CVE-2026 list

CVE-2026 records published in August 2026

Page 12 of 13: records 11,001 to 12,000 of the 12,071 published in August 2026, newest first. The first page carries the figures for August 2026.

CVE-2026 records published in August 2026, newest first: records 11,001 to 12,000 of 12,071
CVE Summary CVSS EPSS Published Signals
CVE-2026-70596Ghost: Cross-site scripting in Feature Image Captions4.3CNA v3.10.3%2026-08-05Fix
CVE-2026-70595Ghost: Server-side request forgery Mitigation issue4.0CNA v3.10.3%2026-08-05Fix
CVE-2026-70448Jenkins Ivy Report Plugin XML external entity injection7.1CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70447Jenkins AWS CodeBuild Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70446Jenkins CodeSonar Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70445Jenkins Sauce OnDemand Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70444Jenkins Violation Comments to GitLab Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70443Jenkins Horreum Plugin improper privilege management4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70442Jenkins Google Chat Notification Plugin improper authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70441Jenkins Summary Display Plugin cross-site scripting5.4CISA ADP v3.10.2%2026-08-05Fix
CVE-2026-70440Jenkins Qualys Container Scanning Connector Plugin cross-site scripting5.4CISA ADP v3.10.2%2026-08-05Fix
CVE-2026-70439Jenkins XML Job to Job DSL Plugin missing authorization6.5CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70438Jenkins Parameterized Remote Trigger Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70437Jenkins Webhook Secret Credentials Provider Plugin timing side channel3.7CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70436Jenkins External Workspace Manager Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70435Jenkins SCM-Manager Plugin missing authorization4.2CISA ADP v3.10.2%2026-08-05Fix
CVE-2026-70434Jenkins SCM-Manager Plugin cross-site request forgery4.2CISA ADP v3.10.1%2026-08-05Fix
CVE-2026-70433Jenkins HCL AppScan Plugin missing authorization4.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70432Jenkins Multijob Plugin A cross-site request forgery8.8CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70431Jenkins Multijob Plugin code injection8.8CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-70430Jenkins improper access control2.7CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70429Jenkins case sensitivity bypass6.5NVD v3.10.4%2026-08-05Fix
CVE-2026-70428Jenkins path traversal4.3CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-70427Jenkins link following4.3CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-70426Jenkins deserialization of untrusted data9.0CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-70378imagecli Negative carve Ratio Bypasses Bounds Check and crashes Process via Reachable panic7.5CNA v3.10.5%2026-08-05
CVE-2026-70377imagecli Uncontrolled Memory Allocation via Unbounded scale Ratio causes denial of service7.5CNA v3.10.5%2026-08-05
CVE-2026-70376Pluck CMS CSRF via Spoofable Missing-Referer Bypass leads to stored XSS and RCE9.6CNA v3.10.2%2026-08-05Exploit code
CVE-2026-70375hashbrown-cms HashBrown CMS OS command injection via Git Deployer Branch field8.8CNA v3.11.9%2026-08-05
CVE-2026-70374hashbrown-cms HashBrown CMS OS command injection in Media Upload Thumbnail Generation8.8CNA v3.11.9%2026-08-05
CVE-2026-69111Milvus, unauthenticated denial of service via /management/stop8.7CNA v4.01.1%2026-08-05Fix
CVE-2026-68746livebook fail-open behavior7.7CNA v4.00.8%2026-08-05Fix
CVE-2026-68080Apache Qpid Broker-j: Unbounded echo flow responses can lead to denial of service6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-68078Apache Qpid Broker-j: Unable to govern the maximum number of transfer frames per incoming delivery6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-68077Apache Qpid Broker-j: Unbounded disposition range handling can lead to denial of service6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-68075Apache Qpid Broker-j: Incoming session flow control window can be exceeded6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-68074Apache Qpid Broker-J symbol value cache denial of service7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-68073Apache Qpid Broker-j: Unbounded type nesting can lead to pre-authentication stack overflow7.5v3.10.5%2026-08-05Fix
CVE-2026-68060Apache Qpid Broker-j: Type size/count handling can lead to excessive allocation pre-authentication7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-67873lib60870-C A heap-based buffer overflow9.8CISA ADP v3.10.7%2026-08-05
CVE-2026-67872Systerel S2OPC monitored item queue resizing denial of service7.5CISA ADP v3.10.8%2026-08-05
CVE-2026-67871Systerel S2OPC buffer overflow7.5CISA ADP v3.10.8%2026-08-05
CVE-2026-67870open62541 AddReferences handling null pointer dereference9.8CISA ADP v3.11.1%2026-08-05
CVE-2026-67869open62541 v1.5.5 buffer overflow7.5CNA v3.10.8%2026-08-05
CVE-2026-67867Systerel S2OPC buffer overflow7.5CISA ADP v3.10.8%2026-08-05
CVE-2026-67866Systerel S2OPC buffer overflow7.5CISA ADP v3.10.8%2026-08-05
CVE-2026-67865S2OPC RepublishResponse handling out-of-bounds read7.5CISA ADP v3.10.8%2026-08-05
CVE-2026-67864open62541 node management type instantiation denial of service7.5CISA ADP v3.10.8%2026-08-05
CVE-2026-67863open62541 MonitoredItem callback handling use-after-free7.5CNA v3.10.7%2026-08-05
CVE-2026-67623mistralai mistral-vibe mistral Vibe arbitrary command execution via git fsmonitor Hook8.6CNA v4.01.1%2026-08-05Fix
CVE-2026-67592Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery7.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-67591Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-67590Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-67589Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-67588Apache Qpid ProtonJ2 symbol value cache denial of service7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-67555Apache Qpid Proton-Dotnet transfer frame handling denial of service6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-67554Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-67553Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-67552Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-67551Apache Qpid Proton-Dotnet type size and count handling denial of service7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-67531AgentFront FrontMCP CodeCall sandbox remote code execution9.3CNA v4.00.7%2026-08-05Fix
CVE-2026-67465Apache Qpid Proton-Dotnet symbol value cache denial of service7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-66885Livebook Teams identity callback lacks state binding, allowing login CSRF6.8CNA v4.00.2%2026-08-05Fix
CVE-2026-66881livebook path traversal in imported file_entries name allows arbitrary file write7.0CNA v4.00.6%2026-08-05Fix
CVE-2026-66839Integrated Systems Technologies NetKids iMark unquoted search path8.4CNA v4.00.2%2026-08-05
CVE-2026-66747ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant9.3CNA v4.00.8%2026-08-05Emerging Threats
CVE-2026-66344Integrated Systems Technologies NetKids iMark uncontrolled search path5.4CNA v4.00.2%2026-08-05
CVE-2026-66298livebook origin validation error8.6CNA v4.00.3%2026-08-05Fix
CVE-2026-66297livebook unescaped deployment environment variables in generated setup commands5.0CNA v4.02.4%2026-08-05Fix
CVE-2026-66277Apache Qpid Proton-j: Unable to govern the maximum number of transfer frames per incoming delivery6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-66276Apache Qpid Proton-j: Unbounded disposition range handling can lead to denial of service6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-66275Apache Qpid Proton-j: Incoming session flow control window can be exceeded6.5CISA ADP v3.10.7%2026-08-05Fix
CVE-2026-66274Apache Qpid Proton-j: Unbounded type nesting can lead to pre-authentication stackoverflow7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-66273Apache Qpid Proton-j: Type size/count handling can lead to excessive allocation pre-authentication7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-66257Apache Qpid Proton-J symbol value cache resource exhaustion7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-64582Linux kernel RDMA rxe driver use-after-free7.8CNA v3.10.1%2026-08-05Fix
CVE-2026-64581Linux kernel xfrm socket destination cache double free7.8CNA v3.10.1%2026-08-05Fix
CVE-2026-64580Linux kernel xfrm6 vulnerability7.8CNA v3.10.1%2026-08-05Fix
CVE-2026-64579Linux kernel xfrm policy hash rebuild vulnerability–0.2%2026-08-05Fix
CVE-2026-64578Linux kernel ksmbd SMB2 compound request parser vulnerability8.2CNA v3.10.6%2026-08-05Fix
CVE-2026-64577Linux kernel GTP driver vulnerability7.5CNA v3.10.6%2026-08-05Fix
CVE-2026-64576Linux kernel nexthop resilient bucket migration vulnerability7.1CNA v3.10.1%2026-08-05Fix
CVE-2026-64575Linux kernel BPF TCP iterator batching vulnerability7.8CNA v3.10.1%2026-08-05Fix
CVE-2026-64574Linux kernel mac80211 link debugfs use-after-free7.8CNA v3.10.1%2026-08-05Fix
CVE-2026-64573Linux kernel Bluetooth QCA NVM TLV parser integer underflow–0.2%2026-08-05Fix
CVE-2026-64572Linux kernel IPv4 FIB alias insertion use-after-free–0.2%2026-08-05Fix
CVE-2026-64571Linux kernel p54 wireless driver EEPROM readback vulnerability–0.2%2026-08-05Fix
CVE-2026-64570Linux kernel mac80211 FILS discovery template double free7.8CNA v3.10.2%2026-08-05Fix
CVE-2026-64569Linux kernel MPLS FIB dump request handling null pointer dereference–0.2%2026-08-05Fix
CVE-2026-64568Linux kernel mac80211 unsolicited broadcast probe response double free7.8CNA v3.10.2%2026-08-05Fix
CVE-2026-64567Linux kernel btrfs free space cache loader vulnerability7.8CNA v3.10.1%2026-08-05Fix
CVE-2026-64566Linux kernel xfrm IPTFS fragment handling memory corruption9.8CNA v3.10.6%2026-08-05Fix
CVE-2026-63457HPE Integrated Lights-Out 6 (iLO 6) potential denial of service6.5CNA v3.10.3%2026-08-05Fix
CVE-2026-61891Eclipse Theia path traversal7.5CNA v3.10.5%2026-08-05Fix
CVE-2026-61486Apache Lucy: Stack-buffer-overflow in JSON parser error reporter on malformed input9.8CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-61484Apache Lucy SearchServer remote interface deserialization of untrusted data9.8CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-61483Apache Lucy QueryParser uncontrolled recursion7.5v3.10.8%2026-08-05
CVE-2026-60053Apache Answer: Residual Administrative API Key Access after Role or Account Revocation9.1CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-60023Apache Answer: Unauthorized disclosure of deleted or pending Answer content7.5CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-60009Eclipse Theia path traversal8.8CNA v3.10.4%2026-08-05Fix
CVE-2026-59675Rancher Audit-Log Middleware Unauthenticated memory exhaustion denial of service7.5CNA v3.10.6%2026-08-05Fix
CVE-2026-55998SUSE Rancher Cluster Existence Oracle via Unauthenticated Import endpoint5.3CNA v3.10.3%2026-08-05Fix
CVE-2026-55997Long-lived Rancher registration token exposed in plaintext8.8CNA v3.10.1%2026-08-05Fix
CVE-2026-55996Unauthenticated denial of service via TLS SAN Stuffing in Rancher and cattle-cluster-agent4.3CNA v3.10.2%2026-08-05Fix
CVE-2026-55747PocketFlow path traversal in pocketflow-coding-agent Cookbook Example file tools6.8CNA v3.10.3%2026-08-05
CVE-2026-55739Crater CustomerPolicy insecure direct object reference8.2CNA v3.10.4%2026-08-05
CVE-2026-55707OpenStack Neutron incorrect authorization7.1CNA v4.00.4%2026-08-05Fix
CVE-2026-55524PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)7.5CNA v3.10.2%2026-08-05Fix
CVE-2026-55523PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets7.7CNA v4.00.5%2026-08-05Fix
CVE-2026-55522PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code7.8CNA v3.10.2%2026-08-05Fix
CVE-2026-54876OpenSSL Client-Side memory leak in OCSP Response Checking7.5CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-54418Leantime two-factor authentication RPC methods missing authorization8.1CNA v3.10.4%2026-08-05
CVE-2026-54416Pluck CMS unrestricted file upload via Missing .php8 extension in Upload Blacklist7.2CNA v3.10.5%2026-08-05
CVE-2026-53992Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date parameters5.1CNA v4.00.4%2026-08-05
CVE-2026-52466Open Library Foundation VuFind access permission validation incorrect authorization9.8CISA ADP v3.10.5%2026-08-05
CVE-2026-50749Apache Answer improper authorization6.5CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-49331Red Hat OpenShift oauth-proxy identity headers header injection6.5CNA v3.10.2%2026-08-05
CVE-2026-49004PostgreSQL Misconfiguration and command injection vulnerability in ZTE NX799J Product6.5CNA v3.11.2%2026-08-05
CVE-2026-48912Apache Answer improper input validation6.5CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-48911Apache Answer: Unauthenticated OAuth Email-Binding account takeover7.5CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-48834Apache Answer: Denial of service via crafted Accept-Language header parsing7.5CISA ADP v3.10.8%2026-08-05Fix
CVE-2026-48168PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name10.0CNA v3.11.5%2026-08-05Fix
CVE-2026-46581Eclipse Mojarra path traversal7.5CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-44945SUSE Rancher Cross-Cluster Impersonation confused-deputy privilege escalation9.1CNA v3.10.6%2026-08-05Fix
CVE-2026-44605Red Hat Hardened Images rpm: Heap buffer overflow in ndb slot table parsing5.5CNA v3.10.2%2026-08-05Fix
CVE-2026-39924Flarum Session Persistence via Improper Access Token Revocation7.6CNA v4.00.4%2026-08-05Fix
CVE-2026-39923Flarum Password Reset Token Expiry Bypass via POST /reset9.2CNA v4.00.4%2026-08-05Fix
CVE-2026-34966Gitea SSRF via Migration URI Fetch Bypass8.3CNA v4.00.4%2026-08-05Fix
CVE-2026-25703Potential information leakage from manager /network/graph API in NeuVector7.3CNA v3.10.8%2026-08-05NucleiFix
CVE-2026-21766HCL Digital Experience and Digital Experience Compose insufficiently protected credentials5.4CNA v3.10.3%2026-08-05
CVE-2026-20313Cisco Catalyst SD-WAN Security Hardening Release memory corruption7.7CNA v3.10.4%2026-08-05Fix
CVE-2026-20312Cisco Catalyst SD-WAN Security Hardening Release information disclosure8.8CNA v3.10.3%2026-08-05Fix
CVE-2026-20311Cisco IOS XE Software Web UI denial of service6.3CNA v3.10.3%2026-08-05Fix
CVE-2026-20310Cisco SD-WAN Software Security Hardening Release improper link resolution before file access9.1CNA v3.10.6%2026-08-05Fix
CVE-2026-20308Cisco IOS XE Software Web-Based Management interface vulnerability4.3CNA v3.10.3%2026-08-05Fix
CVE-2026-20304Cisco Catalyst SD-WAN Security Hardening Release Access Control vulnerabilities9.9CNA v3.10.4%2026-08-05Fix
CVE-2026-20303Cisco Catalyst SD-WAN Security Hardening Release Input Validation vulnerabilities9.9CNA v3.10.5%2026-08-05Exploit codeFix
CVE-2026-20301Cisco IOS Software and IOS XE Software Extensible Messaging client protocol denial of service8.6CNA v3.10.6%2026-08-05Fix
CVE-2026-20294Cisco Catalyst SD-WAN Manager information disclosure6.5CNA v3.10.1%2026-08-05Fix
CVE-2026-20289Cisco RoomOS Logging subsystem information disclosure5.7CNA v3.10.3%2026-08-05Fix
CVE-2026-20288Cisco IMC remote code execution vulnerability remote code execution6.5CNA v3.10.6%2026-08-05Fix
CVE-2026-20273Cisco IOS XE Software Security Hardening Release8.6CNA v3.10.5%2026-08-05Fix
CVE-2026-20272Cisco IOS XE Software Security Hardening Release9.8CNA v3.10.6%2026-08-05Fix
CVE-2026-20271Cisco IOS XE Software Security Hardening Release8.6CNA v3.10.5%2026-08-05Fix
CVE-2026-20270Cisco IOS XE Software Security Hardening Release8.6CNA v3.10.5%2026-08-05Fix
CVE-2026-20269Cisco IOS XE Software Security Hardening Release8.6CNA v3.10.5%2026-08-05Fix
CVE-2026-20268Cisco IOS XE Software Security Hardening Release8.6CNA v3.10.5%2026-08-05Fix
CVE-2026-20267Cisco IOS XE Software Security Hardening Release9.0CNA v3.10.4%2026-08-05Fix
CVE-2026-20263Cisco IOS XE Software Blocks Extensible Exchange protocol denial of service8.6CNA v3.10.6%2026-08-05Fix
CVE-2026-20200Cisco Integrated Management controller argument injection and remote code execution8.8CNA v3.10.7%2026-08-05Exploit codeFix
CVE-2026-20198Cisco Integrated Management controller cross-site scripting4.8CNA v3.10.3%2026-08-05Fix
CVE-2026-20124Cisco IOS XE Software SNMP denial of service7.7CNA v3.10.5%2026-08-05Fix
CVE-2026-20028Cisco Terminal Services Agent Firewall Rules Bypass vulnerability5.0CNA v3.10.3%2026-08-05Fix
CVE-2026-19028HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read6.8CNA v4.00.2%2026-08-05Fix
CVE-2026-19027HDF5 out-of-bounds heap read in N-Bit filter decompression6.9CNA v4.00.2%2026-08-05Fix
CVE-2026-19026The HDF Group HDF5 nbit filter null/short parameter-array dereference6.8CNA v4.00.2%2026-08-05Fix
CVE-2026-19025The HDF Group HDF5 chunked dataset layout decoder divide-by-zero6.8CNA v4.00.2%2026-08-05Fix
CVE-2026-19024HDF5 H5Pget_fill_value null pointer dereference via Malformed Fill Value message8.2CNA v4.00.2%2026-08-05Fix
CVE-2026-19023HDF5 h5dump untrusted pointer dereference in Binary Output of Variable-Length String Datasets6.8CNA v4.00.2%2026-08-05
CVE-2026-18970Rongzhitong Visual Integrated Command and Dispatch Platform findAll SQL injection6.9CNA v4.00.4%2026-08-05
CVE-2026-18969Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload6.9CNA v4.00.5%2026-08-05
CVE-2026-18968ttttonyhe OBlog tags.php cross-site scripting5.3CNA v4.00.4%2026-08-05
CVE-2026-18959yushine InnoShop files endpoint panel-api.php destroyFiles path traversal5.3CNA v4.00.5%2026-08-05
CVE-2026-18958imranrisal-dev Student-Management-System Login loginCheckTest.php SQL injection6.9CNA v4.00.4%2026-08-05
CVE-2026-18954Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server5.7CNA v4.00.2%2026-08-05Fix
CVE-2026-18953Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server6.3CNA v4.00.2%2026-08-05Exploit codeFix
CVE-2026-18933wp-downloadmanager unrestricted file upload via Missing Extension/MIME Validation and path traversal7.2CNA v3.10.5%2026-08-05
CVE-2026-18927imranrisal-dev Student-Management-System Shared Upload Helper unrestricted file upload5.3CNA v4.00.3%2026-08-05
CVE-2026-18907TECNO Mobile Hi Browser PathTravelsal vulnerability in com.talpa.hibrowser7.5CISA ADP v3.10.9%2026-08-05
CVE-2026-18903yeqifu warehouse FileController.java path traversal5.3CNA v4.00.5%2026-08-05
CVE-2026-18902H3C NX15 esps repeaterproc command injection8.6CNA v4.03.8%2026-08-05
CVE-2026-18901H3C NX15 Web API esps service.add routine8.6CNA v4.00.8%2026-08-05
CVE-2026-18900H3C NX15 Backend RPC esps file.exec os command injection8.6CNA v4.03.8%2026-08-05
CVE-2026-18898UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow8.7CNA v4.00.8%2026-08-05
CVE-2026-18897UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow8.7CNA v4.00.8%2026-08-05
CVE-2026-18896lavkush-maurya Student-Registration-System changepass.php SQL injection5.3CNA v4.00.3%2026-08-05
CVE-2026-18895UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow8.7CNA v4.00.8%2026-08-05
CVE-2026-18881TableOn WordPress plugin unauthenticated blind SQL injection via comment_count Filter parameter7.5CNA v3.10.5%2026-08-05Fix
CVE-2026-18859ESAFENET CDG usbkey;logindojojs SQL injection6.9CNA v4.00.4%2026-08-05
CVE-2026-18856Poesis Rhymix CMS Data Import module server-side request forgery5.1CNA v4.00.4%2026-08-05Fix
CVE-2026-18854Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter SQL injection6.9CNA v4.00.4%2026-08-05
CVE-2026-18839rpm-software-management popt popt-devel: Popt-static: Size_t underflow in singleoptionhelp2.2CNA v3.10.1%2026-08-05Fix
CVE-2026-18531IBM Maximo Application Suite session signing vulnerability5.3CNA v3.10.4%2026-08-05Fix
CVE-2026-18485Local privilege escalation in NI-PAL8.5CNA v4.00.2%2026-08-05
CVE-2026-18411Acrisure KARR BT and DR-100 Bluetooth authentication hard-coded cryptographic key7.2CNA v4.00.3%2026-08-05Fix
CVE-2026-18322Smart Popup by Supsystic WordPress plugin unauthenticated privilege escalation to Administrator8.8CNA v3.10.6%2026-08-05Reported exploitedFix
CVE-2026-17633IBM Langflow OSS custom component handling code injection8.5CNA v3.10.7%2026-08-05Emerging ThreatsExploit codeFix
CVE-2026-17632IBM Langflow OSS AST-based security scanning code injection8.8CNA v3.10.7%2026-08-05Fix
CVE-2026-17630IBM Langflow is affected by security vulnerabilities in Model Context protocol features7.2CNA v3.10.8%2026-08-05Fix
CVE-2026-17626IBM Langflow is affected by security vulnerabilities in Model Context protocol features8.8CNA v3.10.4%2026-08-05Fix
CVE-2026-17625IBM Langflow is affected by OS command injection in Model Context protocol features7.2CNA v3.10.8%2026-08-05Fix
CVE-2026-17624IBM Langflow OSS custom component module imports code injection8.5CNA v3.10.7%2026-08-05Fix
CVE-2026-17623IBM Langflow is affected OS command injection in Model Context protocol features8.8CNA v3.10.8%2026-08-05Fix
CVE-2026-17617Server-side request forgery (SSRF) in IBM Application Gateway Operator8.5CNA v3.10.3%2026-08-05Fix
CVE-2026-17613Penpot import-binfile RPC command missing authorization7.5CISA ADP v3.10.6%2026-08-05
CVE-2026-17583Thermo Fisher Applied Biosystems Genetic Analyzers missing support for integrity check8.3CNA v4.00.1%2026-08-05Fix
CVE-2026-17578Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement2.3CNA v4.00.2%2026-08-05Fix
CVE-2026-17556Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage8.8CNA v4.00.8%2026-08-05Fix
CVE-2026-17532Seraphinite Accelerator WordPress plugin reflected cross-site scripting6.1CNA v3.10.8%2026-08-05NucleiExploit codeFix
CVE-2026-17515MLS Import WordPress plugin sensitive information disclosure4.3CISA ADP v3.10.2%2026-08-05Fix
CVE-2026-17506Independent Analytics WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-08-05Fix
CVE-2026-17505TranslatePress WordPress plugin reflected cross-site scripting6.1CNA v3.10.9%2026-08-05NucleiFix
CVE-2026-16993DHL Shipping Germany for WooCommerce shipping label storage directory information disclosure3.7CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-16981DHL for WooCommerce WordPress plugin unauthenticated Shipping Label download via IDOR5.3CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-16968GeoDirectory WordPress plugin Contributor+ user email disclosure via geodir_json_search_users6.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16942WP Custom HTML Pages WordPress plugin Author+ stored XSS5.4CISA ADP v3.10.2%2026-08-05
CVE-2026-16940Custom Fields for WooCommerce WordPress plugin unauthenticated arbitrary file deletion10.0CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-16746MultiVendorX WordPress plugin Store Owner+ Cross-Store Commission data disclosure2.7CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-16736User Registration and Membership registration form improper access control7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16613GDPR Cookie Compliance WordPress plugin Cookie deletion and Forced Logout via CSRF4.3CISA ADP v3.10.2%2026-08-05Fix
CVE-2026-16605MultiVendorX WordPress plugin Store Owner+ Cross-Vendor Store takeover and deletion7.2CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-16604Passster content-lock block information disclosure7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16603Passster core REST API information disclosure7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16602Passster captcha REST endpoint information disclosure7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16583Orbit Fox by ThemeIsle WordPress plugin Author+ stored XSS via SVG upload6.1CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-16573Bit Form WordPress plugin unauthenticated stored XSS via SVG Signature upload7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16561Sunshine Photo Cart WordPress plugin unauthenticated Private Gallery comment disclosure7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16443Red Hat Keycloak SAML metadata import improper signature verification7.4CNA v3.10.3%2026-08-05Fix
CVE-2026-16442Red Hat Keycloak SAML identity broker authentication bypass7.4CNA v3.10.3%2026-08-05Fix
CVE-2026-16143VikRentItems WordPress plugin stored cross-site scripting7.2CNA v3.10.4%2026-08-05Fix
CVE-2026-16102Red Hat Keycloak dynamic client registration policy vulnerability8.1CNA v3.10.5%2026-08-05Fix
CVE-2026-16100Red Hat Keycloak user event metrics resource exhaustion6.5CNA v3.10.6%2026-08-05Fix
CVE-2026-16071Red Hat Keycloak LDAP entry DN search LDAP injection5.4CNA v3.10.3%2026-08-05Fix
CVE-2026-16055Contest Gallery WordPress plugin unauthenticated Login-Protection and 2FA bypass via post_cg_login7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16036miniOrange 2FA WordPress plugin 2FA bypass via Password-Only Second-Factor Rebinding7.5CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-16022Command injection in @oblique/cli7.8CNA v3.10.8%2026-08-05Fix
CVE-2026-15996GitHub Enterprise Server HTTP request parameter parser denial of service6.6CNA v4.00.8%2026-08-05Fix
CVE-2026-15979Content Egg WordPress plugin authenticated (Author+) arbitrary file deletion8.1CNA v3.11.2%2026-08-05Fix
CVE-2026-15941Relevanssi Admin Search AJAX handler SQL injection6.5CNA v3.10.4%2026-08-05Fix
CVE-2026-15918VikAppointments Services Booking Calendar WordPress plugin unauthenticated SQL injection7.5CNA v3.10.5%2026-08-05Fix
CVE-2026-15656IBM Maximo Application Suite session cookie vulnerability4.3CNA v3.10.2%2026-08-05Fix
CVE-2026-15587Privilege escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication header9.4CNA v4.00.2%2026-08-05Fix
CVE-2026-15573Red Hat build of Keycloak keycloak-services: Keycloak-services: Authorization bypass8.1CNA v3.10.5%2026-08-05Fix
CVE-2026-15572Red Hat Keycloak DCR protocol mapper policy privilege escalation8.8CNA v3.10.7%2026-08-05Fix
CVE-2026-15452Smash Balloon Social Photo Feed WordPress plugin reflected cross-site scripting4.7CNA v3.10.4%2026-08-05Fix
CVE-2026-15372WP 2FA WordPress plugin Two-Factor authentication bypass via Passkeys Provider7.5CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-15360Ajax Load More WordPress plugin unauthenticated SQL injection via custom_args9.1CISA ADP v3.10.5%2026-08-05Fix
CVE-2026-15281User Access Manager WordPress plugin authenticated (Subscriber+) SQL injection6.5CNA v3.10.5%2026-08-05Fix
CVE-2026-15230YayPricing WordPress plugin Pricing Configuration modification and Coupon code disclosure8.1CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-15210Login/Signup with Phone Number, OTP Verification for WordPress unauthenticated account takeover9.1CISA ADP v3.10.4%2026-08-05Fix
CVE-2026-14587neo4j Enterprise Edition unathenticated connection can hold Bolt channel open5.5CNA v4.00.5%2026-08-05Fix
CVE-2026-14574Eclipse Theia prototype pollution5.7CNA v4.00.4%2026-08-05Fix
CVE-2026-14553Zportals WordPress plugin Subscriber+ arbitrary file upload8.1CISA ADP v3.10.6%2026-08-05Fix
CVE-2026-14304Eclipse Accessibility Tools Framework (ACTF) XML external entity injection4.6CNA v4.00.2%2026-08-05
CVE-2026-13477IBM QRadar SIEM is vulnerable to remote code execution by privileged users4.7CNA v3.10.5%2026-08-05Fix
CVE-2026-12762IBM Cloud Pak for Business Automation manifest files information disclosure5.3CNA v3.10.4%2026-08-05Fix
CVE-2026-12730Improper validation of certificate with host mismatch in IBM Business Automation Workflow containers3.8CNA v3.10.2%2026-08-05Fix
CVE-2026-12609Eclipse Theia path traversal7.5CNA v3.10.5%2026-08-05NucleiFix
CVE-2026-12410CCleaner local privilege escalation via link following on uninstall7.8CNA v3.10.2%2026-08-05Fix
CVE-2026-12000Page and Post Restriction WordPress plugin information disclosure7.5CNA v3.10.7%2026-08-05Fix
CVE-2026-11977WP Post Author WordPress plugin authenticated (Author+) SQL injection6.5CNA v3.10.4%2026-08-05Fix
CVE-2026-11969WP TripAdvisor Review Slider WordPress plugin authenticated (Administrator+) SQL injection4.9CNA v3.10.5%2026-08-05Fix
CVE-2026-11920JoomSport WordPress plugin authenticated (Administrator+) SQL injection via order parameter4.9CNA v3.10.5%2026-08-05Fix
CVE-2026-11454Groundhogg WordPress plugin insecure direct object reference6.5CNA v3.10.5%2026-08-05Fix
CVE-2026-11421weDevs ERP for WooCommerce advanced filter parameter SQL injection6.5CNA v3.10.6%2026-08-05Fix
CVE-2026-10716Directus Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation7.5CNA v4.00.4%2026-08-05Fix
CVE-2026-10547IBM Langflow vertex build endpoint improper access control5.9CNA v3.10.4%2026-08-05Fix
CVE-2026-10128IBM Langflow is affected by weaknesses in secret handling and sensitive configuration access6.5CNA v3.10.4%2026-08-05Fix
CVE-2026-10090Red Hat Advanced Cluster Management for Kubernetes application subscription controller vulnerability9.0CNA v3.10.6%2026-08-05Fix
CVE-2026-10059Red Hat multicluster engine for Kubernetes ClusterCurator controller privilege escalation9.1CNA v3.10.6%2026-08-05Fix
CVE-2026-10025IBM QRadar SIEM has an XML external entity (XXE) injection8.2CNA v3.10.6%2026-08-05Fix
CVE-2026-9273StellarWP Kadence Memberships lost-password handler vulnerability9.3CNA v3.10.5%2026-08-05Fix
CVE-2026-9205IBM Langflow is affected by weaknesses in secret handling and sensitive configuration access7.4CNA v3.10.4%2026-08-05Fix
CVE-2026-9203Server-side request forgery in Progress MarkLogic Server8.5CNA v3.10.3%2026-08-05Fix
CVE-2026-9201IBM Langflow OSS custom component hash validation cryptographic weakness8.8CNA v3.10.4%2026-08-05Fix
CVE-2026-9196IBM Langflow OSS Agentic Assistant component validation code injection8.1CNA v3.10.5%2026-08-05Fix
CVE-2026-9195Cross-site scripting in Progress MarkLogic Server Query console9.3CNA v3.10.7%2026-08-05Fix
CVE-2026-9193Privilege escalation in Progress MarkLogic Server Hadoop integration9.9CNA v3.10.5%2026-08-05Fix
CVE-2026-9192Authentication bypass in Progress MarkLogic Server ODBC App Server9.8CNA v3.10.8%2026-08-05Fix
CVE-2026-9190HTTP request smuggling in Progress MarkLogic Server9.1CNA v3.10.7%2026-08-05Fix
CVE-2026-9130IBM Langflow MemoryComponent insecure direct object reference7.1CNA v3.10.3%2026-08-05Fix
CVE-2026-9081IBM Langflow Ollama provider validation server-side request forgery7.1CNA v3.10.3%2026-08-05Fix
CVE-2026-9077IBM Langflow MCP server configuration vulnerability8.5CNA v3.10.4%2026-08-05Fix
CVE-2026-8790Football Pool WordPress plugin authenticated (Subscriber+) reflected cross-site scripting6.1CNA v3.10.4%2026-08-05Fix
CVE-2026-8761Dokan WordPress plugin missing authorization to authenticated (Vendor+) privilege escalation8.8CNA v3.10.7%2026-08-05Fix
CVE-2026-8709Privilege escalation in Progress MarkLogic Server REST document patch operation9.9CNA v3.10.5%2026-08-05Fix
CVE-2026-8478IBM Langflow custom component handling code injection8.8CNA v3.10.6%2026-08-05Fix
CVE-2026-8470IBM Langflow is affected by weaknesses in secret handling and sensitive configuration access7.4CNA v3.10.2%2026-08-05Fix
CVE-2026-8446IBM Langflow is affected by security vulnerabilities in Model Context protocol features7.5CNA v3.10.5%2026-08-05Fix
CVE-2026-8400IBM WebSphere Application Server ORB IIOP class loading unsafe reflection8.1CNA v3.10.5%2026-08-05Fix
CVE-2026-8183IBM Langflow OSS path traversal7.7CNA v3.10.6%2026-08-05Fix
CVE-2026-8182IBM Langflow OSS custom component handling code injection8.8CNA v3.10.7%2026-08-05Fix
CVE-2026-8029SQL injection vulnerability in ZTE SmartLife App3.9CNA v3.10.2%2026-08-05
CVE-2026-7869IBM Langflow Knowledge Bases API path traversal5.4CNA v3.10.3%2026-08-05Fix
CVE-2026-7753Cost Calculator Builder WordPress plugin unauthorized access6.5CNA v3.10.5%2026-08-05Fix
CVE-2026-7726Layouts for WPBakery WordPress plugin unauthorized access6.5CNA v3.10.5%2026-08-05Fix
CVE-2026-7693Backup Migration WordPress plugin OS command injection7.2CNA v3.13.0%2026-08-05Fix
CVE-2026-7658IBM Langflow OSS username field validation path traversal6.5CNA v3.10.5%2026-08-05Fix
CVE-2026-7657IBM Langflow OSS API request functionality server-side request forgery6.5CNA v3.10.4%2026-08-05Fix
CVE-2026-7646IBM Langflow is affected by security vulnerabilities in Model Context protocol features6.5CNA v3.10.5%2026-08-05Fix
CVE-2026-7557SAML authentication bypass in Progress MarkLogic Server9.1CNA v3.10.5%2026-08-05Fix
CVE-2026-7529wiseCampaign WordPress plugin unauthorized access7.5CNA v3.10.6%2026-08-05Fix
CVE-2026-7520MailChimp Forms by MailMunch WordPress plugin unauthorized access8.1CNA v3.10.5%2026-08-05Fix
CVE-2026-7456Udimi Tools WordPress plugin missing authorization authenticated plugin Configuration reset6.5CNA v3.10.4%2026-08-05Fix
CVE-2026-7444Search Analytics for WP WordPress plugin cross-site request forgery8.1CNA v3.10.3%2026-08-05Fix
CVE-2026-7441Simple Yearly Archive WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2026-08-05Fix
CVE-2026-7329Privilege escalation in Progress MarkLogic Server REST query interfaces9.9CNA v3.10.6%2026-08-05Fix
CVE-2026-7327Privilege escalation in Progress MarkLogic Server REST API document processing8.1CNA v3.10.4%2026-08-05Fix
CVE-2026-7326Cross-site request forgery in Progress MarkLogic Server Admin UI7.5CNA v3.10.2%2026-08-05Fix
CVE-2026-7105Xpro Addons WordPress plugin missing authorization authenticated arbitrary post creation4.3CNA v3.10.4%2026-08-05Fix
CVE-2026-6972SKT Skill Bar WordPress plugin authenticated (Contributor+) stored cross-site scripting6.4CNA v3.10.3%2026-08-05Fix
CVE-2026-6639AI Chatbot and Workflow Automation by AIWU WordPress plugin information disclosure7.5CNA v3.12.0%2026-08-05NucleiFix
CVE-2026-6627WPFormify WordPress plugin missing authorization8.2CNA v3.10.7%2026-08-05Fix
CVE-2026-6147LightSync Pro WordPress plugin authenticated (Author+) arbitrary file upload8.8CNA v3.11.0%2026-08-05Fix
CVE-2026-6079Material Dashboard WordPress plugin unauthorized access7.3CNA v3.10.4%2026-08-05Fix
CVE-2026-6020ShopLentor WordPress plugin arbitrary function execution via callback parameter via REST API7.2CNA v3.10.8%2026-08-05Fix
CVE-2026-5651Askeet WordPress plugin authenticated (Administrator+) SQL injection via sql_query parameter4.9CNA v3.10.5%2026-08-05Fix
CVE-2026-5581sh1zen Multi Uploader for Gravity Forms media deletion handler missing authorization9.1CNA v3.10.7%2026-08-05Fix
CVE-2026-5116Contact Form 7 WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-08-05Fix
CVE-2026-5108Super Progressive Web Apps WordPress plugin stored cross-site scripting4.4CNA v3.10.3%2026-08-05Fix
CVE-2026-5062PrettyLinks WordPress plugin authenticated (Administrator+) SQL injection via s parameter4.9CNA v3.10.4%2026-08-05Fix
CVE-2026-4431Easy Post Submission WordPress plugin missing authorization9.1CNA v3.10.6%2026-08-05Fix
CVE-2026-0931Denial of service vulnerability in M-Files Server6.9CNA v4.00.4%2026-08-05Fix
CVE-2026-0516SonicWall SonicOS HTTP header injection6.5CISA ADP v3.10.3%2026-08-05Fix
CVE-2026-70620Odysseus SSRF via Embedding Endpoint Configuration6.1CNA v4.00.5%2026-08-04
CVE-2026-70619Odysseus Missing Admin Authorization via Embedding Endpoint Routes8.7CNA v4.00.7%2026-08-04
CVE-2026-70594Ghost: Session fixation in Ghost Admin6.7CNA v3.10.2%2026-08-04Fix
CVE-2026-70593Ghost: Theme upload path traversal6.6CNA v3.10.4%2026-08-04Fix
CVE-2026-70592Ghost: Database Backup path traversal5.5CNA v3.10.4%2026-08-04Fix
CVE-2026-70591Ghost: Server-side request forgery in Image Fetching4.1CNA v3.10.4%2026-08-04Fix
CVE-2026-70590Ghost: Blind password hash disclosure in Ghost Admin API4.8CNA v3.10.3%2026-08-04Fix
CVE-2026-70589Ghost: Archived Offers can be Redeemed4.8CNA v3.10.3%2026-08-04Fix
CVE-2026-70588Ghost: Cross-site scripting in Universal Import5.0CNA v3.10.4%2026-08-04Fix
CVE-2026-70554MaxSite CMS unauthenticated PHP object injection via maxsite_comuser Cookie9.3CNA v4.01.2%2026-08-04Fix
CVE-2026-70553MaxSite CMS unauthenticated RCE via Install endpoint9.3CNA v4.01.3%2026-08-04Exploit codeFix
CVE-2026-70552MaxSite CMS Unauthenticated AJAX Dispatcher Bypass via ajax.php9.3CNA v4.00.8%2026-08-04Fix
CVE-2026-70494Open WebUI folder deletion incorrect authorization8.1CNA v3.10.5%2026-08-04Fix
CVE-2026-70493Open WebUI knowledge search denial of service6.5CNA v3.10.6%2026-08-04Fix
CVE-2026-70492open-webui open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages8.7CNA v3.10.4%2026-08-04Fix
CVE-2026-70491Open WebUI tool source endpoints information disclosure6.5CNA v3.10.5%2026-08-04Fix
CVE-2026-70490Open WebUI terminal WebSocket authentication vulnerability6.3CNA v3.10.3%2026-08-04Fix
CVE-2026-70489Open WebUI automation scheduler denial of service6.5CNA v3.10.6%2026-08-04Fix
CVE-2026-70488Open WebUI knowledge base sync insecure direct object reference4.3CNA v3.10.4%2026-08-04Fix
CVE-2026-70487Open WebUI knowledge attachment metadata information disclosure5.3CNA v3.10.4%2026-08-04Fix
CVE-2026-70486open-webui open WebUI: Same-origin XSS to account takeover8.2CNA v3.10.4%2026-08-04Fix
CVE-2026-70485Open WebUI URL fetching server-side request forgery7.1CNA v3.10.4%2026-08-04Fix
CVE-2026-70484Open WebUI chat completions incorrect authorization4.3CNA v3.10.4%2026-08-04Fix
CVE-2026-70483Open WebUI chat deletion endpoint missing authorization3.1CNA v3.10.5%2026-08-04Fix
CVE-2026-70482open-webui open WebUI: Account takeover8.1CNA v3.10.6%2026-08-04Fix
CVE-2026-70481Open WebUI channel message editing missing authorization5.4CNA v3.10.4%2026-08-04Fix
CVE-2026-70480open-webui open WebUI: Client-side SSRF4.1CNA v3.10.3%2026-08-04Fix
CVE-2026-70479open-webui open WebUI: SSRF into internal services7.7CNA v3.10.5%2026-08-04Fix
CVE-2026-70478FlowiseAI Flowise OAuth2 token refresh endpoint information disclosure9.2CNA v4.00.6%2026-08-04Fix
CVE-2026-70477Flowise: CSV agent prompt injection remote code execution9.5CNA v4.00.8%2026-08-04Fix
CVE-2026-70476FlowiseAI Flowise Stripe subscription endpoints improper access control8.3CNA v4.00.5%2026-08-04Fix
CVE-2026-70475Flowise: Missing authorization on Execution Update endpoint7.1CNA v4.00.5%2026-08-04Fix
CVE-2026-70474Flowise: Cross-Workspace OAuth2 Credential Metadata leak7.6CNA v4.00.5%2026-08-04Fix
CVE-2026-70473FlowiseAI Flowise upsert history endpoint information disclosure8.3CNA v4.00.5%2026-08-04Fix
CVE-2026-70472Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store7.1CNA v4.00.5%2026-08-04Fix
CVE-2026-70471Flowise: RBAC Bypass leading to Unauthorized Workspace Variables Disclosure7.1CNA v4.00.4%2026-08-04Fix
CVE-2026-70470Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE9.5CNA v4.01.0%2026-08-04Fix
CVE-2026-70373Koha SQL injection in reports/issues_stats.pl6.5CISA ADP v3.10.6%2026-08-04
CVE-2026-70372Koha SQL injection in reports/bor_issues_top.pl6.5CISA ADP v3.10.6%2026-08-04
CVE-2026-70371Koha SQL injection in reports/issues_avg_stats.pl6.5CISA ADP v3.10.6%2026-08-04
CVE-2026-70370Koha SQL injection in reports/catalogue_stats.pl6.5CISA ADP v3.10.6%2026-08-04
CVE-2026-70369Koha SQL injection in reports/acquisitions_stats.pl6.5CISA ADP v3.10.6%2026-08-04
CVE-2026-70368Stunnel: Stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message6.5CNA v3.10.4%2026-08-04Fix
CVE-2026-70367Stunnel: Ssrf bypass in stunnel socks proxy5.4CNA v3.10.3%2026-08-04Fix
CVE-2026-69704Atals-Livre SQL injection via Unsanitized GET parameter in supp7.0CNA v4.00.3%2026-08-04
CVE-2026-69703maximeAmini Atals-Livre Atlas-Livre unauthenticated access via Admin Controllers Missing Exit9.3CNA v4.00.6%2026-08-04
CVE-2026-69702SnailJob denial of service via FuryUtil.deserialize OOM7.1CNA v4.00.5%2026-08-04Fix
CVE-2026-69264FlowiseAI Flowise CSV Agent Pyodide execution code injection9.4CNA v4.01.1%2026-08-04Fix
CVE-2026-69263FlowiseAI Flowise MCP environment variable blocklist vulnerability8.7CNA v4.00.7%2026-08-04Exploit codeFix
CVE-2026-69262FlowiseAI Flowise chatflow deletion API incorrect authorization7.1CNA v4.00.5%2026-08-04Fix
CVE-2026-69259Flowise RCE via SQLite Record Manager Node9.4CNA v4.00.8%2026-08-04Fix
CVE-2026-69258Flowise: Unauthenticated Property injection into Flow Execution Context8.8CNA v4.00.7%2026-08-04Fix
CVE-2026-69257Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses7.6CNA v4.00.4%2026-08-04Fix
CVE-2026-69256Flowise: Remote code execution vulnerability in CSVAgent9.4CNA v4.01.0%2026-08-04Fix
CVE-2026-69255Flowise: CSV agent remote code execution via Pyodide code injection Root Shell Verified9.2CNA v4.00.7%2026-08-04Reported exploitedFix
CVE-2026-69254Flowise: RCE via NodeVM sandbox escape in executeJavaScriptCode nodeVMOptions Override9.4CNA v4.00.7%2026-08-04Fix
CVE-2026-69253Flowise sandbox escape to RCE9.0CNA v4.00.7%2026-08-04Fix
CVE-2026-69252FlowiseAI Flowise files API missing authorization7.2CNA v4.00.5%2026-08-04Fix
CVE-2026-69251Flowise RCE via TypeORM DataSource9.0CNA v4.02.7%2026-08-04NucleiFix
CVE-2026-69250Flowise: Unauthenticated OAuth2 Refresh enables Non-blind SSRF and Secret Exfiltration8.5CNA v4.00.6%2026-08-04Fix
CVE-2026-69110Microck opencode-studio OpenCode Studio Unauthenticated File Read via /API/tmp and /API/music9.3CNA v4.00.8%2026-08-04Fix
CVE-2026-69100dromara lamp-cloud LAMP GlueFactory Unsandboxed Groovy script remote code execution8.7CNA v4.01.0%2026-08-04
CVE-2026-69098kotaemon unauthenticated remote code execution via insecure deserialization9.3CNA v4.00.9%2026-08-04
CVE-2026-68744Sssd: Sssd: Nss responder uninitialized heap disclosure in initgroups reply3.3CNA v3.10.1%2026-08-04Fix
CVE-2026-68743Sssd: Sssd: Pam responder out-of-bounds read via unchecked auth_token_length in protocol v15.5CNA v3.10.1%2026-08-04Fix
CVE-2026-68494FasterXML jackson-core Async parser resource exhaustion8.7CNA v4.00.5%2026-08-04Fix
CVE-2026-67979NASA cFS Executive Services dynamic application start arbitrary code execution9.1CISA ADP v3.10.5%2026-08-04
CVE-2026-67862open62541 client attribute reading buffer overflow7.5CISA ADP v3.10.6%2026-08-04
CVE-2026-67861open62541 UA_Client_getRemoteDataTypes denial of service7.5CNA v3.10.8%2026-08-04
CVE-2026-67860open62541 HistoryRead memory backend heap-based buffer overflow7.5CISA ADP v3.10.5%2026-08-04
CVE-2026-67859open62541 v1.5.5 buffer overflow7.5CNA v3.10.8%2026-08-04
CVE-2026-67858open62541 buffer overflow7.5CNA v3.10.9%2026-08-04
CVE-2026-67857open62541 client namespace array reader out-of-bounds read7.5CNA v3.10.6%2026-08-04
CVE-2026-67856open62541 subscription request handling denial of service7.5CISA ADP v3.10.8%2026-08-04
CVE-2026-67855open62541 GDS PushManagement certificate update use-after-free7.5CISA ADP v3.10.5%2026-08-04
CVE-2026-67618marimo API Key Exfiltration via Malicious Notebook PEP-723 Metadata7.1CNA v4.00.3%2026-08-04Fix
CVE-2026-67243refirio freo2 unrestricted file upload8.6CNA v4.00.5%2026-08-04Fix
CVE-2026-67200Perspective path traversal via cwd_static_file_handler8.7CNA v4.00.9%2026-08-04
CVE-2026-67199Perspective DoS via Loop Expression Evaluation7.1CNA v4.00.5%2026-08-04
CVE-2026-67198Perspective DoS via VirtualServer Protocol Dispatcher8.7CNA v4.00.3%2026-08-04
CVE-2026-67196Perspective XSS via Debug plugin innerHTML Interpolation5.1CNA v4.00.3%2026-08-04
CVE-2026-67195Perspective RCE via eval Expression injection8.7CNA v4.01.2%2026-08-04
CVE-2026-66902CJCOLLIER Google::Auth Pluggable external account credentials OS command injection9.8CISA ADP v3.10.7%2026-08-04Fix
CVE-2026-66901Google::Auth versions for Perl allow server side request forgery and credential exfiltration7.5CISA ADP v3.10.5%2026-08-04Fix
CVE-2026-66884Erlang Ecosystem Foundation oidcc_plug cross-site request forgery2.1CNA v4.00.3%2026-08-04Fix
CVE-2026-66883Erlang Ecosystem Foundation oidcc_plug case sensitivity bypass6.3CNA v4.00.4%2026-08-04Fix
CVE-2026-66300SNOMED International Snowstorm reflected XSS2.3CNA v4.00.3%2026-08-04Fix
CVE-2026-65986CVAT has stored XSS via annotation guide assets8.5CNA v4.00.4%2026-08-04Fix
CVE-2026-64634Veeam One improper privilege management8.4CNA v4.00.1%2026-08-04
CVE-2026-64633Veeam One code injection10.0CNA v4.00.6%2026-08-04
CVE-2026-64631Veeam One SQL injection8.6CNA v4.00.4%2026-08-04
CVE-2026-64630Veeam One incorrect authorization5.3CNA v4.00.4%2026-08-04
CVE-2026-64565Linux kernel ims-pcu driver heap buffer overflow–0.2%2026-08-04Fix
CVE-2026-64564Linux kernel SCTP ASCONF DEL-IP processing vulnerability9.8CNA v3.11.4%2026-08-04Exploit codeFix
CVE-2026-64563Linux kernel rhashtable walk iterator use-after-free7.8CNA v3.10.1%2026-08-04Exploit codeFix
CVE-2026-64562Linux kernel KVM nVMX vulnerability8.8CNA v3.10.1%2026-08-04Fix
CVE-2026-64561Linux kernel KVM MMU shadow paging vulnerability8.8CNA v3.10.3%2026-08-04Exploit codeFix
CVE-2026-63456Authentication bypass via spoofed HTTP headers Orchestrator REST API9.8CNA v3.10.8%2026-08-04
CVE-2026-63455Authentication bypass via spoofed HTTP headers Orchestrator REST API9.8CNA v3.10.8%2026-08-04
CVE-2026-63252Eclipse Milo memory leak8.7CNA v4.00.6%2026-08-04Fix
CVE-2026-63248Eclipse Milo missing authorization6.9CNA v4.00.3%2026-08-04Fix
CVE-2026-62927Eclipse Milo incorrect authorization8.7CNA v4.00.4%2026-08-04Fix
CVE-2026-61515Puwell IP Camera unauthenticated command injection via DebugShell9.3CNA v4.02.4%2026-08-04
CVE-2026-61514Puwell IP Camera unauthenticated access via TCP Port 234569.3CNA v4.00.8%2026-08-04
CVE-2026-61387Eclipse Milo missing resource release6.9CNA v4.00.6%2026-08-04Fix
CVE-2026-60007Eclipse Milo response discrepancy9.1CNA v4.00.6%2026-08-04Fix
CVE-2026-58080Eclipse Milo missing authorization8.8CNA v4.00.4%2026-08-04Fix
CVE-2026-58075Veeam One improper authentication8.7CNA v4.00.4%2026-08-04
CVE-2026-58074Veeam One code injection8.6CNA v4.00.5%2026-08-04
CVE-2026-58073Veeam Service Provider Console authentication bypass9.5CNA v4.00.3%2026-08-04Fix
CVE-2026-58072Veeam Service Provider Console path traversal9.0CNA v4.00.5%2026-08-04Fix
CVE-2026-58071Veeam Service Provider Console missing authentication8.2CNA v4.00.4%2026-08-04Fix
CVE-2026-58067Veeam Service Provider Console excessive memory allocation8.7CNA v4.00.4%2026-08-04Fix
CVE-2026-58045Node.js Node reachable assertion6.2CNA v3.00.2%2026-08-04Fix
CVE-2026-58044Node.js Node HTTP request smuggling3.7CNA v3.00.3%2026-08-04Fix
CVE-2026-58042Node.js Node denial of service5.9CNA v3.00.4%2026-08-04Fix
CVE-2026-58041Node.js Node time-of-check time-of-use race condition5.3CNA v3.00.3%2026-08-04Fix
CVE-2026-56848Node.js Node use-after-free7.5CNA v3.00.5%2026-08-04Fix
CVE-2026-56846Node.js Node resource exhaustion7.5CNA v3.00.5%2026-08-04Fix
CVE-2026-56845Rocket.Chat path traversal7.5CNA v3.00.6%2026-08-04Fix
CVE-2026-54020open-webui Open WebUI: DNS Rebinding SSRF Bypass6.3CNA v3.10.3%2026-08-04Fix
CVE-2026-52370O2OA forum posting function reflected cross-site scripting6.1CISA ADP v3.10.3%2026-08-04
CVE-2026-51401Vim VMS filename handling code injection7.7CISA ADP v3.10.2%2026-08-04
CVE-2026-51400Vim VMS filename handling memory leak8.4CISA ADP v3.10.2%2026-08-04
CVE-2026-51144Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.6.1CISA ADP v3.10.4%2026-08-04
CVE-2026-49435Keysight IxChariot-related products stack-based buffer overflow9.3CNA v4.01.4%2026-08-04Fix
CVE-2026-48154GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access5.9CNA v3.10.4%2026-08-04Fix
CVE-2026-48121LangChain LangGraph.js MongoDB checkpoint saver NoSQL injection6.7CNA v3.10.4%2026-08-04Exploit codeFix
CVE-2026-47781PDM: Project-Controlled `.pdm-plugins` Content Executes before CLI Parsing8.4CNA v4.00.2%2026-08-04Fix
CVE-2026-47764PDM wheel installation leads to path traversal via overridden write_to_fs8.4CNA v4.00.2%2026-08-04Fix
CVE-2026-47763PDM: Project-Local State and Config Writes Follow Symlinks6.8CNA v4.00.2%2026-08-04Fix
CVE-2026-47682CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes7.1CNA v4.00.5%2026-08-04Fix
CVE-2026-47623NVIDIA Dynamo deserialization of untrusted data8.2CNA v3.10.7%2026-08-04Fix
CVE-2026-47622NVIDIA Dynamo information disclosure through error messages5.3CNA v3.10.5%2026-08-04Fix
CVE-2026-47621NVIDIA Dynamo time-of-check time-of-use race condition6.5CNA v3.10.4%2026-08-04Fix
CVE-2026-47620NVIDIA Dynamo race condition6.5CNA v3.10.4%2026-08-04Fix
CVE-2026-47619NVIDIA Dynamo code execution6.6CNA v3.10.8%2026-08-04Fix
CVE-2026-47618NVIDIA Dynamo server-side request forgery7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-47617NVIDIA Dynamo server-side request forgery7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-47616NVIDIA Dynamo server-side request forgery7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-47615NVIDIA Dynamo server-side request forgery7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-47614NVIDIA Dynamo server-side request forgery7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-47613NVIDIA Dynamo server-side request forgery7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-47612NVIDIA Dynamo path traversal7.5CNA v3.10.8%2026-08-04Fix
CVE-2026-47487NVIDIA Triton Inference Server path traversal4.4CNA v3.10.2%2026-08-04Fix
CVE-2026-46334OpenSIPS: Denial of service in SDP bandwidth parsing via QoS SDP cloning8.7CNA v4.00.7%2026-08-04Fix
CVE-2026-45809OpenSIPS: Denial of service in watcherinfo XML generation from oversized watcher URI8.7CNA v4.00.6%2026-08-04Fix
CVE-2026-45705OpenSIPS: OOB read in Multipart Body Boundary Parsing5.3CNA v3.10.5%2026-08-04Fix
CVE-2026-45538OpenSIPS: Stack buffer overflow in sip_to_json Header Name Copy9.8CNA v3.10.8%2026-08-04
CVE-2026-45537OpenSIPS: Global buffer overflow in construct_uri9.1CNA v3.10.6%2026-08-04Fix
CVE-2026-45103OpenSIPS: SIP Message Smuggling via TCP Content-Length integer overflow7.5CNA v3.10.6%2026-08-04Fix
CVE-2026-45100OpenSIPS: Buffer overflow in Base64 Encode Transformation9.1CNA v3.10.8%2026-08-04Fix
CVE-2026-45084OpenSIPS: Denial of service in presence.handle_publish from unchecked Content-Type state8.7CNA v4.00.7%2026-08-04Fix
CVE-2026-42169GIMP APNG file loader vulnerability7.8NVD v3.10.1%2026-08-04Fix
CVE-2026-25292Qualcomm Snapdragon improper validation of syntactic correctness of input in Automotive Linux OS7.6CNA v3.10.2%2026-08-04Fix
CVE-2026-25289Qualcomm Snapdragon stack-based buffer overflow in WLAN firmware9.6CNA v3.10.2%2026-08-04Fix
CVE-2026-25288Qualcomm Snapdragon buffer over-read in WLAN firmware7.4CNA v3.10.2%2026-08-04Fix
CVE-2026-24255NVIDIA Dynamo tampering7.5CNA v3.10.5%2026-08-04Fix
CVE-2026-24254NVIDIA Dynamo authentication bypass9.8CNA v3.10.9%2026-08-04Fix
CVE-2026-24253NVIDIA Dynamo out-of-bounds write8.2CNA v3.10.6%2026-08-04Fix
CVE-2026-24084Qualcomm Snapdragon Insecure Security Identifier Mechanism in Multi-Mode Call Processor7.5CNA v3.10.3%2026-08-04Fix
CVE-2026-24083Qualcomm Snapdragon untrusted pointer dereference in Automotive Security7.8CNA v3.10.1%2026-08-04Fix
CVE-2026-24080Qualcomm Snapdragon buffer copy without checking size of input in Biometrics7.8CNA v3.10.1%2026-08-04Fix
CVE-2026-24079Qualcomm Snapdragon missing authentication for critical function in Data Modem8.1CNA v3.10.2%2026-08-04Fix
CVE-2026-24078Qualcomm Snapdragon exposure of private personal information to an unauthorized actor in Data Modem6.5CNA v3.10.2%2026-08-04Fix
CVE-2026-24077Qualcomm Snapdragon integer underflow (wrap or wraparound) in WLAN host6.5CNA v3.10.2%2026-08-04Fix
CVE-2026-24076Qualcomm Snapdragon buffer copy without checking size of input in Bluetooth host6.7CNA v3.10.1%2026-08-04Fix
CVE-2026-21366Qualcomm Snapdragon integer overflow or wraparound in Data Network Stack and Connectivity7.8CNA v3.10.1%2026-08-04Fix
CVE-2026-18853ZomboDroid Meme Generator App com.ZomboDroid.MemeGenerator t5.l.c path traversal4.8CNA v4.00.2%2026-08-04
CVE-2026-18852epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition4.8CNA v4.00.2%2026-08-04
CVE-2026-18830Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API8.6CNA v4.00.5%2026-08-04Fix
CVE-2026-18819RackTables cross-site request forgery5.3CNA v4.00.2%2026-08-04
CVE-2026-18818Ehco1996 django-sspanel Support Ticket Handler authorization bypass5.3CNA v4.00.4%2026-08-04
CVE-2026-18817Baserow user impersonation token handler incorrect authorization2.1CNA v4.00.3%2026-08-04Fix
CVE-2026-18816Baserow 2FA Verify endpoint views.py verify improper authentication2.3CNA v4.00.4%2026-08-04Fix
CVE-2026-18814H3C NX15 esps reload.reload_config command injection8.6CNA v4.03.6%2026-08-04
CVE-2026-18813H3C NX15 esps delete command injection8.6CNA v4.03.6%2026-08-04
CVE-2026-18812H3C NX15 esps esps.ipv6.wan command injection8.6CNA v4.03.6%2026-08-04
CVE-2026-18811H3C NX15 esps add command injection8.6CNA v4.03.6%2026-08-04
CVE-2026-18810H3C NX15 networkSetup missing authentication6.9CNA v4.00.7%2026-08-04
CVE-2026-18809Mozilla information disclosure in Firefox for Android and Firefox Focus for Android6.5CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-18806Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer7.1CNA v3.10.1%2026-08-04Fix
CVE-2026-18801OpenMeter customer usage attribution SQL injection9.3CNA v4.00.4%2026-08-04
CVE-2026-18790Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds4.8CNA v4.00.2%2026-08-04
CVE-2026-18788Trippo ResponsiveFilemanager dialog.php unrestricted upload6.9CNA v4.00.5%2026-08-04
CVE-2026-18787GL.iNet AX1800 RPC endpoint oui-rpc.lua remove_rule command injection8.7CNA v4.03.2%2026-08-04
CVE-2026-18785o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use-after-free4.8CNA v4.00.2%2026-08-04
CVE-2026-18784o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflow4.8CNA v4.00.2%2026-08-04
CVE-2026-18775NousResearch hermes-agent browser tooling server-side request forgery5.3CNA v4.00.4%2026-08-04
CVE-2026-18774NousResearch hermes-agent image generation provider server-side request forgery5.3CNA v4.00.3%2026-08-04
CVE-2026-18773NousResearch hermes-agent Quick run.py _check_slash_access authorization5.3CNA v4.00.3%2026-08-04
CVE-2026-18772Samsung Open Source rlottie sequential memory allocation6.5CNA v3.10.4%2026-08-04Fix
CVE-2026-18770vibesurf-ai VibeSurf Python Validation code code injection6.9CNA v4.00.5%2026-08-04
CVE-2026-18766chetans9 core-php-admin-panel customers.php SQL injection5.3CNA v4.00.3%2026-08-04
CVE-2026-18759ASUSTOR ABP improper privilege management8.5CNA v4.00.2%2026-08-04Fix
CVE-2026-18755GV-ASManager DLL hijacking7.3CNA v3.10.2%2026-08-04Fix
CVE-2026-18754Hard-coded cryptographic key on GV-AS1620 controller Firmware (GV-Cloud)9.1CNA v3.10.4%2026-08-04Fix
CVE-2026-18753Hard-coded cryptographic key on GV-AS1620 controller Firmware (GV-ASManager)9.1CNA v3.10.4%2026-08-04Fix
CVE-2026-18739rpm-software-management popt Popt-devel: Popt-static: Off-by-one in poptstuffargs2.5CNA v3.10.1%2026-08-04Fix
CVE-2026-18723diaowen DWSurvey Survey Status up-survey-status.do improper authorization5.3CNA v4.00.3%2026-08-04
CVE-2026-18722diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization5.3CNA v4.00.4%2026-08-04
CVE-2026-18721kalcaddle kodbox SSO API Login apiLogin redirect5.3CNA v4.00.4%2026-08-04
CVE-2026-18720kalcaddle kodbox msgWarning plugin action improper authorization6.9CNA v4.00.5%2026-08-04
CVE-2026-18719cemtan sar2html Search sar2html.py SQL injection5.3CNA v4.00.3%2026-08-04
CVE-2026-18686GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection9.3CNA v4.04.7%2026-08-04
CVE-2026-18657Microsoft Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows8.5CNA v4.00.2%2026-08-04Fix
CVE-2026-18656Microsoft Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows8.5CNA v4.00.2%2026-08-04Fix
CVE-2026-18650Missing authorization leading to Root code execution in HAVELSAN's Liman MYS8.8CNA v3.10.4%2026-08-04Fix
CVE-2026-18569Red Hat Keycloak backchannel logout improper signature verification3.7CNA v3.10.3%2026-08-04
CVE-2026-18401FasterXML jackson-core asynchronous JSON parser denial of service6.9CNA v4.00.4%2026-08-04Fix
CVE-2026-18103DHCP server OMAPI lease handling buffer overflow4.9CNA v3.10.7%2026-08-04
CVE-2026-17614Red Hat JBoss Enterprise Application Platform 7 WildFly's domain mode implementation path traversal4.4CNA v3.11.1%2026-08-04
CVE-2026-17070Vault Credential Confusion via authorization bypass in HAVELSAN's Liman MYS8.8CNA v3.10.4%2026-08-04Fix
CVE-2026-16881LY LINE client LINE Android app code injection8.7CNA v4.00.4%2026-08-04
CVE-2026-16793Remote command injection via OS Profile Password in Lenovo XClarity Orchestrator8.7CNA v4.00.5%2026-08-04Fix
CVE-2026-16792Global TLS certificate validation bypass in Lenovo XClarity Orchestrator7.0CNA v4.00.1%2026-08-04Fix
CVE-2026-16791Predictable Temporary File Symlink vulnerability in Lenovo XClarity Essentials OneCLI1.0CNA v4.00.1%2026-08-04Fix
CVE-2026-16623Create Block WordPress plugin Admin+ PHP code injection via Pattern Save (Multisite)8.0CISA ADP v3.10.5%2026-08-04Fix
CVE-2026-16618Improve SEO file upload handler unrestricted file upload9.8CISA ADP v3.10.8%2026-08-04
CVE-2026-16548Chat Widget: Floating Customer Support Button response endpoint unrestricted file upload6.5CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-16547REST API Log WordPress plugin unauthenticated sensitive Log data disclosure via download endpoint5.9CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-16546Wired Impact Volunteer Management WordPress plugin arbitrary RSVP Removal via wivm_remove_rsvp4.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-16536Simple Google Calendar Outlook Events Widget WordPress plugin unauthenticated SSRF via calendar_id5.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-16296Clearfy WordPress plugin open redirect via Cyrlitera 404 Handler4.7CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-16295Clearfy WordPress plugin sensitive information disclosure4.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-16293Blubrry PowerPress WordPress plugin Contributor+ stored XSS via Podcast Episode Chapters URL6.8CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-16070Brizy - Page Builder WordPress plugin Contributor+ Template type update via IDOR2.7CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-16069Brizy - Page Builder WordPress plugin Contributor+ stored XSS via Featured Image Focal Point6.8CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-16068Brizy - Page Builder WordPress plugin stored XSS3.5CISA ADP v3.10.2%2026-08-04Fix
CVE-2026-16056Contest Gallery WordPress plugin OpenAI Prompt History disclosure via post_cg_get_openai_prompts4.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-16035miniOrange 2FA WordPress plugin Subscriber+ Arbitrary-Recipient OTP Send4.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-15958Easy Integration for Dropbox file management AJAX actions missing authorization9.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-15920Django potential cross-site scripting via URLField values in the admin5.1CNA v4.00.4%2026-08-04Fix
CVE-2026-15830Django potential denial of service vulnerability via nested geometry collections6.9CNA v4.01.1%2026-08-04Fix
CVE-2026-15721Bilin Software HUMANIST Digital Human Resources query console SQL injection9.8CNA v3.10.3%2026-08-04Fix
CVE-2026-15337Django potential denial of service vulnerability in check_for_language6.9CNA v4.00.6%2026-08-04Fix
CVE-2026-15314Authenticated denial of service vulnerability in TP-Link Tapo P1107.1CNA v4.00.8%2026-08-04Fix
CVE-2026-15307Django server-side file-write and request forgery via spatial lookups8.7CNA v4.01.1%2026-08-04Fix
CVE-2026-15233Nested Pages WordPress plugin Editor+ stored XSS via post Title4.8CISA ADP v3.10.2%2026-08-04Fix
CVE-2026-14939Visualizer: Tables and Charts Manager WordPress plugin server-side request forgery6.8CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-14872Database for Contact Form 7, WPforms, Elementor forms WordPress plugin SQL injection6.8CISA ADP v3.10.4%2026-08-04Fix
CVE-2026-14848Paid Member Subscriptions WordPress plugin Cross-User Subscription Hijack via process_checkout5.4CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-14838Bilin Software and Informatics Consultancy HUMANIST Digital Human Resources information disclosure7.4CNA v3.10.3%2026-08-04Fix
CVE-2026-14824Quiz And Survey Master WordPress plugin Contributor+ stored XSS via Polar Question4.8CISA ADP v3.10.2%2026-08-04Fix
CVE-2026-14818Zyxel ATP series firmware path traversal7.2CNA v3.10.6%2026-08-04Fix
CVE-2026-14816Data443 The GDPR Framework consent record handling improper access control6.5CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-14804Hard-coded cryptographic key in Bilin Software's HUMANIST Digital Human Resources9.1CNA v3.10.4%2026-08-04Fix
CVE-2026-14465Session fixation in Bilin Software's HUMANIST Digital Human Resources6.5CNA v3.10.4%2026-08-04Fix
CVE-2026-14337Adobe Pega Platform stored cross-site scripting4.6CNA v4.00.4%2026-08-04Fix
CVE-2026-14219URL redirection in Bilin Software's HUMANIST Digital Human Resources5.4CNA v3.10.2%2026-08-04Fix
CVE-2026-14202Bilin Software and Informatics Consultancy HUMANIST Digital Human Resources response discrepancy5.3CNA v3.10.3%2026-08-04Fix
CVE-2026-14194Path traversal allows arbitrary file download in Bilin Software's HUMANIST Digital Human Resources6.5CNA v3.10.4%2026-08-04Fix
CVE-2026-14192Stored XSS in Bilin Software's HUMANIST Digital Human Resources5.4CNA v3.10.2%2026-08-04Fix
CVE-2026-14175Unrestricted file upload in Bilin Software's HUMANIST Digital Human Resources9.8CNA v3.10.5%2026-08-04Fix
CVE-2026-13229Zammad ticket article attachment cloning missing authorization7.1CNA v4.00.4%2026-08-04Fix
CVE-2026-13227ERPNext improper authorization in Prospect opportunities API7.1CNA v4.00.4%2026-08-04Fix
CVE-2026-12698wpForo Forum profile update handling improper access control4.3CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-11836Caliptra Core ROM Production Debug-Unlock Token Verification Missing Device Binding1.8CNA v4.00.1%2026-08-04
CVE-2026-11835Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)5.6CNA v4.00.1%2026-08-04
CVE-2026-11368zephyrproject zephyr use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer7.1CNA v3.10.3%2026-08-04Fix
CVE-2026-11366MonsterInsights measurement protocol secret handler authentication bypass3.7CISA ADP v3.10.2%2026-08-04Fix
CVE-2026-10710FBX ExtractDrive stack-based buffer overflow vulnerability in Autodesk FBX SDK7.8CNA v3.10.2%2026-08-04Fix
CVE-2026-10709FBX BinaryReadSectionHeader stack-based buffer overflow vulnerability in Autodesk FBX SDK7.8CNA v3.10.2%2026-08-04Fix
CVE-2026-10526EmbedPress WordPress plugin unauthenticated blind SSRF5.8CISA ADP v3.10.3%2026-08-04Fix
CVE-2026-10050Eclipse Jetty digest authentication lossy encoding8.7CNA v4.00.6%2026-08-04Fix
CVE-2026-10032Google Arbitrary JavaScript Execution via openUrl in @a2ui/web_core6.1CNA v4.00.1%2026-08-04Fix
CVE-2026-8508Zyxel WAX650S firmware "social_login.cgi" CGI program improper authentication6.5CNA v3.10.3%2026-08-04Exploit codeFix
CVE-2026-6837Zyxel WAX650S firmware "export-cgi" CGI program command injection7.2CNA v3.11.5%2026-08-04Exploit codeFix
CVE-2026-0163Google Android vpu_ioctl.c use-after-free9.8CISA ADP v3.10.4%2026-08-04Exploit codeFix
CVE-2026-69249cryptography certificate chain builder denial of service8.7CNA v4.00.3%2026-08-03Fix
CVE-2026-69248cryptography certificate name constraint verifier improper certificate validation6.9CNA v4.00.3%2026-08-03Fix
CVE-2026-69247cryptography PKCS7 decryption timing side channel8.2CNA v4.00.3%2026-08-03Fix
CVE-2026-69246Guzzle: Noncanonical host can bypass host-based checks7.2CNA v3.10.4%2026-08-03Fix
CVE-2026-69245Guzzle: Noncanonical cookie domain keeps subdomain scope6.5CNA v3.10.2%2026-08-03Fix
CVE-2026-69244AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)7.1CNA v4.00.5%2026-08-03Fix
CVE-2026-69243AIOHTTP: HTTP request smuggling via WebSocket upgrade6.3CNA v4.00.4%2026-08-03Exploit codeFix
CVE-2026-69240Sequelize: SQL injection (Oracle DB)9.8CNA v3.10.5%2026-08-03Fix
CVE-2026-69198ip-address special-use address classification server-side request forgery6.9CNA v4.00.5%2026-08-03Fix
CVE-2026-69192ip-address Address4 parser server-side request forgery7.7CNA v4.00.7%2026-08-03Fix
CVE-2026-69185Socket.IO binary attachment handling denial of service7.5CNA v3.10.6%2026-08-03Fix
CVE-2026-69153PostCSS source map loader path traversal6.3CNA v4.00.5%2026-08-03Fix
CVE-2026-69152brace-expansion denial of service7.5CNA v3.10.6%2026-08-03Fix
CVE-2026-69151Angular i18n: Cross-site scripting (XSS) via event-handler attributes7.6CNA v4.00.3%2026-08-03Fix
CVE-2026-69149Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to cross-site scripting (XSS)8.6CNA v4.00.4%2026-08-03Fix
CVE-2026-69097GitPython Config injection via Submodule Names7.3v3.10.3%2026-08-03Fix
CVE-2026-69096OpenWrt luci-app-dockerman Read ACL remote code execution8.7CNA v4.03.3%2026-08-03Fix
CVE-2026-69095OpenWrt luci-app-bmx7 path traversal via bmx7-info8.7CNA v4.00.9%2026-08-03
CVE-2026-69094Admidio IDOR via save_temporary mylist_function.php5.3CNA v4.00.3%2026-08-03Fix
CVE-2026-69093Admidio CSRF via category-report preferences7.1CNA v4.00.2%2026-08-03Fix
CVE-2026-69092Admidio reflected XSS via SSO/SAML endpoint6.9CNA v4.00.4%2026-08-03Fix
CVE-2026-69091Admidio authentication bypass via forum.php8.7CNA v4.00.6%2026-08-03Fix
CVE-2026-69090Admidio Cross-Organization Role Modification6.9CNA v4.00.3%2026-08-03Fix
CVE-2026-69089Grav CMS path traversal via watermark8.7CNA v4.00.5%2026-08-03Fix
CVE-2026-69088Grav CMS arbitrary Method Invocation via Blueprint8.6CNA v4.00.3%2026-08-03Fix
CVE-2026-69087getgrav grav-plugin-form grav form plugin open redirect via form.value Twig7.1CNA v4.00.4%2026-08-03Fix
CVE-2026-69086SiYuan path traversal via unvalidated avID8.3CNA v4.00.5%2026-08-03Fix
CVE-2026-69085SiYuan SQL injection via searchDocs9.9CNA v4.01.5%2026-08-03NucleiFix
CVE-2026-69084SiYuan SQL injection via searchEmbedBlock9.9CNA v4.01.6%2026-08-03NucleiExploit codeFix
CVE-2026-69083SiYuan SQL injection via fullTextSearchAssetContent9.9CNA v4.00.5%2026-08-03Fix
CVE-2026-69082MISP Project cti-transmute cross-site request forgery in the Administrative User Deletion endpoint8.8CNA v4.00.3%2026-08-03
CVE-2026-69079Unauthenticated denial of service via Unbounded Activity-Timeline Range in CTI-Transmute8.7CNA v4.00.5%2026-08-03
CVE-2026-69078Server-side request forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering8.8CNA v4.00.4%2026-08-03
CVE-2026-69075Stored cross-site scripting via Vue template injection in FlowIntel6.9CNA v4.00.5%2026-08-03
CVE-2026-68981Apache NiFi: Uncontrolled resource consumption through Decompression of HTTP requests8.8CNA v4.00.7%2026-08-03Fix
CVE-2026-68980Apache NiFi: Authorization bypass for Parameter Context Asset Deletion2.3CNA v4.00.5%2026-08-03Fix
CVE-2026-68979Apache NiFi: Missing authorization for Components Referenced by Parameter Context Updates5.9CNA v4.00.8%2026-08-03Fix
CVE-2026-68945Angular HttpTransferCache vulnerability8.8CNA v4.00.2%2026-08-03Fix
CVE-2026-68930Russh: Channel-scoped server callbacks can be reached without an open channel6.5CNA v3.10.4%2026-08-03Fix
CVE-2026-68742Sssd: Sssd: Nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr5.5CNA v3.10.1%2026-08-03Fix
CVE-2026-68587SiYuan information disclosure via getHeading*Transaction9.2CNA v4.00.4%2026-08-03Fix
CVE-2026-68586SiYuan Content Disclosure via getBacklinkDoc9.2CNA v4.00.4%2026-08-03Fix
CVE-2026-68585SiYuan Metadata Disclosure via getBlockInfo6.9CNA v4.00.3%2026-08-03Fix
CVE-2026-68584SiYuan authentication bypass via Content endpoints9.2CNA v4.00.5%2026-08-03Fix
CVE-2026-67978NASA cFS SBN UDP interface denial of service7.5CISA ADP v3.10.5%2026-08-03
CVE-2026-67977fprime framework FileDownlink SendPartial component integer overflow7.5CISA ADP v3.10.5%2026-08-03
CVE-2026-67976fprime framework SignalGen reference component denial of service7.5CISA ADP v3.10.5%2026-08-03
CVE-2026-67975NASA cFS improper access control7.5CISA ADP v3.10.4%2026-08-03
CVE-2026-67974NASA cFS Software Bus Network peer subscription handling denial of service7.5CISA ADP v3.10.5%2026-08-03
CVE-2026-67973NASA cFS CFDP receive path denial of service7.5CISA ADP v3.10.5%2026-08-03
CVE-2026-67972NASA cFS CFDP metadata receive handler information disclosure7.5CISA ADP v3.10.4%2026-08-03
CVE-2026-67970NASA cFS DS_SetDestPathCmd improper access control7.5CISA ADP v3.10.4%2026-08-03
CVE-2026-67969NASA cFS HS_MonitorApplications improper input validation7.5CISA ADP v3.10.4%2026-08-03
CVE-2026-67673OreSat Firmware EDL firmware flash command stack-based buffer overflow4.6CISA ADP v3.10.2%2026-08-03
CVE-2026-67617Microweber CMS stored XSS via tag_names parameter4.8CNA v4.00.3%2026-08-03
CVE-2026-67616owen2345 CamaleonCMS camaleon CMS missing authorization via /admin/post_type drafts endpoint5.3CNA v4.00.4%2026-08-03
CVE-2026-67612OpenEMR stored XSS via import_template.php Template Management4.8CNA v4.00.3%2026-08-03
CVE-2026-67611OpenEMR OAuth2 Password Grant authentication bypass via SMART Configuration8.6CNA v4.00.8%2026-08-03
CVE-2026-67610OpenEMR OAuth2 Dynamic Client Registration Unauthorized FHIR Access8.6CNA v4.00.5%2026-08-03
CVE-2026-67609Telenia TVox privilege escalation via Insecure sudoers Configuration8.5CNA v4.00.2%2026-08-03
CVE-2026-67608Telenia TVox OS command injection via action_audio.php8.6CNA v4.02.4%2026-08-03
CVE-2026-67599ClearOS OS command injection via Log Viewer filter parameter8.6CNA v4.02.4%2026-08-03Exploit code
CVE-2026-67598Emlog Pro TLS Certificate Validation Disabled in ai.php9.1CNA v4.00.3%2026-08-03Exploit code
CVE-2026-66326Microsoft Edge (Chromium-based) remote code execution6.5CNA v3.10.8%2026-08-03Fix
CVE-2026-66325Microsoft Edge (Chromium-based) spoofing6.1CNA v3.10.4%2026-08-03Fix
CVE-2026-66322Microsoft Edge (Chromium-based) spoofing7.1CNA v3.10.2%2026-08-03Fix
CVE-2026-66321Microsoft Edge (Chromium-based) remote code execution7.4CNA v3.11.1%2026-08-03Fix
CVE-2026-66318Microsoft Edge (Chromium-based) information disclosure8.1CNA v3.10.4%2026-08-03Fix
CVE-2026-66317Microsoft Edge (Chromium-based) tampering5.4CNA v3.10.2%2026-08-03Fix
CVE-2026-66316Microsoft Edge (Chromium-based) spoofing5.4CNA v3.10.2%2026-08-03Fix
CVE-2026-66315Microsoft Edge (Chromium-based) remote code execution7.5CNA v3.10.6%2026-08-03Fix
CVE-2026-66314Microsoft Edge (Chromium-based) information disclosure6.5CNA v3.10.6%2026-08-03Fix
CVE-2026-66313Microsoft Edge (Chromium-based) tampering6.8CNA v3.10.2%2026-08-03Fix
CVE-2026-66312Microsoft Edge (Chromium-based) remote code execution6.5CNA v3.11.1%2026-08-03Fix
CVE-2026-66311Microsoft Edge (Chromium-based) tampering6.2CNA v3.10.4%2026-08-03Fix
CVE-2026-66310Microsoft Edge for Android information disclosure7.7CNA v3.10.4%2026-08-03Fix
CVE-2026-66296Reflected XSS in oaskit's default HTML error handler5.1CNA v4.00.4%2026-08-03Fix
CVE-2026-66065Ouroboros: Untrusted project .env can still reach RCE8.4CNA v4.00.2%2026-08-03Fix
CVE-2026-65875baserCMS Users Community baserCMS CSV injection5.1CNA v4.00.3%2026-08-03Fix
CVE-2026-65804Microsoft Edge (Chromium-based) spoofing6.1CNA v3.10.4%2026-08-03Fix
CVE-2026-65802Microsoft Edge for Android information disclosure7.4CNA v3.10.9%2026-08-03Fix
CVE-2026-64827Telenia TVox authentication bypass via set_env.php9.3CNA v4.00.8%2026-08-03
CVE-2026-63563Toshiba Tec MFPs insecure default initialization6.9CNA v4.00.4%2026-08-03
CVE-2026-63545Toshiba Tec MFPs incomplete cleanup2.4CNA v4.00.2%2026-08-03
CVE-2026-62870Microsoft Excel remote code execution8.8CNA v3.10.8%2026-08-03Fix
CVE-2026-62416Sharp Network Scanner Tool Lite insecure default initialization6.9CNA v4.00.6%2026-08-03
CVE-2026-62354Apache NiFi: Incorrect authorization for Parameter Context Validation requests7.7CNA v4.00.5%2026-08-03Fix
CVE-2026-61524WebsiteBaker CMS file upload RCE via Module Installation8.6CNA v4.01.0%2026-08-03Fix
CVE-2026-61523WebsiteBaker CMS code injection via Droplets Editor8.6CNA v4.01.2%2026-08-03Fix
CVE-2026-61372Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions7.5CISA ADP v3.10.8%2026-08-03Fix
CVE-2026-60011Toshiba Tec MFPs forced browsing6.9CNA v4.00.4%2026-08-03
CVE-2026-59913Dell Display and Peripheral Manager (DDPM Mac) missing authentication7.8CNA v3.10.2%2026-08-03Fix
CVE-2026-59912Dell Display and Peripheral Manager (DDPM Mac) improper access control7.8CNA v3.10.1%2026-08-03Fix
CVE-2026-59652Legion of the Bouncy Castle BC-JAVA LDAP filter injection in legacy jdk1.4 LDAPStoreHelper6.9CNA v4.00.3%2026-08-03Fix
CVE-2026-59651Bouncy Castle for Java BKS keystore inadequate encryption strength7.1CNA v4.00.2%2026-08-03Fix
CVE-2026-59650Legion of the Bouncy Castle BC-JAVA MTI/A0 DH agreement exponentiates unvalidated peer value9.3CNA v4.00.3%2026-08-03Fix
CVE-2026-59649Legion of the Bouncy Castle Bouncy Castle for Java excessive memory allocation8.7CNA v4.00.5%2026-08-03Fix
CVE-2026-59648Legion of the Bouncy Castle BC-FJA OpenPGP Argon2 S2K honours attacker-chosen memory and passes6.9CNA v4.00.4%2026-08-03Fix
CVE-2026-59647Legion of the Bouncy Castle BC-FJA CRMF/CMP password-MAC honours unbounded iteration count6.9CNA v4.00.4%2026-08-03Fix
CVE-2026-59646Legion of the Bouncy Castle Bouncy Castle for Java excessive memory allocation8.7CNA v4.00.6%2026-08-03Fix
CVE-2026-59645Bouncy Castle for Java OER parser uncontrolled recursion8.7CNA v4.00.5%2026-08-03Fix
CVE-2026-59644Legion of the Bouncy Castle Bouncy Castle for Java MLS hash ratchet excessive iteration8.7CNA v4.00.5%2026-08-03Fix
CVE-2026-59643Legion of the Bouncy Castle BC-FJA OpenPGP inline-signature policy failures silently ignored8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-59642Legion of the Bouncy Castle Bouncy Castle for Java improper integrity check validation8.7CNA v4.00.3%2026-08-03Fix
CVE-2026-59641Legion of the Bouncy Castle Bouncy Castle for Java insufficient verification of data authenticity8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-59640Legion of the Bouncy Castle Bouncy Castle for Java OpenPGP CFB decryption observable discrepancy8.7CNA v4.00.3%2026-08-03Fix
CVE-2026-59639Legion of the Bouncy Castle Bouncy Castle for Java improper signature verification8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-59638Legion of the Bouncy Castle Bouncy Castle for Java JSSE hostname verifier vulnerability9.3CNA v4.00.3%2026-08-03Fix
CVE-2026-58139DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure6.0CNA v4.00.5%2026-08-03
CVE-2026-58063Legion of the Bouncy Castle Bouncy Castle for Java BCFKS keystore loader resource exhaustion5.3CNA v4.00.4%2026-08-03Fix
CVE-2026-58062Legion of the Bouncy Castle Bouncy Castle for Java improper certificate validation9.3CNA v4.00.4%2026-08-03Fix
CVE-2026-58061Legion of the Bouncy Castle Bouncy Castle for Java CCM cipher mode vulnerability8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-58060Bouncy Castle for Java HSS public-key verification excessive memory allocation8.7CNA v4.00.6%2026-08-03Fix
CVE-2026-58059Bouncy Castle for Java X.500 name formatting vulnerability8.7CNA v4.00.5%2026-08-03Fix
CVE-2026-56609HCL iControl TLS protocol support vulnerability4.8CNA v3.10.2%2026-08-03Fix
CVE-2026-56608HCL iControl missing access control3.7CNA v3.10.3%2026-08-03Fix
CVE-2026-52521Z-BlogPHP A SQL injection8.1CISA ADP v3.10.4%2026-08-03
CVE-2026-52520Emlog CMS article publishing module stored cross-site scripting5.4CISA ADP v3.10.3%2026-08-03
CVE-2026-52102openmediavault-md plugin of OpenMediaVault v8.0.4-1 An OS command injection9.8CISA ADP v3.12.9%2026-08-03Exploit code
CVE-2026-51775Fastadmin v.1.6.1.20250430 SQL injection9.8CISA ADP v3.10.5%2026-08-03
CVE-2026-51190serverless-devs/s s init command OS command injection9.8CISA ADP v3.11.9%2026-08-03
CVE-2026-49132OPNsense stored XSS via Certificate Description field5.1CNA v4.00.2%2026-08-03Fix
CVE-2026-49131OPNsense stored XSS via Firewall Rule Description field5.1CNA v4.00.3%2026-08-03Fix
CVE-2026-48399Adobe Campaign Classic (ACC) Violation of Secure Design Principles7.5CNA v3.10.9%2026-08-03Fix
CVE-2026-48333Adobe Campaign Classic (ACC) incorrect authorization9.8CNA v3.10.9%2026-08-03Fix
CVE-2026-48331Adobe Campaign Classic (ACC) server-side request forgery (SSRF)10.0CNA v3.10.9%2026-08-03Fix
CVE-2026-48330Adobe Campaign Classic improper neutralization of special elements used in an SQL command10.0CNA v3.11.0%2026-08-03Fix
CVE-2026-48326Adobe Campaign Classic improper neutralization of special elements used in an SQL command9.9CNA v3.11.0%2026-08-03Fix
CVE-2026-48323Adobe Campaign Classic (ACC) improper neutralization of special elements used in a template engine10.0CNA v3.11.4%2026-08-03Fix
CVE-2026-48317Adobe Campaign Classic improper neutralization of directives in dynamically evaluated code9.6CNA v3.10.9%2026-08-03Fix
CVE-2026-48115Misskey: Improper authorization in the Announcements API6.3CNA v4.00.4%2026-08-03Fix
CVE-2026-48113Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData injection8.5CNA v4.00.4%2026-08-03Fix
CVE-2026-48063Baileys has message upsert / hist sync spoofing and app state corruption when9.3CNA v4.00.2%2026-08-03Fix
CVE-2026-48061Litestar AllowedHostsMiddleware vulnerability5.9CNA v3.10.4%2026-08-03Fix
CVE-2026-48031dhax go-base Go Restful API Boilerplate: Hard-coded JWT Secret random allows Token Forgery9.1CNA v3.10.6%2026-08-03Fix
CVE-2026-47746Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks8.9CNA v4.00.3%2026-08-03Fix
CVE-2026-47211Ouroboros: Remote code execution via Untrusted Project-Directory .env8.4CNA v4.00.2%2026-08-03Fix
CVE-2026-46714Misskey: Denial of service via uncontrolled recursion in Theme Compilation5.1CNA v4.00.4%2026-08-03Fix
CVE-2026-46713Misskey: JSON-LD signature validation + compaction may lead to improper activity handling9.2CNA v4.00.3%2026-08-03Fix
CVE-2026-46712Misskey: Lack of proper permission checks in Direct Messaging feature2.3CNA v4.00.4%2026-08-03Fix
CVE-2026-41453Krayin CRM blind SQL injection via LeadDataGrid.php rotten_lead parameter8.7CNA v4.00.5%2026-08-03Fix
CVE-2026-41452Krayin CRM missing authentication via install/API/admin-config-setup9.3CNA v4.03.7%2026-08-03NucleiExploit codeFix
CVE-2026-41447FirmaCheck DLL hijacking via Unvalidated OpenSSL Configuration Path8.5CNA v4.00.2%2026-08-03Fix
CVE-2026-40717Dell Monitor driver link following6.6CNA v3.10.2%2026-08-03Fix
CVE-2026-39932OpenEMR remote code execution via CategoryTree eval injection9.4CNA v4.02.0%2026-08-03
CVE-2026-39931OpenEMR authenticated SQL injection via backup.php Import feature8.6CNA v4.00.6%2026-08-03
CVE-2026-38447osTicket API key generation insufficient entropy9.8CISA ADP v3.10.7%2026-08-03
CVE-2026-38446osTicket A stored cross-site scripting6.1CISA ADP v3.10.3%2026-08-03
CVE-2026-38444osTicket email reply parser stored cross-site scripting6.1CISA ADP v3.10.4%2026-08-03
CVE-2026-33591Tranquil IT Systems WAPT Server authentication bypass on WaptServer10.0CNA v4.00.7%2026-08-03Fix
CVE-2026-28147Unlimited Elements For Elementor WordPress plugin broken access control5.4CNA v3.10.3%2026-08-03Fix
CVE-2026-21555UNISOC UDX710 modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21554UNISOC UDX710 modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21553UNISOC chipsets modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21552UNISOC chipsets modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21551UNISOC chipsets modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21550UNISOC chipsets modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21549UNISOC chipsets modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-21548UNISOC chipsets nr modem improper input validation7.5CNA v3.10.7%2026-08-03Fix
CVE-2026-20498MediaTek chipset geniezone privilege escalation6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20497MediaTek chipset geniezone out-of-bounds write6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20496MediaTek chipset geniezone out-of-bounds read4.4CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20495MediaTek chipset Bluetooth driver insecure permissions7.8CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20494MediaTek chipset wifi out-of-bounds read5.5CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20493MediaTek chipset wifi out-of-bounds write4.4CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20492MediaTek chipset Audio HAL denial of service5.5CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20491MediaTek chipset out-of-bounds write5.5CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20490MediaTek chipset ccci out-of-bounds read4.4CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20489MediaTek chipset display information disclosure4.4CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20488MediaTek chipset display information disclosure4.4CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20486MediaTek chipset imgsensor crash6.7CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20485MediaTek chipset HFRP out-of-bounds write6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20484MediaTek chipset TFA information disclosure4.4CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20483MediaTek chipset Telephony privilege escalation7.7CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20482MediaTek chipset wlan STA FW denial of service6.5CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-20481MediaTek chipset geniezone out-of-bounds write6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20480MediaTek chipset Audio HAL out-of-bounds write5.5CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20479MediaTek chipset Modem out-of-bounds read7.5CISA ADP v3.10.7%2026-08-03Fix
CVE-2026-20478MediaTek chipset Audio HAL out-of-bounds write5.5CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20477MediaTek chipset display out-of-bounds write6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20476MediaTek chipset ccci out-of-bounds read5.5CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20475MediaTek chipset display out-of-bounds write6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20474MediaTek chipset display privilege escalation6.0CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20473MediaTek chipset display memory corruption6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20472MediaTek chipset TFA out-of-bounds write4.4CISA ADP v3.10.1%2026-08-03Fix
CVE-2026-20471MediaTek chipset DA out-of-bounds write4.6CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20470MediaTek chipset Telephony information disclosure6.2CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20469MediaTek chipset trusted_mem privilege escalation6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20468MediaTek chipset apusys privilege escalation6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20467MediaTek chipset apusys privilege escalation6.0CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20466MediaTek chipset sec boot privilege escalation6.1CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-20465MediaTek chipset wlan AP driver out-of-bounds write8.1CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-20464MediaTek chipset hevc decoder out-of-bounds write6.5CISA ADP v3.10.5%2026-08-03Fix
CVE-2026-18738Shlink CSV formula injection via Visit Export CLI5.1CNA v4.00.5%2026-08-03
CVE-2026-18737Shlink blind SQL injection via tags/stats orderBy parameter7.1CNA v4.00.3%2026-08-03
CVE-2026-18736Shlink server-side request forgery via Short URL Title Auto-Resolution5.3CNA v4.00.3%2026-08-03
CVE-2026-18733AWS strands-agents-tools prompt injection bypasses shell tool consent gate in Strands Agents tools7.5CNA v4.00.6%2026-08-03Fix
CVE-2026-18718Ghidra Swift Demangler Analyzer arbitrary code execution via Project State7.1CNA v4.00.2%2026-08-03Exploit codeFix
CVE-2026-18685GL.iNet GL-MT3000 modem.so glc set_upgrade command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18684GL.iNet GL-MT3000 modem.so glc remove_profile command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18682OpenAkita file upload API upload cross-site scripting2.3CNA v4.00.4%2026-08-03
CVE-2026-18667Tenable Sensor Proxy remote code execution9.3CNA v4.00.7%2026-08-03Fix
CVE-2026-18655Broker Credential and OAuth token disclosure in AWS Labs Amazon MQ MCP Server via prompt injection7.1CNA v4.00.4%2026-08-03Fix
CVE-2026-18654Disabled SSH host key verification in Amazon AWS CLI EMR helper commands6.9CNA v4.00.3%2026-08-03Fix
CVE-2026-18651Red Hat 389 Directory Server SASL PLAIN bind authentication bypass5.4CNA v3.10.3%2026-08-03Fix
CVE-2026-18648Blix Email Blue Mail Calendar App react-native-receive-sharing-intent path traversal4.8CNA v4.00.2%2026-08-03
CVE-2026-18647jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery6.9CNA v4.00.5%2026-08-03
CVE-2026-18646danpros HTMLy Author Name HTMLy.php path traversal6.9CNA v4.00.8%2026-08-03
CVE-2026-18645danpros HTMLy Admin Content endpoint admin.php add_content path traversal5.3CNA v4.00.5%2026-08-03
CVE-2026-18644danpros HTMLy Delete Username Endpoint HTMLy.php unlink path traversal5.3CNA v4.00.5%2026-08-03
CVE-2026-18642Remote code execution via insecure deserialization in TÜBİTAK BİLGEM's eta-otp-lock7.8CNA v3.10.4%2026-08-03Fix
CVE-2026-18641Sangfor Operation and Maintenance Security Management System login OS command injection6.9CNA v4.02.7%2026-08-03
CVE-2026-18632langgenius Dify Jinja2 handler server-side template injection5.3CNA v4.00.4%2026-08-03
CVE-2026-18631jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization5.3CNA v4.00.4%2026-08-03
CVE-2026-18616GL-iNet GL-MT3000 wg-server.so Native plugin glc server.set_peer command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18615GL-iNet GL-MT3000 wg-server.so Native plugin glc wg-server.generate_publickey command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18614GL-iNet GL-MT3000 s2s.so Native plugin glc s2s.enable_echo_server command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18613GL-iNet GL-MT3000 plugins.so Native plugin glc plugins.set_config injection9.3CNA v4.01.0%2026-08-03
CVE-2026-18612GL-iNet GL-MT3000 plugins.so Native plugin glc plugins.install_package command injection9.3CNA v4.04.0%2026-08-03
CVE-2026-18610NewType WebEIP EIP_Com_FileList.aspx improper authentication6.9CNA v4.00.7%2026-08-03
CVE-2026-18607Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow8.7CNA v4.00.8%2026-08-03
CVE-2026-18606Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management8.5CNA v4.00.2%2026-08-03
CVE-2026-18605CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search path7.3CNA v4.00.2%2026-08-03
CVE-2026-18604textPlus Text Message and Call App DialerActivity vulnerability4.8CNA v4.00.1%2026-08-03
CVE-2026-18602GL.iNet GL-MT3000 ovpn-client plugin command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18601GL.iNet GL-MT3000 ovpn-client.so Native plugin glc ovpn-client.check_config command injection9.3CNA v4.03.6%2026-08-03
CVE-2026-18600GL.iNet GL-MT3000 Network Lua RPC plugin network network.switch_status command injection8.7CNA v4.03.2%2026-08-03
CVE-2026-18599GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.set_config command injection8.6CNA v4.04.4%2026-08-03
CVE-2026-18598GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection8.7CNA v4.03.2%2026-08-03
CVE-2026-18593vxcontrol PentAGI Tool Management protocol pentester.tmpl sandbox6.3CNA v4.00.4%2026-08-03
CVE-2026-18592osCommerce Email Template Configuration EmailController.php EmailController SQL injection5.1CNA v4.00.3%2026-08-03
CVE-2026-18591Meesho Online Shopping App com.Meesho.supply cleartext storage2.4CNA v4.00.1%2026-08-03
CVE-2026-18590Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection5.3CNA v4.01.8%2026-08-03
CVE-2026-18589Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow9.3CNA v4.01.1%2026-08-03
CVE-2026-18588Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow9.3CNA v4.01.1%2026-08-03
CVE-2026-18587Wavlink WL-NU516U1 Config Import os command injection7.7CNA v4.02.0%2026-08-03
CVE-2026-18585GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow5.3CNA v4.00.5%2026-08-03
CVE-2026-18584GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization5.3CNA v4.00.4%2026-08-03
CVE-2026-18583Mz-automation libiec61850 MMS request mms_mapping.c checkDataSetAccess out-of-bounds6.9CNA v4.00.9%2026-08-03Fix
CVE-2026-18582MZ Automation libiec61850 reporting handler vulnerability6.9CNA v4.00.9%2026-08-03Fix
CVE-2026-18581ggml-org llama.cpp Jinja Minja template parser.cpp assertion4.8CNA v4.00.2%2026-08-03
CVE-2026-18574Authentication bypass in Check Point Security Management Server9.3CNA v4.00.9%2026-08-03Fix
CVE-2026-18568XML::Sig verify function improper signature verification7.5CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-18508GNU tar one-top-level extraction link following4.4CNA v3.10.1%2026-08-03Fix
CVE-2026-18477Tar: Tar: Toctou in incremental dumpdir x rename handling allows restore path escape4.4CNA v3.10.1%2026-08-03Fix
CVE-2026-18248@fastify/aws-lambda vulnerable to Lambda event spoofing9.1CNA v3.10.4%2026-08-03Fix
CVE-2026-18243HP DesignJet T3500 Potential cross-site scripting (XSS)6.9CNA v4.00.3%2026-08-03Fix
CVE-2026-18108Net::SAML2 encrypted assertion handling improper signature verification9.8CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-18092Net::SAML2 versions for Perl allow SAML authentication bypass8.1CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-18089Net::SAML2 SAML response certificate check improper certificate validation7.5CISA ADP v3.10.2%2026-08-03Fix
CVE-2026-16572LogMyTrip WordPress plugin unauthenticated SQL injection via tid Cookie8.6CISA ADP v3.10.4%2026-08-03
CVE-2026-16565Dokan product attribute REST API insecure direct object reference4.3CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-16564Dokan orders bulk-actions REST endpoint insecure direct object reference4.3CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-16563Academy LMS WordPress plugin arbitrary Lesson content disclosure via lessons REST endpoint6.5CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-16539SM Page Duplicator WordPress plugin Editor+ SQL injection via page Duplication8.1CISA ADP v3.10.4%2026-08-03
CVE-2026-16534Import and export users and customers CSV import privilege escalation9.1CISA ADP v3.10.4%2026-08-03Fix
CVE-2026-16532Link Library WordPress plugin unauthenticated SQL injection via the Front-End Link Submission form9.1CISA ADP v3.10.5%2026-08-03Fix
CVE-2026-16300ChamaWP password reset missing authorization9.8CISA ADP v3.10.5%2026-08-03Fix
CVE-2026-16297Clearfy WordPress plugin Admin+ PHP object injection via settings import4.1CISA ADP v3.10.4%2026-08-03Fix
CVE-2026-16289ProfileGrid WordPress plugin Group Join request disclosure via pm_get_all_requests_from_group4.3CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-16276Classified Listing WordPress plugin Store Revenue Total disclosure via rtcl_revenue_order_search2.7CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-16274Classified Listing WordPress plugin Unpublished post content disclosure via rtcl_block_css_get_posts2.7CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-16250Personal QR Message WordPress plugin unauthenticated arbitrary file upload9.8CISA ADP v3.10.8%2026-08-03
CVE-2026-16060Insert or Embed Articulate Content into WordPress plugin Editor+ arbitrary file upload9.8CISA ADP v3.10.8%2026-08-03
CVE-2026-16057Contest Gallery WordPress plugin arbitrary post deletion via post_cg_youtube_delete_from_library6.5CISA ADP v3.10.4%2026-08-03Fix
CVE-2026-15931Simple Membership WordPress plugin unauthenticated stored XSS6.1CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-15930Simple Membership WordPress plugin unauthenticated Administrator account takeover9.4CISA ADP v3.10.4%2026-08-03Fix
CVE-2026-15430Wellbia XIGNCODE3 IRP_MJ_WRITE command interface improper access control6.2CISA ADP v3.10.2%2026-08-03Exploit code
CVE-2026-15383Blog Floating Button WordPress plugin unauthenticated stored XSS via User-Agent Header6.1CISA ADP v3.10.3%2026-08-03
CVE-2026-15260Geo My WP WordPress plugin arbitrary Geolocation Record modification and deletion via IDOR4.3CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-15254Simply Schedule Appointments WordPress plugin sensitive data disclosure6.5CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-15231TaxoPress private post access check insecure direct object reference2.7CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-15055Legion of the Bouncy Castle BC-FJA PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input5.3CNA v4.00.3%2026-08-03Fix
CVE-2026-14682Bouncy Castle for Java definite-length decoding excessive memory allocation8.7CNA v4.00.3%2026-08-03Fix
CVE-2026-14557SoftMarket WordPress plugin unauthenticated account takeover via email verification bypass9.1CISA ADP v3.10.5%2026-08-03
CVE-2026-13586Legion of the Bouncy Castle BC-FJA PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)5.3CNA v4.00.4%2026-08-03Fix
CVE-2026-13506Legion of the Bouncy Castle BC-FJA lazy ASN.1 sequence forcing resets nesting-depth guard8.7CNA v4.00.4%2026-08-03Fix
CVE-2026-13340SVG Support WordPress plugin Author+ stored XSS via .svgz Sanitization bypass6.1CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-12965Super Store Finder WordPress plugin unauthenticated SQL injection via ssf_tracking9.1CISA ADP v3.10.5%2026-08-03Fix
CVE-2026-12872Webinfos WordPress plugin unauthenticated arbitrary file upload9.8CISA ADP v3.11.0%2026-08-03
CVE-2026-12860Bouncy Castle for Java RSA PKCS#1 improper signature verification8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-12852Legion of the Bouncy Castle BC-JAVA MLS wire decoder excessive memory allocation8.7CNA v4.00.3%2026-08-03Fix
CVE-2026-12817Legion of the Bouncy Castle BC-FJA OpenPGP AEAD decryption skips final tag on chunk-aligned data8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-12816Legion of the Bouncy Castle BC-JAVA IESEngine stream-mode MAC forgery via length-dependent KDF split8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-12803Legion of the Bouncy Castle BC-JAVA KCCMBlockCipher MAC does not bind nonce when AAD is absent8.7CNA v4.00.2%2026-08-03Fix
CVE-2026-12802Legion of the Bouncy Castle BC-FJA CMS AuthEnvelopedData fails to enforce tag-length on decryption8.7CNA v4.00.1%2026-08-03Fix
CVE-2026-12259Improper input validation in nltk/nltk6.5NVD v3.10.1%2026-08-03Fix
CVE-2026-12185Bouncy Castle for Java excessive memory allocation7.1CNA v4.00.3%2026-08-03Fix
CVE-2026-10849Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body8.2CNA v3.10.5%2026-08-03Fix
CVE-2026-9593IDTM FDI Unauthorized Debug Interface Enablement8.4CNA v4.00.2%2026-08-03Fix
CVE-2026-9487XML::Sig versions for Perl allow signature wrapping via duplicate ID9.1CISA ADP v3.10.3%2026-08-03Fix
CVE-2026-9390XML::Sig versions for Perl allow XPath injection in ID lookup9.1CISA ADP v3.10.5%2026-08-03Fix
CVE-2026-8794PaperCut NG/MF: User enumeration via timing attack6.9CNA v4.00.7%2026-08-03Exploit codeFix
CVE-2026-8793PaperCut NG/MF: Insufficient brute-force protection6.9CNA v4.00.7%2026-08-03Fix
CVE-2026-8763Legion of the Bouncy Castle BC-FJA name Constraints bypass via trailing dot in rfc822Name and URI9.3CNA v4.00.4%2026-08-03Fix
CVE-2026-6695Gimp: Gimp: Remote code execution via crafted paa file5.5NVD v3.10.3%2026-08-03Fix
CVE-2026-6694Red Hat Enterprise Linux 6 gimp: Gimp file-png plugin: Denial of service5.5CNA v3.10.2%2026-08-03Fix
CVE-2026-4793Synology Assistant incorrect default permissions7.3CNA v3.10.1%2026-08-03Fix
CVE-2026-2346IDOR in Menulux Software's Mobile App9.8CNA v3.10.5%2026-08-03
CVE-2026-0392eParakstītājs for Windows remote code execution via unauthenticated auto-update7.3CNA v4.00.1%2026-08-03Fix
CVE-2026-68583openwrt luci luci-app-adblock-fast stored XSS via file_url.name5.1CNA v4.00.2%2026-08-02Fix
CVE-2026-68582Vikunja Broken Object Level Authorization via Link-Share Token9.3CNA v4.00.4%2026-08-02Fix
CVE-2026-68581Vikunja authentication bypass via Principal ID Collision8.6CNA v4.00.5%2026-08-02Fix
CVE-2026-68580FreeRDP integer overflow via Audio Input Channel7.7CNA v4.00.3%2026-08-02Fix
CVE-2026-68579FreeRDP heap overflow via CliprdrStream_Read8.7CNA v4.00.5%2026-08-02Fix
CVE-2026-68578ArcadeDB authentication bypass via MCP Transport7.7CNA v4.00.4%2026-08-02Fix
CVE-2026-67357ArcadeDB information disclosure via get_server_settings7.7CNA v4.00.4%2026-08-02Fix
CVE-2026-67356ArcadeDB privilege escalation via JavaScript Trigger8.7CNA v4.00.4%2026-08-02Fix
CVE-2026-65321PyAthena SQL injection via DefaultParameterFormatter delete/CTAS9.3CNA v4.00.8%2026-08-02Exploit codeFix
CVE-2026-18577N-able N-central authentication bypass using an alternate path or channel8.2CNA v4.014.6%2026-08-02KEVNucleiExploit codeFix
CVE-2026-18573Red Hat Keycloak client policy enforcement missing authorization6.5CNA v3.10.5%2026-08-02Fix
CVE-2026-18572Red Hat Keycloak authorization time-policy evaluation incorrect authorization6.5CNA v3.10.4%2026-08-02Fix
CVE-2026-18571Red Hat Keycloak user creation missing authorization6.6CNA v3.10.5%2026-08-02Fix
CVE-2026-18570Red Hat Keycloak client policy validation missing authorization5.4CNA v3.10.3%2026-08-02Fix
CVE-2026-16540Simply Schedule Appointments purge endpoint incorrect authorization7.5CISA ADP v3.10.4%2026-08-02Exploit codeFix
CVE-2026-16292Frontend File Manager WordPress plugin file Metadata update via CSRF5.4CISA ADP v3.10.1%2026-08-02
CVE-2026-16291ProfileGrid WordPress plugin Subscriber+ arbitrary Notification deletion via IDOR4.3CISA ADP v3.10.3%2026-08-02Fix
CVE-2026-16285WooCommerce Product Attachment WordPress plugin unauthenticated arbitrary Media download7.5CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-16273Narrative Publisher WordPress plugin Contributor+ stored XSS via narrative_post_script post Meta4.6CISA ADP v3.10.2%2026-08-02
CVE-2026-16261Social Login password reset improper authentication7.5CISA ADP v3.10.6%2026-08-02
CVE-2026-16256Pouco Import Users WordPress plugin unauthenticated privilege escalation9.8CISA ADP v3.10.5%2026-08-02
CVE-2026-16064Event Booking Manager for WooCommerce quick edit event handler incorrect authorization5.4CISA ADP v3.10.2%2026-08-02Fix
CVE-2026-16063Event Booking Manager for WooCommerce WordPress plugin Author+ stored XSS via Event Timeline content5.4CISA ADP v3.10.2%2026-08-02Fix
CVE-2026-16062Event Booking Manager for WooCommerce WordPress plugin PHP object injection6.6CISA ADP v3.10.6%2026-08-02Fix
CVE-2026-16042LWS Optimize WordPress plugin Subscriber+ Cache deletion4.3CISA ADP v3.10.3%2026-08-02Fix
CVE-2026-15939Simple Restrict WordPress plugin Contributor+ Restricted content disclosure via REST API2.7CISA ADP v3.10.3%2026-08-02Fix
CVE-2026-15385RT Mega Menu WordPress plugin Subscriber+ stored XSS via Menu Item CSS5.4CISA ADP v3.10.2%2026-08-02Fix
CVE-2026-15248Meta Box WordPress plugin Contributor+ arbitrary Attachment deletion via IDOR5.5CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-15241AI ChatBot for WooCommerce Gemini API AJAX handler missing authorization7.5CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-15236Gallery for Google Photos WordPress plugin unauthenticated Google OAuth token disclosure7.5CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-15206SMS Alert Order Notifications WooCommerce WordPress plugin unauthenticated account takeover7.5CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-15151Five Star Restaurant Reservations WordPress plugin Booking Manager+ missing authorization7.5CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-14938FluentBoards WordPress plugin Subscriber+ Cross-Board Task disclosure via IDOR4.3CISA ADP v3.10.3%2026-08-02Fix
CVE-2026-14920AcyMailing WordPress plugin unauthenticated SQL injection via subscription[] parameter8.2CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-14864JetEngine WordPress plugin Contributor+ stored XSS via jet_engine shortcode5.4CISA ADP v3.10.2%2026-08-02Fix
CVE-2026-14841King Addons for Elementor WordPress plugin reflected XSS via posts Grid widget6.1CISA ADP v3.10.3%2026-08-02Fix
CVE-2026-14817Element Pack Elementor Addons WordPress plugin DOM-based stored XSS6.8CISA ADP v3.10.4%2026-08-02Fix
CVE-2026-13389WebToffee Cookie Consent REST API routes missing authorization6.5CISA ADP v3.10.3%2026-08-02Reported exploitedFix
CVE-2026-12586Lenxel WP WordPress theme unauthenticated account takeover via arbitrary password reset8.1CISA ADP v3.10.2%2026-08-02
CVE-2026-12231Exclusive Addons for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-02Fix
CVE-2026-11872Clever Mega Menu for Visual Composer menu item metadata update improper access control4.3CISA ADP v3.10.3%2026-08-02
CVE-2026-10848Out-of-bounds read in Zephyr OCPP RPC message parser (parse_rpc_msg)7.0CNA v3.10.4%2026-08-02Fix
CVE-2026-10774Zephyr Bluetooth Mesh subnet key management memory leak2.4CNA v3.10.3%2026-08-02Fix
CVE-2026-9856Path traversal in huggingface/transformers7.1CNA v3.00.5%2026-08-02Fix
CVE-2026-9335Improper Handling of HDF5 ExternalLinks in keras-team/keras6.5CNA v3.00.8%2026-08-02Exploit codeFix
CVE-2026-3245Canon Production Printing PRISMAproduction deserialization of untrusted data7.7CNA v4.00.7%2026-08-02Fix
CVE-2026-67355Guzzlehttp/guzzle Host-only Cookie Scope8.2CNA v4.00.4%2026-08-01Fix
CVE-2026-67354Guzzlehttp/guzzle URI Fragment Disclosure via Referer8.2CNA v4.00.4%2026-08-01Fix
CVE-2026-67353Guzzlehttp/guzzle Unbounded Cookie denial of service6.9CNA v4.00.4%2026-08-01Fix
CVE-2026-67352openwrt luci luci-app-https-dns-proxy stored XSS via resolver_url6.8CNA v4.00.4%2026-08-01Fix
CVE-2026-67344ArcadeDB authentication bypass via ALTER type8.5CNA v4.00.2%2026-08-01Fix
CVE-2026-67343ArcadeDB Cluster token disclosure via GET /API/v1/server8.7CNA v4.00.5%2026-08-01Fix
CVE-2026-67342ArcadeDB authorization bypass via Database Handlers9.3CNA v4.00.5%2026-08-01Fix
CVE-2026-67341ArcadeDB authorization bypass via SQL DEFINE FUNCTION9.3CNA v4.00.5%2026-08-01Fix
CVE-2026-67340ArcadeDB remote code execution via Trigger scripts8.6CNA v4.00.9%2026-08-01Fix
CVE-2026-67339Guzzlehttp/guzzle Proxy-Authorization Header Disclosure6.9CNA v4.00.4%2026-08-01Fix
CVE-2026-67338JupyterLab stored XSS via Extension Manager5.1CNA v4.00.3%2026-08-01Fix
CVE-2026-67337better-auth Two-Factor authentication bypass via session.cookieCache7.1CNA v4.00.5%2026-08-01Fix
CVE-2026-67336better-auth Insecure Cryptographic Defaults via oidcProvider9.4CNA v4.00.2%2026-08-01Fix
CVE-2026-67335better-auth OAuth State Validation Bypass6.0CNA v4.00.3%2026-08-01Fix
CVE-2026-67334better-auth Stale Sessions Persist after User Deletion5.1CNA v4.00.3%2026-08-01Fix
CVE-2026-67333better-auth stored XSS via javascript redirect_uri5.1CNA v4.00.3%2026-08-01Fix
CVE-2026-67332@better-auth/oauth-provider authorization bypass5.3CNA v4.00.3%2026-08-01Fix
CVE-2026-67331better-auth SCIM authorization bypass8.7CNA v4.00.4%2026-08-01Fix
CVE-2026-67330better-auth SCIM account takeover via Provider-ID Collision9.4CNA v4.00.6%2026-08-01Fix
CVE-2026-67329@better-auth/stripe authorization bypass via Organization Subscription7.1CNA v4.00.3%2026-08-01Fix
CVE-2026-67328@better-auth/sso account takeover via SSO8.6CNA v4.00.5%2026-08-01Fix
CVE-2026-67327better-auth account takeover via Magic-Link Email-OTP8.7CNA v4.00.4%2026-08-01Fix
CVE-2026-67326GitPython Newline injection via config_writer section7.8v3.10.3%2026-08-01Fix
CVE-2026-67325GitPython command injection via option prefix abbreviation8.7CNA v4.02.2%2026-08-01Fix
CVE-2026-67324GitPython authentication bypass via Joined Short options9.3CNA v4.00.6%2026-08-01Fix
CVE-2026-67323GitPython command injection via unguarded Git options8.6CNA v4.01.3%2026-08-01Fix
CVE-2026-67322GitPython Environment Variable Exfiltration via clone_from8.7CNA v4.00.3%2026-08-01Fix
CVE-2026-67321axios and denial of service via maxDepth bypass7.5v3.10.5%2026-08-01Fix
CVE-2026-67320axios prototype pollution via Node HTTP adapter7.5v3.10.5%2026-08-01Fix
CVE-2026-67319axios prototype pollution via nested option objects3.7NVD v3.10.3%2026-08-01Fix
CVE-2026-67318axios maxBodyLength Bypass via HTTP/25.3v3.10.6%2026-08-01Fix
CVE-2026-67317axios maxBodyLength Bypass via ReadableStream7.5v3.10.6%2026-08-01Fix
CVE-2026-67316axios prototype pollution via bodyless methods7.4v3.10.4%2026-08-01Fix
CVE-2026-67315Axios: NO_PROXY bypass for local addresses in axios7.5v3.10.5%2026-08-01Fix
CVE-2026-67314axios prototype pollution via auth subfields6.5v3.10.4%2026-08-01Fix
CVE-2026-67313axios denial of service via formDataToJSON7.5v3.10.5%2026-08-01Fix
CVE-2026-67312axios denial of service via formToJSON7.5v3.10.5%2026-08-01Fix
CVE-2026-67311Budibase SSRF Blacklist Bypass via HTTP Redirect8.2CNA v4.00.4%2026-08-01Fix
CVE-2026-67310openremote Cross-Tenant IDOR via setAssetLinks5.3CNA v4.00.2%2026-08-01Fix
CVE-2026-67309Traefik path traversal via RewriteTarget authentication bypass7.5NVD v3.10.7%2026-08-01Fix
CVE-2026-67308Wazuh GitHub Actions Shell injection via Fork Pull request9.3CNA v4.00.7%2026-08-01
CVE-2026-67307Wazuh Cluster Attribution spoofing via Inventory Sync7.7v3.10.2%2026-08-01Fix
CVE-2026-67306FreeRDP out-of-bounds read via Planar RLE5.3CNA v4.00.4%2026-08-01Fix
CVE-2026-67305FreeRDP Windows client heap buffer overflow via Cliprdr8.8NVD v3.10.8%2026-08-01Fix
CVE-2026-67304FreeRDP null dereference via smartcard cleanup8.7CNA v4.00.7%2026-08-01Fix
CVE-2026-67303FreeRDP denial of service via serial DeviceControl5.3CNA v4.00.4%2026-08-01Fix
CVE-2026-67302FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service6.5v3.10.5%2026-08-01Fix
CVE-2026-67301FreeRDP out-of-bounds read via Polygon async message-proxy8.7CNA v4.00.7%2026-08-01Fix
CVE-2026-67300FreeRDP use-after-free via async message proxy8.7CNA v4.00.6%2026-08-01Fix
CVE-2026-67299FreeRDP use-after-free via WindowIcon async message8.7CNA v4.00.4%2026-08-01Fix
CVE-2026-67298FreeRDP heap buffer overflow via RAIL orderLength Underflow8.7CNA v4.00.7%2026-08-01Fix
CVE-2026-67297FreeRDP resource exhaustion via chunked HTTP response8.7CNA v4.00.5%2026-08-01Fix
CVE-2026-67296FreeRDP denial of service via RDPEI PDU8.7CNA v4.00.5%2026-08-01Fix
CVE-2026-67295FreeRDP path traversal via drive redirection5.3CNA v4.00.4%2026-08-01Fix
CVE-2026-67294FreeRDP TLS Certificate EKU Bypass9.3CNA v4.00.4%2026-08-01Fix
CVE-2026-67293FreeRDP Improper Certificate Hostname Validation9.3CNA v4.00.2%2026-08-01Fix
CVE-2026-67292FreeRDP WebSocket Ping Buffer Over-disclosure9.3CNA v4.00.5%2026-08-01Fix
CVE-2026-67291FreeRDP heap out-of-bounds read via GLYPH_FRAGMENT_ADD8.7CNA v4.00.4%2026-08-01Fix
CVE-2026-67290FreeRDP heap out-of-bounds read via TSMF8.7CNA v4.00.6%2026-08-01Fix
CVE-2026-67289FreeRDP HTTP Proxy request injection via Redirection7.5NVD v3.10.4%2026-08-01Fix
CVE-2026-67288FreeRDP denial of service via smartcard cache8.7CNA v4.00.4%2026-08-01Fix
CVE-2026-66402FreeRDP TLS Certificate Identity Validation Bypass9.3CNA v4.00.5%2026-08-01Fix
CVE-2026-66401FreeRDP out-of-bounds read via UVC H.2642.4CNA v4.00.2%2026-08-01Fix
CVE-2026-55735ueberauth guardian improper signature verification8.2CNA v4.00.5%2026-08-01Fix
CVE-2026-55734guardian atom exhaustion in Guardian.Permissions.encode_permissions!/16.9CNA v4.00.5%2026-08-01Fix
CVE-2026-55733Atom-table exhaustion denial of service in Guardian permissions AtomEncoding6.9CNA v4.00.5%2026-08-01Fix
CVE-2026-54894Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys6.9CNA v4.00.5%2026-08-01Fix
CVE-2026-18556N-able N-central authentication bypass using an alternate path or channel8.2CNA v4.07.9%2026-08-01KEVFix
CVE-2026-18536DATA::Entropy versions for Perl read remote entropy sources over plain HTTP7.5CISA ADP v3.10.2%2026-08-01Fix
CVE-2026-18435Kadence Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-08-01Fix
CVE-2026-18352User Access Manager WordPress plugin unauthenticated arbitrary file read via uamgetfile parameter7.5CNA v3.11.0%2026-08-01Fix