Zero Radar
Live, last checked 41 of 42 sources reachablelast new information

Every vulnerability from the last 7 days, including minor ones. Exploited means attackers already use it, Fixed means a patched version exists. How we rate entries

Today, Monday 2 November UTC

  1. Unrated
    WordPress pingback and Brotli components reported to allow remote code execution
    NewUnverified
  2. High
    Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an…
    NewOfficial sourceCVE-2026-18199
  3. High
    DoS vulnerability in the window module.
    NewOfficial sourceCVE-2026-101186
  4. High
    Permission control vulnerability in the event notification management module.
    NewOfficial sourceCVE-2026-101176
  5. Critical
    Apache Struts2 lets attackers run code on the server
    New1 source, unconfirmed
  6. Medium
    Apache Struts2 Core TokenHelper: non-constant-time token comparison leaks timing
    New1 source, unconfirmed
  7. Medium
    Apache Struts2 Core: integer overflow and wrap-around in downstream type casts (≤7.4.0)
    New1 source, unconfirmed
  8. Critical
    WAVLINK router lets remote attackers run system commands
    NewOfficial sourceCVE-2026-120345
  9. Critical
    WSO2 System REST APIs let lower-privilege users run admin actions
    NewOfficial sourceCVE-2025-11969
  10. Medium
    Apache Struts2 Core: cross-origin protection exemptions apply deployment-wide
    New1 source, unconfirmed
  11. Unrated
    Apache Struts2 REST Plugin skips body size limit on chunked requests
    New1 source, unconfirmed
  12. Unrated
    Apache Struts2 REST plugin mishandles untrimmed Accept header tokens
    New1 source, unconfirmed
  13. High
    Apache Struts2 JSON Plugin: element-count limit bypass enables insecure deserialisation
    New1 source, unconfirmed
  14. Critical
    WAVLINK WN551X3-A router lets remote attackers run system commands
    NewOfficial sourceCVE-2026-120344
  15. High
    C-Kermit: multiple vulnerabilities, including RCE via malicious peer (no CVE yet)
    New1 source, unconfirmed
  16. High
    http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the…
    Official sourceCVE-2026-120317
  17. High
    http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows…
    Official sourceCVE-2026-120316
  18. High
    LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write…
    Official sourceCVE-2026-120315
  19. High
    Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to…
    Official sourceCVE-2026-120313
  20. High
    Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the…
    Official sourceCVE-2026-120312
  21. High
    Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or…
    Official sourceCVE-2026-120311
  22. High
    A vulnerability was identified in Termix-SSH Termix up to 2.9.2.
    Official sourceCVE-2026-120322
  23. Critical
    Linksys E8450 router can be taken over remotely via crafted timezone input
    No fix yetOfficial, 2 sourcesCVE-2026-120283
  24. High
    A vulnerability was determined in WAVLINK WN536AX6-A V260507.
    Official sourceCVE-2026-120282
  25. Critical
    WAVLINK WN536AX6-A router: remote memory overflow in VPN setup
    Official, 2 sourcesCVE-2026-120281
  26. Critical
    WAVLINK WN536AX6-A router: remote command injection via WireGuard settings
    Official, 2 sourcesCVE-2026-120280
  27. Critical
    WAVLINK WN536AX6-A router: remote command execution flaw
    Official, 2 sourcesCVE-2026-120279
  28. Critical
    WAVLINK WN536AX6-A router: remote command injection via WireGuard group name
    Official, 2 sourcesCVE-2026-120277
  29. Critical
    WAVLINK WN536AX6-A router web interface lets attackers run system commands
    Official, 2 sourcesCVE-2026-120276

Yesterday, Sunday 1 November UTC

  1. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-95863
  2. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-84231
  3. High
    Allocation of resources without limits or throttling in Apache Wicket.
    Official sourceCVE-2026-84170
  4. High
    Memory allocation with an excessive size value in Apache Wicket.
    Official sourceCVE-2026-83594
  5. High
    Improper encoding or escaping of output in Apache Wicket.
    Official sourceCVE-2026-83559
  6. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-83539
  7. High
    Improper neutralization of input during web page generation in Apache Wicket.
    Official sourceCVE-2026-82956
  8. High
    Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of…
    Official sourceCVE-2026-111089
  9. High
    Session fixation in Apache Wicket.
    Official sourceCVE-2026-82840
  10. High
    Apache Wicket: 19 security flaws fixed in 8.20.0, 9.25.0, 10.12.0
    1 source, unconfirmed
  11. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53905
  12. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53906
  13. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-25749
  14. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-26269
  15. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-28417
  16. High
    A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48.
    Official sourceCVE-2026-120241
  17. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120240
  18. High
    A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120239
  19. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120238
  20. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74759
  21. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74760
  22. High
    Perl HTTP::Session lets attackers inject commands into memcached
    Fixed in HTTP::Session 0.54 or later · out Official, 2 sourcesCVE-2026-13575
  23. Leak
    Alleged leak of Anthropic model checkpoint on Hugging Face
    Unverified
  24. High
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File…
    Official sourceCVE-2026-66570
  25. Critical
    BookIt WordPress plugin has SQL injection flaw
    Official, 2 sourcesCVE-2026-62048
  26. Critical
    Prefab UI sandbox lets callers read and write server files
    Fix available · out Official sourceCVE-2026-120338
  27. High
    A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2.
    Official sourceCVE-2026-120232
  28. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120231
  29. High
    A vulnerability was found in WAVLINK WN701AE 260105.
    Official sourceCVE-2026-120230
  30. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120229
  31. High
    A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120228
  32. Critical
    Beta9: tenants can reach other tenants' volumes on the worker machine
    Fix available · out Official sourceCVE-2026-120308
  33. Critical
    Beta9 worker file API lets tenants reach worker host files
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120307
  34. Critical
    Beta9 image builds let tenants reach build worker internals
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120306
  35. High
    A vulnerability was detected in WAVLINK WN701AE M01AE_V260105.
    Official sourceCVE-2026-120227
  36. High
    A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120225
  37. High
    A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120224
  38. Critical
    WAVLINK WL-WN530BE1-A router: remote command injection flaw
    Official, 2 sourcesCVE-2026-120198
  39. High
    A flaw has been found in WAVLINK WL-WN530HG4B M_V260724.
    Official sourceCVE-2026-120197
  40. High
    A vulnerability was detected in WAVLINK WN579X3-D V250402.
    Official sourceCVE-2026-120196
  41. Critical
    WAVLINK WL-WN579A3-A router lets remote attackers run system commands
    Official, 2 sourcesCVE-2026-120195
  42. High
    XS::libbrotli (Perl) before 1.2.1.0: out-of-bounds write in bundled brotli decoder
    1 source, unconfirmedCVE-2026-115946
  43. Critical
    D-Link DIR-505 router: remote memory overflow in file upload service
    Official, 2 sourcesCVE-2026-120189

Saturday 31 October UTC

  1. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78188
  2. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78189
  3. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78190
  4. Critical
    AJ-Report signs share links with a secret built into the code, allowing remote code execution
    Official, 2 sourcesCVE-2026-120209
  5. High
    libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…
    Official sourceCVE-2026-120208
  6. High
    Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete…
    Official sourceCVE-2026-120207
  7. High
    Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…
    Official sourceCVE-2026-120205
  8. High
    ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to…
    Official sourceCVE-2026-120203
  9. High
    Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious…
    Official sourceCVE-2026-120202
  10. Critical
    Jpom lets anyone without a login become a super admin
    Official, 2 sourcesCVE-2026-120201
  11. High
    Northflank breach exposed customers' AI API keys to misuse
    Attacks reported (BleepingComputer)1 source, unconfirmed
  12. Unrated
    Chromium SVG improper input validation flaw (CVE-2026-118304) affects Edge and Chrome
    Official sourceCVE-2026-118304
  13. Unrated
    Chromium: use-after-free in Video component (CVE-2026-118313) affects Edge
    Official sourceCVE-2026-118313
  14. Unrated
    Chromium/Edge: memory corruption in Media component (CVE-2026-118311)
    Official sourceCVE-2026-118311
  15. High
    Chromium HTML memory corruption flaw (CVE-2026-118317) affects Chrome and Edge
    Official sourceCVE-2026-118317
  16. Unrated
    Chromium SVG input validation flaw (CVE-2026-118315) affects Chrome and Edge
    Official sourceCVE-2026-118315
  17. Unrated
    Chromium Paint memory corruption (CVE-2026-118312) affects Chrome and Edge
    Official sourceCVE-2026-118312
  18. Unrated
    Chromium V8 improper input validation flaw affects Chrome and Edge
    Official sourceCVE-2026-118316
  19. Unrated
    Chromium V8: improper access control flaw (CVE-2026-118318) affects Edge and Chrome
    Official sourceCVE-2026-118318
  20. High
    Chromium/Microsoft Edge: use-after-free in SVG handling (CVE-2026-118308)
    Official sourceCVE-2026-118308
  21. Unrated
    Chromium Views: improper input validation flaw (CVE-2026-118310)
    Official sourceCVE-2026-118310
  22. Unrated
    Chromium/Edge: CVE-2026-118305 memory corruption in Turbolev
    Official sourceCVE-2026-118305
  23. Unrated
    Chromium Paint use-after-free (CVE-2026-118307) fixed in Chrome and Edge
    Official sourceCVE-2026-118307
  24. Unrated
    Chromium FileSystem memory corruption flaw (CVE-2026-118306) affects Chrome and Edge
    Official sourceCVE-2026-118306
  25. High
    Chromium Skia memory corruption (CVE-2026-118319) affects Chrome and Edge
    Official sourceCVE-2026-118319
  26. Unrated
    Chromium ANGLE memory corruption flaw affects Chrome and Microsoft Edge
    Official sourceCVE-2026-118322
  27. Unrated
    Chromium WebRTC improper input validation flaw affects Chrome and Edge
    Official sourceCVE-2026-118328
  28. Unrated
    Chromium: memory corruption in Media component (CVE-2026-118327), fixed in Edge
    Official sourceCVE-2026-118327
  29. Unrated
    Chromium V8 memory corruption flaw (CVE-2026-118320) affects Chrome and Edge
    Official sourceCVE-2026-118320
  30. High
    Chromium ImageCapture use-after-free (CVE-2026-118334) affects Chrome and Edge
    Official sourceCVE-2026-118334
  31. Unrated
    Chromium: use-after-free in Browser component (CVE-2026-118330), affects Edge
    Official sourceCVE-2026-118330
  32. Unrated
    Chromium: missing authorization in Video component (CVE-2026-118333)
    Official sourceCVE-2026-118333
  33. Unrated
    Chromium Metrics component: improper input validation (CVE-2026-118335)
    Official sourceCVE-2026-118335
  34. Unrated
    Chromium ANGLE improper input validation flaw (CVE-2026-118329) fixed in Edge and Chrome
    Official sourceCVE-2026-118329
  35. Unrated
    Chromium Headless: improper input validation flaw (CVE-2026-118336)
    Official sourceCVE-2026-118336
  36. Unrated
    Chromium/Edge: improper access control in Forms (CVE-2026-118337)
    Official sourceCVE-2026-118337
  37. Unrated
    Chromium/Edge: use-after-free in Animation component (CVE-2026-118338)
    Official sourceCVE-2026-118338
  38. Unrated
    Chromium Skia memory corruption flaw (CVE-2026-118340) affects Chrome and Edge
    Official sourceCVE-2026-118340
  39. High
    Chromium: use-after-free in Modularization lets web pages run code
    Official sourceCVE-2026-118341
  40. Unrated
    Chromium Editing out-of-bounds write (CVE-2026-118342) affects Chrome and Edge
    Official sourceCVE-2026-118342
  41. Unrated
    Chromium ReadingList improper input validation flaw (CVE-2026-118343)
    Official sourceCVE-2026-118343
  42. High
    Chromium Layout use-after-free (CVE-2026-118344) affects Chrome and Edge
    Official sourceCVE-2026-118344
  43. Unrated
    Chromium PDFium use-after-free (CVE-2026-118345) fixed in Edge and Chrome
    Official sourceCVE-2026-118345
  44. Unrated
    Chromium FileSystem use-after-free (CVE-2026-118347) affects Chrome and Edge
    Official sourceCVE-2026-118347
  45. Unrated
    Chromium Skia improper input validation flaw (CVE-2026-118348) fixed in Edge
    Official sourceCVE-2026-118348
  46. High
    Chromium Payments memory corruption flaw (CVE-2026-118349) affects Chrome and Edge
    Official sourceCVE-2026-118349
  47. Unrated
    Chromium Turbolev use-after-free (CVE-2026-118350) affects Microsoft Edge
    Official sourceCVE-2026-118350
  48. Unrated
    Chromium Skia memory corruption flaw (CVE-2026-118351) affects Chrome and Edge
    Official sourceCVE-2026-118351
  49. Unrated
    Chromium/Edge: memory corruption in Cache component (CVE-2026-118352)
    Official sourceCVE-2026-118352
  50. Unrated
    Chromium: use-after-free in Paint component (CVE-2026-118353)
    Official sourceCVE-2026-118353
  51. Unrated
    Chromium Skia improper input validation flaw (CVE-2026-118354) affects Edge
    Official sourceCVE-2026-118354
  52. High
    Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server…
    Official sourceCVE-2026-102212
  53. High
    Android SMS of Death: public PoC lets texts crash unpatched phones
    1 source, unconfirmedCVE-2026-58882
  54. High
    Chainalysis customer contact data exposed in breach
    Attacks reported (The Hacker News, BleepingComputer)2 independent sources
  55. High
    The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution…
    Official sourceCVE-2026-76010
  56. High
    A flaw was found in json-glib.
    Official sourceCVE-2026-120194
  57. High
    The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site…
    Official sourceCVE-2026-120114
  58. High
    The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions…
    Official sourceCVE-2026-109197
  59. High
    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including,…
    Official sourceCVE-2026-120075
  60. Critical
    SimpleForm WordPress plugin lets anyone upload executable files
    Official, 2 sourcesCVE-2026-118235
  61. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-117681
  62. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-116964
  63. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-116086
  64. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-114217
  65. High
    The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…
    Official sourceCVE-2026-110530
  66. Critical
    Acadlix LMS WordPress plugin lets logged-in users delete server files
    Official, 2 sourcesCVE-2026-103882
  67. High
    The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post…
    Official sourceCVE-2026-120070
  68. Critical
    Uncanny Toolkit for LearnDash WordPress plugin lets attackers skip login checks
    Official, 2 sourcesCVE-2026-119096
  69. High
    The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to…
    Official sourceCVE-2026-118057
  70. Critical
    Project Manager WordPress plugin lets anyone run code on the server
    Official, 2 sourcesCVE-2026-116512
  71. High
    The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject…
    Official sourceCVE-2026-107759
  72. High
    The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege…
    Official sourceCVE-2026-104012
  73. High
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up…
    Official sourceCVE-2026-103898
  74. Critical
    Apache MINA 3.0 codec can let attackers run code via untrusted Java objects
    No fix yetOfficial, 3 sourcesCVE-2026-118636
  75. Critical
    Popup Builder WordPress plugin lets anyone trash your popups
    Official, 2 sourcesCVE-2026-89270
  76. High
    The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…
    Official sourceCVE-2026-120040
  77. High
    The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable…
    Official sourceCVE-2026-119163
  78. High
    The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored…
    Official sourceCVE-2026-119162
  79. High
    The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to…
    Official sourceCVE-2026-119089
  80. High
    The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-119065
  81. High
    The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…
    Official sourceCVE-2026-118070
  82. Critical
    WP Booking System plugin lets low-level users delete calendar notes
    Official, 2 sourcesCVE-2026-116557
  83. High
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-116548
  84. High
    The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…
    Official sourceCVE-2026-116522
  85. High
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-115840
  86. High
    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…
    Official sourceCVE-2026-111254
  87. Critical
    PDF Invoice for WooCommerce plugin lets anonymous attackers run code
    Official, 2 sourcesCVE-2026-109220
  88. High
    The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-107750
  89. High
    The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments…
    Official sourceCVE-2026-107653
  90. High
    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.
    Official sourceCVE-2026-119977
  91. High
    The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /…
    Official sourceCVE-2026-116520
  92. High
    The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is…
    Official sourceCVE-2026-109997
  93. High
    The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply…
    Official sourceCVE-2026-109234
  94. High
    ChatGPT shared links can run attacker code and read private chats
    1 source, unconfirmed
  95. Leak
    Scribd reportedly breached, customer data may be exposed
    Unverified
  96. High
    Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron…
    Official sourceCVE-2026-116755
  97. High
    Apache Thrift Java library can be made to recurse without limit
    Fixed in 0.24.0 · out Official, 2 sourcesCVE-2026-120135
  98. High
    The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file…
    Official sourceCVE-2026-110176
  99. High
    GNU mtools: memory write error when parsing FAT disk entries
    Fixed in GNU mtools 4.0.50 · out Official, 2 sourcesCVE-2026-118384
  100. Critical
    Assent Sign in with Apple lets attackers impersonate other users
    Fixed in assent 0.3.2 · out Official sourceCVE-2026-117656

Friday 30 October UTC

  1. Unrated
    Debian DSA-6598-1: Thunderbird security update fixes code execution flaws
    Official source
  2. High
    Coop is an open source review and moderation tool from ROOST.
    Official sourceCVE-2026-63398
  3. High
    Coop is an open source review and moderation tool from ROOST.
    Official sourceCVE-2026-63396
  4. High
    OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language.
    Official sourceCVE-2026-63393
  5. High
    TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language.
    Official sourceCVE-2026-63378
  6. Critical
    TAKO Okta AI agent lets strangers create the admin account before setup
    Fixed in 3.0.1-beta · out Official sourceCVE-2026-63377
  7. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63346
  8. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63345
  9. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63344
  10. High
    Aedes is an MQTT broker that can run on any stream server.
    Official sourceCVE-2026-63341
  11. High
    IXP Manager is a full-stack web application for managing Internet Exchange Points.
    Official sourceCVE-2026-63339
  12. High
    IXP Manager is a full-stack web application for managing Internet Exchange Points.
    Official sourceCVE-2026-63338
  13. Medium
    Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

    glob

    Fixed in glob 14.0.2 · out Official sourceCVE-2026-118773npm
  14. Low
    Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118775npm
  15. Medium
    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118777npm
  16. Medium
    Forge: TLS client crash when the server sends no certificate

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118778npm
  17. Low
    Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118781npm
  18. Low
    Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-118780npm
  19. Medium
    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    node-forge

    Fixed in node-forge 1.4.1 · out Official sourceCVE-2026-119186npm
  20. Medium
    PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

    phpunit/phpunit

    Fixed in phpunit/phpunit 13.4.4 · out Official sourceCVE-2026-119193composer
  21. Medium
    Nuxt dev server exposes generated appSecret through Vite file serving

    @nuxt/vite-builder

    Fixed in @nuxt/vite-builder 4.6.3 · out Official sourceCVE-2026-119201npm
  22. Medium
    Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

    nuxt, @nuxt/nitro-server

    Fixed in nuxt 4.6.3, @nuxt/nitro-server 4.6.3 · out Official sourceCVE-2026-119200npm
  23. Medium
    Nuxt dev server arbitrary file read through client error reports

    @nuxt/vite-builder

    Fixed in @nuxt/vite-builder 4.6.3 · out Official sourceCVE-2026-119198npm
  24. Medium
    Nuxt dev server exposes private runtime config through the Nitro dev bundle

    @nuxt/vite-builder

    Fixed in @nuxt/vite-builder 4.6.3 · out Official sourceCVE-2026-119199npm
  25. Medium
    MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119276maven
  26. Medium
    MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119279maven
  27. Low
    MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119280maven
  28. Medium
    MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a…

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119210maven
  29. Medium
    MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing

    org.mariadb.jdbc:mariadb-java-client

    Fix available · out Official sourceCVE-2026-119281maven
  30. High
    follow-redirects leaks custom API keys to attacker sites on redirect

    follow-redirects

    Fixed in follow-redirects 1.16.2 · out Official sourceCVE-2026-116689npm
  31. Low
    pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

    pageant

    Fixed in pageant 0.2.5 · out Official sourceCVE-2026-116775rust
  32. Medium
    russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

    russh

    Fixed in russh 0.65 · out Official sourceCVE-2026-116774rust
  33. Low
    russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

    russh

    Fixed in russh 0.65.0 · out Official sourceCVE-2026-116696rust
  34. Medium
    russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

    russh

    Fixed in russh 0.65 · out Official sourceCVE-2026-116773rust
  35. Medium
    OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

    openwisp-controller

    Fixed in openwisp-controller 1.3.2 · out Official sourceCVE-2026-116677pip
  36. Medium
    Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

    github.com/gofiber/fiber/v2

    Fixed in github.com/gofiber/fiber/v2 2.52.3 · out Official sourceCVE-2026-119285go
  37. Medium
    signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

    signalk-server

    Fixed in signalk-server 2.34.0 · out Official sourceGHSA-7wpf-ch8f-5f4xnpm
  38. Critical
    Signal K server lets anyone read and overwrite server files, leading to full takeover

    signalk-server, @signalk/resources-provider

    Fix available · out Official sourceGHSA-4xm8-rg9h-jhq2npm
  39. Critical
    imgproxy image processing flaw in ICO loader can crash or take over server

    github.com/imgproxy/imgproxy/v3, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy

    Fixed in 4.0.16 · out Official sourceGHSA-hff9-5pqw-6w9fgo
  40. High
    imgproxy can crash when processing a specially crafted ICO image

    github.com/imgproxy/imgproxy/v3

    Fixed in 4.0.17 · out Official sourceGHSA-494m-4556-wf5pgo
  41. High
    imgproxy can be made to grab about 4GB of memory from one tiny crafted icon file

    github.com/imgproxy/imgproxy/v3

    Fixed in 4.0.16 · out Official sourceGHSA-mmq5-xm89-9pfggo
  42. Medium
    anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

    github.com/anacrolix/torrent

    Fix available · out Official sourceGHSA-2wrx-84qj-4pcggo
  43. Medium
    AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

    adminneo-org/adminneo

    Fixed in adminneo-org/adminneo 5.5.1 · out Official sourceCVE-2026-96634composer
  44. High
    AdminNeo lets logged-in SQLite users delete arbitrary server files

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96633composer
  45. High
    AdminNeo lets attackers inject cookie settings, exposing login sessions

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96631composer
  46. High
    AdminNeo can run attacker code in the admin browser via a rogue database server

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96632composer
  47. High
    AdminNeo SQLite driver lets logged-in users write and run PHP web shells

    adminneo-org/adminneo

    Fixed in 5.5.1 · out Official sourceCVE-2026-96630composer
  48. Medium
    AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery

    adminneo-org/adminneo

    Fixed in adminneo-org/adminneo 5.5.1 · out Official sourceCVE-2026-96629composer
  49. Medium
    NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

    gov.nsa.emissary:emissary

    Fixed in gov.nsa.emissary:emissary 8.51.0 · out Official sourceCVE-2026-54442maven
  50. High
    OpenRemote is an open-source internet-of-things platform.
    Official sourceCVE-2026-63224
  51. High
    Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol.
    Official sourceCVE-2026-63201
  52. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63184
  53. High
    LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support,…
    Official sourceCVE-2026-63182
  54. High
    In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the…
    Official sourceCVE-2026-16760
  55. High
    In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example…
    Official sourceCVE-2026-118938
  56. High
    The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several…
    Official sourceCVE-2026-111578
  57. High
    Shopper is a Headless e-commerce Admin Panel.
    Official sourceCVE-2026-62990
  58. High
    Shopper is a Headless e-commerce Admin Panel.
    Official sourceCVE-2026-62989
  59. High
    jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer.
    Official sourceCVE-2026-62979
  60. High
    Dream Displays provides in-game screens for streaming videos in Minecraft.
    Official sourceCVE-2026-62968
  61. High
    ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support.
    Official sourceCVE-2026-62967
  62. High
    ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350.
    Official sourceCVE-2026-62966
  63. High
    SABnzbd is an open source automated Usenet download tool.
    Official sourceCVE-2026-62965
  64. High
    libriscv is a RISC-V sandbox and emulator.
    Official sourceCVE-2026-62958
  65. High
    Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack.
    Official sourceCVE-2026-62864
  66. Critical
    MoLing MCP server lets web pages control it without login
    Fixed in Version 0.5.0. · out Official sourceCVE-2026-62863
  67. Critical
    ThingLinks IoT platform lets logged-in users run code on the server
    Fixed in 1.4.0 · out Official sourceCVE-2026-62853
  68. Critical
    ThingLinks IoT platform: unauthenticated attackers can tamper with sensor data
    Fixed in ThingLinks 1.4.0 · out Official sourceCVE-2026-62849
  69. High
    Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#.
    Official sourceCVE-2026-62848
  70. High
    Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#.
    Official sourceCVE-2026-62847
  71. High
    ag-psd is a JavaScript library for reading and writing Photoshop Document files.
    Official sourceCVE-2026-62297
  72. High
    Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service.
    Official sourceCVE-2026-58412
  73. High
    NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly.
    Official sourceCVE-2026-40573
  74. Critical
    ssl_verify_fun accepts certificates for the wrong hostname
    Fixed in ssl_verify_fun 1.1.8 or later · out Official sourceCVE-2026-117666
  75. Critical
    PyPI publish action trusted an extra certificate authority it should not have

    pypa/gh-action-pypi-publish

    Fix available · out Official sourceGHSA-5xjx-3w67-w9x9actions
  76. Critical
    Thales Sentinel Keys Server on Windows can be taken over remotely
    Fixed in Version 1.3.8.0 or later · out Official sourceCVE-2026-78403
  77. High
    Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow…
    Official sourceCVE-2026-78402
  78. High
    OpenVM is a performant and modular zkVM framework built for customization and extensibility.
    Official sourceCVE-2026-62334
  79. High
    OpenVM is a performant and modular zkVM framework built for customization and extensibility.
    Official sourceCVE-2026-62333
  80. High
    MyTube is a self-hosted downloader and player for several video websites.
    Official sourceCVE-2026-62302
  81. High
    MyTube is a self-hosted downloader and player for several video websites.
    Official sourceCVE-2026-62301
  82. High
    OSAC operator is a Kubernetes operator.
    Official sourceCVE-2026-62284
  83. Critical
    Kargo: users with project role-editing rights can grant themselves more access
    Fixed in 1.8.14, 1.9.9, 1.10.8 · out Official sourceCVE-2026-61850
  84. Critical
    HoneySQL (Clojure) can let attackers inject SQL commands into database queries
    Fixed in HoneySQL 2.7.1392. · out Official sourceCVE-2026-61620
  85. Critical
    PinePods podcast server can be tricked into reading internal network data
    Fixed in Version 0.9.0 · out Official sourceCVE-2026-55598
  86. High
    RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine.
    Official sourceCVE-2026-119337
  87. High
    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
    Official sourceCVE-2026-119336
  88. High
    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.
    Official sourceCVE-2026-119335
  89. High
    draw.io Desktop is the official Electron build of draw.io.
    Official sourceCVE-2026-119333
  90. High
    Ladybird is a truly independent web browser.
    Official sourceCVE-2026-119332
  91. High
    Ladybird is a truly independent web browser.
    Official sourceCVE-2026-119331
  92. High
    pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged.
    Official sourceCVE-2026-116252
  93. High
    In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission()…
    Official sourceCVE-2026-116250
  94. High
    In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to…
    Official sourceCVE-2026-116249
  95. High
    When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not…
    Official sourceCVE-2026-116247
  96. High
    To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it…
    Official sourceCVE-2026-116246
  97. High
    libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there…
    Official sourceCVE-2026-116245
  98. High
    When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its…
    Official sourceCVE-2026-116244
  99. High
    pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences.
    Official sourceCVE-2026-116243
  100. High
    pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it…
    Official sourceCVE-2026-116242
  101. Critical
    pgAdmin lets database users run commands on the pgAdmin computer
    Fix available · out Official sourceCVE-2026-116241
  102. High
    In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the…
    Official sourceCVE-2026-116240
  103. High
    In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an…
    Official sourceCVE-2026-116239
  104. Critical
    pgAdmin 4 lets attackers guess passwords without being locked out
    Fixed in pgAdmin 4 version 9.19 or later · out Official sourceCVE-2026-116238
  105. High
    In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive…
    Official sourceCVE-2026-115830
  106. High
    In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully…
    Official sourceCVE-2026-115829
  107. Unrated
    Debian DSA-6597-1: DPDK packet processing libraries multiple flaws
    Official source
  108. High
    Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
    Official sourceCVE-2026-94175
  109. Critical
    LeadSnap plugin lets anyone run code on the site without logging in
    Official, 2 sourcesCVE-2026-90888
  110. High
    Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
    Official sourceCVE-2026-78527
  111. High
    Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
    Official sourceCVE-2026-73186
  112. High
    praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI.
    Official sourceCVE-2026-62331
  113. High
    Hydra is a layer-two scalability solution for Cardano.
    Official sourceCVE-2026-62162
  114. High
    VoiceSentinel is a real-time voice moderation system for Minecraft servers.
    Official sourceCVE-2026-61854
  115. High
    Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification.
    Official sourceCVE-2026-61845
  116. High
    Copernik XML Factory provides secure-by-default JAXP factory creation for Java.
    Official sourceCVE-2026-61586
  117. High
    Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
    Official sourceCVE-2026-54855
  118. High
    Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
    Official sourceCVE-2026-48201
  119. High
    Open Access Management (OpenAM) is an access management solution.
    Official sourceCVE-2026-46560
  120. High
    Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
    Official sourceCVE-2026-39786
  121. Critical
    FunnelKit Automations plugin for WordPress: unauthenticated object injection flaw
    Official, 2 sourcesCVE-2026-39738
  122. High
    Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
    Official sourceCVE-2026-39734
  123. Critical
    Transliterator plugin lets anonymous users run database commands
    Official, 2 sourcesCVE-2026-39732
  124. High
    Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
    Official sourceCVE-2026-28160
  125. Critical
    Royal Event WordPress theme can be hijacked through untrusted data
    Official, 2 sourcesCVE-2026-119526
  126. High
    Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the…
    Official sourceCVE-2026-119117
  127. High
    Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
    Official sourceCVE-2026-118090
  128. High
    Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
    Official sourceCVE-2026-118089
  129. High
    Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
    Official sourceCVE-2026-118086
  130. High
    Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
    Official sourceCVE-2026-116862
  131. High
    Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
    Official sourceCVE-2026-116861
  132. Critical
    Widget Options plugin lets attackers run code on the site
    Official, 2 sourcesCVE-2026-116852
  133. High
    Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
    Official sourceCVE-2026-116851
  134. High
    Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
    Official sourceCVE-2026-116847
  135. High
    Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
    Official sourceCVE-2026-116405
  136. High
    Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
    Official sourceCVE-2026-116401
  137. Critical
    SMS Alert Order Notifications plugin lets unauthenticated users gain elevated privileges
    Official, 2 sourcesCVE-2026-116386
  138. High
    Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
    Official sourceCVE-2026-105077
  139. High
    Fashion retailer Resolve: hackers stole customer payment card data
    1 source, unconfirmed
  140. High
    Visual Studio may accept fake server identities on the network
    Official, 3 sourcesCVE-2026-118147
  141. High
    Apache PLC4X OPC UA client: signature bypass and certificate validation flaws
    1 source, unconfirmedCVE-2026-102508
  142. High
    Apache PLC4X OPC UA client: signature bypass and certificate validation flaws
    1 source, unconfirmedCVE-2026-102509
  143. High
    AdminNeo database tool can be crashed by a crafted web request

    adminneo-org/adminneo

    Fixed in 5.5.0 · out Official, 2 sourcesCVE-2026-59978composer
  144. High
    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct…
    Official sourceCVE-2026-97638
  145. High
    The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site…
    Official sourceCVE-2026-96894
  146. High
    GNU C Library gettext can load message files from unsafe paths via LANGUAGE variable
    Official, 3 sourcesCVE-2026-84243
  147. High
    The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution…
    Official sourceCVE-2026-76012
  148. High
    LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows…
    Official sourceCVE-2026-119979
  149. Critical
    Flowise: logged-in users can run system commands on the server
    Official, 2 sourcesCVE-2026-119978
  150. High
    A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser.
    Official sourceCVE-2026-119777
  151. High
    Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target…
    Official sourceCVE-2026-119764
  152. High
    Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of…
    Official sourceCVE-2026-119762
  153. High
    sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolv_cancel() that allows remote unauthenticated…
    Official sourceCVE-2026-119760
  154. High
    Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled…
    Official sourceCVE-2026-119086
  155. Critical
    JetBrains Toolbox and IntelliJ IDEA trust forged certificates
    Fix available · out Official sourceCVE-2026-118697
  156. High
    In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2;…
    Official sourceCVE-2026-118696
  157. High
    The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege…
    Official sourceCVE-2026-118205
  158. High
    The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions…
    Official sourceCVE-2026-115346
  159. High
    The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is…
    Official sourceCVE-2026-112365
  160. High
    The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up…
    Official sourceCVE-2026-110305
  161. High
    The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization…
    Official sourceCVE-2026-107630
  162. High
    The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to…
    Official sourceCVE-2026-105894
  163. High
    The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign'…
    Official sourceCVE-2026-104744
  164. High
    The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7.
    Official sourceCVE-2025-8574
  165. Critical
    Ivanti Connect Secure VPN lets logged-in attackers upload files
    Exploited (CISA KEV, SecurityWeek)Fix available · out Official, 3 sourcesCVE-2026-118527
  166. Critical
    Ivanti Connect Secure flaw lets logged-in users take full control
    Exploited (CISA KEV, NVD)Fix available · out Official, 6 sourcesCVE-2026-111357
  167. High
    Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue…
    Official sourceCVE-2026-65566
  168. Critical
    Bazarr Plex integration endpoints accept requests without login
    Partial fix · out Official sourceCVE-2026-61826
  169. High
    myTinyWMS is a free, open-source warehouse management system.
    Official sourceCVE-2026-61804
  170. High
    Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS…
    Official sourceCVE-2026-119148
  171. High
    A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS…
    Official sourceCVE-2026-119116
  172. Critical
    LXD server lets attackers bypass login and take over the cluster
    Fix available · out Official, 2 sourcesCVE-2026-112816
  173. High
    The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to…
    Official sourceCVE-2026-118238
  174. Medium
    Microsoft Edge (Chromium) elevation of privilege flaw CVE-2026-69446
    Official, 2 sourcesCVE-2026-69446
  175. Medium
    Apache Pinot: lookup() bypasses authorization, exposing dimension tables
    Official, 2 sourcesCVE-2026-73322
  176. High
    Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size…
    Official sourceCVE-2026-119722
  177. High
    Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor…
    Official sourceCVE-2026-119719
  178. High
    Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in…
    Official sourceCVE-2026-119718
  179. Critical
    pybars4 template engine lets crafted templates run Python code
    Official, 2 sourcesCVE-2026-119717
  180. Critical
    pybars3 template engine lets crafted templates run Python code
    Official, 2 sourcesCVE-2026-119716
  181. High
    Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set…
    Official sourceCVE-2026-119713
  182. High
    PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the…
    Official sourceCVE-2026-119710
  183. High
    abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name…
    Official sourceCVE-2026-119708
  184. High
    SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes…
    Official sourceCVE-2026-119707
  185. Critical
    LMDeploy: unauthenticated remote code execution via /update_weights endpoint
    Official, 2 sourcesCVE-2026-119706
  186. High
    Zuke is a code-first, strongly typed build automation system for Deno.
    Official sourceCVE-2026-119290
  187. High
    Zuke is a code-first, strongly typed build automation system for Deno.
    Official sourceCVE-2026-119289
  188. High
    Zuke is a code-first, strongly typed build automation system for Deno.
    Official sourceCVE-2026-119288
  189. High
    Zuke is a code-first, strongly typed build automation system for Deno.
    Official sourceCVE-2026-119287
  190. High
    A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12,…
    Official sourceCVE-2026-104615
  191. High
    Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap…
    Official sourceCVE-2026-104067
  192. High
    Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when…
    Official sourceCVE-2026-104066
  193. High
    Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…
    Official sourceCVE-2026-104065
  194. High
    Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers…
    Official sourceCVE-2026-104064
  195. High
    Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows…
    Official sourceCVE-2026-104062
  196. High
    Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked…
    Official sourceCVE-2026-104061
  197. High
    Business::GoCardless Perl module lets leaked payment redirect IDs charge another customer
    Fixed in Version 1.01 or later. · out Official, 2 sourcesCVE-2026-119038
  198. High
    Perl GoCardless library accepts forged payment webhooks with empty secret
    Fixed in Version 1.01 or later · out Official, 2 sourcesCVE-2026-119037
  199. High
    Perl GoCardless webhook library can be crashed by oversized unsigned requests
    Fixed in Version 1.01 · out Official, 2 sourcesCVE-2026-119036
  200. High
    Starlet web server for Perl sends unwanted data on HEAD requests
    Fixed in Starlet 0.33 or later · out Official, 2 sourcesCVE-2026-116127
  201. High
    Starlet (Perl web server) can be stalled by crafted chunked requests
    Fixed in Starlet 0.33 or later · out Official, 2 sourcesCVE-2026-115866
  202. High
    Starlet (Perl web server) can be crashed by one oversized request
    Fixed in Starlet 0.33 or later · out Official, 2 sourcesCVE-2026-115865
  203. Critical
    Google Cloud Application Integration: code execution via crafted data in SubWorkflow task
    Fix available · out Official sourceCVE-2026-93327
  204. High
    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.
    Official sourceCVE-2026-61739
  205. Critical
    CoPilot security tool lets users overwrite server files via crafted upload name
    Fixed in 0.1.77 · out Official sourceCVE-2026-61738
  206. Critical
    ng-antd-admin login tokens can be forged with a built-in default secret
    Fix available · out Official sourceCVE-2026-61737
  207. Critical
    SOCFortress CoPilot exposes cloud security reports and GCP keys without login
    Partial fix · out Official sourceCVE-2026-61730
  208. Critical
    SOCFortress CoPilot can be bypassed with a public default password
    Fixed in Version 0.1.76 · out Official sourceCVE-2026-61729
  209. Critical
    SOCFortress CoPilot: stored script injection can steal login tokens
    Fix available · out Official sourceCVE-2026-61728
  210. High
    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs.
    Official sourceCVE-2026-61708
  211. High
    libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format.
    Official sourceCVE-2026-61627
  212. High
    libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format.
    Official sourceCVE-2026-61626
  213. High
    Chamilo LMS is an open-source learning management system.
    Official sourceCVE-2026-45145
  214. High
    Chamilo LMS is an open-source learning management system.
    Official sourceCVE-2026-45144
  215. High
    An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine…
    Official sourceCVE-2026-119682
  216. High
    A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to…
    Official sourceCVE-2026-119680
  217. High
    Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to…
    Official sourceCVE-2026-119662
  218. Critical
    MuseBot admin login can be forged with a built-in default key
    Fix available · out Official sourceCVE-2026-119660
  219. High
    CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList…
    Official sourceCVE-2026-119656
  220. High
    CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via…
    Official sourceCVE-2026-119655
  221. High
    DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate…
    Official sourceCVE-2026-119654
  222. High
    Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in…
    Official sourceCVE-2026-119649
  223. High
    ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to…
    Official sourceCVE-2026-119645
  224. Critical
    Vvveb CMS: admins can read and overwrite other admins' API tokens
    Fixed in Version 1.0.8.7 · out Official sourceCVE-2026-112905
  225. Critical
    Vvveb CMS password reset flaw lets attackers bypass login
    Fixed in Vvveb CMS 1.0.8.7 and later · out Official sourceCVE-2026-110799
  226. High
    DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…
    Official sourceCVE-2010-20125
  227. Medium
    ProFTPD: multiple flaws let authenticated remote attackers tamper with files
    Official source
  228. High
    n8n: multiple flaws allow code execution, info disclosure, SQL injection, and security bypass
    Official source
  229. Medium
    Red Hat Enterprise Linux: pipewire and dbus-broker flaws allow denial of service
    Official source
  230. High
    OPNsense: multiple flaws allow code execution as admin, bypass, XSS, DoS
    Official source
  231. Medium
    joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

    joserfc

    Fixed in joserfc 1.7.6 · out Official, 2 sourcesCVE-2026-119284pip
  232. Medium
    charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users

    github.com/charmbracelet/soft-serve

    Fix available · out Official sourceGHSA-f3fj-9625-rv3mgo
  233. Medium
    charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories

    github.com/charmbracelet/soft-serve

    Fix available · out Official sourceGHSA-fgxm-5hvv-x4vhgo
  234. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability.
    Official sourceCVE-2026-91914
  235. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS…
    Official sourceCVE-2026-91913
  236. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability.
    Official sourceCVE-2026-91912
  237. High
    Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc.
    Official sourceCVE-2026-86715
  238. High
    vLLM: several flaws let attackers leak data, tamper, or crash the service
    Official source
  239. Medium
    Apache HttpComponents: remote unauthenticated denial of service flaw
    Official source
  240. Critical
    Ruby on Rails: flaw can leak sensitive information
    Official source
  241. Medium
    vim: multiple vulnerabilities allow local code execution, DoS, info disclosure
    Official source
  242. High
    ffmpeg: multiple vulnerabilities allow memory corruption and code execution
    Official source
  243. Critical
    OpenDeepWiki admin access can be forged with a publicly known key
    Official, 2 sourcesCVE-2026-119597
  244. High
    MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows…
    Official sourceCVE-2026-119578
  245. High
    ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through…
    Official sourceCVE-2026-119577
  246. High
    ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with…
    Official sourceCVE-2026-119575
  247. High
    Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to…
    Official sourceCVE-2026-119574
  248. High
    Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider…
    Official sourceCVE-2026-119572
  249. High
    A flaw was found in GIMP.
    Official sourceCVE-2026-119528
  250. High
    ffmpeg: multiple vulnerabilities allow code execution, data tampering, info disclosure, DoS
    Official source
  251. Medium
    ImageMagick: local attacker can trigger denial of service
    Official source
  252. High
    Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API,…
    Official sourceCVE-2026-112347
  253. Medium
    Roundcube webmail: multiple vulnerabilities enable XSS, DoS, and data exposure
    Official source
  254. Medium
    nghttp2: remote anonymous attacker can manipulate data (CERT-Bund update)
    Official source
  255. Medium
    vim: multiple vulnerabilities allow DoS, info disclosure, code execution
    Official source
  256. Medium
    vim: multiple vulnerabilities allow code execution and denial of service
    Official source
  257. Medium
    vim: vulnerability allows denial of service
    Official source
  258. Medium
    CPython: remote anonymous DoS vulnerability (CERT-Bund WID-SEC-2026-1830 update)
    Official source
  259. Medium
    vim: multiple vulnerabilities allow local code execution and DoS
    Official source
  260. Medium
    vim: multiple vulnerabilities allow arbitrary code execution
    Official source
  261. High
    Synacor Zimbra: multiple vulnerabilities allow XSS, code execution, data disclosure
    Official source
  262. High
    Red Hat Ansible Automation Platform: several vulnerabilities allow takeover or disruption
    Official source
  263. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.
    Official sourceCVE-2026-91917
  264. High
    An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with…
    Official sourceCVE-2026-75882
  265. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL…
    Official sourceCVE-2026-111503
  266. Unrated
    HTTP::Parser::XS for Perl truncates PATH_INFO at encoded NUL byte (CVE-2026-116130)
    Official, 2 sourcesCVE-2026-116130
  267. High
    CallBackery (Perl) lets anyone read server files via /doc route
    Fix available · out Official, 2 sourcesCVE-2026-118988
  268. Unrated
    DateTime::Lite for Perl (before 0.8.1): CPU exhaustion via per-day loop when adding seconds
    Official, 2 sourcesCVE-2026-87768
  269. Critical
    Fake Claude Code extension on Cursor marketplace installed SSH backdoors
    Attacks reported (r/netsec, Hacker News)1 source, unconfirmed
  270. High
    SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits…
    Official sourceCVE-2026-119586
  271. Critical
    vsftpd FTPS data connections can be hijacked by unauthenticated attackers
    Official, 2 sourcesCVE-2026-119568
  272. High
    phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse()…
    Official sourceCVE-2026-119561
  273. High
    OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to…
    Official sourceCVE-2026-119559
  274. High
    n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated…
    Official sourceCVE-2026-119557
  275. High
    Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal…
    Official sourceCVE-2026-119553
  276. High
    Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows…
    Official sourceCVE-2026-119551
  277. High
    Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass…
    Official sourceCVE-2026-119549
  278. High
    phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary…
    Official sourceCVE-2026-119426
  279. High
    Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…
    Official sourceCVE-2026-119422
  280. High
    Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows…
    Official sourceCVE-2026-119421
  281. High
    Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session…
    Official sourceCVE-2026-119420
  282. Critical
    CakePHP: SQL injection via unchecked database collation names
    Official, 2 sourcesCVE-2026-119419
  283. Critical
    CakePHP: SQL injection via window frame values
    Official, 2 sourcesCVE-2026-119418
  284. High
    OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware…
    Official sourceCVE-2026-119409
  285. High
    n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated…
    Official sourceCVE-2026-119408
  286. High
    Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing…
    Official sourceCVE-2026-119407
  287. High
    SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in…
    Official sourceCVE-2026-119379
  288. High
    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write…
    Official sourceCVE-2026-119374
  289. High
    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output…
    Official sourceCVE-2026-119373
  290. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS…
    Official sourceCVE-2026-111505
  291. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command…
    Official sourceCVE-2026-111504
  292. High
    Płatnik performs client-side authentication.
    Official sourceCVE-2026-110972
  293. High
    Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it.
    Official sourceCVE-2026-110971
  294. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS…
    Official sourceCVE-2026-101214
  295. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability.
    Official sourceCVE-2026-101213
  296. High
    Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS…
    Official sourceCVE-2026-101210
  297. High
    ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability.
    Official sourceCVE-2025-68394
  298. High
    ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability.
    Official sourceCVE-2025-68393
  299. High
    WordPress Core flaw lets attackers run code on sites, attacks underway
    Attacks reported (The Hacker News, SecurityWeek)Fix available · out 2 independent sources
  300. High
    A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase…
    Official sourceCVE-2026-85268
  301. High
    The web server does not check authentication on POST or PUT.
    Official sourceCVE-2026-22110
  302. High
    The shipped WebUI template database retains the factory default passwords for all five account types in cleartext.
    Official sourceCVE-2026-22109
  303. High
    Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device…
    Official sourceCVE-2026-22105
  304. Critical
    ClickHouse Server flaw lets outsiders run code on the server
    Official, 2 sourcesCVE-2026-116366
  305. Critical
    Dahua Intelligent Connection Center can be taken over remotely
    Official, 2 sourcesCVE-2025-31704
  306. High
    Keycloak: multiple flaws allow security bypass, data tampering, info disclosure
    Official source
  307. High
    Apache Tomcat: several flaws let remote attackers bypass security or crash the server
    Official source
  308. High
    Microsoft Edge: several flaws allow attackers to run code
    Official source
  309. High
    Eclipse Jetty: multiple flaws allow file tampering, info disclosure, and security bypass
    Official source
  310. High
    Drupal Core, Gin Admin Theme and Entity List: multiple flaws allow code execution and XSS
    Official source
  311. High
    IBM WebSphere Application Server and Liberty: multiple vulnerabilities (code execution, DoS)
    Official source
  312. High
    IBM WebSphere Application Server and Liberty: multiple vulnerabilities (DoS, data disclosure, admin rights)
    Official source
  313. High
    Red Hat Enterprise Linux: flaws in cjose and ruby net-imap
    Official source
  314. Medium
    Red Hat Enterprise Linux resteasy flaw allows remote information disclosure
    Official source
  315. Medium
    IBM WebSphere Application Server Liberty: multiple vulnerabilities (info disclosure, file tampering, privilege escalation)
    Official source
  316. High
    Bouncy Castle for Java: several security flaws can be exploited
    Official source
  317. Medium
    SOS GmbH JobScheduler: multiple flaws allow unspecified attacks
    Official source
  318. High
    An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user…
    Official sourceCVE-2026-14467
  319. High
    The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/…
    Official sourceCVE-2026-59387
  320. Critical
    Drupal Commerce Core lets attackers bypass access checks on online stores

    drupal/commerce

    Attacks reported (The Hacker News, BleepingComputer)Fix availableOfficial, 6 sourcesCVE-2026-118539composer
  321. Critical
    Teltonika router firmware lets anyone without login run system commands
    Official, 2 sourcesCVE-2026-82104
  322. High
    The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and…
    Official sourceCVE-2026-97645
  323. High
    The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field /…
    Official sourceCVE-2026-90437
  324. High
    The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…
    Official sourceCVE-2026-89435
  325. High
    The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-116622
  326. High
    The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in…
    Official sourceCVE-2026-110732
  327. Critical
    Gravity Forms WordPress plugin can let attackers inject harmful data (up to 3.1.2)
    Official, 2 sourcesCVE-2026-103039
  328. Medium
    KeePassXC multiple flaws allow local denial of service and information disclosure
    Official source
Show 100 more