Zero Radar
Live, last checked 41 of 42 sources reachablelast new information

Every vulnerability from the last 7 days, including minor ones. Exploited means attackers already use it, Fixed means a patched version exists. How we rate entries

Today, Monday 2 November UTC

  1. Critical
    WAVLINK router lets remote attackers run system commands
    NewOfficial sourceCVE-2026-120345
  2. Critical
    WSO2 System REST APIs let lower-privilege users run admin actions
    NewOfficial sourceCVE-2025-11969
  3. Medium
    Apache Struts2 Core: cross-origin protection exemptions apply deployment-wide
    New1 source, unconfirmed
  4. Unrated
    Apache Struts2 REST Plugin skips body size limit on chunked requests
    New1 source, unconfirmed
  5. Unrated
    Apache Struts2 REST plugin mishandles untrimmed Accept header tokens
    New1 source, unconfirmed
  6. High
    Apache Struts2 JSON Plugin: element-count limit bypass enables insecure deserialisation
    New1 source, unconfirmed
  7. Critical
    WAVLINK WN551X3-A router lets remote attackers run system commands
    NewOfficial sourceCVE-2026-120344
  8. High
    C-Kermit: multiple vulnerabilities, including RCE via malicious peer (no CVE yet)
    New1 source, unconfirmed
  9. High
    http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the…
    NewOfficial sourceCVE-2026-120317
  10. High
    http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows…
    NewOfficial sourceCVE-2026-120316
  11. High
    LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write…
    NewOfficial sourceCVE-2026-120315
  12. High
    Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to…
    NewOfficial sourceCVE-2026-120313
  13. High
    Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the…
    NewOfficial sourceCVE-2026-120312
  14. High
    Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or…
    NewOfficial sourceCVE-2026-120311
  15. High
    A vulnerability was identified in Termix-SSH Termix up to 2.9.2.
    NewOfficial sourceCVE-2026-120322
  16. Critical
    Linksys E8450 router can be crashed or taken over remotely
    NewNo fix yetOfficial, 2 sourcesCVE-2026-120283
  17. High
    A vulnerability was determined in WAVLINK WN536AX6-A V260507.
    NewOfficial sourceCVE-2026-120282
  18. Critical
    WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler
    NewOfficial, 2 sourcesCVE-2026-120281
  19. Critical
    WAVLINK WN536AX6-A router lets remote attackers run system commands
    NewOfficial, 2 sourcesCVE-2026-120280
  20. Critical
    WAVLINK WN536AX6-A router: remote command injection flaw
    NewOfficial, 2 sourcesCVE-2026-120279
  21. Critical
    WAVLINK WN536AX6-A router: remote command injection via WireGuard group name
    Official, 2 sourcesCVE-2026-120277
  22. Critical
    WAVLINK WN536AX6-A router web interface lets attackers run system commands
    Official, 2 sourcesCVE-2026-120276

Yesterday, Sunday 1 November UTC

  1. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-95863
  2. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-84231
  3. High
    Allocation of resources without limits or throttling in Apache Wicket.
    Official sourceCVE-2026-84170
  4. High
    Memory allocation with an excessive size value in Apache Wicket.
    Official sourceCVE-2026-83594
  5. High
    Improper encoding or escaping of output in Apache Wicket.
    Official sourceCVE-2026-83559
  6. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-83539
  7. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-82956
  8. High
    Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of…
    Official sourceCVE-2026-111089
  9. High
    Session fixation in Apache Wicket.
    Official sourceCVE-2026-82840
  10. High
    Apache Wicket: 19 security flaws fixed in 8.20.0, 9.25.0, 10.12.0
    1 source, unconfirmed
  11. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53905
  12. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53906
  13. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-25749
  14. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-26269
  15. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-28417
  16. High
    A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48.
    Official sourceCVE-2026-120241
  17. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120240
  18. High
    A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120239
  19. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120238
  20. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74759
  21. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74760
  22. High
    Perl HTTP::Session lets attackers inject commands into memcached
    Fixed in HTTP::Session 0.54 or later · out Official, 2 sourcesCVE-2026-13575
  23. Leak
    Alleged leak of Anthropic model checkpoint on Hugging Face
    Unverified
  24. High
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File…
    Official sourceCVE-2026-66570
  25. Critical
    BookIt WordPress plugin has SQL injection flaw
    Official, 2 sourcesCVE-2026-62048
  26. Critical
    Prefab UI sandbox lets callers read and write server files
    Fix available · out Official sourceCVE-2026-120338
  27. High
    A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2.
    Official sourceCVE-2026-120232
  28. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120231
  29. High
    A vulnerability was found in WAVLINK WN701AE 260105.
    Official sourceCVE-2026-120230
  30. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120229
  31. High
    A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120228
  32. Critical
    Beta9: tenants can reach other tenants' volumes on the worker machine
    Fix available · out Official sourceCVE-2026-120308
  33. Critical
    Beta9 worker file API lets tenants reach worker host files
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120307
  34. Critical
    Beta9 image builds let tenants reach build worker internals
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120306
  35. High
    A vulnerability was detected in WAVLINK WN701AE M01AE_V260105.
    Official sourceCVE-2026-120227
  36. High
    A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120225
  37. High
    A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120224
  38. Critical
    WAVLINK WL-WN530BE1-A router: remote command injection flaw
    Official, 2 sourcesCVE-2026-120198
  39. High
    A flaw has been found in WAVLINK WL-WN530HG4B M_V260724.
    Official sourceCVE-2026-120197
  40. High
    A vulnerability was detected in WAVLINK WN579X3-D V250402.
    Official sourceCVE-2026-120196
  41. Critical
    WAVLINK WL-WN579A3-A router lets remote attackers run system commands
    Official, 2 sourcesCVE-2026-120195
  42. High
    XS::libbrotli (Perl) before 1.2.1.0: out-of-bounds write in bundled brotli decoder
    1 source, unconfirmedCVE-2026-115946
  43. Critical
    D-Link DIR-505 router: remote memory overflow in file upload service
    Official, 2 sourcesCVE-2026-120189

Saturday 31 October UTC

  1. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78188
  2. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78189
  3. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78190
  4. Critical
    AJ-Report signs share links with a secret built into the code, allowing remote code execution
    Official, 2 sourcesCVE-2026-120209
  5. High
    libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…
    Official sourceCVE-2026-120208
  6. High
    Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete…
    Official sourceCVE-2026-120207
  7. High
    Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…
    Official sourceCVE-2026-120205
  8. High
    ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to…
    Official sourceCVE-2026-120203
  9. High
    Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious…
    Official sourceCVE-2026-120202
  10. Critical
    Jpom lets anyone without a login become a super admin
    Official, 2 sourcesCVE-2026-120201
  11. High
    Northflank breach exposed customers' AI API keys to misuse
    Attacks reported (BleepingComputer)1 source, unconfirmed
  12. Unrated
    Chromium SVG improper input validation flaw (CVE-2026-118304) affects Edge and Chrome
    Official sourceCVE-2026-118304
  13. Unrated
    Chromium: use-after-free in Video component (CVE-2026-118313) affects Edge
    Official sourceCVE-2026-118313
  14. Unrated
    Chromium/Edge: memory corruption in Media component (CVE-2026-118311)
    Official sourceCVE-2026-118311
  15. High
    Chromium HTML memory corruption flaw (CVE-2026-118317) affects Chrome and Edge
    Official sourceCVE-2026-118317
  16. Unrated
    Chromium SVG input validation flaw (CVE-2026-118315) affects Chrome and Edge
    Official sourceCVE-2026-118315
  17. Unrated
    Chromium Paint memory corruption (CVE-2026-118312) affects Chrome and Edge
    Official sourceCVE-2026-118312
  18. Unrated
    Chromium V8 improper input validation flaw affects Chrome and Edge
    Official sourceCVE-2026-118316
  19. Unrated
    Chromium V8: improper access control flaw (CVE-2026-118318) affects Edge and Chrome
    Official sourceCVE-2026-118318
  20. High
    Chromium/Microsoft Edge: use-after-free in SVG handling (CVE-2026-118308)
    Official sourceCVE-2026-118308
  21. Unrated
    Chromium Views: improper input validation flaw (CVE-2026-118310)
    Official sourceCVE-2026-118310
  22. Unrated
    Chromium/Edge: CVE-2026-118305 memory corruption in Turbolev
    Official sourceCVE-2026-118305
  23. Unrated
    Chromium Paint use-after-free (CVE-2026-118307) fixed in Chrome and Edge
    Official sourceCVE-2026-118307
  24. Unrated
    Chromium FileSystem memory corruption flaw (CVE-2026-118306) affects Chrome and Edge
    Official sourceCVE-2026-118306
  25. High
    Chromium Skia memory corruption (CVE-2026-118319) affects Chrome and Edge
    Official sourceCVE-2026-118319
  26. Unrated
    Chromium ANGLE memory corruption flaw affects Chrome and Microsoft Edge
    Official sourceCVE-2026-118322
  27. Unrated
    Chromium WebRTC improper input validation flaw affects Chrome and Edge
    Official sourceCVE-2026-118328
  28. Unrated
    Chromium: memory corruption in Media component (CVE-2026-118327), fixed in Edge
    Official sourceCVE-2026-118327
  29. Unrated
    Chromium V8 memory corruption flaw (CVE-2026-118320) affects Chrome and Edge
    Official sourceCVE-2026-118320
  30. High
    Chromium ImageCapture use-after-free (CVE-2026-118334) affects Chrome and Edge
    Official sourceCVE-2026-118334
  31. Unrated
    Chromium: use-after-free in Browser component (CVE-2026-118330), affects Edge
    Official sourceCVE-2026-118330
  32. Unrated
    Chromium: missing authorization in Video component (CVE-2026-118333)
    Official sourceCVE-2026-118333
  33. Unrated
    Chromium Metrics component: improper input validation (CVE-2026-118335)
    Official sourceCVE-2026-118335
  34. Unrated
    Chromium ANGLE improper input validation flaw (CVE-2026-118329) fixed in Edge and Chrome
    Official sourceCVE-2026-118329
  35. Unrated
    Chromium Headless: improper input validation flaw (CVE-2026-118336)
    Official sourceCVE-2026-118336
  36. Unrated
    Chromium/Edge: improper access control in Forms (CVE-2026-118337)
    Official sourceCVE-2026-118337
  37. Unrated
    Chromium/Edge: use-after-free in Animation component (CVE-2026-118338)
    Official sourceCVE-2026-118338
  38. Unrated
    Chromium Skia memory corruption flaw (CVE-2026-118340) affects Chrome and Edge
    Official sourceCVE-2026-118340
  39. High
    Chromium: use-after-free in Modularization lets web pages run code
    Official sourceCVE-2026-118341
  40. Unrated
    Chromium Editing out-of-bounds write (CVE-2026-118342) affects Chrome and Edge
    Official sourceCVE-2026-118342
  41. Unrated
    Chromium ReadingList improper input validation flaw (CVE-2026-118343)
    Official sourceCVE-2026-118343
  42. High
    Chromium Layout use-after-free (CVE-2026-118344) affects Chrome and Edge
    Official sourceCVE-2026-118344
  43. Unrated
    Chromium PDFium use-after-free (CVE-2026-118345) fixed in Edge and Chrome
    Official sourceCVE-2026-118345
  44. Unrated
    Chromium FileSystem use-after-free (CVE-2026-118347) affects Chrome and Edge
    Official sourceCVE-2026-118347
  45. Unrated
    Chromium Skia improper input validation flaw (CVE-2026-118348) fixed in Edge
    Official sourceCVE-2026-118348
  46. High
    Chromium Payments memory corruption flaw (CVE-2026-118349) affects Chrome and Edge
    Official sourceCVE-2026-118349
  47. Unrated
    Chromium Turbolev use-after-free (CVE-2026-118350) affects Microsoft Edge
    Official sourceCVE-2026-118350
  48. Unrated
    Chromium Skia memory corruption flaw (CVE-2026-118351) affects Chrome and Edge
    Official sourceCVE-2026-118351
  49. Unrated
    Chromium/Edge: memory corruption in Cache component (CVE-2026-118352)
    Official sourceCVE-2026-118352
  50. Unrated
    Chromium: use-after-free in Paint component (CVE-2026-118353)
    Official sourceCVE-2026-118353
  51. Unrated
    Chromium Skia improper input validation flaw (CVE-2026-118354) affects Edge
    Official sourceCVE-2026-118354
  52. High
    Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server…
    Official sourceCVE-2026-102212
  53. High
    Android SMS of Death: public PoC lets texts crash unpatched phones
    1 source, unconfirmedCVE-2026-58882
  54. High
    Chainalysis customer contact data exposed in breach
    Attacks reported (The Hacker News, BleepingComputer)2 independent sources
  55. High
    The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution…
    Official sourceCVE-2026-76010
  56. High
    A flaw was found in json-glib.
    Official sourceCVE-2026-120194
  57. High
    The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site…
    Official sourceCVE-2026-120114
  58. High
    The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions…
    Official sourceCVE-2026-109197
  59. High
    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including,…
    Official sourceCVE-2026-120075
  60. Critical
    SimpleForm WordPress plugin lets anyone upload executable files
    Official, 2 sourcesCVE-2026-118235
  61. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-117681
  62. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-116964
  63. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-116086
  64. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-114217
  65. High
    The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…
    Official sourceCVE-2026-110530
  66. Critical
    Acadlix LMS WordPress plugin lets logged-in users delete server files
    Official, 2 sourcesCVE-2026-103882
  67. High
    The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post…
    Official sourceCVE-2026-120070
  68. Critical
    Uncanny Toolkit for LearnDash WordPress plugin lets attackers skip login checks
    Official, 2 sourcesCVE-2026-119096
  69. High
    The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to…
    Official sourceCVE-2026-118057
  70. Critical
    Project Manager WordPress plugin lets anyone run code on the server
    Official, 2 sourcesCVE-2026-116512
  71. High
    The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject…
    Official sourceCVE-2026-107759
  72. High
    The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege…
    Official sourceCVE-2026-104012
  73. High
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up…
    Official sourceCVE-2026-103898
  74. Critical
    Apache MINA 3.0 codec can let attackers run code via untrusted Java objects
    No fix yetOfficial, 3 sourcesCVE-2026-118636
  75. Critical
    Popup Builder WordPress plugin lets anyone trash your popups
    Official, 2 sourcesCVE-2026-89270
  76. High
    The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…
    Official sourceCVE-2026-120040
  77. High
    The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable…
    Official sourceCVE-2026-119163
  78. High
    The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored…
    Official sourceCVE-2026-119162
  79. High
    The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to…
    Official sourceCVE-2026-119089
  80. High
    The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-119065
  81. High
    The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…
    Official sourceCVE-2026-118070
  82. Critical
    WP Booking System plugin lets low-level users delete calendar notes
    Official, 2 sourcesCVE-2026-116557
  83. High
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-116548
  84. High
    The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…
    Official sourceCVE-2026-116522
  85. High
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-115840
  86. High
    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…
    Official sourceCVE-2026-111254
  87. Critical
    PDF Invoice for WooCommerce plugin lets anonymous attackers run code
    Official, 2 sourcesCVE-2026-109220
  88. High
    The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-107750
  89. High
    The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments…
    Official sourceCVE-2026-107653
  90. High
    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.
    Official sourceCVE-2026-119977
  91. High
    The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /…
    Official sourceCVE-2026-116520
  92. High
    The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is…
    Official sourceCVE-2026-109997
  93. High
    The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply…
    Official sourceCVE-2026-109234
  94. High
    ChatGPT shared links can run attacker code and read private chats
    1 source, unconfirmed
  95. Leak
    Scribd reportedly breached, customer data may be exposed
    Unverified
  96. High
    Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron…
    Official sourceCVE-2026-116755
  97. High
    Apache Thrift Java library can be made to recurse without limit
    Fixed in 0.24.0 · out Official, 2 sourcesCVE-2026-120135
  98. High
    The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file…
    Official sourceCVE-2026-110176
  99. High
    GNU mtools: memory write error when parsing FAT disk entries
    Fixed in GNU mtools 4.0.50 · out Official, 2 sourcesCVE-2026-118384
  100. Critical
    Assent Sign in with Apple lets attackers impersonate other users
    Fixed in assent 0.3.2 · out Official sourceCVE-2026-117656

Friday 30 October UTC

  1. Unrated
    Debian DSA-6598-1: Thunderbird security update fixes code execution flaws
    Official source
  2. High
    Coop is an open source review and moderation tool from ROOST.
    Official sourceCVE-2026-63398
  3. High
    Coop is an open source review and moderation tool from ROOST.
    Official sourceCVE-2026-63396
  4. High
    OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language.
    Official sourceCVE-2026-63393
  5. High
    TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language.
    Official sourceCVE-2026-63378
  6. Critical
    TAKO Okta AI agent lets strangers create the admin account before setup
    Fixed in 3.0.1-beta · out Official sourceCVE-2026-63377
  7. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63346
  8. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63345
  9. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63344
  10. High
    Aedes is an MQTT broker that can run on any stream server.
    Official sourceCVE-2026-63341
  11. High
    IXP Manager is a full-stack web application for managing Internet Exchange Points.
    Official sourceCVE-2026-63339
  12. High
    IXP Manager is a full-stack web application for managing Internet Exchange Points.
    Official sourceCVE-2026-63338
  13. Medium
    Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

    glob

    Fixed in glob 14.0.2 · out Official sourceCVE-2026-118773npm
  14. Low
    Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118775npm
  15. Medium
    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118777npm
  16. Medium
    Forge: TLS client crash when the server sends no certificate

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118778npm
  17. Low
    Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118781npm
  18. Low
    Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118780npm
  19. Medium
    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-119186npm
  20. Medium
    PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

    phpunit/phpunit

    Fixed in phpunit/phpunit 13.4.4 · out Official sourceCVE-2026-119193composer
  21. Medium
    Nuxt dev server exposes generated appSecret through Vite file serving

    @nuxt/vite-builder

    Fixed in @nuxt/vite-builder 4.6.3 · out Official sourceCVE-2026-119201npm
  22. Medium
    Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

    nuxt, @nuxt/nitro-server

    Fixed in nuxt 4.6.3, @nuxt/nitro-server 4.6.3 · out Official sourceCVE-2026-119200npm
  23. Medium
    Nuxt dev server arbitrary file read through client error reports

    @nuxt/vite-builder

    Fixed in @nuxt/vite-builder 4.6.3 · out Official sourceCVE-2026-119198npm
  24. Medium
    Nuxt dev server exposes private runtime config through the Nitro dev bundle

    @nuxt/vite-builder

    Fixed in @nuxt/vite-builder 4.6.3 · out Official sourceCVE-2026-119199npm
  25. Medium
    MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119276maven
  26. Medium
    MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119279maven
  27. Low
    MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119280maven
  28. Medium
    MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a…

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119210maven
  29. Medium
    MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119281maven
  30. High
    follow-redirects leaks custom API keys to attacker sites on redirect

    follow-redirects

    Fixed in follow-redirects 1.16.2 · out Official sourceCVE-2026-116689npm
  31. Low
    pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

    pageant

    Fixed in pageant 0.2.5 · out Official sourceCVE-2026-116775rust
  32. Medium
    russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

    russh

    Fixed in russh 0.65 · out Official sourceCVE-2026-116774rust
  33. Low
    russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

    russh

    Fixed in russh 0.65.0 · out Official sourceCVE-2026-116696rust
  34. Medium
    russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

    russh

    Fixed in russh 0.65 · out Official sourceCVE-2026-116773rust
  35. Medium
    OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

    openwisp-controller

    Fixed in openwisp-controller 1.3.2 · out Official sourceCVE-2026-116677pip
  36. Medium
    Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

    github.com/gofiber/fiber/v2

    Fixed in github.com/gofiber/fiber/v2 2.52.3 · out Official sourceCVE-2026-119285go
  37. Medium
    signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

    signalk-server

    Fixed in signalk-server 2.34.0 · out Official sourceGHSA-7wpf-ch8f-5f4xnpm
  38. Critical
    Signal K server lets anyone read and overwrite server files, leading to full takeover

    signalk-server, @signalk/resources-provider

    Fix available · out Official sourceGHSA-4xm8-rg9h-jhq2npm
  39. Critical
    imgproxy image processing flaw in ICO loader can crash or take over server

    github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy

    Fixed in 4.0.16 · out Official sourceGHSA-hff9-5pqw-6w9fgo
  40. High
    imgproxy can crash when processing a specially crafted ICO image

    github.com/imgproxy/imgproxy/v3

    Fixed in 4.0.17 · out Official sourceGHSA-494m-4556-wf5pgo
  41. High
    imgproxy can be made to grab about 4GB of memory from one tiny crafted icon file

    github.com/imgproxy/imgproxy/v3

    Fixed in 4.0.16 · out Official sourceGHSA-mmq5-xm89-9pfggo
  42. Medium
    anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

    github.com/anacrolix/torrent

    Fix available · out Official sourceGHSA-2wrx-84qj-4pcggo
  43. Medium
    AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

    adminneo-org/adminneo

    Fixed in adminneo-org/adminneo 5.5.1 · out Official sourceCVE-2026-96634composer
  44. High
    AdminNeo lets logged-in SQLite users delete arbitrary server files

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96633composer
  45. High
    AdminNeo lets attackers inject cookie settings, exposing login sessions

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96631composer
  46. High
    AdminNeo can run attacker code in the admin browser via a rogue database server

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96632composer
  47. High
    AdminNeo SQLite driver lets logged-in users write and run PHP web shells

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96630composer
  48. Medium
    AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

    adminneo-org/adminneo

    Fixed in adminneo-org/adminneo 5.5.1 · out Official sourceCVE-2026-96629composer
  49. Medium
    NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

    gov.nsa.emissary:emissary

    Fixed in gov.nsa.emissary:emissary 8.51.0 · out Official sourceCVE-2026-54442maven
  50. High
    OpenRemote is an open-source internet-of-things platform.
    Official sourceCVE-2026-63224
  51. High
    Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol.
    Official sourceCVE-2026-63201
  52. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63184
  53. High
    LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support,…
    Official sourceCVE-2026-63182
  54. High
    In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the…
    Official sourceCVE-2026-16760
  55. High
    In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example…
    Official sourceCVE-2026-118938
  56. High
    The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several…
    Official sourceCVE-2026-111578
  57. High
    Shopper is a Headless e-commerce Admin Panel.
    Official sourceCVE-2026-62990
  58. High
    Shopper is a Headless e-commerce Admin Panel.
    Official sourceCVE-2026-62989
  59. High
    jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer.
    Official sourceCVE-2026-62979
  60. High
    Dream Displays provides in-game screens for streaming videos in Minecraft.
    Official sourceCVE-2026-62968
  61. High
    ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support.
    Official sourceCVE-2026-62967
  62. High
    ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350.
    Official sourceCVE-2026-62966
  63. High
    SABnzbd is an open source automated Usenet download tool.
    Official sourceCVE-2026-62965
  64. High
    libriscv is a RISC-V sandbox and emulator.
    Official sourceCVE-2026-62958
  65. High
    Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack.
    Official sourceCVE-2026-62864
  66. Critical
    MoLing MCP server lets web pages control it without login
    Fixed in Version 0.5.0. · out Official sourceCVE-2026-62863
  67. Critical
    ThingLinks IoT platform lets logged-in users run code on the server
    Fixed in 1.4.0 · out Official sourceCVE-2026-62853
  68. Critical
    ThingLinks IoT platform: unauthenticated attackers can tamper with sensor data
    Fixed in ThingLinks 1.4.0 · out Official sourceCVE-2026-62849
  69. High
    Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#.
    Official sourceCVE-2026-62848
  70. High
    Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#.
    Official sourceCVE-2026-62847
  71. High
    ag-psd is a JavaScript library for reading and writing Photoshop Document files.
    Official sourceCVE-2026-62297
  72. High
    Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service.
    Official sourceCVE-2026-58412
  73. High
    NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly.
    Official sourceCVE-2026-40573
  74. Critical
    ssl_verify_fun accepts certificates for the wrong hostname
    Fixed in ssl_verify_fun 1.1.8 or later · out Official sourceCVE-2026-117666
  75. Critical
    PyPI publish action trusted an extra certificate authority it should not have

    pypa/gh-action-pypi-publish

    Fix available · out Official sourceGHSA-5xjx-3w67-w9x9actions
  76. Critical
    Thales Sentinel Keys Server on Windows can be taken over remotely
    Fixed in Version 1.3.8.0 or later · out Official sourceCVE-2026-78403
  77. High
    Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow…
    Official sourceCVE-2026-78402
  78. High
    OpenVM is a performant and modular zkVM framework built for customization and extensibility.
    Official sourceCVE-2026-62334
  79. High
    OpenVM is a performant and modular zkVM framework built for customization and extensibility.
    Official sourceCVE-2026-62333
  80. High
    MyTube is a self-hosted downloader and player for several video websites.
    Official sourceCVE-2026-62302
  81. High
    MyTube is a self-hosted downloader and player for several video websites.
    Official sourceCVE-2026-62301
  82. High
    OSAC operator is a Kubernetes operator.
    Official sourceCVE-2026-62284
  83. Critical
    Kargo: users with project role-editing rights can grant themselves more access
    Fixed in 1.8.14, 1.9.9, 1.10.8 · out Official sourceCVE-2026-61850
  84. Critical
    HoneySQL (Clojure) can let attackers inject SQL commands into database queries
    Fixed in HoneySQL 2.7.1392. · out Official sourceCVE-2026-61620
  85. Critical
    PinePods podcast server can be tricked into reading internal network data
    Fixed in Version 0.9.0 · out Official sourceCVE-2026-55598
  86. High
    RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
    Official sourceCVE-2026-119337
  87. High
    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
    Official sourceCVE-2026-119336
  88. High
    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
    Official sourceCVE-2026-119335
  89. High
    draw.io Desktop is the official Electron build of draw.io.
    Official sourceCVE-2026-119333
  90. High
    Ladybird is a truly independent web browser.
    Official sourceCVE-2026-119332
  91. High
    Ladybird is a truly independent web browser.
    Official sourceCVE-2026-119331
  92. High
    pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged.
    Official sourceCVE-2026-116252
  93. High
    In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission()…
    Official sourceCVE-2026-116250
  94. High
    In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to…
    Official sourceCVE-2026-116249
  95. High
    When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not…
    Official sourceCVE-2026-116247
Show 100 more