boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Wednesday, October 14, 2026 · all times UTC← 2026-10-13 · archive

Security Box Score — October 14, 2026 — page 3

Edition of October 14, 2026, continued — page 3 of 3. Back to page 1 · page 2

Results (continued, ranked) — ranks 307–821 of 821
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-1028997.628.6getsentrysentryCWE-287Sentry: Improper authentication on SAML SSO process allows user identity linking
CVE-2026-1107196.928.7Portkey-AIgatewayCWE-918Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
CVE-2026-1002296.528.7Red HatRed Hat Enterprise Linux 10CWE-787Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write…
CVE-2026-553867.128.5InvoiceShelfInvoiceShelfCWE-89InvoiceShelf ORDER BY SQL injection through orderByField
CVE-2026-1052366.328.5ErlangOTPCWE-295TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate…
CVE-2026-1106952.128.4turboderpExLlamaV2CWE-119turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor b…
CVE-2026-1073508.828.3n/aPgBouncerCWE-287Authentication bypass via second StartupMessage during SCRAM authentication i…
CVE-2026-852987.328.3Google CloudApplication IntegrationCWE-863Improper Authorization in Google Cloud Application Integration Leads to Privi…
CVE-2026-731355.328.2GiteaGiteaCWE-200Gitea hidden-owner repository listing disclosure
CVE-2026-1049398.728.0F5NGINX Ingress ControllerCWE-303NGINX Ingress Controller vulnerability
CVE-2026-1094386.327.93proxy3proxyCWE-9083proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
CVE-2026-737937.927.9Hewlett Packard EnterpriseHPE NonStop MiddlewareCWE-502HPE NonStop Middleware - Secret key handling vulnerability
CVE-2026-1029447.527.8yhirosecpp-httplibCWE-522cpp-httplib: Cookie header leaked on cross-origin redirect
CVE-2026-1106272.127.8MacWarriorclipbucket-v5CWE-79ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
CVE-2026-1019738.727.7Juniper NetworksJunos OSCWE-476Junos OS: Malformed packet causes pkid denial of service when certificate re-…
CVE-2026-1108526.327.6n8n-ion8nCWE-288n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution vi…
CVE-2026-1106265.127.5MacWarriorclipbucket-v5CWE-79ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_…
CVE-2026-337988.727.1Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code exe…
CVE-2026-1027555.127.1dataeasedataeaseCWE-79DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting
CVE-2026-1105925.127.0MicroPyramidBottleCRMCWE-116BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
CVE-2026-1020148.726.9Juniper NetworksJunos OSCWE-121Junos OS: An attacker causes authd to crash when subscriber RADIUS authentica…
CVE-2026-1020158.726.9Juniper NetworksJunos OSCWE-122Junos OS and Junos OS Evolved: An attacker causes root code execution when 80…
CVE-2026-1020698.726.9Juniper NetworksJunos OSCWE-121Junos OS: An ICCP peer causes dot1xd to crash when dot1x synchronization is e…
CVE-2026-1004068.226.9dbt-labsdbt-coreCWE-22dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
CVE-2026-732617.526.9cesantamongooseCWE-20Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts…
CVE-2026-1095065.926.5TP-Link Systems Inc.RE190 v5CWE-287Improper Authentication in Multiple TP-Link WiFi Repeaters
CVE-2026-1033078.626.4UnknownWalletdoc Payment Gateway for WooCommerceCWE-89Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and …
CVE-2026-1047677.526.4davefxMembership & User Roles for WooCommerce (Automatic Role Changer)CWE-269Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 …
CVE-2026-556828.126.1LabRedesCefetRJWeGIACWE-200WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak i…
CVE-2026-1106685.526.2cemtansar2htmlCWE-74cemtan sar2html sar2html.py index sql injection
CVE-2026-1020828.226.0Juniper NetworksJunos OSCWE-166Junos OS: SRX Series: If TLS session resumption is configured and a specific …
CVE-2026-553877.225.9InvoiceShelfInvoiceShelfCWE-284InvoiceShelf bulk deletion lacks company scoping
CVE-2026-704066.526.0GiteaGiteaCWE-863Gitea private comparison disclosure with public-only tokens
CVE-2026-1020498.725.8Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code ex…
CVE-2026-1020528.725.8Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DH…
CVE-2026-1020618.725.8Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: An attacker causes root code execution when SZ…
CVE-2026-539997.725.9radius-projectradiusCWE-20Radius Controller May Delete a Container Resource via an Injected Deployment …
CVE-2026-1020778.725.7Juniper NetworksJunos OSCWE-754Junos OS: MX Series with SPC3: In a source NAT scenario malformed packets wil…
CVE-2026-196737.125.7zephyrprojectzephyrCWE-125Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when pa…
CVE-2026-921606.525.7nasafprimeCWE-190F´: SendPartial Integer Overflow Leading to Assertion DoS
CVE-2026-1106116.025.7getrebuildrebuildCWE-639REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
CVE-2026-824025.325.6gogsgogsCWE-601Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`
CVE-2026-1108457.725.4n8n-ion8nCWE-15n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Opera…
CVE-2026-1013418.725.3NLnet LabsNSDCWE-121Stack overwrite from specially formatted TXT-DATA RDATA field
CVE-2026-148519.224.8CopartCopart’s online billing serviceCWE-200Unauthorised disclosure of information on Copart’s online billing service
CVE-2026-943706.524.8qtQt_for_MCUsCWE-415Memory corruption (double free / use-after-free) vulnerability in core string…
CVE-2026-1074317.524.5CrocoblockJetFormBuilderCWE-862WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
CVE-2026-1073205.324.5UnknownGamiPressCWE-200GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
CVE-2026-1108072.124.5sgl-projectSGLangCWE-404sgl-project SGLang generate Endpoint io_struct.py denial of service
CVE-2026-502188.524.3AkamaiGuardicore Platform AgentCWE-99Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 imp…
CVE-2026-1020788.224.3Juniper NetworksJunos OSCWE-416Junos OS: SRX Series: A high volume of DNS traffic over TCP can lead to a flo…
CVE-2026-1106982.124.3n/aPraatCWE-119Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write
CVE-2026-1002368.624.1Red HatFast Datapath for RHEL 10CWE-787Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
CVE-2026-1020536.924.1Juniper NetworksJunos OSCWE-401Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of ser…
CVE-2026-03216.624.0Palo Alto NetworksCloud NGFWCWE-754PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services
CVE-2026-1106242.324.1papermergepapermerge-coreCWE-862Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /docume…
CVE-2026-1020558.724.0Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remo…
CVE-2026-737988.224.0Hewlett Packard EnterpriseHPE NonStop DNS 9.2.3 Non Secure VersionCWE-115HPE NonStop DNS 9.2.3 Non Secure Version
CVE-2026-502165.323.9AkamaiGuardicore Platform AgentCWE-191An integer underflow exists in the DNS proxy component of the macOS NetworkEx…
CVE-2026-1108095.323.8sgl-projectSGLangCWE-404sgl-project SGLang Session Cleanup session_controller.py Session.create_req d…
CVE-2026-1033587.523.6VillaThemeEmail Template Customizer for WooCommerceCWE-94WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content…
CVE-2026-1077517.223.6kitae-parkMang BoardCWE-79Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_n…
CVE-2026-1024716.923.7Eclipse FoundationEclipse Vert.xCWE-93CRLF header injection in vertx-mail-client allows manipulation of outgoing SM…
CVE-2026-1041096.823.6error311FileRiseCWE-59FileRise: Authenticated ZIP extraction follows a pre-existing symlink and del…
CVE-2026-879745.323.6UnknownAsaas Gateway for WooCommerceCWE-287Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass …
CVE-2026-1108629.323.5better-authbetter-authCWE-287Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
CVE-2026-1013378.723.4NLnet LabsNSDCWE-121Stack overwrite from specially formatted base64 RDATA field
CVE-2026-1013388.723.4NLnet LabsNSDCWE-121Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
CVE-2026-1013398.723.4NLnet LabsNSDCWE-121Stack overwrite from a specially crafted and formatted HIP RR
CVE-2026-1064658.723.4Eclipse FoundationNetX DuoCWE-290The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly gen…
CVE-2026-867976.823.4UnknownPricing TableCWE-79Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link
CVE-2026-1046446.823.4UnknownImage Photo Gallery Final Tiles GridCWE-79Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via G…
CVE-2026-1052616.823.4UnknownSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change CategoriesCWE-79PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' a…
CVE-2026-1019266.523.4hyyanHyyan WooCommerce Polylang IntegrationCWE-89Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+)…
CVE-2026-1104665.323.2WisdomGardenTronclassCWE-497WisdomGarden｜Tronclass - Sensitive Data Exposure
CVE-2026-888297.223.0Red HatRed Hat Hardened ImagesCWE-444Busybox: busybox: http request smuggling via pipelined requests in httpd reve…
CVE-2026-03184.623.0Palo Alto NetworksCloud NGFWCWE-754PAN-OS: Denial of Service (DoS) on Panorama
CVE-2026-1024608.622.9Eclipse FoundationEclipse Vert.x—In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9]…
CVE-2026-1030817.522.9VillaThemeSalevoCWE-94WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability
CVE-2026-1010256.922.9F5NGINX JavaScriptCWE-401NGINX ngx_http_js_module vulnerability
CVE-2026-704074.322.9GiteaGiteaCWE-285Gitea organization listing token scope bypass
CVE-2026-1076317.222.8davidevalerioRecord of Consent Extension for ComplianzCWE-79Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cro…
CVE-2026-1077566.422.8tigroumeowMeow LightboxCWE-79Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Script…
CVE-2026-1020838.222.6Juniper NetworksJunos OSCWE-413Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load c…
CVE-2026-737908.222.4Hewlett Packard EnterpriseHPE NonStop iTP WebServerCWE-20HPE NonStop iTP WebServer - Memory corruption vulnerability
CVE-2026-1108427.722.5n8n-ion8nCWE-1321n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation …
CVE-2026-890737.522.5ProgressMOVEit TransferCWE-613MOVEit Transfer Access restriction bypass in OAuth authentication
CVE-2026-1108486.022.5n8n-ion8nCWE-1321n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow B…
CVE-2026-737923.822.4Hewlett Packard EnterpriseHPE NonStop Java JToolkitCWE-78HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability
CVE-2026-1019367.122.3Juniper NetworksJunos OSCWE-617Junos OS: SRX Series: An attacker causes data-plane denial of service when ch…
CVE-2026-1039076.522.4jegthemeJeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPressCWE-862Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Sub…
CVE-2026-1108598.722.2gitpython-developersGitPythonCWE-88GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
CVE-2026-921596.522.2nasafprimeCWE-130F´: TlmPacketizer copies oversized telemetry past configured channel slots an…
CVE-2026-1033804.322.3latepointAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressCWE-200Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive I…
CVE-2026-771147.222.1danrossiterDocument GalleryCWE-79Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
CVE-2026-835927.222.1doctorwpContact Form DB for EnfoldCWE-79Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scrip…
CVE-2026-973987.222.1foliovisionFV Flowplayer Video PlayerCWE-79FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site…
CVE-2026-1001537.222.1ice00NewStatPressCWE-79NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL R…
CVE-2026-1019247.222.1ice00NewStatPressCWE-79NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlr…
CVE-2026-1034227.222.1ateshabaevAnyCommentCWE-79AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email'…
CVE-2026-1041076.522.1error311FileRiseCWE-22FileRise: Authenticated path traversal escapes configured storage root throug…
CVE-2026-618438.221.9error311FileRiseCWE-862FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
CVE-2026-1020327.122.0Juniper NetworksJunos OSCWE-401Junos OS and Junos OS Evolved: Unintended l2ald memory allocation causes a de…
CVE-2026-1108327.121.9FreeRDPFreeRDPCWE-400FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST
CVE-2026-1106676.921.9cemtansar2htmlCWE-259cemtan sar2html sar2html.py hard-coded credentials
CVE-2026-1106796.921.9n/aOpenSIPSCWE-119OpenSIPS rtpproxy rtpproxy_answer out-of-bounds
CVE-2026-1047616.421.9kitae-parkMang BoardCWE-79Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via…
CVE-2026-1076525.321.9arshidkv12Database Addon for Contact Form 7 – CFDB7CWE-639Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Del…
CVE-2026-1026958.221.8omnifacesomnifacesCWE-345OmniFaces: Forged combined-resource IDs and related output/push boundaries
CVE-2026-942605.321.8UnknownSifalo PayCWE-862Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification …
CVE-2026-1108698.721.7nodemailernodemailerCWE-1333Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
CVE-2026-1106077.121.7BizSpringBizSpring ShopCWE-345BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay E…
CVE-2026-1029806.521.6makeplaneplaneCWE-639Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing …
CVE-2026-1108166.321.6ljharbqsCWE-248qs.stringify with arrayFormat comma throws TypeError on array elements that c…
CVE-2026-1106105.321.6YunaiVruoyi-vue-proCWE-918ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify im…
CVE-2026-1020508.720.9Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-pl…
CVE-2026-1021768.720.9Juniper NetworksJunos OSCWE-120Junos OS: Specific packets cause SDK service crash or Routing Engine compromi…
CVE-2026-03171.221.0Palo Alto NetworksCloud NGFWCWE-754PAN-OS: Denial of Service Vulnerability
CVE-2026-545668.520.8shd101wyyvscode-markdown-preview-enhancedCWE-94Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.c…
CVE-2026-553817.120.5InvoiceShelfInvoiceShelfCWE-639InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any …
CVE-2026-969045.320.6UnknownAWP ClassifiedsCWE-200AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure vi…
CVE-2026-713014.320.6GiteaGiteaCWE-284Gitea private pull request title disclosure through markup
CVE-2026-731264.320.6GiteaGiteaCWE-863Gitea private workflow badge token scope bypass
CVE-2026-936373.720.6ZimbraZimbra Collaboration SuiteCWE-307Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth R…
CVE-2026-60021await20.5GiteaGiteaCWE-400Gitea GitLab migration denial of service
CVE-2026-1108376.120.4FreeRDPFreeRDPCWE-122FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding
CVE-2026-1107698.320.4holaboss-aiholaOSCWE-1188holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors
CVE-2026-1108407.020.3n8n-ion8nCWE-89n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
CVE-2026-70396await20.4GiteaGiteaCWE-863Gitea organization repository creation token scope bypass
CVE-2026-1108438.220.2n8n-ion8nCWE-770n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persisten…
CVE-2026-1108728.220.2nodemailernodemailerCWE-400Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
CVE-2026-78433await20.2GiteaGiteaCWE-284Gitea private attachment disclosure through repository mismatch
CVE-2026-1106552.320.1miniupnp projectminiupnpcCWE-125miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
CVE-2026-1106562.320.1miniupnp projectminiupnpcCWE-125miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
CVE-2026-1108649.119.9better-authbetter-authCWE-287Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
CVE-2026-1020637.120.0Juniper NetworksJunos OSCWE-617Junos OS: MX Series: An unauthenticated network attacker causes an rpd crash …
CVE-2026-1020856.919.8Juniper NetworksJunos OS EvolvedCWE-923Junos OS Evolved: A port which has been inadvertently exposed can be reached …
CVE-2026-574916.519.8error311FileRiseCWE-434FileRise: ZIP extraction writes blocked file extensions to disk, bypassing th…
CVE-2026-1041428.719.7dataeasedataeaseCWE-89DataEase: Stored SQL Injection in group-field binning bounds
CVE-2026-750846.819.7zephyrprojectzephyrCWE-787Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated…
CVE-2026-626645.419.7error311FileRiseCWE-22FileRise: Authenticated path traversal in createFolder allows arbitrary direc…
CVE-2026-1107665.319.7colanodecolanodeCWE-22Colanode Server through 0.4.7 Path Traversal via Avatar Download Route
CVE-2026-1034159.319.5Eclipse FoundationNetX DuoCWE-787When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's c…
CVE-2026-918819.019.5DellTerraform Provider for RedfishCWE-295Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Imp…
CVE-2026-1083377.419.4Hitachi VantaraRemot Ops AgentCWE-640Password Reset Code Accessible in User Listing API
CVE-2026-1108447.219.3n8n-ion8nCWE-863n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Wor…
CVE-2026-1108416.119.3n8n-ion8nCWE-639n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool A…
CVE-2026-974715.319.3themefusionAvada (Fusion) BuilderCWE-200Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Expo…
CVE-2026-1071585.319.3UnknownLTL Freight QuotesCWE-862LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightD…
CVE-2026-1041418.719.2dataeasedataeaseCWE-89DataEase: SQL Injection in datasource metadata identifiers
CVE-2026-1019387.119.2Juniper NetworksJunos OSCWE-191Junos OS and Junos OS Evolved: SRX Series: An attacker causes a forwarding-pl…
CVE-2026-1020007.119.2Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is en…
CVE-2026-1020177.119.2Juniper NetworksJunos OSCWE-787Junos OS and Junos OS Evolved: An attacker causes routing-plane denial of ser…
CVE-2026-1020407.119.2Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: An attacker crashes the routing daemon when co…
CVE-2026-1027565.119.2dataeasedataeaseCWE-79DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
CVE-2026-597664.319.2GiteaGiteaCWE-284Gitea private repository metadata disclosure after access revocation
CVE-2026-1051077.219.0Koha CommunityKohaCWE-89Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and …
CVE-2026-553845.319.0InvoiceShelfInvoiceShelfCWE-284InvoiceShelf trusts client-supplied document totals
CVE-2026-03194.918.9Palo Alto NetworksCloud NGFWCWE-754PAN-OS: Improper Input Handling Vulnerability
CVE-2026-1108568.718.9gitpython-developersGitPythonCWE-1333GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
CVE-2026-1050678.518.8WebnusModern Events Calendar LiteCWE-89WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnera…
CVE-2026-1099018.518.8CodepeopleCP Multi View Event CalendarCWE-89WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulne…
CVE-2026-1019947.118.9Juniper NetworksJunos OSCWE-130Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald hea…
CVE-2026-554984.818.9error311FileRiseCWE-59FileRise Shared Folder Symlink Escape
CVE-2026-1029856.518.8makeplaneplaneCWE-862Plane: Any project member can modify (deactivate) other members' records
CVE-2026-1084738.718.5TP-Link Systems Inc.HS103 v5CWE-306Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices
CVE-2026-1106706.918.5cemtansar2htmlCWE-74cemtan sar2html Archive Processing sar2html.py updateDb sql injection
CVE-2026-1024798.718.5Eclipse FoundationEclipse Vert.x—In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],…
CVE-2026-574927.418.5error311FileRiseCWE-306FileRise: Setup mode re-activates when users.txt becomes empty, allowing unau…
CVE-2026-774275.918.5error311FileRiseCWE-798FileRise: Insecure default cryptographic key fallback in manual installs
CVE-2026-1020667.118.3Juniper NetworksJunos OS—Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when …
CVE-2026-1059695.318.0UnknownCodeAtoZ B2B Suite for WooCommerceCWE-200CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disc…
CVE-2026-1060995.318.0UnknownWP Data AccessCWE-200WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table…
CVE-2026-1021777.217.9Juniper NetworksJunos OSCWE-787Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash whe…
CVE-2026-1108638.617.7better-authssoCWE-287Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal …
CVE-2026-1019377.117.7Juniper NetworksJunos OSCWE-195Junos OS: SRX Series: An attacker causes data-plane denial of service when ch…
CVE-2026-1019607.117.7Juniper NetworksJunos OS EvolvedCWE-787Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load…
CVE-2026-1019697.117.7Juniper NetworksJunos OSCWE-20Junos OS and Junos OS Evolved: An unauthenticated attacker causes rpd denial …
CVE-2026-1019707.117.7Juniper NetworksJunos OSCWE-416Junos OS and Junos OS Evolved: Specific PIM messages causes rpd crash when mu…
CVE-2026-1019717.117.7Juniper NetworksJunos OSCWE-770Junos OS and Junos OS Evolved: An attacker causes routing protocol daemon cra…
CVE-2026-1019727.117.7Juniper NetworksJunos OSCWE-190Junos OS and Junos OS Evolved: Malformed OSPF packets causes routing disrupti…
CVE-2026-1019847.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when labeled-un…
CVE-2026-1019857.117.7Juniper NetworksJunos OS EvolvedCWE-1284Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER ove…
CVE-2026-1019877.117.7Juniper NetworksJunos OS—Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd cra…
CVE-2026-1019887.117.7Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker causes an…
CVE-2026-1019897.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An crafted LDP message causes an rpd crash whe…
CVE-2026-1019927.117.7Juniper NetworksJunos OSCWE-20Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when automatic …
CVE-2026-1019937.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An eBGP peer causes an rpd crash when VPLS aut…
CVE-2026-1019967.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An inconsistent ICCP peer message causes an l2…
CVE-2026-1019997.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP is en…
CVE-2026-1020117.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes rpd to crash when LDP link …
CVE-2026-1020187.117.7Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: Malformed PIM Bidir DF-Election messages cause…
CVE-2026-1020197.117.7Juniper NetworksJunos OSCWE-1284Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service…
CVE-2026-1020217.117.7Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: Malformed RSVP packet causes rpd crash when MP…
CVE-2026-1020337.117.7Juniper NetworksJunos OSCWE-1284Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-L…
CVE-2026-1020347.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes l2ald to restart when MC-LA…
CVE-2026-1020357.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes a denial of service when MC…
CVE-2026-1020397.117.7Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: An attacker causes routing-process denial of s…
CVE-2026-1020417.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when…
CVE-2026-1020427.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes rpd to crash when RSVP asso…
CVE-2026-1020437.117.7Juniper NetworksJunos OSCWE-197Junos OS and Junos OS Evolved: An attacker causes a routing-process crash whe…
CVE-2026-1020457.117.7Juniper NetworksJunos OS EvolvedCWE-787Junos OS Evolved: An crafted LACP frame causes lacpd to crash when LACP is en…
CVE-2026-1020477.117.7Juniper NetworksJunos OSCWE-1288Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service whe…
CVE-2026-1020717.117.7Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: Specific RSVP packet causes an rpd crash when …
CVE-2026-1074256.517.8Magepeople inc.Bus Ticket Booking with Seat ReservationCWE-862WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken A…
CVE-2026-1074336.517.8miniOrangeWP OAuth ServerCWE-862WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
CVE-2026-1077546.417.7paoltaiaGeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryCWE-79GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scrip…
CVE-2026-1104675.317.8WisdomGardenTronclassCWE-639WisdomGarden｜Tronclass - Insecure Direct Object Reference
CVE-2026-918834.317.7DellTerraform Provider for OMECWE-532Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an In…
CVE-2026-1020487.117.6Juniper NetworksJunos OSCWE-770Junos OS: An attacker causes l2cpd crash when FNP is used with VLAN-VPLS enca…
CVE-2026-1020517.117.6Juniper NetworksJunos OSCWE-401Junos OS and Junos OS Evolved: An attacker causes l2cpd memory exhaustion whe…
CVE-2026-1104573.717.6Ubiquiti IncUniFi Protect AI KeyCWE-22A malicious actor with access to the network and under certain conditions cou…
CVE-2026-799578.117.2ServiceNextSerTecCWE-639ServiceNext Insecure Direct Object Reference via GetUsarios
CVE-2026-1107725.317.3we-promisesureCWE-862Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk U…
CVE-2026-1074267.317.2VideoWhisper.comPaid Videochat Turnkey SiteCWE-862WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Contro…
CVE-2026-1020567.117.1Juniper NetworksJunos OSCWE-125Junos OS and Junos OS Evolved: An attacker causes denial of service and infor…
CVE-2026-03161.117.2Palo Alto NetworksCloud NGFWCWE-79PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
CVE-2026-1041438.717.0dataeasedataeaseCWE-289DataEase: Stored SQL Injection via dateFormat field templates
CVE-2026-1108388.716.9FreeRDPFreeRDPCWE-306FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm A…
CVE-2026-1108548.216.8parse-communityparse-serverCWE-248Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled…
CVE-2026-970206.416.8dougwollisonPO/MO EditorCWE-79PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripti…
CVE-2026-1034256.416.8masaakitanakaBooking PackageCWE-79Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Sc…
CVE-2026-1076506.416.8paoltaiaGeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryCWE-79GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scrip…
CVE-2026-668746.516.8GiteaGiteaCWE-284Gitea required Actions check bypass through skipped workflows
CVE-2026-1104565.316.8Ubiquiti IncUniFi Protect AI KeyCWE-284A malicious actor with access to the network and under certain conditions cou…
CVE-2026-1104598.616.6Ubiquiti IncUniFi Protect AI KeyCWE-284A malicious actor with access to the network could exploit an Improper Access…
CVE-2026-1104583.716.6Ubiquiti IncUniFi Protect AI KeyCWE-22A malicious actor with access to the network and under certain conditions cou…
CVE-2026-1041066.516.6error311FileRiseCWE-306FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enr…
CVE-2026-1073194.316.4UnknownGamiPressCWE-639GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
CVE-2026-73539await16.3GiteaGiteaCWE-88Gitea external renderer argument injection and code execution
CVE-2026-1013015.316.2UnknownWPCodeCWE-284WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
CVE-2026-557868.416.0flytohubflyto-coreCWE-78Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`
CVE-2026-1020587.116.1Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker causes a bfdd denial of service wh…
CVE-2026-1084808.215.9SkydropxSkydropxCWE-862WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability
CVE-2026-966157.116.0F5NGINX Gateway FabricCWE-290NGINX Gateway Fabric vulnerability
CVE-2026-1020677.115.8Juniper NetworksJunos OSCWE-1284Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash whe…
CVE-2026-1108297.115.8FreeRDPFreeRDPCWE-476FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment
CVE-2026-1108347.115.8FreeRDPFreeRDPCWE-476FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle
CVE-2026-1108367.115.8FreeRDPFreeRDPCWE-835FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
CVE-2026-1108717.115.8nodemailernodemailerCWE-400Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Ser…
CVE-2026-1106942.115.9OAIDTengineCWE-119OAID Tengine tmfile Model Loader tm2_serializer.c get_tm_file_model out-of-bo…
CVE-2026-1104655.315.7WisdomGardenTronclassCWE-639WisdomGarden｜Tronclass - Insecure Direct Object Reference
CVE-2026-618447.115.6error311FileRiseCWE-706FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
CVE-2026-1105976.915.5syoyotinyexrCWE-125Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFrom…
CVE-2025-93736.415.6peprodevPeproDev Branches Map (Mapify)CWE-79PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Si…
CVE-2026-958076.415.6foliovisionFV Player 8CWE-79FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripti…
CVE-2026-1001856.415.6wpwaxDirectorist: AI-Powered Business Directory, Listings & Classified AdsCWE-79Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10…
CVE-2026-1033696.415.6joaoromaoSocial Share Buttons & Analytics Plugin – GetSocial.ioCWE-79Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) …
CVE-2026-1020877.115.3Juniper NetworksJunos OSCWE-184Junos OS and Junos OS Evolved: If in a traffic engineering scenario a specifi…
CVE-2026-1050667.115.4SimplyRETSSimplyRETS Real Estate IDXCWE-79WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (…
CVE-2026-1078707.115.4CrocoblockJetEngineCWE-79WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1066465.915.4UnknownClassified ListingCWE-862Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modifi…
CVE-2026-1081515.315.3PluginUs.NetMDTFCWE-94WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability
CVE-2026-1104545.315.3Ubiquiti IncUniFi Protect AI KeyCWE-284A malicious actor with access to the network could exploit an Improper Access…
CVE-2026-1108308.215.2FreeRDPFreeRDPCWE-400FreeRDP before 3.32.0 Denial of Service via Serial IRP_MJ_CREATE
CVE-2026-1108338.215.2FreeRDPFreeRDPCWE-400FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
CVE-2026-1019597.115.2Juniper NetworksJunos OSCWE-688Junos OS and Junos OS Evolved: A malformed LSP-ping causes an rpd crash
CVE-2026-1019647.115.2Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: An attacker can cause an rpd crash via a craft…
CVE-2026-1019747.115.2Juniper NetworksJunos OS—Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclo…
CVE-2026-1020607.115.2Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: MX Series, ACX Series: An attacker causes a ro…
CVE-2026-1104497.515.1NixOSNixCWE-190Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultan…
CVE-2026-1107757.115.1ModelEngine-GroupnexentCWE-639Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
CVE-2026-951016.914.8F5NGINX PlusCWE-172NGINX ngx_http_v3_module vulnerability
CVE-2026-1102275.314.710upRestricted Site AccessCWE-862WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vuln…
CVE-2026-1019818.714.7Juniper NetworksJunos OSCWE-121Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine com…
CVE-2026-718548.214.6OpenAEV-PlatformopenaevCWE-306OpenAEV has unauthenticated access and missing object-level authorization on …
CVE-2026-1019685.314.6Juniper NetworksJunos OSCWE-191Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker …
CVE-2026-1074217.314.5VideoWhisper.comBroadcast Live VideoCWE-384WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
CVE-2026-1106574.814.6Khronos GroupnnefCWE-22Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Tra…
CVE-2026-1108497.214.4n8n-ion8nCWE-79n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
CVE-2026-1039936.914.4Juniper NetworksJunos OSCWE-787Junos OS and Junos OS Evolved: If a specific set of BGP communities is presen…
CVE-2026-1105996.914.4l-smashl-smashCWE-415L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe
CVE-2026-1001934.714.4themeumTutor LMS – eLearning and online course solutionCWE-79Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
CVE-2026-1019465.314.2Juniper NetworksJunos OSCWE-125Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosu…
CVE-2026-1024769.113.9Eclipse FoundationEclipse Vert.x—In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],…
CVE-2026-1083359.114.0Hitachi VantaraRemote Ops AgentCWE-640Password Reset Functionality Missing Brute-Force Protection
CVE-2026-636268.813.9cesantamongooseCWE-122Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds …
CVE-2026-850005.313.9UnknownEmbedPressCWE-284EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Databa…
CVE-2026-879685.313.9UnknownProduct Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce MerchantCWE-284Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Regis…
CVE-2026-942615.313.9UnknownSifalo PayCWE-639Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an …
CVE-2026-943605.313.9UnknownPaymentfor Gateway for WooCommerceCWE-862Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Fo…
CVE-2026-969005.313.9UnknownCart Abandonment Recovery for WooCommerceCWE-639Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned…
CVE-2026-1047515.313.9UnknownRank Math SEOCWE-862Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion
CVE-2026-1059755.313.9UnknownCamPay Shortcode Payment GatewayCWE-862CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forge…
CVE-2026-1060985.313.9UnknownWP Data AccessCWE-863WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline …
CVE-2026-73804await13.9GiteaGiteaCWE-266Gitea API token scope escalation through HTTP signatures
CVE-2016-200996.813.7l-smashl-smashCWE-835L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer Probe
CVE-2026-1106006.813.7brechtsandersxlsxioCWE-476xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Wit…
CVE-2026-1107646.013.7iflytekastron-rpaCWE-639AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download
CVE-2026-1107746.013.7blinkospaceblinkoCWE-639Blinko through 1.8.8 Private Attachment Read via /api/file Route
CVE-2026-98420await13.7LinuxLinux—ksmbd: follow SMB2 session expiration semantics
CVE-2026-1108679.013.6renovatebotrenovateCWE-863Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
CVE-2026-557877.113.5flytohubflyto-coreCWE-918Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6…
CVE-2026-574936.813.6error311FileRiseCWE-613FileRise: Remember-me auto-login uses stale admin role from token instead of …
CVE-2026-1106025.813.5kyzlibmspackCWE-824libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path
CVE-2026-1077574.913.4tigroumeowGallery Custom LinksCWE-79Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site…
CVE-2026-853454.113.5UnknownFV Flowplayer Video PlayerCWE-918FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data
CVE-2026-1026825.613.2pipecat-aipipecatCWE-345Pipecat: Public exposure of Pipecat’s development runner can allow unauthenti…
CVE-2026-1108315.313.3FreeRDPFreeRDPCWE-775FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE
CVE-2026-1061665.313.0UnknownNEX-FormsCWE-639NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification v…
CVE-2026-866074.313.0HitachiHitachi Ops Center AdministratorCWE-209Internal Application Information Exposure Vulnerability in Hitachi Ops Center…
CVE-2026-732607.512.8cesantamongooseCWE-125Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.5…
CVE-2026-1107626.312.9bbPressbbPressCWE-863bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream
CVE-2026-648563.712.8error311FileRiseCWE-200FileRise: Missing Authentication Guard on File Snippet Preview Endpoint
CVE-2026-1108557.112.7gitpython-developersGitPythonCWE-200GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submod…
CVE-2026-750835.912.7zephyrprojectzephyrCWE-191Integer underflow of the radio-reported frame length causes an out-of-bounds …
CVE-2026-1108537.112.6n8n-ion8nCWE-639n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
CVE-2026-1108516.112.6n8n-ion8nCWE-639n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agent…
CVE-2026-1077957.512.5TP-Link Systems Inc.Omada Software ControllerCWE-284Improper Authorization in TP-Link Omada Controller TLS Certificate and Privat…
CVE-2026-1108688.412.4renovatebotrenovateCWE-918Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
CVE-2026-923928.112.4curlcurlCWE-416HTTP/2 upload Use-After-Free
CVE-2026-973155.412.4UnknownResponsive BlocksCWE-74Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notificati…
CVE-2026-1107658.212.3flexpriceflexpriceCWE-347FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass
CVE-2026-1036715.312.1EC-CUBE CO.,LTD.AmazonPay V2 Plugin (4.0/4.1 series)CWE-472External control of assumed-Immutable web parameter issue exists in EC-CUBE p…
CVE-2026-1083369.112.0Hitachi VantaraRemot Ops AgentCWE-321Token Signing Key Allows Unauthenticated Administrative Access
CVE-2026-1019955.312.0Juniper NetworksJunos OSCWE-1284Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disc…
CVE-2026-1107715.311.9ShopizerShopizerCWE-639Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
CVE-2026-73800await12.0GiteaGiteaCWE-94Gitea reusable workflow secret exposure in pull_request_target
CVE-2026-1020545.311.9Juniper NetworksJunos OSCWE-130Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping …
CVE-2026-1108397.111.8FreeRDPFreeRDPCWE-787FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipb…
CVE-2026-1108706.911.7nodemailernodemailerCWE-20Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address…
CVE-2026-1107686.311.6holaboss-aiholaOSCWE-290holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Usernam…
CVE-2026-1080662.711.7UnknownWP 2FACWE-639WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
CVE-2026-1106042.011.7Michael R SweetMini-XMLCWE-193Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
CVE-2026-98388await11.6LinuxLinux—exec: do_close_on_exec() before taking exec_update_lock
CVE-2026-98404await11.6LinuxLinux—drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
CVE-2026-98406await11.6LinuxLinux—wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
CVE-2026-98407await11.6LinuxLinux—wifi: rsi: fix heap OOB write on key removal
CVE-2026-98413await11.6LinuxLinux—selinux: always fill AVC decision in avc_has_perm_noaudit()
CVE-2026-98416await11.6LinuxLinux—dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_…
CVE-2026-98417await11.6LinuxLinux—net: xfrm: reject unrepresentable espintcp transport headers
CVE-2026-98419await11.6LinuxLinux—drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
CVE-2026-98422await11.6LinuxLinux—wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
CVE-2026-98426await11.6LinuxLinux—wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
CVE-2026-1074176.511.5Muralidharan RamasamyPush Notification for Post and BuddyPressCWE-862WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken A…
CVE-2026-691915.411.5error311FileRiseCWE-287FileRise: Login Method Restriction Bypass via Direct API Access
CVE-2026-936355.311.5ZimbraZimbra Collaboration SuiteCWE-90Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Te…
CVE-2026-1108356.311.4FreeRDPFreeRDPCWE-93FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token
CVE-2026-1108616.311.3better-authdrizzle-adapterCWE-307Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Co…
CVE-2026-547027.311.2shd101wyyvscode-markdown-preview-enhancedCWE-749Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Mes…
CVE-2026-878436.511.2UnknownTrust Payments Gateway for WooCommerceCWE-284Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Paymen…
CVE-2026-547035.811.2shd101wyyvscode-markdown-preview-enhancedCWE-73Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Wi…
CVE-2026-98418await11.2LinuxLinux—sched/core: Avoid false migration warning for proxy donors
CVE-2026-892888.611.1UnknownFast CourierCWE-89Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
CVE-2026-1108507.211.1n8n-ion8nCWE-863n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
CVE-2026-98398await11.1LinuxLinux—locking/lockdep: Invalidate stale class_cache entries for zapped classes
CVE-2026-98402await11.1LinuxLinux—net: icmp: avoid invalid transport header access in icmp_send tracepoint
CVE-2026-98410await11.1LinuxLinux—watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
CVE-2026-98421await11.1LinuxLinux—wifi: mac80211: require a peer station for TDLS setup confirm
CVE-2026-98423await11.1LinuxLinux—wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
CVE-2026-98428await11.1LinuxLinux—ALSA: usb: 6fire: Avoid embedded URBs
CVE-2026-98429await11.1LinuxLinux—RDMA/efa: Keep EQ resources alive while IRQ is registered
CVE-2026-98430await11.1LinuxLinux—RDMA/efa: Keep admin queues alive while IRQ is registered
CVE-2026-1039745.411.0lichess-orglilaCWE-79lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
CVE-2026-1108737.110.8heymrunheymCWE-863Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field
CVE-2026-890727.510.7ProgressMOVEit TransferCWE-863MOVEit Transfer Authorization Flaw in Certificate Management
CVE-2026-1080646.510.5UnknownWP EncryptionCWE-862WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Or…
CVE-2026-864768.410.4Red HatRed Hat Enterprise Linux 10CWE-787Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidat…
CVE-2026-1041056.410.4error311FileRiseCWE-287FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed …
CVE-2026-1108665.310.4renovatebotrenovateCWE-693Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
CVE-2026-98386await10.3LinuxLinux—scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
CVE-2026-98387await10.3LinuxLinux—s390/crypto: Fix skcipher_walk return code handling in aes_s390
CVE-2026-98392await10.3LinuxLinux—Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
CVE-2026-98394await10.3LinuxLinux—af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
CVE-2026-98399await10.3LinuxLinux—s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
CVE-2026-98400await10.3LinuxLinux—s390/ipl: Fix NULL deref in kdump without re-IPL parm block
CVE-2026-98401await10.3LinuxLinux—net: iptunnel: fix stale transport header during tunnel decapsulation
CVE-2026-98403await10.3LinuxLinux—s390/boot: Avoid IPL parameter append past command line
CVE-2026-98405await10.3LinuxLinux—smb: client: fix missing iov bounds check in parse_posix_sids()
CVE-2026-98409await10.3LinuxLinux—watchdog: rtd119x: Avoid division by zero
CVE-2026-98411await10.3LinuxLinux—power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
CVE-2026-98412await10.3LinuxLinux—power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
CVE-2026-98425await10.3LinuxLinux—wifi: mac80211: don't warn when an IBSS has no channel to scan
CVE-2026-1107635.310.2zuihoulamp-bootCWE-639lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
CVE-2026-1107735.310.2growchiefgrowchiefCWE-862GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint
CVE-2026-98389await10.0LinuxLinux—drm/amdgpu: skip gfx switch_power_profile during GPU reset
CVE-2026-98393await10.0LinuxLinux—net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
CVE-2026-98408await10.0LinuxLinux—watchdog: rzv2h: Avoid division by zero
CVE-2026-98424await10.0LinuxLinux—wifi: cfg80211: undo netns switch if renaming the wiphy fails
CVE-2026-547016.910.0shd101wyyvscode-markdown-preview-enhancedCWE-79Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` …
CVE-2026-551674.210.0LDAPAccountManagerlamCWE-294LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP se…
CVE-2026-98390await10.0LinuxLinux—x86/amd_node: Avoid divide by zero on virtualized systems
CVE-2026-98414await10.0LinuxLinux—memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
CVE-2026-98415await10.0LinuxLinux—soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
CVE-2026-164956.49.8wpdevartCountdown Timer – Widget CountdownCWE-79Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) St…
CVE-2026-750854.29.8zephyrprojectzephyrCWE-125Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE …
CVE-2026-1058747.19.7Brainstorm ForceSureCartCWE-79WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1078677.19.7CrocoblockJetProductTablesCWE-79WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulne…
CVE-2026-96540await9.7SonicWallNetwork Security Manager (NSM)CWE-863An improper access control vulnerability has been identified in the SonicWall…
CVE-2017-202868.59.4DentonWDevILCWE-787DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette
CVE-2026-1106056.89.3tomoltlibschriftCWE-369libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
CVE-2026-73802await9.3GiteaGitea RunnerCWE-269Gitea Runner host isolation bypass through container options
CVE-2026-1010198.39.1F5NGINX JavaScriptCWE-436NGINX ngx_http_js_module vulnerability
CVE-2026-1023546.89.2alam00000bentopdfCWE-367BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker
CVE-2026-889274.39.2UnknownrtMedia for WordPress, BuddyPress and bbPressCWE-639rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrar…
CVE-2026-73535await9.3GiteaGiteaCWE-304Gitea second-factor bypass through OpenID identity linking
CVE-2026-98391await8.9LinuxLinux—drm/xe: Guard page-fault worker with runtime PM check
CVE-2026-98395await8.9LinuxLinux—powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
CVE-2026-98396await8.9LinuxLinux—powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
CVE-2026-98397await8.9LinuxLinux—platform/x86: x86-android-tablets: hold device reference for secondary fwnode…
CVE-2026-98427await8.9LinuxLinux—net/sched: codel: bound the dropping loop per dequeue call
CVE-2026-98431await8.9LinuxLinux—RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
CVE-2026-909547.88.8Red HatRed Hat Hardened ImagesCWE-59Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred …
CVE-2026-1071537.08.6Rakuten Mobile, Inc.Rakuten MiniCWE-1391Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys …
CVE-2026-1039297.88.6jdxmiseCWE-78mise permits untrusted local configuration to override default shell arguments
CVE-2026-1064696.88.3UnknownGutenverse FormCWE-79Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon
CVE-2026-73814await8.4GiteaGiteaCWE-266Gitea repository ownership escalation by administrators
CVE-2026-1074287.18.3VideoWhisper.comPaid Videochat Turnkey SiteCWE-79WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting…
CVE-2026-1084837.18.2hippoooHippoo Mobile App for WooCommerceCWE-79WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scr…
CVE-2026-1084847.18.2WPManageNinjaBest Payments Plugin for WPCWE-79WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting…
CVE-2026-704025.88.0GiteaGiteaCWE-732Gitea local code execution through writable Git hooks
CVE-2026-1019915.38.0Juniper NetworksJunos OSCWE-130Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when…
CVE-2026-1040866.87.87-Zip7-ZipCWE-9087-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table
CVE-2026-691944.87.9error311FileRiseCWE-79FileRise: Unsanitized footerHtml in Public Site Config
CVE-2026-737912.07.7Hewlett Packard EnterpriseHPE NonStop HpjmeterCWE-122HPE NonStop Hpjmeter - Buffer overflow vulnerability
CVE-2026-1039885.47.7error311FileRiseCWE-284FileRise renameFolder omits destination-parent authorization
CVE-2026-1019757.17.5Juniper NetworksJunos OSCWE-617Junos OS and Junos OS Evolved: Improper OSPF LSA validation causes an rpd cra…
CVE-2026-1108657.17.5renovatebotrenovateCWE-424Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
CVE-2026-924096.87.6UnknownDonation ThermometerCWE-79Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode
CVE-2026-1020806.07.3Juniper NetworksJunos OSCWE-413Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE …
CVE-2026-965965.97.4ErlangOTPCWE-835erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
CVE-2026-1074226.57.3axew3.comWP w3all phpBBCWE-79WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnera…
CVE-2026-1064648.77.1Eclipse FoundationNetX DuoCWE-125`_nx_secure_x509_parse_signature_data` computes the certificate signature's l…
CVE-2026-737944.67.0Hewlett Packard EnterpriseHPE NonStop MODULAR NSJCWE-337HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation
CVE-2026-536158.06.8util-linuxutil-linuxCWE-190util-linux libblkid DOS extended-partition overflow produces invalid partitio…
CVE-2026-1041088.16.7error311FileRiseCWE-287FileRise OIDC login can bind an attacker identity to an existing local account
CVE-2026-976298.36.5F5NGINX PlusCWE-908NGINX ngx_http_ssl_module vulnerability
CVE-2026-1106015.86.3saitohalibsixelCWE-787libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write vi…
CVE-2026-1106035.86.3rapidlassoLASzipCWE-824LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
CVE-2026-1106546.96.1zapping-vbilibzvbiCWE-787libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
CVE-2026-1107156.96.1Artifex SoftwareMuJSCWE-787MuJS 1.3.6 before 1.3.9 Heap Out-of-Bounds Read/Write via Array.prototype.sort
CVE-2026-1102576.86.1OW2ASMCWE-789OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attr…
CVE-2026-1102586.86.1OW2ASMCWE-789OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instruct…
CVE-2026-1102596.86.1OW2ASMCWE-674OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInst…
CVE-2026-1102606.86.1OW2ASMCWE-407OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
CVE-2026-1102616.86.1OW2ASMCWE-407OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
CVE-2026-1102636.86.1OW2ASMCWE-674OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
CVE-2026-1102706.86.1OW2ASMCWE-407OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
CVE-2026-1105916.86.1OW2ASMCWE-770OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
CVE-2026-1105966.86.1dlbeerquircCWE-834quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
CVE-2026-1106596.86.1serge1ELFIOCWE-476ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor g…
CVE-2026-1107166.86.1twogoodunshieldCWE-125unshield through 1.6.2 Heap Out-of-Bounds Read via unshield_get_file_table
CVE-2026-1105986.96.0libyallibpffCWE-125Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entr…
CVE-2026-909894.35.9UnknownTainacanCWE-200Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via …
CVE-2026-890757.35.7ProgressMOVEit TransferCWE-922MOVEit Transfer Local Disclosure of Session Information Vulnerability
CVE-2026-943486.15.7DellPowerScale InsightIQCWE-89Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper…
CVE-2024-583924.85.6icculusPhysicsFSCWE-125PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint
CVE-2026-1102624.85.6OW2ASMCWE-770OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter
CVE-2026-1106064.85.6LibreCADlibdxfrwCWE-125LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::r…
CVE-2026-1106604.85.6vgmstreamvgmstreamCWE-125vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
CVE-2026-1106614.85.6CGNSCGNSCWE-125CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
CVE-2026-78231await5.7GiteaGiteaCWE-918Gitea blind SSRF through OpenID assertion verification
CVE-2026-865658.25.6Red HatFast Datapath for RHEL 10CWE-787Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor t…
CVE-2026-910765.35.5UnknownRobokassa payment gateway for WoocommerceCWE-862Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order S…
CVE-2026-942545.35.5UnknownSellKitCWE-862SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sel…
CVE-2026-1047958.85.3Red HatRed Hat OpenShift Container Platform 4CWE-250Insights-runtime-extractor: insights-runtime-extractor: container escape via …
CVE-2026-761134.35.2DellTerraform Provider for RedfishCWE-532Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains a…
CVE-2026-865637.84.9Red HatFast Datapath for RHEL 10CWE-131Dpdk: dpdk: double offset bug in vhost log mapping calculation
CVE-2026-924264.94.8UnknownYITH WooCommerce PopupCWE-863YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion
CVE-2026-1034148.44.7Eclipse FoundationGUIXCWE-787The GUIX binary resource (theme) loader sizes its arena and populates it in t…
CVE-2026-865616.54.5Red HatFast Datapath for RHEL 10CWE-770Dpdk: dpdk: missing memory size validation before mmap in vhost memory region…
CVE-2026-868466.54.5Red HatFast Datapath for RHEL 10CWE-787Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring i…
CVE-2026-868476.54.5Red HatFast Datapath for RHEL 10CWE-824Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain c…
CVE-2026-1019346.74.4Juniper NetworksJunos OSCWE-787Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd
CVE-2026-492062.94.3d99krisrapidcsvCWE-190rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access
CVE-2026-1071605.34.3UnknownLTL Freight QuotesCWE-345LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored H…
CVE-2026-1080695.34.3UnknownSunshine Photo CartCWE-345Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_…
CVE-2026-1019278.64.1Juniper NetworksJunos OSCWE-122Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial o…
CVE-2026-1020136.74.2Juniper NetworksJunos OSCWE-476Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the …
CVE-2026-1002316.13.8Red HatRed Hat Enterprise Linux 10CWE-787Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds …
CVE-2026-888423.33.9Red HatRed Hat Hardened ImagesCWE-125Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read an…
CVE-2026-1104508.03.8NixOSNixCWE-696Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repa…
CVE-2026-889985.33.6UnknownTickeraCWE-345Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
CVE-2026-865627.83.4Red HatFast Datapath for RHEL 10CWE-362Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk…
CVE-2026-870938.83.3ProgressMOVEit TransferCWE-732MOVEit Transfer Service Directory Writable by Local Users Enables Local Privi…
CVE-2026-828445.33.3UnknownWPForms LiteCWE-345WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal C…
CVE-2026-865678.83.1Red HatFast Datapath for RHEL 10CWE-416Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is in…
CVE-2026-03124.33.1Palo Alto NetworksCheckov by Prisma CloudCWE-22Checkov by Prisma Cloud: Path Traversal Vulnerabilities
CVE-2026-536147.02.9util-linuxutil-linuxCWE-269util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
CVE-2026-1033086.52.9UnknownVisma Pay for WooCommerceCWE-345Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order …
CVE-2026-1106338.52.7Report OneMyReport UpdaterCWE-269MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service
CVE-2026-502154.42.7AkamaiGuardicore Platform AgentCWE-416A use-after-free exists in the Windows WFP packet-capture driver shipped with…
CVE-2026-865735.12.6HitachiHitachi Disk Array Driver for AIXCWE-787Out-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitac…
CVE-2026-737964.42.6Hewlett Packard EnterpriseHPE NonStop TSQLEXECWE-564HPE NonStop TSQLEXE - Memory Corruption vulnerability
CVE-2026-1099704.72.5Red HatRed Hat Enterprise Linux 10CWE-538Clevis: clevis: pkcs#11 token pin written to world-readable file
CVE-2026-775643.32.5siderolabstalosCWE-312Talos Linux: Support bundle does not redact registry credentials
CVE-2026-1104514.32.4NixOSNixCWE-863Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox esc…
CVE-2026-1104534.32.4NixOSNixCWE-863Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows c…
CVE-2026-1104524.02.4NixOSNixCWE-708The multi-user installer in Nix before 2.35.3 sets the ownership of store con…
CVE-2026-865666.52.3Red HatFast Datapath for RHEL 10CWE-191Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost en…
CVE-2026-868456.52.3Red HatFast Datapath for RHEL 10CWE-825Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto…
CVE-2026-868496.52.3Red HatFast Datapath for RHEL 10CWE-787Dpdk: dpdk: integer overflow combined with missing validation leads to host b…
CVE-2026-868566.52.3Red HatFast Datapath for RHEL 10CWE-787Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver
CVE-2026-1108606.92.3gitpython-developersGitPythonCWE-59GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
CVE-2026-536137.02.2util-linuxutil-linuxCWE-367util-linux mount target TOCTOU allows local privilege escalation
CVE-2026-1080725.42.2TSplusTSplus Remote AccessCWE-276Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Executio…
CVE-2026-1099714.72.1Red HatRed Hat Enterprise Linux 10CWE-214Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool
CVE-2026-1106891.92.1OpenClawClawScanCWE-693OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection me…
CVE-2026-827157.91.9HitachiHitachi Disk Array Driver for AIXCWE-377Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, H…
CVE-2026-1071716.91.8TrellixTrellix AgentCWE-321An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 v…
CVE-2026-1103597.81.6HylandDesktop HostCWE-276Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privileg…
CVE-2026-1099694.71.5Red HatRed Hat Enterprise Linux 10CWE-306Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injec…
CVE-2026-536127.01.5util-linuxutil-linuxCWE-367util-linux mount hook_owner TOCTOU allows local privilege escalation
CVE-2026-821532.21.4DellOS Recovery ToolCWE-922Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage …
CVE-2026-868488.81.2Red HatFast Datapath for RHEL 10CWE-367Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered …
CVE-2026-737975.31.2Hewlett Packard EnterpriseHPE NonStop TSQLFILCWE-475HPE NonStop TSQLFIL - Memory corruption vulnerability
CVE-2026-502174.71.1AkamaiGuardicore Platform AgentCWE-416A use-after-free vulnerability in the Windows WFP callout driver of Akamai Gu…
CVE-2026-03111.11.1Palo Alto NetworksCheckov by Prisma CloudCWE-918Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability
CVE-2026-737956.41.0Hewlett Packard EnterpriseHPE NonStop TMF Auditread2CWE-121HPE NonStop TMF Auditread2 - Denial of Service vulnerability
CVE-2026-03155.91.0Palo Alto NetworksGlobalProtect AppCWE-426GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
CVE-2026-936836.40.8Red HatFast Datapath for RHEL 10CWE-367Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor …
CVE-2026-03144.30.8Palo Alto NetworksGlobalProtect AppCWE-843GlobalProtect App: Local Denial of Service (DoS) on Windows
CVE-2026-775723.30.7veracryptVeraCryptCWE-200VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topolog…
CVE-2026-151027.50.6AutodeskADP Desktop SDKCWE-319Cleartext Transmission of Sensitive Information in ADP Desktop SDK
CVE-2026-1099685.50.5Red HatRed Hat Enterprise Linux 10CWE-532Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable…