55834pocket-id pocket ID: Open redirect on the OIDC /authorize page4.3CNA v3.10.4%2026-08-28Fix
CVE-2026-55785free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA3.7CNA v3.10.4%2026-08-28Fix
CVE-2026-55784free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI7.5CNA v3.10.4%2026-08-28
CVE-2026-55779Silverstripe Versioned: XSS in archive admin restore5.4CNA v3.10.3%2026-08-28Fix
CVE-2026-55764Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-55763Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits8.7CNA v4.00.5%2026-08-28Fix
CVE-2026-55696PrivateBin attachment download link cross-site scripting4.3CNA v3.10.4%2026-08-28Fix
CVE-2026-55678Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset6.9CNA v4.00.7%2026-08-28Fix
CVE-2026-55673PowSyBl: Command injection in LocalCommandExecutor-s7.1CNA v4.00.6%2026-08-28Fix
CVE-2026-55634Pimcore: Remote code execution via DataObject Class-Definition Field Name9.9CNA v3.10.7%2026-08-28Fix
CVE-2026-55584phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers7.5CNA v3.11.9%2026-08-28Exploit codeFix
CVE-2026-55569aqua archive extraction link following6.6CNA v3.10.2%2026-08-28Fix
CVE-2026-55566Yamcs: DOM XSS in Extension Routing4.3CNA v3.10.4%2026-08-28Fix
CVE-2026-55565Yamcs: Authenticated remote code execution9.9CNA v3.10.7%2026-08-28Fix
CVE-2026-55559Yamcs: Remote code execution via instance-template argument YAML injection (createInstance)9.8CNA v3.10.8%2026-08-28Exploit codeFix
CVE-2026-55552Yamcs: Unauthenticated directory traversal7.5CNA v3.10.5%2026-08-28NucleiFix
CVE-2026-55549Yamcs: Reflected XSS in the URL of the Authorize endpoint6.5CNA v3.11.3%2026-08-28NucleiFix
CVE-2026-55547Yamcs role and privilege enumeration endpoints missing authorization4.3CNA v3.10.3%2026-08-28Fix
CVE-2026-55545Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce6.5CNA v3.10.5%2026-08-28Fix
CVE-2026-55521Yamcs: Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API8.8CNA v3.10.5%2026-08-28Fix
CVE-2026-55520Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching7.1CNA v4.00.5%2026-08-28Fix
CVE-2026-55511Yamcs: Authenticated RCE9.1CNA v3.10.7%2026-08-28Exploit codeFix
CVE-2026-55509WsgiDAV: Blind SQL injection in the MySQL provider8.8CNA v4.00.5%2026-08-28Fix
CVE-2026-55485piccolo-orm piccolo_admin piccolo Admin: Privilege escalation admin to superuser8.8CNA v3.10.6%2026-08-28Fix
CVE-2026-55484ALOS HTTP request path sanitizer denial of service7.5CNA v3.10.5%2026-08-28Fix
CVE-2026-55425Graylog system catalog titles endpoint information disclosure5.0CNA v3.10.4%2026-08-28Fix
CVE-2026-55378shriyanss js-recon JS Recon: Command injection in PR Branch Checker workflow9.3CNA v4.00.8%2026-08-28Fix
CVE-2026-55248plone.app.portlets vulnerable to denial of service via RSS feed portlet9.1CNA v3.10.4%2026-08-28Fix
CVE-2026-55247plone.app.event vulnerable to denial of service via iCalendar import9.1CNA v3.10.4%2026-08-28Fix
CVE-2026-55245Bifrost URL fetch validation server-side request forgery8.7CNA v4.00.6%2026-08-28Fix
CVE-2026-55220Pimcore Hotspotimage data object insecure deserialization9.3CNA v4.00.7%2026-08-28Fix
CVE-2026-55215MariaDB Connector/Node.js TLS handshake authentication information disclosure7.5CNA v3.10.6%2026-08-28Fix
CVE-2026-55108KubeVela Terraform remote loader DoS via unbounded file read8.5CNA v3.10.8%2026-08-28Fix
CVE-2026-55068free5GC NRF NF registration improper input validation9.3CNA v4.00.6%2026-08-28Fix
CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment5.0CNA v3.10.3%2026-08-28Fix
CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id7.1CNA v3.10.4%2026-08-28Fix
CVE-2026-55065Vikunja: Improper authorization and authorization bypass8.1CNA v3.10.5%2026-08-28Fix
CVE-2026-55064Vikunja project hierarchy permission check missing authorization4.3CNA v3.10.4%2026-08-28Fix
CVE-2026-54788DataDog dd-trace-rs datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS7.5CNA v3.10.8%2026-08-28Fix
CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent project5.3CNA v4.00.4%2026-08-28Fix
CVE-2026-54755Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV9.6CNA v3.10.6%2026-08-28Fix
CVE-2026-54754Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid9.6CNA v3.10.4%2026-08-28Fix
CVE-2026-54746Hatchet: Cross-tenant write/DoS to other tenants' workers6.4CNA v3.10.4%2026-08-28Fix
CVE-2026-54745Kubeflow Pipelines frontend proxy route server-side request forgery10.0CNA v3.10.6%2026-08-28Fix
CVE-2026-52687Open-Xchange OX Dovecot Pro denial of service6.5CNA v3.10.4%2026-08-28Fix
CVE-2026-52681Open-Xchange OX Dovecot Pro and CE Sieve CPU accounting denial of service3.1CNA v3.10.3%2026-08-28Fix
CVE-2026-51665TOTOLINK T6 getTracerouteCfg function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51664TOTOLINK T6 getTelnetCfg function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51663TOTOLINK T6 getWiFiApcliScan function improper access control9.8CISA ADP v3.10.6%2026-08-28
CVE-2026-51662TOTOLINK T6 getCloudSrvCheckStatus function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51661TOTOLINK T6 getPortForwardRules function improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51660TOTOLINK T6 getIpPortFilterRules function improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51659TOTOLINK T6 getUrlFilterRules function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51658TOTOLINK T6 DMZ configuration endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51657TOTOLINK T6 syslog configuration endpoint improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51656TOTOLINK T6 VPN passthrough endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51655TOTOLINK T6 MAC filter endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51654TOTOLINK T6 schedule configuration endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51653TOTOLINK T6 storage configuration endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51652TOTOLINK T6 UPnP configuration endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51651TOTOLINK T6 Smart QoS endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51650TOTOLINK T6 remote management endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51649TOTOLINK T6 diagnostic configuration endpoint improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51648TOTOLINK T6 WAN information endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51647TOTOLINK T6 cloud remote control status endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51646TOTOLINK T6 parental control endpoint improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51645TOTOLINK T6 administrative password endpoint improper access control9.8CISA ADP v3.10.6%2026-08-28
CVE-2026-51644TOTOLINK T6 cloud remote control endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51643TOTOLINK T6 NTP configuration endpoint improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51642TOTOLINK T6 mesh routing endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51641TOTOLINK T6 mesh configuration endpoint improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51640TOTOLINK T6 mesh neighbor endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51639TOTOLINK T6 AP Wi-Fi scheduling endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51638TOTOLINK T6 guest Wi-Fi configuration endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51637TOTOLINK T6 mesh portal endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51636TOTOLINK T6 Wi-Fi ACL rules endpoint improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51635TOTOLINK T6 Wi-Fi scheduling endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51634TOTOLINK T6 Wi-Fi configuration endpoint improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51633TOTOLINK T6 getWiFiEasyGuestCfg function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51632TOTOLINK T6 getWiFiAdvancedCfg function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51631TOTOLINK T6 getStaticDhcpRules function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51630TOTOLINK T6 getDdnsCfg function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51629TOTOLINK T6 getStaticDhcpRules function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51628TOTOLINK T6 getGenerateWiFiWpsPin function improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51627TOTOLINK T6 getIptvCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51626TOTOLINK T6 getWiFiWpsCfg function improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51625TOTOLINK T6 getWiFiEasyCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51624TOTOLINK T6 getStationMacByIp function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51623TOTOLINK T6 getDdnsStatus function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51622TOTOLINK T6 getWanCfg function improper access control9.1CISA ADP v3.10.5%2026-08-28
CVE-2026-51621TOTOLINK T6 getInitCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51620TOTOLINK T6 getNetInfoCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51619TOTOLINK T6 getOnlineClient function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51618TOTOLINK T6 getWizardCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51617TOTOLINK T6 getSysStatusCfg function improper access control7.5CISA ADP v3.10.3%2026-08-28
CVE-2026-51616TOTOLINK T6 getWanIeCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51615TOTOLINK T6 getLanCfg function improper access control7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-51614TOTOLINK T6 getAccessDeviceCfg function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51613TOTOLINK T6 getDeviceInfo function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51611TOTOLINK T6 startSlaveReboot function improper access control9.8CISA ADP v3.10.6%2026-08-28
CVE-2026-51610TOTOLINK T6 RebootSystem function improper access control4.3CISA ADP v3.10.3%2026-08-28
CVE-2026-51376BitChat for iOS mesh gossip cache denial of service6.5CISA ADP v3.10.4%2026-08-28Exploit code
CVE-2026-50980DNS lookup/management component of oPanel cross-site scripting6.1CISA ADP v3.10.4%2026-08-28Exploit code
CVE-2026-50979Osbil Technology oPanel curl tool command injection8.1CISA ADP v3.11.9%2026-08-28Exploit code
CVE-2026-42395Open-Xchange OX Dovecot Pro crash4.3CNA v3.10.4%2026-08-28Fix
CVE-2026-42393Open-Xchange OX Dovecot Pro information disclosure3.1CNA v3.10.2%2026-08-28Fix
CVE-2026-42392Open-Xchange OX Dovecot Pro uninitialized memory use4.3CNA v3.10.3%2026-08-28Fix
CVE-2026-42391Open-Xchange OX Dovecot Pro denial of service7.5CNA v3.10.4%2026-08-28Fix
CVE-2026-42008Open-Xchange OX Dovecot Pro improper authentication4.3CNA v3.10.2%2026-08-28Fix
CVE-2026-42007Open-Xchange OX Dovecot Pro use-after-free9.1CNA v3.10.3%2026-08-28Fix
CVE-2026-40541Synology Chat Server cross-site scripting9.0CNA v3.10.5%2026-08-28Fix
CVE-2026-40205Open-Xchange OX Dovecot Pro improper authentication5.9CNA v3.10.2%2026-08-28Fix
CVE-2026-40204Open-Xchange OX Dovecot Pro improper access control3.1CNA v3.10.2%2026-08-28Fix
CVE-2026-40203Open-Xchange OX Dovecot Pro information disclosure3.7CNA v3.10.3%2026-08-28Fix
CVE-2026-40019Open-Xchange OX Dovecot CE infinite loop5.9CNA v3.10.4%2026-08-28Fix
CVE-2026-40018Open-Xchange OX Dovecot Pro SQL injection7.4CNA v3.10.3%2026-08-28Fix
CVE-2026-40017Open-Xchange OX Dovecot Pro denial of service6.5CNA v3.10.3%2026-08-28Fix
CVE-2026-40015Open-Xchange OX Dovecot Pro out-of-bounds read4.3CNA v3.10.6%2026-08-28Fix
CVE-2026-40014Open-Xchange OX Dovecot Pro denial of service6.5CNA v3.10.3%2026-08-28Fix
CVE-2026-40013Open-Xchange OX Dovecot Pro buffer underflow4.3CNA v3.10.9%2026-08-28Fix
CVE-2026-39071Spiffy Plugin event title field stored cross-site scripting5.4CISA ADP v3.10.2%2026-08-28Fix
CVE-2026-39070Bit Assist call-to-action feature stored cross-site scripting4.8CISA ADP v3.10.2%2026-08-28Fix
CVE-2026-38822openNDS OS command injection7.6CNA v3.12.3%2026-08-28Fix
CVE-2026-38821openNDS A heap-based buffer overflow7.1CNA v3.10.3%2026-08-28Fix
CVE-2026-38820openNDS OS command injection8.3CNA v3.12.9%2026-08-28Fix
CVE-2026-38819openNDS memory leak5.3CNA v3.10.3%2026-08-28Fix
CVE-2026-38725PrestaShop xipblog module comment form stored cross-site scripting5.4CISA ADP v3.10.3%2026-08-28
CVE-2026-38638relibc with_argv function denial of service7.5CISA ADP v3.10.6%2026-08-28
CVE-2026-38636relibc seekdir function denial of service7.5CISA ADP v3.10.6%2026-08-28
CVE-2026-38093file_picker Android openFileStream implementation path traversal3.3CISA ADP v3.10.2%2026-08-28
CVE-2026-37751killSessionSync function An OS command injection9.8CISA ADP v3.12.9%2026-08-28
CVE-2026-37736OWASP json-sanitizer JsonSanitizer.sanitize function resource exhaustion7.5CISA ADP v3.10.5%2026-08-28
CVE-2026-37710Omeka S v.4.2.0 cross-site scripting6.1CISA ADP v3.10.5%2026-08-28
CVE-2026-37237vLLM denial of service7.5CISA ADP v3.10.7%2026-08-28Fix
CVE-2026-37236grpc-gateway ServeMux.ServeHTTP method override header improper access control9.8CISA ADP v3.10.4%2026-08-28Fix
CVE-2026-33607Open-Xchange OX Dovecot Pro denial of service4.3CNA v3.10.6%2026-08-28Fix
CVE-2026-33606Open-Xchange OX Dovecot Pro CRLF injection4.8CNA v3.10.2%2026-08-28Fix
CVE-2026-33605Open-Xchange OX Dovecot Pro crash7.5CNA v3.10.4%2026-08-28Fix
CVE-2026-33604Open-Xchange OX Dovecot Pro injection5.9CNA v3.10.3%2026-08-28Fix
CVE-2026-33263Open-Xchange OX Dovecot Pro file descriptor leak4.3CNA v3.10.6%2026-08-28Fix
CVE-2026-27852Open-Xchange OX Dovecot Pro denial of service7.5CNA v3.10.4%2026-08-28Fix
CVE-2026-22056Denial of service vulnerability in StorageGRID (formerly StorageGRID Webscale)2.3CNA v4.00.2%2026-08-28Fix
CVE-2026-19423Ultimate Member - unauthenticated privilege escalation via Role field on Profile forms8.1CISA ADP v3.10.2%2026-08-28Fix
CVE-2026-19412Hard-coded credentials vulnerability in CP Plus CP-XR-DE21-S Router8.7CNA v4.00.2%2026-08-28Fix
CVE-2026-19295IBM Langflow flow build process vulnerability9.9CNA v3.13.3%2026-08-28MetasploitExploit codeFix
CVE-2026-19294IBM Langflow private flow access insecure direct object reference6.4CNA v3.10.2%2026-08-28Fix
CVE-2026-19286IBM Langflow A2A endpoint code injection9.8CNA v3.10.8%2026-08-28Exploit codeFix
CVE-2026-19084Shared Files featured image file path handler vulnerability7.5CISA ADP v3.10.3%2026-08-28Fix
CVE-2026-18983One User Avatar User Profile Picture WordPress plugin stored cross-site scripting7.5CNA v3.10.7%2026-08-28Fix
CVE-2026-18978LiteSpeed Cache WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.4%2026-08-28Fix
CVE-2026-18918Eclipse Lyo OAuth 1.0 session-fixation chain9.1CNA v4.00.4%2026-08-28Fix
CVE-2026-18904IBM Langflow OSS user identifier namespace insecure direct object reference8.2CNA v3.10.3%2026-08-28Fix
CVE-2026-18899IBM Langflow OSS path traversal7.5CNA v3.10.5%2026-08-28Fix
CVE-2026-18891IBM Langflow OSS authentication bypass8.2CNA v3.10.3%2026-08-28Fix
CVE-2026-18729IBM Langflow code injection8.8CNA v3.11.9%2026-08-28MetasploitExploit codeFix
CVE-2026-18545IBM Langflow server-side request forgery4.3CNA v3.10.2%2026-08-28Fix
CVE-2026-18527IBM Application Runtime Expert for i ARE GUI session fixation9.9CNA v3.10.3%2026-08-28Fix
CVE-2026-18393Red Hat Enterprise Linux AI 3 ffmpeg: Ffmpeg: Heap buffer overflow in tdsc_load_cursor5.4CNA v3.10.3%2026-08-28Fix
CVE-2026-18324Forminator Forms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-08-28Fix
CVE-2026-17203IBM Administration Runtime Expert for i improper authentication7.5CNA v3.10.4%2026-08-28Fix
CVE-2026-16821IBM AIX and PowerVM VIOS format string7.0CNA v3.10.1%2026-08-28Fix
CVE-2026-16759Tutor LMS WordPress plugin unauthenticated remote code execution6.5CNA v3.10.6%2026-08-28Reported exploitedFix
CVE-2026-16654Avada (Fusion) Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-08-28Fix
CVE-2026-15798Smart Slider 3 WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-28Fix
CVE-2026-15603morgan vulnerable to Log Forging via unescaped Unicode line separators5.3CNA v3.10.3%2026-08-28Fix
CVE-2026-14567WP User Frontend WordPress plugin unauthenticated user email and Phone disclosure via user directory5.3CISA ADP v3.10.3%2026-08-28Fix
CVE-2026-14558WP User Frontend WordPress plugin Editor+ PHP object injection via AI form Builder7.2CISA ADP v3.10.5%2026-08-28Fix
CVE-2026-13761Pegasystems Pega Platform denial of service8.8CNA v4.00.3%2026-08-28Fix
CVE-2026-13735Zephyr WireGuard receive handler vulnerability3.7CNA v3.10.2%2026-08-28Fix
CVE-2026-13734Zephyr WireGuard receive handler vulnerability6.5CNA v3.10.2%2026-08-28Fix
CVE-2026-12514Shared Files WordPress plugin unauthenticated limited file upload5.3CISA ADP v3.10.2%2026-08-28Fix
CVE-2026-12513Shared Files WordPress plugin unauthenticated arbitrary file deletion via path traversal6.8CISA ADP v3.10.3%2026-08-28Exploit codeFix
CVE-2026-9548Synology Chat Server cross-site scripting6.5CNA v3.10.3%2026-08-28Fix
CVE-2026-9491Synology Chat Server server-side request forgery4.3CNA v3.10.4%2026-08-28Fix
CVE-2026-6286Booking for Appointments and Events Calendar WordPress plugin stored cross-site scripting7.2CNA v3.10.6%2026-08-28Fix
CVE-2026-6176Customer Reviews for WooCommerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-08-28Fix
CVE-2026-6128All-in-One WP Migration Unlimited Extension WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-28Fix
CVE-2026-5953Reflected XSS in Ceviz Informatics's Web Design6.1CNA v3.10.3%2026-08-28
CVE-2026-5934WP Rocket WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-08-28Fix
CVE-2026-5800Reflected XSS in Dayneks Software's E-Commerce Platform6.1CNA v3.10.3%2026-08-28
CVE-2026-5510GiveWP WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2026-08-28Fix
CVE-2026-5097wpForo Forum WordPress plugin unauthenticated SQL injection via referer parameter7.5CNA v3.10.6%2026-08-28Fix
CVE-2026-5096Everest Forms WordPress plugin unauthenticated server-side request forgery5.3CNA v3.10.4%2026-08-28Fix
CVE-2026-4378Stored XSS in Akıllı Ticaret's E-Commerce Pack5.4CNA v3.10.2%2026-08-28Fix
CVE-2026-4246ElementsKit Pro WordPress plugin unauthenticated stored cross-site scripting via s parameter6.1CNA v3.10.4%2026-08-28Fix