CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-127111 SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force 12.11.2026 9.1
CVE-2026-120869 An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance 12.11.2026 9.3
CVE-2026-19422 Authentication Bypass 12.11.2026 9.1
CVE-2026-127046 MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response 12.11.2026 9.2
CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints 12.11.2026 9.2
CVE-2026-90908 Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator 12.11.2026 9.3
CVE-2026-110003 Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution 12.11.2026 9.3
CVE-2026-12591 Privilege Escalation 12.11.2026 9.9
CVE-2026-12507 Authenticated remote code execution 12.11.2026 9.1
CVE-2026-8333 TimePictra Stored Cross-site Scripting 12.11.2026 9.4
CVE-2026-76954 12.11.2026 9.8
CVE-2026-126785 rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission 12.11.2026 9.3
CVE-2026-67449 Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key 11.11.2026 9.8
CVE-2026-126229 12.11.2026 9.1
CVE-2026-126251 12.11.2026 9.1
CVE-2026-126253 12.11.2026 9.3
CVE-2026-126254 12.11.2026 9.6
CVE-2026-126257 11.11.2026 9
CVE-2026-126259 12.11.2026 9
CVE-2026-126262 12.11.2026 9.3
CVE-2026-126263 12.11.2026 9.4
CVE-2026-126147 11.11.2026 9.8
CVE-2026-126148 11.11.2026 9.8
CVE-2026-126150 11.11.2026 9.1
CVE-2026-126155 11.11.2026 9.1
CVE-2026-126156 11.11.2026 9.1
CVE-2026-126157 11.11.2026 9.1
CVE-2026-126164 11.11.2026 9.4
CVE-2026-126170 11.11.2026 9.8
CVE-2026-126797 NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin 11.11.2026 9.3
CVE-2026-126800 Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class 11.11.2026 9.3
CVE-2026-126806 WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag 11.11.2026 9.3
CVE-2026-126812 blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose 11.11.2026 9.3
CVE-2026-126777 Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password 11.11.2026 9.1
CVE-2026-65840 Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey 11.11.2026 9.6
CVE-2026-126768 OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag 11.11.2026 9.3
CVE-2026-110697 Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens 12.11.2026 9.9
CVE-2026-126325 Critical Remote Code Execution (RCE) vulnerability reported in Windchill 11.11.2026 9.2
CVE-2026-123710 Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation 12.11.2026 9.8
CVE-2026-85632 Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce) 11.11.2026 9.1
CVE-2026-126537 Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress' 12.11.2026 9.1
CVE-2026-78287 WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability 12.11.2026 10
CVE-2026-118965 Path traversal in host label synchronization allows code execution on the central site from a remote site 11.11.2026 9.4
CVE-2026-120495 Arbitrary file write and code execution via crafted Synthetic Monitoring agent data 11.11.2026 9.4
CVE-2026-121374 Arbitrary file write and code execution via excluded node roles in Kubernetes special agent 11.11.2026 9.4
CVE-2026-112174 Privilege escalation in Enter’s Iperius Backup 11.11.2026 9.3
CVE-2026-64678 Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path 11.11.2026 9.8
CVE-2026-64682 AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name 11.11.2026 9.8
CVE-2026-64670 Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit 11.11.2026 9.3
CVE-2026-126539 Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface 11.11.2026 9.2
CVE-2026-126542 WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login 11.11.2026 9.3
CVE-2026-126187 React: Unauthenticated Remote Code Execution in React Server Components 10.11.2026 9.5
CVE-2026-126261 10.11.2026 9
CVE-2026-82391 Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length 10.11.2026 9.1
CVE-2026-113579 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94) 11.11.2026 9.9
CVE-2026-113580 Adobe Experience Manager | Improper Control of Generation of Code ('Code Injection') (CWE-94) 11.11.2026 9.9
CVE-2026-114371 Adobe Experience Manager | Incorrect Authorization (CWE-863) 11.11.2026 9.9
CVE-2026-119017 Adobe Experience Manager | Incorrect Authorization (CWE-863) 11.11.2026 9.9
CVE-2026-125297 AsiaInfo Business Support System (BSS) Missing Authentication 10.11.2026 9.3
CVE-2026-125298 AsiaInfo Business Support System (BSS) Missing JWT Signature Verification 10.11.2026 9.3
CVE-2026-121349 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 11.11.2026 9.6
CVE-2026-121351 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 11.11.2026 10
CVE-2026-121352 Adobe Connect | Incorrect Authorization (CWE-863) 11.11.2026 10
CVE-2026-121353 Adobe Connect | Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93) 11.11.2026 10
CVE-2026-121354 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 11.11.2026 9.9
CVE-2026-121355 Adobe Connect | Incorrect Authorization (CWE-863) 12.11.2026 9.1
CVE-2026-121356 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918) 11.11.2026 10
CVE-2026-121887 Adobe Connect | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 11.11.2026 9.9
CVE-2026-121889 Adobe Connect | Server-Side Request Forgery (SSRF) (CWE-918) 11.11.2026 10
CVE-2026-121892 Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94) 11.11.2026 9.9
CVE-2026-121894 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 11.11.2026 9.9
CVE-2026-121896 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 11.11.2026 9.9
CVE-2026-121898 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 11.11.2026 9.9
CVE-2026-121902 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 11.11.2026 9.4
CVE-2026-121904 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) 10.11.2026 9.6
CVE-2026-121906 Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 11.11.2026 9.9
CVE-2026-121908 Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 11.11.2026 9.9
CVE-2026-125881 Schema-hint SSRF via service import schema validation 10.11.2026 9.3
CVE-2026-89324 Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt 10.11.2026 9.8
CVE-2026-125883 Multiple XXE Vulnerabilities 12.11.2026 9.3
CVE-2026-126082 Active Storage: Possible arbitrary file write and read in Active Storage image analysis 10.11.2026 9.8
CVE-2026-118383 Pre-authentication use-after-free in MongoDB Server replica set primary catch-up 10.11.2026 9.5
CVE-2026-126065 OpenObserve: Empty external password allows authentication bypass 10.11.2026 9.8
CVE-2026-102166 Security Advisory 0227 10.11.2026 9.4
CVE-2026-120808 Certificate Validation Bypass via IPv6 trust-result skip in macOS TLS client 10.11.2026 9.1
CVE-2026-121289 Security Advisory 0208 10.11.2026 9.3
CVE-2026-121295 Security Advisory 0223 10.11.2026 9.2
CVE-2026-121370 Security Advisory 0224 10.11.2026 9.2
CVE-2026-121529 12.11.2026 9.1
CVE-2026-126087 Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent 10.11.2026 9.4
CVE-2026-125331 HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer 10.11.2026 9.1
CVE-2026-116945 Microsoft SQL Server Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-118740 Aspire Security Feature Bypass Vulnerability 12.11.2026 9.1
CVE-2026-119958 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-120002 Microsoft SharePoint Server Elevation of Privilege Vulnerability 12.11.2026 9.9
CVE-2026-112967 Windows Xbox Live Networking Service Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-114146 ASP.NET Core Elevation of Privilege Vulnerability 12.11.2026 9
CVE-2026-114160 Azure Managed Grafana Elevation of Privilege Vulnerability 12.11.2026 9.8
CVE-2026-114162 Microsoft Graph Elevation of Privilege Vulnerability 12.11.2026 9.1
CVE-2026-116928 Windows Search Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-119990 Azure OpenAI Elevation of Privilege Vulnerability 12.11.2026 9.8
CVE-2026-120779 Visual Studio Code Remote Code Execution Vulnerability 12.11.2026 9.6
CVE-2026-80095 Microsoft Office SharePoint Elevation of Privilege Vulnerability 12.11.2026 9
CVE-2026-85844 Windows Kerberos Elevation of Privilege Vulnerability 12.11.2026 9.8
CVE-2026-88218 Windows DNS Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-88234 Windows iSCSI Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-88243 Windows DHCP Server Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-95882 Microsoft DirectMusic Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-95901 Microsoft DirectMusic Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-95962 Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability 12.11.2026 9
CVE-2026-96067 Microsoft Color Management Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-96078 Microsoft Color Management Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-96157 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-109454 Microsoft Office SharePoint Spoofing Vulnerability 12.11.2026 9
CVE-2026-109467 Azure DevOps Server Remote Code Execution Vulnerability 12.11.2026 9.9
CVE-2026-66801 Microsoft Xbox Remote Code Execution Vulnerability 12.11.2026 9.8
CVE-2026-44685 10.11.2026 9.3
CVE-2026-61473 10.11.2026 9.2
CVE-2026-61887 10.11.2026 9.4
CVE-2026-63011 GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels 10.11.2026 9.4
CVE-2026-61547 rabbitmq-c: Heap Buffer Overflow in amqp_send_frame() When Serializing Oversized AMQP_FRAME_BODY 10.11.2026 9.8
CVE-2026-108186 11.11.2026 9.6
CVE-2026-121683 10.11.2026 9.4
CVE-2026-121653 11.11.2026 9.8
CVE-2026-125757 mailcow: dockerized before 2026-11 Template Injection RCE via Domain-Wide Footer 10.11.2026 9.4
CVE-2026-125758 Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET 10.11.2026 9.1
CVE-2026-82509 V Programming Language net.http TLS Certificate Validation Bypass 10.11.2026 9.1
CVE-2026-112136 10.11.2026 9.2
CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token 10.11.2026 9.4
CVE-2026-13312 12.11.2026 9.9
CVE-2026-115646 Partial String Comparison Vulnerability in HiRDB 10.11.2026 9.8
CVE-2026-109795 Missing authorization check in S4CRM 11.11.2026 9.9
CVE-2026-109798 XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) 10.11.2026 9.1
CVE-2026-109803 Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) 11.11.2026 9.9
CVE-2026-120017 Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) 11.11.2026 10
CVE-2026-125086 D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentials 10.11.2026 10
CVE-2026-89126 Memory Corruption vulnerability in SAP Web Dispatcher 11.11.2026 10
CVE-2026-107246 12.11.2026 9.2
CVE-2026-124600 Unencrypted HTTP Traffic Exposing Sensitive User Credentials in GV-Face Android Application v2.2.1 10.11.2026 10
CVE-2026-76964 Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) 11.11.2026 10
CVE-2026-76965 OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform 11.11.2026 9.9
CVE-2026-89103 Broken Access Control in SAP Gateway 11.11.2026 10
CVE-2026-89119 Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager 11.11.2026 9.6
CVE-2026-125370 Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret 11.11.2026 9.3
CVE-2026-125383 INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass 09.11.2026 9.3
CVE-2026-125384 INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder 10.11.2026 9.3
CVE-2026-115934 SQL injection leading to privilege escalation 09.11.2026 9.3
CVE-2026-125120 Mongoose: sanitizeFilter not applied on countDocuments 09.11.2026 9.8
CVE-2026-123815 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) 09.11.2026 9.4
CVE-2026-123807 Signal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution 10.11.2026 9.8
CVE-2026-124001 ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR 09.11.2026 9.2
CVE-2026-123800 SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications 09.11.2026 9.9
CVE-2026-119756 Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP 09.11.2026 9.3
CVE-2026-104989 Pre-authentication remote code execution in Chaos V-Ray Swarm 09.11.2026 9.3
CVE-2026-110468 Remote Code Execution via Unrestricted File Upload in WidzialniCMS 09.11.2026 10
CVE-2026-110469 Remote Code Execution via Unrestricted File Upload in WidzialniCMS 09.11.2026 10
CVE-2026-124079 rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning 09.11.2026 9.3
CVE-2026-118462 AIS update mechanism executes unverified code 09.11.2026 9.2
CVE-2026-115252 Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option 09.11.2026 10
CVE-2026-123870 [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset 12.11.2026 9.5
CVE-2026-124585 Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection 09.11.2026 9.4
CVE-2026-124580 Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection 09.11.2026 10
CVE-2026-124577 Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication 10.11.2026 9.3
CVE-2026-113363 10.11.2026 9.3
CVE-2026-113364 10.11.2026 9.3
CVE-2026-124560 D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow 12.11.2026 9.3
CVE-2026-119506 WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability 09.11.2026 9.1
CVE-2026-6715 Multiple Vulnerabilities in IBM Concert Software 10.11.2026 9.8
CVE-2026-17466 IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities 09.11.2026 9.1
CVE-2026-15266 Multiple Vulnerabilities in IBM Concert Software 10.11.2026 9.8
CVE-2026-114464 Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026 09.11.2026 9.3
CVE-2026-107331 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 9.9
CVE-2026-101117 IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks. 09.11.2026 9.1
CVE-2026-109900 WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability 08.11.2026 9.6
CVE-2026-124427 Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next 08.11.2026 9.3
CVE-2026-124438 Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access 08.11.2026 9.1
CVE-2026-124440 Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass 09.11.2026 9.4
CVE-2026-124445 OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force 08.11.2026 9.3
CVE-2026-124450 OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument 08.11.2026 9.3
CVE-2026-124463 OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View 12.11.2026 9.3
CVE-2026-124469 OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter 10.11.2026 9.4
CVE-2026-124490 OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument 10.11.2026 9.4
CVE-2026-124493 SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent 12.11.2026 9.3
CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass 10.11.2026 9.3
CVE-2026-123549 OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass 08.11.2026 9.3
CVE-2026-123550 OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions 09.11.2026 9.3
CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket 08.11.2026 10
CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow 09.11.2026 9.3
CVE-2026-124060 TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow 09.11.2026 9.4
CVE-2026-124059 TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow 09.11.2026 9.4
CVE-2026-124058 TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow 12.11.2026 9.4
CVE-2026-124057 TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow 11.11.2026 9.4
CVE-2026-123966 Tenda AC19 saveParentControlInfo heap-based overflow 09.11.2026 10
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 09.11.2026 9.1
CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action 07.11.2026 9.1
CVE-2026-104014 Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization 07.11.2026 9.8
CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter 08.11.2026 9.1
CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout 07.11.2026 9.8
CVE-2026-123961 TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow 09.11.2026 9.4
CVE-2026-123960 TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow 09.11.2026 9.4
CVE-2026-123959 TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow 10.11.2026 9.4
CVE-2026-123958 TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow 11.11.2026 9.4
CVE-2026-123957 TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow 09.11.2026 9.4
CVE-2026-18535 IBM API Connect Denial of Service 08.11.2026 9.6
CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.9
CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.9
CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.1
CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect 12.11.2026 9.3
CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.9
CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.9
CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17147 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17239 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.1
CVE-2026-17296 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.6
CVE-2026-17297 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.6
CVE-2026-17298 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17299 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17301 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17313 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.8
CVE-2026-17329 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17336 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.9
CVE-2026-17338 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.1
CVE-2026-17339 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.1
CVE-2026-17340 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.8
CVE-2026-17342 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17344 Multiple Vulnerabilities in IBM API Connect 12.11.2026 9.3
CVE-2026-17353 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.6
CVE-2026-17354 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17359 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17360 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17392 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17394 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.6
CVE-2026-17396 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17399 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.9
CVE-2026-17402 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.9
CVE-2026-17403 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9
CVE-2026-17408 Multiple Vulnerabilities in IBM API Connect 11.11.2026 9.8
CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect 10.11.2026 9.4
CVE-2026-17410 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-18836 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.3
CVE-2026-18838 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-123218 IBM Aspera Faspex Authorization Bypass 10.11.2026 9.8
CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter 08.11.2026 9.8
CVE-2026-17362 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.8
CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 08.11.2026 9.8
CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability 12.11.2026 10
CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials 10.11.2026 9.3
CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections 11.11.2026 9.1
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution 09.11.2026 9.8
CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET 09.11.2026 9.8
CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew 10.11.2026 9.3
CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL 09.11.2026 9.4
CVE-2026-86044 JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution 10.11.2026 9.6
CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value 10.11.2026 9.8
CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 09.11.2026 9.8
CVE-2026-58490 Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults 09.11.2026 9.8
CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State 11.11.2026 9.2
CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser 07.11.2026 9.3
CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access 09.11.2026 10
CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX) 06.11.2026 9.3
CVE-2026-123831 07.11.2026 9.6
CVE-2026-123832 07.11.2026 9.6
CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint 09.11.2026 9.3
CVE-2026-59105 Universal sysadmin credential vulnerability in Jumis 06.11.2026 9.3
CVE-2026-107622 BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter 06.11.2026 9.8
CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter 06.11.2026 9.1
CVE-2026-123279 10.11.2026 9
CVE-2026-123294 07.11.2026 9.6
CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability 07.11.2026 9.8
CVE-2026-120844 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability 06.11.2026 9.8
CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload 06.11.2026 10
CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion 06.11.2026 9.1
CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization 10.11.2026 9.4
CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection 10.11.2026 9.4

Latest Updates

CVE Title Updated Score
CVE-2026-126329 Docker Sandboxes privilege escalation through untrusted state directories 12.11.2026
CVE-2026-127111 SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force 12.11.2026
CVE-2026-127121 SOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailView 12.11.2026
CVE-2026-126330 Docker Sandboxes restores removed automatically assigned port publications 12.11.2026
CVE-2026-70641 12.11.2026
CVE-2026-19809 Kernel stack information disclosure in the charger_get_prop() system call handler 12.11.2026 3.3
CVE-2026-91007 Arbitrary supervisor-mode function pointer injection via charger_set_prop() syscall in the charger driver API 12.11.2026 7.8
CVE-2026-127109 CVE-2026-127109 12.11.2026
CVE-2026-123790 Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution 12.11.2026
CVE-2026-126998 JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery 12.11.2026
CVE-2026-126997 JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgery 12.11.2026
CVE-2026-116303 PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions 12.11.2026 3.1
CVE-2026-116304 PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-116306 PostgreSQL composite-type change during field assignment executes arbitrary code 12.11.2026 8.8
CVE-2026-116307 PostgreSQL plperl prepared-query use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-116308 PostgreSQL dict_int reads beyond zero-length tokens 12.11.2026 4.3
CVE-2026-116309 PostgreSQL plperl blessed-reference type confusion may execute arbitrary code 12.11.2026 8.8
CVE-2026-116310 PostgreSQL COPY error context uses freed field storage 12.11.2026 4.3
CVE-2026-116311 PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables 12.11.2026 5.4
CVE-2026-116312 PostgreSQL MERGE can place the wrong row in a trigger transition table 12.11.2026 5.4
CVE-2026-116313 PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user 12.11.2026 7.2
CVE-2026-116314 PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation 12.11.2026 8.8
CVE-2026-116315 PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code 12.11.2026 8.8
CVE-2026-116316 PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find 12.11.2026 8.8
CVE-2026-116317 PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code 12.11.2026 8.8
CVE-2026-116318 PostgreSQL pg_dump not-null constraint name allows SQL injection 12.11.2026 8.8
CVE-2026-116319 PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-116320 PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-116321 PostgreSQL unterminated name value discloses server memory 12.11.2026 4.3
CVE-2026-116322 PostgreSQL pre-authentication cancel request can leak a spinlock 12.11.2026 5.3
CVE-2026-116323 PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-116325 PostgreSQL reindexdb index name quoting allows SQL injection 12.11.2026 8
CVE-2026-116326 PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf 12.11.2026 8.8
CVE-2026-116327 PostgreSQL security_barrier analysis can expose hidden values through indirect expressions 12.11.2026 4.3
CVE-2026-116328 PostgreSQL generation memory context integer wraparound executes arbitrary code 12.11.2026 8.8
CVE-2026-116329 PostgreSQL statistics import type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-116330 PostgreSQL pg_dump tar restore.sql fails to block psql command injection 12.11.2026 8.8
CVE-2026-116331 PostgreSQL min/max aggregate type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-116332 PostgreSQL portal setup use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-116333 PostgreSQL parallel B-tree array scan reads beyond array bounds 12.11.2026 6.5
CVE-2026-116335 PostgreSQL commutator or negator result-type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-116336 PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions 12.11.2026 8.8
CVE-2026-120139 PostgreSQL tuple-size integer wraparound executes arbitrary code 12.11.2026 8.8
CVE-2026-120141 PostgreSQL materialized set-returning function type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-120142 PostgreSQL dropped-column type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-120143 PostgreSQL transition-table cursor use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-120144 PostgreSQL type-cache invalidation gap executes arbitrary code 12.11.2026 8.8
CVE-2026-120145 PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code 12.11.2026 8.8
CVE-2026-120146 PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks 12.11.2026 4.3
CVE-2026-120147 PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-120148 PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code 12.11.2026 8.1
CVE-2026-120149 PostgreSQL FDW batch-insert mismatch executes arbitrary code 12.11.2026 8.8
CVE-2026-120150 PostgreSQL expanded-record domain-check use-after-free executes arbitrary code 12.11.2026 8.8
CVE-2026-120151 PostgreSQL plpgsql record-field type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-120152 PostgreSQL pg_show_all_settings() use-after-free discloses memory 12.11.2026 4.3
CVE-2026-120153 PostgreSQL extension-script substitutions allow SQL injection through object names 12.11.2026 7.2
CVE-2026-120154 PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies 12.11.2026 4.3
CVE-2026-126996 SakanaAI text-to-LoRA Checkpoint Loading model_loading.py get_tokenizer path traversal 12.11.2026
CVE-2026-14661 PostgreSQL dblink and subscriptions can append to arbitrary files 12.11.2026 8.1
CVE-2026-16237 PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition 12.11.2026 5.4
CVE-2026-16240 PostgreSQL pg_basebackup can use backup manifest content as a format string 12.11.2026 3.7
CVE-2026-18447 PostgreSQL output parameter type confusion executes arbitrary code 12.11.2026 8.8
CVE-2026-6460 PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code 12.11.2026 8.8
CVE-2026-6467 PostgreSQL extension script schema mishandling executes arbitrary SQL 12.11.2026 7.2
CVE-2026-120490 Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms 12.11.2026 3.8
CVE-2026-120869 An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance 12.11.2026
CVE-2026-123039 Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket 12.11.2026 7.8
CVE-2026-71367 Awx: websocket broadcast groups leak cross-organization job metadata 12.11.2026
CVE-2026-107484 Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user 12.11.2026 7.3
CVE-2026-126995 tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal 12.11.2026
CVE-2026-92083 Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer 12.11.2026 7.8
CVE-2026-124018 Gutenverse Form WordPress Plugin < 3.2.2 CSV Formula Injection via Form Submission 12.11.2026
CVE-2026-124628 12.11.2026
CVE-2026-124627 12.11.2026
CVE-2026-116835 12.11.2026
CVE-2026-114466 Insufficient Granularity of Access Control in Git 12.11.2026 4.4
CVE-2026-114467 Out-of-bounds Write in Git 12.11.2026 3.3
CVE-2026-114469 Out-of-bounds Read in Git 12.11.2026 4.4
CVE-2026-127058 WonderCMS before 3.7.0 Unverified Password Change via saveAction 12.11.2026
CVE-2026-97845 Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt 12.11.2026
CVE-2026-125285 TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability 12.11.2026
CVE-2026-125870 BookStack before 26.09.3 Broken Access Control via ImageController 12.11.2026
CVE-2026-111552 Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure 12.11.2026 7.1
CVE-2026-127056 PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan 12.11.2026
CVE-2026-75869 Authenticated command injection 12.11.2026 8.8
CVE-2026-110951 Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure 12.11.2026 7.5
CVE-2026-126994 braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or code 12.11.2026
CVE-2026-127050 Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback 12.11.2026
CVE-2026-75867 Broken Access Control 12.11.2026 8.1
CVE-2026-75868 Broken Access Control 12.11.2026 8.1
CVE-2026-123139 12.11.2026
CVE-2026-126993 SiteServer SSCMS captcha inadequate encryption 12.11.2026
CVE-2026-19422 Authentication Bypass 12.11.2026 9.1
CVE-2026-75864 Broken Access Control 12.11.2026 8.1
CVE-2026-124705 URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI 12.11.2026 7.8
CVE-2026-127046 MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response 12.11.2026
CVE-2026-19421 Authenticated Injection 12.11.2026 8.8
CVE-2026-127036 ibi WebFOCUS - OS Command Injection Vulnerability 12.11.2026
CVE-2026-13764 Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation 12.11.2026 8.8
CVE-2026-15309 CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint 12.11.2026 8.8
CVE-2026-16135 VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings() 12.11.2026 8.8
CVE-2026-2982 WP Table Builder – Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' 12.11.2026 5.4
CVE-2026-114369 Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework 12.11.2026
CVE-2026-124703 Improper Control of Generation of Code in Progress Telerik UI for WPF 12.11.2026 7.8
CVE-2026-124704 Deserialization of Untrusted Data in Progress Telerik UI for WPF 12.11.2026 7.8
CVE-2026-126641 Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled 12.11.2026
CVE-2026-126643 Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource 12.11.2026
CVE-2026-126644 Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory 12.11.2026
CVE-2026-124701 Deserialization of Untrusted Data in Progress Telerik UI for WinForms 12.11.2026 7.8
CVE-2026-124023 Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper 12.11.2026
CVE-2026-123765 Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls. 12.11.2026
CVE-2026-124699 Improper Control of Generation of Code in Progress Telerik UI for WinForms 12.11.2026 7.8
CVE-2026-118975 XML External Entity (XXE) Injection in Telerik Reporting SVG Processing 12.11.2026 6.5
CVE-2026-106140 Deserialization of Untrusted Data in Telerik Reporting Report Designers 12.11.2026 7.3
CVE-2026-117474 12.11.2026
CVE-2026-117475 12.11.2026
CVE-2026-117476 12.11.2026
CVE-2026-127016 MISP Modules Website: Missing Authorization on External Tool Management Endpoints 12.11.2026
CVE-2026-124617 12.11.2026
CVE-2026-76173 SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft 12.11.2026
CVE-2026-90908 Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator 12.11.2026
CVE-2026-110003 Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution 12.11.2026
CVE-2026-126642 Awx: webhook credential assignment omits use_role check, exposing another user's token 12.11.2026
CVE-2026-47832 OpenStack Application Credentials Logged in Cleartext to BOSH Debug Logs 12.11.2026
CVE-2026-40820 Authenticated SQLi in getVpnData function 12.11.2026
CVE-2026-118855 Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status 12.11.2026
CVE-2026-123133 12.11.2026
CVE-2026-125836 WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability 12.11.2026 8.8
CVE-2026-126991 SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input 12.11.2026
CVE-2026-82292 NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt 12.11.2026
CVE-2026-113408 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git 12.11.2026 3.3
CVE-2026-12591 Privilege Escalation 12.11.2026 9.9
CVE-2026-12507 Authenticated remote code execution 12.11.2026 9.1
CVE-2026-87772 Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About 12.11.2026 7.8
CVE-2026-8331 TimePictra ermote code execution via file upload 12.11.2026
CVE-2026-8332 TimePictra root password hardcoded in installation files 12.11.2026
CVE-2026-8333 TimePictra Stored Cross-site Scripting 12.11.2026
CVE-2026-106027 Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback 12.11.2026
CVE-2026-110041 Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints 12.11.2026
CVE-2026-110072 Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attribute 12.11.2026
CVE-2026-110959 Descope < 1.2.0 - Unauthenticated Account Takeover 12.11.2026
CVE-2026-118421 WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter 12.11.2026
CVE-2026-118531 Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update 12.11.2026
CVE-2026-118597 Akaunting 3.3.0 - Stored XSS in custom invoice payment terms 12.11.2026
CVE-2026-119039 Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection 12.11.2026
CVE-2026-119040 Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification 12.11.2026
CVE-2026-121498 Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR 12.11.2026
CVE-2026-122003 Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF 12.11.2026
CVE-2026-123044 ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure 12.11.2026
CVE-2026-123092 WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action 12.11.2026
CVE-2026-124647 TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie 12.11.2026
CVE-2026-124648 TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key 12.11.2026
CVE-2026-124652 Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR 12.11.2026
CVE-2026-124653 Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure 12.11.2026
CVE-2026-124665 Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR 12.11.2026
CVE-2026-124814 Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter 12.11.2026
CVE-2026-124815 Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions 12.11.2026
CVE-2026-124817 Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification 12.11.2026
CVE-2026-76792 User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification 12.11.2026
CVE-2026-101107 12.11.2026
CVE-2026-111436 12.11.2026 4.4
CVE-2026-111433 12.11.2026 8.6
CVE-2026-111434 12.11.2026 5.6
CVE-2026-111435 12.11.2026 7.4
CVE-2026-76954 12.11.2026 9.8
CVE-2026-81559 12.11.2026 4.3
CVE-2026-85101 12.11.2026 8.6
CVE-2026-88266 12.11.2026 4.3
CVE-2026-124993 12.11.2026 5.3
CVE-2026-13656 12.11.2026 5.4
CVE-2026-13672 12.11.2026 8.8
CVE-2026-15198 12.11.2026 6.5
CVE-2026-15201 12.11.2026 5.9
CVE-2026-16550 12.11.2026 6.5
CVE-2026-18596 12.11.2026 8.1
CVE-2026-18633 12.11.2026 7.5
CVE-2026-18792 12.11.2026 8.8
CVE-2026-19048 12.11.2026 8.1
CVE-2026-19414 12.11.2026 4.3
CVE-2026-19833 12.11.2026 5.4
CVE-2026-74850 12.11.2026 4.3
CVE-2026-74857 12.11.2026 8.8
CVE-2026-75785 12.11.2026 7.2
CVE-2026-77738 12.11.2026 4.3
CVE-2026-81557 12.11.2026 5.4
CVE-2026-81558 12.11.2026 4.3
CVE-2026-81584 12.11.2026 8.1
CVE-2026-85098 12.11.2026 5.3
CVE-2026-86343 12.11.2026 6.8
CVE-2026-87801 12.11.2026 6.5
CVE-2026-92379 12.11.2026 5.4
CVE-2026-117687 12.11.2026
CVE-2026-114556 MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability 12.11.2026
CVE-2026-114558 OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114559 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114560 OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114561 OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114562 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114563 OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114564 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114565 OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114566 OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114567 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114568 OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-114569 OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-118631 Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability 12.11.2026
CVE-2026-118632 Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability 12.11.2026
CVE-2026-121742 Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability 12.11.2026
CVE-2026-121743 Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-121744 Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-121752 Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-121753 Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability 12.11.2026
CVE-2026-122044 Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability 12.11.2026
CVE-2025-10935 libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability 12.11.2026
CVE-2026-121741 Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability 12.11.2026
CVE-2026-13269 Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability 12.11.2026
CVE-2026-13270 Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability 12.11.2026
CVE-2026-126957 ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c 12.11.2026 5.3
CVE-2026-126795 ToolJet Onboarding Signup Endpoint util.service.ts activateUserWithPassword missing authentication 12.11.2026
CVE-2026-126673 Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr 12.11.2026
CVE-2026-125785 WordPress JetEngine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability 12.11.2026 6.5
CVE-2026-125786 WordPress Quiz And Survey Master plugin <= 11.3.0 - Content Injection vulnerability 12.11.2026 5.3
CVE-2026-125787 WordPress Quiz And Survey Master plugin <= 11.3.0 - Broken Access Control vulnerability 12.11.2026 5.4
CVE-2026-126785 rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission 12.11.2026