Vulnerability Intelligence
HIGH & CRITICAL severity โ CVSS score โฅ 7.0
Total
3922
NVD
3705
CISA KEV
124
Exploit-DB
93
ANSSI
0
| CVE ID | Title | Severity | CVSS | Source | Published |
|---|---|---|---|---|---|
| CVE-2026-41709 | Broadcom - VMware ESX | CRITICAL | N/A | CISA | Oct 28, 2026 |
| CVE-2026-46300 | Linux - Kernel | CRITICAL | N/A | CISA | Oct 28, 2026 |
| CVE-2026-105781 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 10.0 | NVD | Oct 27, 2026 |
| CVE-2026-105780 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | CRITICAL | 9.9 | NVD | Oct 27, 2026 |
| CVE-2026-105779 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 9.1 | NVD | Oct 27, 2026 |
| CVE-2026-105489 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 9.9 | NVD | Oct 27, 2026 |
| CVE-2026-104354 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 9.1 | NVD | Oct 27, 2026 |
| CVE-2026-104353 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 9.9 | NVD | Oct 27, 2026 |
| CVE-2026-104351 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of | CRITICAL | 9.9 | NVD | Oct 27, 2026 |
| CVE-2026-104350 | Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XS | CRITICAL | 9.3 | NVD | Oct 27, 2026 |
| CVE-2026-104349 | Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulner | HIGH | 7.3 | NVD | Oct 27, 2026 |
| CVE-2026-102638 | A maliciously crafted HTML payload in the description of an electronic library ( | HIGH | 7.1 | NVD | Oct 27, 2026 |
| CVE-2026-102637 | A maliciously crafted HTML payload in the documentName parameter of a Fusion pro | HIGH | 7.1 | NVD | Oct 27, 2026 |
| CVE-2026-102636 | A maliciously crafted HTML payload in a design name, when displayed after anothe | HIGH | 7.1 | NVD | Oct 27, 2026 |
| CVE-2026-116885 | Semantic MediaWiki from 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116884 | Semantic Mediawiki โ SemanticMediaWiki from 5 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116881 | Semantic MediaWiki from 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116880 | Semantic MediaWiki from 3 | HIGH | 7.1 | NVD | Oct 27, 2026 |
| CVE-2026-116878 | Semantic MediaWiki from 2 | HIGH | 7.5 | NVD | Oct 27, 2026 |
| CVE-2026-116877 | Semantic MediaWiki from 2 | MEDIUM | 6.5 | NVD | Oct 27, 2026 |
| CVE-2026-116876 | Semantic MediaWiki from 2 | HIGH | 7.1 | NVD | Oct 27, 2026 |
| CVE-2026-116875 | Semantic Mediawiki โ SemanticMediaWiki from 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116874 | Semantic Mediawiki โ SemanticMediaWiki from 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116873 | Semantic MediaWiki from 7 | HIGH | 7.3 | NVD | Oct 27, 2026 |
| CVE-2026-116872 | Semantic MediaWiki from 3 | HIGH | 7.5 | NVD | Oct 27, 2026 |
| CVE-2026-116871 | Semantic MediaWiki 3 | HIGH | 7.5 | NVD | Oct 27, 2026 |
| CVE-2026-10511 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scrip | MEDIUM | 6.4 | NVD | Oct 27, 2026 |
| CVE-2026-75891 | The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Obj | HIGH | 8.8 | NVD | Oct 27, 2026 |
| CVE-2026-106174 | A improper locking vulnerability in Fortinet FortiOS 8 | HIGH | 7.5 | NVD | Oct 27, 2026 |
| CVE-2026-117470 | Psono Server CE & EE versions 3 | MEDIUM | 6.5 | NVD | Oct 27, 2026 |
| CVE-2026-117468 | Psono Server versions 5 | MEDIUM | 6.5 | NVD | Oct 27, 2026 |
| CVE-2026-111820 | The Analytics Insights โ Google Analytics Dashboard for WordPress plugin for Wor | HIGH | 7.2 | NVD | Oct 27, 2026 |
| CVE-2026-116808 | OpenPanel before 3 | HIGH | 7.2 | NVD | Oct 27, 2026 |
| CVE-2026-116807 | OpenPanel before 3 | MEDIUM | 6.5 | NVD | Oct 27, 2026 |
| CVE-2026-116804 | DOMPurify from 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116803 | DOMPurify before 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116802 | DOMPurify before 3 | MEDIUM | 6.1 | NVD | Oct 27, 2026 |
| CVE-2026-116800 | WWBN AVideo before 29 | MEDIUM | 6.2 | NVD | Oct 27, 2026 |
| CVE-2026-116604 | A vulnerability has been found in SourceCodester Online Food Ordering System 1 | MEDIUM | 6.5 | NVD | Oct 27, 2026 |
| CVE-2026-111497 | Google - Brotli | CRITICAL | N/A | CISA | Oct 27, 2026 |
| CVE-2026-48356 | Adobe - Commerce and Magento | CRITICAL | N/A | CISA | Oct 27, 2026 |
| CVE-2026-116602 | A vulnerability was detected in SourceCodester Online Food Ordering System 1 | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-116384 | A weakness has been identified in Bdtask Garage 24 Garage Management Software 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116371 | A weakness has been identified in Akuvox Akubela HyPanel PS51 51 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116370 | A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-115913 | Vllm โ vLLM is an inference and serving engine for large language m | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115912 | Vllm โ vLLM is an inference and serving engine for large language m | HIGH | 7.5 | NVD | Oct 26, 2026 |
| CVE-2026-115911 | Vllm โ vLLM is an inference and serving engine for large language m | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115910 | Python Social Auth is a social authentication and registration mechanism | MEDIUM | 6.8 | NVD | Oct 26, 2026 |
| CVE-2026-115909 | zip is a zip library for Rust that supports reading and writing simple ZIP files | HIGH | 7.5 | NVD | Oct 26, 2026 |
| CVE-2026-115908 | zip is a zip library for Rust that supports reading and writing simple ZIP files | HIGH | 7.4 | NVD | Oct 26, 2026 |
| CVE-2026-115907 | zip is a zip library for Rust that supports reading and writing simple ZIP files | HIGH | 7.5 | NVD | Oct 26, 2026 |
| CVE-2026-115906 | zip is a zip library for Rust that supports reading and writing simple ZIP files | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115418 | SQL injection in the database-query custom resource handlers in the Amazon Web S | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-114710 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-116258 | A vulnerability was identified in libimobiledevice up to 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116257 | A vulnerability was determined in BillaBear up to 2025 | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-116256 | A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030 | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-115961 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115956 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115955 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115953 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115951 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115950 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-115948 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 8.5 | NVD | Oct 26, 2026 |
| CVE-2026-115608 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 8.5 | NVD | Oct 26, 2026 |
| CVE-2026-115594 | Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-114708 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-114707 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-107899 | V-SFT provided by FUJI ELECTRIC CO | HIGH | 7.8 | NVD | Oct 26, 2026 |
| CVE-2026-107898 | V-SFT provided by FUJI ELECTRIC CO | HIGH | 7.8 | NVD | Oct 26, 2026 |
| CVE-2026-107897 | V-SFT provided by FUJI ELECTRIC CO | HIGH | 7.8 | NVD | Oct 26, 2026 |
| CVE-2026-107896 | V-SFT provided by FUJI ELECTRIC CO | HIGH | 7.8 | NVD | Oct 26, 2026 |
| CVE-2026-107895 | V-SFT provided by FUJI ELECTRIC CO | HIGH | 7.8 | NVD | Oct 26, 2026 |
| CVE-2026-107894 | V-SFT provided by FUJI ELECTRIC CO | HIGH | 7.8 | NVD | Oct 26, 2026 |
| CVE-2026-103381 | The Mintpay for WooCommerce WordPress plugin through 2 | MEDIUM | 6.5 | NVD | Oct 26, 2026 |
| CVE-2026-116118 | A vulnerability has been found in Z | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116117 | A flaw has been found in halo-dev halo up to 2 | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-116113 | A security flaw has been discovered in GouGuOA up to 6 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116112 | A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-116111 | A vulnerability was determined in 2K Games Civilization V 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116110 | A vulnerability was found in GiantappMan LiveWallPaper 2 | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-116109 | A vulnerability has been found in continuedev Continue 2 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116106 | A security vulnerability has been detected in HeyCyan App 1 | HIGH | 7.3 | NVD | Oct 26, 2026 |
| CVE-2026-116104 | A security flaw has been discovered in Sony Neural Network Libraries up to 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116103 | A vulnerability was identified in Sony Neural Network Libraries up to 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116102 | A vulnerability was determined in QuantGeekDev docker-mcp 0 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116101 | A vulnerability was found in itsourcecode Online Cake Ordering System 1 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116099 | A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplay | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-116098 | A vulnerability was detected in SteelRaven7 Ravenfield 25407073 | MEDIUM | 6.3 | NVD | Oct 26, 2026 |
| CVE-2026-109619 | PHP Group - PHP | CRITICAL | N/A | CISA | Oct 26, 2026 |
| CVE-2026-109618 | PHP Group - PHP | CRITICAL | N/A | CISA | Oct 26, 2026 |
| CVE-2026-116094 | A vulnerability was determined in EyouCMS up to 1 | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-116062 | A security flaw has been discovered in SourceCodester Performance Indicator Syst | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-116061 | A vulnerability was identified in SourceCodester Performance Indicator System 1 | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-116060 | A vulnerability was determined in SourceCodester Performance Indicator System 1 | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-116073 | Leon before commit 50df142 contains a path traversal vulnerability in getModelFi | MEDIUM | 6.5 | NVD | Oct 25, 2026 |
| CVE-2026-116070 | Docker-Proxy through 5 | MEDIUM | 6.5 | NVD | Oct 25, 2026 |
| CVE-2026-116069 | NiubiGEO before 0 | MEDIUM | 6.5 | NVD | Oct 25, 2026 |
| CVE-2026-116068 | Dokploy through 0 | HIGH | 8.8 | NVD | Oct 25, 2026 |
| CVE-2026-116067 | Paisa before 0 | HIGH | 8.2 | NVD | Oct 25, 2026 |
| CVE-2026-116066 | Firecrawl before 2 | MEDIUM | 6.8 | NVD | Oct 25, 2026 |
| CVE-2026-116048 | A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-116044 | A security vulnerability has been detected in prasathmani TinyFileManager up to | MEDIUM | 6.3 | NVD | Oct 25, 2026 |
| CVE-2026-115251 | The Duplicator WordPress plugin before 5 | HIGH | 7.2 | NVD | Oct 25, 2026 |
| CVE-2026-115214 | The Datawiza Proxy Auth Plugin WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Oct 25, 2026 |
| CVE-2026-111979 | The GiveWP WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Oct 25, 2026 |
| CVE-2026-111978 | The GiveWP WordPress plugin before 4 | MEDIUM | 6.0 | NVD | Oct 25, 2026 |
| CVE-2026-116006 | A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026 | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-116000 | A security flaw has been discovered in Zylon PrivateGPT 1 | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-115999 | A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359 | HIGH | 7.3 | NVD | Oct 25, 2026 |
| CVE-2026-115997 | A flaw has been found in pig-mesh pig up to 4 | MEDIUM | 6.3 | NVD | Oct 25, 2026 |
| CVE-2026-115995 | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to | CRITICAL | 9.6 | NVD | Oct 24, 2026 |
| CVE-2026-115973 | A vulnerability was identified in FaveoSuite Faveo Helpdesk 2 | HIGH | 7.3 | NVD | Oct 24, 2026 |
| CVE-2026-114820 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente | CRITICAL | 9.1 | NVD | Oct 24, 2026 |
| CVE-2026-115970 | A vulnerability has been found in Travisun Opptrix 0 | HIGH | 7.3 | NVD | Oct 24, 2026 |
| CVE-2026-114704 | Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevans | HIGH | 7.2 | NVD | Oct 24, 2026 |
| CVE-2026-114192 | Missing Authorization vulnerability in Magepeople inc | MEDIUM | 6.5 | NVD | Oct 24, 2026 |
| CVE-2026-114191 | Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for | HIGH | 7.5 | NVD | Oct 24, 2026 |
| CVE-2026-115932 | When a post is published, Postiz treats a media path that is not a web address a | CRITICAL | 9.6 | NVD | Oct 24, 2026 |
| CVE-2026-116019 | Grav 2 | HIGH | 8.8 | NVD | Oct 24, 2026 |
| CVE-2026-116016 | yudao-cloud through 2026 | HIGH | 7.1 | NVD | Oct 24, 2026 |
| CVE-2026-116014 | open62541 1 | HIGH | 8.1 | NVD | Oct 24, 2026 |
| CVE-2026-116011 | Crow before 1 | HIGH | 7.5 | NVD | Oct 24, 2026 |
| CVE-2026-116009 | Camaleon CMS before 2 | HIGH | 8.8 | NVD | Oct 24, 2026 |
| CVE-2026-110018 | The aBlocks โ Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Buil | HIGH | 8.8 | NVD | Oct 24, 2026 |
| CVE-2026-108013 | BigFix Platform uses Mozilla CA certificate bundle (PEM) | MEDIUM | 6.8 | NVD | Oct 24, 2026 |
| CVE-2026-87835 | The Front End Users WordPress plugin through 3 | MEDIUM | 6.5 | NVD | Oct 24, 2026 |
| CVE-2026-114429 | The WPVR WordPress plugin before 9 | MEDIUM | 6.8 | NVD | Oct 24, 2026 |
| CVE-2026-113673 | The GeoDirectory WordPress plugin before 2 | HIGH | 7.2 | NVD | Oct 24, 2026 |
| CVE-2026-113493 | The GeoDirectory WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Oct 24, 2026 |
| CVE-2026-113491 | The GeoDirectory WordPress plugin before 2 | MEDIUM | 6.4 | NVD | Oct 24, 2026 |
| CVE-2026-112207 | The Download Monitor WordPress plugin before 5 | HIGH | 7.1 | NVD | Oct 24, 2026 |
| CVE-2026-110956 | The asVereinbase WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Oct 24, 2026 |
| CVE-2026-107907 | The MAS Videos WordPress plugin through 1 | MEDIUM | 6.5 | NVD | Oct 24, 2026 |
| CVE-2026-105199 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Oct 24, 2026 |
| CVE-2026-115807 | The User Profile Builder โ Beautiful User Registration Forms, User Profiles & Us | HIGH | 7.1 | NVD | Oct 24, 2026 |
| CVE-2026-115806 | The Prime Mover โ Backup and Migration plugin for WordPress is vulnerable to PHP | CRITICAL | 9.8 | NVD | Oct 24, 2026 |
| CVE-2026-115929 | MongoDB Compass relies on Electron, a third-party runtime that carries its own T | MEDIUM | 6.8 | NVD | Oct 24, 2026 |
| CVE-2026-115931 | Postiz lets a signed-in user ask the backend to run a function on one of their c | CRITICAL | 9.9 | NVD | Oct 23, 2026 |
| CVE-2026-115845 | An incomplete list of disallowed inputs in the Python code validator of the run_ | MEDIUM | 6.4 | NVD | Oct 23, 2026 |
| CVE-2026-115570 | Electron is a framework for writing cross-platform desktop applications using Ja | HIGH | 7.4 | NVD | Oct 23, 2026 |
| CVE-2026-112342 | Tandoor Recipes before 2 | HIGH | 7.1 | NVD | Oct 23, 2026 |
| CVE-2026-115863 | ConnMan through 2 | HIGH | 7.6 | NVD | Oct 23, 2026 |
| CVE-2026-115812 | Relative path traversal during model archive extraction in Amazon Web Services M | CRITICAL | 9.8 | NVD | Oct 23, 2026 |
| CVE-2026-110975 | A flaw was found in Kruize Autotune | HIGH | 7.4 | NVD | Oct 23, 2026 |
| CVE-2026-115810 | Tandoor Recipes before 2 | HIGH | 7.7 | NVD | Oct 23, 2026 |
| CVE-2026-98870 | ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_dereg | HIGH | 8.8 | NVD | Oct 23, 2026 |
| CVE-2026-56840 | PraisonAI is a multi-agent teams system | HIGH | 8.8 | NVD | Oct 23, 2026 |
| CVE-2026-56838 | PraisonAI is a multi-agent teams system | HIGH | 7.8 | NVD | Oct 23, 2026 |
| CVE-2026-56837 | PraisonAI is a multi-agent teams system | HIGH | 8.6 | NVD | Oct 23, 2026 |
| CVE-2026-56836 | PraisonAI is a multi-agent teams system | HIGH | 8.2 | NVD | Oct 23, 2026 |
| CVE-2026-56835 | PraisonAI is a multi-agent teams system | HIGH | 8.3 | NVD | Oct 23, 2026 |
| CVE-2026-56834 | PraisonAI is a multi-agent teams system | HIGH | 7.5 | NVD | Oct 23, 2026 |
| CVE-2026-56833 | PraisonAI is a multi-agent teams system | HIGH | 7.5 | NVD | Oct 23, 2026 |
| CVE-2026-56832 | PraisonAI is a multi-agent teams system | HIGH | 8.8 | NVD | Oct 23, 2026 |
| CVE-2026-115727 | AgenticSeek before commit 409840c contains a remote code execution vulnerability | HIGH | 8.1 | NVD | Oct 23, 2026 |
| CVE-2026-115726 | Aider through 0 | HIGH | 7.8 | NVD | Oct 23, 2026 |
| CVE-2026-115723 | Snap7 through 1 | HIGH | 7.4 | NVD | Oct 23, 2026 |
| CVE-2026-115722 | RPly through 1 | MEDIUM | 6.1 | NVD | Oct 23, 2026 |
| CVE-2026-112904 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | HIGH | 8.7 | NVD | Oct 23, 2026 |
| CVE-2026-111982 | The User Profile Builder WordPress plugin before 4 | HIGH | 7.2 | NVD | Oct 23, 2026 |
| CVE-2026-111966 | The User Profile Builder WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Oct 23, 2026 |
| CVE-2026-109936 | The Otter Blocks WordPress plugin before 3 | HIGH | 7.5 | NVD | Oct 23, 2026 |
| CVE-2026-109933 | The Otter Blocks WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Oct 23, 2026 |
| CVE-2026-115497 | The Music Store โ WordPress eCommerce plugin for WordPress is vulnerable to Dire | HIGH | 7.5 | NVD | Oct 23, 2026 |
| CVE-2026-109198 | The Anti-Spam by CleanTalk โ Spam Protection Without CAPTCHA plugin for WordPres | HIGH | 7.2 | NVD | Oct 23, 2026 |
| CVE-2026-115547 | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows | CRITICAL | 9.1 | NVD | Oct 23, 2026 |
| CVE-2026-115546 | Okta Access Gateway (OAG) does not validate the selected authentication source d | HIGH | 8.1 | NVD | Oct 23, 2026 |
| CVE-2026-115486 | A flaw was found in the iscsiuio component of open-iscsi | HIGH | 7.1 | NVD | Oct 23, 2026 |
| CVE-2026-115485 | A flaw was found in the iscsiuio component of open-iscsi | MEDIUM | 6.3 | NVD | Oct 23, 2026 |
| CVE-2026-115484 | A flaw was found in the iscsiuio component of open-iscsi | HIGH | 7.6 | NVD | Oct 23, 2026 |
| CVE-2026-110447 | Collabora - Collabora Online โ Built-in CODE Server | CRITICAL | N/A | CISA | Oct 23, 2026 |
| CVE-2026-114625 | Arista - VeloCloud Orchestrator | CRITICAL | N/A | CISA | Oct 23, 2026 |
| CVE-2026-92450 | The authentication framework used by affected Kiloview E3 NDI encoder firmware s | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-110825 | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts ho | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-110491 | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-110243 | The network management service on affected Kiloview E3 NDI encoder firmware fail | CRITICAL | 9.9 | NVD | Oct 22, 2026 |
| CVE-2026-107861 | The system control service on affected Kiloview E3 NDI encoder firmware fails to | CRITICAL | 9.9 | NVD | Oct 22, 2026 |
| CVE-2026-97785 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elev | CRITICAL | 10.0 | NVD | Oct 22, 2026 |
| CVE-2026-96616 | Authentication tokens issued by the E3's web management interface on login are g | MEDIUM | 6.5 | NVD | Oct 22, 2026 |
| CVE-2026-96185 | Stack-based buffer overflow in Microsoft Exchange Online allows an authorized at | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-83938 | Missing authentication for critical function in Azure Kubernetes Configuration S | CRITICAL | 10.0 | NVD | Oct 22, 2026 |
| CVE-2026-113874 | SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identi | HIGH | 8.1 | NVD | Oct 22, 2026 |
| CVE-2026-113873 | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-108360 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files | MEDIUM | 6.4 | NVD | Oct 22, 2026 |
| CVE-2026-75508 | GraphQL-core is a Python port of the GraphQL | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-75507 | GraphQL-core is a Python port of the GraphQL | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-115513 | OpenCATS before 0 | HIGH | 8.7 | NVD | Oct 22, 2026 |
| CVE-2026-115416 | Incorrect authorization checks in Amazon Athena engine version 3 query processin | HIGH | 7.7 | NVD | Oct 22, 2026 |
| CVE-2026-114607 | Better Auth is an authentication and authorization library for TypeScript | CRITICAL | 9.1 | NVD | Oct 22, 2026 |
| CVE-2026-114605 | dnspython is a DNS toolkit for Python | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-104068 | JetBackup plugin for WordPress before 3 | HIGH | 7.2 | NVD | Oct 22, 2026 |
| CVE-2023-54413 | WPML Multilingual CMS plugin for WordPress before 4 | MEDIUM | 6.1 | NVD | Oct 22, 2026 |
| CVE-2022-51025 | Penta Security WAPPLES 4 | MEDIUM | 6.5 | NVD | Oct 22, 2026 |
| CVE-2022-51024 | Kavita 0 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2022-51023 | PHPOK 4 | HIGH | 8.2 | NVD | Oct 22, 2026 |
| CVE-2022-51022 | YiShaAdmin 2 | CRITICAL | 9.1 | NVD | Oct 22, 2026 |
| CVE-2022-51021 | NotificationX plugin for WordPress 2 | HIGH | 8.2 | NVD | Oct 22, 2026 |
| CVE-2021-48017 | OrbiTeam BSCW Server 5 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2021-48016 | DedeCMS through 5 | CRITICAL | 9.8 | NVD | Oct 22, 2026 |
| CVE-2021-48015 | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2021-48014 | FineReport 9 | CRITICAL | 9.8 | NVD | Oct 22, 2026 |
| CVE-2021-48013 | Weaver E-cology 8 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2020-37284 | Sickbeard through build-507 contains a reflected cross-site scripting vulnerabil | MEDIUM | 6.1 | NVD | Oct 22, 2026 |
| CVE-2019-25779 | WooThemes Diarise through 1 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2019-25778 | SeaCMS through 8 | HIGH | 8.2 | NVD | Oct 22, 2026 |
| CVE-2018-25439 | MetInfo CMS 6 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2018-25438 | Intermesh Group-Office 3 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2017-20290 | Discourse 1 | MEDIUM | 6.1 | NVD | Oct 22, 2026 |
| CVE-2017-20289 | Broadstreet Ad Widget plugin for WordPress 2 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2017-20288 | QCubed 2 | MEDIUM | 6.1 | NVD | Oct 22, 2026 |
| CVE-2017-20287 | Javo Spot theme for WordPress before 3 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-97328 | The WebP Express WordPress plugin before 0 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-78392 | The Link Library WordPress plugin before 7 | MEDIUM | 6.8 | NVD | Oct 22, 2026 |
| CVE-2026-111971 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6 | MEDIUM | 6.8 | NVD | Oct 22, 2026 |
| CVE-2026-111958 | The Royal MCP WordPress plugin before 1 | HIGH | 7.5 | NVD | Oct 22, 2026 |
| CVE-2026-109987 | The PixelYourSite WordPress plugin before 11 | HIGH | 7.2 | NVD | Oct 22, 2026 |
| CVE-2026-109927 | The HIPAA Forms WordPress plugin before 3 | HIGH | 7.2 | NVD | Oct 22, 2026 |
| CVE-2026-114222 | NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerabil | MEDIUM | 6.2 | NVD | Oct 22, 2026 |
| CVE-2026-114221 | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerabili | HIGH | 7.4 | NVD | Oct 22, 2026 |
| CVE-2026-114220 | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation | CRITICAL | 9.1 | NVD | Oct 22, 2026 |
| CVE-2026-114219 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil | HIGH | 7.4 | NVD | Oct 22, 2026 |
| EDB-52704 | [remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE | CRITICAL | 9.8 | EXPLOIT-DB | Oct 22, 2026 |
| CVE-2026-76299 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.9 | NVD | Oct 21, 2026 |
| CVE-2026-76298 | In Splunk Enterprise versions below 10 | HIGH | 8.8 | NVD | Oct 21, 2026 |
| CVE-2026-76293 | In Splunk Enterprise versions below 10 | HIGH | 7.2 | NVD | Oct 21, 2026 |
| CVE-2026-76292 | In Splunk Enterprise versions below 10 | MEDIUM | 6.5 | NVD | Oct 21, 2026 |
| CVE-2026-76291 | In Splunk Enterprise versions below 10 | HIGH | 8.8 | NVD | Oct 21, 2026 |
| CVE-2026-76290 | In Splunk Enterprise versions below 10 | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-76289 | In Splunk Enterprise versions below 10 | MEDIUM | 6.5 | NVD | Oct 21, 2026 |
| CVE-2026-76288 | In Splunk Enterprise versions below 10 | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-114441 | A weakness has been identified in oretnom23 php-travel-agency-system | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-114440 | A vulnerability was identified in oretnom23 php-travel-agency-system | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-114439 | A vulnerability was determined in oretnom23 php-travel-agency-system | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-20236 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-20043 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.0 | NVD | Oct 21, 2026 |
| CVE-2026-114261 | A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d9 | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-114260 | A vulnerability has been found in oretnom23 file-management-system-php up to 2e3 | MEDIUM | 6.5 | NVD | Oct 21, 2026 |
| CVE-2026-114259 | A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f1 | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-114258 | A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1 | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-114123 | D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-56386 | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-114242 | A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5 | HIGH | 7.3 | NVD | Oct 21, 2026 |
| CVE-2026-109147 | The WP Booking System WordPress plugin before 2 | HIGH | 7.1 | NVD | Oct 21, 2026 |
| CVE-2026-107790 | The HireZoot WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Oct 21, 2026 |
| CVE-2026-107506 | The Simple Banner WordPress plugin before 3 | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-107237 | The Backup and Staging by WP Time Capsule WordPress plugin before 1 | HIGH | 8.2 | NVD | Oct 21, 2026 |
| CVE-2026-107127 | The Uncanny Toolkit for LearnDash WordPress plugin before 3 | HIGH | 7.5 | NVD | Oct 21, 2026 |
| CVE-2026-106932 | The Moloni WordPress plugin before 5 | MEDIUM | 6.5 | NVD | Oct 21, 2026 |
| CVE-2026-105262 | The Falang multilanguage for WordPress plugin before 1 | HIGH | 8.0 | NVD | Oct 21, 2026 |
| CVE-2026-102499 | The Modern Events Calendar Lite WordPress plugin before 7 | HIGH | 7.7 | NVD | Oct 21, 2026 |
| CVE-2026-100145 | The Synchrony Financing WordPress plugin before 1 | MEDIUM | 6.5 | NVD | Oct 21, 2026 |
| EDB-52697 | [webapps] Automotive Shop Management System 1.0 - SQLi | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52703 | [webapps] pizzafy-1.0 - SQLi | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52694 | [remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52695 | [remote] Exasol Database 7.1.30 - command execution | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52696 | [remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52693 | [remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52698 | [webapps] Open eClass 3.15 - RCE | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52699 | [webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52700 | [remote] Synametrics Syncrify 6.2 - command execution | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| EDB-52701 | [remote] South River Technologies Titan MFT Server 26.0.0 - code execution | HIGH | N/A | EXPLOIT-DB | Oct 21, 2026 |
| CVE-2026-113138 | Chrome โ Memory corruption in WebAppInstalls in Google Chrome prior t | CRITICAL | 9.6 | NVD | Oct 20, 2026 |
| CVE-2026-113137 | Chrome โ Memory corruption in Extensions in Google Chrome prior to 15 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113136 | Chrome โ Memory corruption in DevTools in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113135 | Chrome โ Memory corruption in PictureInPicture in Google Chrome prior | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113134 | Memory corruption in ANGLE in Google Chrome on on Windows prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113133 | Chrome โ Memory corruption in PlatformIntegration in Google Chrome pr | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113132 | Chrome โ Memory corruption in DevTools in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113131 | Chrome โ Memory corruption in Bluetooth in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113130 | Chrome โ Use after free in Actor in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113129 | Chrome โ Improper access control in Extensions in Google Chrome prior | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-113128 | Chrome โ Missing authorization in Animation in Google Chrome prior to | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113127 | Chrome โ Memory corruption in Browser in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113126 | Chrome โ Memory corruption in PolicyContainer in Google Chrome prior | CRITICAL | 9.6 | NVD | Oct 20, 2026 |
| CVE-2026-113125 | Chrome โ Memory corruption in DevTools in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113124 | Chrome โ Memory corruption in DataTransfer in Google Chrome prior to | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113123 | Chrome โ Use after free in GPU in Google Chrome prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113122 | Chrome โ Memory corruption in Loader in Google Chrome prior to 156 | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-113121 | Memory corruption in ContextMenu in Google Chrome on on Android prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113120 | Chrome โ Improper input validation in Media in Google Chrome prior to | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113119 | Use after free in Network in Google Chrome on on Windows prior to 156 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-92539 | A service account with user-management permissions in one organization can read, | MEDIUM | 6.7 | NVD | Oct 20, 2026 |
| CVE-2026-28329 | SolarWinds Observability Self-Hosted was found to be affected by a Server-Side R | MEDIUM | 6.4 | NVD | Oct 20, 2026 |
| CVE-2026-28328 | SolarWinds Observability Self-Hosted was found to be affected by a broken author | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113658 | ApostropheCMS is an open-source Node | HIGH | 7.5 | NVD | Oct 20, 2026 |
| CVE-2026-113649 | ApostropheCMS is an open-source Node | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-113356 | DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Dra | HIGH | 7.5 | NVD | Oct 20, 2026 |
| CVE-2026-113354 | Dockhand before 1 | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-113352 | uTox through 0 | HIGH | 7.5 | NVD | Oct 20, 2026 |
| CVE-2026-108089 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an u | HIGH | 7.5 | NVD | Oct 20, 2026 |
| CVE-2026-112177 | A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8 | HIGH | 7.3 | NVD | Oct 20, 2026 |
| CVE-2026-111090 | A logic error exists in the signature verification routine resulting in acceptan | HIGH | 7.8 | NVD | Oct 20, 2026 |
| CVE-2026-93878 | The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Sc | MEDIUM | 6.4 | NVD | Oct 20, 2026 |
| CVE-2026-113404 | WebITR developed by Uniong has a Insecure Deserialization vulnerability | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-113403 | ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulner | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-113402 | ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vul | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-110306 | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node | MEDIUM | 6.1 | NVD | Oct 20, 2026 |
| CVE-2026-93300 | The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injec | HIGH | 7.5 | NVD | Oct 20, 2026 |
| CVE-2026-113386 | Roundcube Webmail before 1 | HIGH | 7.1 | NVD | Oct 20, 2026 |
| CVE-2026-109440 | LangAlpha through 2026 | HIGH | 8.1 | NVD | Oct 20, 2026 |
| CVE-2026-109395 | Ning compress-lzf before 1 | CRITICAL | 9.1 | NVD | Oct 20, 2026 |
| CVE-2026-105297 | Summary Before version 0 | HIGH | 7.5 | NVD | Oct 20, 2026 |
| CVE-2026-112373 | A security vulnerability has been detected in H3C Magic NX15 NX15V100R017 | MEDIUM | 6.5 | NVD | Oct 20, 2026 |
| CVE-2026-109126 | IBM Verify Identity Access 11 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-107400 | IBM TRIRIGA Application Platform 5 | HIGH | 8.8 | NVD | Oct 20, 2026 |
| CVE-2026-107366 | IBM Langflow OSS 1 | HIGH | 8.3 | NVD | Oct 20, 2026 |
| CVE-2026-105453 | IBM Sterling Connect Direct for Unix 6 | HIGH | 8.4 | NVD | Oct 20, 2026 |
| CVE-2026-106931 | EG Secure Solutions - SiteGuard Server Edition | CRITICAL | N/A | CISA | Oct 20, 2026 |
| CVE-2026-110936 | Siemens - Software Center | CRITICAL | N/A | CISA | Oct 20, 2026 |
| CVE-2026-96652 | Plex - Media Server | CRITICAL | N/A | CISA | Oct 20, 2026 |
| CVE-2026-96655 | Plex - Media Server | CRITICAL | N/A | CISA | Oct 20, 2026 |
| CVE-2026-96656 | Plex - Media Server | CRITICAL | N/A | CISA | Oct 20, 2026 |
| CVE-2026-19595 | The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rt | MEDIUM | 6.1 | NVD | Oct 19, 2026 |
| CVE-2026-19178 | IBM Storage TS4500 Library 1 | MEDIUM | 6.8 | NVD | Oct 19, 2026 |
| CVE-2026-112372 | A weakness has been identified in H3C Magic NX15 V100R017 | MEDIUM | 6.6 | NVD | Oct 19, 2026 |
| CVE-2026-112371 | A vulnerability was determined in H3C Magic NX15 NX15V100R017 | CRITICAL | 9.9 | NVD | Oct 19, 2026 |
| CVE-2026-112370 | A vulnerability was found in H3C Magic NX15 100R017 | CRITICAL | 9.9 | NVD | Oct 19, 2026 |
| CVE-2025-36252 | IBM Storage TS4500 Library 1 | MEDIUM | 6.3 | NVD | Oct 19, 2026 |
| CVE-2025-36061 | IBM Storage TS4500 Library 1 | MEDIUM | 6.5 | NVD | Oct 19, 2026 |
| CVE-2026-111059 | Mercury is a Python framework for sharing Jupyter notebooks as web applications | MEDIUM | 6.1 | NVD | Oct 19, 2026 |
| CVE-2026-10743 | IBM MQ could allow an authenticated attacker to cause a denial of service or cor | HIGH | 8.8 | NVD | Oct 19, 2026 |
| CVE-2026-10574 | IBM MQ could allow an authenticated attacker to cause a denial of service or pot | HIGH | 8.8 | NVD | Oct 19, 2026 |
| CVE-2026-10572 | IBM MQ could allow an authenticated attacker to cause a denial of service or pot | HIGH | 8.8 | NVD | Oct 19, 2026 |
| CVE-2026-107188 | A user can upload export reports with any file contents and specify any contents | CRITICAL | 9.6 | NVD | Oct 19, 2026 |
| CVE-2026-107187 | A user can access any database details, such as usernames and passwords by sendi | HIGH | 8.5 | NVD | Oct 19, 2026 |
| CVE-2026-107186 | An unauthenticated user can send a DWR request with isPasswordUppercase as one c | HIGH | 8.6 | NVD | Oct 19, 2026 |
| CVE-2026-107083 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9 | CRITICAL | 9.8 | NVD | Oct 19, 2026 |
| CVE-2026-107082 | Slims (Senayan Library Management Systems) 9 Bulian 9 | HIGH | 8.8 | NVD | Oct 19, 2026 |
| CVE-2025-13173 | Tokens associated with user sessions are not revoked when the corresponding user | MEDIUM | 6.5 | NVD | Oct 19, 2026 |
| CVE-2025-10149 | The SCIM endpoint does not sufficiently validate authorization for federated use | HIGH | 8.2 | NVD | Oct 19, 2026 |
| CVE-2026-84178 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component | MEDIUM | 6.1 | NVD | Oct 19, 2026 |
| CVE-2026-84176 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Ca | MEDIUM | 6.5 | NVD | Oct 19, 2026 |
| CVE-2026-83531 | Improper Control of Generation of Code ('Code Injection'), Improper Neutralizati | HIGH | 8.8 | NVD | Oct 19, 2026 |
| CVE-2026-80344 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component | HIGH | 8.2 | NVD | Oct 19, 2026 |
| CVE-2026-80343 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP c | HIGH | 8.2 | NVD | Oct 19, 2026 |
| CVE-2026-80312 | Improper Authentication vulnerability in Apache Camel OAuth component | HIGH | 8.2 | NVD | Oct 19, 2026 |
| CVE-2026-79986 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.4 | NVD | Oct 19, 2026 |
| CVE-2026-79985 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.4 | NVD | Oct 19, 2026 |
| CVE-2026-79984 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.4 | NVD | Oct 19, 2026 |
| CVE-2026-79983 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.4 | NVD | Oct 19, 2026 |
| CVE-2026-78165 | Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis com | HIGH | 8.8 | NVD | Oct 19, 2026 |
| CVE-2026-78164 | Improper Neutralization of Special Elements Used in a Template Engine and Exposu | HIGH | 8.2 | NVD | Oct 19, 2026 |
| CVE-2026-71253 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection | CRITICAL | 9.8 | NVD | Oct 19, 2026 |
| CVE-2026-112104 | A flaw has been found in eremef bandcamp-player up to 1 | HIGH | 7.3 | NVD | Oct 19, 2026 |
| CVE-2026-108984 | A vulnerability is in Web Server default connection ports under the process name | HIGH | 7.5 | NVD | Oct 19, 2026 |
| CVE-2026-108983 | A vulnerability is in Web Server default connection ports under the process name | CRITICAL | 9.8 | NVD | Oct 19, 2026 |
| CVE-2026-112035 | A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5 | MEDIUM | 6.3 | NVD | Oct 19, 2026 |
| CVE-2026-112030 | A vulnerability was found in diem-project diem up to 5 | MEDIUM | 6.3 | NVD | Oct 19, 2026 |
| CVE-2026-112028 | A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/ | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-112025 | A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d | HIGH | 7.3 | NVD | Oct 18, 2026 |
| CVE-2026-97859 | Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, f | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-110494 | Adding attachments to a release checked the repository and release of an attachm | MEDIUM | 6.3 | NVD | Oct 18, 2026 |
| CVE-2026-110324 | The visibility check of Gitea user profiles was applied to GET requests only, wh | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-109553 | Gitea resolved the principals of an SSH certificate by searching the content of | HIGH | 7.5 | NVD | Oct 18, 2026 |
| CVE-2026-105964 | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-111992 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e | MEDIUM | 6.3 | NVD | Oct 18, 2026 |
| CVE-2026-112000 | Vanus 0 | HIGH | 7.6 | NVD | Oct 18, 2026 |
| CVE-2026-111999 | Vanus 0 | HIGH | 7.5 | NVD | Oct 18, 2026 |
| CVE-2026-111998 | Vanus 0 | CRITICAL | 9.8 | NVD | Oct 18, 2026 |
| CVE-2026-110897 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 18, 2026 |
| CVE-2026-110895 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 8.5 | NVD | Oct 18, 2026 |
| CVE-2026-110886 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational F | CRITICAL | 9.8 | NVD | Oct 18, 2026 |
| CVE-2026-110885 | Improper Control of Generation of Code ('Code Injection') vulnerability in HiveP | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-110883 | Authentication Bypass by Primary Weakness vulnerability in VideoWhisper | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-110880 | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-110383 | Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature | HIGH | 7.5 | NVD | Oct 18, 2026 |
| CVE-2026-110382 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 18, 2026 |
| CVE-2026-110373 | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone nu | HIGH | 8.1 | NVD | Oct 18, 2026 |
| CVE-2026-110372 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretri | CRITICAL | 9.8 | NVD | Oct 18, 2026 |
| CVE-2026-110365 | Missing Authorization vulnerability in WPExperts Advanced File Manager file-mana | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-109895 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 18, 2026 |
| CVE-2026-109894 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | CRITICAL | 9.3 | NVD | Oct 18, 2026 |
| CVE-2026-108485 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 18, 2026 |
| CVE-2026-107436 | Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials | HIGH | 8.8 | NVD | Oct 18, 2026 |
| CVE-2026-96534 | The Modern Events Calendar Lite WordPress plugin before 7 | HIGH | 7.7 | NVD | Oct 18, 2026 |
| CVE-2026-110981 | The WP Photo Album Plus WordPress plugin before 9 | HIGH | 7.1 | NVD | Oct 18, 2026 |
| CVE-2026-110070 | The Modern Events Calendar Lite WordPress plugin before 7 | MEDIUM | 6.5 | NVD | Oct 18, 2026 |
| CVE-2026-110033 | The Salon Booking System WordPress plugin before 10 | MEDIUM | 6.8 | NVD | Oct 18, 2026 |
| CVE-2026-110031 | The Salon Booking System WordPress plugin before 10 | HIGH | 7.2 | NVD | Oct 18, 2026 |
| CVE-2026-111873 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e | HIGH | 7.3 | NVD | Oct 18, 2026 |
| CVE-2026-111872 | A security vulnerability has been detected in itsmeravitejak Online-Examination- | HIGH | 7.3 | NVD | Oct 18, 2026 |
| CVE-2026-111871 | A weakness has been identified in itsmeravitejak Online-Examination-System up to | HIGH | 7.3 | NVD | Oct 18, 2026 |
| CVE-2026-111868 | A vulnerability was determined in datastax pulsar-jms up to 9 | MEDIUM | 6.3 | NVD | Oct 18, 2026 |
| CVE-2026-111866 | A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a4 | HIGH | 7.3 | NVD | Oct 18, 2026 |
| CVE-2026-111895 | phpMyFAQ 3 | MEDIUM | 6.8 | NVD | Oct 17, 2026 |
| CVE-2026-111893 | phpMyFAQ 4 | MEDIUM | 6.5 | NVD | Oct 17, 2026 |
| CVE-2026-111892 | phpMyFAQ 4 | MEDIUM | 6.5 | NVD | Oct 17, 2026 |
| CVE-2026-111886 | phpMyFAQ from 4 | MEDIUM | 6.5 | NVD | Oct 17, 2026 |
| CVE-2026-111884 | phpMyFAQ before 4 | HIGH | 8.3 | NVD | Oct 17, 2026 |
| CVE-2026-111882 | phpMyFAQ 3 | HIGH | 8.1 | NVD | Oct 17, 2026 |
| CVE-2026-111881 | FreeRDP from 3 | HIGH | 7.6 | NVD | Oct 17, 2026 |
| CVE-2026-111880 | FreeRDP versions from 2 | HIGH | 7.4 | NVD | Oct 17, 2026 |
| CVE-2026-109701 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 17, 2026 |
| CVE-2026-110889 | Generation of Error Message Containing Sensitive Information vulnerability in Ga | HIGH | 7.5 | NVD | Oct 17, 2026 |
| CVE-2026-111110 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for Wo | HIGH | 7.2 | NVD | Oct 17, 2026 |
| CVE-2026-109983 | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site | MEDIUM | 6.4 | NVD | Oct 17, 2026 |
| CVE-2026-100316 | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vu | HIGH | 7.2 | NVD | Oct 17, 2026 |
| CVE-2026-110384 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 17, 2026 |
| CVE-2026-97314 | The ThirstyAffiliates WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Oct 17, 2026 |
| CVE-2026-92433 | The Patreon WordPress plugin before 1 | MEDIUM | 6.5 | NVD | Oct 17, 2026 |
| CVE-2026-91074 | The BSK PDF Manager WordPress plugin through 3 | MEDIUM | 6.8 | NVD | Oct 17, 2026 |
| CVE-2026-81344 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3 | MEDIUM | 6.6 | NVD | Oct 17, 2026 |
| CVE-2026-104122 | The Ukr-To-Lat WordPress plugin through 1 | MEDIUM | 6.8 | NVD | Oct 17, 2026 |
| CVE-2026-104734 | The Kirki โ Freeform Page Builder, Website Builder & Customizer plugin for WordP | HIGH | 7.2 | NVD | Oct 17, 2026 |
| CVE-2026-111855 | An issue was discovered on Tektronix 3 Series MDO devices before 1 | HIGH | 7.5 | NVD | Oct 17, 2026 |
| CVE-2026-111854 | An issue was discovered on Tektronix 3 Series MDO devices before 1 | HIGH | 8.1 | NVD | Oct 17, 2026 |
| CVE-2026-111853 | An issue was discovered on Tektronix 3 Series MDO devices before 1 | HIGH | 8.8 | NVD | Oct 17, 2026 |
| CVE-2026-111823 | Mage OSS through 0 | CRITICAL | 9.8 | NVD | Oct 17, 2026 |
| CVE-2026-89085 | A flaw was found in parted | MEDIUM | 6.6 | NVD | Oct 16, 2026 |
| CVE-2026-111802 | A flaw was found in Nautilus | MEDIUM | 6.6 | NVD | Oct 16, 2026 |
| CVE-2026-85748 | MariaDB server is a community developed fork of MySQL server | CRITICAL | 9.9 | NVD | Oct 16, 2026 |
| CVE-2026-85746 | MariaDB server is a community developed fork of MySQL server | CRITICAL | 9.9 | NVD | Oct 16, 2026 |
| CVE-2026-77474 | destructive_command_guard (dcg) is a command-line safety tool that blocks destru | HIGH | 7.1 | NVD | Oct 16, 2026 |
| CVE-2026-59962 | Tandoor Recipes is an application for managing recipes, planning meals, and buil | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-57169 | Dockhand is a Docker management application | CRITICAL | 9.6 | NVD | Oct 16, 2026 |
| CVE-2026-49868 | RIOT is an open-source microcontroller operating system designed for Internet of | CRITICAL | 9.8 | NVD | Oct 16, 2026 |
| CVE-2026-102693 | RIOT is an open-source microcontroller operating system designed for Internet of | CRITICAL | 9.6 | NVD | Oct 16, 2026 |
| CVE-2026-102692 | RIOT is an open-source microcontroller operating system designed for Internet of | CRITICAL | 9.1 | NVD | Oct 16, 2026 |
| CVE-2026-96424 | Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager | HIGH | 7.8 | NVD | Oct 16, 2026 |
| CVE-2026-92263 | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili | HIGH | 7.2 | NVD | Oct 16, 2026 |
| CVE-2026-77630 | pupnp is an SDK for development of UPnP device and control point applications | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-111405 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-111400 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-111399 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 8.5 | NVD | Oct 16, 2026 |
| CVE-2026-111396 | Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Mana | HIGH | 7.1 | NVD | Oct 16, 2026 |
| CVE-2026-110903 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-107564 | An unauthenticated remote attacker may use an allocation of resources without li | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-105958 | A flaw was found in spice-server | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-111391 | SGLang 0 | HIGH | 8.1 | NVD | Oct 16, 2026 |
| CVE-2026-107648 | The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerabl | HIGH | 7.2 | NVD | Oct 16, 2026 |
| CVE-2026-105959 | A flaw was found in spice-server | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-109119 | Improper Privilege Management in the user management API endpoint (/api/users/{u | HIGH | 8.8 | NVD | Oct 16, 2026 |
| CVE-2026-111114 | The Nexter Extension โ Security, Performance, Code Snippets & Site Toolkit plugi | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-111106 | The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filte | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-110590 | The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization b | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-109998 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting | HIGH | 7.2 | NVD | Oct 16, 2026 |
| CVE-2026-109515 | The MailOptin โ Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, A | CRITICAL | 9.8 | NVD | Oct 16, 2026 |
| CVE-2026-109512 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting | MEDIUM | 6.4 | NVD | Oct 16, 2026 |
| CVE-2026-109400 | The InstaWP Connect โ 1-click WP Staging & Migration plugin for WordPress is vul | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-109221 | The Groundhogg โ CRM, Newsletters, and Marketing Automation plugin for WordPress | HIGH | 8.1 | NVD | Oct 16, 2026 |
| CVE-2026-109219 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in al | CRITICAL | 9.8 | NVD | Oct 16, 2026 |
| CVE-2026-107746 | The FunnelKit โ Funnel Builder for WooCommerce Checkout plugin for WordPress is | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-107659 | The Modula Image Gallery โ Photo Grid & Video Gallery plugin for WordPress is vu | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-104798 | The My Calendar โ Accessible Event Manager plugin for WordPress is vulnerable to | CRITICAL | 9.8 | NVD | Oct 16, 2026 |
| CVE-2026-103911 | The The Forminator Forms โ Contact Form, Payment Form & Custom Form Builder plug | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-103895 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres | HIGH | 8.1 | NVD | Oct 16, 2026 |
| CVE-2026-103525 | The FluentCart A New Era of eCommerce โ Faster, Lighter, and Simpler plugin for | HIGH | 7.5 | NVD | Oct 16, 2026 |
| CVE-2026-103481 | The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site | MEDIUM | 6.1 | NVD | Oct 16, 2026 |
| CVE-2026-101335 | The Forminator Forms โ Contact Form, Payment Form & Custom Form Builder plugin f | MEDIUM | 6.5 | NVD | Oct 16, 2026 |
| CVE-2026-102764 | BeyondTrust - Remote Support | CRITICAL | N/A | CISA | Oct 16, 2026 |
| CVE-2025-61624 | Fortinet - Multiple Products | CRITICAL | N/A | CISA | Oct 16, 2026 |
| CVE-2026-111279 | Dragonfly through 2 | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-111277 | NivoCart through 2 | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-111275 | nifti_clib through 3 | MEDIUM | 6.1 | NVD | Oct 15, 2026 |
| CVE-2026-111273 | unarr through 1 | MEDIUM | 6.1 | NVD | Oct 15, 2026 |
| CVE-2026-111270 | libmodplug through 0 | MEDIUM | 6.1 | NVD | Oct 15, 2026 |
| CVE-2026-111269 | libical through 4 | MEDIUM | 6.1 | NVD | Oct 15, 2026 |
| CVE-2026-110922 | Use after free in Prerender in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-110921 | Use after free in V8 in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-110920 | Memory corruption in V8 in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-110919 | Use after free in V8 in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-110916 | Improper input validation in Desktop in Google Chrome prior to 155 | CRITICAL | 9.6 | NVD | Oct 15, 2026 |
| CVE-2026-110915 | Use after free in Compositing in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-110914 | Memory corruption in Workers in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-110913 | Memory corruption in DOM in Google Chrome prior to 155 | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-85634 | A flaw was found in the ContentRepositoryImpl | HIGH | 8.8 | NVD | Oct 15, 2026 |
| CVE-2026-78851 | Directory Traversal vulnerability in Grav CMS 2 | MEDIUM | 6.5 | NVD | Oct 15, 2026 |
| CVE-2026-61611 | Lychee is a free, open-source photo-management tool | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-110812 | Deserialization of untrusted data in the Gremlin graph data import component in | CRITICAL | 9.9 | NVD | Oct 15, 2026 |
| CVE-2026-105065 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 15, 2026 |
| CVE-2026-100409 | OpenNext Cloudflare is an open Next | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-100354 | kin-openapi is a Go project for handling OpenAPI files | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-100353 | kin-openapi is a Go project for handling OpenAPI files | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-109685 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 15, 2026 |
| CVE-2026-107416 | Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-105882 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 15, 2026 |
| CVE-2026-102389 | Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU | MEDIUM | 6.5 | NVD | Oct 15, 2026 |
| CVE-2026-79836 | A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to | MEDIUM | 6.4 | NVD | Oct 15, 2026 |
| CVE-2026-79834 | A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticat | HIGH | 7.4 | NVD | Oct 15, 2026 |
| CVE-2026-110726 | In `api-gateway` versions till `1 | MEDIUM | 6.5 | NVD | Oct 15, 2026 |
| CVE-2026-79833 | A vulnerability inย HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated a | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-79832 | A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potenti | HIGH | 7.6 | NVD | Oct 15, 2026 |
| CVE-2026-79831 | A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary cod | MEDIUM | 6.6 | NVD | Oct 15, 2026 |
| CVE-2026-79830 | A vulnerability inย HPE NonStop Kernel Level Thread Model Lib can cause stack buf | MEDIUM | 6.6 | NVD | Oct 15, 2026 |
| CVE-2026-109695 | Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-109694 | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl | CRITICAL | 9.8 | NVD | Oct 15, 2026 |
| CVE-2026-108498 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 15, 2026 |
| CVE-2026-108497 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | CRITICAL | 9.3 | NVD | Oct 15, 2026 |
| CVE-2026-108491 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 15, 2026 |
| CVE-2026-88043 | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Script | HIGH | 7.2 | NVD | Oct 15, 2026 |
| CVE-2026-86803 | The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode ex | MEDIUM | 6.5 | NVD | Oct 15, 2026 |
| CVE-2026-78087 | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting | MEDIUM | 6.4 | NVD | Oct 15, 2026 |
| CVE-2026-78001 | The Post and Page Builder by BoldGrid โ Visual Drag and Drop Editor plugin for W | MEDIUM | 6.4 | NVD | Oct 15, 2026 |
| CVE-2026-18586 | The Premium Packages โ Sell Digital Products Securely plugin for WordPress is vu | HIGH | 7.2 | NVD | Oct 15, 2026 |
| CVE-2026-18557 | The Photo Gallery by 10Web โ Mobile-Friendly Image Gallery plugin for WordPress | MEDIUM | 6.1 | NVD | Oct 15, 2026 |
| CVE-2026-18548 | The Groundhogg โ CRM, Newsletters, and Marketing Automation plugin for WordPress | HIGH | 7.2 | NVD | Oct 15, 2026 |
| CVE-2026-17031 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPre | HIGH | 8.1 | NVD | Oct 15, 2026 |
| CVE-2026-17001 | The Import and export users and customers plugin for WordPress is vulnerable to | MEDIUM | 6.4 | NVD | Oct 15, 2026 |
| CVE-2026-15180 | The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross- | MEDIUM | 6.1 | NVD | Oct 15, 2026 |
| CVE-2026-15090 | The Link Library plugin for WordPress is vulnerable to time-based SQL Injection | HIGH | 7.5 | NVD | Oct 15, 2026 |
| CVE-2026-110923 | A flaw was found in OpenSSH | MEDIUM | 6.5 | NVD | Oct 15, 2026 |
| CVE-2026-76665 | A security vulnerability inย HPE NonStop EXPAND may cause out-of-bounds memory re | HIGH | 7.1 | NVD | Oct 15, 2026 |
| CVE-2026-3712 | The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery | HIGH | 7.3 | NVD | Oct 15, 2026 |
| CVE-2026-14572 | The Kirki โ Freeform Page Builder, Website Builder & Customizer plugin for WordP | MEDIUM | 6.4 | NVD | Oct 15, 2026 |
| CVE-2026-108587 | The 10Web Booster โ Website speed optimization, Cache & Page Speed optimizer plu | CRITICAL | 9.8 | NVD | Oct 15, 2026 |
| CVE-2026-21589 | Atlassian - Multiple Products | CRITICAL | N/A | CISA | Oct 15, 2026 |
| CVE-2026-110839 | FreeRDP 3 | HIGH | 7.1 | NVD | Oct 14, 2026 |
| CVE-2026-110838 | FreeRDP shadow server from 3 | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-110837 | FreeRDP 2 | HIGH | 7.1 | NVD | Oct 14, 2026 |
| CVE-2026-110836 | FreeRDP from 3 | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-110834 | FreeRDP from 2 | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-110832 | FreeRDP from 2 | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-110829 | FreeRDP versions from 3 | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-101956 | An Improper Authentication vulnerability in the J-Web web management component o | CRITICAL | 9.8 | NVD | Oct 14, 2026 |
| CVE-2026-101955 | A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper | HIGH | 8.1 | NVD | Oct 14, 2026 |
| CVE-2026-101951 | An Improper Validation of Consistency within Input vulnerability in the routing | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101950 | A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo | CRITICAL | 9.8 | NVD | Oct 14, 2026 |
| CVE-2026-101948 | A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101945 | An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Ne | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101944 | An Integer Overflow or Wraparound vulnerability in the routing protocol daemon ( | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101943 | An Improper Input Validation vulnerability in the routing protocol daemon (rpd) | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101942 | An Improper Handling of Length Parameter Inconsistency vulnerability in the rout | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101941 | A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101940 | A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Ne | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101939 | A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-101938 | An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-101937 | A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Net | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-101936 | A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Ju | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-101927 | A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos O | HIGH | 7.8 | NVD | Oct 14, 2026 |
| CVE-2026-100236 | A flaw was found in the DPDK GSO library | HIGH | 8.6 | NVD | Oct 14, 2026 |
| CVE-2016-15060 | A vulnerability was found in PCMan FTP Server up to 2 | HIGH | 8.3 | NVD | Oct 14, 2026 |
| CVE-2026-73795 | A security vulnerability in HPE NonStop TMF Auditread2 can causeย Denial of Serv | MEDIUM | 6.4 | NVD | Oct 14, 2026 |
| CVE-2026-107431 | Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-105067 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 8.5 | NVD | Oct 14, 2026 |
| CVE-2026-104795 | The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) | HIGH | 8.8 | NVD | Oct 14, 2026 |
| CVE-2026-103905 | The authentication middleware of the JTL-Shop administration backend processes t | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-103904 | The public consent endpoint of JTL-Shop accepts arbitrary consent names from una | CRITICAL | 9.3 | NVD | Oct 14, 2026 |
| CVE-2026-103358 | Improper Control of Generation of Code ('Code Injection') vulnerability in Villa | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-103308 | The Visma Pay for WooCommerce WordPress plugin before 1 | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-100229 | A flaw was found in GStreamer's H | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-46449 | The Akamai Guardicore Platform Agent (GPA) before 7 | MEDIUM | 6.7 | NVD | Oct 14, 2026 |
| CVE-2026-110455 | A malicious actor with access to the network and under certain conditions could | HIGH | 8.1 | NVD | Oct 14, 2026 |
| CVE-2026-110450 | Nix before 2 | HIGH | 8.0 | NVD | Oct 14, 2026 |
| CVE-2026-105429 | Improper neutralization of special elements in the NetBird client SSH configurat | HIGH | 8.0 | NVD | Oct 14, 2026 |
| CVE-2026-103369 | The Social Share Buttons & Analytics Plugin โ GetSocial | MEDIUM | 6.4 | NVD | Oct 14, 2026 |
| CVE-2026-101926 | The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to | MEDIUM | 6.5 | NVD | Oct 14, 2026 |
| CVE-2026-101924 | The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti | HIGH | 7.2 | NVD | Oct 14, 2026 |
| CVE-2026-97398 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros | HIGH | 7.2 | NVD | Oct 14, 2026 |
| CVE-2026-97020 | The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripti | MEDIUM | 6.4 | NVD | Oct 14, 2026 |
| CVE-2026-104749 | The Bit integrations โ Form Integration, Webhook, Spreadsheets, CRM, LMS & Email | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-103425 | The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scri | MEDIUM | 6.4 | NVD | Oct 14, 2026 |
| CVE-2026-103423 | The Booking Package plugin for WordPress is vulnerable to authorization bypass i | HIGH | 7.5 | NVD | Oct 14, 2026 |
| CVE-2026-110359 | Hyland Desktop Host for Windows before 25 | HIGH | 7.8 | NVD | Oct 14, 2026 |
| CVE-2026-92817 | The Ignition Perspective module does not properly validate session privileges wh | HIGH | 8.8 | NVD | Oct 14, 2026 |
| CVE-2026-0322 | Palo Alto Networks - PAN-OS | CRITICAL | N/A | CISA | Oct 14, 2026 |
| CVE-2026-76519 | Cisco - Secure Email Gateway | CRITICAL | N/A | CISA | Oct 14, 2026 |
| CVE-2026-97381 | Legacy Update is a tool for activating and installing updates on legacy Windows | CRITICAL | 9.9 | NVD | Oct 13, 2026 |
| CVE-2026-95634 | C2Pa โ CAI Content Credentials is affected by a Server-Side Request | HIGH | 8.6 | NVD | Oct 13, 2026 |
| CVE-2026-95633 | C2Pa โ CAI Content Credentials is affected by an Improper Verificat | HIGH | 7.5 | NVD | Oct 13, 2026 |
| CVE-2026-95632 | C2Pa โ CAI Content Credentials is affected by an Improper Verificat | HIGH | 7.5 | NVD | Oct 13, 2026 |
| CVE-2026-94453 | Libreswan's pluto daemon has a use-after-free vulnerability when a client connec | HIGH | 7.5 | NVD | Oct 13, 2026 |
| CVE-2026-110097 | Ikaros 1 | HIGH | 8.1 | NVD | Oct 13, 2026 |
| CVE-2026-109827 | A vulnerability has been found in GPAC up to 26 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-109620 | A vulnerability has been found in SourceCodester Online Reviewer System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-109607 | A flaw has been found in SourceCodester Online Exam System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-109606 | A vulnerability was detected in SourceCodester Art Gallery Management System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-109412 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote | CRITICAL | 9.9 | NVD | Oct 13, 2026 |
| CVE-2026-106047 | A Path Traversal vulnerability in the template export functionality of Ivanti Xt | HIGH | 7.7 | NVD | Oct 13, 2026 |
| CVE-2026-106043 | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction | HIGH | 7.5 | NVD | Oct 13, 2026 |
| CVE-2026-106042 | An External Control of File Name or Path vulnerability in Ivanti Xtraction befor | CRITICAL | 9.9 | NVD | Oct 13, 2026 |
| CVE-2026-104250 | The unstructured library provides open-source components for ingesting and pre-p | MEDIUM | 6.1 | NVD | Oct 13, 2026 |
| CVE-2026-104126 | JumpServer is an open source bastion host and an operation and maintenance secur | MEDIUM | 6.0 | NVD | Oct 13, 2026 |
| CVE-2026-103030 | Dio is a powerful HTTP client for Dart and Flutter | HIGH | 7.5 | NVD | Oct 13, 2026 |
| CVE-2026-102989 | TanStack Router is a client-first, server-capable, fully type-safe router and fu | CRITICAL | 9.3 | NVD | Oct 13, 2026 |
| CVE-2026-109705 | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a | CRITICAL | 9.6 | NVD | Oct 13, 2026 |
| CVE-2026-109704 | Privilege escalation in the Application Update component | HIGH | 8.8 | NVD | Oct 13, 2026 |
| CVE-2026-109405 | A security flaw has been discovered in conductor-oss conductor up to 3 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-109403 | A vulnerability was determined in conductor-oss conductor up to 3 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-89279 | Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc | MEDIUM | 6.5 | NVD | Oct 13, 2026 |
| CVE-2026-109832 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux | HIGH | 7.5 | NVD | Oct 13, 2026 |
| CVE-2026-109402 | A vulnerability was found in conductor-oss conductor 3 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-109190 | A vulnerability has been found in conductor-oss conductor 3 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-109189 | A vulnerability was detected in fit2cloud MeterSphere up to 3 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-109157 | A vulnerability was found in TRENDnet TEW-432BRP 3 | CRITICAL | 9.9 | NVD | Oct 13, 2026 |
| CVE-2026-109156 | A vulnerability has been found in SeldonIO MLServer up to 1 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-109155 | A flaw has been found in DeepPavlov up to 1 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-109153 | A vulnerability was detected in MosaicML Composer up to 0 | MEDIUM | 6.3 | NVD | Oct 13, 2026 |
| CVE-2026-102007 | The Bit integrations โ Form Integration, Webhook, Spreadsheets, CRM, LMS & Email | HIGH | 7.2 | NVD | Oct 13, 2026 |
| CVE-2026-108975 | A security flaw has been discovered in SourceCodester Library Management System | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108974 | A vulnerability was identified in SourceCodester E-Learning System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108973 | A vulnerability was determined in SourceCodester Contact Tracing System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-103316 | The macOS version of the DigiD app is not signed with Hardened Runtime | HIGH | 7.1 | NVD | Oct 13, 2026 |
| CVE-2026-89269 | The WP Testimonials WordPress plugin through 1 | MEDIUM | 6.8 | NVD | Oct 13, 2026 |
| CVE-2026-54870 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 13, 2026 |
| CVE-2026-54869 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 13, 2026 |
| CVE-2026-54868 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 13, 2026 |
| CVE-2026-54867 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 13, 2026 |
| CVE-2026-108972 | A vulnerability was found in SourceCodester Human Resource Management System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108971 | A flaw has been found in D-Link DCS-930L B1 | CRITICAL | 9.6 | NVD | Oct 13, 2026 |
| CVE-2026-108970 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108969 | A security vulnerability has been detected in itsmeravitejak Online-Examination- | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108968 | A weakness has been identified in SourceCodester Performance Indicator System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108967 | A security flaw has been discovered in SourceCodester Performance Indicator Syst | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-108966 | A vulnerability was identified in SourceCodester Performance Indicator System 1 | HIGH | 7.3 | NVD | Oct 13, 2026 |
| CVE-2026-104935 | Ivanti - Connect Secure | CRITICAL | N/A | CISA | Oct 13, 2026 |
| CVE-2026-96951 | Microsoft - Windows | CRITICAL | N/A | CISA | Oct 13, 2026 |
| CVE-2026-109573 | phpMyFAQ before 4 | HIGH | 8.1 | NVD | Oct 12, 2026 |
| CVE-2026-109572 | Open WebUI from 0 | HIGH | 7.6 | NVD | Oct 12, 2026 |
| CVE-2026-102627 | IBM TRIRIGA Application Platform 5 | HIGH | 8.8 | NVD | Oct 12, 2026 |
| CVE-2025-71432 | Frappe ERPNext before 14 | HIGH | 8.1 | NVD | Oct 12, 2026 |
| CVE-2024-58390 | Frappe before 14 | HIGH | 8.8 | NVD | Oct 12, 2026 |
| CVE-2023-54412 | Frappe before 13 | MEDIUM | 6.5 | NVD | Oct 12, 2026 |
| CVE-2023-54408 | Frappe before 13 | MEDIUM | 6.1 | NVD | Oct 12, 2026 |
| CVE-2026-109246 | FreeRDP before 3 | MEDIUM | 6.5 | NVD | Oct 12, 2026 |
| CVE-2026-109245 | FreeRDP 3 | MEDIUM | 6.8 | NVD | Oct 12, 2026 |
| CVE-2026-109244 | FreeRDP from 2 | MEDIUM | 6.6 | NVD | Oct 12, 2026 |
| CVE-2026-109242 | FreeRDP before 3 | HIGH | 7.1 | NVD | Oct 12, 2026 |
| CVE-2026-109238 | Crawl4AI 0 | HIGH | 8.6 | NVD | Oct 12, 2026 |
| CVE-2026-109237 | Crawl4AI from 0 | HIGH | 8.1 | NVD | Oct 12, 2026 |
| CVE-2026-108914 | A flaw has been found in Edimax BR-6208AC 1 | CRITICAL | 9.9 | NVD | Oct 12, 2026 |
| CVE-2026-108907 | A vulnerability was determined in Netcore NR268 1 | CRITICAL | 10.0 | NVD | Oct 12, 2026 |
| CVE-2026-108478 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 12, 2026 |
| CVE-2026-108831 | A security vulnerability has been detected in meetecho janus-gateway up to 1 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108826 | A vulnerability was found in Zen Cart up to 2 | HIGH | 7.3 | NVD | Oct 12, 2026 |
| CVE-2026-108824 | A flaw has been found in DataEase up to 3 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-105412 | An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17 | HIGH | 7.1 | NVD | Oct 12, 2026 |
| CVE-2026-105411 | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule | HIGH | 8.1 | NVD | Oct 12, 2026 |
| CVE-2026-105410 | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed | HIGH | 8.7 | NVD | Oct 12, 2026 |
| CVE-2026-105409 | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed | HIGH | 8.7 | NVD | Oct 12, 2026 |
| CVE-2026-105408 | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed | HIGH | 8.7 | NVD | Oct 12, 2026 |
| CVE-2026-105407 | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1 | HIGH | 8.8 | NVD | Oct 12, 2026 |
| CVE-2026-103903 | An incorrect authorization vulnerability in the WinBox authentication flow of Mi | HIGH | 8.8 | NVD | Oct 12, 2026 |
| CVE-2026-103902 | Improper verification of cryptographic signature vulnerability in DigiDoc libdig | HIGH | 7.5 | NVD | Oct 12, 2026 |
| CVE-2026-108801 | A security flaw has been discovered in prasathmani TinyFileManager up to 2 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108799 | A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d1 | HIGH | 7.3 | NVD | Oct 12, 2026 |
| CVE-2026-66086 | In the modem OTA stack, there is a possible stack-based buffer overflow due to i | CRITICAL | 9.8 | NVD | Oct 12, 2026 |
| CVE-2026-108980 | Blinko through 1 | HIGH | 8.8 | NVD | Oct 12, 2026 |
| CVE-2026-108787 | A vulnerability was found in houtini-ai voice-analyser-mcp up to 2 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108786 | A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108785 | A flaw has been found in macrozheng mall up to 1 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108784 | A vulnerability was detected in macrozheng mall up to 1 | MEDIUM | 6.5 | NVD | Oct 12, 2026 |
| CVE-2026-108783 | A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1 | HIGH | 7.3 | NVD | Oct 12, 2026 |
| CVE-2026-108782 | A weakness has been identified in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108781 | A security flaw has been discovered in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108779 | A vulnerability was identified in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108778 | A vulnerability was determined in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108777 | A vulnerability was found in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108775 | A vulnerability has been found in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108774 | A flaw has been found in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 12, 2026 |
| CVE-2026-108773 | A vulnerability was detected in erzhongxmu JEEWMS up to 2026 | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108976 | GNU Emacs before 31 | HIGH | 7.8 | NVD | Oct 11, 2026 |
| CVE-2026-108963 | databasement before 1 | HIGH | 8.8 | NVD | Oct 11, 2026 |
| CVE-2026-108925 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu | MEDIUM | 6.1 | NVD | Oct 11, 2026 |
| CVE-2026-19935 | The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) da | HIGH | 7.5 | NVD | Oct 11, 2026 |
| CVE-2026-19740 | The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bl | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-19739 | The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/l | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-19738 | The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected I | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-19736 | The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng | HIGH | 7.8 | NVD | Oct 11, 2026 |
| CVE-2026-19669 | The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_ga | HIGH | 7.8 | NVD | Oct 11, 2026 |
| CVE-2026-19577 | net_route_ipv6_packet() in subsys/net/ip/route_ipv6 | HIGH | 7.1 | NVD | Oct 11, 2026 |
| CVE-2026-19576 | The Goodix GT9xx input driver in drivers/input/input_gt911 | MEDIUM | 6.8 | NVD | Oct 11, 2026 |
| CVE-2026-108718 | Rill 0 | HIGH | 8.1 | NVD | Oct 11, 2026 |
| CVE-2026-108717 | Combodo iTop 3 | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108714 | MCP Kotlin SDK through 0 | HIGH | 7.5 | NVD | Oct 11, 2026 |
| CVE-2026-108710 | NornicDB through 1 | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-108576 | A vulnerability was found in TOZED X300 up to 6 | CRITICAL | 10.0 | NVD | Oct 11, 2026 |
| CVE-2026-108575 | A vulnerability has been found in BerriAI LiteLLM up to 1 | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108571 | A weakness has been identified in Xinhu Rainrock RockOA up to 2 | HIGH | 7.3 | NVD | Oct 11, 2026 |
| CVE-2026-108570 | A security flaw has been discovered in Furion | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108569 | A vulnerability was identified in Furion | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-81154 | The Robo Gallery WordPress plugin before 5 | MEDIUM | 6.8 | NVD | Oct 11, 2026 |
| CVE-2026-81153 | The Robo Gallery WordPress plugin before 5 | MEDIUM | 6.8 | NVD | Oct 11, 2026 |
| CVE-2026-14854 | The WooCommerce Bookings WordPress plugin before 3 | HIGH | 7.5 | NVD | Oct 11, 2026 |
| CVE-2026-12980 | The Post Snippets WordPress plugin through 4 | MEDIUM | 6.8 | NVD | Oct 11, 2026 |
| CVE-2026-108541 | A vulnerability has been found in highwarden Super Store Finder up to 3 | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108540 | A flaw has been found in OpenSpug Spug up to 3 | CRITICAL | 9.9 | NVD | Oct 11, 2026 |
| CVE-2026-106029 | The WeddingCity Lite WordPress plugin through 1 | HIGH | 7.5 | NVD | Oct 11, 2026 |
| CVE-2026-104680 | The Envira Gallery WordPress plugin before 1 | HIGH | 7.2 | NVD | Oct 11, 2026 |
| CVE-2026-104028 | The Anton Extensions WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Oct 11, 2026 |
| CVE-2026-103695 | The Mobile builder WordPress plugin through 1 | HIGH | 8.6 | NVD | Oct 11, 2026 |
| CVE-2026-103694 | The Mobile builder WordPress plugin through 1 | HIGH | 8.8 | NVD | Oct 11, 2026 |
| CVE-2026-103305 | The Prenotazioni WordPress plugin through 1 | HIGH | 8.8 | NVD | Oct 11, 2026 |
| CVE-2026-108539 | A vulnerability was detected in GPAC up to 26 | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108538 | A security vulnerability has been detected in GPAC up to 26 | MEDIUM | 6.3 | NVD | Oct 11, 2026 |
| CVE-2026-108708 | Wukong_HRM through commit 186115e contains a missing authorization vulnerability | HIGH | 8.8 | NVD | Oct 11, 2026 |
| CVE-2026-108707 | Wukong_HRM through commit 186115e contains an authentication bypass vulnerabilit | CRITICAL | 9.8 | NVD | Oct 11, 2026 |
| CVE-2026-108700 | 1Panel-dev CordysCRM before 1 | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-108695 | MultiVendorX WordPress plugin through 5 | HIGH | 7.1 | NVD | Oct 11, 2026 |
| CVE-2026-108694 | ConvertX through 0 | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-108693 | ImageMagick on Windows through 7 | HIGH | 7.0 | NVD | Oct 11, 2026 |
| CVE-2026-108692 | 1Panel-dev CordysCRM from 1 | MEDIUM | 6.5 | NVD | Oct 11, 2026 |
| CVE-2026-108598 | Floci 1 | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-108593 | 9router 0 | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-106610 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verifi | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-105892 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-94160 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 10, 2026 |
| CVE-2026-62044 | Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player s | HIGH | 7.2 | NVD | Oct 10, 2026 |
| CVE-2026-106609 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcas | HIGH | 7.5 | NVD | Oct 10, 2026 |
| CVE-2026-106608 | Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommer | HIGH | 7.2 | NVD | Oct 10, 2026 |
| CVE-2026-105889 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | CRITICAL | 9.3 | NVD | Oct 10, 2026 |
| CVE-2026-104398 | Deserialization of Untrusted Data vulnerability in VillaTheme AFFI โ Affiliate M | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-103071 | Improper Control of Generation of Code ('Code Injection') vulnerability in Villa | HIGH | 7.5 | NVD | Oct 10, 2026 |
| CVE-2026-97264 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 10, 2026 |
| CVE-2026-97263 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 10, 2026 |
| CVE-2026-94676 | Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan t | HIGH | 7.2 | NVD | Oct 10, 2026 |
| CVE-2026-108164 | Open Source Social Network (OSSN) through 10 | MEDIUM | 6.5 | NVD | Oct 10, 2026 |
| CVE-2026-108163 | Pingvin Share X before 1 | MEDIUM | 6.5 | NVD | Oct 10, 2026 |
| CVE-2026-108162 | Pingvin Share X before 1 | MEDIUM | 6.5 | NVD | Oct 10, 2026 |
| CVE-2026-108161 | FusionPBX through 5 | HIGH | 7.5 | NVD | Oct 10, 2026 |
| CVE-2026-105885 | Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider- | HIGH | 8.8 | NVD | Oct 10, 2026 |
| CVE-2026-102388 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 10, 2026 |
| CVE-2026-103520 | The HivePress โ Business Directory, Listings & Classified Ads Plugin plugin for | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-9696 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-97670 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization b | CRITICAL | 9.1 | NVD | Oct 10, 2026 |
| CVE-2026-97630 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-96648 | The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Sto | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-89301 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner | HIGH | 7.5 | NVD | Oct 10, 2026 |
| CVE-2026-87869 | The Filter Everything โ WordPress & WooCommerce Filters plugin for WordPress is | MEDIUM | 6.1 | NVD | Oct 10, 2026 |
| CVE-2026-104993 | The GeoDirectory โ WP Business Directory Plugin and Classified Listings Director | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-104735 | The RSS Aggregator by Feedzy โ Feed to Post, Autoblogging, News & YouTube Video | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-104021 | The Fastcache by Host | HIGH | 7.2 | NVD | Oct 10, 2026 |
| CVE-2026-103998 | The Form Maker by 10Web โ Mobile-Friendly Drag & Drop Contact Form Builder plugi | MEDIUM | 6.1 | NVD | Oct 10, 2026 |
| CVE-2026-103889 | The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable t | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-102401 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scr | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-96743 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Sto | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-94589 | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirect | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-107645 | The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation | CRITICAL | 9.1 | NVD | Oct 10, 2026 |
| CVE-2026-104898 | The Online Scheduling and Appointment Booking System โ Bookly plugin for WordPre | MEDIUM | 6.8 | NVD | Oct 10, 2026 |
| CVE-2026-104797 | The Advanced Form Integration โ Connect Forms to 300+ Apps plugin for WordPress | HIGH | 8.1 | NVD | Oct 10, 2026 |
| CVE-2026-104732 | The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Byp | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-93883 | The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to S | MEDIUM | 6.4 | NVD | Oct 10, 2026 |
| CVE-2026-104915 | The Academy LMS โ AI Course Builder, Quizzes, Certificates & eLearning plugin fo | MEDIUM | 6.5 | NVD | Oct 10, 2026 |
| CVE-2026-108474 | In JetBrains Exposed before 1 | CRITICAL | 9.8 | NVD | Oct 10, 2026 |
| CVE-2026-107818 | MariaDB server is a community developed fork of MySQL server | HIGH | 8.4 | NVD | Oct 09, 2026 |
| CVE-2026-107816 | MariaDB server is a community developed fork of MySQL server | MEDIUM | 6.4 | NVD | Oct 09, 2026 |
| CVE-2026-75347 | EIPStackGroup OpENer v2 | HIGH | 7.5 | NVD | Oct 09, 2026 |
| CVE-2026-55797 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes | HIGH | 8.8 | NVD | Oct 09, 2026 |
| CVE-2026-48484 | pyLoad is a free and open-source download manager written in Python | MEDIUM | 6.5 | NVD | Oct 09, 2026 |
| CVE-2026-42695 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 09, 2026 |
| CVE-2026-108160 | AstronRPA through 1 | HIGH | 7.5 | NVD | Oct 09, 2026 |
| CVE-2026-108159 | AstronRPA through 1 | HIGH | 7.5 | NVD | Oct 09, 2026 |
| CVE-2026-108158 | plugNmeet Server through 2 | MEDIUM | 6.5 | NVD | Oct 09, 2026 |
| CVE-2026-108157 | Pingvin Share X from 0 | HIGH | 8.1 | NVD | Oct 09, 2026 |
| CVE-2026-108156 | LobsterAI 2026 | HIGH | 7.1 | NVD | Oct 09, 2026 |
| CVE-2026-108119 | A flaw was found in busybox | MEDIUM | 6.3 | NVD | Oct 09, 2026 |
| CVE-2026-107815 | MariaDB server is a community developed fork of MySQL server | HIGH | 8.5 | NVD | Oct 09, 2026 |
| CVE-2026-62039 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Oct 09, 2026 |
| CVE-2026-86850 | The SKU Error Fixer for WooCommerce WordPress plugin through 1 | MEDIUM | 6.5 | NVD | Oct 09, 2026 |
| CVE-2026-81929 | The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulner | HIGH | 7.2 | NVD | Oct 09, 2026 |
| CVE-2026-106097 | The Code Snippets WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Oct 09, 2026 |
| CVE-2025-15700 | The AWP Classifieds WordPress plugin before 4 | HIGH | 8.8 | NVD | Oct 09, 2026 |
| CVE-2026-107914 | Backdrop CMS 1 | HIGH | 7.8 | NVD | Oct 09, 2026 |
| CVE-2026-107911 | A type confusion vulnerability in the _read_flags function (src/commands/cmd_dis | HIGH | 7.5 | NVD | Oct 09, 2026 |
| CVE-2026-107910 | An improper authentication vulnerability in the is_authenticated function (src/b | HIGH | 8.1 | NVD | Oct 09, 2026 |
| CVE-2026-107909 | A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws | CRITICAL | 9.1 | NVD | Oct 09, 2026 |
| CVE-2026-107908 | A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_ | CRITICAL | 9.8 | NVD | Oct 09, 2026 |
| CVE-2026-7827 | A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph de | HIGH | 8.1 | NVD | Oct 09, 2026 |
| CVE-2026-7826 | A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function | CRITICAL | 9.1 | NVD | Oct 09, 2026 |
| CVE-2026-5759 | A double free and use-after-free vulnerability in the RdbLoadDeletedNodes functi | CRITICAL | 9.8 | NVD | Oct 09, 2026 |
| CVE-2026-56866 | When http | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-56857 | On Windows, when the target of Root | CRITICAL | 9.8 | NVD | Oct 08, 2026 |
| CVE-2026-107728 | Strawberry GraphQL is a library for creating GraphQL APIs | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-50055 | A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-50054 | An authorization flaw in Zimbra Collaboration Suiteโs GrantRightsRequest allows | HIGH | 7.1 | NVD | Oct 08, 2026 |
| CVE-2026-10631 | An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suit | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-107709 | A path traversal vulnerability exists in Bower decompress-zip through version 0 | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-107301 | msgpack5 is a msgpack v5 implementation for node | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-107300 | msgpack5 is a msgpack v5 implementation for node | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-107295 | Pydantic AI is a Python agent framework for building applications and workflows | HIGH | 7.6 | NVD | Oct 08, 2026 |
| CVE-2026-107294 | Pydantic AI is a Python agent framework for building applications and workflows | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-107292 | Pydantic AI is a Python agent framework for building applications and workflows | MEDIUM | 6.4 | NVD | Oct 08, 2026 |
| CVE-2026-107290 | Pydantic AI is a Python agent framework for building applications and workflows | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-105436 | Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-ch | HIGH | 8.8 | NVD | Oct 08, 2026 |
| CVE-2026-104078 | Obsidian Desktop before 1 | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-104077 | Obsidian Desktop before 1 | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-107577 | Inefficient algorithmic complexity and a non-terminating loop in the MIME proces | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-107576 | Inefficient algorithmic complexity in the inbound DKIM and ARC signature verific | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-107574 | Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMail | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-107573 | Incorrect default permissions in the Windows installer of Progressive Robot hMai | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-107572 | Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMail | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-107275 | @fastify/jwt is a JSON Web Token plugin for the Fastify web framework | MEDIUM | 6.8 | NVD | Oct 08, 2026 |
| CVE-2026-93509 | The Wallet System for WooCommerce WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-104704 | Progressive Robot hMailServer 6 | HIGH | 7.4 | NVD | Oct 08, 2026 |
| CVE-2026-104660 | Missing authorization on COM objects in Progressive Robot hMailServer 6 | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-104659 | Missing Host header validation and missing throttling of failed administrator si | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-104658 | The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMa | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-103649 | Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6 | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-103647 | Cross-site scripting in the webmail of Progressive Robot hMailServer 6 | HIGH | 8.0 | NVD | Oct 08, 2026 |
| CVE-2026-103011 | Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEn | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-103010 | Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEn | HIGH | 7.8 | NVD | Oct 08, 2026 |
| CVE-2026-103646 | The Ultimate Multisite WordPress plugin before 2 | CRITICAL | 9.8 | NVD | Oct 08, 2026 |
| CVE-2026-103309 | The GPTranslate WordPress plugin before 2 | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-17609 | The Super Forms โ Drag & Drop Form Builder plugin for WordPress is vulnerable to | CRITICAL | 9.1 | NVD | Oct 08, 2026 |
| CVE-2026-17196 | The Super Forms โ Drag & Drop Form Builder plugin for WordPress is vulnerable to | HIGH | 8.8 | NVD | Oct 08, 2026 |
| CVE-2017-20283 | NXP MQX Classic before 5 | MEDIUM | 6.5 | NVD | Oct 08, 2026 |
| CVE-2026-82627 | The Uncanny Automator โ AI + Automation for WordPress | AI Agent, AI Page Builde | HIGH | 7.5 | NVD | Oct 08, 2026 |
| CVE-2026-94154 | The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scrip | MEDIUM | 6.1 | NVD | Oct 08, 2026 |
| CVE-2016-3081 | Apache - Struts | CRITICAL | N/A | CISA | Oct 08, 2026 |
| CVE-2021-3199 | ONLYOFFICE - Docs | CRITICAL | N/A | CISA | Oct 08, 2026 |
| CVE-2015-3306 | ProFTPD - ProFTPD | CRITICAL | N/A | CISA | Oct 08, 2026 |
| CVE-2015-5477 | ISC - BIND | CRITICAL | N/A | CISA | Oct 08, 2026 |
| CVE-2023-22894 | Strapi - Strapi | CRITICAL | N/A | CISA | Oct 08, 2026 |
| CVE-2026-89322 | Vault and Vault Enterprise did not consistently evaluate ACL policies against th | HIGH | 7.2 | NVD | Oct 07, 2026 |
| CVE-2026-76455 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Oct 07, 2026 |
| CVE-2026-76454 | A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Pre | CRITICAL | 9.1 | NVD | Oct 07, 2026 |
| CVE-2026-76453 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.8 | NVD | Oct 07, 2026 |
| CVE-2026-62253 | Homer is open source telecom observability software | CRITICAL | 9.8 | NVD | Oct 07, 2026 |
| CVE-2026-62252 | Homer is open source telecom observability software | CRITICAL | 9.8 | NVD | Oct 07, 2026 |
| CVE-2026-62251 | Homer is open source telecom observability software | HIGH | 8.1 | NVD | Oct 07, 2026 |
| CVE-2026-62176 | PraisonAI is a multi-agent teams system | CRITICAL | 9.1 | NVD | Oct 07, 2026 |
| CVE-2026-20362 | A vulnerability in the web-based management interface of Cisco Finesse could all | HIGH | 7.2 | NVD | Oct 07, 2026 |
| CVE-2026-20328 | A vulnerability in the web-based management interface of Cisco License On-Prem, | CRITICAL | 9.1 | NVD | Oct 07, 2026 |
| CVE-2026-20321 | A vulnerability in the web-based management API for Cisco Application Policy Inf | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-106557 | Backstage is an open framework for building developer portals | HIGH | 7.7 | NVD | Oct 07, 2026 |
| CVE-2026-106065 | A heap-based buffer overflow was found in GIMPโs PCX export plug-in | MEDIUM | 6.3 | NVD | Oct 07, 2026 |
| CVE-2026-105138 | Obot 0 | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-102256 | Post-authentication Improper Neutralization of Special Elements used in an OS Co | HIGH | 7.8 | NVD | Oct 07, 2026 |
| CVE-2026-102255 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Pla | CRITICAL | 10.0 | NVD | Oct 07, 2026 |
| CVE-2026-42710 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 7.6 | NVD | Oct 07, 2026 |
| CVE-2026-42708 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 7.6 | NVD | Oct 07, 2026 |
| CVE-2026-107159 | MiniUPnPd through 2 | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-106059 | GitAhead through 2 | HIGH | 8.8 | NVD | Oct 07, 2026 |
| CVE-2026-106058 | GitAhead through 2 | HIGH | 7.5 | NVD | Oct 07, 2026 |
| CVE-2026-106057 | patool before 4 | HIGH | 7.8 | NVD | Oct 07, 2026 |
| CVE-2026-106056 | Rundeck before 6 | HIGH | 7.5 | NVD | Oct 07, 2026 |
| CVE-2026-42714 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 7.6 | NVD | Oct 07, 2026 |
| CVE-2026-42713 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | HIGH | 7.6 | NVD | Oct 07, 2026 |
| CVE-2026-105316 | The Magee Shortcodes WordPress plugin through 2 | HIGH | 7.1 | NVD | Oct 07, 2026 |
| CVE-2026-104953 | The MPG WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Oct 07, 2026 |
| CVE-2026-104677 | The WP Coder WordPress plugin before 4 | HIGH | 7.2 | NVD | Oct 07, 2026 |
| CVE-2026-104667 | The Animated Number Counters WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Oct 07, 2026 |
| CVE-2026-104653 | The Envira Gallery WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Oct 07, 2026 |
| CVE-2026-104652 | The Envira Gallery WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Oct 07, 2026 |
| CVE-2026-103378 | The Geliver Akฤฑllฤฑ Kargo Pazaryeri WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-59347 | VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerabilit | HIGH | 8.1 | NVD | Oct 07, 2026 |
| CVE-2026-59346 | VMware Workstation and Fusion contain an integer-overflow vulnerability | CRITICAL | 9.3 | NVD | Oct 07, 2026 |
| CVE-2026-103869 | A flaw was found in pulp-ansible's bearer-token refresh for collection remotes | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-103868 | A flaw was found in pulp-container when it authenticates to an upstream registry | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-102173 | The Kirki โ Freeform Page Builder, Website Builder & Customizer plugin for WordP | HIGH | 7.2 | NVD | Oct 07, 2026 |
| CVE-2026-97671 | Langflow โ IBM Langflow OSS 1 | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-97655 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.8 | NVD | Oct 07, 2026 |
| CVE-2026-93678 | Langflow โ IBM Langflow OSS 1 | HIGH | 7.6 | NVD | Oct 07, 2026 |
| CVE-2026-93677 | Langflow โ IBM Langflow OSS 1 | HIGH | 7.7 | NVD | Oct 07, 2026 |
| CVE-2026-93675 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.8 | NVD | Oct 07, 2026 |
| CVE-2026-93674 | Langflow โ IBM Langflow OSS 1 | CRITICAL | 9.8 | NVD | Oct 07, 2026 |
| CVE-2026-93449 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.5 | NVD | Oct 07, 2026 |
| CVE-2026-93448 | Langflow โ IBM Langflow OSS 1 | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-93447 | Langflow โ IBM Langflow OSS 1 | HIGH | 7.5 | NVD | Oct 07, 2026 |
| CVE-2026-93445 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.1 | NVD | Oct 07, 2026 |
| CVE-2026-93443 | Langflow โ IBM Langflow OSS 1 | HIGH | 7.5 | NVD | Oct 07, 2026 |
| CVE-2026-88962 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.8 | NVD | Oct 07, 2026 |
| CVE-2026-104334 | Langflow โ IBM Langflow OSS 1 | CRITICAL | 9.8 | NVD | Oct 07, 2026 |
| CVE-2026-103360 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.1 | NVD | Oct 07, 2026 |
| CVE-2026-101331 | Langflow โ IBM Langflow OSS 1 | HIGH | 7.7 | NVD | Oct 07, 2026 |
| CVE-2026-101329 | Langflow โ IBM Langflow OSS 1 | MEDIUM | 6.5 | NVD | Oct 07, 2026 |
| CVE-2026-104335 | IBM Langflow OSS 1 | HIGH | 8.8 | NVD | Oct 07, 2026 |
| CVE-2026-105859 | Payload is a free and open source headless content management system | CRITICAL | 9.8 | NVD | Oct 06, 2026 |
| CVE-2026-105858 | Payload is a free and open source headless content management system | HIGH | 8.1 | NVD | Oct 06, 2026 |
| CVE-2026-105857 | Payload is a free and open source headless content management system | CRITICAL | 10.0 | NVD | Oct 06, 2026 |
| CVE-2026-105846 | Payload is a free and open source headless content management system | MEDIUM | 6.1 | NVD | Oct 06, 2026 |
| CVE-2026-104850 | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol ser | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-104070 | The Crayons plugin for SPIP before 3 | CRITICAL | 9.8 | NVD | Oct 06, 2026 |
| CVE-2025-71384 | Dbit WIFI4 N300 1 | MEDIUM | 6.7 | NVD | Oct 06, 2026 |
| CVE-2025-71383 | Dbit WIFI4 N300 1 | CRITICAL | 9.8 | NVD | Oct 06, 2026 |
| CVE-2026-105839 | libmikmod before 3 | HIGH | 7.8 | NVD | Oct 06, 2026 |
| CVE-2026-105837 | libmikmod before 3 | HIGH | 7.8 | NVD | Oct 06, 2026 |
| CVE-2026-105790 | Microsoft UFO is an open-source framework for intelligent automation across devi | MEDIUM | 6.4 | NVD | Oct 06, 2026 |
| CVE-2026-105788 | Microsoft UFO is an open-source framework for intelligent automation across devi | HIGH | 8.8 | NVD | Oct 06, 2026 |
| CVE-2026-82531 | Smarty before 4 | HIGH | 8.1 | NVD | Oct 06, 2026 |
| CVE-2026-106016 | Mitigation bypass in the File Handling component | CRITICAL | 9.8 | NVD | Oct 06, 2026 |
| CVE-2026-105919 | A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb8 | HIGH | 7.3 | NVD | Oct 06, 2026 |
| CVE-2026-105835 | PLANKA 2 | HIGH | 7.4 | NVD | Oct 06, 2026 |
| CVE-2026-105834 | Rundeck before 6 | MEDIUM | 6.5 | NVD | Oct 06, 2026 |
| CVE-2026-105918 | A vulnerability has been found in Kusalkasilva Learning-Management-System up to | HIGH | 7.3 | NVD | Oct 06, 2026 |
| CVE-2026-105985 | Craft CMS 5 | HIGH | 8.8 | NVD | Oct 06, 2026 |
| CVE-2026-105778 | A vulnerability has been found in Tenda AC5 02 | CRITICAL | 9.9 | NVD | Oct 06, 2026 |
| CVE-2026-105776 | A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-We | HIGH | 7.3 | NVD | Oct 06, 2026 |
| CVE-2026-105701 | The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution i | HIGH | 8.8 | NVD | Oct 06, 2026 |
| CVE-2026-97300 | Unauthenticated Broken Access Control in WP Event Solution <= 4 | MEDIUM | 6.5 | NVD | Oct 06, 2026 |
| CVE-2026-75962 | The Post SMTP โ Complete Email Deliverability and SMTP Solution with Email Logs, | HIGH | 7.2 | NVD | Oct 06, 2026 |
| CVE-2026-41563 | Unauthenticated Sensitive Data Exposure in Sitemovr <= 1 | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-41558 | Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files โ WP Synchro < | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-39789 | Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1 | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-39760 | Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5 | HIGH | 7.1 | NVD | Oct 06, 2026 |
| CVE-2026-39723 | Unauthenticated Broken Access Control in Morning for WooCommerce <= 2 | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-32582 | Contributor Broken Access Control in IATO MCP <= 1 | MEDIUM | 6.5 | NVD | Oct 06, 2026 |
| CVE-2026-32576 | Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER | MEDIUM | 6.5 | NVD | Oct 06, 2026 |
| CVE-2026-105072 | Unauthenticated Broken Access Control in FluentBooking Pro < 2 | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-105704 | A vulnerability was identified in SourceCodester Drug Recommendation System 1 | HIGH | 7.3 | NVD | Oct 06, 2026 |
| CVE-2026-105783 | Joplin is an open source note-taking and to-do application that organises notes | HIGH | 8.0 | NVD | Oct 06, 2026 |
| CVE-2026-105782 | Scrapy is a high-level web crawling and scraping framework for Python | HIGH | 7.5 | NVD | Oct 06, 2026 |
| CVE-2026-105763 | Twenty is an open-source CRM (customer relationship management) platform | CRITICAL | 9.6 | NVD | Oct 06, 2026 |
| CVE-2026-105762 | Dify is an open-source LLM app development platform | HIGH | 8.3 | NVD | Oct 06, 2026 |
| CVE-2026-105471 | A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy | HIGH | 7.3 | NVD | Oct 06, 2026 |
| CVE-2026-105761 | Dify is an open-source LLM app development platform | HIGH | 7.1 | NVD | Oct 05, 2026 |
| CVE-2026-105757 | vLLM is an inference and serving engine for large language models | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-105756 | vLLM is an inference and serving engine for large language models | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-105754 | vLLM is an inference and serving engine for large language models | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-105753 | vLLM is an inference and serving engine for large language models | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-105470 | A vulnerability was identified in girishsaraf Online-Appointment-Booking-System | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105469 | A vulnerability was determined in girishsaraf Online-Appointment-Booking-System | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105383 | A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105382 | A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-104970 | Plane is an open-source project management tool | HIGH | 8.1 | NVD | Oct 05, 2026 |
| CVE-2026-104969 | Plane is an open-source project management tool | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-104964 | Plane is an open-source project management tool | MEDIUM | 6.8 | NVD | Oct 05, 2026 |
| CVE-2026-104962 | Plane is an open-source project management tool | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-104960 | Plane is an open-source project management tool | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-102282 | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node | HIGH | 7.1 | NVD | Oct 05, 2026 |
| CVE-2026-105307 | A vulnerability was detected in Casdoor up to 3 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105290 | A vulnerability was determined in feelec-yishu feelcrm-os 1 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105238 | A flaw has been found in ChatGPTNextWeb NextChat up to 2 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2019-25777 | YAML versions before 1 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2017-20285 | YAML versions before 1 | CRITICAL | 9.1 | NVD | Oct 05, 2026 |
| CVE-2026-105306 | A flaw was found in the Dynamic Client Registration flow of the Keycloak identit | MEDIUM | 6.5 | NVD | Oct 05, 2026 |
| CVE-2026-105233 | A vulnerability has been found in kishor-23 food-waste-management-system 411989e | MEDIUM | 6.3 | NVD | Oct 05, 2026 |
| CVE-2026-105232 | A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105231 | A vulnerability was detected in kishor-23 food-waste-management-system 411989e3e | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105230 | A security vulnerability has been detected in kishor-23 food-waste-management-sy | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105229 | A weakness has been identified in kishor-23 food-waste-management-system 411989e | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105295 | GitAhead 2 | HIGH | 7.5 | NVD | Oct 05, 2026 |
| CVE-2026-105294 | Legcord 1 | HIGH | 7.4 | NVD | Oct 05, 2026 |
| CVE-2026-105293 | Legcord 1 | HIGH | 8.1 | NVD | Oct 05, 2026 |
| CVE-2026-105223 | maclof kubernetes-client 0 | HIGH | 7.4 | NVD | Oct 05, 2026 |
| CVE-2026-105175 | A vulnerability was found in SourceCodester Drug Recommendation System 1 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105172 | A vulnerability was detected in itsourcecode Online Admission System 1 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105171 | A security vulnerability has been detected in kishor-23 food-waste-management-sy | MEDIUM | 6.3 | NVD | Oct 05, 2026 |
| CVE-2026-105170 | A weakness has been identified in kishor-23 food-waste-management-system 411989e | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105169 | A security flaw has been discovered in kishor-23 food-waste-management-system 41 | HIGH | 7.3 | NVD | Oct 05, 2026 |
| CVE-2026-105168 | A vulnerability was identified in kishor-23 food-waste-management-system 411989e | MEDIUM | 6.3 | NVD | Oct 05, 2026 |
| CVE-2026-105222 | The alexpechkarev/google-maps Laravel package through 12 | HIGH | 7.4 | NVD | Oct 04, 2026 |
| CVE-2026-105221 | The gist RubyGem before 6 | HIGH | 7.4 | NVD | Oct 04, 2026 |
| CVE-2026-105220 | Twine 2 desktop through 2 | HIGH | 7.8 | NVD | Oct 04, 2026 |
| CVE-2026-105167 | A vulnerability was determined in kishor-23 food-waste-management-system 411989e | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-105166 | A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb8 | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-105165 | A vulnerability has been found in devopspolis secrets-replicator up to 0 | MEDIUM | 6.3 | NVD | Oct 04, 2026 |
| CVE-2026-105219 | Mammoth | HIGH | 7.5 | NVD | Oct 04, 2026 |
| CVE-2026-105218 | gopay before 1 | HIGH | 7.4 | NVD | Oct 04, 2026 |
| CVE-2026-105216 | go-micro before 6 | HIGH | 7.4 | NVD | Oct 04, 2026 |
| CVE-2026-105215 | ZITADEL before 3 | CRITICAL | 9.1 | NVD | Oct 04, 2026 |
| CVE-2026-105213 | ZITADEL 4 | HIGH | 8.2 | NVD | Oct 04, 2026 |
| CVE-2026-105212 | ZITADEL 3 | HIGH | 7.5 | NVD | Oct 04, 2026 |
| CVE-2026-105211 | ZITADEL before 4 | HIGH | 8.1 | NVD | Oct 04, 2026 |
| CVE-2026-105210 | ZITADEL 3 | HIGH | 8.2 | NVD | Oct 04, 2026 |
| CVE-2026-105209 | ZITADEL 3 | CRITICAL | 9.6 | NVD | Oct 04, 2026 |
| CVE-2026-105208 | ZITADEL 4 | HIGH | 7.7 | NVD | Oct 04, 2026 |
| CVE-2026-105207 | ZITADEL 3 | CRITICAL | 9.8 | NVD | Oct 04, 2026 |
| CVE-2026-105158 | A vulnerability was detected in RainyGao DocSys up to 2 | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-105149 | A security flaw has been discovered in mooSocial up to 3 | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-105148 | A vulnerability was identified in SciPhi-AI R2R up to 3 | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-105147 | A vulnerability was determined in SciPhi-AI R2R up to 3 | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-97307 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixTheme | HIGH | 7.5 | NVD | Oct 04, 2026 |
| CVE-2026-97276 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 04, 2026 |
| CVE-2026-105141 | A security flaw has been discovered in topoteretes cognee up to 1 | MEDIUM | 6.3 | NVD | Oct 04, 2026 |
| CVE-2026-103355 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | CRITICAL | 9.3 | NVD | Oct 04, 2026 |
| CVE-2026-103354 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 04, 2026 |
| CVE-2026-103344 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 04, 2026 |
| CVE-2026-103062 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 04, 2026 |
| CVE-2026-93549 | The CoCart WordPress plugin before 4 | HIGH | 8.8 | NVD | Oct 04, 2026 |
| CVE-2026-17005 | The Horizontal scrolling announcements WordPress plugin through 2 | MEDIUM | 6.8 | NVD | Oct 04, 2026 |
| CVE-2026-105135 | A vulnerability has been found in InternLM MindSearch 0 | CRITICAL | 10.0 | NVD | Oct 04, 2026 |
| CVE-2026-105134 | A flaw has been found in Ahsay AhsayCBS up to 10 | CRITICAL | 10.0 | NVD | Oct 04, 2026 |
| CVE-2026-105133 | A vulnerability was detected in Ahsay AhsayCBS up to 10 | HIGH | 7.3 | NVD | Oct 04, 2026 |
| CVE-2026-105096 | A vulnerability was determined in Omega Solution CoinEx Crypto 2025 | MEDIUM | 6.3 | NVD | Oct 04, 2026 |
| CVE-2026-105129 | LaraDashboard before 1 | MEDIUM | 6.5 | NVD | Oct 04, 2026 |
| CVE-2026-105126 | LaraDashboard before 1 | HIGH | 7.2 | NVD | Oct 04, 2026 |
| CVE-2026-105124 | W (vincent-peugnet/wcms) through 3 | MEDIUM | 6.1 | NVD | Oct 04, 2026 |
| CVE-2026-105123 | W (vincent-peugnet/wcms) through 3 | HIGH | 8.8 | NVD | Oct 04, 2026 |
| CVE-2026-88779 | Citrix - NetScaler | CRITICAL | N/A | CISA | Oct 04, 2026 |
| CVE-2026-96451 | Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Membe | HIGH | 8.8 | NVD | Oct 03, 2026 |
| CVE-2026-103342 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Oct 03, 2026 |
| CVE-2026-103065 | Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirk | HIGH | 8.2 | NVD | Oct 03, 2026 |
| CVE-2026-105119 | OpenAM before 16 | MEDIUM | 6.8 | NVD | Oct 03, 2026 |
| CVE-2026-105117 | OpenAM before 16 | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-105116 | OpenAM before 16 | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-105115 | OpenAM before 16 | HIGH | 8.6 | NVD | Oct 03, 2026 |
| CVE-2026-105114 | OpenAM before 16 | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-105113 | Nezha Dashboard from 1 | MEDIUM | 6.5 | NVD | Oct 03, 2026 |
| CVE-2026-105105 | CWE-306: Missing Authentication for Critical Function in the ait | CRITICAL | 9.8 | NVD | Oct 03, 2026 |
| CVE-2026-104983 | A vulnerability has been found in Linux Mint Xreader up to 4 | MEDIUM | 6.3 | NVD | Oct 03, 2026 |
| CVE-2026-85015 | The Unlimited Elements for Elementor WordPress plugin before 2 | MEDIUM | 6.6 | NVD | Oct 03, 2026 |
| CVE-2026-103913 | The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the sto | HIGH | 7.5 | NVD | Oct 03, 2026 |
| CVE-2026-103909 | The Calculated Fields Form โ AI Form Builder for WordPress โ Contact, Payment, Q | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-103888 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to R | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-103514 | The WP 2FA WordPress plugin before 4 | HIGH | 7.5 | NVD | Oct 03, 2026 |
| CVE-2026-103293 | The MPG WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Oct 03, 2026 |
| CVE-2026-101928 | The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stor | HIGH | 7.2 | NVD | Oct 03, 2026 |
| CVE-2026-101923 | The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrar | HIGH | 8.1 | NVD | Oct 03, 2026 |
| CVE-2026-101162 | The WP Ultimate Review WordPress plugin before 2 | MEDIUM | 6.4 | NVD | Oct 03, 2026 |
| CVE-2026-101161 | The WP Ultimate Review WordPress plugin before 2 | HIGH | 7.5 | NVD | Oct 03, 2026 |
| CVE-2026-101160 | The WP Ultimate Review WordPress plugin before 2 | HIGH | 7.5 | NVD | Oct 03, 2026 |
| CVE-2026-101159 | The WP Ultimate Review WordPress plugin before 2 | HIGH | 7.5 | NVD | Oct 03, 2026 |
| CVE-2026-100152 | The The All in One SEO โ AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, | MEDIUM | 6.5 | NVD | Oct 03, 2026 |
| CVE-2026-100148 | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Store | MEDIUM | 6.4 | NVD | Oct 03, 2026 |
| CVE-2025-12828 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored | MEDIUM | 6.4 | NVD | Oct 03, 2026 |
| CVE-2026-92243 | The Ivory Search โ WordPress Search Plugin plugin for WordPress is vulnerable to | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-105080 | In ConvertX before 0 | CRITICAL | 9.9 | NVD | Oct 03, 2026 |
| CVE-2026-104478 | Formwork before 2 | HIGH | 7.1 | NVD | Oct 03, 2026 |
| CVE-2026-104477 | Showdown through 2 | MEDIUM | 6.1 | NVD | Oct 03, 2026 |
| CVE-2026-104474 | OpenLiteSpeed before 1 | MEDIUM | 6.7 | NVD | Oct 03, 2026 |
| CVE-2026-104433 | Mooncake transfer engine before 0 | HIGH | 7.5 | NVD | Oct 03, 2026 |
| CVE-2026-84411 | The web management service in affected RouterOS versions contains an integer und | CRITICAL | 9.8 | NVD | Oct 02, 2026 |
| CVE-2026-96940 | Weak authorization in Microsoft Exchange Server allows an authenticated attacker | HIGH | 8.8 | NVD | Oct 02, 2026 |
| CVE-2026-19856 | The All in One SEO WordPress plugin before 5 | MEDIUM | 6.5 | NVD | Oct 02, 2026 |
| CVE-2026-103958 | Server-side request forgery in the tool server and remote agent connection handl | HIGH | 7.6 | NVD | Oct 02, 2026 |
| CVE-2026-103957 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS bef | MEDIUM | 6.2 | NVD | Oct 02, 2026 |
| CVE-2026-103956 | Missing authentication for critical function in the authentication dependency in | CRITICAL | 10.0 | NVD | Oct 02, 2026 |
| CVE-2023-54405 | H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat | CRITICAL | 9.8 | NVD | Oct 02, 2026 |
| CVE-2020-37278 | Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability th | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2014-125130 | CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress t | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-104861 | probe-image-size gets image dimensions without downloading the entire file | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-102795 | Improper Access Control vulnerability in Apache Traffic Server | CRITICAL | 9.3 | NVD | Oct 02, 2026 |
| CVE-2026-104851 | fsspec is a specification and Python implementation framework for filesystem int | HIGH | 8.8 | NVD | Oct 02, 2026 |
| CVE-2026-104606 | A security flaw has been discovered in itsourcecode Online Admission System Proj | MEDIUM | 6.3 | NVD | Oct 02, 2026 |
| CVE-2026-97318 | The Giveaways and Contests by RafflePress WordPress plugin before 1 | MEDIUM | 6.1 | NVD | Oct 02, 2026 |
| CVE-2026-94298 | The BuildKit WordPress plugin before 1 | MEDIUM | 6.2 | NVD | Oct 02, 2026 |
| CVE-2026-92820 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary f | HIGH | 8.1 | NVD | Oct 02, 2026 |
| CVE-2026-92174 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File I | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-91828 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-91022 | The Motors WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Oct 02, 2026 |
| CVE-2026-90438 | The Ninja Forms โ The Contact Form Builder That Grows With You plugin for WordPr | HIGH | 7.2 | NVD | Oct 02, 2026 |
| CVE-2026-85016 | The Unlimited Elements for Elementor WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Oct 02, 2026 |
| CVE-2026-84925 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is v | MEDIUM | 6.1 | NVD | Oct 02, 2026 |
| CVE-2026-15897 | The Super Forms โ Drag & Drop Form Builder plugin for WordPress is vulnerable to | HIGH | 8.8 | NVD | Oct 02, 2026 |
| CVE-2026-15896 | The Super Forms โ Drag & Drop Form Builder plugin for WordPress is vulnerable to | CRITICAL | 9.1 | NVD | Oct 02, 2026 |
| CVE-2026-13718 | The Tabs Responsive WordPress plugin through 2 | MEDIUM | 6.8 | NVD | Oct 02, 2026 |
| CVE-2026-19660 | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass | CRITICAL | 9.8 | NVD | Oct 02, 2026 |
| CVE-2026-10026 | The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all ver | HIGH | 7.2 | NVD | Oct 02, 2026 |
| CVE-2026-93367 | The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable | HIGH | 7.2 | NVD | Oct 02, 2026 |
| CVE-2026-14378 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leadi | CRITICAL | 9.8 | NVD | Oct 02, 2026 |
| CVE-2026-104123 | A vulnerability was detected in SourceCodester Online Reviewer Management System | HIGH | 7.3 | NVD | Oct 02, 2026 |
| CVE-2026-104120 | A security vulnerability has been detected in modelcontextprotocol mcp-server-fe | HIGH | 7.3 | NVD | Oct 02, 2026 |
| CVE-2026-104054 | A security flaw has been discovered in calcom cal | MEDIUM | 6.3 | NVD | Oct 02, 2026 |
| CVE-2026-104053 | A vulnerability was identified in itsourcecode Pet Shop Management System 1 | MEDIUM | 6.3 | NVD | Oct 02, 2026 |
| CVE-2026-104052 | A vulnerability was determined in itsourcecode Pet Shop Management System 1 | MEDIUM | 6.3 | NVD | Oct 02, 2026 |
| CVE-2026-103098 | Transmission of a sensitive key in the URL over an unencrypted HTTP connection | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-103097 | An API key is hardcoded and retrievable from the application package | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-103096 | API key is hardcoded and retrievable from the application package | HIGH | 7.5 | NVD | Oct 02, 2026 |
| CVE-2026-86345 | A flaw was found in 389-ds-base | CRITICAL | 9.0 | NVD | Oct 02, 2026 |
| CVE-2026-103766 | ClipBucket v5 through 5 | HIGH | 7.2 | NVD | Oct 02, 2026 |
| CVE-2026-103765 | Mooncake through 0 | CRITICAL | 9.4 | NVD | Oct 02, 2026 |
| CVE-2026-103764 | Mooncake transfer engine before 0 | CRITICAL | 9.8 | NVD | Oct 02, 2026 |
| CVE-2026-102489 | Zammad GmbH - Zammad | CRITICAL | N/A | CISA | Oct 02, 2026 |
| CVE-2026-102490 | Zammad GmbH - Zammad | CRITICAL | N/A | CISA | Oct 02, 2026 |
| CVE-2026-103761 | Mooncake transfer engine through 0 | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2025-71427 | Office-PowerPoint-MCP-Server through 2 | MEDIUM | 6.8 | NVD | Oct 01, 2026 |
| CVE-2026-59685 | Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while process | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-57941 | Use After Free vulnerability in Apache HTTP Server's mod_http2ย via shared sessio | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-56449 | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with cr | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-56154 | Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using look | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-56153 | Http Server โ Out-of-bounds Write vulnerability in Apache HTTP Server's mo | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-48005 | Http Server โ Missing authentication checks in mod_auth_digest in Apache S | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-14316 | The revoked-key error path builds a human-readable failure reason using sprintf( | HIGH | 8.1 | NVD | Oct 01, 2026 |
| CVE-2026-12544 | A flaw was found in Foreman | HIGH | 7.7 | NVD | Oct 01, 2026 |
| CVE-2026-12541 | A flaw was found in Foreman | HIGH | 8.2 | NVD | Oct 01, 2026 |
| CVE-2026-12540 | A flaw was found in Foreman | HIGH | 8.2 | NVD | Oct 01, 2026 |
| CVE-2026-12423 | A flaw was found in Foreman | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-12405 | A flaw was found in rubygem-foreman_remote_execution | HIGH | 8.8 | NVD | Oct 01, 2026 |
| CVE-2026-103921 | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL sc | HIGH | 7.4 | NVD | Oct 01, 2026 |
| CVE-2026-101889 | The Prime Mover plugin for WordPress before 2 | MEDIUM | 6.5 | NVD | Oct 01, 2026 |
| CVE-2026-101888 | The Prime Mover plugin for WordPress before 2 | HIGH | 7.2 | NVD | Oct 01, 2026 |
| CVE-2026-103262 | Tornado versions before 6 | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-103259 | n8n versions before 2 | HIGH | 7.6 | NVD | Oct 01, 2026 |
| CVE-2026-103258 | n8n versions before 2 | MEDIUM | 6.8 | NVD | Oct 01, 2026 |
| CVE-2026-103257 | n8n versions before 1 | HIGH | 7.7 | NVD | Oct 01, 2026 |
| CVE-2026-103256 | n8n versions before 2 | HIGH | 7.1 | NVD | Oct 01, 2026 |
| CVE-2026-103255 | n8n versions before 1 | CRITICAL | 9.0 | NVD | Oct 01, 2026 |
| CVE-2026-103254 | n8n versions before 1 | MEDIUM | 6.3 | NVD | Oct 01, 2026 |
| CVE-2026-103253 | n8n versions before 1 | HIGH | 8.7 | NVD | Oct 01, 2026 |
| CVE-2026-103252 | n8n versions before 1 | HIGH | 7.7 | NVD | Oct 01, 2026 |
| CVE-2026-103251 | n8n versions before 1 | HIGH | 7.1 | NVD | Oct 01, 2026 |
| CVE-2026-103250 | n8n versions before 1 | HIGH | 8.1 | NVD | Oct 01, 2026 |
| CVE-2026-103249 | n8n versions before 1 | HIGH | 7.6 | NVD | Oct 01, 2026 |
| CVE-2026-103248 | n8n versions before 1 | CRITICAL | 9.0 | NVD | Oct 01, 2026 |
| CVE-2026-103247 | n8n versions before 1 | HIGH | 8.5 | NVD | Oct 01, 2026 |
| CVE-2026-103246 | n8n versions before 2 | HIGH | 7.7 | NVD | Oct 01, 2026 |
| CVE-2026-103244 | ground-station versions before 0 | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-103082 | Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element | HIGH | 7.2 | NVD | Oct 01, 2026 |
| CVE-2026-101147 | The Featured Image from URL (FIFU) WordPress plugin before 6 | HIGH | 8.8 | NVD | Oct 01, 2026 |
| CVE-2026-92966 | The The Appointment Booking Plugin โ LatePoint | Calendar & Scheduling for WordP | CRITICAL | 9.1 | NVD | Oct 01, 2026 |
| CVE-2026-82829 | Hitachi Coding Software Suite contains a vulnerability related to Hidden Functio | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-82828 | Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability | HIGH | 8.8 | NVD | Oct 01, 2026 |
| CVE-2026-82827 | Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-co | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-82826 | Hitachi Coding Software Suite contains a vulnerability related to the Cleartext | HIGH | 7.5 | NVD | Oct 01, 2026 |
| CVE-2026-82825 | Hitachi Coding Software Suite contains a vulnerability related to Missing Authen | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-82824 | Hitachi Coding Software Suite contains a vulnerability related to Path Traversal | CRITICAL | 9.8 | NVD | Oct 01, 2026 |
| CVE-2026-103538 | A security flaw has been discovered in ZongXR SuperMarket 1 | MEDIUM | 6.5 | NVD | Oct 01, 2026 |
| CVE-2026-103536 | A vulnerability was identified in ZongXR Supermarket 1 | HIGH | 7.3 | NVD | Oct 01, 2026 |
| CVE-2026-91109 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure | MEDIUM | 6.5 | NVD | Oct 01, 2026 |
| CVE-2026-103534 | A vulnerability was determined in David-Crty databasement up to 1 | MEDIUM | 6.3 | NVD | Oct 01, 2026 |
| CVE-2026-103530 | A vulnerability was detected in decolua 9Router up to 0 | HIGH | 7.3 | NVD | Oct 01, 2026 |
| EDB-52684 | [webapps] POMS oretnom23v1.0 - SQLi vulnerabilities | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52688 | [remote] Ecava_ntegraXor IGX_16.0.701.10 - RCE | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52689 | [webapps] Food-Ordering 1.0 - LFI | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52690 | [webapps] WordPress 7.0.2 - Path Travesal | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52691 | [webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52686 | [webapps] SuiteCRM 8.10.1 - Authenticated SSRF | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52685 | [webapps] InvoicePlane 1.7.1 - RCE | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52687 | [webapps] Krayin CRM 2.2.4 - IDOR | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| EDB-52692 | [remote] Teltonika_RutOS 00.07.06.21 - command injection | HIGH | N/A | EXPLOIT-DB | Oct 01, 2026 |
| CVE-2026-104286 | Fortinet - FortiMail | CRITICAL | N/A | CISA | Oct 01, 2026 |
| CVE-2026-103592 | simple-php-router through 5 | MEDIUM | 6.5 | NVD | Sep 30, 2026 |
| CVE-2026-103591 | DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file | HIGH | 7.5 | NVD | Sep 30, 2026 |
| CVE-2026-102375 | Subscriber Broken Access Control in Optimole <= 4 | MEDIUM | 6.5 | NVD | Sep 30, 2026 |
| CVE-2026-100512 | Contributor PHP Object Injection in Nested Pages <= 3 | CRITICAL | 9.8 | NVD | Sep 30, 2026 |
| CVE-2026-100510 | Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid | HIGH | 7.1 | NVD | Sep 30, 2026 |
| CVE-2026-62308 | Tugtainer is a self-hosted app for automating updates of Docker containers | CRITICAL | 9.1 | NVD | Sep 30, 2026 |
| CVE-2026-55494 | Tugtainer is a self-hosted app for automating updates of Docker containers | CRITICAL | 9.8 | NVD | Sep 30, 2026 |
| CVE-2026-55181 | Tugtainer is a self-hosted app for automating updates of Docker containers | CRITICAL | 9.4 | NVD | Sep 30, 2026 |
| CVE-2026-55176 | Soft Machine is a Virtual Machineโbased agentic development environment / Cloud | CRITICAL | 9.0 | NVD | Sep 30, 2026 |
| CVE-2026-46711 | Soft Machine is a Virtual Machineโbased agentic development environment / Cloud | HIGH | 8.3 | NVD | Sep 30, 2026 |
| CVE-2026-103233 | A security vulnerability has been detected in AdithyaYelloju Restaurant-Manageme | MEDIUM | 6.3 | NVD | Sep 30, 2026 |
| CVE-2026-103232 | A weakness has been identified in AdithyaYelloju Restaurant-Management-System up | HIGH | 7.3 | NVD | Sep 30, 2026 |
| CVE-2026-102385 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3 | HIGH | 7.1 | NVD | Sep 30, 2026 |
| CVE-2026-100513 | Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Manag | MEDIUM | 6.5 | NVD | Sep 30, 2026 |
| CVE-2026-100507 | Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Personalizat | HIGH | 7.1 | NVD | Sep 30, 2026 |
| CVE-2026-88920 | An authentication bypass in the DOM security processor in Apache WSS4J allows un | CRITICAL | 9.8 | NVD | Sep 30, 2026 |
| CVE-2026-87830 | In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupport | CRITICAL | 9.1 | NVD | Sep 30, 2026 |
| CVE-2026-85532 | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets withou | HIGH | 7.5 | NVD | Sep 30, 2026 |
| CVE-2026-62146 | A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influ | HIGH | 7.8 | NVD | Sep 30, 2026 |
| CVE-2026-103242 | A heap-based buffer overflow flaw was found in rpm | HIGH | 7.1 | NVD | Sep 30, 2026 |
| CVE-2026-103114 | A vulnerability was identified in OS4ED openSIS-Classic up to 9 | MEDIUM | 6.3 | NVD | Sep 30, 2026 |
| CVE-2026-76992 | The CODESYS Gateway Client allocates memory based on a size field in a gateway r | HIGH | 7.5 | NVD | Sep 30, 2026 |
| CVE-2026-89193 | The Robin Image Optimizer WordPress plugin before 2 | HIGH | 7.5 | NVD | Sep 30, 2026 |
| CVE-2026-88797 | The Vayu X WordPress theme before 1 | HIGH | 7.1 | NVD | Sep 30, 2026 |
| CVE-2026-87777 | The Hostinger Reach WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Sep 30, 2026 |
| CVE-2026-85573 | The All in One Files Upload WordPress plugin before 2 | HIGH | 8.8 | NVD | Sep 30, 2026 |
| CVE-2026-85415 | The Audio Player Block WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Sep 30, 2026 |
| CVE-2026-85001 | The EmbedPress WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 30, 2026 |
| CVE-2026-75873 | The Zella Theme WordPress theme before 2 | CRITICAL | 9.8 | NVD | Sep 30, 2026 |
| CVE-2026-75823 | The User Frontend WordPress plugin before 4 | HIGH | 7.4 | NVD | Sep 30, 2026 |
| CVE-2026-100143 | The FluentCart A New Era of eCommerce WordPress plugin before 1 | MEDIUM | 6.5 | NVD | Sep 30, 2026 |
| CVE-2026-103111 | PCRE2 before 10 | HIGH | 7.6 | NVD | Sep 30, 2026 |
| CVE-2026-102913 | A security flaw has been discovered in SourceCodester Car Driving School Managem | HIGH | 7.3 | NVD | Sep 30, 2026 |
| CVE-2026-103051 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 30, 2026 |
| CVE-2026-103050 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 30, 2026 |
| CVE-2026-103049 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 30, 2026 |
| CVE-2026-103048 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimed | MEDIUM | 6.1 | NVD | Sep 30, 2026 |
| CVE-2026-102794 | A vulnerability has been found in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 30, 2026 |
| CVE-2026-102793 | A flaw has been found in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 30, 2026 |
| CVE-2026-76504 | Cisco - Catalyst SD-WAN Manager | CRITICAL | N/A | CISA | Sep 30, 2026 |
| CVE-2026-103047 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 29, 2026 |
| CVE-2026-103046 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 29, 2026 |
| CVE-2026-103045 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 29, 2026 |
| CVE-2026-103044 | XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundat | CRITICAL | 9.8 | NVD | Sep 29, 2026 |
| CVE-2026-103043 | anchorme through 3 | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-103042 | LightLLM through 1 | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-103041 | LightLLM through 1 | CRITICAL | 9.8 | NVD | Sep 29, 2026 |
| CVE-2026-103040 | LightLLM through 1 | CRITICAL | 9.8 | NVD | Sep 29, 2026 |
| CVE-2026-102792 | A vulnerability was detected in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 29, 2026 |
| CVE-2026-91191 | The device's update mechanism includes conditions that allow unauthorized softwa | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-102673 | Electron is a framework for writing cross-platform desktop applications using Ja | HIGH | 8.2 | NVD | Sep 29, 2026 |
| CVE-2026-102634 | SGLang through 0 | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-102623 | A flaw was found in KubeVirt | MEDIUM | 6.5 | NVD | Sep 29, 2026 |
| CVE-2026-102557 | A flaw was found in libsoup | HIGH | 8.6 | NVD | Sep 29, 2026 |
| CVE-2026-102556 | A flaw was found in libsoup | HIGH | 8.6 | NVD | Sep 29, 2026 |
| CVE-2026-100245 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site | MEDIUM | 6.1 | NVD | Sep 29, 2026 |
| CVE-2026-100244 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-100243 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site | MEDIUM | 6.1 | NVD | Sep 29, 2026 |
| CVE-2026-100241 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wiki | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-100238 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site | MEDIUM | 6.1 | NVD | Sep 29, 2026 |
| CVE-2022-51019 | Akaunting before 2 | HIGH | 8.8 | NVD | Sep 29, 2026 |
| CVE-2026-100758 | Sandbox escape in the DOM: Navigation component | CRITICAL | 9.6 | NVD | Sep 29, 2026 |
| CVE-2026-100757 | Use-after-free in the Widget component | HIGH | 8.8 | NVD | Sep 29, 2026 |
| CVE-2026-100756 | Incorrect boundary conditions in the Audio/Video: Playback component | HIGH | 8.1 | NVD | Sep 29, 2026 |
| CVE-2026-95520 | A heap-based buffer overflow flaw was found in rpm | HIGH | 7.1 | NVD | Sep 29, 2026 |
| CVE-2026-87748 | Missing Authorization vulnerability in Interprobe Information Technologies Inc | HIGH | 8.8 | NVD | Sep 29, 2026 |
| CVE-2026-73597 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5 | MEDIUM | 6.5 | NVD | Sep 29, 2026 |
| CVE-2026-73594 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5 | MEDIUM | 6.4 | NVD | Sep 29, 2026 |
| CVE-2026-66083 | The /datasources/unauth-datasource endpoint does not properly enforce data sourc | MEDIUM | 6.5 | NVD | Sep 29, 2026 |
| CVE-2026-102497 | The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type der | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-102496 | Apache XmlSchema doesn't limit how deeply schema structures can be nested when i | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-102495 | Apache XmlSchema doesn't limit how deeply schema imports and includes can be nes | HIGH | 7.5 | NVD | Sep 29, 2026 |
| CVE-2026-84154 | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Rel | CRITICAL | 9.9 | NVD | Sep 29, 2026 |
| CVE-2026-86158 | Missing authentication in the local | HIGH | 7.7 | NVD | Sep 29, 2026 |
| CVE-2026-102293 | A vulnerability was identified in realjerrytang tacomall 1 | HIGH | 7.3 | NVD | Sep 29, 2026 |
| CVE-2026-18417 | The native BSD-socket layer recorded a pending asynchronous socket error by type | MEDIUM | 6.5 | NVD | Sep 29, 2026 |
| CVE-2026-102365 | mall4j through 4 | MEDIUM | 6.5 | NVD | Sep 29, 2026 |
| CVE-2026-102361 | mall4j through 4 | CRITICAL | 9.1 | NVD | Sep 29, 2026 |
| CVE-2026-101277 | A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2 | MEDIUM | 6.5 | NVD | Sep 29, 2026 |
| CVE-2026-101264 | A vulnerability was determined in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 29, 2026 |
| CVE-2026-101263 | A vulnerability was found in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 29, 2026 |
| CVE-2026-86950 | Apple - Multiple Products | CRITICAL | N/A | CISA | Sep 29, 2026 |
| CVE-2026-102335 | Nginx Proxy Manager through 2 | HIGH | 7.1 | NVD | Sep 28, 2026 |
| CVE-2026-102334 | Nginx Proxy Manager through 2 | HIGH | 7.4 | NVD | Sep 28, 2026 |
| CVE-2026-102333 | httpdbg before 2 | MEDIUM | 6.1 | NVD | Sep 28, 2026 |
| CVE-2026-102332 | Dozzle versions before 11 | MEDIUM | 6.1 | NVD | Sep 28, 2026 |
| CVE-2026-101262 | A vulnerability has been found in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 28, 2026 |
| CVE-2026-101261 | A flaw has been found in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 28, 2026 |
| CVE-2026-101260 | A vulnerability was detected in Ziroom ZHOME A0101 1 | CRITICAL | 9.1 | NVD | Sep 28, 2026 |
| CVE-2026-87114 | A flaw was found in kube-compare | HIGH | 7.1 | NVD | Sep 28, 2026 |
| CVE-2026-55096 | fast-mcp-telegram is a Telegram MCP Server | HIGH | 7.1 | NVD | Sep 28, 2026 |
| CVE-2026-54160 | Network UPS Tools is a collection of programs which provide a common interface f | HIGH | 8.2 | NVD | Sep 28, 2026 |
| CVE-2026-101894 | The decompress package for Node | CRITICAL | 9.1 | NVD | Sep 28, 2026 |
| CVE-2026-101081 | A security flaw has been discovered in D-Link DI-8400 16 | CRITICAL | 9.1 | NVD | Sep 28, 2026 |
| CVE-2026-87752 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 28, 2026 |
| CVE-2026-78424 | Improper parameter handling in NeuVector allows any authenticated user who holds | HIGH | 8.8 | NVD | Sep 28, 2026 |
| CVE-2026-19444 | A path traversal vulnerability was discovered in the Kubernetesย kubectlย client's | MEDIUM | 6.5 | NVD | Sep 28, 2026 |
| CVE-2026-12264 | Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitra | HIGH | 8.8 | NVD | Sep 28, 2026 |
| CVE-2026-101053 | A vulnerability was determined in Thinkware U3000 up to 1 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-101052 | A security vulnerability has been detected in refly-ai refly up to 1 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-91006 | Apache Karaf's instance-management service (InstanceServiceImpl) builds the comm | HIGH | 8.8 | NVD | Sep 28, 2026 |
| CVE-2026-12269 | Zohocorp ManageEngine DDI Central 6 | HIGH | 8.8 | NVD | Sep 28, 2026 |
| CVE-2026-12268 | ManageEngine DDI Central versions below 6201 are vulnerable toย PowerShell comman | HIGH | 8.8 | NVD | Sep 28, 2026 |
| CVE-2026-12267 | ManageEngine DDI Central versions below 6201 are vulnerable toย Command injection | HIGH | 7.2 | NVD | Sep 28, 2026 |
| CVE-2026-101040 | A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Afi | MEDIUM | 6.5 | NVD | Sep 28, 2026 |
| CVE-2026-101039 | A vulnerability was identified in FAST FAC1900R 20190827_2 | CRITICAL | 10.0 | NVD | Sep 28, 2026 |
| CVE-2026-101038 | A vulnerability was determined in FAST FAC1200R 5 | CRITICAL | 9.9 | NVD | Sep 28, 2026 |
| CVE-2026-84744 | The WPForms Lite WordPress plugin from 1 | MEDIUM | 6.5 | NVD | Sep 28, 2026 |
| CVE-2026-101009 | A vulnerability was determined in aaPanel BaoTa up to 11 | HIGH | 8.4 | NVD | Sep 28, 2026 |
| CVE-2026-101008 | A vulnerability was found in aaPanel BaoTa up to 11 | CRITICAL | 9.1 | NVD | Sep 28, 2026 |
| CVE-2026-101007 | A vulnerability has been found in aaPanel BaoTa up to 11 | HIGH | 8.4 | NVD | Sep 28, 2026 |
| CVE-2026-101005 | A vulnerability was detected in October CMS up to 4 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-101002 | A security flaw has been discovered in Netcore NBR200V2 1 | CRITICAL | 9.9 | NVD | Sep 28, 2026 |
| CVE-2026-101001 | A vulnerability was identified in Netcore NBR200V2 1 | CRITICAL | 10.0 | NVD | Sep 28, 2026 |
| CVE-2026-101000 | A vulnerability was determined in Netcore NBR100V2 1 | CRITICAL | 10.0 | NVD | Sep 28, 2026 |
| CVE-2026-100909 | A vulnerability was found in OctoberCMS up to 4 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-100908 | A vulnerability has been found in Eyeplus 57 | HIGH | 7.5 | NVD | Sep 28, 2026 |
| CVE-2026-100901 | A vulnerability was found in athlon1600 youtube-downloader up to 4 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-100899 | A flaw has been found in DevaslanPHP project-management 1 | MEDIUM | 6.3 | NVD | Sep 28, 2026 |
| CVE-2026-100898 | A vulnerability was detected in DevaslanPHP project-management 1 | MEDIUM | 6.3 | NVD | Sep 28, 2026 |
| CVE-2026-100896 | A weakness has been identified in TOTOLINK N150RT 3 | CRITICAL | 9.9 | NVD | Sep 28, 2026 |
| CVE-2026-100894 | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to | MEDIUM | 6.3 | NVD | Sep 28, 2026 |
| CVE-2026-100893 | A vulnerability was determined in Privoce VoceChat Server up to 0 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-100891 | A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-100889 | A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-100888 | A weakness has been identified in Trusted Domain Project OpenDKIM up to 2 | HIGH | 7.3 | NVD | Sep 28, 2026 |
| CVE-2026-100887 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Manage | MEDIUM | 6.3 | NVD | Sep 28, 2026 |
| CVE-2026-100886 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4 | CRITICAL | 10.0 | NVD | Sep 27, 2026 |
| CVE-2026-100885 | A vulnerability was found in Krayin laravel-crm up to 2 | HIGH | 7.3 | NVD | Sep 27, 2026 |
| CVE-2026-100883 | A flaw has been found in Krayin laravel-crm up to 2 | MEDIUM | 6.3 | NVD | Sep 27, 2026 |
| CVE-2026-101045 | Fleet-maintained app install and uninstall scripts for macOS are generated from | HIGH | 8.0 | NVD | Sep 27, 2026 |
| CVE-2026-101044 | pacquet, the Rust package-manager component shipped in the pnpm npm package vers | HIGH | 7.1 | NVD | Sep 27, 2026 |
| CVE-2026-101043 | pnpm versions 11 | HIGH | 7.4 | NVD | Sep 27, 2026 |
| CVE-2026-88778 | Netscaler Application Delivery Controller โ Predictable exact value from previous values vulnerability i | HIGH | 7.5 | NVD | Sep 27, 2026 |
| CVE-2026-88777 | Netscaler Application Delivery Controller โ Memory overflow vulnerability vulnerability in Citrix NetSca | CRITICAL | 9.8 | NVD | Sep 27, 2026 |
| CVE-2026-88776 | Netscaler Application Delivery Controller โ Memory overflow vulnerability vulnerability in Citrix NetSca | CRITICAL | 9.8 | NVD | Sep 27, 2026 |
| CVE-2026-88775 | Netscaler Application Delivery Controller โ Memory overflow vulnerability in Citrix NetScaler ADC and Ci | CRITICAL | 9.8 | NVD | Sep 27, 2026 |
| CVE-2026-88774 | Netscaler Application Delivery Controller โ Vulnerability in Citrix NetScaler ADC and Citrix NetScaler G | HIGH | 7.2 | NVD | Sep 27, 2026 |
| CVE-2026-88773 | Netscaler Application Delivery Controller โ Inconsistent interpretation of HTTP requests ('HTTP Request/ | CRITICAL | 10.0 | NVD | Sep 27, 2026 |
| CVE-2026-101050 | Heym before 0 | MEDIUM | 6.5 | NVD | Sep 27, 2026 |
| CVE-2026-101049 | Heym before 0 | MEDIUM | 6.5 | NVD | Sep 27, 2026 |
| CVE-2026-101042 | Parse Server is an open-source backend server | MEDIUM | 6.4 | NVD | Sep 27, 2026 |
| CVE-2026-101032 | navi through 2 | HIGH | 7.0 | NVD | Sep 27, 2026 |
| CVE-2026-100872 | Sylius versions before 2 | HIGH | 7.5 | NVD | Sep 27, 2026 |
| CVE-2026-100871 | Sylius versions before 1 | HIGH | 8.8 | NVD | Sep 27, 2026 |
| CVE-2026-100870 | Sylius versions before 1 | HIGH | 8.8 | NVD | Sep 27, 2026 |
| CVE-2026-100868 | Penpot before 2 | MEDIUM | 6.3 | NVD | Sep 27, 2026 |
| CVE-2026-100741 | Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's | CRITICAL | 9.8 | NVD | Sep 27, 2026 |
| CVE-2026-97319 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11 | MEDIUM | 6.8 | NVD | Sep 27, 2026 |
| CVE-2026-96899 | The Optima Express IDX WordPress plugin before 8 | MEDIUM | 6.8 | NVD | Sep 27, 2026 |
| CVE-2026-96896 | The Malcure Malware Shield โ Removal, Repair, Monitor WordPress plugin before 19 | HIGH | 7.2 | NVD | Sep 27, 2026 |
| CVE-2026-96895 | The WP YouTube Lyte WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Sep 27, 2026 |
| CVE-2026-89006 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Sep 27, 2026 |
| CVE-2026-86609 | The Download Manager WordPress plugin before 7 | HIGH | 8.8 | NVD | Sep 27, 2026 |
| CVE-2026-85002 | The EmbedPress WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 27, 2026 |
| CVE-2026-81655 | The Ad Inserter WordPress plugin before 2 | HIGH | 7.5 | NVD | Sep 27, 2026 |
| CVE-2026-100839 | Contrast is a confidential-computing runtime for Kubernetes | HIGH | 8.4 | NVD | Sep 27, 2026 |
| CVE-2026-100838 | Contrast is a confidential-computing runtime for Kubernetes | HIGH | 8.1 | NVD | Sep 27, 2026 |
| CVE-2026-100835 | Contrast before 1 | HIGH | 7.4 | NVD | Sep 27, 2026 |
| CVE-2026-100833 | Contrast (edgelesssys/contrast) versions 1 | HIGH | 8.2 | NVD | Sep 27, 2026 |
| CVE-2026-100745 | A vulnerability has been found in Edimax BR-6428nC 1 | MEDIUM | 6.3 | NVD | Sep 27, 2026 |
| CVE-2026-100744 | A flaw has been found in coollabsio Coolify up to 4 | HIGH | 7.3 | NVD | Sep 27, 2026 |
| CVE-2026-100725 | http4k (Maven artifact org | MEDIUM | 6.5 | NVD | Sep 27, 2026 |
| CVE-2026-100723 | vm2 before 3 | HIGH | 7.5 | NVD | Sep 27, 2026 |
| CVE-2026-100722 | vm2 before 3 | MEDIUM | 6.8 | NVD | Sep 27, 2026 |
| CVE-2026-100721 | vm2 before 3 | CRITICAL | 9.0 | NVD | Sep 27, 2026 |
| CVE-2025-71426 | Contrast is a confidential-computing runtime for Kubernetes | HIGH | 7.1 | NVD | Sep 27, 2026 |
| CVE-2025-71425 | Contrast (Edgeless Systems) before 1 | HIGH | 7.3 | NVD | Sep 27, 2026 |
| CVE-2025-71423 | Edgelesssys Contrast is a confidential-computing runtime for Kubernetes | HIGH | 7.3 | NVD | Sep 27, 2026 |
| CVE-2026-100740 | A vulnerability was detected in D-Link DIR-895L A1_102b07 | CRITICAL | 9.9 | NVD | Sep 27, 2026 |
| CVE-2026-88772 | Citrix - NetScaler | CRITICAL | N/A | CISA | Sep 27, 2026 |
| CVE-2026-88771 | Citrix - NetScaler | CRITICAL | N/A | CISA | Sep 27, 2026 |
| CVE-2026-100739 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d | HIGH | 7.3 | NVD | Sep 26, 2026 |
| CVE-2026-94400 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-94399 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-94398 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-94397 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-94396 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-82300 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-82294 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-78582 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of d | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-72668 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent B | HIGH | 7.3 | NVD | Sep 26, 2026 |
| CVE-2026-72662 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to | MEDIUM | 6.3 | NVD | Sep 26, 2026 |
| CVE-2026-82901 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitr | CRITICAL | 9.8 | NVD | Sep 26, 2026 |
| CVE-2026-85984 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres | CRITICAL | 9.8 | NVD | Sep 26, 2026 |
| CVE-2026-77203 | The Groups โ Memberships and Access Control plugin for WordPress is vulnerable t | HIGH | 8.8 | NVD | Sep 26, 2026 |
| CVE-2026-100615 | Cap-go capgo | HIGH | 8.8 | NVD | Sep 26, 2026 |
| CVE-2026-100614 | Capgo before 12 | HIGH | 8.8 | NVD | Sep 26, 2026 |
| CVE-2026-100612 | Capgo (capgo | HIGH | 7.2 | NVD | Sep 26, 2026 |
| CVE-2026-100611 | Capgo (capgo | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-100610 | Flowise through 3 | HIGH | 7.5 | NVD | Sep 26, 2026 |
| CVE-2026-100609 | Flowise (npm packages `flowise` and `flowise-components`) through 3 | MEDIUM | 6.8 | NVD | Sep 26, 2026 |
| CVE-2026-100608 | Flowise through 3 | HIGH | 8.3 | NVD | Sep 26, 2026 |
| CVE-2026-100607 | Flowise through 3 | HIGH | 7.7 | NVD | Sep 26, 2026 |
| CVE-2026-100606 | Flowise through 3 | HIGH | 7.7 | NVD | Sep 26, 2026 |
| CVE-2026-100605 | Flowise through 3 | HIGH | 7.1 | NVD | Sep 26, 2026 |
| CVE-2026-100602 | ClawHub (openclaw/clawhub application/backend) contains a missing authorization | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-100315 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5d | HIGH | 7.3 | NVD | Sep 26, 2026 |
| CVE-2026-100314 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Pr | HIGH | 7.3 | NVD | Sep 26, 2026 |
| CVE-2026-100312 | A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project u | MEDIUM | 6.3 | NVD | Sep 26, 2026 |
| CVE-2026-96532 | The Testimonials Widget WordPress plugin through 4 | HIGH | 7.5 | NVD | Sep 26, 2026 |
| CVE-2026-96531 | The Optimole WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 26, 2026 |
| CVE-2026-96524 | The MCP Server for WordPress WordPress plugin before 1 | HIGH | 8.8 | NVD | Sep 26, 2026 |
| CVE-2026-92411 | The WP Delicious WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Sep 26, 2026 |
| CVE-2026-89237 | The Bluff Post WordPress plugin through 1 | MEDIUM | 6.8 | NVD | Sep 26, 2026 |
| CVE-2026-85081 | The File Manager WordPress plugin before 8 | HIGH | 7.5 | NVD | Sep 26, 2026 |
| CVE-2026-84097 | The wp-review-slider-pro WordPress plugin before 12 | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-84096 | The wp-review-slider-pro WordPress plugin before 12 | HIGH | 8.0 | NVD | Sep 26, 2026 |
| CVE-2026-84095 | The wp-review-slider-pro WordPress plugin before 12 | HIGH | 8.0 | NVD | Sep 26, 2026 |
| CVE-2026-18143 | The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitr | CRITICAL | 9.8 | NVD | Sep 26, 2026 |
| CVE-2026-16591 | The WP Directory Kit WordPress plugin before 1 | HIGH | 7.2 | NVD | Sep 26, 2026 |
| CVE-2026-100532 | @openclaw/whatsapp (npm) before 2026 | HIGH | 8.1 | NVD | Sep 26, 2026 |
| CVE-2026-100531 | The @openclaw/slack npm package before 2026 | MEDIUM | 6.5 | NVD | Sep 26, 2026 |
| CVE-2026-100530 | OpenClaw versions before 2026 | HIGH | 7.3 | NVD | Sep 26, 2026 |
| CVE-2026-100529 | OpenClaw versions before 2026 | MEDIUM | 6.4 | NVD | Sep 26, 2026 |
| CVE-2026-100523 | Cotonti through 1 | MEDIUM | 6.1 | NVD | Sep 26, 2026 |
| CVE-2026-100522 | Cotonti through 1 | MEDIUM | 6.1 | NVD | Sep 26, 2026 |
| CVE-2026-100521 | Cotonti through 1 | MEDIUM | 6.1 | NVD | Sep 26, 2026 |
| CVE-2026-100520 | Laranode versions before 1 | HIGH | 8.8 | NVD | Sep 26, 2026 |
| CVE-2026-100504 | Ghidra versions through 12 | HIGH | 7.0 | NVD | Sep 26, 2026 |
| CVE-2026-96795 | Horilla is an HR and CRM software | HIGH | 8.8 | NVD | Sep 25, 2026 |
| CVE-2026-18320 | Readwise Reader for Android uses a sanitize-html configuration that permits all | MEDIUM | 6.1 | NVD | Sep 25, 2026 |
| CVE-2026-18312 | Readwise Reader for Android constructs URLs in its WebView using attacker-contro | MEDIUM | 6.1 | NVD | Sep 25, 2026 |
| CVE-2026-18311 | Readwise Reader for Android contains a cross-site scripting vulnerability due to | MEDIUM | 6.1 | NVD | Sep 25, 2026 |
| CVE-2026-100237 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 25, 2026 |
| CVE-2026-97536 | scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response | HIGH | 7.5 | NVD | Sep 25, 2026 |
| CVE-2026-97531 | scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xx_repor | HIGH | 7.5 | NVD | Sep 25, 2026 |
| CVE-2026-97528 | scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme | HIGH | 8.8 | NVD | Sep 25, 2026 |
| CVE-2026-97527 | scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport- | HIGH | 8.8 | NVD | Sep 25, 2026 |
| CVE-2026-97525 | x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated | HIGH | 8.2 | NVD | Sep 25, 2026 |
| CVE-2026-97524 | mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp r | HIGH | 7.5 | NVD | Sep 25, 2026 |
| CVE-2026-97523 | mptcp: close race between scheduler and state change The mptcp scheduler may ra | HIGH | 7.5 | NVD | Sep 25, 2026 |
| CVE-2026-93303 | The HT Contact Form โ Drag & Drop Form Builder for WordPress plugin for WordPres | HIGH | 7.2 | NVD | Sep 25, 2026 |
| CVE-2026-92746 | The Gutenverse โ WordPress Blocks, Page Builder & Site Editor plugin for WordPre | MEDIUM | 6.4 | NVD | Sep 25, 2026 |
| CVE-2026-92212 | The JetFormBuilder โ Dynamic Blocks Form Builder plugin for WordPress is vulnera | MEDIUM | 6.1 | NVD | Sep 25, 2026 |
| CVE-2026-89055 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to autho | CRITICAL | 9.1 | NVD | Sep 25, 2026 |
| CVE-2026-84281 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Si | HIGH | 7.2 | NVD | Sep 25, 2026 |
| CVE-2026-84279 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Si | HIGH | 7.2 | NVD | Sep 25, 2026 |
| CVE-2026-83591 | The AMP for WP โ Accelerated Mobile Pages plugin for WordPress is vulnerable to | HIGH | 7.2 | NVD | Sep 25, 2026 |
| CVE-2026-78393 | The Link Library WordPress plugin before 7 | MEDIUM | 6.1 | NVD | Sep 25, 2026 |
| CVE-2026-62062 | Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder all | HIGH | 8.8 | NVD | Sep 25, 2026 |
| CVE-2026-14281 | The Automation Web Platform โ Notifications and OTP for WooCommerce, Advanced Co | CRITICAL | 9.8 | NVD | Sep 25, 2026 |
| CVE-2026-97818 | phpIPAM through 1 | HIGH | 8.6 | NVD | Sep 25, 2026 |
| CVE-2026-97737 | In Wakapi before 2 | HIGH | 7.4 | NVD | Sep 25, 2026 |
| CVE-2025-14814 | The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross- | MEDIUM | 6.4 | NVD | Sep 25, 2026 |
| CVE-2026-97731 | MinIO through 7aac2a2 does not verify that every x-amz-* header present on a req | HIGH | 7.1 | NVD | Sep 25, 2026 |
| CVE-2026-97730 | In Netgate pfSense Plus before 26 | HIGH | 8.5 | NVD | Sep 25, 2026 |
| CVE-2026-95811 | Lemonldap::NG::Handler versions from 2 | MEDIUM | 6.5 | NVD | Sep 25, 2026 |
| CVE-2026-97646 | A weakness has been identified in ningzichun student-management-system up to 987 | HIGH | 7.3 | NVD | Sep 25, 2026 |
| CVE-2026-92288 | Lemonldap::NG::Portal versions from 2 | CRITICAL | 9.1 | NVD | Sep 25, 2026 |
| CVE-2026-67279 | MikroTik - RouterOS | CRITICAL | N/A | CISA | Sep 25, 2026 |
| CVE-2026-87902 | WordPress - Core | CRITICAL | N/A | CISA | Sep 25, 2026 |
| CVE-2026-65660 | Microsoft - SharePoint | CRITICAL | N/A | CISA | Sep 25, 2026 |
| CVE-2026-97230 | IO::Socket::SSL::SelfCertificate versions 1 | CRITICAL | 9.8 | NVD | Sep 24, 2026 |
| CVE-2026-88382 | hiredis commit 29ea279 (post-v1 | HIGH | 7.5 | NVD | Sep 24, 2026 |
| CVE-2026-88376 | Bento4 1 | HIGH | 7.5 | NVD | Sep 24, 2026 |
| CVE-2026-88373 | libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the | HIGH | 7.5 | NVD | Sep 24, 2026 |
| CVE-2026-88372 | libsndfile 1 | HIGH | 7.5 | NVD | Sep 24, 2026 |
| CVE-2026-88367 | NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg | MEDIUM | 6.5 | NVD | Sep 24, 2026 |
| CVE-2026-79766 | Termix is a web-based server management platform with SSH terminal, tunneling, a | CRITICAL | 9.1 | NVD | Sep 24, 2026 |
| CVE-2026-79764 | Termix is a web-based server management platform with SSH terminal, tunneling, a | HIGH | 7.7 | NVD | Sep 24, 2026 |
| CVE-2026-63498 | Snipe-IT is an IT asset/license management system | HIGH | 8.7 | NVD | Sep 24, 2026 |
| CVE-2026-62368 | Snipe-IT is an IT asset/license management system | HIGH | 8.1 | NVD | Sep 24, 2026 |
| CVE-2026-97182 | A security vulnerability has been detected in halo-dev Halo up to 2 | HIGH | 7.3 | NVD | Sep 24, 2026 |
| CVE-2026-94416 | An authorization bypass was found in the Ansible Automation Platform (AAP) gatew | MEDIUM | 6.8 | NVD | Sep 24, 2026 |
| CVE-2026-88916 | Incorrect Authorization vulnerability in TรBฤฐTAK ULAKBฤฐM UlakPDF allows Privileg | MEDIUM | 6.8 | NVD | Sep 24, 2026 |
| CVE-2026-88907 | Incorrect Authorization vulnerability in TรBฤฐTAK ULAKBฤฐM UlakPDF allows Authenti | HIGH | 7.4 | NVD | Sep 24, 2026 |
| CVE-2026-19072 | Velociraptor stores the compiled VQL in the hunt object internally to avoid havi | CRITICAL | 9.9 | NVD | Sep 24, 2026 |
| CVE-2026-4806 | The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to | MEDIUM | 6.5 | NVD | Sep 24, 2026 |
| CVE-2026-97177 | A flaw was found in the user update mechanism of the Keycloak Admin REST API | MEDIUM | 6.6 | NVD | Sep 24, 2026 |
| CVE-2026-89005 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Sep 24, 2026 |
| CVE-2026-89002 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Sep 24, 2026 |
| CVE-2026-88843 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3 | HIGH | 7.2 | NVD | Sep 24, 2026 |
| CVE-2026-82195 | The 10Web Booster WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Sep 24, 2026 |
| CVE-2026-80513 | The wpForo Forum WordPress plugin before 3 | HIGH | 7.5 | NVD | Sep 24, 2026 |
| CVE-2026-80338 | The CMB2 WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Sep 24, 2026 |
| CVE-2026-74991 | The WPForms WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Sep 24, 2026 |
| CVE-2026-96762 | A vulnerability was determined in kvcache-ai mooncake up to 0 | HIGH | 7.3 | NVD | Sep 24, 2026 |
| CVE-2026-96751 | A vulnerability has been found in pmTicket Project-Management-Software up to 078 | HIGH | 7.3 | NVD | Sep 24, 2026 |
| CVE-2026-93577 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19 | CRITICAL | 9.9 | NVD | Sep 24, 2026 |
| CVE-2026-92470 | GitLab has remediated an issue in GitLab EE affecting all versions from 18 | HIGH | 7.7 | NVD | Sep 24, 2026 |
| CVE-2026-89078 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19 | CRITICAL | 9.9 | NVD | Sep 24, 2026 |
| CVE-2026-71362 | Adobe - Commerce and Magento | CRITICAL | N/A | CISA | Sep 24, 2026 |
| CVE-2026-5430 | WSO2 - Multiple Products | CRITICAL | N/A | CISA | Sep 24, 2026 |
| EDB-52683 | [remote] MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE | HIGH | N/A | EXPLOIT-DB | Sep 24, 2026 |
| CVE-2026-96678 | A security vulnerability has been detected in weiqingwen spring-boot-forum up to | MEDIUM | 6.3 | NVD | Sep 23, 2026 |
| CVE-2026-96676 | A vulnerability was identified in Fast FAC1900R 20190827_2 | MEDIUM | 6.3 | NVD | Sep 23, 2026 |
| CVE-2026-70125 | Microsoft Office Outlook Remote Code Execution Vulnerability | HIGH | 8.8 | NVD | Sep 23, 2026 |
| CVE-2026-96654 | Plex Media Server before 1 | MEDIUM | 6.5 | NVD | Sep 23, 2026 |
| CVE-2026-96651 | Plex Media Server before 1 | MEDIUM | 6.5 | NVD | Sep 23, 2026 |
| CVE-2026-96514 | A weakness has been identified in Neethuharii CafeManagement | HIGH | 7.3 | NVD | Sep 23, 2026 |
| CVE-2026-96513 | A security flaw has been discovered in Neethuharii CafeManagement | HIGH | 7.3 | NVD | Sep 23, 2026 |
| CVE-2026-95846 | Moquette โ Moquette is a lightweight Java MQTT broker | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-95845 | Moquette โ Moquette is a lightweight Java MQTT broker | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-95843 | Moquette โ Moquette is a lightweight Java MQTT broker | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-95842 | Moquette โ Moquette is a lightweight Java MQTT broker | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-93349 | Frictionless through 5 | HIGH | 8.8 | NVD | Sep 23, 2026 |
| CVE-2026-88832 | BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled met | HIGH | 7.3 | NVD | Sep 23, 2026 |
| CVE-2026-88830 | A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-85724 | Moquette โ Moquette is a lightweight Java MQTT broker | CRITICAL | 9.6 | NVD | Sep 23, 2026 |
| CVE-2026-6668 | Integer overflow in the packet buffer growth logic in PgBouncer through 1 | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-19888 | Missing validation of a mandatory attribute in the SCRAM client-final-message pa | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2025-63564 | SQL injection vulnerability in Moodle Socialwall plugin v | CRITICAL | 9.8 | NVD | Sep 23, 2026 |
| CVE-2026-84098 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPr | MEDIUM | 6.5 | NVD | Sep 23, 2026 |
| CVE-2026-82843 | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6 | CRITICAL | 9.0 | NVD | Sep 23, 2026 |
| CVE-2026-80342 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Sep 23, 2026 |
| CVE-2026-75799 | The YAHMAN Add-ons WordPress plugin before 0 | CRITICAL | 9.0 | NVD | Sep 23, 2026 |
| CVE-2026-19438 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.5 | NVD | Sep 23, 2026 |
| CVE-2026-16264 | The Newsletters WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Sep 23, 2026 |
| CVE-2026-14321 | The divi-dash WordPress plugin before 1 | HIGH | 8.2 | NVD | Sep 23, 2026 |
| CVE-2025-15696 | The Real3D Flipbook WordPress plugin before 5 | MEDIUM | 6.8 | NVD | Sep 23, 2026 |
| CVE-2022-4997 | The jet-form-builder-stripe-gateway WordPress plugin before 1 | HIGH | 8.6 | NVD | Sep 23, 2026 |
| CVE-2026-95868 | A weakness has been identified in AdithyaYelloju Restaurant-Management-System up | MEDIUM | 6.3 | NVD | Sep 23, 2026 |
| CVE-2026-95833 | A weakness has been identified in itsourcecode Leave Management System 1 | MEDIUM | 6.3 | NVD | Sep 23, 2026 |
| CVE-2026-95830 | A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea81 | MEDIUM | 6.3 | NVD | Sep 23, 2026 |
| CVE-2026-95829 | A vulnerability was identified in TDuckCloud tduck-platform up to 5 | MEDIUM | 6.3 | NVD | Sep 23, 2026 |
| CVE-2026-94367 | OpenEye Apex Network Video Recorder (NVR) firmware 3 | HIGH | 7.2 | NVD | Sep 23, 2026 |
| CVE-2026-92930 | OpenEye Apex Network Video Recorder (NVR) firmware 3 | MEDIUM | 6.2 | NVD | Sep 23, 2026 |
| CVE-2026-92928 | OpenEye Apex Network Video Recorder (NVR) firmware 3 | MEDIUM | 6.5 | NVD | Sep 23, 2026 |
| CVE-2026-95820 | A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98 | MEDIUM | 6.3 | NVD | Sep 22, 2026 |
| CVE-2026-61685 | ReactPress is a publishing system for React developers | HIGH | 7.5 | NVD | Sep 22, 2026 |
| CVE-2026-57576 | plone | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2026-18176 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot | HIGH | 7.4 | NVD | Sep 22, 2026 |
| CVE-2026-18172 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot | HIGH | 7.4 | NVD | Sep 22, 2026 |
| CVE-2026-18170 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2026-18169 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot | CRITICAL | 9.9 | NVD | Sep 22, 2026 |
| CVE-2026-18163 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot | CRITICAL | 9.8 | NVD | Sep 22, 2026 |
| CVE-2026-18162 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot | CRITICAL | 9.8 | NVD | Sep 22, 2026 |
| CVE-2026-86059 | Dokploy is a free, self-hostable Platform as a Service (PaaS) | CRITICAL | 9.6 | NVD | Sep 22, 2026 |
| CVE-2026-85740 | LightRAG provides simple and fast retrieval-augmented generation | HIGH | 7.1 | NVD | Sep 22, 2026 |
| CVE-2026-85734 | LightRAG provides simple and fast retrieval-augmented generation | CRITICAL | 9.1 | NVD | Sep 22, 2026 |
| CVE-2026-84301 | FastGPT is an open-source LLM platform for building AI applications on a knowled | MEDIUM | 6.3 | NVD | Sep 22, 2026 |
| CVE-2026-83603 | Netdata is an open source observability tool | HIGH | 8.4 | NVD | Sep 22, 2026 |
| CVE-2026-83602 | Netdata is an open source observability tool | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2026-83601 | Netdata is an open source observability tool | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2026-83600 | Netdata is an open source observability tool | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2026-83599 | Netdata is an open source observability tool | HIGH | 7.5 | NVD | Sep 22, 2026 |
| CVE-2026-83598 | Netdata is an open source observability tool | HIGH | 7.8 | NVD | Sep 22, 2026 |
| CVE-2026-13087 | A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-ove | HIGH | 8.8 | NVD | Sep 22, 2026 |
| CVE-2026-95619 | A flaw was found in libstdc++ | HIGH | 7.7 | NVD | Sep 22, 2026 |
| CVE-2026-95271 | A vulnerability has been found in dgtlmoon changedetection | HIGH | 7.3 | NVD | Sep 22, 2026 |
| CVE-2026-75791 | Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab | HIGH | 8.6 | NVD | Sep 22, 2026 |
| CVE-2026-74849 | Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerab | CRITICAL | 9.8 | NVD | Sep 22, 2026 |
| CVE-2026-16778 | The Live Composer โ Free WordPress Website Builder plugin for WordPress is vulne | MEDIUM | 6.4 | NVD | Sep 22, 2026 |
| CVE-2025-1281 | The BM Content Builder plugin for WordPress is vulnerable to arbitrary file dele | HIGH | 8.8 | NVD | Sep 22, 2026 |
| CVE-2025-1280 | The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2016-15059 | Net::IDN::Punycode versions before 2 | CRITICAL | 9.8 | NVD | Sep 22, 2026 |
| CVE-2026-94504 | Ninja Forms 3 | HIGH | 7.2 | NVD | Sep 22, 2026 |
| CVE-2026-92438 | The Ninja Forms WordPress plugin 3 | HIGH | 8.8 | NVD | Sep 22, 2026 |
| CVE-2026-91827 | The Ninja Forms WordPress plugin 3 | HIGH | 7.5 | NVD | Sep 22, 2026 |
| CVE-2026-89412 | The TranslatePress โ Translate Multilingual sites with AI Translation plugin for | HIGH | 7.2 | NVD | Sep 22, 2026 |
| CVE-2026-93655 | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site | MEDIUM | 6.1 | NVD | Sep 22, 2026 |
| CVE-2026-88788 | The Text Styler WordPress plugin through 1 | MEDIUM | 6.8 | NVD | Sep 22, 2026 |
| CVE-2026-85653 | The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross- | MEDIUM | 6.4 | NVD | Sep 22, 2026 |
| CVE-2026-12470 | The CMP โ Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress i | HIGH | 7.2 | NVD | Sep 22, 2026 |
| CVE-2026-19658 | The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in | CRITICAL | 9.8 | NVD | Sep 22, 2026 |
| CVE-2026-13355 | The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to A | CRITICAL | 9.8 | NVD | Sep 22, 2026 |
| CVE-2026-94493 | A vulnerability was detected in Gigatech PDV5701 1 | CRITICAL | 10.0 | NVD | Sep 22, 2026 |
| CVE-2026-94492 | A security vulnerability has been detected in Yonyou U8cloud 5 | MEDIUM | 6.3 | NVD | Sep 22, 2026 |
| CVE-2026-94491 | A weakness has been identified in Yonyou KSOA 9 | HIGH | 7.3 | NVD | Sep 22, 2026 |
| CVE-2026-93712 | Dancer2 versions from 2 | HIGH | 7.5 | NVD | Sep 22, 2026 |
| CVE-2026-93711 | Dancer2 versions before 2 | MEDIUM | 6.5 | NVD | Sep 22, 2026 |
| CVE-2026-93710 | Dancer2 versions from 2 | HIGH | 7.5 | NVD | Sep 22, 2026 |
| CVE-2026-85102 | Check Point - Multiple Products | CRITICAL | N/A | CISA | Sep 22, 2026 |
| CVE-2026-93616 | Check Point - Multiple Products | CRITICAL | N/A | CISA | Sep 22, 2026 |
| CVE-2026-94127 | F5 - BIG-IP APM | CRITICAL | N/A | CISA | Sep 22, 2026 |
| CVE-2026-93952 | Arista - VeloCloud Orchestrator | CRITICAL | N/A | CISA | Sep 22, 2026 |
| CVE-2026-94425 | A vulnerability was found in Moore Threads MTT S80 Driver Package 340 | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-84990 | ntopng is a web-based network traffic monitoring application | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-83621 | ntopng is a web-based network traffic monitoring application | HIGH | 8.1 | NVD | Sep 21, 2026 |
| CVE-2026-79920 | Ajenti is a Linux & BSD modular server admin panel | CRITICAL | 9.9 | NVD | Sep 21, 2026 |
| CVE-2026-77560 | Tinyauth is an authentication and authorization server | HIGH | 8.1 | NVD | Sep 21, 2026 |
| CVE-2026-63334 | draw | MEDIUM | 6.8 | NVD | Sep 21, 2026 |
| CVE-2026-63116 | deepstream is a server that allows clients and backend services to sync data, se | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-62866 | Dasel is a command-line tool and library for querying, modifying, and transformi | MEDIUM | 6.2 | NVD | Sep 21, 2026 |
| CVE-2026-62371 | KubeEdge is an open source system for extending native containerized application | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-62370 | KubeEdge is an open source system for extending native containerized application | MEDIUM | 6.5 | NVD | Sep 21, 2026 |
| CVE-2026-59168 | Dasel is a command-line tool and library for querying, modifying, and transformi | MEDIUM | 6.2 | NVD | Sep 21, 2026 |
| CVE-2026-58504 | draw | MEDIUM | 6.1 | NVD | Sep 21, 2026 |
| CVE-2026-17051 | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi | MEDIUM | 6.0 | NVD | Sep 21, 2026 |
| CVE-2026-84285 | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1 | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-94368 | A flaw was found in the signature verification logic of noobaa-core, the core co | HIGH | 7.1 | NVD | Sep 21, 2026 |
| CVE-2026-91866 | A specially crafted pair of WS-Policy documents can force Neethi's policy-inters | HIGH | 7.5 | NVD | Sep 21, 2026 |
| CVE-2026-91865 | A small WS-Policy document using repeated policy references can force Neethi to | HIGH | 7.5 | NVD | Sep 21, 2026 |
| CVE-2026-91864 | A specially crafted WS-Policy document can pack unlimited content inside a polic | HIGH | 7.5 | NVD | Sep 21, 2026 |
| CVE-2026-91863 | A specially crafted WS-Policy document with deeply nested policy elements can by | HIGH | 7.5 | NVD | Sep 21, 2026 |
| CVE-2026-85113 | The GiveWP WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Sep 21, 2026 |
| CVE-2026-15801 | A vulnerability was found in CRI-O related to the container checkpoint and resto | HIGH | 8.0 | NVD | Sep 21, 2026 |
| CVE-2026-47321 | The CompressionFilter class uses ZLib to deflate and inflate data sent and recei | HIGH | 7.5 | NVD | Sep 21, 2026 |
| CVE-2026-94146 | A vulnerability was found in BioStar BIOS Update Utility 1 | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-94144 | A flaw has been found in drogonframework drogon up to 1 | HIGH | 7.3 | NVD | Sep 21, 2026 |
| CVE-2026-90860 | The Canva Mobile App for HarmonyOS before v1 | HIGH | 7.1 | NVD | Sep 21, 2026 |
| CVE-2026-82187 | The Web to Print Online Designer WordPress plugin before 2 | CRITICAL | 9.8 | NVD | Sep 21, 2026 |
| CVE-2026-94143 | A vulnerability was detected in drogonframework drogon up to 1 | HIGH | 7.3 | NVD | Sep 21, 2026 |
| CVE-2026-94142 | A security vulnerability has been detected in BioStar Temperature Monitor Utilit | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-94139 | A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router | HIGH | 7.4 | NVD | Sep 21, 2026 |
| CVE-2026-94138 | A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star R | MEDIUM | 6.6 | NVD | Sep 21, 2026 |
| CVE-2026-94129 | A vulnerability was detected in BioStar VALKYRIE AURORA 2 | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-94128 | A security vulnerability has been detected in BioStar VIVID LED DJ 4 | HIGH | 8.8 | NVD | Sep 21, 2026 |
| CVE-2026-94110 | A security vulnerability has been detected in QCMS up to 6 | HIGH | 7.3 | NVD | Sep 21, 2026 |
| CVE-2026-94101 | A security vulnerability has been detected in Netcore NBR200V2 1 | CRITICAL | 9.9 | NVD | Sep 21, 2026 |
| CVE-2026-94100 | A weakness has been identified in Netcore NBR200V2 1 | CRITICAL | 9.9 | NVD | Sep 21, 2026 |
| CVE-2026-94099 | A security flaw has been discovered in Netcore NBR200V2 1 | CRITICAL | 9.9 | NVD | Sep 21, 2026 |
| CVE-2026-94098 | A vulnerability was identified in Netcore NBR200V2 1 | CRITICAL | 9.1 | NVD | Sep 21, 2026 |
| CVE-2026-94097 | A vulnerability was determined in Netcore NBR200V2 1 | CRITICAL | 10.0 | NVD | Sep 21, 2026 |
| CVE-2026-94096 | A vulnerability was found in Netcore NBR200V2 1 | CRITICAL | 9.9 | NVD | Sep 21, 2026 |
| CVE-2026-94095 | A vulnerability has been found in Netcore NBR200V2 1 | CRITICAL | 9.9 | NVD | Sep 21, 2026 |
| CVE-2026-7273 | Zyxel - GS1900 Series Switches | CRITICAL | N/A | CISA | Sep 21, 2026 |
| CVE-2026-94093 | A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2 | MEDIUM | 6.3 | NVD | Sep 20, 2026 |
| CVE-2026-94089 | A vulnerability was determined in D-Link DIR-868L 2 | CRITICAL | 10.0 | NVD | Sep 20, 2026 |
| CVE-2026-94051 | A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979 | MEDIUM | 6.3 | NVD | Sep 20, 2026 |
| CVE-2026-94048 | A vulnerability was detected in CodeAstro QR Code Attendance Management System 1 | MEDIUM | 6.6 | NVD | Sep 20, 2026 |
| CVE-2026-94047 | A security vulnerability has been detected in samanhappy MCPHub up to 1 | MEDIUM | 6.3 | NVD | Sep 20, 2026 |
| CVE-2026-94044 | A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81a | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-94042 | A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7 | MEDIUM | 6.3 | NVD | Sep 20, 2026 |
| CVE-2026-94041 | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up | MEDIUM | 6.3 | NVD | Sep 20, 2026 |
| CVE-2026-94039 | A vulnerability was detected in vas3k TaxHacker up to 0 | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-94038 | A security vulnerability has been detected in NonceGeek dim-sum-app | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-90817 | An unauthenticated Remote Code Execution vulnerability was found in the survey p | CRITICAL | 9.8 | NVD | Sep 20, 2026 |
| CVE-2026-94113 | Frappe ERPNext versions before 15 | MEDIUM | 6.5 | NVD | Sep 20, 2026 |
| CVE-2026-94112 | mayswind ezBookkeeping before 2 | MEDIUM | 6.8 | NVD | Sep 20, 2026 |
| CVE-2026-94111 | Tencent BrowserSkill through 0 | MEDIUM | 6.6 | NVD | Sep 20, 2026 |
| CVE-2026-94109 | openEQUELLA versions before 2026 | HIGH | 8.8 | NVD | Sep 20, 2026 |
| CVE-2026-94108 | getID3 through 1 | MEDIUM | 6.5 | NVD | Sep 20, 2026 |
| CVE-2026-94107 | NivoCart through 2 | HIGH | 8.1 | NVD | Sep 20, 2026 |
| CVE-2026-94106 | getID3 before 1 | HIGH | 8.8 | NVD | Sep 20, 2026 |
| CVE-2026-94104 | NivoCart through 2 | HIGH | 8.8 | NVD | Sep 20, 2026 |
| CVE-2026-94004 | A vulnerability was found in DedeCMS up to 5 | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-94003 | A vulnerability has been found in Comfast CF-N1-S 2 | CRITICAL | 10.0 | NVD | Sep 20, 2026 |
| CVE-2026-93997 | A weakness has been identified in SourceCodester Drug Recommendation System 1 | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-93980 | A weakness has been identified in code-projects Internship Management System 1 | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-93979 | A security flaw has been discovered in code-projects Internship Management Syste | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-93978 | A vulnerability was identified in code-projects Internship Management System 1 | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-87839 | The Tripzzy WordPress plugin before 1 | HIGH | 7.5 | NVD | Sep 20, 2026 |
| CVE-2026-87068 | The Forminator Forms WordPress plugin before 1 | MEDIUM | 6.6 | NVD | Sep 20, 2026 |
| CVE-2026-87067 | The Forminator Forms WordPress plugin before 1 | HIGH | 8.5 | NVD | Sep 20, 2026 |
| CVE-2026-85017 | The Unlimited Elements For Elementor WordPress plugin before 2 | HIGH | 7.5 | NVD | Sep 20, 2026 |
| CVE-2026-84223 | The Kirki WordPress plugin before 6 | MEDIUM | 6.8 | NVD | Sep 20, 2026 |
| CVE-2026-82842 | The SAML Single Sign On WordPress plugin before 6 | HIGH | 8.1 | NVD | Sep 20, 2026 |
| CVE-2026-81650 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4 | HIGH | 7.2 | NVD | Sep 20, 2026 |
| CVE-2026-14844 | The Master Slider WordPress plugin through 3 | MEDIUM | 6.8 | NVD | Sep 20, 2026 |
| CVE-2026-93965 | A flaw has been found in aiyiyi121 SxDevOps 1 | MEDIUM | 6.6 | NVD | Sep 20, 2026 |
| CVE-2026-93963 | A security vulnerability has been detected in itsourcecode Leave Management Syst | MEDIUM | 6.3 | NVD | Sep 20, 2026 |
| CVE-2026-93962 | A weakness has been identified in Kamailio up to 5 | HIGH | 8.3 | NVD | Sep 20, 2026 |
| CVE-2026-93959 | A vulnerability was determined in SourceCodester Online Reviewer Management Syst | HIGH | 7.3 | NVD | Sep 20, 2026 |
| CVE-2026-94084 | Suricata before 8 | CRITICAL | 9.4 | NVD | Sep 20, 2026 |
| CVE-2026-94083 | Suricata before 8 | CRITICAL | 9.4 | NVD | Sep 20, 2026 |
| CVE-2026-93958 | A vulnerability was found in D-Link R95 BE9500_1 | CRITICAL | 9.1 | NVD | Sep 20, 2026 |
| CVE-2026-94056 | Exim before 4 | HIGH | 7.5 | NVD | Sep 19, 2026 |
| CVE-2026-94054 | Exim before 4 | HIGH | 7.0 | NVD | Sep 19, 2026 |
| CVE-2026-93993 | Mistral Vibe before 2 | HIGH | 8.8 | NVD | Sep 19, 2026 |
| CVE-2026-93992 | Gopeed through 2 | HIGH | 8.1 | NVD | Sep 19, 2026 |
| CVE-2026-93991 | Argo Workflows versions 4 | HIGH | 7.7 | NVD | Sep 19, 2026 |
| CVE-2026-93990 | Expat through 2 | HIGH | 7.5 | NVD | Sep 19, 2026 |
| CVE-2026-93988 | QloApps through 1 | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-94001 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-94000 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and | MEDIUM | 6.6 | NVD | Sep 19, 2026 |
| CVE-2026-93985 | OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerabi | CRITICAL | 9.9 | NVD | Sep 19, 2026 |
| CVE-2026-78030 | DBI versions before 1 | CRITICAL | 9.8 | NVD | Sep 19, 2026 |
| CVE-2026-92404 | The MgoSync WordPress plugin before 2 | HIGH | 7.5 | NVD | Sep 19, 2026 |
| CVE-2026-92099 | The WPGraphQL Smart Cache WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-88926 | The VikRentItems Flexible Rental Management System WordPress plugin before 1 | HIGH | 8.6 | NVD | Sep 19, 2026 |
| CVE-2026-88824 | The Master Blocks WordPress plugin before 1 | HIGH | 8.8 | NVD | Sep 19, 2026 |
| CVE-2026-86814 | The UsersWP WordPress plugin before 1 | HIGH | 8.1 | NVD | Sep 19, 2026 |
| CVE-2026-86591 | The Botiga Pro WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Sep 19, 2026 |
| CVE-2026-85680 | The Ultimate Member WordPress plugin before 2 | HIGH | 8.8 | NVD | Sep 19, 2026 |
| CVE-2026-85574 | The Unbounce Landing Pages WordPress plugin before 1 | HIGH | 8.0 | NVD | Sep 19, 2026 |
| CVE-2026-84750 | The Ultra Addons for Contact Form 7 WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-76790 | The Estatik Real Estate Plugin WordPress plugin before 4 | HIGH | 7.1 | NVD | Sep 19, 2026 |
| CVE-2026-76554 | The WP Import Export Lite WordPress plugin before 3 | HIGH | 7.2 | NVD | Sep 19, 2026 |
| CVE-2026-93741 | A security flaw has been discovered in Totolink A3002MU Hh-B20211125 | CRITICAL | 10.0 | NVD | Sep 19, 2026 |
| CVE-2026-92967 | The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | MEDIUM | 6.1 | NVD | Sep 19, 2026 |
| CVE-2026-92807 | The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitra | HIGH | 8.8 | NVD | Sep 19, 2026 |
| CVE-2026-92229 | The The Forminator Forms โ Contact Form, Payment Form & Custom Form Builder plug | CRITICAL | 9.1 | NVD | Sep 19, 2026 |
| CVE-2026-89334 | The Better Messages โ Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-89333 | The Tutor LMS โ eLearning and online course solution plugin for WordPress is vul | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-89274 | The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Ex | CRITICAL | 9.1 | NVD | Sep 19, 2026 |
| CVE-2026-89081 | The Tutor LMS โ eLearning and online course solution plugin for WordPress is vul | MEDIUM | 6.1 | NVD | Sep 19, 2026 |
| CVE-2026-87909 | The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execut | HIGH | 7.5 | NVD | Sep 19, 2026 |
| CVE-2026-84434 | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in | CRITICAL | 9.8 | NVD | Sep 19, 2026 |
| CVE-2026-15760 | The Divi Essential plugin for WordPress is vulnerable to sensitive information e | MEDIUM | 6.5 | NVD | Sep 19, 2026 |
| CVE-2026-13354 | The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stor | HIGH | 7.2 | NVD | Sep 19, 2026 |
| CVE-2026-77820 | The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting | MEDIUM | 6.4 | NVD | Sep 19, 2026 |
| CVE-2026-93923 | SiYuan through 3 | HIGH | 8.8 | NVD | Sep 19, 2026 |
| CVE-2026-93922 | SiYuan through 3 | HIGH | 8.8 | NVD | Sep 19, 2026 |
| CVE-2026-77606 | Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users | MEDIUM | 6.1 | NVD | Sep 18, 2026 |
| CVE-2026-77301 | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-77240 | WACRM is a self-hostable CRM template for WhatsApp | CRITICAL | 9.9 | NVD | Sep 18, 2026 |
| CVE-2026-77239 | WACRM is a self-hostable CRM template for WhatsApp | HIGH | 8.1 | NVD | Sep 18, 2026 |
| CVE-2026-61833 | zot is a container image and artifact registry based on the Open Container Initi | HIGH | 8.1 | NVD | Sep 18, 2026 |
| CVE-2026-61795 | Capsule is a multi-tenancy and policy-based framework for Kubernetes | MEDIUM | 6.8 | NVD | Sep 18, 2026 |
| CVE-2026-61794 | Capsule is a multi-tenancy and policy-based framework for Kubernetes | MEDIUM | 6.8 | NVD | Sep 18, 2026 |
| CVE-2026-61672 | Capsule is a multi-tenancy and policy-based framework for Kubernetes | HIGH | 7.1 | NVD | Sep 18, 2026 |
| CVE-2026-61548 | Rsyslog is a rocket-fast system for log processing | HIGH | 8.1 | NVD | Sep 18, 2026 |
| CVE-2026-58197 | ToolHive is a utility designed to simplify the deployment and management of Mode | HIGH | 8.8 | NVD | Sep 18, 2026 |
| CVE-2026-46655 | virtio-win provides Windows paravirtualized drivers for QEMU and KVM | HIGH | 7.8 | NVD | Sep 18, 2026 |
| CVE-2026-93019 | Imager versions before 1 | CRITICAL | 9.1 | NVD | Sep 18, 2026 |
| CVE-2026-88622 | NUUO Network Video Recorder 2 | HIGH | 8.8 | NVD | Sep 18, 2026 |
| CVE-2026-79294 | Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 | MEDIUM | 6.1 | NVD | Sep 18, 2026 |
| CVE-2026-62282 | OpenCVE is a vulnerability intelligence platform | MEDIUM | 6.5 | NVD | Sep 18, 2026 |
| CVE-2023-5778 | Improper handling of length parameter inconsistency vulnerability in ABB Freelan | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-93491 | A flaw was found in Netty's HttpServerCodec | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-93488 | A flaw was found in Netty | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-28198 | An authenticated, low-privileged user with access to the NetBackup Flex OS mana | HIGH | 8.8 | NVD | Sep 18, 2026 |
| CVE-2026-28197 | An authenticated, low-privileged user with access to the NetBackup Flex OS mana | HIGH | 8.8 | NVD | Sep 18, 2026 |
| CVE-2026-93575 | A flaw was found in Netty's MqttDecoder | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-93572 | A flaw was found in Netty's `RedisArrayAggregator` component | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-93563 | A flaw was found in Netty's `SmtpResponseDecoder` component | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-93561 | A flaw was found in io | MEDIUM | 6.5 | NVD | Sep 18, 2026 |
| CVE-2026-81627 | A flaw was found in QEMU | MEDIUM | 6.7 | NVD | Sep 18, 2026 |
| CVE-2026-87775 | The Tz Weekly Radio Schedule WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 18, 2026 |
| CVE-2026-87774 | The Tz Weekly Radio Schedule WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 18, 2026 |
| CVE-2026-87771 | The Product Question and Answer WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 18, 2026 |
| CVE-2026-87770 | The Price Drop Alert for Woo Commerce WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 18, 2026 |
| CVE-2026-87767 | The wp shortcut link and advertisement baner WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 18, 2026 |
| CVE-2026-85127 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1 | HIGH | 8.8 | NVD | Sep 18, 2026 |
| CVE-2026-85122 | The Easy Form Builder by WhiteStudio WordPress plugin before 4 | HIGH | 8.8 | NVD | Sep 18, 2026 |
| CVE-2026-85009 | The RestroPress WordPress plugin through 3 | MEDIUM | 6.5 | NVD | Sep 18, 2026 |
| CVE-2026-84902 | The King Addons for Elementor WordPress plugin before 51 | MEDIUM | 6.8 | NVD | Sep 18, 2026 |
| CVE-2026-84738 | The AF Companion WordPress plugin before 2 | CRITICAL | 9.1 | NVD | Sep 18, 2026 |
| CVE-2026-81810 | The All-in-One WP Migration and Backup WordPress plugin before 7 | HIGH | 7.2 | NVD | Sep 18, 2026 |
| CVE-2026-18912 | ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authent | HIGH | 7.7 | NVD | Sep 18, 2026 |
| CVE-2026-18911 | ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent a | HIGH | 7.5 | NVD | Sep 18, 2026 |
| CVE-2026-62874 | Insufficient verification of data authenticity in Azure Billing allows an unauth | CRITICAL | 10.0 | NVD | Sep 18, 2026 |
| CVE-2026-2585 | The Brizy โ Page Builder plugin for WordPress is vulnerable to Stored Cross-Site | MEDIUM | 6.4 | NVD | Sep 18, 2026 |
| CVE-2026-53266 | Linux - Kernel | CRITICAL | N/A | CISA | Sep 18, 2026 |
| CVE-2025-39964 | Linux - Kernel | CRITICAL | N/A | CISA | Sep 18, 2026 |
| CVE-2025-39682 | Linux - Kernel | CRITICAL | N/A | CISA | Sep 18, 2026 |
| CVE-2026-93436 | vLLM through 0 | HIGH | 7.5 | NVD | Sep 17, 2026 |
| CVE-2026-93435 | redis-parser through 3 | HIGH | 7.5 | NVD | Sep 17, 2026 |
| CVE-2026-87701 | Improper neutralization of special elements in output used by a downstream compo | CRITICAL | 9.6 | NVD | Sep 17, 2026 |
| CVE-2026-85917 | Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized at | HIGH | 7.5 | NVD | Sep 17, 2026 |
| CVE-2026-85889 | Missing authentication for critical function in Azure AI Foundry allows an unaut | CRITICAL | 10.0 | NVD | Sep 17, 2026 |
| CVE-2026-85885 | Improper neutralization of special elements used in a command ('command injectio | CRITICAL | 9.9 | NVD | Sep 17, 2026 |
| CVE-2026-83944 | Improper access control in Azure Logic Apps allows an unauthorized attacker to e | CRITICAL | 10.0 | NVD | Sep 17, 2026 |
| CVE-2026-78501 | Improper neutralization of special elements used in a command ('command injectio | HIGH | 7.4 | NVD | Sep 17, 2026 |
| CVE-2026-77903 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized | CRITICAL | 9.0 | NVD | Sep 17, 2026 |
| CVE-2026-70200 | Improper limitation of a pathname to a restricted directory ('path traversal') i | CRITICAL | 10.0 | NVD | Sep 17, 2026 |
| CVE-2026-70009 | Improper limitation of a pathname to a restricted directory ('path traversal') i | CRITICAL | 9.3 | NVD | Sep 17, 2026 |
| CVE-2026-69865 | Authorization bypass through user-controlled key in Microsoft Container Registry | CRITICAL | 10.0 | NVD | Sep 17, 2026 |
| CVE-2026-69399 | Azure Arc Elevation of Privilege Vulnerability | CRITICAL | 10.0 | NVD | Sep 17, 2026 |
| CVE-2026-68791 | Incorrect authorization in Azure Machine Learning allows an unauthorized attacke | HIGH | 8.6 | NVD | Sep 17, 2026 |
| CVE-2026-55946 | Improper neutralization of special elements used in a command ('command injectio | MEDIUM | 6.1 | NVD | Sep 17, 2026 |
| CVE-2026-90052 | dm-integrity: fix buffer overflow with keyed discard Since commit 68c5c42567bc | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-90051 | tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-28326 | SolarWinds Access Rights Manager was reported to be affected by an unauthenticat | HIGH | 8.8 | NVD | Sep 17, 2026 |
| CVE-2026-90823 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi | CRITICAL | 9.8 | NVD | Sep 17, 2026 |
| CVE-2026-90822 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware versi | CRITICAL | 9.8 | NVD | Sep 17, 2026 |
| CVE-2026-81480 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 7.2 | NVD | Sep 17, 2026 |
| CVE-2026-81478 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 8.1 | NVD | Sep 17, 2026 |
| CVE-2026-81477 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 7.2 | NVD | Sep 17, 2026 |
| CVE-2026-81476 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 8.1 | NVD | Sep 17, 2026 |
| CVE-2026-81475 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 8.1 | NVD | Sep 17, 2026 |
| CVE-2026-81440 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 7.3 | NVD | Sep 17, 2026 |
| CVE-2026-92903 | Improper input validation in Snowflake CLI versions prior to 3 | HIGH | 8.2 | NVD | Sep 17, 2026 |
| CVE-2026-81474 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-66269 | Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 7.3 | NVD | Sep 17, 2026 |
| CVE-2026-85128 | The Choose User Role at Registration WordPress plugin before 1 | HIGH | 7.5 | NVD | Sep 17, 2026 |
| CVE-2025-15697 | The Dictionary WordPress plugin through 1 | HIGH | 7.1 | NVD | Sep 17, 2026 |
| CVE-2026-87935 | The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload i | HIGH | 8.1 | NVD | Sep 17, 2026 |
| CVE-2026-87796 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbit | CRITICAL | 9.8 | NVD | Sep 17, 2026 |
| CVE-2026-25294 | Transient DOS while parsing frame during channel usage | HIGH | 7.4 | NVD | Sep 17, 2026 |
| CVE-2026-25290 | Memory Corruption when validating large data buffers from external sources using | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-25284 | Information Disclosure when a pointer is reused after being deallocated | HIGH | 7.3 | NVD | Sep 17, 2026 |
| CVE-2026-25283 | Memory Corruption when copying unverified data from an external source exceeds t | HIGH | 8.8 | NVD | Sep 17, 2026 |
| CVE-2026-25282 | Transient DOS when processing unverified data from a neighboring system causes o | HIGH | 7.9 | NVD | Sep 17, 2026 |
| CVE-2026-25281 | Transient DOS when processing large or numerous request buffers without sufficie | HIGH | 7.4 | NVD | Sep 17, 2026 |
| CVE-2026-25280 | Memory corruption when processing escape handling flow with insufficient user bu | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-25278 | Memory Corruption when processing I2C transfer requests due to a race condition | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-25275 | Transient DOS when processing authentication frames with invalid FILS informatio | HIGH | 7.5 | NVD | Sep 17, 2026 |
| CVE-2026-25261 | Memory corruption while processing rear sensor IOCTL calls | MEDIUM | 6.7 | NVD | Sep 17, 2026 |
| CVE-2026-24081 | Transient DOS when processing a channel map with insufficient used channels and | HIGH | 7.4 | NVD | Sep 17, 2026 |
| CVE-2026-24075 | Memory Corruption when multiple threads issue concurrent IOCTL requests to the d | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-24074 | Memory Corruption when processing data with large offset and length values excee | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-24073 | Memory corruption when processing decode statistics due to insufficient validati | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2025-59607 | Memory Corruption when copying large input data exceeds normal allocation limits | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-86311 | The Photo Gallery by 10Web โ Mobile-Friendly Image Gallery plugin for WordPress | MEDIUM | 6.4 | NVD | Sep 17, 2026 |
| CVE-2026-92838 | A DLL hijacking vulnerability exists in the GeoVisionย GV-Remote E-Mapย desktop ap | HIGH | 7.8 | NVD | Sep 17, 2026 |
| CVE-2026-81546 | The Affinity by Canva application before 3 | HIGH | 7.7 | NVD | Sep 17, 2026 |
| CVE-2026-65388 | A remote attacker who controls a container registry may be able to direct a clie | HIGH | 7.5 | NVD | Sep 16, 2026 |
| CVE-2026-61596 | djust provides Phoenix LiveView-style reactive server-side rendering for Django | HIGH | 7.1 | NVD | Sep 16, 2026 |
| CVE-2026-61589 | djust provides Phoenix LiveView-style reactive server-side rendering for Django | MEDIUM | 6.3 | NVD | Sep 16, 2026 |
| CVE-2026-61588 | djust provides Phoenix LiveView-style reactive server-side rendering for Django | MEDIUM | 6.5 | NVD | Sep 16, 2026 |
| CVE-2026-85731 | oras-go is a Go library for managing OCI artifacts | HIGH | 8.8 | NVD | Sep 16, 2026 |
| CVE-2026-84993 | MikroORM is a TypeScript ORM for Node | MEDIUM | 6.5 | NVD | Sep 16, 2026 |
| CVE-2026-76420 | A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) | CRITICAL | 9.0 | NVD | Sep 16, 2026 |
| CVE-2026-71180 | Dell Update Package Framework, versions prior to 26 | HIGH | 8.2 | NVD | Sep 16, 2026 |
| CVE-2026-71179 | Dell Update Package Framework, versions prior to 26 | HIGH | 7.3 | NVD | Sep 16, 2026 |
| CVE-2026-68904 | node-opcua is an OPC UA implementation for TypeScript and Node | HIGH | 7.0 | NVD | Sep 16, 2026 |
| CVE-2026-59974 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, | HIGH | 7.8 | NVD | Sep 16, 2026 |
| CVE-2026-59944 | Composer is a dependency Manager for the PHP language | MEDIUM | 6.1 | NVD | Sep 16, 2026 |
| CVE-2026-57173 | vLLM is an inference and serving engine for large language models | MEDIUM | 6.5 | NVD | Sep 16, 2026 |
| CVE-2026-42784 | A flaw was found in sequoia-openpgp | HIGH | 7.4 | NVD | Sep 16, 2026 |
| CVE-2026-20331 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.6 | NVD | Sep 16, 2026 |
| CVE-2026-20307 | A vulnerability in the web-based management interface of Cisco ISE could allow a | CRITICAL | 9.9 | NVD | Sep 16, 2026 |
| CVE-2026-20306 | A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenti | CRITICAL | 9.1 | NVD | Sep 16, 2026 |
| CVE-2026-20305 | A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an | CRITICAL | 9.1 | NVD | Sep 16, 2026 |
| CVE-2026-20234 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.9 | NVD | Sep 16, 2026 |
| CVE-2026-89808 | drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram When | HIGH | 7.8 | NVD | Sep 16, 2026 |
| CVE-2026-89806 | drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation The framebuffer s | HIGH | 8.4 | NVD | Sep 16, 2026 |
| CVE-2026-89805 | drm/pagemap: Fix folio allocation fallback and use-after-put drm_pagemap_migrat | HIGH | 7.8 | NVD | Sep 16, 2026 |
| CVE-2026-89804 | drm/nouveau/dmem: fix mismatched DMA unmap size for large folios Device-private | HIGH | 8.8 | NVD | Sep 16, 2026 |
| CVE-2026-89803 | drm/nouveau: unsubscribe the channel-kill event before the fence context nouvea | HIGH | 7.8 | NVD | Sep 16, 2026 |
| CVE-2026-89801 | drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE In nouvea | HIGH | 7.8 | NVD | Sep 16, 2026 |
| CVE-2026-89799 | bpf: Disable preemption in bpf_get_stackid The get_perf_callchain call needs di | HIGH | 7.8 | NVD | Sep 16, 2026 |
| CVE-2026-89795 | PCI: Allow per function PCI slots to fix slot reset on s390 On s390 systems, wh | HIGH | 8.4 | NVD | Sep 16, 2026 |
| CVE-2026-86106 | An unauthenticated actor with network access to the private HA interconnect may | CRITICAL | 9.6 | NVD | Sep 16, 2026 |
| CVE-2026-78472 | The Ni WooCommerce Sales Report WordPress plugin before 4 | HIGH | 8.6 | NVD | Sep 16, 2026 |
| CVE-2026-76558 | The WP Import Export Lite WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Sep 16, 2026 |
| CVE-2026-76557 | The WP Import Export Lite WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Sep 16, 2026 |
| CVE-2026-76556 | The WP Import Export Lite WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Sep 16, 2026 |
| CVE-2026-76555 | The WP Import Export Lite WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Sep 16, 2026 |
| CVE-2026-76553 | The WP Import Export Lite WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Sep 16, 2026 |
| CVE-2026-76552 | The WP Import Export Lite WordPress plugin before 3 | HIGH | 8.8 | NVD | Sep 16, 2026 |
| CVE-2026-76551 | The WP Import Export Lite WordPress plugin before 3 | HIGH | 7.2 | NVD | Sep 16, 2026 |
| CVE-2026-76550 | The WP Import Export Lite WordPress plugin before 3 | HIGH | 7.2 | NVD | Sep 16, 2026 |
| CVE-2026-74926 | The MultiVendorX WordPress plugin before 5 | HIGH | 7.1 | NVD | Sep 16, 2026 |
| CVE-2026-89063 | The Online Scheduling and Appointment Booking System โ Bookly plugin for WordPre | HIGH | 7.5 | NVD | Sep 16, 2026 |
| CVE-2026-5920 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc | MEDIUM | 6.4 | NVD | Sep 16, 2026 |
| CVE-2026-18555 | The Better Messages โ Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl | MEDIUM | 6.1 | NVD | Sep 16, 2026 |
| CVE-2026-86109 | The VeloCloud Edge software update workflow may accept update bundles without pr | MEDIUM | 6.6 | NVD | Sep 16, 2026 |
| CVE-2026-86108 | Insufficient validation of inputs supplied through affected VeloCloud Edge manag | HIGH | 8.0 | NVD | Sep 16, 2026 |
| CVE-2026-73450 | On affected platforms running Arista EOS with MLAG Dual Primary Detection config | MEDIUM | 6.9 | NVD | Sep 16, 2026 |
| CVE-2026-92299 | @jitsi/electron-sdk before 10 | HIGH | 7.4 | NVD | Sep 16, 2026 |
| CVE-2026-92217 | A vulnerability was determined in a2ui-project a2ui up to 0 | MEDIUM | 6.3 | NVD | Sep 16, 2026 |
| CVE-2026-92215 | A vulnerability has been found in a2ui-project a2ui up to 0 | HIGH | 7.3 | NVD | Sep 16, 2026 |
| CVE-2026-92184 | A security flaw has been discovered in ag-ui-protocol ag-ui 0 | MEDIUM | 6.3 | NVD | Sep 16, 2026 |
| CVE-2026-73460 | On affected platforms running Arista EOS with IS-IS graceful restart enabled, an | MEDIUM | 6.1 | NVD | Sep 16, 2026 |
| CVE-2026-73459 | On affected platforms running Arista EOS with IS-IS configured, an unauthenticat | HIGH | 7.4 | NVD | Sep 16, 2026 |
| CVE-2026-73446 | On affected platforms running Arista EOS with IS-IS configured on a broadcast in | HIGH | 7.4 | NVD | Sep 16, 2026 |
| CVE-2026-87886 | Acronis - Backup | CRITICAL | N/A | CISA | Sep 16, 2026 |
| CVE-2026-58704 | Google - Pixel | CRITICAL | N/A | CISA | Sep 16, 2026 |
| CVE-2026-76460 | Cisco - Identity Services Engine | CRITICAL | N/A | CISA | Sep 16, 2026 |
| CVE-2026-85893 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke | HIGH | 8.8 | NVD | Sep 15, 2026 |
| CVE-2026-69486 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor | HIGH | 8.8 | NVD | Sep 15, 2026 |
| CVE-2026-58200 | Payload Plugins is a collection of plugins designed to enhance Payload CMS | HIGH | 7.1 | NVD | Sep 15, 2026 |
| CVE-2026-55692 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function c | HIGH | 7.5 | NVD | Sep 15, 2026 |
| CVE-2026-55691 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function c | HIGH | 8.6 | NVD | Sep 15, 2026 |
| CVE-2026-55690 | The EmbedVideo Extension is a MediaWiki extension which adds a parser function c | HIGH | 7.5 | NVD | Sep 15, 2026 |
| CVE-2026-55149 | Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_req | HIGH | 7.5 | NVD | Sep 15, 2026 |
| CVE-2026-54561 | MCP Memory Keeper is an MCP server for persistent context management in AI codin | MEDIUM | 6.2 | NVD | Sep 15, 2026 |
| CVE-2026-53710 | MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and | CRITICAL | 10.0 | NVD | Sep 15, 2026 |
| CVE-2024-58385 | Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fil | CRITICAL | 9.8 | NVD | Sep 15, 2026 |
| CVE-2023-54398 | Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability i | CRITICAL | 9.8 | NVD | Sep 15, 2026 |
| CVE-2026-57139 | PraisonAI is a multi-agent teams system | CRITICAL | 9.8 | NVD | Sep 15, 2026 |
| CVE-2026-57138 | PraisonAI is a multi-agent teams system | CRITICAL | 9.9 | NVD | Sep 15, 2026 |
| CVE-2026-57137 | PraisonAI is a multi-agent teams system | HIGH | 8.8 | NVD | Sep 15, 2026 |
| CVE-2026-57136 | PraisonAI is a multi-agent teams system | HIGH | 8.8 | NVD | Sep 15, 2026 |
| CVE-2026-57135 | PraisonAI is a multi-agent teams system | HIGH | 7.6 | NVD | Sep 15, 2026 |
| CVE-2026-57134 | PraisonAI is a multi-agent teams system | HIGH | 8.2 | NVD | Sep 15, 2026 |
| CVE-2026-57133 | PraisonAI is a multi-agent teams system | HIGH | 8.8 | NVD | Sep 15, 2026 |
| CVE-2026-57112 | PraisonAI is a multi-agent teams system | HIGH | 8.3 | NVD | Sep 15, 2026 |
| CVE-2026-1759 | Improper handling of insufficient permissions or privileges vulnerability in Sec | MEDIUM | 6.5 | NVD | Sep 15, 2026 |
| CVE-2026-1758 | Session fixation vulnerability in Secomea GateManager (webserver module) allows | HIGH | 8.3 | NVD | Sep 15, 2026 |
| CVE-2026-89141 | The AI Engine โ The Chatbot, AI Framework & MCP for WordPress plugin for WordPre | MEDIUM | 6.5 | NVD | Sep 15, 2026 |
| CVE-2026-75983 | The Eventin โ Event Calendar, Tickets, Registration, Booking & WooCommerce plugi | HIGH | 7.5 | NVD | Sep 15, 2026 |
| CVE-2026-18063 | The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripti | MEDIUM | 6.4 | NVD | Sep 15, 2026 |
| CVE-2026-15402 | The Eventin โ Event Calendar, Event Registration, Tickets & Booking (AI Powered) | MEDIUM | 6.4 | NVD | Sep 15, 2026 |
| CVE-2026-91004 | A vulnerability has been found in SourceCodester Online Faculty Clearance System | HIGH | 7.3 | NVD | Sep 15, 2026 |
| CVE-2026-91003 | A flaw has been found in D-Link DI-8300 16 | CRITICAL | 9.1 | NVD | Sep 15, 2026 |
| CVE-2026-91001 | A security flaw has been discovered in D-Link DI-8400 16 | CRITICAL | 9.9 | NVD | Sep 15, 2026 |
| CVE-2026-81303 | A flaw was found in hawtio-operator | MEDIUM | 6.3 | NVD | Sep 15, 2026 |
| CVE-2026-16593 | The WP Directory Kit WordPress plugin through 1 | MEDIUM | 6.8 | NVD | Sep 15, 2026 |
| CVE-2026-90880 | A security flaw has been discovered in D-Link DSL-3782 2016-07-28 | HIGH | 7.4 | NVD | Sep 15, 2026 |
| CVE-2026-90879 | A vulnerability was identified in zyx0814 FilePress up to 3 | HIGH | 7.3 | NVD | Sep 15, 2026 |
| CVE-2026-85575 | The ShopEngine Elementor WooCommerce Builder Addon โ All in One WooCommerce Solu | MEDIUM | 6.4 | NVD | Sep 15, 2026 |
| CVE-2026-90841 | A security flaw has been discovered in PHPGurukul Blood Donor Management System | HIGH | 7.3 | NVD | Sep 15, 2026 |
| CVE-2026-90840 | A vulnerability was identified in PHPGurukul Blood Donor Management System 1 | HIGH | 7.3 | NVD | Sep 15, 2026 |
| CVE-2026-91200 | DevSpace through 6 | HIGH | 8.8 | NVD | Sep 14, 2026 |
| CVE-2026-91197 | Flowable flowable-engine through 8 | MEDIUM | 6.5 | NVD | Sep 14, 2026 |
| CVE-2026-81900 | Concrete Cms โ Concrete CMS before 9 | MEDIUM | 6.1 | NVD | Sep 14, 2026 |
| CVE-2026-14986 | The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mo | MEDIUM | 6.8 | NVD | Sep 14, 2026 |
| CVE-2026-76443 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Sep 14, 2026 |
| CVE-2026-76442 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 7.5 | NVD | Sep 14, 2026 |
| CVE-2026-76441 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Sep 14, 2026 |
| CVE-2026-76440 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Sep 14, 2026 |
| CVE-2026-61701 | Laravel MagicLink creates links for authentication without a password or for acc | HIGH | 8.8 | NVD | Sep 14, 2026 |
| CVE-2026-59960 | Argos JavaScript provides official Argos SDKs for JavaScript | HIGH | 7.5 | NVD | Sep 14, 2026 |
| CVE-2026-57579 | Alchemy is an open source content management system engine written in Ruby on Ra | HIGH | 7.5 | NVD | Sep 14, 2026 |
| CVE-2026-55837 | dbt-mcp is a Model Context Protocol server for interacting with dbt | MEDIUM | 6.8 | NVD | Sep 14, 2026 |
| CVE-2026-55416 | Pimcore is an Open Source Data & Experience Management Platform | HIGH | 8.8 | NVD | Sep 14, 2026 |
| CVE-2026-55073 | WeasyPrint helps web developers to create PDF documents | MEDIUM | 6.2 | NVD | Sep 14, 2026 |
| CVE-2026-55072 | Pimcore is an Open Source Data & Experience Management Platform | HIGH | 8.5 | NVD | Sep 14, 2026 |
| CVE-2026-54156 | node-opcua is an OPC UA implementation for TypeScript and Node | HIGH | 7.5 | NVD | Sep 14, 2026 |
| CVE-2026-54155 | node-opcua is an OPC UA implementation for TypeScript and Node | HIGH | 7.7 | NVD | Sep 14, 2026 |
| CVE-2026-20353 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Sep 14, 2026 |
| CVE-2026-87802 | Improper verification of cryptographic signature vulnerability in Apache Syncope | CRITICAL | 9.1 | NVD | Sep 14, 2026 |
| CVE-2026-87785 | Authentication bypass by spoofing vulnerability in Apache Syncope | CRITICAL | 9.1 | NVD | Sep 14, 2026 |
| CVE-2026-87779 | Insertion of sensitive information into log file vulnerability in Apache Syncope | HIGH | 7.5 | NVD | Sep 14, 2026 |
| CVE-2026-86460 | Cypher injection vulnerability in the Neo4j persistence layer when processing so | CRITICAL | 9.8 | NVD | Sep 14, 2026 |
| CVE-2026-82232 | Improper neutralization of special elements used in an SQL command ('SQL injecti | CRITICAL | 9.8 | NVD | Sep 14, 2026 |
| CVE-2026-5132 | Mattermost versions 11 | MEDIUM | 6.5 | NVD | Sep 14, 2026 |
| CVE-2026-15814 | Mattermost versions 11 | MEDIUM | 6.5 | NVD | Sep 14, 2026 |
| CVE-2023-34854 | HotelDruid before 3 | MEDIUM | 6.6 | NVD | Sep 14, 2026 |
| CVE-2023-32803 | The ca-certificates package before ca-certificates-2021 | HIGH | 7.5 | NVD | Sep 14, 2026 |
| CVE-2023-29377 | An issue was discovered in Softing OPC UA C++ SDK through 6 | MEDIUM | 6.6 | NVD | Sep 14, 2026 |
| CVE-2023-28148 | A bodyclass XSS issue was discovered in Paessler PRTG before 23 | HIGH | 7.2 | NVD | Sep 14, 2026 |
| CVE-2026-90608 | A flaw has been found in Totolink A3002MU Hh-B20211125 | CRITICAL | 9.9 | NVD | Sep 14, 2026 |
| CVE-2026-90607 | A vulnerability was detected in Totolink A3002MU Hh-B20211125 | CRITICAL | 9.9 | NVD | Sep 14, 2026 |
| CVE-2026-90606 | A security vulnerability has been detected in Totolink A3002MU Hh-B20211125 | CRITICAL | 9.9 | NVD | Sep 14, 2026 |
| CVE-2026-90605 | A weakness has been identified in Totolink A3002MU Hh-B20211125 | CRITICAL | 9.9 | NVD | Sep 14, 2026 |
| CVE-2022-42917 | In FRRouting FRR before 8 | MEDIUM | 6.7 | NVD | Sep 14, 2026 |
| CVE-2026-76461 | Cisco - Secure Email Gateway | CRITICAL | N/A | CISA | Sep 14, 2026 |
| CVE-2026-90603 | A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90601 | A vulnerability was found in getzep graphiti up to 0 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90600 | A vulnerability has been found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-15891 | The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mq | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-29811 | CyberPanel before 2 | HIGH | 7.7 | NVD | Sep 13, 2026 |
| CVE-2026-90579 | A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2025-70819 | Zettlab D6 Ultra before 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90574 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90776 | Nodemailer versions 9 | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-90775 | PostGIS address_standardizer through 3 | MEDIUM | 6.5 | NVD | Sep 13, 2026 |
| CVE-2026-90518 | A security flaw has been discovered in PHPGurukul Bank Locker Management System | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90516 | A vulnerability was found in SourceCodester School Registration and Fee System 1 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90515 | A vulnerability was determined in SourceCodester School Registration and Fee Sys | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90774 | rustypaste before 0 | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-90772 | Amundsen frontend through 4 | HIGH | 7.6 | NVD | Sep 13, 2026 |
| CVE-2026-90770 | Spug through 3 | HIGH | 8.8 | NVD | Sep 13, 2026 |
| CVE-2026-90769 | Open Notebook before 1 | HIGH | 7.7 | NVD | Sep 13, 2026 |
| CVE-2026-90768 | CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpo | HIGH | 8.1 | NVD | Sep 13, 2026 |
| CVE-2026-90767 | Froxlor before 2 | MEDIUM | 6.5 | NVD | Sep 13, 2026 |
| CVE-2026-90562 | LangBot before 4 | HIGH | 8.1 | NVD | Sep 13, 2026 |
| CVE-2026-90561 | Strapi versions 4 | HIGH | 8.7 | NVD | Sep 13, 2026 |
| CVE-2026-90514 | A vulnerability has been found in SourceCodester School Registration and Fee Sys | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90513 | A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa8137 | MEDIUM | 6.5 | NVD | Sep 13, 2026 |
| CVE-2026-90511 | A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90510 | A security vulnerability has been detected in dromara orion-visor up to 2 | HIGH | 8.3 | NVD | Sep 13, 2026 |
| CVE-2026-90504 | A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf236007395986 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90501 | A security vulnerability has been detected in lenve vhr 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90500 | A weakness has been identified in lenve vhr 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90498 | A vulnerability was identified in lenve vhr 1 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-89080 | The Really Simple Security WordPress plugin before 9 | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-86406 | The User Registration & Membership WordPress plugin before 5 | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-80071 | The User Registration & Membership WordPress plugin before 5 | HIGH | 7.2 | NVD | Sep 13, 2026 |
| CVE-2026-90678 | An issue was discovered in HAProxy 3 | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-90495 | A vulnerability has been found in Fengoffice Feng Office up to 3 | HIGH | 7.3 | NVD | Sep 13, 2026 |
| CVE-2026-90493 | A vulnerability was detected in Tonec Internet Download Manager up to 6 | HIGH | 8.8 | NVD | Sep 13, 2026 |
| CVE-2026-90668 | The webserver in UnrealIRCd 6 | HIGH | 7.5 | NVD | Sep 13, 2026 |
| CVE-2026-90492 | A security vulnerability has been detected in webgjc web_robot 2 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90491 | A weakness has been identified in sanjevirau gsubs up to 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90490 | A security flaw has been discovered in lenve vhr 1 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90651 | Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2 | HIGH | 8.1 | NVD | Sep 13, 2026 |
| CVE-2026-90488 | A vulnerability was determined in Xuxueli xxl-job up to 3 | MEDIUM | 6.3 | NVD | Sep 13, 2026 |
| CVE-2026-90647 | ASE/Kalkitech ASE2000 V2 Communication Test Set 2 | HIGH | 7.4 | NVD | Sep 12, 2026 |
| CVE-2026-90486 | A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11 | MEDIUM | 6.3 | NVD | Sep 12, 2026 |
| CVE-2026-90616 | In Flatpak before 1 | HIGH | 7.4 | NVD | Sep 12, 2026 |
| CVE-2026-90560 | zstd-jni versions 1 | HIGH | 8.2 | NVD | Sep 12, 2026 |
| CVE-2026-90559 | snappy-java through 1 | HIGH | 7.5 | NVD | Sep 12, 2026 |
| CVE-2026-90558 | sngrep through 1 | CRITICAL | 9.8 | NVD | Sep 12, 2026 |
| CVE-2026-90557 | Freeciv versions 3 | MEDIUM | 6.1 | NVD | Sep 12, 2026 |
| CVE-2026-90556 | Freeciv versions before 3 | HIGH | 7.8 | NVD | Sep 12, 2026 |
| CVE-2026-90537 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m | HIGH | 8.2 | NVD | Sep 12, 2026 |
| CVE-2026-15451 | The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privile | HIGH | 8.8 | NVD | Sep 12, 2026 |
| CVE-2026-10148 | The Booking for Appointments and Events Calendar plugin for WordPress is vulnera | MEDIUM | 6.4 | NVD | Sep 12, 2026 |
| CVE-2026-90474 | MCPHub before 1 | MEDIUM | 6.8 | NVD | Sep 12, 2026 |
| CVE-2026-84023 | The BEAR WordPress plugin before 1 | MEDIUM | 6.5 | NVD | Sep 12, 2026 |
| CVE-2026-83532 | The Custom Menu Wizard Widget WordPress plugin through 3 | MEDIUM | 6.8 | NVD | Sep 12, 2026 |
| CVE-2026-82847 | The Masteriyo LMS WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Sep 12, 2026 |
| CVE-2026-82845 | The Masteriyo LMS WordPress plugin before 3 | CRITICAL | 9.9 | NVD | Sep 12, 2026 |
| CVE-2026-81742 | The BE REST Endpoints WordPress plugin through 1 | HIGH | 8.8 | NVD | Sep 12, 2026 |
| CVE-2026-81429 | The Export & Import WPBakery Page Builder WordPress plugin through 1 | HIGH | 7.1 | NVD | Sep 12, 2026 |
| CVE-2026-81402 | The DS Ad Rotator WordPress plugin through 0 | CRITICAL | 9.8 | NVD | Sep 12, 2026 |
| CVE-2026-81090 | The Gpx2Graphics WordPress plugin through 0 | HIGH | 7.2 | NVD | Sep 12, 2026 |
| CVE-2026-80494 | The Yogeta WP Cloud WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 12, 2026 |
| CVE-2026-80491 | The SAMO Forms WordPress plugin through 1 | HIGH | 8.6 | NVD | Sep 12, 2026 |
| CVE-2026-77752 | The Temporary Login Without Password WordPress plugin before 1 | HIGH | 7.2 | NVD | Sep 12, 2026 |
| CVE-2026-77705 | The Booking for Appointments and Events Calendar WordPress plugin before 2 | HIGH | 7.2 | NVD | Sep 12, 2026 |
| CVE-2026-77006 | The WebTotem Backups WordPress plugin through 1 | CRITICAL | 9.6 | NVD | Sep 12, 2026 |
| CVE-2026-77005 | The CODE MONKEYS PROPOSALS WordPress plugin through 1 | CRITICAL | 9.6 | NVD | Sep 12, 2026 |
| CVE-2026-75800 | The Frontegg SAML SSO WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Sep 12, 2026 |
| CVE-2026-87719 | GitLab has remediated an issue in GitLab EE affecting all versions from 18 | CRITICAL | 9.9 | NVD | Sep 12, 2026 |
| CVE-2026-89266 | stb_vorbis through 1 | HIGH | 8.2 | NVD | Sep 12, 2026 |
| CVE-2026-89099 | A race condition in the document value layer of MongoDB Server can allow concurr | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-82535 | Chamilo LMS before 1 | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-7298 | Improper neutralization of input during web page generation ('cross-site scripti | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-78807 | An issue in wpa_supplicant all versions before v | HIGH | 7.1 | NVD | Sep 11, 2026 |
| CVE-2026-18495 | A flaw was found in libtiff | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-72710 | SPIP before 4 | CRITICAL | 9.8 | NVD | Sep 11, 2026 |
| CVE-2026-72709 | SPIP before 4 | CRITICAL | 9.8 | NVD | Sep 11, 2026 |
| CVE-2026-72708 | SPIP before 4 | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-89245 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a c | MEDIUM | 6.5 | NVD | Sep 11, 2026 |
| CVE-2026-89244 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-89243 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s | HIGH | 8.1 | NVD | Sep 11, 2026 |
| CVE-2026-89242 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a s | HIGH | 7.2 | NVD | Sep 11, 2026 |
| CVE-2026-89241 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-89240 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-89239 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a r | MEDIUM | 6.1 | NVD | Sep 11, 2026 |
| CVE-2026-87776 | compression is a Node | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-89147 | Net-SNMP through 5 | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-89146 | libp2p-rendezvous through 0 | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-85116 | The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1 | MEDIUM | 6.5 | NVD | Sep 11, 2026 |
| CVE-2026-85678 | The AI Builder WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Sep 11, 2026 |
| CVE-2026-85677 | The Gutenverse News WordPress plugin before 3 | HIGH | 8.8 | NVD | Sep 11, 2026 |
| CVE-2026-83546 | The CoolClock WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 11, 2026 |
| CVE-2026-83545 | The CoolClock WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 11, 2026 |
| CVE-2026-74925 | The MultiVendorX WordPress plugin before 5 | HIGH | 7.2 | NVD | Sep 11, 2026 |
| CVE-2026-73785 | A potential security vulnerability in HPE IceWall Federation Agent and Proxy cou | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-73784 | A potential security vulnerability in HPE IceWall products could be exploited to | HIGH | 8.8 | NVD | Sep 11, 2026 |
| CVE-2026-14563 | The advanced-customized-prompts WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Sep 11, 2026 |
| CVE-2026-14560 | The teddy-bear-customize-addon WordPress plugin through 1 | CRITICAL | 10.0 | NVD | Sep 11, 2026 |
| CVE-2026-14559 | The teddy-bear-customize-addon WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Sep 11, 2026 |
| CVE-2026-89060 | A cross-namespace authorization flaw in multicluster-observability-addon allows | HIGH | 7.7 | NVD | Sep 11, 2026 |
| CVE-2026-78134 | strongSwan 4 | HIGH | 7.1 | NVD | Sep 11, 2026 |
| CVE-2026-78133 | libcharon in strongSwan 6 | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-78132 | strongSwan 5 | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-78130 | strongSwan 4 | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-77807 | The AcyMailing โ An Ultimate Newsletter Plugin and Marketing Automation Solution | HIGH | 7.5 | NVD | Sep 11, 2026 |
| CVE-2026-42016 | JFrog - Artifactory | CRITICAL | N/A | CISA | Sep 11, 2026 |
| EDB-52682 | [remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE | CRITICAL | 9.8 | EXPLOIT-DB | Sep 11, 2026 |
| CVE-2026-42018 | JFrog - Artifactory | CRITICAL | N/A | CISA | Sep 11, 2026 |
| CVE-2026-85706 | GitLab - Community Edition and Enterprise Edition | CRITICAL | N/A | CISA | Sep 11, 2026 |
| CVE-2026-84869 | ConnectWise - ScreenConnect | CRITICAL | N/A | CISA | Sep 11, 2026 |
| CVE-2026-88045 | rclone is a command-line program to sync files and directories to and from diffe | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-88044 | rclone is a command-line program to sync files and directories to and from diffe | CRITICAL | 9.1 | NVD | Sep 10, 2026 |
| CVE-2026-85228 | An integer overflow in the tensor buffer validation component in Amazon Deep Jav | CRITICAL | 9.1 | NVD | Sep 10, 2026 |
| CVE-2026-73699 | FileRun before 2026 | HIGH | 7.2 | NVD | Sep 10, 2026 |
| CVE-2026-73698 | FileRun before 2026 | HIGH | 7.2 | NVD | Sep 10, 2026 |
| CVE-2026-73694 | FileRun before 2026 | HIGH | 7.2 | NVD | Sep 10, 2026 |
| CVE-2026-73693 | FileRun before 2026 | HIGH | 8.8 | NVD | Sep 10, 2026 |
| CVE-2026-52098 | An issue in Flowise 3 | CRITICAL | 9.8 | NVD | Sep 10, 2026 |
| CVE-2026-52097 | An issue in AppFlowy 0 | MEDIUM | 6.8 | NVD | Sep 10, 2026 |
| CVE-2026-64838 | ICEcoder versions through 8 | HIGH | 8.3 | NVD | Sep 10, 2026 |
| CVE-2026-64837 | ICEcoder through 8 | HIGH | 8.8 | NVD | Sep 10, 2026 |
| CVE-2026-64836 | ICEcoder versions through 8 | HIGH | 8.8 | NVD | Sep 10, 2026 |
| CVE-2026-9166 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-9163 | Improper neutralization of special elements used in an SQL command ('SQL injecti | CRITICAL | 9.8 | NVD | Sep 10, 2026 |
| CVE-2026-85545 | There is an Vulnerability in some HikCentral Access Control versions | HIGH | 7.1 | NVD | Sep 10, 2026 |
| CVE-2026-88859 | A flaw was found in Evolution | MEDIUM | 6.3 | NVD | Sep 10, 2026 |
| CVE-2026-84828 | A flaw was found in PCS (Pacemaker Configuration System) | MEDIUM | 6.5 | NVD | Sep 10, 2026 |
| CVE-2026-87962 | t-digest versions 3 | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-87961 | ESP32-audioI2S versions 3 | HIGH | 7.1 | NVD | Sep 10, 2026 |
| CVE-2026-19436 | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3 | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-85645 | The Form Maker by 10Web โ Mobile-Friendly Drag & Drop Contact Form Builder plugi | MEDIUM | 6.1 | NVD | Sep 10, 2026 |
| CVE-2026-84939 | Freemarker โ Path traversal vulnerability in Apache FreeMarker template l | CRITICAL | 9.1 | NVD | Sep 10, 2026 |
| CVE-2026-82079 | A stack-based buffer overflow vulnerability in the Nintendo Switch local wireles | HIGH | 8.4 | NVD | Sep 10, 2026 |
| CVE-2026-75880 | An authenticated client could attach a consumer with a selector containing craft | MEDIUM | 6.5 | NVD | Sep 10, 2026 |
| CVE-2026-67593 | A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause | CRITICAL | 9.1 | NVD | Sep 10, 2026 |
| CVE-2026-57967 | An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH pa | CRITICAL | 9.8 | NVD | Sep 10, 2026 |
| CVE-2026-57822 | When the broker is processing message-based management requests, sent by an auth | MEDIUM | 6.5 | NVD | Sep 10, 2026 |
| CVE-2026-49364 | An unauthenticated network-adjacent attacker can leverage discovery to capture c | CRITICAL | 9.1 | NVD | Sep 10, 2026 |
| CVE-2026-49363 | An unauthenticated remote attacker connecting with the CORE protocol can discove | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-49362 | An unauthenticated remote attacker can create arbitrary durable queues via the C | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-15820 | The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross- | MEDIUM | 6.4 | NVD | Sep 10, 2026 |
| CVE-2026-15796 | The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross- | MEDIUM | 6.4 | NVD | Sep 10, 2026 |
| CVE-2026-15019 | The Direct Download for WooCommerce plugin for WordPress is vulnerable to Direct | HIGH | 7.5 | NVD | Sep 10, 2026 |
| CVE-2026-14873 | The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalati | HIGH | 8.0 | NVD | Sep 10, 2026 |
| CVE-2026-87870 | The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored | MEDIUM | 6.4 | NVD | Sep 10, 2026 |
| CVE-2026-19584 | Velociraptor allows for the creation of notebook backups in its default enabled | HIGH | 7.7 | NVD | Sep 10, 2026 |
| CVE-2026-19583 | Velociraptor allows some sensitive artifacts to be gated by additional permissio | CRITICAL | 9.9 | NVD | Sep 10, 2026 |
| CVE-2026-18351 | The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulner | CRITICAL | 9.8 | NVD | Sep 10, 2026 |
| CVE-2026-87933 | A vulnerability was found in DaveGamble cJSON up to 1 | HIGH | 7.3 | NVD | Sep 10, 2026 |
| CVE-2026-87931 | A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral | CRITICAL | 9.6 | NVD | Sep 10, 2026 |
| CVE-2026-87925 | A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78 | HIGH | 7.3 | NVD | Sep 10, 2026 |
| CVE-2026-67277 | MikroTik - RouterOS | CRITICAL | N/A | CISA | Sep 10, 2026 |
| CVE-2026-86060 | MikroTik - RouterOS | CRITICAL | N/A | CISA | Sep 10, 2026 |
| CVE-2026-87924 | A security vulnerability has been detected in Rizwan17 inventory-management-syst | MEDIUM | 6.5 | NVD | Sep 09, 2026 |
| CVE-2026-80914 | Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready iso_con | HIGH | 8.8 | NVD | Sep 09, 2026 |
| CVE-2026-70425 | Dell PowerScale OneFS, Versions 9 | MEDIUM | 6.7 | NVD | Sep 09, 2026 |
| CVE-2026-23855 | Dell iDRAC9, 14G versions prior to 7 | HIGH | 7.2 | NVD | Sep 09, 2026 |
| CVE-2026-18147 | A flaw was found in FreeIPA | HIGH | 8.1 | NVD | Sep 09, 2026 |
| CVE-2026-85978 | An unauthenticated remote code execution vulnerability exists in the Policy Mana | CRITICAL | 9.8 | NVD | Sep 09, 2026 |
| CVE-2026-79641 | Secure Connect Gateway โ Dell SCG 5 | HIGH | 7.5 | NVD | Sep 09, 2026 |
| CVE-2026-79635 | Secure Connect Gateway โ Dell SCG 5 | HIGH | 7.3 | NVD | Sep 09, 2026 |
| CVE-2026-73334 | Parquet โ Potential problem for users of theย org | HIGH | 8.1 | NVD | Sep 09, 2026 |
| CVE-2026-65181 | Impala โ Insufficient authorization of Data Source tables in Impala 2 | HIGH | 8.1 | NVD | Sep 09, 2026 |
| CVE-2026-57866 | Impala โ Server side request forgery in Apache Impala versions 4 | HIGH | 8.8 | NVD | Sep 09, 2026 |
| CVE-2026-56207 | Impala โ Signature of Bearer token is not verified in last step of SA | CRITICAL | 9.8 | NVD | Sep 09, 2026 |
| CVE-2026-41871 | Nutch โ Missing Authorization, Use of Externally-Controlled Input to | CRITICAL | 9.8 | NVD | Sep 09, 2026 |
| CVE-2026-41870 | Missing Authorization, Improper Control of Generation of Code ('Code Injection') | HIGH | 8.8 | NVD | Sep 09, 2026 |
| CVE-2026-41869 | Nutch โ Missing Authorization, Improper Resource Shutdown and Job In | CRITICAL | 9.1 | NVD | Sep 09, 2026 |
| CVE-2026-87795 | zstd-jni versions before 1 | HIGH | 8.2 | NVD | Sep 09, 2026 |
| CVE-2026-87794 | bestzip versions 2 | HIGH | 8.4 | NVD | Sep 09, 2026 |
| CVE-2026-86547 | mrubyc through 4 | MEDIUM | 6.2 | NVD | Sep 09, 2026 |
| CVE-2026-78377 | URL redirection to untrusted site ('open redirect') vulnerability in Yordam Info | MEDIUM | 6.1 | NVD | Sep 09, 2026 |
| CVE-2026-21089 | Android โ Improper input validation in removing style tag in libsubext | HIGH | 7.8 | NVD | Sep 09, 2026 |
| CVE-2026-21088 | Android โ Improper input validation in loading a subtitle frame in lib | HIGH | 7.8 | NVD | Sep 09, 2026 |
| CVE-2026-21087 | Android โ Out-of-bounds write in libmdnie | HIGH | 7.8 | NVD | Sep 09, 2026 |
| CVE-2026-21085 | Android โ Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2 | MEDIUM | 6.7 | NVD | Sep 09, 2026 |
| CVE-2026-19945 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scri | MEDIUM | 6.4 | NVD | Sep 09, 2026 |
| CVE-2026-84293 | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stor | HIGH | 7.2 | NVD | Sep 09, 2026 |
| CVE-2026-7804 | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to | MEDIUM | 6.1 | NVD | Sep 09, 2026 |
| CVE-2026-77187 | The My Calendar โ Accessible Event Manager plugin for WordPress is vulnerable to | MEDIUM | 6.4 | NVD | Sep 09, 2026 |
| CVE-2026-77186 | The My Calendar โ Accessible Event Manager plugin for WordPress is vulnerable to | MEDIUM | 6.4 | NVD | Sep 09, 2026 |
| CVE-2026-75966 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross | MEDIUM | 6.4 | NVD | Sep 09, 2026 |
| CVE-2026-6485 | UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands | HIGH | 8.2 | NVD | Sep 09, 2026 |
| CVE-2025-25249 | Fortinet - Multiple Products | CRITICAL | N/A | CISA | Sep 09, 2026 |
| CVE-2026-87491 | Google - Chromium V8 | CRITICAL | N/A | CISA | Sep 09, 2026 |
| CVE-2026-20079 | Cisco - Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | CRITICAL | N/A | CISA | Sep 09, 2026 |
| CVE-2026-19490 | Citrix - NetScaler | CRITICAL | N/A | CISA | Sep 09, 2026 |
| CVE-2026-53637 | Sylius is an Open Source eCommerce Framework on Symfony | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-53581 | OPNsense is a FreeBSD based firewall and routing platform | CRITICAL | 9.0 | NVD | Sep 08, 2026 |
| CVE-2026-18090 | A flaw was found in gdk-pixbuf | MEDIUM | 6.1 | NVD | Sep 08, 2026 |
| CVE-2026-82058 | A flaw in MongoDB's JSON Schema validation error generation code allows an authe | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-82057 | A security issue was discovered in MongoDB where an authenticated user with read | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-82055 | A security issue exists in MongoDB's 2dsphere index key generation that can caus | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-82054 | A security issue exists in MongoDB server's JSON Pointer parser used during $jso | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-82053 | A security issue exists in MongoDB's LDAP authorization integration where pooled | HIGH | 8.1 | NVD | Sep 08, 2026 |
| CVE-2026-82052 | The $regexFindAll expression can be used by an authenticated user who can run ag | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-79570 | mfish-nocode-pro v1 | CRITICAL | 9.8 | NVD | Sep 08, 2026 |
| CVE-2026-79569 | Movie_Recommend v1 | CRITICAL | 9.8 | NVD | Sep 08, 2026 |
| CVE-2026-78997 | UC Browser for Android (package com | CRITICAL | 9.3 | NVD | Sep 08, 2026 |
| CVE-2026-75156 | Apache Airflow FAB provider versions 3 | CRITICAL | 9.1 | NVD | Sep 08, 2026 |
| CVE-2026-47625 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | HIGH | 7.5 | NVD | Sep 08, 2026 |
| CVE-2026-26084 | A improper access control vulnerability in Fortinet FortiSandbox 5 | CRITICAL | 9.9 | NVD | Sep 08, 2026 |
| CVE-2026-20293 | A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implem | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-16497 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac | HIGH | 7.5 | NVD | Sep 08, 2026 |
| CVE-2026-86713 | PX4 Autopilot through 1 | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-86712 | SiYuan before 3 | HIGH | 8.8 | NVD | Sep 08, 2026 |
| CVE-2026-86711 | electerm before 5 | HIGH | 7.4 | NVD | Sep 08, 2026 |
| CVE-2026-80219 | A flaw was found in hawtio-operator | HIGH | 8.7 | NVD | Sep 08, 2026 |
| CVE-2026-78234 | A flaw was found in hawtio-operator | CRITICAL | 9.9 | NVD | Sep 08, 2026 |
| CVE-2026-77968 | A flaw was found in hawtio-operator | HIGH | 8.2 | NVD | Sep 08, 2026 |
| CVE-2026-76931 | The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Si | MEDIUM | 6.4 | NVD | Sep 08, 2026 |
| CVE-2026-74860 | A flaw was found in libxml2 with Python bindings enabled | HIGH | 8.5 | NVD | Sep 08, 2026 |
| CVE-2026-3174 | The Event Tickets and Registration plugin for WordPress is vulnerable to unautho | HIGH | 7.5 | NVD | Sep 08, 2026 |
| CVE-2026-18021 | The The Beaver Builder Page Builder โ Drag and Drop Website Builder plugin for W | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-17509 | The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL I | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-16502 | The Live Composer โ Free WordPress Website Builder plugin for WordPress is vulne | HIGH | 8.8 | NVD | Sep 08, 2026 |
| CVE-2026-12230 | The LearnPress โ WordPress LMS Plugin for Create and Sell Online Courses plugin | MEDIUM | 6.4 | NVD | Sep 08, 2026 |
| CVE-2026-62647 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2 | HIGH | 7.4 | NVD | Sep 08, 2026 |
| CVE-2026-62646 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2 | HIGH | 7.4 | NVD | Sep 08, 2026 |
| CVE-2026-62645 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2 | CRITICAL | 9.8 | NVD | Sep 08, 2026 |
| CVE-2026-58113 | A vulnerability has been identified in Teamcenter V2412 (All versions < V2412 | MEDIUM | 6.1 | NVD | Sep 08, 2026 |
| CVE-2026-50093 | A vulnerability has been identified in Siveillance Control Pro V3 | CRITICAL | 9.0 | NVD | Sep 08, 2026 |
| CVE-2026-34223 | A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versio | HIGH | 8.2 | NVD | Sep 08, 2026 |
| CVE-2026-84820 | Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor ( | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-84818 | Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1 | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-84817 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3 | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-81806 | Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost | HIGH | 7.2 | NVD | Sep 08, 2026 |
| CVE-2026-81802 | Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5 | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-81798 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-81792 | Unauthenticated Privilege Escalation in Product Catalog Enquiry for WooCommerce | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-81790 | Missing Authorization vulnerability in Viszt Pรฉter Csomagpontok รฉs szรกllรญtรกsi cรญ | HIGH | 7.5 | NVD | Sep 08, 2026 |
| CVE-2026-81781 | Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce | HIGH | 7.1 | NVD | Sep 08, 2026 |
| CVE-2026-76561 | A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority compo | HIGH | 7.2 | NVD | Sep 08, 2026 |
| CVE-2026-71375 | Improper restriction of XML external entity reference vulnerability in Cosminexu | HIGH | 7.4 | NVD | Sep 08, 2026 |
| CVE-2026-71374 | Deserialization of untrusted data vulnerability in Cosminexus Component Containe | CRITICAL | 9.8 | NVD | Sep 08, 2026 |
| CVE-2026-48888 | Allocation of Resources Without Limits or Throttling vulnerability in Automattic | HIGH | 7.5 | NVD | Sep 08, 2026 |
| CVE-2026-44766 | SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged a | MEDIUM | 6.5 | NVD | Sep 08, 2026 |
| CVE-2026-44756 | A memory safety vulnerability exists in the Extended Passport Protocol (EPP) pro | CRITICAL | 10.0 | NVD | Sep 08, 2026 |
| CVE-2026-85880 | Microsoft - Windows | CRITICAL | N/A | CISA | Sep 08, 2026 |
| CVE-2026-75650 | Adobe - Commerce and Magento | CRITICAL | N/A | CISA | Sep 08, 2026 |
| CVE-2026-81963 | Microsoft - Windows | CRITICAL | N/A | CISA | Sep 08, 2026 |
| CVE-2026-86218 | N-able - N-central | CRITICAL | N/A | CISA | Sep 08, 2026 |
| CVE-2026-86544 | knowns versions before 0 | HIGH | 8.1 | NVD | Sep 07, 2026 |
| CVE-2026-86543 | knowns versions before 0 | CRITICAL | 9.8 | NVD | Sep 07, 2026 |
| CVE-2026-86542 | knowns before 0 | CRITICAL | 9.1 | NVD | Sep 07, 2026 |
| CVE-2026-86541 | knowns versions before 0 | HIGH | 8.3 | NVD | Sep 07, 2026 |
| CVE-2026-86540 | knowns versions before 0 | HIGH | 7.8 | NVD | Sep 07, 2026 |
| CVE-2026-86539 | knowns through 0 | HIGH | 7.2 | NVD | Sep 07, 2026 |
| CVE-2026-86538 | knowns versions before 0 | HIGH | 7.5 | NVD | Sep 07, 2026 |
| CVE-2026-86439 | knowns versions before 0 | HIGH | 8.8 | NVD | Sep 07, 2026 |
| CVE-2026-86489 | In JetBrains YouTrack before 2026 | MEDIUM | 6.5 | NVD | Sep 07, 2026 |
| CVE-2026-86488 | In JetBrains YouTrack before 2026 | MEDIUM | 6.5 | NVD | Sep 07, 2026 |
| CVE-2026-86482 | In JetBrains YouTrack before 2026 | HIGH | 8.8 | NVD | Sep 07, 2026 |
| CVE-2026-86480 | In JetBrains Hub before 2026 | CRITICAL | 9.8 | NVD | Sep 07, 2026 |
| CVE-2026-86479 | In JetBrains YouTrack before 2026 | HIGH | 8.1 | NVD | Sep 07, 2026 |
| CVE-2026-86478 | In JetBrains YouTrack before 2025 | CRITICAL | 9.8 | NVD | Sep 07, 2026 |
| CVE-2026-80166 | Dell SCG 5 | HIGH | 7.8 | NVD | Sep 07, 2026 |
| CVE-2026-80126 | Dell SCG 5 | MEDIUM | 6.5 | NVD | Sep 07, 2026 |
| CVE-2026-79639 | Dell SCG 5 | HIGH | 7.6 | NVD | Sep 07, 2026 |
| CVE-2026-86300 | A flaw has been found in Tenda AC9 15 | HIGH | 7.3 | NVD | Sep 07, 2026 |
| CVE-2026-86299 | A vulnerability was detected in Linksys RE7000 2 | CRITICAL | 9.9 | NVD | Sep 07, 2026 |
| CVE-2026-2390 | The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | MEDIUM | 6.4 | NVD | Sep 07, 2026 |
| CVE-2026-86298 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling | HIGH | 7.3 | NVD | Sep 07, 2026 |
| CVE-2026-86297 | A vulnerability was identified in D-Link DIR-605 B1v202WWB03 | HIGH | 8.1 | NVD | Sep 07, 2026 |
| CVE-2026-86296 | A vulnerability was determined in D-Link DIR-822A A_101 | CRITICAL | 10.0 | NVD | Sep 07, 2026 |
| CVE-2026-86295 | A vulnerability was found in D-Link DIR-895L A1_102b07 | HIGH | 8.3 | NVD | Sep 07, 2026 |
| CVE-2026-85640 | Zohocorp ManageEngine Endpoint Central versions below 11 | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-77697 | Zohocorp ManageEngine Endpoint Central versions below 11 | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-78254 | The ftp and scp tasks of Apache Ant can download files from a remote server | HIGH | 7.4 | NVD | Sep 07, 2026 |
| CVE-2026-14296 | When using the Direct XIP update strategy, the main application image starts oth | HIGH | 7.5 | NVD | Sep 07, 2026 |
| CVE-2026-86279 | A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Manag | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-86277 | A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Manag | HIGH | 7.3 | NVD | Sep 07, 2026 |
| CVE-2026-79698 | A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661 | CRITICAL | 9.9 | NVD | Sep 07, 2026 |
| CVE-2026-79697 | A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-661 | CRITICAL | 9.9 | NVD | Sep 07, 2026 |
| CVE-2026-86276 | A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & E | HIGH | 7.3 | NVD | Sep 07, 2026 |
| CVE-2026-86273 | A weakness has been identified in projeto-siga siga up to 11 | HIGH | 7.3 | NVD | Sep 07, 2026 |
| CVE-2026-86272 | A vulnerability was determined in Beijing Meite Software Technology U+Smart Enjo | HIGH | 7.3 | NVD | Sep 07, 2026 |
| CVE-2026-86270 | A vulnerability has been found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-20508 | In Power HAL, there is a possible escalation of privilege due to type confusion | MEDIUM | 6.7 | NVD | Sep 07, 2026 |
| CVE-2026-20507 | In Audio HAL, there is a possible escalation of privilege due to use after free | MEDIUM | 6.7 | NVD | Sep 07, 2026 |
| CVE-2026-20506 | In Audio HAL, there is a possible escalation of privilege due to use after free | MEDIUM | 6.7 | NVD | Sep 07, 2026 |
| CVE-2026-20502 | In vdec, there is a possible out of bounds write due to a missing bounds check | HIGH | 8.4 | NVD | Sep 07, 2026 |
| CVE-2026-20501 | In vdec, there is a possible out of bounds write due to a heap buffer overflow | HIGH | 8.4 | NVD | Sep 07, 2026 |
| CVE-2026-86236 | A vulnerability has been found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-86235 | A flaw has been found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-86234 | A vulnerability was detected in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-86233 | A security vulnerability has been detected in itsourcecode Sales and Inventory S | MEDIUM | 6.3 | NVD | Sep 07, 2026 |
| CVE-2026-86304 | MojoX::Authentication versions before 0 | CRITICAL | 9.8 | NVD | Sep 06, 2026 |
| CVE-2026-86232 | A weakness has been identified in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 06, 2026 |
| CVE-2026-86225 | A vulnerability was identified in SourceCodester Class and Exam Timetabling Syst | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86224 | A vulnerability was determined in SourceCodester Class and Exam Timetabling Syst | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86223 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86222 | A vulnerability has been found in SourceCodester Class and Exam Timetabling Syst | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86221 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86220 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-80229 | When performing transfers via libcurlโs multi interface, pooled TLS connections | HIGH | 7.5 | NVD | Sep 06, 2026 |
| CVE-2026-19931 | A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given ho | CRITICAL | 9.8 | NVD | Sep 06, 2026 |
| CVE-2026-18924 | A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent hand | CRITICAL | 9.1 | NVD | Sep 06, 2026 |
| CVE-2026-13608 | A flaw in the libcurl SASL negotiation for LDAP authentication allows an incompl | HIGH | 7.4 | NVD | Sep 06, 2026 |
| CVE-2026-86214 | A vulnerability was determined in Mstfakts College-Management-System | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86213 | A vulnerability was found in Mstfakts College-Management-System | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86255 | wger before 2 | MEDIUM | 6.5 | NVD | Sep 06, 2026 |
| CVE-2026-86254 | wger versions through master contain an incomplete authorization bypass in wger/ | MEDIUM | 6.8 | NVD | Sep 06, 2026 |
| CVE-2026-86250 | h3 versions before 2 | HIGH | 7.5 | NVD | Sep 06, 2026 |
| CVE-2026-86242 | Bifrost HTTP transport before 2 | HIGH | 8.1 | NVD | Sep 06, 2026 |
| CVE-2022-51009 | PocketMine-MP before 4 | HIGH | 7.5 | NVD | Sep 06, 2026 |
| CVE-2021-48007 | PocketMine-MP versions before 3 | MEDIUM | 6.5 | NVD | Sep 06, 2026 |
| CVE-2020-37277 | PocketMine-MP versions before 3 | MEDIUM | 6.5 | NVD | Sep 06, 2026 |
| CVE-2026-86211 | A flaw has been found in rabindralamsal inventory-management-system 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-19859 | The JetFormBuilder WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Sep 06, 2026 |
| CVE-2026-86180 | A vulnerability has been found in code-projects Task Management System In PHP 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86172 | A vulnerability was detected in DefaultFuction CRM 1 | MEDIUM | 6.3 | NVD | Sep 06, 2026 |
| CVE-2026-86171 | A security vulnerability has been detected in DefaultFuction CRM 1 | MEDIUM | 6.3 | NVD | Sep 06, 2026 |
| CVE-2026-84219 | The Kirki WordPress plugin before 6 | HIGH | 7.5 | NVD | Sep 06, 2026 |
| CVE-2026-84028 | The Bold Page Builder WordPress plugin before 5 | MEDIUM | 6.8 | NVD | Sep 06, 2026 |
| CVE-2026-75793 | The SureCart WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Sep 06, 2026 |
| CVE-2026-18480 | The SureCart WordPress plugin before 4 | HIGH | 8.8 | NVD | Sep 06, 2026 |
| CVE-2026-86170 | A weakness has been identified in DefaultFuction CRM 1 | MEDIUM | 6.3 | NVD | Sep 06, 2026 |
| CVE-2026-86168 | A security flaw has been discovered in code-projects Content Management System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86167 | A vulnerability was identified in Tenda HG10 300001138 | CRITICAL | 9.9 | NVD | Sep 06, 2026 |
| CVE-2026-86166 | A vulnerability was determined in Tenda HG10 300001138 | HIGH | 8.8 | NVD | Sep 06, 2026 |
| CVE-2026-86165 | A vulnerability was found in Tenda HG10 300001138 | CRITICAL | 9.8 | NVD | Sep 06, 2026 |
| CVE-2026-86164 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 06, 2026 |
| CVE-2026-86163 | A vulnerability was identified in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Sep 06, 2026 |
| CVE-2026-86162 | A vulnerability was determined in SourceCodester Online Voting System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86161 | A vulnerability was found in SourceCodester Online Voting System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86160 | A vulnerability has been found in SourceCodester Online Voting System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-86159 | A flaw has been found in SourceCodester Online Voting System 1 | HIGH | 7.3 | NVD | Sep 06, 2026 |
| CVE-2026-75816 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentic | CRITICAL | 9.8 | NVD | Sep 06, 2026 |
| CVE-2026-18056 | The HivePress Authentication plugin for WordPress is vulnerable to Authenticatio | HIGH | 7.5 | NVD | Sep 06, 2026 |
| CVE-2026-16310 | The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Refe | CRITICAL | 9.8 | NVD | Sep 06, 2026 |
| CVE-2026-86153 | A vulnerability has been found in Tenda CP3 27 | CRITICAL | 9.1 | NVD | Sep 06, 2026 |
| CVE-2026-86152 | A flaw has been found in Tenda CP3 27 | CRITICAL | 10.0 | NVD | Sep 06, 2026 |
| CVE-2026-86151 | A vulnerability was detected in Tenda CP3 27 | CRITICAL | 9.1 | NVD | Sep 06, 2026 |
| CVE-2026-86190 | WWBN AVideo contains a broken access control vulnerability in videoViewsInfo end | CRITICAL | 9.1 | NVD | Sep 05, 2026 |
| CVE-2026-86189 | WWBN AVideo contains a path traversal vulnerability in notify | CRITICAL | 9.8 | NVD | Sep 05, 2026 |
| CVE-2026-86188 | AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerabili | HIGH | 7.2 | NVD | Sep 05, 2026 |
| CVE-2026-86186 | AVideo API fails to enforce rate limits when clients send a bot User-Agent heade | MEDIUM | 6.5 | NVD | Sep 05, 2026 |
| CVE-2026-86185 | Bilibili Desktop through 1 | HIGH | 8.0 | NVD | Sep 05, 2026 |
| CVE-2026-86184 | Lara Dashboard before 1 | CRITICAL | 9.8 | NVD | Sep 05, 2026 |
| CVE-2026-10196 | The Mail Mint โ Email Marketing, Newsletter, Email Automation & WooCommerce Emai | CRITICAL | 9.8 | NVD | Sep 05, 2026 |
| CVE-2025-9049 | The Nokri โ Job Board WordPress Theme theme for WordPress is vulnerable to unaut | HIGH | 8.8 | NVD | Sep 05, 2026 |
| CVE-2026-86177 | Pterodactyl Panel before 1 | HIGH | 8.8 | NVD | Sep 05, 2026 |
| CVE-2026-86175 | NetBox through 4 | MEDIUM | 6.5 | NVD | Sep 05, 2026 |
| CVE-2026-86173 | MindsDB through 26 | HIGH | 7.5 | NVD | Sep 05, 2026 |
| CVE-2026-86169 | Axolotl through 0 | HIGH | 8.8 | NVD | Sep 05, 2026 |
| CVE-2026-8625 | The Dear Flipbook โ PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for | MEDIUM | 6.4 | NVD | Sep 05, 2026 |
| CVE-2026-8623 | The Dear Flipbook โ PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for | MEDIUM | 6.4 | NVD | Sep 05, 2026 |
| CVE-2026-86145 | PCRE2 before 10 | HIGH | 8.2 | NVD | Sep 05, 2026 |
| CVE-2026-83627 | The Hummingbird โ Speed Optimization, Caching, Minify, Compress & CDN plugin for | CRITICAL | 9.8 | NVD | Sep 05, 2026 |
| CVE-2026-77263 | The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin | HIGH | 7.2 | NVD | Sep 05, 2026 |
| CVE-2026-77233 | The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin | HIGH | 7.2 | NVD | Sep 05, 2026 |
| CVE-2026-18404 | The Social Chat โ Click To Chat App Button plugin for WordPress is vulnerable to | MEDIUM | 6.4 | NVD | Sep 05, 2026 |
| CVE-2026-13447 | The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via J | CRITICAL | 9.8 | NVD | Sep 05, 2026 |
| CVE-2026-86143 | In xmlIO in libxml2 before 2 | MEDIUM | 6.9 | NVD | Sep 05, 2026 |
| CVE-2026-86142 | In libxml2 before 2 | MEDIUM | 6.9 | NVD | Sep 05, 2026 |
| CVE-2026-86140 | In libxml2 before 2 | HIGH | 8.0 | NVD | Sep 05, 2026 |
| CVE-2026-86139 | In libxml2 before 2 | MEDIUM | 6.9 | NVD | Sep 05, 2026 |
| CVE-2026-86138 | In libxml2 before 2 | MEDIUM | 6.9 | NVD | Sep 05, 2026 |
| CVE-2026-86100 | Camaleon CMS versions 2 | MEDIUM | 6.4 | NVD | Sep 05, 2026 |
| CVE-2026-52775 | YesWiki is a wiki system written in PHP | HIGH | 8.8 | NVD | Sep 05, 2026 |
| CVE-2026-52774 | YesWiki is a wiki system written in PHP | MEDIUM | 6.1 | NVD | Sep 05, 2026 |
| CVE-2026-52773 | YesWiki is a wiki system written in PHP | MEDIUM | 6.1 | NVD | Sep 05, 2026 |
| CVE-2026-52771 | YesWiki is a wiki system written in PHP | HIGH | 8.3 | NVD | Sep 05, 2026 |
| CVE-2026-52770 | YesWiki is a wiki system written in PHP | HIGH | 7.5 | NVD | Sep 05, 2026 |
| CVE-2026-52769 | YesWiki is a wiki system written in PHP | HIGH | 8.3 | NVD | Sep 05, 2026 |
| CVE-2026-52767 | YesWiki is a wiki system written in PHP | HIGH | 8.2 | NVD | Sep 05, 2026 |
| CVE-2026-52766 | YesWiki is a wiki system written in PHP | CRITICAL | 9.1 | NVD | Sep 05, 2026 |
| CVE-2026-52763 | YesWiki is a wiki system written in PHP | MEDIUM | 6.5 | NVD | Sep 05, 2026 |
| CVE-2026-86098 | ntop nDPI versions before 6 | HIGH | 7.4 | NVD | Sep 04, 2026 |
| CVE-2026-86097 | PX4 Autopilot through 1 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-86095 | Unidata netcdf-c through 4 | HIGH | 7.8 | NVD | Sep 04, 2026 |
| CVE-2026-48019 | Laravel is a web application framework | HIGH | 8.9 | NVD | Sep 04, 2026 |
| CVE-2026-17273 | IBM i 7 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-17207 | IBM i 7 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-17057 | IBM i 7 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-16689 | IBM App Connect Enterprise 13 | MEDIUM | 6.2 | NVD | Sep 04, 2026 |
| CVE-2026-14470 | IBM Langflow OSS 1 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-85585 | SiYuan before v3 | HIGH | 7.5 | NVD | Sep 04, 2026 |
| CVE-2026-85584 | SiYuan versions before v3 | HIGH | 7.5 | NVD | Sep 04, 2026 |
| CVE-2026-85583 | SiYuan versions before v3 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-85582 | SiYuan versions before v3 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-85581 | SiYuan before v3 | HIGH | 7.5 | NVD | Sep 04, 2026 |
| CVE-2026-85580 | SiYuan versions before v3 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-85578 | SiYuan through 3 | MEDIUM | 6.5 | NVD | Sep 04, 2026 |
| CVE-2026-19080 | Observable response discrepancy vulnerability in Menulux Software Inc | HIGH | 7.5 | NVD | Sep 04, 2026 |
| CVE-2026-19051 | Plaintext storage of a password vulnerability in Menulux Software Inc | HIGH | 7.1 | NVD | Sep 04, 2026 |
| CVE-2026-85512 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling | HIGH | 7.3 | NVD | Sep 04, 2026 |
| CVE-2026-84428 | fastify versions before 5 | HIGH | 7.5 | NVD | Sep 04, 2026 |
| CVE-2026-19224 | The Hummingbird Performance WordPress plugin before 3 | HIGH | 7.2 | NVD | Sep 04, 2026 |
| CVE-2026-16281 | The Classified Listing WordPress plugin before 6 | HIGH | 7.1 | NVD | Sep 04, 2026 |
| CVE-2026-15354 | The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85509 | FreeIPMI before 1 | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85508 | ipmi-oem in FreeIPMI before 1 | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85507 | ipmi-oem in FreeIPMI before 1 | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85506 | ipmi-oem in FreeIPMI before 1 | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85505 | ipmi-oem in FreeIPMI before 1 | HIGH | 7.5 | NVD | Sep 04, 2026 |
| CVE-2026-85504 | FreeIPMI before 1 | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85409 | A vulnerability was identified in Eleveo Quality Management 9 | MEDIUM | 6.3 | NVD | Sep 04, 2026 |
| CVE-2026-11613 | The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion | CRITICAL | 9.8 | NVD | Sep 04, 2026 |
| CVE-2026-85046 | Google - Chromium V8 | CRITICAL | N/A | CISA | Sep 04, 2026 |
| CVE-2026-85430 | MOOS essential-moos through 10 | CRITICAL | 9.1 | NVD | Sep 03, 2026 |
| CVE-2026-85429 | MOOS-IvP uFldNodeComms through 24 | HIGH | 7.5 | NVD | Sep 03, 2026 |
| CVE-2026-85428 | MOOS core-moos through 10 | CRITICAL | 9.8 | NVD | Sep 03, 2026 |
| CVE-2026-85427 | MOOS essential-moos pAntler through 10 | HIGH | 8.1 | NVD | Sep 03, 2026 |
| CVE-2026-85426 | MOOS-IvP uMemWatch through 24 | CRITICAL | 9.8 | NVD | Sep 03, 2026 |
| CVE-2026-85425 | MOOS-IvP iSay through 24 | CRITICAL | 9.8 | NVD | Sep 03, 2026 |
| CVE-2026-85424 | MOOS core-moos through 10 | CRITICAL | 9.8 | NVD | Sep 03, 2026 |
| CVE-2026-85378 | A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d | HIGH | 7.3 | NVD | Sep 03, 2026 |
| CVE-2026-85241 | A weakness has been identified in SpecterOps BloodHound up to 9 | MEDIUM | 6.3 | NVD | Sep 03, 2026 |
| CVE-2026-85225 | A vulnerability was identified in code-projects Doctor Appointment System 1 | HIGH | 7.3 | NVD | Sep 03, 2026 |
| CVE-2026-83711 | Authorization bypass through user-controlled key in Microsoft Azure Active Direc | CRITICAL | 10.0 | NVD | Sep 03, 2026 |
| CVE-2026-80098 | Improper verification of cryptographic signature in Copilot Studio allows an una | CRITICAL | 9.3 | NVD | Sep 03, 2026 |
| CVE-2026-70352 | Missing authentication for critical function in Azure AI Language allows an unau | CRITICAL | 10.0 | NVD | Sep 03, 2026 |
| CVE-2026-70178 | Missing authorization in Microsoft Fabric allows an authorized attacker to eleva | HIGH | 8.5 | NVD | Sep 03, 2026 |
| CVE-2026-69857 | Authorization bypass through user-controlled key in Azure Cosmos DB allows an au | HIGH | 8.5 | NVD | Sep 03, 2026 |
| CVE-2026-65818 | Server-side request forgery (ssrf) in Power Automate allows an authorized attack | HIGH | 8.5 | NVD | Sep 03, 2026 |
| CVE-2026-62916 | Authentication bypass using an alternate path or channel in Microsoft Entra ID a | CRITICAL | 9.1 | NVD | Sep 03, 2026 |
| CVE-2026-62906 | Improper neutralization of special elements in data query logic in Microsoft Dis | HIGH | 7.4 | NVD | Sep 03, 2026 |
| CVE-2026-84761 | Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7 | HIGH | 7.2 | NVD | Sep 03, 2026 |
| CVE-2026-84758 | Unauthenticated Broken Access Control in Business Directory <= 6 | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-84757 | Unauthenticated Settings Change in WP Compress <= 7 | HIGH | 8.2 | NVD | Sep 03, 2026 |
| CVE-2026-84756 | Subscriber Privilege Escalation in WCFM Membership <= 2 | HIGH | 7.1 | NVD | Sep 03, 2026 |
| CVE-2026-84755 | Unauthenticated Broken Access Control in Mail Mint <= 1 | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-84754 | Unauthenticated Broken Access Control in WPFunnels <= 3 | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-84753 | Unauthenticated PHP Object Injection in Mail Mint <= 1 | CRITICAL | 9.8 | NVD | Sep 03, 2026 |
| CVE-2026-84752 | Contributor PHP Object Injection in RTMKit <= 2 | HIGH | 8.8 | NVD | Sep 03, 2026 |
| CVE-2026-84238 | Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Pr | CRITICAL | 9.8 | NVD | Sep 03, 2026 |
| CVE-2026-84215 | Unauthenticated Broken Access Control in Timetics <= 1 | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-81776 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3 | HIGH | 7.1 | NVD | Sep 03, 2026 |
| CVE-2026-81773 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extensio | HIGH | 7.1 | NVD | Sep 03, 2026 |
| CVE-2026-81300 | Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= | HIGH | 7.1 | NVD | Sep 03, 2026 |
| CVE-2026-81295 | Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5 | HIGH | 7.1 | NVD | Sep 03, 2026 |
| CVE-2026-81292 | Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2 | HIGH | 7.1 | NVD | Sep 03, 2026 |
| CVE-2026-81282 | Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooComm | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-81281 | Subscriber Cross Site Scripting (XSS) in Graphene <= 2 | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-75602 | OpenList a file list program that supports multiple storage | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-74769 | Dell PowerProtect Data Manager, versions 20 | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2026-73600 | Dell PowerProtect Data Manager, versions 20 | HIGH | 7.8 | NVD | Sep 03, 2026 |
| CVE-2026-71221 | A stack out-of-bounds write vulnerability was found in gfs2-utils | HIGH | 7.0 | NVD | Sep 03, 2026 |
| CVE-2026-71220 | A stack out-of-bounds write vulnerability was found in gfs2-utils | HIGH | 7.0 | NVD | Sep 03, 2026 |
| CVE-2026-68860 | Dell PowerProtect Data Manager, versions 20 | MEDIUM | 6.8 | NVD | Sep 03, 2026 |
| CVE-2026-3852 | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via th | MEDIUM | 6.4 | NVD | Sep 03, 2026 |
| CVE-2026-2573 | The GutenKit โ Page Builder Blocks, Patterns, and Templates for Gutenberg Block | MEDIUM | 6.4 | NVD | Sep 03, 2026 |
| CVE-2021-43614 | Error in handling the PlatformLangCodes UEFI variable could cause a buffer overf | MEDIUM | 6.7 | NVD | Sep 03, 2026 |
| CVE-2021-43613 | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O | MEDIUM | 6.5 | NVD | Sep 03, 2026 |
| CVE-2021-38489 | HDD password plaintext is stored in a UEFI variable | HIGH | 8.2 | NVD | Sep 03, 2026 |
| CVE-2026-84851 | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1 | HIGH | 7.5 | NVD | Sep 03, 2026 |
| CVE-2026-84394 | Fast-Uri โ fast-uri accepts a host that contains an unbalanced or mispl | HIGH | 7.5 | NVD | Sep 03, 2026 |
| EDB-52680 | [webapps] Metabase 0.61.0 - Authenticated Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Sep 03, 2026 |
| EDB-52681 | [webapps] FreePBX 17.0.2 - Remote Code Execution (RCE) | HIGH | N/A | EXPLOIT-DB | Sep 03, 2026 |
| CVE-2026-79755 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing | HIGH | 8.0 | NVD | Sep 02, 2026 |
| CVE-2026-55421 | Open edX Platform enables the authoring and delivery of online learning at any s | MEDIUM | 6.8 | NVD | Sep 02, 2026 |
| CVE-2026-53635 | Open edX Platform enables the authoring and delivery of online learning at any s | HIGH | 7.6 | NVD | Sep 02, 2026 |
| CVE-2026-52833 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing | HIGH | 8.0 | NVD | Sep 02, 2026 |
| CVE-2026-52831 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing | HIGH | 8.0 | NVD | Sep 02, 2026 |
| CVE-2026-45730 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing | HIGH | 8.3 | NVD | Sep 02, 2026 |
| CVE-2026-20281 | A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Se | HIGH | 7.5 | NVD | Sep 02, 2026 |
| CVE-2026-20280 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-20279 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Sep 02, 2026 |
| CVE-2026-20278 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-20277 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.2 | NVD | Sep 02, 2026 |
| CVE-2026-20276 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.6 | NVD | Sep 02, 2026 |
| CVE-2026-20275 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-20274 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Sep 02, 2026 |
| CVE-2026-20212 | A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switc | CRITICAL | 9.8 | NVD | Sep 02, 2026 |
| CVE-2026-84759 | Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-83562 | Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3 | MEDIUM | 6.5 | NVD | Sep 02, 2026 |
| CVE-2026-82223 | Unauthenticated Broken Access Control in WP Event SOlution <= 4 | MEDIUM | 6.5 | NVD | Sep 02, 2026 |
| CVE-2026-81775 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-81774 | Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2 | HIGH | 7.5 | NVD | Sep 02, 2026 |
| CVE-2026-81772 | Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3 | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-81771 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-81770 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-81769 | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-81294 | Unauthenticated Privilege Escalation in Authorizer <= 3 | CRITICAL | 9.8 | NVD | Sep 02, 2026 |
| CVE-2026-81289 | Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-81288 | Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCom | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-81286 | Unauthenticated SQL Injection in WCFM Marketplace <= 3 | CRITICAL | 9.3 | NVD | Sep 02, 2026 |
| CVE-2026-81283 | Subscriber PHP Object Injection in WP User Frontend <= 4 | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-32773 | There is a lack of XSS escaping in the Spark History Server prior to 3 | MEDIUM | 6.1 | NVD | Sep 02, 2026 |
| CVE-2026-19219 | In Progressยฎ Telerikยฎ UI for AJAX prior to v2026 | HIGH | 8.1 | NVD | Sep 02, 2026 |
| CVE-2026-18672 | In Progressยฎ Telerikยฎ UI for AJAX prior to v2026 | HIGH | 7.5 | NVD | Sep 02, 2026 |
| CVE-2026-19723 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-19719 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Sep 02, 2026 |
| CVE-2026-19453 | The JetBackup WordPress plugin before 3 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-19116 | The User Frontend WordPress plugin before 4 | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-14357 | The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in ve | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-14215 | The Booking for Appointments and Events Calendar WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Sep 02, 2026 |
| CVE-2026-12865 | The Photo Gallery by 10Web WordPress plugin before 1 | HIGH | 7.1 | NVD | Sep 02, 2026 |
| CVE-2026-12526 | The Advanced Custom Fields: Extended WordPress plugin before 0 | HIGH | 8.1 | NVD | Sep 02, 2026 |
| CVE-2025-15664 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 02, 2026 |
| CVE-2025-15663 | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Sep 02, 2026 |
| CVE-2026-9055 | The Booking for Appointments and Events Calendar โ Amelia (Premium) plugin for W | CRITICAL | 9.8 | NVD | Sep 02, 2026 |
| CVE-2025-46418 | Westermo WeOS 5 | HIGH | 7.6 | NVD | Sep 02, 2026 |
| CVE-2024-35585 | Oxford Nanopore MinKNOW before 24 | HIGH | 8.6 | NVD | Sep 02, 2026 |
| CVE-2026-84327 | Incorrect authorization in Autofill in Google Chrome on on Android prior to 152 | MEDIUM | 6.5 | NVD | Sep 02, 2026 |
| CVE-2026-84326 | Chrome โ Uninitialized resource in V8 in Google Chrome prior to 152 | HIGH | 8.8 | NVD | Sep 02, 2026 |
| CVE-2026-84325 | Chrome โ Improper input validation in DataTransfer in Google Chrome p | CRITICAL | 9.8 | NVD | Sep 02, 2026 |
| CVE-2026-84324 | Chrome โ Use after free in Proxy in Google Chrome prior to 152 | CRITICAL | 9.0 | NVD | Sep 02, 2026 |
| CVE-2026-81928 | Net::DNS versions before 1 | HIGH | 7.5 | NVD | Sep 02, 2026 |
| EDB-52679 | [dos] EVerest 2025.9.0 - DoS | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| CVE-2026-83549 | SonicWall - SMA1000 Appliances | CRITICAL | N/A | CISA | Sep 02, 2026 |
| CVE-2026-83548 | SonicWall - SMA1000 Appliances | CRITICAL | N/A | CISA | Sep 02, 2026 |
| CVE-2026-9586 | Sangoma - Switchvox | CRITICAL | N/A | CISA | Sep 02, 2026 |
| CVE-2026-82329 | JFrog - Artifactory | CRITICAL | N/A | CISA | Sep 02, 2026 |
| CVE-2026-49869 | Kestra - Kestra OSS | CRITICAL | N/A | CISA | Sep 02, 2026 |
| CVE-2026-48710 | Kludex - Starlette | CRITICAL | N/A | CISA | Sep 02, 2026 |
| CVE-2026-59822 | BerriAI - LiteLLM | CRITICAL | N/A | CISA | Sep 02, 2026 |
| EDB-52673 | [webapps] Marimo 0.20.4 - RCE | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| EDB-52674 | [hardware] Fullhan FH8626V100 - Multiple Vulnerabilities | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| EDB-52675 | [webapps] Langflow 1.10.0 - RCE | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| EDB-52676 | [webapps] Ghost_CMS 6.19.0 - Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| EDB-52677 | [webapps] PodcastGenerator 3.2.9 - Stored XSS | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| EDB-52678 | [webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting | HIGH | N/A | EXPLOIT-DB | Sep 02, 2026 |
| CVE-2026-84482 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulner | HIGH | 8.8 | NVD | Sep 01, 2026 |
| CVE-2026-84480 | WWBN AVideo fails to validate password recovery token expiration in userRecoverP | CRITICAL | 9.8 | NVD | Sep 01, 2026 |
| CVE-2026-84479 | WWBN AVideo (current e01e41ecc and earlier) makes three login-time security cont | CRITICAL | 9.1 | NVD | Sep 01, 2026 |
| CVE-2026-84478 | WWBN AVideo contains a path traversal vulnerability in the API get_api_login_cod | HIGH | 7.3 | NVD | Sep 01, 2026 |
| CVE-2026-84476 | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-F | HIGH | 7.5 | NVD | Sep 01, 2026 |
| CVE-2026-84423 | A vulnerability has been found in Casdoor up to 4 | HIGH | 7.3 | NVD | Sep 01, 2026 |
| CVE-2026-84208 | AVideo through version 29 | HIGH | 7.5 | NVD | Sep 01, 2026 |
| CVE-2026-83551 | Cleartext storage of sensitive information in the @step and @remote decorator pi | HIGH | 7.2 | NVD | Sep 01, 2026 |
| CVE-2026-52132 | llama | HIGH | 7.5 | NVD | Sep 01, 2026 |
| CVE-2026-52131 | llama | HIGH | 7.5 | NVD | Sep 01, 2026 |
| CVE-2026-52130 | llama | HIGH | 7.5 | NVD | Sep 01, 2026 |
| CVE-2026-52111 | An issue in fast-note-sync-service <=2 | CRITICAL | 9.8 | NVD | Sep 01, 2026 |
| CVE-2026-52022 | An issue in kamailio v | HIGH | 7.5 | NVD | Sep 01, 2026 |
| CVE-2026-51974 | An eval() injection vulnerability in the get_list function in modules/meta_parse | HIGH | 8.8 | NVD | Sep 01, 2026 |
| CVE-2026-19593 | OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata | CRITICAL | 9.8 | NVD | Sep 01, 2026 |
| CVE-2026-19592 | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and | HIGH | 7.3 | NVD | Sep 01, 2026 |
| CVE-2026-19591 | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and | HIGH | 8.8 | NVD | Sep 01, 2026 |
| CVE-2026-19590 | OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git | HIGH | 7.3 | NVD | Sep 01, 2026 |
| CVE-2026-58566 | Dell PowerStore, an Incorrect Authorization vulnerability | HIGH | 8.8 | NVD | Sep 01, 2026 |
| CVE-2026-51956 | A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS p | HIGH | 8.1 | NVD | Sep 01, 2026 |
| CVE-2026-51934 | Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co | CRITICAL | 9.8 | NVD | Sep 01, 2026 |
| CVE-2026-84192 | LibreNMS before 26 | HIGH | 7.1 | NVD | Sep 01, 2026 |
| CVE-2026-84191 | LibreNMS before 26 | MEDIUM | 6.1 | NVD | Sep 01, 2026 |
| CVE-2026-84190 | LibreNMS versions before 26 | HIGH | 7.2 | NVD | Sep 01, 2026 |
| CVE-2026-84189 | LibreNMS through 26 | HIGH | 8.1 | NVD | Sep 01, 2026 |
| CVE-2026-84187 | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish | HIGH | 8.2 | NVD | Sep 01, 2026 |
| CVE-2026-83595 | AVideo contains a cross-site request forgery vulnerability in plugin/API/set | HIGH | 8.1 | NVD | Sep 01, 2026 |
| CVE-2026-76111 | Dell PowerStore contains an Incorrect Authorization vulnerability | HIGH | 8.8 | NVD | Sep 01, 2026 |
| CVE-2026-18550 | The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege E | CRITICAL | 9.8 | NVD | Sep 01, 2026 |
| CVE-2026-11873 | An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequ | MEDIUM | 6.5 | NVD | Sep 01, 2026 |
| CVE-2025-15613 | Kyverno before v1 | MEDIUM | 6.5 | NVD | Sep 01, 2026 |
| CVE-2026-84059 | A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704 | HIGH | 7.4 | NVD | Sep 01, 2026 |
| CVE-2026-75865 | The WPLP Cookie Consent โ Cookie Banner & Consent Management for GDPR, CCPA & Go | CRITICAL | 9.8 | NVD | Sep 01, 2026 |
| EDB-52669 | [webapps] Grav CMS 2.0.7 - RCE | HIGH | N/A | EXPLOIT-DB | Sep 01, 2026 |
| EDB-52671 | [webapps] Payload CMS 3.72.0 - Blind SQL Injection | HIGH | N/A | EXPLOIT-DB | Sep 01, 2026 |
| EDB-52668 | [webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass | HIGH | N/A | EXPLOIT-DB | Sep 01, 2026 |
| EDB-52670 | [webapps] Bludit CMS - Stored XSS | HIGH | N/A | EXPLOIT-DB | Sep 01, 2026 |
| EDB-52667 | [webapps] EasyAppointments 1.5.1 - Blind SQL Injection | HIGH | N/A | EXPLOIT-DB | Sep 01, 2026 |
| EDB-52672 | [webapps] Wolf CMS 0.8.3.1 - RCE v | HIGH | N/A | EXPLOIT-DB | Sep 01, 2026 |
| CVE-2026-83524 | A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimiz | CRITICAL | 9.9 | NVD | Aug 31, 2026 |
| CVE-2026-82971 | A vulnerability was determined in QVidium Opera11 3 | CRITICAL | 10.0 | NVD | Aug 31, 2026 |
| CVE-2026-82808 | A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7 | HIGH | 7.3 | NVD | Aug 31, 2026 |
| CVE-2026-51724 | Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4 | CRITICAL | 9.8 | NVD | Aug 31, 2026 |
| CVE-2026-51723 | Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-51722 | Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-51721 | Incorrect access control in the setPairCfg function of TOTOLINK T6 4 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-51720 | Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-17615 | A flaw was found in RESTEasy's SourceProvider | HIGH | 7.5 | NVD | Aug 31, 2026 |
| CVE-2026-14366 | The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drive | MEDIUM | 6.4 | NVD | Aug 31, 2026 |
| CVE-2026-82807 | A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1 | HIGH | 8.8 | NVD | Aug 31, 2026 |
| CVE-2026-77975 | The affected Ebyte product exports administrative credentials and other sensi | MEDIUM | 6.5 | NVD | Aug 31, 2026 |
| CVE-2026-77966 | The affectedย Ebyte productย does not provide separation between limited and adm | HIGH | 8.8 | NVD | Aug 31, 2026 |
| CVE-2026-76133 | The affectedย Ebyte product uses a deprecated hashing algorithm in an authenti | CRITICAL | 9.8 | NVD | Aug 31, 2026 |
| CVE-2026-75133 | Keep Backup Daily plugin for WordPress before 2 | HIGH | 7.5 | NVD | Aug 31, 2026 |
| CVE-2026-75132 | WAPT Server versions 2 | MEDIUM | 6.5 | NVD | Aug 31, 2026 |
| CVE-2026-73819 | The affectedย Ebyte product's vendor configuration utility permits access to ad | CRITICAL | 9.8 | NVD | Aug 31, 2026 |
| CVE-2026-82691 | A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-34 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-82690 | A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-82689 | A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 | CRITICAL | 9.9 | NVD | Aug 31, 2026 |
| CVE-2026-71257 | Wicket โ Apache Wicket enforces the upload limits configured on a for | HIGH | 7.5 | NVD | Aug 31, 2026 |
| CVE-2026-82880 | YaCy Search Server through 1 | HIGH | 7.5 | NVD | Aug 31, 2026 |
| CVE-2026-82879 | DataEase before 2 | MEDIUM | 6.3 | NVD | Aug 31, 2026 |
| CVE-2026-82878 | DataEase versions before 2 | MEDIUM | 6.3 | NVD | Aug 31, 2026 |
| CVE-2026-82877 | ILIAS versions before 9 | MEDIUM | 6.5 | NVD | Aug 31, 2026 |
| CVE-2026-82876 | Phison PS3111-S11 controller firmware verifies RSA signatures using a public mod | HIGH | 8.2 | NVD | Aug 31, 2026 |
| CVE-2026-82688 | A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1 | CRITICAL | 9.1 | NVD | Aug 31, 2026 |
| CVE-2026-82680 | A weakness has been identified in D-Link DSM-G600 1 | HIGH | 8.8 | NVD | Aug 31, 2026 |
| CVE-2026-82679 | A security flaw has been discovered in diem-project diem up to 5 | MEDIUM | 6.3 | NVD | Aug 31, 2026 |
| CVE-2026-58301 | Shiro โ When Apache Shiro is used with the Jakarta EE integration mo | MEDIUM | 6.5 | NVD | Aug 31, 2026 |
| CVE-2026-82628 | A vulnerability was found in Colorful iGameCenter 2 | HIGH | 8.8 | NVD | Aug 31, 2026 |
| CVE-2026-58574 | Dell PowerStore contains a Missing Authentication for Critical Function vulnerab | CRITICAL | 9.8 | NVD | Aug 31, 2026 |
| CVE-2026-40463 | WaveSuite is affected by an insufficient role-based access control vulnerability | HIGH | 7.6 | NVD | Aug 31, 2026 |
| CVE-2026-82621 | A weakness has been identified in Soarkey StudentManagement and ๅญฆ็ไฟกๆฏ็ฎก็็ณป็ป up to e | HIGH | 7.3 | NVD | Aug 31, 2026 |
| CVE-2026-82620 | A security flaw has been discovered in Soarkey StudentManagement and ๅญฆ็ไฟกๆฏ็ฎก็็ณป็ป up | MEDIUM | 6.3 | NVD | Aug 31, 2026 |
| CVE-2026-82616 | A vulnerability was found in TOTOLINK NR1800X 9 | CRITICAL | 9.9 | NVD | Aug 31, 2026 |
| CVE-2026-82615 | A vulnerability has been found in itsourcecode Online Medicine Delivery System 1 | HIGH | 7.3 | NVD | Aug 31, 2026 |
| CVE-2026-82614 | A flaw has been found in itsourcecode Online Medicine Delivery System 1 | HIGH | 7.3 | NVD | Aug 31, 2026 |
| CVE-2026-82600 | A security flaw has been discovered in SeaCMS up to 13 | HIGH | 7.3 | NVD | Aug 31, 2026 |
| CVE-2026-82598 | A vulnerability was determined in SeaCMS up to 13 | HIGH | 7.3 | NVD | Aug 31, 2026 |
| CVE-2026-82597 | A vulnerability was identified in TOTOLINK NR1800X 9 | HIGH | 7.4 | NVD | Aug 31, 2026 |
| CVE-2026-82595 | A vulnerability was found in D-Link DIR-825M 1 | HIGH | 7.4 | NVD | Aug 31, 2026 |
| CVE-2026-82593 | A flaw has been found in D-Link DIR-825M 1 | CRITICAL | 9.9 | NVD | Aug 31, 2026 |
| CVE-2026-81578 | PaperCut - NG/MF | CRITICAL | N/A | CISA | Aug 31, 2026 |
| EDB-52666 | [webapps] C-MOR 6.0104 - Directory Traversal | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52665 | [webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS) | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52664 | [webapps] CubeCart 6.7.4 - SQL injection | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52663 | [webapps] CubeCart 6.7.4 - SQL | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52662 | [webapps] CubeCart 6.7.4 - Stored XSS | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52661 | [webapps] CubeCart 6.7.4 - Cross-Site Scripting | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52660 | [webapps] Linksys E1200_2.0.04 - Unauthenticated OS Command Injection | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| EDB-52659 | [webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Aug 31, 2026 |
| CVE-2026-82078 | PaperCut - NG/MF | CRITICAL | N/A | CISA | Aug 31, 2026 |
| CVE-2026-82592 | A vulnerability was detected in D-Link DIR-825M 1 | CRITICAL | 9.9 | NVD | Aug 30, 2026 |
| CVE-2026-82556 | A vulnerability was found in Forgejo up to 15 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82553 | A vulnerability was detected in sambitraj Student Management System up to 56ba28 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82638 | jina-ai reader disables its private-address guard outside Google Cloud deploymen | HIGH | 7.5 | NVD | Aug 30, 2026 |
| CVE-2026-82636 | Qubes OS before qubes-core-dom0-linux 4 | HIGH | 7.9 | NVD | Aug 30, 2026 |
| CVE-2026-82635 | Pake before 3 | HIGH | 8.8 | NVD | Aug 30, 2026 |
| CVE-2026-82634 | Frappe Framework development builds contain an authorization flaw in the render_ | MEDIUM | 6.5 | NVD | Aug 30, 2026 |
| CVE-2026-82543 | A vulnerability was detected in vastsa FileCodeBox up to 2 | HIGH | 7.3 | NVD | Aug 30, 2026 |
| CVE-2026-82542 | A weakness has been identified in Tenda HG10 300001138 | CRITICAL | 10.0 | NVD | Aug 30, 2026 |
| CVE-2026-82541 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82540 | A vulnerability was identified in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82539 | A vulnerability was determined in TOTOLINK A720R 4 | CRITICAL | 9.1 | NVD | Aug 30, 2026 |
| CVE-2026-82487 | A vulnerability was determined in Beetel 450TC3 01 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82485 | A vulnerability has been found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82484 | A flaw has been found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-81766 | The Really Simple Security WordPress plugin before 9 | MEDIUM | 6.6 | NVD | Aug 30, 2026 |
| CVE-2026-81660 | The Groundhogg โ CRM, Newsletters, and Marketing Automation WordPress plugin bef | HIGH | 8.8 | NVD | Aug 30, 2026 |
| CVE-2026-76585 | The Customer Reviews for WooCommerce WordPress plugin before 5 | HIGH | 8.8 | NVD | Aug 30, 2026 |
| CVE-2026-14835 | The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3 | MEDIUM | 6.8 | NVD | Aug 30, 2026 |
| CVE-2026-14307 | The geotargetingwp WordPress plugin before 3 | HIGH | 7.1 | NVD | Aug 30, 2026 |
| CVE-2026-82480 | A security flaw has been discovered in NASA cFS up to 7 | HIGH | 7.4 | NVD | Aug 30, 2026 |
| CVE-2026-82479 | A vulnerability was identified in NASA cFS up to 7 | MEDIUM | 6.3 | NVD | Aug 30, 2026 |
| CVE-2026-82478 | A vulnerability was determined in NASA Trick 19 | HIGH | 7.3 | NVD | Aug 30, 2026 |
| CVE-2026-15980 | The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in a | CRITICAL | 9.8 | NVD | Aug 30, 2026 |
| CVE-2026-82424 | A weakness has been identified in PHPGurukul Student Information System 1 | MEDIUM | 6.3 | NVD | Aug 29, 2026 |
| CVE-2026-82422 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 29, 2026 |
| CVE-2026-82421 | A vulnerability was identified in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 29, 2026 |
| CVE-2026-15369 | The Custom User Registration Fields for WooCommerce plugin for WordPress is vuln | CRITICAL | 9.8 | NVD | Aug 29, 2026 |
| CVE-2026-75807 | The SAML Single Sign On โ SSO Login plugin for WordPress is vulnerable to Authen | HIGH | 7.5 | NVD | Aug 29, 2026 |
| CVE-2026-82475 | iFlytek astron-agent through 1 | HIGH | 8.1 | NVD | Aug 29, 2026 |
| CVE-2026-82474 | Sudo through 1 | HIGH | 7.8 | NVD | Aug 29, 2026 |
| CVE-2026-82473 | KubeEdge CloudCore through 1 | HIGH | 8.2 | NVD | Aug 29, 2026 |
| CVE-2026-82472 | Documenso before 2 | HIGH | 7.5 | NVD | Aug 29, 2026 |
| CVE-2026-82466 | Rodauth before 2 | HIGH | 8.7 | NVD | Aug 29, 2026 |
| CVE-2026-82464 | pac4j-core before 6 | MEDIUM | 6.1 | NVD | Aug 29, 2026 |
| CVE-2026-82463 | pac4j-core before 6 | HIGH | 8.1 | NVD | Aug 29, 2026 |
| CVE-2026-82462 | pac4j-oidc before 6 | MEDIUM | 6.5 | NVD | Aug 29, 2026 |
| CVE-2026-82461 | pac4j-oidc before 6 | HIGH | 8.1 | NVD | Aug 29, 2026 |
| CVE-2026-82460 | Cloud Commander before 19 | CRITICAL | 9.8 | NVD | Aug 29, 2026 |
| CVE-2026-82457 | su-exec through 0 | HIGH | 7.8 | NVD | Aug 29, 2026 |
| CVE-2026-82456 | argocd-mcp 0 | CRITICAL | 10.0 | NVD | Aug 29, 2026 |
| CVE-2026-82455 | RubyGems fails to re-validate path containment after filesystem symlink resoluti | HIGH | 7.1 | NVD | Aug 29, 2026 |
| CVE-2026-82454 | The Omnivore API (packages/api) before the fix in commit abf53d6 contains an aut | CRITICAL | 9.1 | NVD | Aug 29, 2026 |
| CVE-2026-82453 | rust-iot-platform through commit 5df942ab stores user passwords in cleartext wit | HIGH | 7.5 | NVD | Aug 29, 2026 |
| CVE-2026-82452 | rust-iot-platform through commit 5df942ab contains an authentication bypass vuln | CRITICAL | 9.8 | NVD | Aug 29, 2026 |
| CVE-2026-82451 | Formwork through 2 | MEDIUM | 6.1 | NVD | Aug 29, 2026 |
| CVE-2026-82450 | BookStack before 26 | HIGH | 8.8 | NVD | Aug 29, 2026 |
| CVE-2026-82448 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child | CRITICAL | 9.8 | NVD | Aug 29, 2026 |
| CVE-2026-82447 | Skyvern before 1 | HIGH | 8.8 | NVD | Aug 29, 2026 |
| CVE-2026-14494 | The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution | CRITICAL | 9.8 | NVD | Aug 29, 2026 |
| CVE-2026-77012 | The ็ฑ้้ๆฐๆฎ้้ๅๅๅธๆไปถ WordPress plugin through 1 | CRITICAL | 9.3 | NVD | Aug 29, 2026 |
| CVE-2026-77010 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through | MEDIUM | 6.5 | NVD | Aug 29, 2026 |
| CVE-2026-77008 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through | MEDIUM | 6.5 | NVD | Aug 29, 2026 |
| CVE-2026-77007 | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through | HIGH | 7.5 | NVD | Aug 29, 2026 |
| CVE-2026-76586 | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin | HIGH | 7.5 | NVD | Aug 29, 2026 |
| CVE-2026-76548 | The User Profile Builder WordPress plugin before 4 | HIGH | 8.2 | NVD | Aug 29, 2026 |
| CVE-2026-76547 | The User Profile Builder WordPress plugin before 4 | MEDIUM | 6.6 | NVD | Aug 29, 2026 |
| CVE-2026-76546 | The User Profile Builder WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Aug 29, 2026 |
| CVE-2026-18234 | The MStore API WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Aug 29, 2026 |
| CVE-2026-18233 | The MStore API WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Aug 29, 2026 |
| CVE-2026-16947 | The Total processing card payments for WooCommerce WordPress plugin through 7 | CRITICAL | 9.1 | NVD | Aug 29, 2026 |
| CVE-2026-16600 | The SmartAIPress WordPress plugin through 1 | HIGH | 7.7 | NVD | Aug 29, 2026 |
| CVE-2026-16259 | The Uix UserCenter WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Aug 29, 2026 |
| CVE-2026-16061 | The Rest Routes WordPress plugin through 5 | HIGH | 8.6 | NVD | Aug 29, 2026 |
| CVE-2026-41012 | Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers | HIGH | 7.7 | NVD | Aug 29, 2026 |
| CVE-2026-55855 | MariaDB Connector/Node | MEDIUM | 6.5 | NVD | Aug 28, 2026 |
| CVE-2026-55848 | mapfish-print is a component of MapFish for printing templated cartographic maps | HIGH | 8.6 | NVD | Aug 28, 2026 |
| CVE-2026-55841 | Graylog is a free and open log management platform | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-55784 | free5GC is an open-source implementation of the 5G core network | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-42391 | An unauthenticated attacker can send an IMAP ID command with a very large number | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-42007 | An attacker that has valid credentials can use a Sieve script with the editheade | CRITICAL | 9.1 | NVD | Aug 28, 2026 |
| CVE-2026-40018 | None None None No publicly available exploits are known | HIGH | 7.4 | NVD | Aug 28, 2026 |
| CVE-2026-40017 | An attacker that can send mail to a user can craft a message header whose values | MEDIUM | 6.5 | NVD | Aug 28, 2026 |
| CVE-2026-40014 | An attacker that can send mail to a user can craft a message header that makes t | MEDIUM | 6.5 | NVD | Aug 28, 2026 |
| CVE-2026-33605 | An unauthenticated attacker can crash the ManageSieve login process by sending a | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-27852 | An attacker that can send mail to a user can craft a message whose headers conta | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-40541 | An improper neutralization of input during web page generation ('Cross-site Scri | CRITICAL | 9.0 | NVD | Aug 28, 2026 |
| CVE-2026-19423 | The Ultimate Member WordPress plugin before 2 | HIGH | 8.1 | NVD | Aug 28, 2026 |
| CVE-2026-19084 | The shared-files-pro WordPress plugin before 1 | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-14558 | The User Frontend WordPress plugin before 4 | HIGH | 7.2 | NVD | Aug 28, 2026 |
| CVE-2026-12513 | The Shared Files WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Aug 28, 2026 |
| CVE-2026-82082 | NUMail developed by Green-Computing has an OS Command Injection vulnerability | CRITICAL | 9.8 | NVD | Aug 28, 2026 |
| CVE-2026-82081 | wallabag 2 through 2 | MEDIUM | 6.4 | NVD | Aug 28, 2026 |
| CVE-2026-77365 | The Optimole โ Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image O | HIGH | 7.2 | NVD | Aug 28, 2026 |
| CVE-2026-76053 | The TranslatePress โ Translate Multilingual sites with AI Translation plugin for | HIGH | 7.2 | NVD | Aug 28, 2026 |
| CVE-2026-3129 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri | MEDIUM | 6.4 | NVD | Aug 28, 2026 |
| CVE-2026-18983 | The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-18978 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scri | HIGH | 7.2 | NVD | Aug 28, 2026 |
| CVE-2026-18324 | The Forminator Forms โ Contact Form, Payment Form & Custom Form Builder plugin f | HIGH | 7.2 | NVD | Aug 28, 2026 |
| CVE-2026-16759 | The Tutor LMS โ eLearning and online course solution plugin for WordPress is vul | MEDIUM | 6.5 | NVD | Aug 28, 2026 |
| CVE-2026-16654 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Si | MEDIUM | 6.4 | NVD | Aug 28, 2026 |
| CVE-2026-15798 | The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scrip | MEDIUM | 6.4 | NVD | Aug 28, 2026 |
| CVE-2026-54330 | Ceph is an open-source distributed storage platform providing object, block, and | HIGH | 8.1 | NVD | Aug 28, 2026 |
| CVE-2026-54085 | Wazuh is an open-source security platform providing unified XDR and SIEM protect | HIGH | 7.1 | NVD | Aug 28, 2026 |
| CVE-2026-54083 | Wazuh is an open-source security platform providing unified XDR and SIEM protect | HIGH | 8.1 | NVD | Aug 28, 2026 |
| CVE-2026-50152 | Ceph is an open-source distributed storage platform providing object, block, and | CRITICAL | 9.1 | NVD | Aug 28, 2026 |
| CVE-2026-44629 | Improper access control to the Synergis Softwire installation folder | HIGH | 7.9 | NVD | Aug 28, 2026 |
| CVE-2026-39944 | Ceph is an open-source distributed storage platform providing object, block, and | HIGH | 8.8 | NVD | Aug 28, 2026 |
| CVE-2026-38350 | An integer overflow in the target_sws_fuzzer() function (libswscale/output | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-38349 | An integer overflow in the hScale16To19_c() function (libswscale/output | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-38348 | An integer overflow in the libswscale/utils | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-38346 | An integer overflow in the yuv2planeX_8_c() function (libswscale/output | HIGH | 7.5 | NVD | Aug 28, 2026 |
| CVE-2026-18965 | PayRange APIย is missing proper authorization on management endpoints, which allo | HIGH | 8.8 | NVD | Aug 28, 2026 |
| CVE-2026-18717 | ASE2000 2 | HIGH | 7.4 | NVD | Aug 28, 2026 |
| CVE-2025-30156 | Ceph is an open-source distributed storage platform providing object, block, and | HIGH | 8.9 | NVD | Aug 28, 2026 |
| CVE-2026-81658 | A flaw was found in Foreman | MEDIUM | 6.5 | NVD | Aug 27, 2026 |
| CVE-2026-74233 | Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, an | CRITICAL | 9.8 | NVD | Aug 27, 2026 |
| CVE-2026-74232 | Zbtlink L3_V2_8 firmware 3 | CRITICAL | 9.8 | NVD | Aug 27, 2026 |
| CVE-2026-66155 | A vulnerability has been identified in Element maps-ng V47 (All versions < V47 | HIGH | 7.6 | NVD | Aug 27, 2026 |
| CVE-2026-17562 | Authorization bypass through User-Controlled key vulnerability in Summit Securit | MEDIUM | 6.5 | NVD | Aug 27, 2026 |
| CVE-2026-13415 | The CMP WordPress plugin before 4 | HIGH | 7.2 | NVD | Aug 27, 2026 |
| CVE-2026-47856 | Spring Integration's JSON to object conversion uses the json__TypeId__ header to | MEDIUM | 6.3 | NVD | Aug 27, 2026 |
| CVE-2026-47852 | A local attacker on a multi-user host can pre-create the deterministic cache pat | HIGH | 7.5 | NVD | Aug 27, 2026 |
| CVE-2026-47851 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a Sta | HIGH | 7.5 | NVD | Aug 27, 2026 |
| CVE-2026-66384 | JFrog - Artifactory | CRITICAL | N/A | CISA | Aug 27, 2026 |
| CVE-2026-53362 | Linux - Kernel | CRITICAL | N/A | CISA | Aug 27, 2026 |
| CVE-2023-49105 | ownCloud - ownCloud | CRITICAL | N/A | CISA | Aug 27, 2026 |
| CVE-2026-81203 | A vulnerability has been found in SourceCodester Simple Online Food Ordering Sys | HIGH | 7.3 | NVD | Aug 26, 2026 |
| CVE-2026-75340 | The device metadata import interface /device/instance/{productId}/property-metad | CRITICAL | 9.1 | NVD | Aug 26, 2026 |
| CVE-2026-75338 | disconf (Distributed Configuration Management Platform) 2 | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-75336 | Funiture 1 | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-75332 | Zyplayer-Doc <=1 | CRITICAL | 9.1 | NVD | Aug 26, 2026 |
| CVE-2026-75330 | The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of s | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-47666 | Penpot is an open-source design and prototyping platform | HIGH | 7.6 | NVD | Aug 26, 2026 |
| CVE-2026-47665 | Penpot is an open-source design and prototyping platform | HIGH | 8.7 | NVD | Aug 26, 2026 |
| CVE-2025-61163 | Cohere North AI v1 | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2025-61162 | Incorrect access control in Cohere North AI v1 | HIGH | 7.5 | NVD | Aug 26, 2026 |
| CVE-2026-58474 | whichllm before 0 | HIGH | 8.8 | NVD | Aug 26, 2026 |
| CVE-2026-47841 | An application using Spring Security's WebAuthn support may be vulnerable to use | HIGH | 7.4 | NVD | Aug 26, 2026 |
| CVE-2026-47837 | Missing Authentication for Critical Function vulnerability in Spring Spring Clou | MEDIUM | 6.8 | NVD | Aug 26, 2026 |
| CVE-2026-47836 | The base directory (spring | HIGH | 7.2 | NVD | Aug 26, 2026 |
| CVE-2026-32639 | Winter CMS is a content management system built on the Laravel PHP framework | MEDIUM | 6.8 | NVD | Aug 26, 2026 |
| CVE-2025-56798 | Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc | HIGH | 8.8 | NVD | Aug 26, 2026 |
| CVE-2026-32258 | Winter is a free, open-source content management system (CMS) based on the Larav | HIGH | 8.1 | NVD | Aug 26, 2026 |
| CVE-2026-32257 | Winter is a free, open-source content management system (CMS) based on the Larav | HIGH | 8.1 | NVD | Aug 26, 2026 |
| CVE-2026-63041 | Apisix โ Reliance on Untrusted Inputs in a Security Decision vulnerab | HIGH | 8.8 | NVD | Aug 26, 2026 |
| CVE-2026-15985 | The Classified Listing - Mobile Number Verification plugin for WordPress is vuln | HIGH | 8.1 | NVD | Aug 26, 2026 |
| CVE-2026-80205 | NLTK versions before 3 | HIGH | 7.5 | NVD | Aug 26, 2026 |
| CVE-2026-80203 | The getgrav/grav-plugin-api plugin before 1 | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-77557 | A malicious actor with access to the network could exploit an Improper Access Co | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-77554 | A malicious actor with access to the network could exploit an Improper Input Val | CRITICAL | 10.0 | NVD | Aug 26, 2026 |
| CVE-2026-77553 | A malicious actor with access to the network and low privileges could exploit an | CRITICAL | 9.9 | NVD | Aug 26, 2026 |
| CVE-2026-77552 | A malicious actor with access to the network could exploit an Improper Input Val | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-77551 | A malicious actor with access to the network and under certain conditions could | CRITICAL | 9.0 | NVD | Aug 26, 2026 |
| CVE-2026-77550 | A malicious actor with access to the network could exploit an Improper Neutraliz | CRITICAL | 10.0 | NVD | Aug 26, 2026 |
| CVE-2026-77549 | A malicious actor with access to the network and under certain conditions could | CRITICAL | 9.0 | NVD | Aug 26, 2026 |
| CVE-2026-77548 | A malicious actor with access to the network and low privileges could exploit an | CRITICAL | 9.9 | NVD | Aug 26, 2026 |
| CVE-2026-77547 | A malicious actor with access to the network and low privileges could exploit an | CRITICAL | 9.9 | NVD | Aug 26, 2026 |
| CVE-2026-77546 | A malicious actor with access to the network and low privileges could exploit an | CRITICAL | 9.9 | NVD | Aug 26, 2026 |
| CVE-2026-77532 | A malicious actor with access to an adjacent network could exploit a Buffer Over | CRITICAL | 9.6 | NVD | Aug 26, 2026 |
| CVE-2026-5092 | The Greenshift โ animation and page builder blocks plugin for WordPress is vulne | MEDIUM | 6.4 | NVD | Aug 26, 2026 |
| CVE-2026-18080 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for Wo | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2026-80196 | Kimai before 2 | HIGH | 7.5 | NVD | Aug 26, 2026 |
| CVE-2026-80193 | Kimai before 2 | HIGH | 8.8 | NVD | Aug 26, 2026 |
| CVE-2026-80192 | @better-auth/sso before 1 | HIGH | 8.1 | NVD | Aug 26, 2026 |
| CVE-2026-80191 | GROWI applies its page-viewer permission check to attachment requests only when | HIGH | 7.5 | NVD | Aug 26, 2026 |
| CVE-2026-80189 | LeafWiki extracts an uploaded ZIP archive without limiting how much data it will | MEDIUM | 6.5 | NVD | Aug 26, 2026 |
| CVE-2026-58092 | In FreeBSD 15 | HIGH | 8.1 | NVD | Aug 26, 2026 |
| CVE-2026-58091 | The implementation of this ioctl attempts to acquire locks on all channels in a | HIGH | 7.8 | NVD | Aug 26, 2026 |
| CVE-2026-58090 | The SOCK_STREAM receive path in the unix socket implementation failed to fully d | HIGH | 7.8 | NVD | Aug 26, 2026 |
| CVE-2026-58089 | When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is | HIGH | 7.8 | NVD | Aug 26, 2026 |
| CVE-2026-57171 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing | HIGH | 7.7 | NVD | Aug 26, 2026 |
| CVE-2026-57170 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing | HIGH | 7.8 | NVD | Aug 26, 2026 |
| CVE-2026-54467 | On the Trusted Firmware-M (TF-M) 2 through 2 | HIGH | 7.0 | NVD | Aug 26, 2026 |
| CVE-2026-29988 | A cleartext transmission of sensitive information vulnerability in the NFC inter | HIGH | 7.6 | NVD | Aug 26, 2026 |
| CVE-2026-19632 | The TranslatePress โ Translate Multilingual sites with AI Translation plugin for | CRITICAL | 9.8 | NVD | Aug 26, 2026 |
| CVE-2021-23758 | Ajax.NET Professional - Ajax.NET Professional | CRITICAL | N/A | CISA | Aug 26, 2026 |
| CVE-2019-1068 | Microsoft - SQL Server | CRITICAL | N/A | CISA | Aug 26, 2026 |
| CVE-2026-8452 | Citrix - NetScaler ADC and NetScaler Gateway | CRITICAL | N/A | CISA | Aug 26, 2026 |
| CVE-2022-0995 | Linux - Kernel | CRITICAL | N/A | CISA | Aug 26, 2026 |
| CVE-2015-5287 | Red Hat - Automatic Bug Reporting Tool | CRITICAL | N/A | CISA | Aug 26, 2026 |
| CVE-2015-3246 | Red Hat - Libuser | CRITICAL | N/A | CISA | Aug 26, 2026 |
| CVE-2026-54757 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing | HIGH | 7.8 | NVD | Aug 25, 2026 |
| CVE-2026-41707 | Authentication Bypass by Capture-replay vulnerability in Spring Spring Security | HIGH | 7.4 | NVD | Aug 25, 2026 |
| CVE-2026-18985 | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Force | HIGH | 8.1 | NVD | Aug 25, 2026 |
| CVE-2026-18259 | Observable Timing Discrepancy vulnerability in Drupal Token Content Access allow | HIGH | 7.5 | NVD | Aug 25, 2026 |
| CVE-2026-16645 | Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript | CRITICAL | 9.1 | NVD | Aug 25, 2026 |
| CVE-2026-16644 | Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Bro | CRITICAL | 9.1 | NVD | Aug 25, 2026 |
| CVE-2026-16641 | Vulnerability in Drupal Commerce Elavon | CRITICAL | 9.8 | NVD | Aug 25, 2026 |
| CVE-2026-16640 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti | MEDIUM | 6.1 | NVD | Aug 25, 2026 |
| CVE-2026-16639 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal | CRITICAL | 9.8 | NVD | Aug 25, 2026 |
| CVE-2026-16638 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti | MEDIUM | 6.1 | NVD | Aug 25, 2026 |
| CVE-2026-55553 | urllib is an HTTP client for Node | HIGH | 7.5 | NVD | Aug 25, 2026 |
| CVE-2026-47626 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privil | HIGH | 8.2 | NVD | Aug 25, 2026 |
| CVE-2026-47624 | NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/a | MEDIUM | 6.0 | NVD | Aug 25, 2026 |
| CVE-2026-24263 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privil | HIGH | 8.2 | NVD | Aug 25, 2026 |
| CVE-2026-24262 | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privil | HIGH | 8.2 | NVD | Aug 25, 2026 |
| CVE-2026-24225 | NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an | MEDIUM | 6.0 | NVD | Aug 25, 2026 |
| CVE-2026-24170 | NVIDIA UFM Enterprise contains a vulnerability in the web interface authorizatio | HIGH | 8.8 | NVD | Aug 25, 2026 |
| CVE-2026-24169 | NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, whe | HIGH | 8.0 | NVD | Aug 25, 2026 |
| CVE-2026-24168 | NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an aut | MEDIUM | 6.8 | NVD | Aug 25, 2026 |
| CVE-2026-24167 | NVIDIA UFM Enterprise contains a vulnerability in the user management component, | MEDIUM | 6.8 | NVD | Aug 25, 2026 |
| CVE-2026-19913 | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure v | HIGH | 7.5 | NVD | Aug 25, 2026 |
| CVE-2026-18445 | There is an integer overflow vulnerability resulting in an out-of-bounds write r | MEDIUM | 6.6 | NVD | Aug 25, 2026 |
| CVE-2026-18444 | There is an integer conversion vulnerability resulting in an out-of-bounds read | MEDIUM | 6.6 | NVD | Aug 25, 2026 |
| CVE-2026-16234 | There is a memory corruption vulnerability recently discovered in NI LabVIEW tha | HIGH | 7.8 | NVD | Aug 25, 2026 |
| CVE-2026-16233 | There is a memory corruption vulnerability recently discovered in NI LabVIEW tha | HIGH | 7.8 | NVD | Aug 25, 2026 |
| CVE-2026-13216 | The virtio PCI driver (drivers/virtio/virtio_pci | MEDIUM | 6.1 | NVD | Aug 25, 2026 |
| CVE-2026-75971 | The ShopEngine Elementor WooCommerce Builder Addon โ All in One WooCommerce Solu | HIGH | 7.2 | NVD | Aug 25, 2026 |
| CVE-2026-19949 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL | HIGH | 8.8 | NVD | Aug 25, 2026 |
| CVE-2026-18547 | The Ultimate Member โ User Profile, Registration, Login, Member Directory, Conte | MEDIUM | 6.4 | NVD | Aug 25, 2026 |
| CVE-2026-78863 | A vulnerability was found in liketrek TREK up to 3 | MEDIUM | 6.3 | NVD | Aug 25, 2026 |
| CVE-2026-59335 | Improper handling of case sensitivity (CWE-178) in the identity zone authorizati | HIGH | 8.7 | NVD | Aug 25, 2026 |
| CVE-2026-55976 | Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hiv | CRITICAL | 9.1 | NVD | Aug 25, 2026 |
| CVE-2026-53561 | An improper authentication vulnerability in HiveServer2 SAML bearer-token valida | HIGH | 7.4 | NVD | Aug 25, 2026 |
| CVE-2026-49845 | SQL injection in Hive Metastore direct SQL partition-name resolution in Apache H | CRITICAL | 9.8 | NVD | Aug 25, 2026 |
| CVE-2026-18100 | The MetForm โ Contact Form, Survey, Quiz, & Custom Form Builder for Elementor pl | MEDIUM | 6.4 | NVD | Aug 25, 2026 |
| CVE-2026-16601 | The CM Map Locations โ Visualize and share your locations in a few clicks plugin | HIGH | 8.8 | NVD | Aug 25, 2026 |
| CVE-2026-78656 | A vulnerability was found in itsourcecode Sales and Inventory System 1 | MEDIUM | 6.3 | NVD | Aug 25, 2026 |
| CVE-2026-78654 | A vulnerability has been found in cleverbrush framework and deep up to 4 | HIGH | 7.3 | NVD | Aug 25, 2026 |
| CVE-2026-78478 | The Mane theme for WordPress is vulnerable to Local File Inclusion in all versio | HIGH | 8.1 | NVD | Aug 25, 2026 |
| CVE-2026-78477 | The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versio | CRITICAL | 9.8 | NVD | Aug 25, 2026 |
| CVE-2026-78470 | The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection i | MEDIUM | 6.5 | NVD | Aug 25, 2026 |
| CVE-2026-78637 | A vulnerability was detected in Fdawgs node-poppler up to 9 | HIGH | 7.3 | NVD | Aug 25, 2026 |
| CVE-2026-13215 | The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field o | MEDIUM | 6.8 | NVD | Aug 25, 2026 |
| CVE-2026-13214 | The OCPP 1 | CRITICAL | 9.8 | NVD | Aug 25, 2026 |
| CVE-2026-12561 | The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scri | MEDIUM | 6.4 | NVD | Aug 25, 2026 |
| CVE-2026-56706 | Adminer before 5 | MEDIUM | 6.8 | NVD | Aug 25, 2026 |
| CVE-2026-56705 | Adminer before 5 | CRITICAL | 9.8 | NVD | Aug 25, 2026 |
| CVE-2026-56704 | Adminer before 5 | MEDIUM | 6.1 | NVD | Aug 25, 2026 |
| CVE-2026-56703 | Adminer before 5 | HIGH | 7.2 | NVD | Aug 25, 2026 |
| CVE-2026-56702 | Adminer versions before 5 | HIGH | 8.8 | NVD | Aug 25, 2026 |
| CVE-2026-34968 | Adminer before 5 | HIGH | 8.1 | NVD | Aug 25, 2026 |
| CVE-2026-15023 | The Events Manager โ Calendar, Bookings, Tickets, and more! plugin for WordPress | MEDIUM | 6.5 | NVD | Aug 25, 2026 |
| CVE-2026-66766 | SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular | HIGH | 7.5 | NVD | Aug 25, 2026 |
| CVE-2026-55373 | OpenEXR is the reference implementation and specification for the EXR image form | MEDIUM | 6.2 | NVD | Aug 25, 2026 |
| CVE-2026-55059 | OpenEXR is the reference implementation and specification for the EXR image form | MEDIUM | 6.1 | NVD | Aug 25, 2026 |
| CVE-2026-60004 | Gitea - Gitea | CRITICAL | N/A | CISA | Aug 25, 2026 |
| EDB-52658 | [remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE | HIGH | 8.1 | EXPLOIT-DB | Aug 25, 2026 |
| CVE-2026-78465 | A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only | HIGH | 7.0 | NVD | Aug 24, 2026 |
| CVE-2026-77915 | rConfig Core 8 | CRITICAL | 9.8 | NVD | Aug 24, 2026 |
| CVE-2026-77914 | rConfig Core 8 | MEDIUM | 6.5 | NVD | Aug 24, 2026 |
| CVE-2026-71300 | Improper input validation vulnerability in Apache Camel Atmosphere Websocket com | CRITICAL | 9.8 | NVD | Aug 24, 2026 |
| CVE-2026-66908 | Improper Authentication vulnerability in Apache Camel Platform HTTP Main compone | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-66907 | Relative path traversal vulnerability in Apache Camel Google Storage component | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-66906 | Relative path traversal vulnerability in Apache Camel Azure Storage Blob compone | CRITICAL | 9.1 | NVD | Aug 24, 2026 |
| CVE-2026-59230 | Improper input validation vulnerability in Apache Camel | MEDIUM | 6.5 | NVD | Aug 24, 2026 |
| CVE-2026-19685 | NetworkManager did not apply the private_user restriction to the 802-1x | HIGH | 7.1 | NVD | Aug 24, 2026 |
| CVE-2025-36940 | Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which cou | HIGH | 8.8 | NVD | Aug 24, 2026 |
| CVE-2026-32477 | Unauthenticated Arbitrary File Deletion in ShopBuilder Pro โ Elementor WooCommer | HIGH | 8.6 | NVD | Aug 24, 2026 |
| CVE-2026-32476 | Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0 | HIGH | 7.1 | NVD | Aug 24, 2026 |
| CVE-2026-32471 | Subscriber SQL Injection in ProLancer Element <= 1 | HIGH | 8.5 | NVD | Aug 24, 2026 |
| CVE-2026-28190 | Subscriber Broken Access Control in ProLancer Element <= 1 | HIGH | 7.1 | NVD | Aug 24, 2026 |
| CVE-2026-28171 | Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10 | HIGH | 8.6 | NVD | Aug 24, 2026 |
| CVE-2026-28167 | Unauthenticated Arbitrary File Download in Super Forms <= 6 | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-28166 | Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5 | HIGH | 7.1 | NVD | Aug 24, 2026 |
| CVE-2026-28165 | Unauthenticated Privilege Escalation in Digits <= 9 | CRITICAL | 9.8 | NVD | Aug 24, 2026 |
| CVE-2026-28162 | Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3 | HIGH | 7.1 | NVD | Aug 24, 2026 |
| CVE-2026-28153 | Unauthenticated Broken Access Control in Notification Master – Real-Time W | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-28152 | Unauthenticated Local File Inclusion in Tonda Core < 2 | HIGH | 8.1 | NVD | Aug 24, 2026 |
| CVE-2026-28151 | Unauthenticated Local File Inclusion in Tonda < 2 | HIGH | 8.1 | NVD | Aug 24, 2026 |
| CVE-2026-78245 | A flaw has been found in itsourcecode Online Pharmacy System 1 | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78244 | A vulnerability was detected in itsourcecode Real Estate Management System 1 | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-76172 | fast-uri is a URI parser for Node | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-10582 | Hugo's security | HIGH | 7.4 | NVD | Aug 24, 2026 |
| CVE-2026-75931 | fast-uri is a URI parser for Node | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-75899 | fast-uri is a URI parser for Node | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an a | CRITICAL | 9.9 | NVD | Aug 24, 2026 |
| CVE-2026-78202 | A vulnerability was found in itsourcecode Payroll System 1 | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78201 | A vulnerability has been found in itsourcecode Payroll System 1 | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78200 | A flaw has been found in itsourcecode Library Management System 1 | MEDIUM | 6.3 | NVD | Aug 24, 2026 |
| CVE-2026-78199 | A vulnerability was detected in SourceCodester Simple Online Food Ordering Syste | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78198 | A security vulnerability has been detected in SourceCodester Simple Online Food | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78197 | A weakness has been identified in SourceCodester Simple Online Food Ordering Sys | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78167 | A weakness has been identified in EFM ipTIME T16000M 14 | CRITICAL | 10.0 | NVD | Aug 24, 2026 |
| CVE-2026-78166 | A security flaw has been discovered in provectus kafka-ui up to 0 | MEDIUM | 6.3 | NVD | Aug 24, 2026 |
| CVE-2026-78209 | exceljs-hardened versions before 5 | HIGH | 8.2 | NVD | Aug 24, 2026 |
| CVE-2026-78208 | exceljs-hardened before 5 | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-78207 | exceljs-hardened before 5 | CRITICAL | 9.4 | NVD | Aug 24, 2026 |
| CVE-2026-78206 | exceljs-hardened before 5 | HIGH | 7.5 | NVD | Aug 24, 2026 |
| CVE-2026-78203 | Ghostwriter before 7 | HIGH | 7.1 | NVD | Aug 24, 2026 |
| CVE-2026-78161 | A vulnerability was found in warmcat libwebsockets 4 | HIGH | 7.3 | NVD | Aug 24, 2026 |
| CVE-2026-78160 | A vulnerability has been found in Dolibarr ERP up to 18 | MEDIUM | 6.3 | NVD | Aug 24, 2026 |
| CVE-2026-78158 | A flaw has been found in Open5GS 2 | MEDIUM | 6.3 | NVD | Aug 24, 2026 |
| CVE-2026-78157 | A vulnerability was detected in Open5GS 2 | HIGH | 7.4 | NVD | Aug 24, 2026 |
| CVE-2026-78156 | A security vulnerability has been detected in Open5GS 2 | HIGH | 7.4 | NVD | Aug 24, 2026 |
| CVE-2026-21962 | Oracle - HTTP Server and Oracle Weblogic Server Proxy Plug-in | CRITICAL | N/A | CISA | Aug 24, 2026 |
| CVE-2026-78147 | A vulnerability was found in ggml-org llama | HIGH | 7.3 | NVD | Aug 23, 2026 |
| CVE-2026-78144 | A vulnerability was identified in code-projects Barangay Resident Profiling Mana | MEDIUM | 6.3 | NVD | Aug 23, 2026 |
| CVE-2026-78143 | A vulnerability was determined in code-projects Barangay Resident Profiling Mana | HIGH | 7.3 | NVD | Aug 23, 2026 |
| CVE-2026-78142 | A vulnerability was found in code-projects Barangay Resident Profiling Managemen | MEDIUM | 6.3 | NVD | Aug 23, 2026 |
| CVE-2026-78141 | A vulnerability has been found in Tenda CH22 1 | HIGH | 7.4 | NVD | Aug 23, 2026 |
| CVE-2026-9769 | justhtml through 1 | HIGH | 7.5 | NVD | Aug 23, 2026 |
| CVE-2026-8630 | justhtml before 1 | MEDIUM | 6.1 | NVD | Aug 23, 2026 |
| CVE-2026-8445 | justhtml versions <= 1 | CRITICAL | 9.8 | NVD | Aug 23, 2026 |
| CVE-2026-7808 | justhtml before 1 | CRITICAL | 9.8 | NVD | Aug 23, 2026 |
| CVE-2026-77088 | justhtml versions 0 | MEDIUM | 6.1 | NVD | Aug 23, 2026 |
| CVE-2026-74793 | justhtml before 3 | MEDIUM | 6.1 | NVD | Aug 23, 2026 |
| CVE-2026-6827 | justhtml before 1 | MEDIUM | 6.1 | NVD | Aug 23, 2026 |
| CVE-2026-5751 | justhtml versions 1 | MEDIUM | 6.1 | NVD | Aug 23, 2026 |
| CVE-2026-5389 | justhtml versions before 1 | MEDIUM | 6.1 | NVD | Aug 23, 2026 |
| CVE-2026-5388 | justhtml before 1 | CRITICAL | 9.8 | NVD | Aug 23, 2026 |
| CVE-2026-4671 | justhtml before 1 | HIGH | 7.5 | NVD | Aug 23, 2026 |
| CVE-2026-78155 | privilege escalation in StackGres operator allows a low-privilege tenant who own | CRITICAL | 9.9 | NVD | Aug 23, 2026 |
| CVE-2026-78112 | A flaw has been found in itsourcecode Hospital Management System Project in PHP | MEDIUM | 6.3 | NVD | Aug 23, 2026 |
| CVE-2026-10053 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18 | HIGH | 8.5 | NVD | Aug 23, 2026 |
| CVE-2026-77115 | Brave Popup Builder (brave-popup-builder) up to version 0 | HIGH | 7.1 | NVD | Aug 23, 2026 |
| CVE-2026-78063 | A security flaw has been discovered in Tenda CH22 1 | HIGH | 7.4 | NVD | Aug 23, 2026 |
| CVE-2026-78062 | A vulnerability was identified in vas3k TaxHacker up to 0 | HIGH | 7.3 | NVD | Aug 23, 2026 |
| CVE-2026-78061 | A vulnerability was determined in vas3k TaxHacker up to 0 | MEDIUM | 6.3 | NVD | Aug 23, 2026 |
| CVE-2026-78057 | A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e903 | MEDIUM | 6.3 | NVD | Aug 23, 2026 |
| CVE-2026-78056 | A vulnerability was detected in sambitraj Student-Management-System up to 56ba28 | MEDIUM | 6.3 | NVD | Aug 23, 2026 |
| CVE-2026-78136 | chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data | HIGH | 7.8 | NVD | Aug 23, 2026 |
| CVE-2026-78050 | A vulnerability was found in Comfast CF-N1-S 2 | CRITICAL | 9.9 | NVD | Aug 23, 2026 |
| CVE-2026-18027 | The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping | MEDIUM | 6.5 | NVD | Aug 23, 2026 |
| CVE-2026-16149 | The Security Hardener plugin for WordPress is vulnerable to Missing Authorizatio | HIGH | 8.8 | NVD | Aug 23, 2026 |
| CVE-2026-0551 | The PPWP โ Password Protect Pages plugin for WordPress is vulnerable to PHP Obje | HIGH | 8.8 | NVD | Aug 23, 2026 |
| CVE-2026-78122 | docker-socket-proxy fails to properly gate read endpoints in the /containers Doc | HIGH | 7.4 | NVD | Aug 22, 2026 |
| CVE-2026-47895 | In strongSwan before 6 | HIGH | 7.5 | NVD | Aug 22, 2026 |
| CVE-2026-59808 | AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability w | HIGH | 8.8 | NVD | Aug 22, 2026 |
| CVE-2026-59256 | WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerabili | HIGH | 7.5 | NVD | Aug 22, 2026 |
| CVE-2026-58003 | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulner | HIGH | 7.1 | NVD | Aug 22, 2026 |
| CVE-2026-58002 | WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an | MEDIUM | 6.5 | NVD | Aug 22, 2026 |
| CVE-2026-57998 | better-npm-audit through 3 | HIGH | 7.8 | NVD | Aug 22, 2026 |
| CVE-2026-77988 | A weakness has been identified in TRENDnet TEW-823DRU 1 | MEDIUM | 6.6 | NVD | Aug 22, 2026 |
| CVE-2026-77946 | A vulnerability was determined in TRENDnet TEW-821DAP 2 | CRITICAL | 10.0 | NVD | Aug 22, 2026 |
| CVE-2026-77945 | A vulnerability was found in TRENDnet TEW-821DAP 2 | HIGH | 7.4 | NVD | Aug 22, 2026 |
| CVE-2026-78003 | The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Requ | CRITICAL | 9.8 | NVD | Aug 22, 2026 |
| CVE-2026-77002 | The SmilePass Selfie Login WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Aug 22, 2026 |
| CVE-2026-77001 | The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin t | CRITICAL | 9.8 | NVD | Aug 22, 2026 |
| CVE-2026-77000 | The WP Social Media Login WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Aug 22, 2026 |
| CVE-2026-76793 | The Firebase Authentication WordPress plugin before 1 | HIGH | 8.1 | NVD | Aug 22, 2026 |
| CVE-2026-76789 | The Slider Hero with Video Background, Animation WordPress plugin before 9 | HIGH | 8.8 | NVD | Aug 22, 2026 |
| CVE-2026-19222 | The Forminator Forms WordPress plugin before 1 | MEDIUM | 6.6 | NVD | Aug 22, 2026 |
| CVE-2026-19221 | The Forminator Forms WordPress plugin before 1 | HIGH | 7.2 | NVD | Aug 22, 2026 |
| CVE-2026-19093 | The Tutor LMS WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Aug 22, 2026 |
| CVE-2026-18052 | The ManageWP Worker WordPress plugin before 4 | HIGH | 8.1 | NVD | Aug 22, 2026 |
| CVE-2026-16260 | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1 | MEDIUM | 6.8 | NVD | Aug 22, 2026 |
| CVE-2026-19883 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorize | HIGH | 8.8 | NVD | Aug 22, 2026 |
| CVE-2026-53525 | WeeChat (Wee Enhanced Environment for Chat) is a free chat client | HIGH | 7.4 | NVD | Aug 21, 2026 |
| CVE-2026-53524 | WeeChat (Wee Enhanced Environment for Chat) is a free chat client | MEDIUM | 6.5 | NVD | Aug 21, 2026 |
| CVE-2026-34949 | Combodo iTop is a web based IT service management tool | MEDIUM | 6.5 | NVD | Aug 21, 2026 |
| CVE-2026-34948 | Combodo iTop is a web based IT service management tool | HIGH | 7.7 | NVD | Aug 21, 2026 |
| CVE-2026-39909 | llama | HIGH | 8.1 | NVD | Aug 21, 2026 |
| CVE-2026-59279 | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not | HIGH | 7.5 | NVD | Aug 21, 2026 |
| CVE-2026-19848 | The ProfilePress WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Aug 21, 2026 |
| CVE-2026-77769 | The report | MEDIUM | 6.5 | NVD | Aug 21, 2026 |
| CVE-2026-77768 | The report | MEDIUM | 6.5 | NVD | Aug 21, 2026 |
| CVE-2026-77767 | Reconmap's API applies a fallback authorization policy in apps/api/app/Program | HIGH | 7.5 | NVD | Aug 21, 2026 |
| CVE-2026-77763 | The filestore backend in pkg/object/file | MEDIUM | 6.5 | NVD | Aug 21, 2026 |
| CVE-2026-77683 | A security flaw has been discovered in Comfast CF-N1-S 2 | CRITICAL | 9.9 | NVD | Aug 21, 2026 |
| CVE-2026-77086 | SiYuan before v3 | CRITICAL | 9.1 | NVD | Aug 21, 2026 |
| CVE-2026-50112 | SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a | HIGH | 8.8 | NVD | Aug 21, 2026 |
| CVE-2026-77264 | The Automation Web Platform โ Notifications and OTP for WooCommerce, Advanced Co | CRITICAL | 9.8 | NVD | Aug 21, 2026 |
| CVE-2026-16323 | Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics | HIGH | 7.5 | NVD | Aug 21, 2026 |
| CVE-2026-75796 | The AI Engine WordPress plugin before 3 | HIGH | 7.2 | NVD | Aug 21, 2026 |
| CVE-2026-18781 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin befor | HIGH | 8.1 | NVD | Aug 21, 2026 |
| CVE-2026-16959 | The Media Library Assistant WordPress plugin before 3 | MEDIUM | 6.8 | NVD | Aug 21, 2026 |
| CVE-2026-16576 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress pl | HIGH | 7.2 | NVD | Aug 21, 2026 |
| CVE-2026-14601 | The Link Whisper Free WordPress plugin before 0 | MEDIUM | 6.8 | NVD | Aug 21, 2026 |
| CVE-2026-18409 | The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | HIGH | 7.2 | NVD | Aug 21, 2026 |
| CVE-2026-73267 | A flaw was found in the clusterclaims-controller component of multicluster engin | HIGH | 7.7 | NVD | Aug 21, 2026 |
| CVE-2026-77392 | A weakness has been identified in SourceCodester Dynamic Input Field Generator U | MEDIUM | 6.3 | NVD | Aug 21, 2026 |
| CVE-2026-77651 | The arrayref crate 0 | CRITICAL | 9.8 | NVD | Aug 21, 2026 |
| CVE-2026-77650 | The append-only-vec crate 0 | CRITICAL | 9.8 | NVD | Aug 21, 2026 |
| CVE-2026-77649 | The internment crate 0 | CRITICAL | 9.8 | NVD | Aug 21, 2026 |
| CVE-2026-77647 | SPIP before 4 | CRITICAL | 9.8 | NVD | Aug 20, 2026 |
| CVE-2026-66590 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7 | HIGH | 7.1 | NVD | Aug 20, 2026 |
| CVE-2026-66586 | Author Local File Inclusion in WP Cafe Pro < 3 | MEDIUM | 6.6 | NVD | Aug 20, 2026 |
| CVE-2026-66583 | Unauthenticated PHP Object Injection in Forminator <= 1 | CRITICAL | 9.8 | NVD | Aug 20, 2026 |
| CVE-2026-66582 | Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3 | HIGH | 7.1 | NVD | Aug 20, 2026 |
| CVE-2026-66581 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3 | HIGH | 7.1 | NVD | Aug 20, 2026 |
| CVE-2026-28150 | Unauthenticated Local File Inclusion in Golo Framework < 1 | HIGH | 8.1 | NVD | Aug 20, 2026 |
| CVE-2025-53999 | Unauthenticated Broken Access Control in Altair <= 5 | MEDIUM | 6.5 | NVD | Aug 20, 2026 |
| CVE-2025-15689 | Unauthenticated Privilege Escalation in Capella <= 2 | CRITICAL | 9.8 | NVD | Aug 20, 2026 |
| CVE-2025-15688 | Unauthenticated SQL Injection in Capella <= 2 | CRITICAL | 9.3 | NVD | Aug 20, 2026 |
| CVE-2025-15637 | Unauthenticated Local File Inclusion in Shuffle <= 1 | HIGH | 8.1 | NVD | Aug 20, 2026 |
| CVE-2026-73199 | A flaw was found in the `ipa-enrollment` SLAPI plugin | MEDIUM | 6.5 | NVD | Aug 20, 2026 |
| CVE-2026-73198 | A flaw was found in FreeIPA | HIGH | 7.5 | NVD | Aug 20, 2026 |
| CVE-2026-73197 | A flaw was found in FreeIPA | HIGH | 7.5 | NVD | Aug 20, 2026 |
| CVE-2026-13097 | A privilege escalation flaw was found in FreeIPA | CRITICAL | 9.1 | NVD | Aug 20, 2026 |
| CVE-2026-11861 | A flaw was found in FreeIPA | CRITICAL | 9.6 | NVD | Aug 20, 2026 |
| CVE-2026-75963 | The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion | HIGH | 7.5 | NVD | Aug 20, 2026 |
| CVE-2026-75860 | The JSON Options WordPress plugin through 0 | CRITICAL | 9.8 | NVD | Aug 20, 2026 |
| CVE-2026-74992 | The Kirki WordPress plugin before 6 | MEDIUM | 6.8 | NVD | Aug 20, 2026 |
| CVE-2026-19697 | The GutenKit WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Aug 20, 2026 |
| CVE-2026-19615 | The Admin and Site Enhancements (ASE) WordPress plugin before 9 | MEDIUM | 6.8 | NVD | Aug 20, 2026 |
| CVE-2026-15049 | The Depicter โ Popup & Slider Builder WordPress plugin before 4 | HIGH | 7.2 | NVD | Aug 20, 2026 |
| CVE-2026-13405 | The Royal Addons for Elementor WordPress plugin before 1 | MEDIUM | 6.6 | NVD | Aug 20, 2026 |
| CVE-2026-19582 | In binutils 2 | HIGH | 7.8 | NVD | Aug 20, 2026 |
| CVE-2026-72530 | TrueConf - Server | CRITICAL | N/A | CISA | Aug 20, 2026 |
| CVE-2026-72529 | TrueConf - Server | CRITICAL | N/A | CISA | Aug 20, 2026 |
| CVE-2026-76886 | C12 | HIGH | 8.1 | NVD | Aug 19, 2026 |
| CVE-2026-76880 | RRC protocol dissector crash in 4 | HIGH | 7.5 | NVD | Aug 19, 2026 |
| CVE-2026-76879 | C12 | HIGH | 7.5 | NVD | Aug 19, 2026 |
| CVE-2026-76761 | A vulnerability was identified in chenhg5 cc-connect up to 1 | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-76760 | A vulnerability was found in chenhg5 cc-connect up to 1 | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-44901 | Wazuh is a free and open source platform used for threat prevention, detection, | HIGH | 8.4 | NVD | Aug 19, 2026 |
| CVE-2026-41424 | Wazuh is a free and open source platform used for threat prevention, detection, | HIGH | 8.2 | NVD | Aug 19, 2026 |
| CVE-2026-20359 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.9 | NVD | Aug 19, 2026 |
| CVE-2026-20358 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 10.0 | NVD | Aug 19, 2026 |
| CVE-2026-20357 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 10.0 | NVD | Aug 19, 2026 |
| CVE-2026-20327 | A vulnerability in the web-based management interface of Cisco Unified Intellige | MEDIUM | 6.5 | NVD | Aug 19, 2026 |
| CVE-2026-20320 | A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWork | HIGH | 7.5 | NVD | Aug 19, 2026 |
| CVE-2026-20319 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 7.5 | NVD | Aug 19, 2026 |
| CVE-2026-20318 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.6 | NVD | Aug 19, 2026 |
| CVE-2026-20317 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 10.0 | NVD | Aug 19, 2026 |
| CVE-2026-20315 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 10.0 | NVD | Aug 19, 2026 |
| CVE-2026-20302 | A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated | MEDIUM | 6.1 | NVD | Aug 19, 2026 |
| CVE-2026-20231 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.9 | NVD | Aug 19, 2026 |
| CVE-2026-20030 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 10.0 | NVD | Aug 19, 2026 |
| CVE-2024-13942 | Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use at | HIGH | 7.6 | NVD | Aug 19, 2026 |
| CVE-2026-73364 | Customer PHP Object Injection in Flexible Subscriptions <= 1 | CRITICAL | 9.8 | NVD | Aug 19, 2026 |
| CVE-2026-73363 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < | MEDIUM | 6.5 | NVD | Aug 19, 2026 |
| CVE-2026-73354 | Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3 | HIGH | 7.1 | NVD | Aug 19, 2026 |
| CVE-2026-73347 | Unauthenticated Privilege Escalation in TrueBooker <= 1 | CRITICAL | 9.8 | NVD | Aug 19, 2026 |
| CVE-2026-73185 | Unauthenticated SQL Injection in NGG Smart Image Search < 4 | CRITICAL | 9.3 | NVD | Aug 19, 2026 |
| CVE-2026-73184 | Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11 | HIGH | 7.1 | NVD | Aug 19, 2026 |
| CVE-2026-73183 | Unauthenticated SQL Injection in Maps Marker Pro <= 4 | CRITICAL | 9.3 | NVD | Aug 19, 2026 |
| CVE-2026-73182 | Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3 | HIGH | 7.1 | NVD | Aug 19, 2026 |
| CVE-2026-66668 | Subscriber SQL Injection in Community by PeepSo <= 9 | HIGH | 8.5 | NVD | Aug 19, 2026 |
| CVE-2026-66613 | Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3 | CRITICAL | 9.8 | NVD | Aug 19, 2026 |
| CVE-2026-66596 | Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9 | HIGH | 7.1 | NVD | Aug 19, 2026 |
| CVE-2026-61986 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30 | HIGH | 7.1 | NVD | Aug 19, 2026 |
| CVE-2026-32552 | Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2 | HIGH | 8.5 | NVD | Aug 19, 2026 |
| CVE-2026-15253 | The Easy Media Replace WordPress plugin through 0 | MEDIUM | 6.8 | NVD | Aug 19, 2026 |
| CVE-2026-14861 | The User Verification by PickPlugins WordPress plugin through 2 | HIGH | 7.5 | NVD | Aug 19, 2026 |
| CVE-2026-14334 | The Booking calendar, Appointment Booking System WordPress plugin through 3 | HIGH | 8.8 | NVD | Aug 19, 2026 |
| CVE-2026-13175 | The Eventin WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Aug 19, 2026 |
| CVE-2026-13174 | The Eventin WordPress plugin before 4 | HIGH | 7.2 | NVD | Aug 19, 2026 |
| CVE-2026-13169 | The Eventin WordPress plugin before 4 | HIGH | 8.1 | NVD | Aug 19, 2026 |
| CVE-2026-12983 | The Dinatur WordPress plugin through 1 | HIGH | 8.6 | NVD | Aug 19, 2026 |
| CVE-2026-11565 | The Advanced File Manager WordPress plugin before 5 | HIGH | 8.5 | NVD | Aug 19, 2026 |
| CVE-2026-49419 | When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() rel | HIGH | 8.8 | NVD | Aug 19, 2026 |
| CVE-2026-49418 | When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, | HIGH | 8.8 | NVD | Aug 19, 2026 |
| CVE-2026-49415 | During execve(2) of a SUID binary, the new virtual address space is installed be | HIGH | 8.8 | NVD | Aug 19, 2026 |
| CVE-2026-19942 | The Atarim โ AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO | HIGH | 8.1 | NVD | Aug 19, 2026 |
| CVE-2026-76050 | A vulnerability was found in SourceCodester Simple Online Food Ordering System 1 | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-76049 | A vulnerability has been found in SourceCodester Simple Online Food Ordering Sys | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-76048 | A flaw has been found in SourceCodester Simple Online Food Ordering System 1 | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-76008 | A flaw has been found in Comfast CF-N1-S 2 | CRITICAL | 10.0 | NVD | Aug 19, 2026 |
| CVE-2026-76004 | A security vulnerability has been detected in UTT HiPER 1250GW up to 3 | CRITICAL | 9.9 | NVD | Aug 19, 2026 |
| CVE-2026-76003 | A weakness has been identified in UTT HiPER 1200GW up to 2 | CRITICAL | 9.9 | NVD | Aug 19, 2026 |
| CVE-2026-75987 | A vulnerability was found in SPLWare esProc up to 20260507 | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-75986 | A vulnerability has been found in code-projects Online Job Portal System 1 | HIGH | 7.3 | NVD | Aug 19, 2026 |
| CVE-2026-75985 | A flaw has been found in TRENDnet Router 1 | HIGH | 7.4 | NVD | Aug 19, 2026 |
| CVE-2026-15421 | The Speed Optimizer โ The All-In-One Performance-Boosting Plugin plugin for Word | MEDIUM | 6.4 | NVD | Aug 19, 2026 |
| CVE-2026-75984 | A vulnerability was detected in TRENDnet TEW-823DRU 1 | HIGH | 7.4 | NVD | Aug 19, 2026 |
| CVE-2026-75979 | A vulnerability was found in xianrendzw EasyReport up to 2 | MEDIUM | 6.3 | NVD | Aug 19, 2026 |
| CVE-2026-75978 | A security vulnerability has been detected in xianrendzw EasyReport up to 2 | MEDIUM | 6.3 | NVD | Aug 19, 2026 |
| CVE-2026-75976 | A weakness has been identified in TRENDnet TEW-823DRU 1 | CRITICAL | 9.9 | NVD | Aug 19, 2026 |
| CVE-2026-64849 | MLflow - MLflow | CRITICAL | N/A | CISA | Aug 19, 2026 |
| CVE-2026-66591 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.5 | NVD | Aug 18, 2026 |
| CVE-2026-61574 | authentik is an open-source identity provider | HIGH | 8.8 | NVD | Aug 18, 2026 |
| CVE-2026-52723 | ePA 3 | CRITICAL | 9.1 | NVD | Aug 18, 2026 |
| CVE-2026-52606 | A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8 | MEDIUM | 6.1 | NVD | Aug 18, 2026 |
| CVE-2026-50578 | ePA 3 | HIGH | 7.5 | NVD | Aug 18, 2026 |
| CVE-2026-50577 | ePA 3 | HIGH | 7.4 | NVD | Aug 18, 2026 |
| CVE-2026-50576 | ePA 3 | MEDIUM | 6.8 | NVD | Aug 18, 2026 |
| CVE-2026-49228 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | HIGH | 8.8 | NVD | Aug 18, 2026 |
| CVE-2026-49225 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | HIGH | 8.3 | NVD | Aug 18, 2026 |
| CVE-2026-49224 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | HIGH | 8.3 | NVD | Aug 18, 2026 |
| CVE-2026-49223 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | HIGH | 7.6 | NVD | Aug 18, 2026 |
| CVE-2026-49222 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | HIGH | 7.6 | NVD | Aug 18, 2026 |
| CVE-2026-48744 | Saleor is an e-commerce platform | MEDIUM | 6.5 | NVD | Aug 18, 2026 |
| CVE-2026-30250 | Cross-site scripting vulnerability in the user documentation field in Beta Syste | MEDIUM | 6.1 | NVD | Aug 18, 2026 |
| CVE-2026-18963 | A flaw was found in the reset-credentials flow of the keycloak-services componen | CRITICAL | 9.1 | NVD | Aug 18, 2026 |
| CVE-2026-75829 | grav-plugin-api versions before 1 | HIGH | 8.1 | NVD | Aug 18, 2026 |
| CVE-2026-75828 | Grav before 2 | HIGH | 8.7 | NVD | Aug 18, 2026 |
| CVE-2026-75827 | Grav before 2 | HIGH | 8.8 | NVD | Aug 18, 2026 |
| CVE-2026-74906 | SiYuan before v3 | HIGH | 7.5 | NVD | Aug 18, 2026 |
| CVE-2026-74905 | SiYuan before v3 | HIGH | 7.1 | NVD | Aug 18, 2026 |
| CVE-2026-74904 | SiYuan before v3 | HIGH | 7.5 | NVD | Aug 18, 2026 |
| CVE-2026-74902 | SiYuan before v3 | HIGH | 8.6 | NVD | Aug 18, 2026 |
| CVE-2026-15585 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.5 | NVD | Aug 18, 2026 |
| CVE-2026-75627 | Bastillion fails to properly validate request URI paths in its controller dispat | CRITICAL | 9.8 | NVD | Aug 18, 2026 |
| CVE-2026-75626 | SpiderFoot fails to HTML-escape correlation titles built from external scan data | CRITICAL | 9.3 | NVD | Aug 18, 2026 |
| CVE-2024-14046 | A security vulnerability has been detected in OpenBoxes up to 0 | MEDIUM | 6.3 | NVD | Aug 18, 2026 |
| CVE-2024-14045 | A weakness has been identified in OpenBoxes up to 0 | MEDIUM | 6.3 | NVD | Aug 18, 2026 |
| CVE-2026-34884 | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability | CRITICAL | 9.8 | NVD | Aug 18, 2026 |
| CVE-2026-15371 | Velociraptor's web GUI allows specifying a custom type for columns in tables | HIGH | 8.1 | NVD | Aug 18, 2026 |
| CVE-2026-75091 | The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for | HIGH | 7.2 | NVD | Aug 18, 2026 |
| CVE-2026-15748 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload | CRITICAL | 9.8 | NVD | Aug 18, 2026 |
| CVE-2026-11801 | The WPAdverts โ Classifieds Plugin plugin for WordPress is vulnerable to authori | HIGH | 7.5 | NVD | Aug 18, 2026 |
| CVE-2026-75094 | A flaw has been found in COMFAST CF-N1-S 2 | CRITICAL | 9.1 | NVD | Aug 18, 2026 |
| CVE-2026-75089 | A weakness has been identified in PHPGurukul Complaint Management System 1 | HIGH | 7.3 | NVD | Aug 18, 2026 |
| CVE-2026-75088 | A vulnerability was determined in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 18, 2026 |
| CVE-2026-75087 | A vulnerability was found in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 18, 2026 |
| CVE-2026-75086 | A vulnerability has been found in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 18, 2026 |
| CVE-2026-75080 | A security vulnerability has been detected in SourceCodester Class and Exam Time | HIGH | 7.3 | NVD | Aug 18, 2026 |
| CVE-2026-75079 | A weakness has been identified in SourceCodester Class and Exam Timetabling Syst | HIGH | 7.3 | NVD | Aug 18, 2026 |
| CVE-2026-65400 | Apple - macOS | CRITICAL | N/A | CISA | Aug 18, 2026 |
| CVE-2025-62593 | Ray-Project - Ray | CRITICAL | N/A | CISA | Aug 18, 2026 |
| EDB-52657 | [remote] PCMan 2.0.7 - Buffer Overflow | HIGH | N/A | EXPLOIT-DB | Aug 18, 2026 |
| EDB-52656 | [dos] NanaZip 6.5 - DoS | HIGH | N/A | EXPLOIT-DB | Aug 18, 2026 |
| EDB-52655 | [webapps] flyto-core 2.26.7 - Arbitrary File Write | HIGH | N/A | EXPLOIT-DB | Aug 18, 2026 |
| EDB-52654 | [webapps] Nodemailer 9.0.0 - File Read/ SSRF | HIGH | N/A | EXPLOIT-DB | Aug 18, 2026 |
| EDB-52653 | [webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF | HIGH | N/A | EXPLOIT-DB | Aug 18, 2026 |
| CVE-2026-33824 | Microsoft - Internet Key Exchange (IKE) Service Extensions | CRITICAL | N/A | CISA | Aug 18, 2026 |
| CVE-2026-59310 | Broadcom - VMware vCenter | CRITICAL | N/A | CISA | Aug 18, 2026 |
| CVE-2026-55040 | Microsoft - SharePoint | CRITICAL | N/A | CISA | Aug 18, 2026 |
| CVE-2026-67961 | An issue in O2OA v | HIGH | 7.8 | NVD | Aug 17, 2026 |
| CVE-2026-67919 | An issue in Halo 2 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-42164 | Mahara before 25 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-42162 | Mahara before 25 | CRITICAL | 9.1 | NVD | Aug 17, 2026 |
| CVE-2026-38165 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template e | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-59893 | sqlparse is a non-validating SQL parser module for Python | HIGH | 7.5 | NVD | Aug 17, 2026 |
| CVE-2026-51346 | SQL Injection vulnerability in StudIP 6 | CRITICAL | 9.1 | NVD | Aug 17, 2026 |
| CVE-2026-50772 | An issue in Squirro Cognitive Search < 3 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-50771 | Cross Site Scripting vulnerability in Squirro Cognitive Search < 3 | MEDIUM | 6.1 | NVD | Aug 17, 2026 |
| CVE-2026-50770 | An issue in Squirro Cognitive Search before v | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-50769 | The CRM+ application before and including version 2025 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-50768 | File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-46345 | compliance-trestle is a tooling platform for managing compliance as code | HIGH | 8.4 | NVD | Aug 17, 2026 |
| CVE-2026-33437 | Stirling-PDF is a locally hosted web application that facilitates various operat | HIGH | 8.1 | NVD | Aug 17, 2026 |
| CVE-2026-9771 | The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash | HIGH | 8.8 | NVD | Aug 17, 2026 |
| CVE-2026-68517 | Glances is an open-source system cross-platform monitoring tool | MEDIUM | 6.5 | NVD | Aug 17, 2026 |
| CVE-2026-74880 | openssl_encrypt versions before 1 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-74879 | openssl_encrypt versions before 1 | HIGH | 7.5 | NVD | Aug 17, 2026 |
| CVE-2026-74878 | openssl_encrypt versions before 1 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-74877 | openssl_encrypt versions before 1 | HIGH | 8.8 | NVD | Aug 17, 2026 |
| CVE-2026-74876 | openssl_encrypt versions before 1 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-74875 | openssl_encrypt versions before 1 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-74874 | openssl_encrypt versions before 1 | HIGH | 7.5 | NVD | Aug 17, 2026 |
| CVE-2026-74872 | openssl_encrypt versions before 1 | CRITICAL | 9.8 | NVD | Aug 17, 2026 |
| CVE-2026-74871 | openssl_encrypt versions before 1 | MEDIUM | 6.2 | NVD | Aug 17, 2026 |
| CVE-2026-74869 | stoatchat before 0 | HIGH | 7.7 | NVD | Aug 17, 2026 |
| CVE-2026-74868 | SiYuan versions before 3 | HIGH | 7.5 | NVD | Aug 17, 2026 |
| CVE-2026-74842 | A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11 | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-74802 | SiYuan versions before 3 | HIGH | 8.2 | NVD | Aug 17, 2026 |
| CVE-2026-74801 | SiYuan before 3 | HIGH | 8.2 | NVD | Aug 17, 2026 |
| CVE-2026-74800 | SiYuan before v3 | CRITICAL | 9.0 | NVD | Aug 17, 2026 |
| CVE-2026-74799 | SiYuan before 3 | CRITICAL | 9.3 | NVD | Aug 17, 2026 |
| CVE-2026-74798 | SiYuan kernel before v3 | HIGH | 8.7 | NVD | Aug 17, 2026 |
| CVE-2026-20000 | A vulnerability was detected in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19999 | A security vulnerability has been detected in Open Asset Import Library Assimp A | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19994 | A vulnerability was found in Webkul Bagisto up to 2 | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19984 | A flaw has been found in jkawamoto mcp-florence2 up to 0 | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19983 | A vulnerability was detected in GL | HIGH | 8.3 | NVD | Aug 17, 2026 |
| CVE-2026-19982 | A security vulnerability has been detected in GL | HIGH | 7.4 | NVD | Aug 17, 2026 |
| CVE-2026-19977 | A vulnerability was detected in EFM ipTIME A3004T 14 | CRITICAL | 10.0 | NVD | Aug 17, 2026 |
| CVE-2026-19976 | A security vulnerability has been detected in COMFAST CF-N1-S 2 | MEDIUM | 6.6 | NVD | Aug 17, 2026 |
| CVE-2026-19973 | A vulnerability was found in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19972 | A vulnerability has been found in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19970 | A vulnerability was detected in Open Asset Import Library Assimp 17c12da | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19967 | A security flaw has been discovered in Open Asset Import Library Assimp 17c12da | MEDIUM | 6.3 | NVD | Aug 17, 2026 |
| CVE-2026-19963 | A vulnerability has been found in Edimax EW-7478APC 1 | HIGH | 7.4 | NVD | Aug 17, 2026 |
| CVE-2026-19962 | A flaw has been found in Edimax EW-7478APC 1 | HIGH | 7.4 | NVD | Aug 17, 2026 |
| EDB-52648 | [remote] phpSysInfo 3.4.5 - IP Allowlist Bypass | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52649 | [webapps] webpack_devserver 5.2.5 - CSRF | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52650 | [webapps] Probo 0.222.2 - IDOR | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52651 | [webapps] flyto_core 2.26.7 - Server-Side Request Forgery | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52652 | [dos] NanaZip 6.5 - DoS | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52642 | [webapps] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52643 | [remote] D-Link DNS_340L - OS Command Injection | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52644 | [remote] ipTIME A3004T - Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52645 | [webapps] Joomla JCE_2.9.15 - Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52646 | [webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| EDB-52647 | [dos] Nmap 7.99 - Extension Header Integer Underflow | HIGH | N/A | EXPLOIT-DB | Aug 17, 2026 |
| CVE-2026-19961 | A vulnerability was detected in Edimax EW-7478APC 1 | CRITICAL | 9.9 | NVD | Aug 16, 2026 |
| CVE-2026-19960 | A security vulnerability has been detected in Edimax EW-7478APC 1 | HIGH | 7.4 | NVD | Aug 16, 2026 |
| CVE-2026-19959 | A weakness has been identified in Edimax EW-7478APC 1 | CRITICAL | 9.9 | NVD | Aug 16, 2026 |
| CVE-2026-19958 | A security flaw has been discovered in iatsiuk pptr-mcp up to 0 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19957 | A vulnerability was identified in graphlit graphlit-mcp-server 1 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19956 | A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-74790 | Scriban before 7 | CRITICAL | 9.1 | NVD | Aug 16, 2026 |
| CVE-2026-74789 | Scriban before 7 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-74788 | Scriban before 7 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-74787 | Scriban before 7 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-74786 | Scriban before 7 | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-74785 | Scriban before 7 | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-74783 | Scriban versions 6 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-73062 | Scriban versions 3 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-73061 | Scriban before 7 | CRITICAL | 9.8 | NVD | Aug 16, 2026 |
| CVE-2026-73060 | Scriban versions from 3 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-73059 | stoatchat before 0 | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-73057 | stoatchat before 0 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-73056 | SiYuan kernel versions before 3 | CRITICAL | 9.8 | NVD | Aug 16, 2026 |
| CVE-2026-72888 | Net::OAuth versions before 0 | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-72887 | Net::OAuth::Client versions before 0 | CRITICAL | 9.8 | NVD | Aug 16, 2026 |
| CVE-2026-19349 | Lemonldap::NG::Portal versions from 2 | CRITICAL | 9.8 | NVD | Aug 16, 2026 |
| CVE-2024-58375 | OpenTofu versions 1 | HIGH | 7.5 | NVD | Aug 16, 2026 |
| CVE-2026-17123 | The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Req | HIGH | 8.8 | NVD | Aug 16, 2026 |
| CVE-2026-16099 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary fi | HIGH | 8.8 | NVD | Aug 16, 2026 |
| CVE-2026-16098 | The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File U | CRITICAL | 9.8 | NVD | Aug 16, 2026 |
| CVE-2026-16079 | The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Inject | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-15963 | The Quiz and Survey Master (QSM) โ Easy Quiz and Survey Maker plugin for WordPre | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-15726 | The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scrip | MEDIUM | 6.4 | NVD | Aug 16, 2026 |
| CVE-2026-15066 | The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scrip | MEDIUM | 6.4 | NVD | Aug 16, 2026 |
| CVE-2026-15009 | The Advanced File Manager โ Ultimate File Manager for WordPress And Document Lib | MEDIUM | 6.1 | NVD | Aug 16, 2026 |
| CVE-2026-15002 | The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to | HIGH | 7.2 | NVD | Aug 16, 2026 |
| CVE-2026-14524 | The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file d | CRITICAL | 9.1 | NVD | Aug 16, 2026 |
| CVE-2026-14498 | The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution i | HIGH | 8.8 | NVD | Aug 16, 2026 |
| CVE-2026-13358 | The Appointment Booking Calendar โ Simply Schedule Appointments Booking Plugin p | MEDIUM | 6.5 | NVD | Aug 16, 2026 |
| CVE-2026-11780 | The Quiz and Survey Master (QSM) โ Easy Quiz and Survey Maker plugin for WordPre | MEDIUM | 6.4 | NVD | Aug 16, 2026 |
| CVE-2026-19930 | A security flaw has been discovered in Dolibarr up to 23 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19929 | A vulnerability was identified in OpenBoxes up to 0 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19928 | A vulnerability was determined in OpenBoxes up to 0 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19927 | A vulnerability was found in OpenBoxes up to 0 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19926 | A vulnerability has been found in Evergreen up to 3 | HIGH | 7.3 | NVD | Aug 16, 2026 |
| CVE-2026-19924 | A security vulnerability has been detected in Tenda AC10 16 | CRITICAL | 9.8 | NVD | Aug 16, 2026 |
| CVE-2026-19923 | A weakness has been identified in code-projects Online Shopping System 1 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19921 | A vulnerability was identified in code-projects Online Shopping System 1 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19920 | A vulnerability was determined in code-projects Online Shopping System 1 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19919 | A vulnerability was found in code-projects Online Shopping System 1 | HIGH | 7.3 | NVD | Aug 16, 2026 |
| CVE-2026-19918 | A vulnerability has been found in SpaceX Starlink Router Gen 3 2025 | MEDIUM | 6.3 | NVD | Aug 16, 2026 |
| CVE-2026-19917 | A flaw has been found in code-projects Online Food Order System 1 | MEDIUM | 6.3 | NVD | Aug 15, 2026 |
| CVE-2026-73053 | SiYuan versions before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-73052 | SiYuan before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-73050 | SiYuan versions before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-73047 | siyuan versions <= 3 | MEDIUM | 6.2 | NVD | Aug 15, 2026 |
| CVE-2026-73046 | SiYuan before v3 | CRITICAL | 9.8 | NVD | Aug 15, 2026 |
| CVE-2026-73045 | SiYuan before 3 | HIGH | 7.5 | NVD | Aug 15, 2026 |
| CVE-2026-73044 | SiYuan versions before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-73043 | SiYuan versions before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-73042 | SiYuan before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-73041 | SiYuan versions before v3 | CRITICAL | 9.0 | NVD | Aug 15, 2026 |
| CVE-2026-19905 | A weakness has been identified in Jinher OA 1 | HIGH | 7.3 | NVD | Aug 15, 2026 |
| CVE-2026-18855 | The Link Library plugin for WordPress is vulnerable to arbitrary file deletion d | CRITICAL | 9.1 | NVD | Aug 15, 2026 |
| CVE-2026-19901 | A security flaw has been discovered in LB-LINK X-PRO 1 | HIGH | 8.1 | NVD | Aug 15, 2026 |
| CVE-2026-19598 | The Pods โ Custom Content Types and Fields plugin for WordPress is vulnerable to | CRITICAL | 9.8 | NVD | Aug 15, 2026 |
| CVE-2026-19900 | A vulnerability was identified in LB-LINK X-PRO 1 | HIGH | 8.1 | NVD | Aug 15, 2026 |
| CVE-2026-19899 | A vulnerability was determined in SourceCodester Class and Exam Timetabling Syst | HIGH | 7.3 | NVD | Aug 15, 2026 |
| CVE-2026-74449 | drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport | HIGH | 7.8 | NVD | Aug 15, 2026 |
| CVE-2026-74447 | drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment eop_ring_bu | HIGH | 7.8 | NVD | Aug 15, 2026 |
| CVE-2026-74446 | drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoin | HIGH | 7.8 | NVD | Aug 15, 2026 |
| CVE-2026-74444 | drm/vmwgfx: validate DRAW_PRIMITIVES header size before division vmw_cmd_draw() | HIGH | 7.8 | NVD | Aug 15, 2026 |
| CVE-2026-74443 | drm/vmwgfx: bound DMA command body size against suffix pointer vmw_cmd_dma() lo | HIGH | 8.8 | NVD | Aug 15, 2026 |
| CVE-2026-74440 | drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user jo | HIGH | 7.8 | NVD | Aug 15, 2026 |
| CVE-2026-19894 | A security flaw has been discovered in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 15, 2026 |
| CVE-2026-12248 | The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection vi | MEDIUM | 6.5 | NVD | Aug 15, 2026 |
| CVE-2026-15965 | The MaxUpload โ Big File Uploads โ Increase Maximum File Upload Size plugin for | HIGH | 8.8 | NVD | Aug 15, 2026 |
| CVE-2026-15341 | The User Session Synchronizer plugin for WordPress is vulnerable to Authenticati | CRITICAL | 9.8 | NVD | Aug 15, 2026 |
| CVE-2026-15312 | The Propovoice: All-in-One Client Management System plugin for WordPress is vuln | HIGH | 8.8 | NVD | Aug 15, 2026 |
| CVE-2026-15303 | The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass | CRITICAL | 9.8 | NVD | Aug 15, 2026 |
| CVE-2026-15162 | The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injec | HIGH | 7.5 | NVD | Aug 15, 2026 |
| CVE-2026-15001 | The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to | HIGH | 8.8 | NVD | Aug 15, 2026 |
| CVE-2026-14484 | The RapiSafe โ Secure Multi File Upload for Contact Form 7 plugin for WordPress | CRITICAL | 9.1 | NVD | Aug 15, 2026 |
| CVE-2026-14433 | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordP | HIGH | 7.2 | NVD | Aug 15, 2026 |
| CVE-2026-74250 | In OpenStack Ironic before 38 | MEDIUM | 6.3 | NVD | Aug 14, 2026 |
| CVE-2026-74243 | A flaw was found in Red Hat Quay | MEDIUM | 6.5 | NVD | Aug 14, 2026 |
| CVE-2026-46603 | VP8L decoding in golang | HIGH | 7.5 | NVD | Aug 14, 2026 |
| CVE-2026-46439 | compliance-trestle is a tooling platform for managing compliance as code | HIGH | 7.8 | NVD | Aug 14, 2026 |
| CVE-2026-46380 | compliance-trestle is a tooling platform for managing compliance as code | MEDIUM | 6.7 | NVD | Aug 14, 2026 |
| CVE-2026-19845 | A vulnerability was determined in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19844 | A vulnerability was found in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19628 | A command injection vulnerability exists in Tenable Security Center | HIGH | 7.2 | NVD | Aug 14, 2026 |
| CVE-2026-19626 | A remote code execution vulnerability exists in Tenable Security Center's report | CRITICAL | 9.9 | NVD | Aug 14, 2026 |
| CVE-2026-72827 | Grav CMS before 2 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-72826 | The getgrav/grav-plugin-api plugin before 1 | CRITICAL | 9.8 | NVD | Aug 14, 2026 |
| CVE-2026-72825 | The getgrav/grav-plugin-api plugin before 1 | HIGH | 7.6 | NVD | Aug 14, 2026 |
| CVE-2026-72824 | The Grav API plugin (getgrav/grav-plugin-api) before 1 | CRITICAL | 9.8 | NVD | Aug 14, 2026 |
| CVE-2026-72822 | The getgrav/grav-plugin-api Composer package before 1 | CRITICAL | 9.8 | NVD | Aug 14, 2026 |
| CVE-2026-72819 | Grav CMS before 2 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-72817 | go-chi/chi versions 0 | MEDIUM | 6.5 | NVD | Aug 14, 2026 |
| CVE-2026-72816 | go-chi/chi through 5 | MEDIUM | 6.5 | NVD | Aug 14, 2026 |
| CVE-2026-72812 | SiYuan versions before v3 | MEDIUM | 6.5 | NVD | Aug 14, 2026 |
| CVE-2026-72811 | SiYuan versions <= v3 | CRITICAL | 10.0 | NVD | Aug 14, 2026 |
| CVE-2026-72810 | SiYuan versions before v3 | HIGH | 8.6 | NVD | Aug 14, 2026 |
| CVE-2026-19822 | A vulnerability was identified in Tenda W20E 15 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19821 | A vulnerability was determined in Tenda AC12 15 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19815 | A flaw has been found in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19814 | A vulnerability was detected in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19813 | A security vulnerability has been detected in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19812 | A weakness has been identified in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19794 | The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting i | HIGH | 7.2 | NVD | Aug 14, 2026 |
| CVE-2026-19811 | A security flaw has been discovered in TOTOLINK A800R 4 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-18039 | The Essential Addons for Elementor WordPress plugin before 6 | HIGH | 8.1 | NVD | Aug 14, 2026 |
| CVE-2026-16810 | The Bit Form โ Contact Form, Payment Forms, Multi Step Forms, Calculator & Custo | MEDIUM | 6.5 | NVD | Aug 14, 2026 |
| CVE-2026-15205 | The Paymob for WooCommerce WordPress plugin before 4 | HIGH | 8.6 | NVD | Aug 14, 2026 |
| CVE-2026-14290 | The Embed Google Photos album WordPress plugin through 2 | MEDIUM | 6.8 | NVD | Aug 14, 2026 |
| CVE-2026-12949 | The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via I | CRITICAL | 9.8 | NVD | Aug 14, 2026 |
| CVE-2026-19792 | A security flaw has been discovered in Tenda G0 up to 20260625 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19791 | A weakness has been identified in Tenda G0 up to 20260625 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19788 | A vulnerability was found in Tenda AC1206 15 | HIGH | 8.8 | NVD | Aug 14, 2026 |
| CVE-2026-19785 | A vulnerability has been found in francoisjacquet RosarioSIS up to 12 | MEDIUM | 6.3 | NVD | Aug 14, 2026 |
| CVE-2026-18109 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip | HIGH | 7.2 | NVD | Aug 14, 2026 |
| CVE-2026-19771 | A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2 | HIGH | 7.2 | NVD | Aug 14, 2026 |
| CVE-2026-19767 | A weakness has been identified in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 14, 2026 |
| CVE-2026-19765 | A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951 | MEDIUM | 6.3 | NVD | Aug 14, 2026 |
| CVE-2026-19764 | A vulnerability was identified in Raisecom Communication Command and Dispatch Ma | HIGH | 7.3 | NVD | Aug 14, 2026 |
| CVE-2026-19762 | A vulnerability was found in DTStack Taier 1 | HIGH | 7.3 | NVD | Aug 14, 2026 |
| CVE-2026-19758 | A vulnerability was determined in dromara lamp-cloud up to 5 | HIGH | 7.3 | NVD | Aug 14, 2026 |
| CVE-2026-19757 | A vulnerability was found in Dromara lamp-cloud up to 5 | HIGH | 7.3 | NVD | Aug 14, 2026 |
| CVE-2026-19756 | A vulnerability has been found in Dromara lamp-cloud up to 5 | MEDIUM | 6.3 | NVD | Aug 13, 2026 |
| CVE-2026-19753 | A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1 | HIGH | 7.3 | NVD | Aug 13, 2026 |
| CVE-2026-24791 | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self r | HIGH | 8.1 | NVD | Aug 13, 2026 |
| CVE-2026-24059 | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- | MEDIUM | 6.5 | NVD | Aug 13, 2026 |
| CVE-2026-13051 | Form::Processor::Field::HtmlArea versions from 0 | CRITICAL | 9.1 | NVD | Aug 13, 2026 |
| CVE-2026-13048 | Data::MuForm::Localizer versions through 0 | HIGH | 8.2 | NVD | Aug 13, 2026 |
| CVE-2022-4993 | HTML::FormHandler versions through 0 | CRITICAL | 9.1 | NVD | Aug 13, 2026 |
| CVE-2026-73671 | Saurus CMS Community Edition contains an unauthenticated open redirect vulnerabi | MEDIUM | 6.1 | NVD | Aug 13, 2026 |
| CVE-2026-73670 | A CMS contains a SQL injection vulnerability in admin/db_data | HIGH | 7.2 | NVD | Aug 13, 2026 |
| CVE-2026-73576 | In Zimbra Collaboration (ZCS) before 10 | MEDIUM | 6.3 | NVD | Aug 13, 2026 |
| CVE-2026-73572 | In Zimbra Collaboration (ZCS) before 10 | MEDIUM | 6.1 | NVD | Aug 13, 2026 |
| CVE-2026-73570 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) befor | HIGH | 8.9 | NVD | Aug 13, 2026 |
| CVE-2026-73559 | vLLM is an inference and serving engine for large language models | MEDIUM | 6.5 | NVD | Aug 13, 2026 |
| CVE-2026-73533 | Ninja Tables Pro 5 | CRITICAL | 9.8 | NVD | Aug 13, 2026 |
| CVE-2026-73532 | Fluent Forms Pro 6 | CRITICAL | 9.8 | NVD | Aug 13, 2026 |
| CVE-2026-73515 | PostGIS before 3 | HIGH | 8.1 | NVD | Aug 13, 2026 |
| CVE-2026-73514 | The address_standardizer extension for PostGIS through 3 | HIGH | 8.8 | NVD | Aug 13, 2026 |
| CVE-2026-73608 | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not presen | HIGH | 8.6 | NVD | Aug 13, 2026 |
| CVE-2026-73604 | Flowise before 3 | MEDIUM | 6.5 | NVD | Aug 13, 2026 |
| CVE-2026-12263 | Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 vers | HIGH | 8.8 | NVD | Aug 13, 2026 |
| CVE-2026-19481 | @fastify/busboy is a multipart form-data parser | HIGH | 7.5 | NVD | Aug 13, 2026 |
| CVE-2026-15413 | The Link Factory WordPress plugin is a backdoor | CRITICAL | 10.0 | NVD | Aug 13, 2026 |
| CVE-2026-14298 | Mattermost versions 11 | MEDIUM | 6.5 | NVD | Aug 13, 2026 |
| CVE-2026-3639 | The PPWP โ Password Protect Pages plugin for WordPress is vulnerable to Stored C | MEDIUM | 6.4 | NVD | Aug 13, 2026 |
| CVE-2026-11840 | Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngin | HIGH | 8.8 | NVD | Aug 13, 2026 |
| CVE-2026-18146 | The Fluent Forms โ Customizable Contact Forms, Survey, Quiz, & Conversational Fo | HIGH | 7.2 | NVD | Aug 13, 2026 |
| CVE-2026-18945 | The WP Helper Premium WordPress plugin before 4 | HIGH | 8.2 | NVD | Aug 13, 2026 |
| CVE-2026-14182 | The Customer Email Verification for WooCommerce WordPress plugin before 3 | CRITICAL | 9.8 | NVD | Aug 13, 2026 |
| CVE-2026-13610 | The KiviCare WordPress plugin before 4 | HIGH | 7.5 | NVD | Aug 13, 2026 |
| CVE-2026-50544 | NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonligh | MEDIUM | 6.3 | NVD | Aug 13, 2026 |
| CVE-2026-49819 | UpSnap is a wake on lan web app | CRITICAL | 9.8 | NVD | Aug 13, 2026 |
| CVE-2026-49473 | @cedar-policy/authorization-for-expressjs is an open-source Express | HIGH | 8.8 | NVD | Aug 13, 2026 |
| CVE-2026-17431 | PDF::WebKit versions through 1 | MEDIUM | 6.1 | NVD | Aug 13, 2026 |
| CVE-2026-16770 | PDF::WebKit versions through 1 | CRITICAL | 9.8 | NVD | Aug 13, 2026 |
| CVE-2026-71194 | In OpenStack Designate before 22 | MEDIUM | 6.8 | NVD | Aug 12, 2026 |
| CVE-2026-71193 | In OpenStack Designate before 22 | CRITICAL | 9.6 | NVD | Aug 12, 2026 |
| CVE-2026-49481 | UpSnap is a wake on lan web app | CRITICAL | 9.6 | NVD | Aug 12, 2026 |
| CVE-2026-47717 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software | HIGH | 7.5 | NVD | Aug 12, 2026 |
| CVE-2026-73240 | Specifically crafted inputs may lead to git argument injection in Apache Allura | CRITICAL | 9.8 | NVD | Aug 12, 2026 |
| CVE-2026-73239 | Insecure Direct Object Reference (IDOR) due to missing permission checks for mul | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-73238 | XSS vulnerability in code display in Apache Allura | MEDIUM | 6.1 | NVD | Aug 12, 2026 |
| CVE-2026-73237 | XSS vulnerability in Markdown handling in Apache Allura | MEDIUM | 6.1 | NVD | Aug 12, 2026 |
| CVE-2026-48554 | Nagios Core before 4 | HIGH | 7.5 | NVD | Aug 12, 2026 |
| CVE-2026-48553 | Nagios Core before 4 | HIGH | 7.5 | NVD | Aug 12, 2026 |
| CVE-2026-48551 | Nagios Core before 4 | HIGH | 7.4 | NVD | Aug 12, 2026 |
| CVE-2026-48550 | Nagios Core before 4 | MEDIUM | 6.1 | NVD | Aug 12, 2026 |
| CVE-2026-18847 | IBM i 7 | HIGH | 8.8 | NVD | Aug 12, 2026 |
| CVE-2026-18683 | IBM i 7 | HIGH | 8.8 | NVD | Aug 12, 2026 |
| CVE-2026-18499 | IBM WebSphere Application Server - Liberty 17 | HIGH | 8.1 | NVD | Aug 12, 2026 |
| CVE-2026-18098 | IBM i 7 | HIGH | 8.1 | NVD | Aug 12, 2026 |
| CVE-2026-17095 | IBM i 7 | HIGH | 8.3 | NVD | Aug 12, 2026 |
| CVE-2026-16694 | IBM i 7 | MEDIUM | 6.4 | NVD | Aug 12, 2026 |
| CVE-2026-70468 | A authentication bypass using an alternate path or channel vulnerability in Fort | HIGH | 8.1 | NVD | Aug 12, 2026 |
| CVE-2026-57858 | Cal | HIGH | 8.9 | NVD | Aug 12, 2026 |
| CVE-2026-53996 | NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio | HIGH | 7.0 | NVD | Aug 12, 2026 |
| CVE-2026-47226 | Admidio is an open-source user management solution | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-26035 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet For | CRITICAL | 9.8 | NVD | Aug 12, 2026 |
| CVE-2026-70465 | A buffer copy without checking size of input ('classic buffer overflow') vulnera | HIGH | 8.1 | NVD | Aug 12, 2026 |
| CVE-2026-16747 | The Kirki WordPress plugin before 6 | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-15045 | The Wallet System for WooCommerce WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-11325 | Description Cloudflare was recently notified by external researchers of vulne | HIGH | 8.8 | NVD | Aug 12, 2026 |
| CVE-2026-68868 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provi | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-16051 | The wpmudev-updates WordPress plugin before 5 | CRITICAL | 9.8 | NVD | Aug 12, 2026 |
| CVE-2026-15039 | The giftware WordPress plugin before 4 | CRITICAL | 9.8 | NVD | Aug 12, 2026 |
| CVE-2026-14925 | The Import WP WordPress plugin before 2 | HIGH | 7.5 | NVD | Aug 12, 2026 |
| CVE-2026-13613 | The KiviCare WordPress plugin before 4 | HIGH | 8.8 | NVD | Aug 12, 2026 |
| CVE-2026-13171 | The Eventin WordPress plugin before 4 | HIGH | 8.2 | NVD | Aug 12, 2026 |
| CVE-2026-13168 | The Eventin WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-12976 | The LearnPress WordPress plugin before 4 | MEDIUM | 6.5 | NVD | Aug 12, 2026 |
| CVE-2026-64954 | Velociraptor allows scheduling new collections via VQL queries in notebooks | HIGH | 8.2 | NVD | Aug 12, 2026 |
| CVE-2026-12235 | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocati | MEDIUM | 6.3 | NVD | Aug 12, 2026 |
| CVE-2026-12234 | The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg( | HIGH | 7.8 | NVD | Aug 12, 2026 |
| CVE-2026-12232 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() i | MEDIUM | 6.1 | NVD | Aug 12, 2026 |
| CVE-2024-14043 | A vulnerability was determined in Open5GS up to 2 | MEDIUM | 6.3 | NVD | Aug 12, 2026 |
| CVE-2026-73249 | calibre is an e-book manager | HIGH | 7.5 | NVD | Aug 11, 2026 |
| CVE-2026-73247 | Kestra is an open-source, event-driven orchestration platform | HIGH | 8.6 | NVD | Aug 11, 2026 |
| CVE-2026-73246 | Kestra is an open-source, event-driven orchestration platform | HIGH | 7.5 | NVD | Aug 11, 2026 |
| CVE-2026-73245 | Kestra is an open-source, event-driven orchestration platform | MEDIUM | 6.5 | NVD | Aug 11, 2026 |
| CVE-2026-12571 | An authentication bypass in ManageEngine DDI Central's password-reset workflow a | CRITICAL | 9.8 | NVD | Aug 11, 2026 |
| CVE-2026-72546 | An insecure direct object reference vulnerability in Attendize through commit 92 | HIGH | 7.1 | NVD | Aug 11, 2026 |
| CVE-2026-72545 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign throu | HIGH | 7.5 | NVD | Aug 11, 2026 |
| CVE-2026-72544 | An integrity verification vulnerability in OpenSignLabs OpenSign through 2 | HIGH | 7.5 | NVD | Aug 11, 2026 |
| CVE-2026-72543 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign throu | HIGH | 7.5 | NVD | Aug 11, 2026 |
| CVE-2026-72541 | A missing authorization vulnerability in Windmill Labs Windmill through 1 | MEDIUM | 6.5 | NVD | Aug 11, 2026 |
| CVE-2026-72539 | An information disclosure vulnerability in Windmill Labs Windmill through 1 | MEDIUM | 6.5 | NVD | Aug 11, 2026 |
| CVE-2026-72538 | An argument injection vulnerability in PrefectHQ Prefect through 3 | HIGH | 8.8 | NVD | Aug 11, 2026 |
| CVE-2026-72537 | A privilege escalation vulnerability in Authentik Security authentik through 202 | HIGH | 8.8 | NVD | Aug 11, 2026 |
| CVE-2026-72536 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows | HIGH | 8.6 | NVD | Aug 11, 2026 |
| CVE-2026-72535 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows | HIGH | 8.6 | NVD | Aug 11, 2026 |
| CVE-2026-72534 | A privilege escalation vulnerability in Authentik Security authentik through 202 | HIGH | 8.8 | NVD | Aug 11, 2026 |
| CVE-2026-72533 | An authentication bypass vulnerability in Portainer CE through 2 | HIGH | 8.8 | NVD | Aug 11, 2026 |
| CVE-2026-50237 | A Server-Side Request Forgery and supply chain flaw was found in the OpenShift C | HIGH | 7.4 | NVD | Aug 11, 2026 |
| CVE-2026-50236 | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhoo | HIGH | 7.4 | NVD | Aug 11, 2026 |
| CVE-2026-58231 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authent | CRITICAL | 10.0 | NVD | Aug 11, 2026 |
| CVE-2026-19391 | A flaw was found in insights-core where the password redaction layer fails to re | MEDIUM | 6.5 | NVD | Aug 11, 2026 |
| CVE-2026-16053 | Zohocorp ManageEngineย M365 Manager Plus and M365 Security Plus versions belowย 48 | HIGH | 8.5 | NVD | Aug 11, 2026 |
| CVE-2026-4757 | A VAPIX API parameter had improper input validation which could allow code execu | HIGH | 7.2 | NVD | Aug 11, 2026 |
| CVE-2026-19516 | A caller-supplied X-Grafana-URL request header controls the destination of mcp-g | CRITICAL | 9.1 | NVD | Aug 11, 2026 |
| CVE-2026-14548 | The Ray Enterprise Translation WordPress plugin through 1 | MEDIUM | 6.5 | NVD | Aug 11, 2026 |
| CVE-2026-13716 | Path traversal in server import and admin file upload in Crafty Controller | CRITICAL | 9.1 | NVD | Aug 11, 2026 |
| CVE-2026-19425 | Travel Agency Management System developed by Win Men Intermational has a SQL Inj | CRITICAL | 9.8 | NVD | Aug 11, 2026 |
| CVE-2026-16974 | The Kirki โ Freeform Page Builder, Website Builder & Customizer plugin for WordP | MEDIUM | 6.4 | NVD | Aug 11, 2026 |
| CVE-2026-58235 | SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated ope | MEDIUM | 6.3 | NVD | Aug 11, 2026 |
| CVE-2026-58230 | SAP Approuter does not sufficiently validate certain token content under specifi | HIGH | 7.0 | NVD | Aug 11, 2026 |
| CVE-2026-44765 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integrat | HIGH | 7.3 | NVD | Aug 11, 2026 |
| CVE-2026-44764 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integrat | HIGH | 7.3 | NVD | Aug 11, 2026 |
| CVE-2026-44763 | SAP Manufacturing Integration and Intelligence allows a privileged attacker to e | HIGH | 7.6 | NVD | Aug 11, 2026 |
| CVE-2026-44758 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with hig | CRITICAL | 9.1 | NVD | Aug 11, 2026 |
| CVE-2026-34265 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to expl | CRITICAL | 9.8 | NVD | Aug 11, 2026 |
| EDB-52638 | [remote] mcp-server-kubernetes 3.8.x - Argument Injection | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| EDB-52641 | [webapps] Apache Gravitino 1.2.1 - SSRF | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| EDB-52640 | [webapps] Blocksy Companion 2.1.46 - RCE | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| EDB-52639 | [remote] PraisonAI praisonaiagents 1.6.77 - Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| CVE-2026-72898 | Metabase - Metabase | CRITICAL | N/A | CISA | Aug 11, 2026 |
| CVE-2026-68820 | Microsoft - Windows Ancillary Function Driver for WinSock | CRITICAL | N/A | CISA | Aug 11, 2026 |
| CVE-2026-20349 | Cisco - Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | CRITICAL | N/A | CISA | Aug 11, 2026 |
| EDB-52635 | [webapps] Ray 2.56.0 - Directory Traversal & Local File Inclusion | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| EDB-52636 | [webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| EDB-52637 | [dos] LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting | HIGH | N/A | EXPLOIT-DB | Aug 11, 2026 |
| CVE-2026-8718 | tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tl | HIGH | 8.4 | NVD | Aug 10, 2026 |
| CVE-2026-72726 | Discourse is an open-source discussion platform | MEDIUM | 6.5 | NVD | Aug 10, 2026 |
| CVE-2026-72720 | Discourse is an open-source discussion platform | MEDIUM | 6.4 | NVD | Aug 10, 2026 |
| CVE-2026-72719 | Chatwoot is a customer engagement suite | MEDIUM | 6.7 | NVD | Aug 10, 2026 |
| CVE-2026-66738 | SPIP before 4 | HIGH | 8.8 | NVD | Aug 10, 2026 |
| CVE-2026-48048 | XWiki Platform is a generic wiki platform | HIGH | 7.5 | NVD | Aug 10, 2026 |
| CVE-2026-47754 | Metacat is data repository software that helps researchers preserve, share, and | CRITICAL | 9.3 | NVD | Aug 10, 2026 |
| CVE-2026-65948 | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2 | HIGH | 7.3 | NVD | Aug 10, 2026 |
| CVE-2026-65945 | Logs contain replayable JWT tokens in Apache Ranger versions <= 2 | MEDIUM | 6.5 | NVD | Aug 10, 2026 |
| CVE-2026-65942 | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2 | HIGH | 7.5 | NVD | Aug 10, 2026 |
| CVE-2026-61899 | Vulnerability in tapestry-core in Apache Tapestry 5 | HIGH | 7.5 | NVD | Aug 10, 2026 |
| CVE-2026-59087 | A flaw was found in the GIMP image manipulation program, specifically within its | HIGH | 7.8 | NVD | Aug 10, 2026 |
| CVE-2026-55814 | Missing Authentication in Apache Ranger Download APIs on versions <= 2 | HIGH | 7.5 | NVD | Aug 10, 2026 |
| CVE-2026-16298 | The FoodBoxBooker WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Aug 10, 2026 |
| CVE-2026-16257 | The Arvow AI SEO Writer WordPress plugin before 1 | HIGH | 8.2 | NVD | Aug 10, 2026 |
| CVE-2026-15047 | The s2Member WordPress plugin before 260805 does not escape several shortcode a | MEDIUM | 6.8 | NVD | Aug 10, 2026 |
| CVE-2026-14293 | The Autopay WordPress plugin before 5 | HIGH | 8.8 | NVD | Aug 10, 2026 |
| CVE-2026-14237 | The vitepos WordPress plugin before 3 | HIGH | 7.2 | NVD | Aug 10, 2026 |
| CVE-2026-14206 | The HT Contact Form WordPress plugin before 2 | HIGH | 7.5 | NVD | Aug 10, 2026 |
| CVE-2026-13600 | The AutoNetTV Relay WordPress plugin before 3 | HIGH | 8.1 | NVD | Aug 10, 2026 |
| CVE-2026-72522 | libexpat before 2 | MEDIUM | 6.2 | NVD | Aug 10, 2026 |
| CVE-2026-19389 | Multiple integer overflow and underflow vulnerabilities were found in the GStrea | HIGH | 7.1 | NVD | Aug 10, 2026 |
| CVE-2026-19387 | A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins- | HIGH | 7.6 | NVD | Aug 10, 2026 |
| CVE-2026-19384 | A weakness has been identified in SourceCodester Simple Doctors Appointment Syst | HIGH | 7.3 | NVD | Aug 10, 2026 |
| CVE-2026-19381 | A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2 | HIGH | 7.8 | NVD | Aug 10, 2026 |
| CVE-2026-19379 | A vulnerability was determined in EFM ipTIME AX8004M 15 | HIGH | 7.3 | NVD | Aug 10, 2026 |
| CVE-2026-19376 | A vulnerability has been found in Uasoft Badaso 3 | HIGH | 7.3 | NVD | Aug 10, 2026 |
| CVE-2026-19375 | A vulnerability was detected in dmitriiweb article-scraper-mcp 1 | MEDIUM | 6.3 | NVD | Aug 10, 2026 |
| EDB-52632 | [local] Microsoft Edge 150.0.4078.48 - RCE | HIGH | N/A | EXPLOIT-DB | Aug 10, 2026 |
| EDB-52630 | [webapps] Joomla 2.9.99.4 - Unauthenticated Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Aug 10, 2026 |
| EDB-52631 | [webapps] CorgetGpsDget 2_3.2 - OS Command Injection | HIGH | N/A | EXPLOIT-DB | Aug 10, 2026 |
| EDB-52633 | [webapps] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Aug 10, 2026 |
| CVE-2026-19374 | A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfe | HIGH | 7.3 | NVD | Aug 09, 2026 |
| CVE-2026-19367 | A vulnerability has been found in NocteDefensor LudusMCP 1 | MEDIUM | 6.3 | NVD | Aug 09, 2026 |
| CVE-2026-19364 | A vulnerability was determined in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 09, 2026 |
| CVE-2026-19358 | A weakness has been identified in 3CORESec Trapdoor up to 1 | MEDIUM | 6.3 | NVD | Aug 09, 2026 |
| CVE-2026-19355 | A vulnerability was determined in MingSoft MCMS up to 3 | HIGH | 7.3 | NVD | Aug 09, 2026 |
| CVE-2026-19354 | A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc | MEDIUM | 6.3 | NVD | Aug 09, 2026 |
| CVE-2026-19351 | A vulnerability was found in dresende node-sql-query 0 | HIGH | 7.3 | NVD | Aug 09, 2026 |
| CVE-2026-19350 | A vulnerability has been found in Dolibarr ERP up to 23 | MEDIUM | 6.3 | NVD | Aug 09, 2026 |
| CVE-2026-19348 | A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-19347 | A vulnerability was identified in itsourcecode Hospital Management System 1 | MEDIUM | 6.3 | NVD | Aug 09, 2026 |
| CVE-2026-18473 | The WP Directory Kit WordPress plugin before 1 | CRITICAL | 9.1 | NVD | Aug 09, 2026 |
| CVE-2026-18465 | The WP MAPS PRO WordPress plugin before 6 | MEDIUM | 6.5 | NVD | Aug 09, 2026 |
| CVE-2026-18464 | The WP MAPS PRO WordPress plugin before 6 | HIGH | 7.5 | NVD | Aug 09, 2026 |
| CVE-2026-18357 | The WPC Order Tip for WooCommerce WordPress plugin before 3 | HIGH | 7.5 | NVD | Aug 09, 2026 |
| CVE-2026-18032 | The WP Data Access WordPress plugin before 5 | HIGH | 7.5 | NVD | Aug 09, 2026 |
| CVE-2026-17017 | The CubeWP Framework WordPress plugin before 1 | HIGH | 8.1 | NVD | Aug 09, 2026 |
| CVE-2026-16988 | The GeoDirectory WordPress plugin before 2 | HIGH | 7.5 | NVD | Aug 09, 2026 |
| CVE-2026-16032 | The LWS Optimize WordPress plugin before 4 | MEDIUM | 6.1 | NVD | Aug 09, 2026 |
| CVE-2026-15038 | The InfiniteWP Client WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71993 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71992 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71991 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71990 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71989 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71988 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71987 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71986 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71985 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71984 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 09, 2026 |
| CVE-2026-71983 | MSI Radix AXE6600 router firmware version v781521 contains a command injection v | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71958 | D-Link DWR-M961 devices with hardware version C1 and software version 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71957 | D-Link DWR-M961 devices with hardware version C1 and software version 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71956 | D-Link DWR-M961 devices with hardware version C1 and software version 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71955 | D-Link DWR-M961 devices with hardware version C1 and software version 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71954 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71953 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71952 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71951 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71950 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71949 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71948 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71947 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71946 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71945 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-71944 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1 | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-67620 | Flowise through 3 | HIGH | 7.7 | NVD | Aug 08, 2026 |
| CVE-2026-42170 | A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Su | HIGH | 7.8 | NVD | Aug 08, 2026 |
| CVE-2026-14526 | The AI Copilot โ Content Generator plugin for WordPress is vulnerable to authori | CRITICAL | 9.8 | NVD | Aug 08, 2026 |
| CVE-2026-18988 | The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scrip | MEDIUM | 6.4 | NVD | Aug 08, 2026 |
| CVE-2026-52880 | Klever-Go is the Go implementation of the Klever blockchain protocol | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-52879 | Klever-Go is the Go implementation of the Klever blockchain protocol | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-52878 | Klever-Go is the Go implementation of the Klever blockchain protocol | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-48120 | Kakoune is a code editor | HIGH | 8.6 | NVD | Aug 07, 2026 |
| CVE-2026-48026 | lakeFS is an open-source tool that transforms object storage into a Git-like rep | HIGH | 8.7 | NVD | Aug 07, 2026 |
| CVE-2026-47249 | Klever-Go is the Go implementation of the Klever blockchain protocol | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-47127 | Ghostfolio is an open source wealth management software | MEDIUM | 6.5 | NVD | Aug 07, 2026 |
| CVE-2026-46409 | OpenYak is a local-first agent runtime for reliable tool-using models, with a de | CRITICAL | 9.6 | NVD | Aug 07, 2026 |
| CVE-2026-20348 | A vulnerability in the XAR file format parser of ClamAV could allow an unauthent | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-20347 | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauth | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-20346 | A vulnerability in the PDF file format parser of ClamAV could allow an unauthent | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-20345 | A vulnerability in the GPT file format parser of ClamAV could allow an unauthent | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-20339 | A vulnerability in the PESpin file format parser of ClamAV could allow an unauth | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-20338 | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-20337 | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticat | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-19211 | A vulnerability was found in SourceCodester Photo Share Website 1 | HIGH | 7.3 | NVD | Aug 07, 2026 |
| CVE-2026-48093 | The Code Embed WordPress plugin prior to version 2 | MEDIUM | 6.5 | NVD | Aug 07, 2026 |
| CVE-2026-19210 | A vulnerability has been found in SourceCodester Photo Share Website 1 | MEDIUM | 6.3 | NVD | Aug 07, 2026 |
| CVE-2026-19264 | Postiz is an open-source social media scheduling tool | CRITICAL | 9.8 | NVD | Aug 07, 2026 |
| CVE-2022-4995 | Weaver (Fanwei) E-cology 9 | CRITICAL | 9.8 | NVD | Aug 07, 2026 |
| CVE-2026-56794 | Openmanage Server Administrator โ Dell OpenManage Server Administrator, versions prior to 11 | MEDIUM | 6.5 | NVD | Aug 07, 2026 |
| CVE-2026-56793 | Openmanage Server Administrator โ Dell OpenManage Server Administrator, versions prior to 11 | HIGH | 7.7 | NVD | Aug 07, 2026 |
| CVE-2026-15816 | A flaw was found in dracut | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-16030 | The MStore API WordPress plugin before 4 | HIGH | 8.1 | NVD | Aug 07, 2026 |
| CVE-2026-15361 | The Content Views WordPress plugin before 4 | HIGH | 8.1 | NVD | Aug 07, 2026 |
| CVE-2026-15359 | The Templately WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Aug 07, 2026 |
| CVE-2026-15215 | The Subscriptions for WooCommerce WordPress plugin before 2 | HIGH | 8.8 | NVD | Aug 07, 2026 |
| CVE-2026-15032 | The Comments WordPress plugin before 7 | MEDIUM | 6.1 | NVD | Aug 07, 2026 |
| CVE-2026-14943 | The Password Protected โ Lock Entire Site, Pages, Posts, Categories, and Partial | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-14331 | The Subscribe2 WordPress plugin before 10 | MEDIUM | 6.1 | NVD | Aug 07, 2026 |
| CVE-2026-14205 | The WP Events Manager WordPress plugin before 2 | CRITICAL | 9.8 | NVD | Aug 07, 2026 |
| CVE-2026-19195 | A vulnerability has been found in V-Secure Jingyun Antivirus 2 | HIGH | 7.8 | NVD | Aug 07, 2026 |
| CVE-2026-19193 | A flaw has been found in Jiangmin Antivirus 21 | HIGH | 7.8 | NVD | Aug 07, 2026 |
| CVE-2026-19192 | A vulnerability was detected in DeepCool DisplayService 1 | HIGH | 7.8 | NVD | Aug 07, 2026 |
| CVE-2026-19191 | A security vulnerability has been detected in StableBit DrivePool 2 | HIGH | 7.8 | NVD | Aug 07, 2026 |
| CVE-2026-14365 | The TrueBooker โ Appointment Booking and Scheduler System plugin for WordPress i | CRITICAL | 9.8 | NVD | Aug 07, 2026 |
| CVE-2026-14364 | The TrueBooker โ Appointment Booking and Scheduler System plugin for WordPress i | CRITICAL | 9.8 | NVD | Aug 07, 2026 |
| CVE-2026-12801 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored | MEDIUM | 6.4 | NVD | Aug 07, 2026 |
| CVE-2026-11907 | The Stream plugin for WordPress is vulnerable to authorization bypass in all ver | MEDIUM | 6.5 | NVD | Aug 07, 2026 |
| CVE-2026-19189 | A security flaw has been discovered in Power Sofware PowerISO 9 | HIGH | 7.8 | NVD | Aug 07, 2026 |
| CVE-2026-70332 | Sharepoint Online โ Improper neutralization of input during web page generation | CRITICAL | 9.6 | NVD | Aug 07, 2026 |
| CVE-2026-68823 | Azure Confidential Ledger โ Exposed dangerous method or function in Azure Confidential L | CRITICAL | 9.1 | NVD | Aug 07, 2026 |
| CVE-2026-65668 | Purview Ediscovery โ Improper access control in Microsoft Purview eDiscovery allo | HIGH | 8.8 | NVD | Aug 07, 2026 |
| CVE-2026-65667 | Teams โ Missing authorization in Microsoft Teams allows an unauthori | CRITICAL | 10.0 | NVD | Aug 07, 2026 |
| CVE-2026-63508 | Planetary Computer โ Missing authentication for critical function in Microsoft Pl | CRITICAL | 10.0 | NVD | Aug 07, 2026 |
| CVE-2026-62918 | Teams โ Improper verification of cryptographic signature in Microsof | HIGH | 7.5 | NVD | Aug 07, 2026 |
| CVE-2026-62896 | Teams โ Improper authentication in Microsoft Teams allows an authori | CRITICAL | 9.6 | NVD | Aug 07, 2026 |
| CVE-2026-62873 | Windows Admin Center โ Improper verification of cryptographic signature in Microsof | CRITICAL | 9.8 | NVD | Aug 07, 2026 |
| CVE-2026-62836 | Azure Sql Managed Instance โ Improper restriction of communication channel to intended en | HIGH | 8.7 | NVD | Aug 07, 2026 |
| CVE-2026-62830 | Azure Sre Agent โ Missing authorization in Azure SRE Agent allows an authorize | CRITICAL | 9.9 | NVD | Aug 07, 2026 |
| CVE-2026-59118 | Power Apps โ Improper authorization in Microsoft Power Apps allows an una | CRITICAL | 9.3 | NVD | Aug 07, 2026 |
| CVE-2026-59115 | Entra Provisioning Service โ ' | CRITICAL | 9.9 | NVD | Aug 07, 2026 |
| CVE-2026-56162 | Azure Sql Database โ Improper authentication in Azure SQL Database allows an unau | CRITICAL | 10.0 | NVD | Aug 07, 2026 |
| CVE-2026-56161 | Azure Logic Apps โ Improper access control in Azure Logic Apps allows an author | CRITICAL | 9.6 | NVD | Aug 07, 2026 |
| CVE-2026-50515 | Azure Service Bus โ Deserialization of untrusted data in Azure Service Bus allow | CRITICAL | 9.9 | NVD | Aug 07, 2026 |
| CVE-2026-50481 | Azure Active Directory โ Modification of assumed-immutable data (maid) in Azure Activ | CRITICAL | 9.9 | NVD | Aug 07, 2026 |
| CVE-2026-49163 | Improper limitation of a pathname to a restricted directory ('path traversal') i | HIGH | 8.8 | NVD | Aug 07, 2026 |
| CVE-2026-8037 | Progress - LoadMaster | CRITICAL | N/A | CISA | Aug 07, 2026 |
| CVE-2026-14812 | The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backd | CRITICAL | 10.0 | NVD | Aug 06, 2026 |
| CVE-2026-13399 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2 | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-12584 | The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7 | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-11976 | The official MonsterInsights Pro update distribution bucket (`monster-insights | CRITICAL | 10.0 | NVD | Aug 06, 2026 |
| CVE-2026-11803 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an | HIGH | 7.8 | NVD | Aug 06, 2026 |
| CVE-2026-10599 | The Integrate PhonePe with WooCommerce WordPress plugin through 1 | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-10524 | The CoCart WordPress plugin before 4 | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2025-14561 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isol | CRITICAL | 9.0 | NVD | Aug 06, 2026 |
| CVE-2024-6541 | The Class Mediator fails to correctly validate or sanitize `messageContext` prop | MEDIUM | 6.8 | NVD | Aug 06, 2026 |
| CVE-2024-39024 | In Packetfence 13 | HIGH | 8.8 | NVD | Aug 06, 2026 |
| CVE-2026-68481 | Cxf โ In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-68079 | Cxf โ In Apache CXF's DefaultEncryptingCodeDataProvider,ย a capture | CRITICAL | 9.8 | NVD | Aug 06, 2026 |
| CVE-2026-65583 | Cxf โ Apache CXFโs OIDC relying-party token validation could accep | CRITICAL | 9.1 | NVD | Aug 06, 2026 |
| CVE-2026-63687 | Cxf โ Apache CXF's JwtRequestCodeFilter copies all claims from a s | CRITICAL | 9.1 | NVD | Aug 06, 2026 |
| CVE-2026-61466 | Cxf โ In Apache CXF's OAuth2 Dynamic Client Registration endpoint, | CRITICAL | 9.1 | NVD | Aug 06, 2026 |
| CVE-2026-5391 | The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting | MEDIUM | 6.4 | NVD | Aug 06, 2026 |
| CVE-2026-5158 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites โ PostX plugin | MEDIUM | 6.4 | NVD | Aug 06, 2026 |
| CVE-2026-57818 | Cxf โ A race condition in JCacheCodeDataProvider allows an attacke | HIGH | 8.1 | NVD | Aug 06, 2026 |
| CVE-2026-19035 | A vulnerability was identified in Shibby Tomato 1 | HIGH | 7.2 | NVD | Aug 06, 2026 |
| CVE-2025-15028 | The FormGent โ Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, | HIGH | 7.2 | NVD | Aug 06, 2026 |
| CVE-2026-66909 | Cxf โ Apache CXF's JMS transport deserializes the body of any inbo | CRITICAL | 9.8 | NVD | Aug 06, 2026 |
| CVE-2026-65432 | Cxf โ Apache CXF reads a top-level WSDL through its hardened StaxU | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-64958 | Cxf โ An incomplete fix forย CVE-2026-50645 means that it is still | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-57819 | Cxf โ Apache CXF allows to set a limit on the number of form param | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-57817 | Cxf โ The OpenID Connect Core 1 | HIGH | 8.1 | NVD | Aug 06, 2026 |
| CVE-2026-54225 | Cxf โ Apache CXF allows to control the maximum attachment size via | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-19034 | A vulnerability was determined in Shibby Tomato 1 | HIGH | 7.2 | NVD | Aug 06, 2026 |
| CVE-2026-14204 | The Google Authenticator WordPress plugin before 0 | MEDIUM | 6.5 | NVD | Aug 06, 2026 |
| CVE-2026-13154 | The Gutenberg Essential Blocks WordPress plugin before 6 | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-13153 | The Gutenberg Essential Blocks WordPress plugin before 6 | HIGH | 7.5 | NVD | Aug 06, 2026 |
| CVE-2026-12713 | The WPCargo Track & Trace WordPress plugin before 8 | CRITICAL | 9.1 | NVD | Aug 06, 2026 |
| CVE-2026-11588 | The EONSR AEO Agent WordPress plugin through 3 | MEDIUM | 6.1 | NVD | Aug 06, 2026 |
| CVE-2025-15678 | The Nexter Blocks WordPress plugin before 5 | MEDIUM | 6.1 | NVD | Aug 06, 2026 |
| CVE-2026-19000 | A vulnerability was identified in JeecgBoot up to 3 | HIGH | 7.3 | NVD | Aug 06, 2026 |
| CVE-2026-18998 | A vulnerability was determined in cosmicstack-labs mercury-agent up to 1 | MEDIUM | 6.3 | NVD | Aug 06, 2026 |
| CVE-2026-18997 | A vulnerability was found in cosmicstack-labs mercury-agent up to 1 | MEDIUM | 6.3 | NVD | Aug 06, 2026 |
| CVE-2026-15459 | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypa | HIGH | 8.1 | NVD | Aug 06, 2026 |
| CVE-2026-18996 | A vulnerability has been found in cosmicstack-labs mercury-agent up to 1 | MEDIUM | 6.3 | NVD | Aug 06, 2026 |
| CVE-2026-18993 | A vulnerability was detected in NousResearch hermes-agent up to 0 | MEDIUM | 6.3 | NVD | Aug 06, 2026 |
| CVE-2026-18992 | A vulnerability was detected in zhayujie CowAgent up to 2 | MEDIUM | 6.3 | NVD | Aug 06, 2026 |
| CVE-2026-18325 | The Forminator Forms โ Contact Form, Payment Form & Custom Form Builder plugin f | HIGH | 7.2 | NVD | Aug 06, 2026 |
| CVE-2026-16636 | The FluentSMTP โ WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Go | HIGH | 7.2 | NVD | Aug 06, 2026 |
| CVE-2026-15991 | The File Manager plugin for WordPress is vulnerable to arbitrary file deletion d | HIGH | 8.8 | NVD | Aug 06, 2026 |
| CVE-2026-67867 | Buffer Overflow vulnerability in Systerel S2OPC 1 | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-67866 | Buffer Overflow vulnerability in Systerel S2OPC 1 | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-67863 | In open62541 1 | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-20288 | A vulnerability in the web-based management interface of Cisco IMC could allow a | MEDIUM | 6.5 | NVD | Aug 05, 2026 |
| CVE-2026-20273 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.6 | NVD | Aug 05, 2026 |
| CVE-2026-20272 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.8 | NVD | Aug 05, 2026 |
| CVE-2026-20271 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.6 | NVD | Aug 05, 2026 |
| CVE-2026-20270 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.6 | NVD | Aug 05, 2026 |
| CVE-2026-20269 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.6 | NVD | Aug 05, 2026 |
| CVE-2026-20268 | As part of Cisco's ongoing commitment to proactive security and product quality, | HIGH | 8.6 | NVD | Aug 05, 2026 |
| CVE-2026-20267 | As part of Cisco's ongoing commitment to proactive security and product quality, | CRITICAL | 9.0 | NVD | Aug 05, 2026 |
| CVE-2026-20263 | A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cis | HIGH | 8.6 | NVD | Aug 05, 2026 |
| CVE-2026-20200 | A vulnerability in the web-based management interface of Cisco IMC could allow a | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-20124 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Ci | HIGH | 7.7 | NVD | Aug 05, 2026 |
| CVE-2026-18927 | A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7 | MEDIUM | 6.3 | NVD | Aug 05, 2026 |
| CVE-2026-17630 | Langflow โ IBM Langflow OSS 1 | HIGH | 7.2 | NVD | Aug 05, 2026 |
| CVE-2026-17626 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-17623 | Langflow โ IBM Langflow OSS 1 | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-17617 | IBM Application Gateway Operator 22 | HIGH | 8.5 | NVD | Aug 05, 2026 |
| CVE-2026-71244 | Paperless-ngx's MailAccountViewSet | MEDIUM | 6.5 | NVD | Aug 05, 2026 |
| CVE-2026-71243 | The backmeup npm package assembles shell command strings by directly concatenati | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-71242 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / vi | HIGH | 8.3 | NVD | Aug 05, 2026 |
| CVE-2026-71241 | Book-Management-System's Flask API endpoints /student, /record, /books, /find_st | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-71239 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, | HIGH | 8.1 | NVD | Aug 05, 2026 |
| CVE-2026-71238 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed w | CRITICAL | 9.1 | NVD | Aug 05, 2026 |
| CVE-2026-71237 | Miantang/IoT-PHP's index | CRITICAL | 9.8 | NVD | Aug 05, 2026 |
| CVE-2026-71236 | Grocy's API request-body parser (controllers/Api/BaseApiController | HIGH | 8.7 | NVD | Aug 05, 2026 |
| CVE-2026-71235 | Magistrala's Rules Engine allows authenticated users to create rules with embedd | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-71234 | Documize Community's attachment download route (domain/attachment/endpoint | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-71233 | InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client | HIGH | 8.7 | NVD | Aug 05, 2026 |
| CVE-2026-71232 | MacCMS10's admin template editor (application/admin/controller/Template | HIGH | 7.2 | NVD | Aug 05, 2026 |
| CVE-2026-71231 | IOTSmartHome's gui/login | CRITICAL | 9.8 | NVD | Aug 05, 2026 |
| CVE-2026-66747 | Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, | CRITICAL | 9.8 | NVD | Aug 05, 2026 |
| CVE-2026-60009 | In Eclipse Theia versions up to and including 1 | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-12609 | In Eclipse Theia versions 1 | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-68060 | A pre-authentication attacker could leverage type size/count handling to cause e | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-67589 | A pre-authentication attacker could leverage type size/count handling to cause e | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-67588 | A pre-authentication attacker could leverage unbounded symbol value caching to c | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-67551 | pre-authentication attacker could leverage type size/count handling to cause exc | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-67465 | A pre-authentication attacker could leverage unbounded symbol value caching to c | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-66273 | A pre-authentication attacker could leverage type size/count handling to cause e | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-66257 | A pre-authentication attacker could leverage unbounded symbol value caching to c | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-18902 | A vulnerability was detected in H3C NX15 V100R017 | HIGH | 7.2 | NVD | Aug 05, 2026 |
| CVE-2026-18322 | The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Esc | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-16143 | The VikRentItems โ Flexible Rental Management System plugin for WordPress is vul | HIGH | 7.2 | NVD | Aug 05, 2026 |
| CVE-2026-15941 | The plugin provides an Admin Search page that allows users with the `edit_posts` | MEDIUM | 6.5 | NVD | Aug 05, 2026 |
| CVE-2026-15918 | VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unaut | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-11421 | The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin | MEDIUM | 6.5 | NVD | Aug 05, 2026 |
| CVE-2026-18901 | A security vulnerability has been detected in H3C NX15 V100R017 | HIGH | 7.2 | NVD | Aug 05, 2026 |
| CVE-2026-18900 | A weakness has been identified in H3C NX15 V100R017 | HIGH | 7.2 | NVD | Aug 05, 2026 |
| CVE-2026-18898 | A security flaw has been discovered in UTT HiPER 1200GW up to v2 | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-18907 | Path Traversal in Download File Feature in com | HIGH | 7.5 | NVD | Aug 05, 2026 |
| CVE-2026-18897 | A vulnerability was identified in UTT HiPER 1250GW up to v3 | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-18896 | A vulnerability was determined in lavkush-maurya Student-Registration-System 1 | MEDIUM | 6.3 | NVD | Aug 05, 2026 |
| CVE-2026-18895 | A vulnerability was found in UTT HiPER 1250GW up to 3 | HIGH | 8.8 | NVD | Aug 05, 2026 |
| CVE-2026-18859 | A vulnerability was identified in ESAFENET CDG up to 20260615 | HIGH | 7.3 | NVD | Aug 05, 2026 |
| CVE-2026-18854 | A vulnerability has been found in Shandong Hoteam PDM Product Data Management Sy | HIGH | 7.3 | NVD | Aug 05, 2026 |
| CVE-2026-45537 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation | CRITICAL | 9.1 | NVD | Aug 04, 2026 |
| CVE-2026-18818 | A weakness has been identified in Ehco1996 django-sspanel up to 2023 | MEDIUM | 6.3 | NVD | Aug 04, 2026 |
| CVE-2026-63455 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orch | CRITICAL | 9.8 | NVD | Aug 04, 2026 |
| CVE-2026-48121 | @langchain/langgraph-checkpoint-mongodb provides a LangGraph | MEDIUM | 6.7 | NVD | Aug 04, 2026 |
| CVE-2026-18787 | A vulnerability was identified in GL | HIGH | 8.8 | NVD | Aug 04, 2026 |
| CVE-2026-18775 | A vulnerability has been found in NousResearch hermes-agent up to 0 | MEDIUM | 6.3 | NVD | Aug 04, 2026 |
| CVE-2026-18774 | A flaw has been found in NousResearch hermes-agent up to 0 | MEDIUM | 6.3 | NVD | Aug 04, 2026 |
| CVE-2026-15920 | An issue was discovered in Django 5 | MEDIUM | 6.1 | NVD | Aug 04, 2026 |
| CVE-2026-15307 | An issue was discovered in Django 5 | HIGH | 8.8 | NVD | Aug 04, 2026 |
| CVE-2025-29296 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3 | CRITICAL | 9.8 | NVD | Aug 04, 2026 |
| CVE-2026-61387 | Milo โ In Eclipse Milo versions 1 | HIGH | 7.5 | NVD | Aug 04, 2026 |
| CVE-2026-60007 | Milo โ In Eclipse Milo versions 0 | HIGH | 7.4 | NVD | Aug 04, 2026 |
| CVE-2026-58080 | Milo โ In Eclipse Milo versions 1 | HIGH | 8.2 | NVD | Aug 04, 2026 |
| CVE-2026-18809 | Information disclosure in Firefox for Android and Firefox Focus for Android | MEDIUM | 6.5 | NVD | Aug 04, 2026 |
| CVE-2026-18806 | External control of file name or path vulnerability in TรBฤฐTAK BฤฐLGEM Software T | HIGH | 7.1 | NVD | Aug 04, 2026 |
| CVE-2026-10710 | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigge | HIGH | 7.8 | NVD | Aug 04, 2026 |
| CVE-2026-10709 | A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigge | HIGH | 7.8 | NVD | Aug 04, 2026 |
| CVE-2026-15721 | Cleartext storage of sensitive information vulnerability in Bilin Software and I | CRITICAL | 9.8 | NVD | Aug 04, 2026 |
| CVE-2026-14838 | Use of GET request method with sensitive query strings vulnerability in Bilin So | HIGH | 7.4 | NVD | Aug 04, 2026 |
| CVE-2026-14804 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informat | CRITICAL | 9.1 | NVD | Aug 04, 2026 |
| CVE-2026-14465 | Insufficient session expiration vulnerability in Bilin Software and Informatics | MEDIUM | 6.5 | NVD | Aug 04, 2026 |
| CVE-2026-14194 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | MEDIUM | 6.5 | NVD | Aug 04, 2026 |
| CVE-2026-14175 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software | CRITICAL | 9.8 | NVD | Aug 04, 2026 |
| CVE-2026-16293 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11 | MEDIUM | 6.8 | NVD | Aug 04, 2026 |
| CVE-2026-16069 | The Brizy WordPress plugin before 2 | MEDIUM | 6.8 | NVD | Aug 04, 2026 |
| CVE-2026-15958 | The Easy Integration for Dropbox WordPress plugin before 2 | CRITICAL | 9.3 | NVD | Aug 04, 2026 |
| CVE-2026-14939 | The Visualizer WordPress plugin before 4 | MEDIUM | 6.8 | NVD | Aug 04, 2026 |
| CVE-2026-14872 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin befor | MEDIUM | 6.8 | NVD | Aug 04, 2026 |
| CVE-2026-14816 | The GDPR Framework By Data443 WordPress plugin before 2 | MEDIUM | 6.5 | NVD | Aug 04, 2026 |
| CVE-2026-66311 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized | MEDIUM | 6.2 | NVD | Aug 04, 2026 |
| CVE-2026-66310 | External control of file name or path in Microsoft Edge for Android allows an un | HIGH | 7.7 | NVD | Aug 04, 2026 |
| CVE-2026-65804 | Improper control of generation of code ('code injection') in Microsoft Edge (Chr | MEDIUM | 6.1 | NVD | Aug 04, 2026 |
| CVE-2026-65802 | External control of file name or path in Microsoft Edge for Android allows an un | HIGH | 7.4 | NVD | Aug 04, 2026 |
| CVE-2026-62870 | Use after free in Microsoft Office Excel allows an unauthorized attacker to exec | HIGH | 8.8 | NVD | Aug 04, 2026 |
| CVE-2026-18686 | A vulnerability was detected in GL | CRITICAL | 9.8 | NVD | Aug 04, 2026 |
| CVE-2026-18685 | A security vulnerability has been detected in GL | CRITICAL | 9.8 | NVD | Aug 04, 2026 |
| CVE-2026-34486 | Apache - Tomcat | CRITICAL | N/A | CISA | Aug 04, 2026 |
| CVE-2026-18556 | N-able - N-central | CRITICAL | N/A | CISA | Aug 04, 2026 |
| CVE-2026-9198 | IBM - Langflow | CRITICAL | N/A | CISA | Aug 04, 2026 |
| CVE-2026-67978 | An issue in the SBN UDP interface of NASA cFS v7 | HIGH | 7.5 | NVD | Aug 03, 2026 |
| CVE-2026-48399 | Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Princip | HIGH | 7.5 | NVD | Aug 03, 2026 |
| CVE-2026-48333 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-48331 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) | CRITICAL | 10.0 | NVD | Aug 03, 2026 |
| CVE-2026-48330 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 10.0 | NVD | Aug 03, 2026 |
| CVE-2026-48326 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 9.9 | NVD | Aug 03, 2026 |
| CVE-2026-48323 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | CRITICAL | 10.0 | NVD | Aug 03, 2026 |
| CVE-2026-48317 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Direct | CRITICAL | 9.6 | NVD | Aug 03, 2026 |
| CVE-2026-18684 | A weakness has been identified in GL | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-18667 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code | CRITICAL | 9.6 | NVD | Aug 03, 2026 |
| CVE-2026-68930 | Russh is a Rust SSH client & server library | MEDIUM | 6.5 | NVD | Aug 03, 2026 |
| CVE-2026-67611 | OpenEMR through 8 | HIGH | 8.1 | NVD | Aug 03, 2026 |
| CVE-2026-67610 | OpenEMR through 8 | HIGH | 8.1 | NVD | Aug 03, 2026 |
| CVE-2026-61372 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | HIGH | 7.5 | NVD | Aug 03, 2026 |
| CVE-2026-41453 | Krayin CRM before 2 | HIGH | 8.8 | NVD | Aug 03, 2026 |
| CVE-2026-41452 | Krayin CRM 2 | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-39932 | OpenEMR through 8 | CRITICAL | 9.1 | NVD | Aug 03, 2026 |
| CVE-2026-39931 | OpenEMR through 8 | HIGH | 7.2 | NVD | Aug 03, 2026 |
| CVE-2026-18718 | Ghidra contains an arbitrary code execution vulnerability in the Swift demangler | HIGH | 7.0 | NVD | Aug 03, 2026 |
| CVE-2026-18607 | A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN52 | HIGH | 8.8 | NVD | Aug 03, 2026 |
| CVE-2026-18606 | A weakness has been identified in Razer RzUpdateService 1 | HIGH | 7.8 | NVD | Aug 03, 2026 |
| CVE-2026-18605 | A security flaw has been discovered in CheckMAL AppCheck Pro 3 | HIGH | 7.0 | NVD | Aug 03, 2026 |
| CVE-2026-18602 | A vulnerability was determined in GL | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-69084 | SiYuan versions <= v3 | CRITICAL | 10.0 | NVD | Aug 03, 2026 |
| CVE-2026-69083 | SiYuan versions before v3 | CRITICAL | 10.0 | NVD | Aug 03, 2026 |
| CVE-2026-68587 | SiYuan versions before v3 | HIGH | 8.6 | NVD | Aug 03, 2026 |
| CVE-2026-68586 | SiYuan before v3 | HIGH | 8.6 | NVD | Aug 03, 2026 |
| CVE-2026-68584 | SiYuan versions before v3 | HIGH | 8.6 | NVD | Aug 03, 2026 |
| CVE-2026-67608 | Telenia Software TVox 26 | HIGH | 7.2 | NVD | Aug 03, 2026 |
| CVE-2026-64827 | Telenia Software TVox 26 | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-18642 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Techn | HIGH | 7.8 | NVD | Aug 03, 2026 |
| CVE-2026-18601 | A vulnerability was found in GL | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-18600 | A vulnerability has been found in GL | HIGH | 8.8 | NVD | Aug 03, 2026 |
| CVE-2026-18108 | Net::SAML2 versions before 0 | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-18092 | Net::SAML2 versions before 0 | HIGH | 8.1 | NVD | Aug 03, 2026 |
| CVE-2026-18089 | Net::SAML2 versions before 0 | HIGH | 7.5 | NVD | Aug 03, 2026 |
| CVE-2026-2346 | Authorization bypass through User-Controlled key vulnerability in Menulux Softwa | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-18599 | A flaw has been found in GL | HIGH | 8.0 | NVD | Aug 03, 2026 |
| CVE-2026-18598 | A vulnerability was detected in GL | HIGH | 8.8 | NVD | Aug 03, 2026 |
| CVE-2026-16250 | The Personal QR Message WordPress plugin through 1 | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-16060 | The Insert or Embed Articulate Content into WordPress plugin through 4 | CRITICAL | 9.8 | NVD | Aug 03, 2026 |
| CVE-2026-16057 | The Contest Gallery WordPress plugin before 30 | MEDIUM | 6.5 | NVD | Aug 03, 2026 |
| CVE-2026-15931 | The Simple Membership WordPress plugin before 4 | MEDIUM | 6.1 | NVD | Aug 03, 2026 |
| CVE-2026-15930 | The Simple Membership WordPress plugin before 4 | CRITICAL | 9.4 | NVD | Aug 03, 2026 |
| CVE-2026-15383 | The Blog Floating Button WordPress plugin through 1 | MEDIUM | 6.1 | NVD | Aug 03, 2026 |
| CVE-2026-15254 | The Simply Schedule Appointments WordPress plugin before 1 | MEDIUM | 6.5 | NVD | Aug 03, 2026 |
| CVE-2026-14557 | The SoftMarket โ Digital Marketplace WordPress plugin through 1 | CRITICAL | 9.1 | NVD | Aug 03, 2026 |
| CVE-2026-13340 | The SVG Support WordPress plugin before 2 | MEDIUM | 6.1 | NVD | Aug 03, 2026 |
| CVE-2026-12965 | The Super Store Finder WordPress plugin through 7 | CRITICAL | 9.1 | NVD | Aug 03, 2026 |
| CVE-2025-15672 | The ChamaWP WordPress plugin before 1 | HIGH | 8.1 | NVD | Aug 03, 2026 |
| CVE-2026-3245 | A deserialization vulnerability in PRISMAproduction Version 6 | HIGH | 7.5 | NVD | Aug 03, 2026 |
| CVE-2026-18577 | N-able - N-central | CRITICAL | N/A | CISA | Aug 03, 2026 |
| CVE-2026-10848 | The OCPP 1 | HIGH | 7.0 | NVD | Aug 02, 2026 |
| CVE-2026-65321 | PyAthena prior to 3 | CRITICAL | 9.8 | NVD | Aug 02, 2026 |
| CVE-2026-68582 | Vikunja versions >= 0 | MEDIUM | 6.5 | NVD | Aug 02, 2026 |
| CVE-2026-68581 | Vikunja versions 0 | HIGH | 8.1 | NVD | Aug 02, 2026 |
| CVE-2026-68580 | FreeRDP before 3 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-68579 | FreeRDP before 3 | CRITICAL | 9.6 | NVD | Aug 02, 2026 |
| CVE-2026-68578 | ArcadeDB versions before 26 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-67357 | ArcadeDB versions before 26 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-67356 | ArcadeDB before 26 | HIGH | 8.8 | NVD | Aug 02, 2026 |
| CVE-2025-71400 | better-auth passkey versions before 1 | HIGH | 7.1 | NVD | Aug 02, 2026 |
| CVE-2025-71399 | Better Auth relies on better-call, which uses the rou3 router library | HIGH | 8.6 | NVD | Aug 02, 2026 |
| CVE-2026-15241 | The AI ChatBot for WooCommerce WordPress plugin before 4 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-15236 | The Gallery for Google Photos WordPress plugin before 1 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-15206 | The SMS Alert WordPress plugin before 3 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-15151 | The Five Star Restaurant Reservations WordPress plugin before 2 | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-14841 | The King Addons for Elementor WordPress plugin before 51 | MEDIUM | 6.1 | NVD | Aug 02, 2026 |
| CVE-2026-13389 | The webtoffee-cookie-consent WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Aug 02, 2026 |
| CVE-2026-8457 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authenticat | CRITICAL | 9.8 | NVD | Aug 02, 2026 |
| CVE-2026-18352 | The User Access Manager plugin for WordPress is vulnerable to Directory Traversa | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-13339 | The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal i | HIGH | 7.5 | NVD | Aug 02, 2026 |
| CVE-2026-67298 | FreeRDP versions 3 | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-67297 | FreeRDP before 3 | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-67296 | FreeRDP before 3 | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-67295 | FreeRDP before 3 | MEDIUM | 6.3 | NVD | Aug 01, 2026 |
| CVE-2026-67292 | FreeRDP before 3 | MEDIUM | 6.5 | NVD | Aug 01, 2026 |
| CVE-2026-67291 | FreeRDP before 3 | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-67290 | FreeRDP before 3 | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-67289 | FreeRDP before 3 | CRITICAL | 9.8 | NVD | Aug 01, 2026 |
| CVE-2026-67288 | FreeRDP before 3 | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-66402 | FreeRDP before 3 | CRITICAL | 9.8 | NVD | Aug 01, 2026 |
| CVE-2026-2411 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attrib | MEDIUM | 6.5 | NVD | Aug 01, 2026 |
| CVE-2025-71403 | better-auth versions before 1 | HIGH | 7.1 | NVD | Aug 01, 2026 |
| CVE-2026-3141 | The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file d | CRITICAL | 9.1 | NVD | Aug 01, 2026 |
| CVE-2026-7623 | The SureForms โ Contact Form, Payment Form & Other Custom Form Builder plugin fo | MEDIUM | 6.4 | NVD | Aug 01, 2026 |
| CVE-2026-15414 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privileg | HIGH | 8.8 | NVD | Aug 01, 2026 |
| CVE-2026-15006 | The Bit integrations โ Form Integration, Webhook, Spreadsheets, CRM, LMS & Email | HIGH | 7.5 | NVD | Aug 01, 2026 |
| CVE-2026-13362 | The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to S | MEDIUM | 6.4 | NVD | Aug 01, 2026 |
| CVE-2026-54785 | gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini | MEDIUM | 6.2 | NVD | Jul 31, 2026 |
| CVE-2026-45377 | Decidim is a participatory democracy framework | MEDIUM | 6.5 | NVD | Jul 31, 2026 |
| CVE-2026-34641 | Premiere Pro is affected by an out-of-bounds write vulnerability that could resu | HIGH | 7.8 | NVD | Jul 31, 2026 |
| CVE-2026-53501 | Thumbor is an open-source photo thumbnail service by globo | HIGH | 8.2 | NVD | Jul 31, 2026 |
| CVE-2026-53500 | Thumbor is an open-source photo thumbnail service by globo | HIGH | 8.2 | NVD | Jul 31, 2026 |
| CVE-2026-18481 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel be | HIGH | 7.3 | NVD | Jul 31, 2026 |
| CVE-2026-54737 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preserva | HIGH | 7.3 | NVD | Jul 31, 2026 |
| CVE-2026-54725 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret | CRITICAL | 9.6 | NVD | Jul 31, 2026 |
| CVE-2026-67822 | Tenda W6-S 1 | CRITICAL | 9.8 | NVD | Jul 31, 2026 |
| CVE-2026-52856 | Wings is the server control plane for Pterodactyl, a free, open-source game serv | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-52855 | Wings is the server control plane for Pterodactyl, a free, open-source game serv | CRITICAL | 9.9 | NVD | Jul 31, 2026 |
| CVE-2026-18358 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-17561 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innot | CRITICAL | 9.8 | NVD | Jul 31, 2026 |
| CVE-2026-62391 | The security fix for CVE-2025-66518 is incomplete | HIGH | 8.1 | NVD | Jul 31, 2026 |
| CVE-2026-44615 | Path traversal vulnerability in Apache Zeppelin | MEDIUM | 6.5 | NVD | Jul 31, 2026 |
| CVE-2026-16843 | Some Hikvision Wireless Access Points are vulnerable to authenticated command ex | HIGH | 7.2 | NVD | Jul 31, 2026 |
| CVE-2026-14483 | The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulner | CRITICAL | 9.8 | NVD | Jul 31, 2026 |
| CVE-2026-14333 | The Demi WordPress plugin before 0 | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-14319 | The GiveWP WordPress plugin before 4 | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-13609 | The Frontend Admin by DynamiApps WordPress plugin before 3 | HIGH | 8.8 | NVD | Jul 31, 2026 |
| CVE-2026-13392 | The ElementsKit Elementor Addons WordPress plugin before 3 | HIGH | 7.2 | NVD | Jul 31, 2026 |
| CVE-2026-12721 | The Kirki WordPress plugin before 6 | HIGH | 8.6 | NVD | Jul 31, 2026 |
| CVE-2026-12720 | The Kirki WordPress plugin before 6 | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-12695 | The miniOrange 2FA WordPress plugin before 6 | HIGH | 8.1 | NVD | Jul 31, 2026 |
| CVE-2026-12251 | The Ultimate Member WordPress plugin before 2 | HIGH | 8.1 | NVD | Jul 31, 2026 |
| CVE-2026-63223 | CodeIgniter is a PHP full-stack web framework | CRITICAL | 9.8 | NVD | Jul 31, 2026 |
| CVE-2026-63222 | CodeIgniter is a PHP full-stack web framework | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-63221 | CodeIgniter is a PHP full-stack web framework | CRITICAL | 9.4 | NVD | Jul 31, 2026 |
| CVE-2026-56673 | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-56672 | ComfyUI is a node-based diffusion model GUI, API, and backend | HIGH | 8.2 | NVD | Jul 31, 2026 |
| CVE-2026-56671 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | HIGH | 7.5 | NVD | Jul 31, 2026 |
| CVE-2026-56670 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | HIGH | 8.2 | NVD | Jul 31, 2026 |
| CVE-2026-66720 | The GOOSE subscriber component improperly validates the UTC timestamp field in | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-66421 | OpenClaw Dashboard contains a stored cross-site scripting vulnerability that all | CRITICAL | 9.3 | NVD | Jul 30, 2026 |
| CVE-2026-66420 | MeshCentral 1 | HIGH | 8.8 | NVD | Jul 30, 2026 |
| CVE-2026-66369 | The GOOSE parser contains an off-by-one boundary-handling flaw that can be trig | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-66364 | The GOOSE payload parser contains a boundary handling flaw that can be triggere | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-66360 | The ISO Presentation layer contains a flaw in the handling of specific paramete | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-66349 | The MMS server connection handler contains a flaw in its processing of BER-enco | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-65423 | An integer overflow in the UA_Variant arrayDimensions product computation in op | HIGH | 8.8 | NVD | Jul 30, 2026 |
| CVE-2026-65421 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-63550 | The MMS BER decoder contains a boundary-handling flaw in the processing of cert | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-63035 | A heap use-after-free vulnerability in the TransferSubscriptions service in ope | HIGH | 8.1 | NVD | Jul 30, 2026 |
| CVE-2026-63033 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what f | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-61893 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated o | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-56758 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connec | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2024-25039 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-9322 | IBM WebSphere Application Server 9 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-66414 | Leantime 3 | MEDIUM | 6.1 | NVD | Jul 30, 2026 |
| CVE-2026-62663 | Banks generates meaningful LLM prompts using a simple template language | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-12945 | IBM Langflow OSS 1 | HIGH | 7.1 | NVD | Jul 30, 2026 |
| CVE-2026-12940 | IBM Langflow OSS 1 | CRITICAL | 9.8 | NVD | Jul 30, 2026 |
| CVE-2026-11885 | IBM PowerVM Hypervisor FW1110 | HIGH | 8.4 | NVD | Jul 30, 2026 |
| CVE-2026-54367 | CentreStack before 17 | HIGH | 8.6 | NVD | Jul 30, 2026 |
| CVE-2026-54366 | CentreStack before 17 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-54365 | CentreStack before 17 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-54364 | CentreStack before 17 | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-54363 | CentreStack before 17 | CRITICAL | 9.1 | NVD | Jul 30, 2026 |
| CVE-2026-47876 | VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual | CRITICAL | 9.3 | NVD | Jul 30, 2026 |
| CVE-2026-41703 | VMware ESX,ย Workstation, and Fusionย contain an out-of-bounds read vulnerability | HIGH | 7.6 | NVD | Jul 30, 2026 |
| CVE-2026-18382 | A flaw was found in koku-metrics-operator | MEDIUM | 6.8 | NVD | Jul 30, 2026 |
| CVE-2026-18381 | A flaw was found in the koku-metrics-operator for Red Hat OpenShift | HIGH | 7.6 | NVD | Jul 30, 2026 |
| CVE-2026-18378 | A flaw was found in koku-metrics-operator | HIGH | 7.6 | NVD | Jul 30, 2026 |
| CVE-2026-15397 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing | HIGH | 7.2 | NVD | Jul 30, 2026 |
| CVE-2026-22622 | Improper input validation in one of the session management interface of Eaton's | HIGH | 8.8 | NVD | Jul 30, 2026 |
| CVE-2026-22621 | Improper input validation in one of the session management interface of Eaton's | HIGH | 8.3 | NVD | Jul 30, 2026 |
| CVE-2026-22620 | Improper input validation in the authentication component ofย Eaton's Tripp Lite | HIGH | 8.6 | NVD | Jul 30, 2026 |
| CVE-2026-13395 | The Online Scheduling and Appointment Booking System WordPress plugin before 27 | HIGH | 8.6 | NVD | Jul 30, 2026 |
| CVE-2026-13330 | The Animation Addons for Elementor WordPress plugin before 2 | MEDIUM | 6.1 | NVD | Jul 30, 2026 |
| CVE-2026-13178 | The Eventin WordPress plugin before 4 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-12687 | The ProfileGrid WordPress plugin before 5 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-12500 | The WP Travel Engine WordPress plugin before 6 | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-11881 | The Fluent Forms WordPress plugin before 6 | MEDIUM | 6.1 | NVD | Jul 30, 2026 |
| CVE-2026-11867 | The Frontend Admin by DynamiApps WordPress plugin before 3 | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-1360 | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untruste | HIGH | 7.5 | NVD | Jul 30, 2026 |
| CVE-2026-16610 | The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to | CRITICAL | 9.8 | NVD | Jul 30, 2026 |
| CVE-2026-14356 | The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in a | HIGH | 8.8 | NVD | Jul 30, 2026 |
| CVE-2026-17664 | Insufficient validation of untrusted input in Loader in Google Chrome prior to 1 | MEDIUM | 6.5 | NVD | Jul 30, 2026 |
| CVE-2026-17663 | Insufficient validation of untrusted input in GPU in Google Chrome on Android pr | HIGH | 8.3 | NVD | Jul 30, 2026 |
| CVE-2026-17661 | Use after free in Loader in Google Chrome prior to 151 | HIGH | 8.8 | NVD | Jul 30, 2026 |
| CVE-2026-17660 | Insufficient validation of untrusted input in Network in Google Chrome prior to | HIGH | 8.3 | NVD | Jul 30, 2026 |
| CVE-2026-17658 | Use after free in V8 in Google Chrome prior to 151 | HIGH | 8.8 | NVD | Jul 30, 2026 |
| CVE-2026-17657 | Use after free in Navigation in Google Chrome prior to 151 | HIGH | 8.3 | NVD | Jul 30, 2026 |
| CVE-2026-17656 | Use after free in Ozone in Google Chrome prior to 151 | CRITICAL | 9.6 | NVD | Jul 30, 2026 |
| CVE-2026-17655 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | CRITICAL | 9.6 | NVD | Jul 30, 2026 |
| CVE-2026-17654 | Race in Updater in Google Chrome on Mac prior to 151 | HIGH | 7.8 | NVD | Jul 30, 2026 |
| CVE-2026-17653 | Use after free in Skia in Google Chrome prior to 151 | HIGH | 8.3 | NVD | Jul 30, 2026 |
| CVE-2026-17652 | Use after free in Views in Google Chrome prior to 151 | CRITICAL | 9.6 | NVD | Jul 30, 2026 |
| CVE-2026-17651 | Insufficient validation of untrusted input in Dawn in Google Chrome on Android p | CRITICAL | 9.6 | NVD | Jul 30, 2026 |
| CVE-2026-17650 | Use after free in Compositing in Google Chrome prior to 151 | HIGH | 8.3 | NVD | Jul 30, 2026 |
| CVE-2026-13723 | A vulnerability in the `zipx | MEDIUM | 6.5 | NVD | Jul 29, 2026 |
| CVE-2026-67194 | Courier IMAP before 6 | MEDIUM | 6.5 | NVD | Jul 29, 2026 |
| CVE-2026-64560 | posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwo | HIGH | 7.8 | NVD | Jul 29, 2026 |
| CVE-2026-64559 | s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer l | HIGH | 7.8 | NVD | Jul 29, 2026 |
| CVE-2026-64558 | s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check t | HIGH | 7.8 | NVD | Jul 29, 2026 |
| CVE-2026-54727 | proot-distro is a utility for managing proot containers | HIGH | 8.2 | NVD | Jul 29, 2026 |
| CVE-2026-54680 | Logging operator automates the deployment and configuration of Kubernetes loggin | CRITICAL | 9.9 | NVD | Jul 29, 2026 |
| CVE-2026-54574 | proot-distro is a utility for managing proot containers | HIGH | 8.2 | NVD | Jul 29, 2026 |
| CVE-2026-51992 | SQL Injection vulnerability in ClickHouse Server Versions <= 26 | CRITICAL | 9.1 | NVD | Jul 29, 2026 |
| CVE-2026-18255 | A flaw was found in Quay | HIGH | 7.2 | NVD | Jul 29, 2026 |
| CVE-2026-15144 | @fastify/rate-limit before 11 | HIGH | 7.3 | NVD | Jul 29, 2026 |
| CVE-2026-13697 | undici's cache interceptor mishandles malformed Cache-Control private directives | HIGH | 7.4 | NVD | Jul 29, 2026 |
| CVE-2025-60931 | An Insecure Direct Object Reference (IDOR) in the Employee Compensation View fun | HIGH | 7.5 | NVD | Jul 29, 2026 |
| CVE-2026-14270 | The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCom | HIGH | 8.8 | NVD | Jul 29, 2026 |
| CVE-2026-8791 | The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Sit | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-7436 | The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to S | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-5060 | The MasterStudy LMS WordPress Plugin โ for Online Courses and Education plugin f | MEDIUM | 6.5 | NVD | Jul 29, 2026 |
| CVE-2026-18220 | An out-of-bounds write vulnerability was found in the BFD library's DLX ELF back | HIGH | 7.8 | NVD | Jul 29, 2026 |
| CVE-2026-16655 | The Fluent Forms โ Customizable Contact Forms, Survey, Quiz, & Conversational Fo | HIGH | 7.2 | NVD | Jul 29, 2026 |
| CVE-2026-16597 | The GTM4WP โ A Google Tag Manager (GTM) plugin for WordPress plugin for WordPres | HIGH | 7.2 | NVD | Jul 29, 2026 |
| CVE-2026-14900 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Cod | CRITICAL | 9.8 | NVD | Jul 29, 2026 |
| CVE-2026-14488 | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via | CRITICAL | 9.1 | NVD | Jul 29, 2026 |
| CVE-2026-63234 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed | CRITICAL | 9.9 | NVD | Jul 29, 2026 |
| CVE-2026-63233 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed | CRITICAL | 9.9 | NVD | Jul 29, 2026 |
| CVE-2026-63232 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed | CRITICAL | 9.9 | NVD | Jul 29, 2026 |
| CVE-2026-63231 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an auth | HIGH | 8.1 | NVD | Jul 29, 2026 |
| CVE-2026-63230 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allo | CRITICAL | 9.1 | NVD | Jul 29, 2026 |
| CVE-2026-63229 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an | CRITICAL | 9.1 | NVD | Jul 29, 2026 |
| CVE-2026-63227 | An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authen | CRITICAL | 9.9 | NVD | Jul 29, 2026 |
| CVE-2026-14300 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Wo | HIGH | 8.1 | NVD | Jul 29, 2026 |
| CVE-2026-14234 | The WOLF WordPress plugin before 1 | HIGH | 7.1 | NVD | Jul 29, 2026 |
| CVE-2026-13690 | The UsersWP WordPress plugin before 1 | HIGH | 7.4 | NVD | Jul 29, 2026 |
| CVE-2026-13605 | The PhotoSwipe WordPress plugin through 4 | MEDIUM | 6.8 | NVD | Jul 29, 2026 |
| CVE-2026-13423 | The Streamit WordPress theme through 4 | CRITICAL | 9.8 | NVD | Jul 29, 2026 |
| CVE-2026-11974 | The wp-media-folder-addon WordPress plugin through 4 | HIGH | 8.6 | NVD | Jul 29, 2026 |
| CVE-2026-18072 | The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick | CRITICAL | 9.8 | NVD | Jul 29, 2026 |
| CVE-2026-17162 | The WowStore โ Store Builder & Product Blocks for WooCommerce plugin for WordPre | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-17161 | The WowStore โ Store Builder & Product Blocks for WooCommerce plugin for WordPre | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-15735 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-S | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-12939 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scr | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-12938 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scr | MEDIUM | 6.4 | NVD | Jul 29, 2026 |
| CVE-2026-12144 | The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Es | HIGH | 8.8 | NVD | Jul 29, 2026 |
| CVE-2026-56822 | Netty is an asynchronous, event-driven network application framework | HIGH | 7.4 | NVD | Jul 29, 2026 |
| CVE-2026-56821 | Netty is an asynchronous, event-driven network application framework | HIGH | 7.4 | NVD | Jul 29, 2026 |
| CVE-2026-20316 | Cisco - Secure Firewall Management Center (FMC) | CRITICAL | N/A | CISA | Jul 29, 2026 |
| CVE-2026-66063 | goshs is a feature-rich single-binary file server for red teamers and developers | MEDIUM | 6.5 | NVD | Jul 28, 2026 |
| CVE-2026-64863 | goshs is a feature-rich single-binary file server for red teamers and developers | CRITICAL | 9.1 | NVD | Jul 28, 2026 |
| CVE-2026-62325 | goshs is a feature-rich single-binary file server for red teamers and developers | CRITICAL | 9.1 | NVD | Jul 28, 2026 |
| CVE-2026-54719 | goshs is a feature-rich single-binary file server for red teamers and developers | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-54658 | Hypequery is a TypeScript semantic layer for ClickHouse | CRITICAL | 9.8 | NVD | Jul 28, 2026 |
| CVE-2026-54650 | openhole exposes localhost to the internet in one command | HIGH | 8.6 | NVD | Jul 28, 2026 |
| CVE-2026-54638 | gotd/td is a T Telegram MTProto API client in Go | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-47219 | find-my-way is a framework-independent HTTP router that internally uses a Radix | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-51275 | In schreibfaul1 ESP32-audioI2S 3 | HIGH | 8.8 | NVD | Jul 28, 2026 |
| CVE-2026-51274 | In schreibfaul1 ESP32-audioI2S 3 | HIGH | 8.8 | NVD | Jul 28, 2026 |
| CVE-2026-51273 | In schreibfaul1 ESP32-audioI2S 3 | HIGH | 7.8 | NVD | Jul 28, 2026 |
| CVE-2026-16313 | A flaw was found in sg3_utils | HIGH | 7.6 | NVD | Jul 28, 2026 |
| CVE-2026-7868 | IBM OPENBMC FW1110 | MEDIUM | 6.5 | NVD | Jul 28, 2026 |
| CVE-2026-66749 | Let's Chat 0 | MEDIUM | 6.5 | NVD | Jul 28, 2026 |
| CVE-2026-66748 | Camaleon CMS versions 2 | HIGH | 8.8 | NVD | Jul 28, 2026 |
| CVE-2026-61609 | Pterodactyl is a free, open-source game server management panel | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-18047 | A flaw was found in Dogtag PKI's ACME responder where the web | MEDIUM | 6.5 | NVD | Jul 28, 2026 |
| CVE-2026-15393 | The Cozy Blocks โ Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 | MEDIUM | 6.4 | NVD | Jul 28, 2026 |
| CVE-2026-15016 | The Paid Memberships Pro โ Content Restriction, User Registration, & Paid Subscr | MEDIUM | 6.4 | NVD | Jul 28, 2026 |
| CVE-2026-15025 | The Uncanny Automator โ Easy Automation, Integration, Webhooks & Workflow Builde | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-13440 | The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Che | HIGH | 7.2 | NVD | Jul 28, 2026 |
| CVE-2026-12741 | The WP Fast Total Search โ The Power of Indexed Search plugin for WordPress is v | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-11756 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App | CRITICAL | 10.0 | NVD | Jul 28, 2026 |
| CVE-2026-6251 | The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Bli | MEDIUM | 6.5 | NVD | Jul 28, 2026 |
| CVE-2026-16585 | The Better Messages โ Chat Rooms, Group Chat, Private Messages & AI Chat Bots pl | HIGH | 7.2 | NVD | Jul 28, 2026 |
| CVE-2026-14924 | The Tablesome Table WordPress plugin before 1 | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-14870 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin befor | HIGH | 7.1 | NVD | Jul 28, 2026 |
| CVE-2026-14545 | The TrueBooker WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Jul 28, 2026 |
| CVE-2026-14490 | The Demi โ One Click Demo Import, WP Backup & Site Migration plugin for WordPres | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-17528 | Versions of the package nice-select2 before 2 | MEDIUM | 6.1 | NVD | Jul 28, 2026 |
| CVE-2026-17524 | Versions of the package zip-lib before 1 | HIGH | 7.5 | NVD | Jul 28, 2026 |
| CVE-2026-66473 | Unauthenticated Broken Access Control in Xendit Payment <= 7 | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-65448 | Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – | MEDIUM | 6.5 | NVD | Jul 27, 2026 |
| CVE-2026-65447 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65446 | Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65445 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1 | MEDIUM | 6.5 | NVD | Jul 27, 2026 |
| CVE-2026-65443 | Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65442 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3 | HIGH | 7.2 | NVD | Jul 27, 2026 |
| CVE-2026-65441 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65440 | Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65439 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65438 | Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-65437 | Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWal | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-61957 | Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-61953 | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro | HIGH | 7.2 | NVD | Jul 27, 2026 |
| CVE-2026-51565 | Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController | MEDIUM | 6.1 | NVD | Jul 27, 2026 |
| CVE-2025-63913 | An issue was discovered in OpenSBI 1 | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-51235 | LibRaw 0 | HIGH | 8.8 | NVD | Jul 27, 2026 |
| CVE-2026-48030 | Pheditor is a single-file editor and file manager written in PHP | CRITICAL | 9.9 | NVD | Jul 27, 2026 |
| CVE-2026-45623 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-17568 | Improper access control in the role membership management endpoint in Devolution | HIGH | 8.8 | NVD | Jul 27, 2026 |
| CVE-2026-17552 | Plack::App::Prerender versions before 0 | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-66731 | facil | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-66730 | facil | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-66729 | facil | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-66391 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability | MEDIUM | 6.5 | NVD | Jul 27, 2026 |
| CVE-2026-66390 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | MEDIUM | 6.1 | NVD | Jul 27, 2026 |
| CVE-2026-63077 | In JetBrains TeamCity before 2026 | CRITICAL | 9.8 | NVD | Jul 27, 2026 |
| CVE-2026-24252 | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS co | HIGH | 7.8 | NVD | Jul 27, 2026 |
| CVE-2026-17192 | A VCO feature does not sufficiently validate caller-supplied input, allowing req | HIGH | 8.5 | NVD | Jul 27, 2026 |
| CVE-2026-17191 | An input validation vulnerability exists in an API component of the orchestrator | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-58662 | Thrift โ Improper Validation of Specified Quantity in Input, Out-of-b | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-58389 | Thrift โ Allocation of Resources Without Limits or Throttling vulnera | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-58023 | Thrift โ Out-of-bounds Read vulnerability in Apache Thrift c_glib bin | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-55971 | Thrift โ Heap-based Buffer Overflow vulnerability in Apache Thrift C+ | CRITICAL | 9.8 | NVD | Jul 27, 2026 |
| CVE-2026-55970 | Thrift โ Buffer Over-read vulnerability in Apache Thrift C++ bindings | MEDIUM | 6.5 | NVD | Jul 27, 2026 |
| CVE-2026-55969 | Thrift โ Integer Overflow or Wraparound vulnerability in Apache Thrif | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-55968 | Thrift โ Inefficient Algorithmic Complexity, Allocation of Resources | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-49158 | Thrift โ Improper Handling of Highly Compressed Data (Data Amplificat | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-48586 | Thrift โ Improper Handling of Highly Compressed Data (Data Amplificat | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-48145 | Thrift โ Improper Validation of Certificate with Host Mismatch vulner | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-48144 | Thrift โ Improper Validation of Certificate with Host Mismatch vulner | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-45112 | Thrift โ Allocation of Resources Without Limits or Throttling vulnera | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-43871 | Thrift โ Loop with Unreachable Exit Condition ('Infinite Loop') vulne | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-41608 | Thrift โ Improper Handling of Highly Compressed Data (Data Amplificat | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-14568 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Pro | MEDIUM | 6.5 | NVD | Jul 27, 2026 |
| CVE-2026-14289 | The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5 | CRITICAL | 9.0 | NVD | Jul 27, 2026 |
| CVE-2026-14235 | The Download Manager WordPress plugin before 3 | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-14190 | The Sina Extension for Elementor WordPress plugin before 3 | MEDIUM | 6.1 | NVD | Jul 27, 2026 |
| CVE-2026-13726 | The MPG WordPress plugin before 4 | HIGH | 7.1 | NVD | Jul 27, 2026 |
| CVE-2026-13714 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5 | CRITICAL | 9.8 | NVD | Jul 27, 2026 |
| CVE-2026-13597 | The ๅพฎไฟกไบ็ปด็ ็ป้ WordPress plugin through 1 | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-13400 | Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site | MEDIUM | 6.1 | NVD | Jul 27, 2026 |
| CVE-2026-13332 | The Masteriyo LMS WordPress plugin before 2 | CRITICAL | 9.1 | NVD | Jul 27, 2026 |
| CVE-2026-13152 | The Custom Fields Account Registration For Woocommerce WordPress plugin before 1 | HIGH | 8.1 | NVD | Jul 27, 2026 |
| CVE-2026-12982 | The Document Gallery WordPress plugin before 5 | MEDIUM | 6.1 | NVD | Jul 27, 2026 |
| CVE-2026-12493 | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1 | HIGH | 7.5 | NVD | Jul 27, 2026 |
| CVE-2026-12394 | The MemberGlut WordPress plugin before 1 | CRITICAL | 9.8 | NVD | Jul 27, 2026 |
| CVE-2026-12255 | The MainWP Child WordPress plugin before 6 | HIGH | 8.1 | NVD | Jul 27, 2026 |
| CVE-2026-10082 | The Advanced Ads WordPress plugin before 2 | MEDIUM | 6.1 | NVD | Jul 27, 2026 |
| CVE-2025-15662 | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin bef | HIGH | 8.6 | NVD | Jul 27, 2026 |
| CVE-2026-16812 | Arista - VeloCloud Orchestrator | CRITICAL | N/A | CISA | Jul 27, 2026 |
| CVE-2025-68686 | Fortinet - FortiOS | CRITICAL | N/A | CISA | Jul 27, 2026 |
| CVE-2026-57990 | Files or directories accessible to external parties in Microsoft Edge (Chromium- | HIGH | 7.4 | NVD | Jul 26, 2026 |
| CVE-2026-57989 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorize | HIGH | 7.4 | NVD | Jul 26, 2026 |
| CVE-2026-17497 | NoteGen before 0 | HIGH | 8.3 | NVD | Jul 26, 2026 |
| CVE-2026-17496 | NoteGen before 0 | HIGH | 8.1 | NVD | Jul 26, 2026 |
| CVE-2026-17458 | A vulnerability was found in mf-yang openclaw-cn up to 0 | MEDIUM | 6.3 | NVD | Jul 26, 2026 |
| CVE-2026-64530 | net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() | CRITICAL | 9.8 | NVD | Jul 26, 2026 |
| CVE-2024-14040 | net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur a | HIGH | 7.8 | NVD | Jul 26, 2026 |
| CVE-2026-63720 | datamodel-code-generator prior to version 0 | HIGH | 7.5 | NVD | Jul 26, 2026 |
| CVE-2026-17434 | A flaw has been found in nanocoai NanoClaw up to 2 | MEDIUM | 6.3 | NVD | Jul 26, 2026 |
| CVE-2026-15962 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Objec | HIGH | 8.8 | NVD | Jul 26, 2026 |
| CVE-2026-10681 | In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/us | MEDIUM | 6.5 | NVD | Jul 25, 2026 |
| CVE-2026-66012 | SiYuan before v3 | CRITICAL | 10.0 | NVD | Jul 25, 2026 |
| CVE-2026-15425 | The Yoast SEO โ Advanced SEO with real-time guidance and built-in AI plugin for | MEDIUM | 6.4 | NVD | Jul 25, 2026 |
| CVE-2026-14955 | The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerab | MEDIUM | 6.5 | NVD | Jul 25, 2026 |
| CVE-2026-10818 | The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in a | HIGH | 8.1 | NVD | Jul 25, 2026 |
| CVE-2026-66374 | Knot Resolver before 6 | HIGH | 8.1 | NVD | Jul 25, 2026 |
| CVE-2026-66373 | Redis before 8 | HIGH | 7.5 | NVD | Jul 25, 2026 |
| CVE-2026-54342 | In epa4all, prior to version 2026-05-20, an attacker on the network path between | HIGH | 8.1 | NVD | Jul 24, 2026 |
| CVE-2026-48021 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS c | CRITICAL | 9.1 | NVD | Jul 24, 2026 |
| CVE-2026-17107 | A flaw was found in the cluster-proxy service-proxy component used in Red Hat Ad | HIGH | 8.5 | NVD | Jul 24, 2026 |
| CVE-2026-66035 | libssh2 through 1 | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-66034 | libssh2 through 1 | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-66033 | libssh2 through 1 | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-66032 | libssh2 through 1 | HIGH | 8.8 | NVD | Jul 24, 2026 |
| CVE-2026-65711 | sysPass through version 3 | HIGH | 7.2 | NVD | Jul 24, 2026 |
| CVE-2026-65710 | sysPass through version 3 | HIGH | 7.1 | NVD | Jul 24, 2026 |
| CVE-2026-65709 | sysPass through version 3 | HIGH | 8.3 | NVD | Jul 24, 2026 |
| CVE-2026-65708 | sysPass through version 3 | HIGH | 8.1 | NVD | Jul 24, 2026 |
| CVE-2026-65707 | Likeshop through 3 | MEDIUM | 6.5 | NVD | Jul 24, 2026 |
| CVE-2026-9765 | Note: The CVE and blog post don't exist because we determined this is actually a | HIGH | 7.1 | NVD | Jul 24, 2026 |
| CVE-2026-66144 | Although remote policy references are not retrieved during policy normalization, | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-66143 | It is possible to bypass theย maximum number of normalized policy alternatives th | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-66142 | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-66010 | DOMPurify before 3 | MEDIUM | 6.1 | NVD | Jul 24, 2026 |
| CVE-2026-45816 | NULL Pointer Dereference vulnerability in Apache NimBLE inย LE Long Term Key Requ | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-45815 | Reachable Assertion vulnerability in Apache NimBLE | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-45813 | Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apa | HIGH | 8.8 | NVD | Jul 24, 2026 |
| CVE-2026-45812 | Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when process | MEDIUM | 6.5 | NVD | Jul 24, 2026 |
| CVE-2026-45811 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerabi | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-15653 | The Visualizer โ Tables & Charts Manager with Built-in AI Generator plugin for W | MEDIUM | 6.4 | NVD | Jul 24, 2026 |
| CVE-2026-15648 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Si | MEDIUM | 6.4 | NVD | Jul 24, 2026 |
| CVE-2026-15464 | The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scr | MEDIUM | 6.4 | NVD | Jul 24, 2026 |
| CVE-2026-15334 | The Cozy Blocks โ Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 | MEDIUM | 6.4 | NVD | Jul 24, 2026 |
| CVE-2026-15333 | The Cozy Blocks โ Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 | MEDIUM | 6.4 | NVD | Jul 24, 2026 |
| CVE-2026-14603 | The WowOptin: Next-Gen Popup Maker WordPress plugin before 1 | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-14172 | Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables | HIGH | 7.8 | NVD | Jul 24, 2026 |
| CVE-2026-12981 | The CAFEHAUS API WordPress plugin through 1 | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-12877 | The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5 | CRITICAL | 9.1 | NVD | Jul 24, 2026 |
| CVE-2026-12688 | The ProfileGrid WordPress plugin before 5 | MEDIUM | 6.5 | NVD | Jul 24, 2026 |
| CVE-2026-12497 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User | HIGH | 7.5 | NVD | Jul 24, 2026 |
| CVE-2026-16870 | Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior | HIGH | 8.8 | NVD | Jul 24, 2026 |
| CVE-2026-66141 | Exim before 4 | HIGH | 7.4 | NVD | Jul 24, 2026 |
| CVE-2026-66140 | Exim before 4 | HIGH | 8.4 | NVD | Jul 24, 2026 |
| CVE-2026-66138 | In OpenStack Ironic Python Agent through 11 | HIGH | 7.2 | NVD | Jul 24, 2026 |
| CVE-2026-12736 | The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in vers | HIGH | 8.0 | NVD | Jul 24, 2026 |
| CVE-2025-9205 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in | MEDIUM | 6.4 | NVD | Jul 24, 2026 |
| CVE-2026-62825 | Improper authentication in Azure Key Vault allows an unauthorized attacker to el | CRITICAL | 10.0 | NVD | Jul 24, 2026 |
| CVE-2026-58275 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr | CRITICAL | 10.0 | NVD | Jul 24, 2026 |
| CVE-2026-56191 | Improper authentication in Microsoft Exchange Online allows an unauthorized atta | CRITICAL | 10.0 | NVD | Jul 24, 2026 |
| CVE-2026-56167 | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attac | HIGH | 8.5 | NVD | Jul 24, 2026 |
| CVE-2026-56165 | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker | CRITICAL | 9.8 | NVD | Jul 24, 2026 |
| CVE-2026-56160 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att | CRITICAL | 9.1 | NVD | Jul 24, 2026 |
| CVE-2026-54120 | Improper input validation in Microsoft Surface allows an authorized attacker to | CRITICAL | 9.9 | NVD | Jul 24, 2026 |
| CVE-2026-50517 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker | CRITICAL | 9.9 | NVD | Jul 24, 2026 |
| CVE-2026-49159 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph al | MEDIUM | 6.5 | NVD | Jul 24, 2026 |
| CVE-2026-35425 | Improper access control in Azure API Management (APIM) allows an authorized atta | HIGH | 8.0 | NVD | Jul 24, 2026 |
| CVE-2026-50044 | Pronetiqs IntraVUE versions 3 | MEDIUM | 6.8 | NVD | Jul 23, 2026 |
| CVE-2026-42933 | Pronetiqs IntraVUE versions 3 | CRITICAL | 10.0 | NVD | Jul 23, 2026 |
| CVE-2026-40430 | Pronetiqs IntraVUE Versions 3 | HIGH | 7.5 | NVD | Jul 23, 2026 |
| CVE-2026-28698 | Pronetiqs IntraVUE versions 3 | HIGH | 8.6 | NVD | Jul 23, 2026 |
| CVE-2026-16767 | A vulnerability was detected in Ne-Lexa php-zip up to 4 | MEDIUM | 6.5 | NVD | Jul 23, 2026 |
| CVE-2026-65702 | Vanna through 2 | HIGH | 8.6 | NVD | Jul 23, 2026 |
| CVE-2026-65701 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path trav | CRITICAL | 9.1 | NVD | Jul 23, 2026 |
| CVE-2026-65700 | h2oGPT through 0 | CRITICAL | 9.8 | NVD | Jul 23, 2026 |
| CVE-2026-47755 | ITFlow provides an IT documentation, ticketing and accounting system for small m | MEDIUM | 6.5 | NVD | Jul 23, 2026 |
| CVE-2026-47752 | Tugtainer is a self-hosted app for automating updates of Docker containers | CRITICAL | 9.9 | NVD | Jul 23, 2026 |
| CVE-2026-47743 | Shopper is a Headless e-commerce Admin Panel | HIGH | 8.7 | NVD | Jul 23, 2026 |
| CVE-2026-47668 | DbGate is cross-platform database manager | CRITICAL | 10.0 | NVD | Jul 23, 2026 |
| CVE-2026-65697 | Fathom Lite through 1 | MEDIUM | 6.1 | NVD | Jul 23, 2026 |
| CVE-2026-65695 | Office-Word-MCP-Server through 1 | MEDIUM | 6.8 | NVD | Jul 23, 2026 |
| CVE-2026-44909 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP | HIGH | 7.5 | NVD | Jul 23, 2026 |
| CVE-2026-16232 | Check Point - SmartConsole | CRITICAL | N/A | CISA | Jul 22, 2026 |
| CVE-2026-50522 | Microsoft - SharePoint | CRITICAL | N/A | CISA | Jul 22, 2026 |
| CVE-2026-0770 | Langflow - Langflow | CRITICAL | N/A | CISA | Jul 21, 2026 |
| CVE-2026-60137 | WordPress - Core | CRITICAL | N/A | CISA | Jul 21, 2026 |
| CVE-2026-63030 | WordPress - Core | CRITICAL | N/A | CISA | Jul 21, 2026 |
| CVE-2021-27137 | DD-WRT - DD-WRT | CRITICAL | N/A | CISA | Jul 21, 2026 |
| CVE-2026-25089 | Fortinet - FortiSandbox | CRITICAL | N/A | CISA | Jul 16, 2026 |
| CVE-2026-58644 | Microsoft - SharePoint | CRITICAL | N/A | CISA | Jul 16, 2026 |
| CVE-2026-39808 | Fortinet - FortiSandbox | CRITICAL | N/A | CISA | Jul 16, 2026 |
| CVE-2026-46817 | Oracle - E-Business Suite | CRITICAL | N/A | CISA | Jul 15, 2026 |
| CVE-2023-4346 | KNX Association - KNX Protocol Connection Authorization Option 1 | CRITICAL | N/A | CISA | Jul 15, 2026 |
| CVE-2026-56164 | Microsoft - SharePoint Server | CRITICAL | N/A | CISA | Jul 14, 2026 |
| CVE-2026-15410 | SonicWall - SMA1000 Appliances | CRITICAL | N/A | CISA | Jul 14, 2026 |
| CVE-2026-15409 | SonicWall - SMA1000 Appliances | CRITICAL | N/A | CISA | Jul 14, 2026 |
| CVE-2026-56155 | Microsoft - Active Directory Federation Services | CRITICAL | N/A | CISA | Jul 14, 2026 |
| CVE-2008-4128 | Cisco - IOS | CRITICAL | N/A | CISA | Jul 13, 2026 |
| CVE-2026-48939 | iCagenda - iCagenda | CRITICAL | N/A | CISA | Jul 10, 2026 |
| CVE-2026-56291 | Balbooa - Forms | CRITICAL | N/A | CISA | Jul 10, 2026 |
| EDB-52629 | [webapps] Krayin CRM v2.2.x - Authenticated Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Jul 08, 2026 |
| EDB-52627 | [webapps] Langflow 1.9.0 - RCE | HIGH | N/A | EXPLOIT-DB | Jul 08, 2026 |
| EDB-52628 | [webapps] Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure | HIGH | N/A | EXPLOIT-DB | Jul 08, 2026 |
| EDB-52626 | [webapps] Joomla Page Builder CK 3.5.10 - Arbitrary File Upload | HIGH | N/A | EXPLOIT-DB | Jul 08, 2026 |
| EDB-52620 | [webapps] Tenable Nessus 10.12.1 - SQL Injection | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52621 | [webapps] Discuz! X5.0 - Authentication Bypass | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52623 | [webapps] Flowise 3.1.3 - arbitrary code execution | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52622 | [remote] Hydra - Stack Buffer Overflow | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52624 | [local] ProtonVPN v4.4.1 - Unquoted Service Path | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52625 | [webapps] MCPJam Inspector - Remote Code Execution | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| CVE-2026-55255 | Langflow - Langflow | CRITICAL | N/A | CISA | Jul 07, 2026 |
| CVE-2026-48908 | JoomShaper - SP Page Builder | CRITICAL | N/A | CISA | Jul 07, 2026 |
| EDB-52618 | [remote] iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52619 | [webapps] WordPress Bricks Builder Theme - RCE | HIGH | N/A | EXPLOIT-DB | Jul 07, 2026 |
| EDB-52617 | [webapps] Joomla Extension 4.1.4 - PHP Object injection | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52615 | [local] MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52612 | [local] Windows Defender (MsMpEng.exe) - Race Condition | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52613 | [webapps] KNX visualisering - Broken Access Control | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52614 | [webapps] KeepInMind 0.8.4.2 - Stored XSS | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52616 | [webapps] Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52611 | [webapps] WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) | HIGH | N/A | EXPLOIT-DB | Jul 06, 2026 |
| EDB-52610 | [webapps] OpenEMR 7.0.2 - Arbitrary File Read | HIGH | N/A | EXPLOIT-DB | Jun 08, 2026 |
3922 results