CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-123966 Tenda AC19 saveParentControlInfo heap-based overflow 07.11.2026 10
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 07.11.2026 9.1
CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action 07.11.2026 9.1
CVE-2026-104014 Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization 07.11.2026 9.8
CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter 07.11.2026 9.1
CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout 07.11.2026 9.8
CVE-2026-123961 TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow 07.11.2026 9.4
CVE-2026-123960 TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow 07.11.2026 9.4
CVE-2026-123959 TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow 07.11.2026 9.4
CVE-2026-123958 TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow 07.11.2026 9.4
CVE-2026-123957 TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow 07.11.2026 9.4
CVE-2026-18535 IBM API Connect Denial of Service 07.11.2026 9.6
CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17147 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17239 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17296 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17297 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17298 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17299 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17301 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17313 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17329 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17336 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17338 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17339 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17340 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17342 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17344 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17353 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17354 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17359 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17360 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17392 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17394 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17396 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17399 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17402 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17403 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9
CVE-2026-17408 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-17410 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-18836 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-18838 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-123218 IBM Aspera Faspex Authorization Bypass 07.11.2026 9.8
CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter 07.11.2026 9.8
CVE-2026-17362 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 07.11.2026 9.8
CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability 06.11.2026 10
CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials 06.11.2026 9.3
CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections 06.11.2026 9.1
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution 06.11.2026 9.8
CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET 06.11.2026 9.8
CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew 06.11.2026 9.3
CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL 06.11.2026 9.4
CVE-2026-86044 JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution 06.11.2026 9.6
CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value 06.11.2026 9.8
CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 06.11.2026 9.8
CVE-2026-58490 Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults 06.11.2026 9.8
CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State 06.11.2026 9.2
CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser 06.11.2026 9.3
CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access 06.11.2026 10
CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX) 06.11.2026 9.3
CVE-2026-123831 07.11.2026 9.6
CVE-2026-123832 07.11.2026 9.6
CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint 06.11.2026 9.3
CVE-2026-59105 Universal sysadmin credential vulnerability in Jumis 06.11.2026 9.3
CVE-2026-107622 BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter 06.11.2026 9.8
CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter 06.11.2026 9.1
CVE-2026-123279 06.11.2026 9
CVE-2026-123294 07.11.2026 9.6
CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability 06.11.2026 9.8
CVE-2026-120844 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability 06.11.2026 9.8
CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload 06.11.2026 10
CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion 06.11.2026 9.1
CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization 06.11.2026 9.4
CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection 06.11.2026 9.4
CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads 05.11.2026 9.6
CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app 05.11.2026 9.1
CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API 05.11.2026 9.9
CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform 05.11.2026 9.9
CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure 05.11.2026 9.3
CVE-2026-48705 MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) 05.11.2026 9.3
CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 05.11.2026 9
CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS 05.11.2026 9.1
CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment 05.11.2026 9.6
CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY 05.11.2026 9.1
CVE-2026-116779 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands 07.11.2026 9.8
CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling 05.11.2026 9.1
CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection 05.11.2026 9.4
CVE-2026-71550 SuiteCRM: LFI to RCE via AOW_WorkFlow 05.11.2026 9.9
CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID> 05.11.2026 9.3
CVE-2026-54143 OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution 05.11.2026 9.8
CVE-2026-54141 OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec` 05.11.2026 9
CVE-2026-119344 Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks 05.11.2026 9.1
CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names 07.11.2026 9.1
CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 05.11.2026 10
CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override 05.11.2026 10
CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors 05.11.2026 10
CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults 05.11.2026 10
CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 05.11.2026 10
CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 05.11.2026 10
CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 05.11.2026 10
CVE-2026-73098 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing 05.11.2026 10
CVE-2026-100109 Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user 05.11.2026 9.8
CVE-2026-123025 05.11.2026 9.4
CVE-2026-122992 05.11.2026 9.2
CVE-2026-122302 Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check 05.11.2026 9.3
CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy 05.11.2026 9.4
CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader 05.11.2026 9.4
CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath 05.11.2026 9.4
CVE-2026-122311 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument 05.11.2026 9.4
CVE-2026-122313 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy 05.11.2026 9.4
CVE-2026-122051 Edimax BR-6208AC mp command injection 05.11.2026 10
CVE-2026-115770 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing 04.11.2026 9.6
CVE-2026-52848 GLPI: MFA bypass 04.11.2026 9.2
CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ 04.11.2026 9.3
CVE-2026-54378 VitaFit Cloud API Broken Access Control via S3 Token Endpoint 04.11.2026 9.3
CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy 05.11.2026 9.3
CVE-2026-102894 GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover 06.11.2026 9.1
CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin 06.11.2026 9.8
CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise 04.11.2026 9.9
CVE-2026-82418 IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL 04.11.2026 9.8
CVE-2026-122013 Comfast CF-WR632AX Multipart webmgnt path traversal 04.11.2026 10
CVE-2025-71457 vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php 05.11.2026 9.3
CVE-2026-113373 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again 04.11.2026 9.1
CVE-2026-122220 WPO365 LOGIN before 45.2 SAML Replay Protection Bypass 05.11.2026 9.1
CVE-2026-121933 Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication 04.11.2026 10
CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list 04.11.2026 9.3
CVE-2026-113780 ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary 05.11.2026 9.3
CVE-2026-121932 Linksys E5350 apply.cgi system os command injection 04.11.2026 10
CVE-2026-121931 Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection 04.11.2026 9.4
CVE-2026-121930 Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection 04.11.2026 9.4
CVE-2026-122120 05.11.2026 9
CVE-2026-121952 FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability 04.11.2026 9.3
CVE-2026-121953 FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close 04.11.2026 9.3
CVE-2026-121638 WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks 04.11.2026 9.1
CVE-2026-121639 WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service 04.11.2026 9.2
CVE-2026-121640 WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions 04.11.2026 9.1
CVE-2026-122006 05.11.2026 9.8
CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking 04.11.2026 9.2
CVE-2026-119481 WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability 04.11.2026 9.8
CVE-2026-65555 WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability 04.11.2026 9.8
CVE-2026-114424 Code execution through double evaluation in address replacement rules 04.11.2026 9.2
CVE-2026-114425 Forged LFT metadata permits arbitrary file read and deletion 04.11.2026 9.2
CVE-2026-121802 06.11.2026 9.1
CVE-2026-121615 Linksys E5600 Login mesh_login.cgi improper authentication 04.11.2026 10
CVE-2026-121609 Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials 04.11.2026 10
CVE-2026-121607 Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 04.11.2026 10
CVE-2026-121606 Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 04.11.2026 10
CVE-2026-121600 TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow 04.11.2026 9.4
CVE-2026-121598 TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow 04.11.2026 9.4
CVE-2026-121599 TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow 07.11.2026 9.4
CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow 04.11.2026 9.4
CVE-2026-92189 Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-92188 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-92190 Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality 06.11.2026 9.3
CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 05.11.2026 9.1
CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials 07.11.2026 9.3
CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters 06.11.2026 9.2
CVE-2026-82158 03.11.2026 9
CVE-2026-115731 Report Deserialization Code Execution 06.11.2026 9.4
CVE-2026-115732 Certificate Name Authorization Bypass 06.11.2026 9
CVE-2026-95860 node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 07.11.2026 9.1
CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access 03.11.2026 9.8
CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict 03.11.2026 9.3
CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring 03.11.2026 9.3
CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator 07.11.2026 9.3
CVE-2026-112917 Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall 04.11.2026 9.2
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 03.11.2026 9.8
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 07.11.2026 9.8
CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability 04.11.2026 9.9
CVE-2026-121260 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 03.11.2026 9.4
CVE-2026-121392 FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate 03.11.2026 9.1
CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures 03.11.2026 9.2
CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client 03.11.2026 9.2
CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 03.11.2026 9.8
CVE-2026-13594 Improper Access Control vulnerability 04.11.2026 9.1
CVE-2026-120518 BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler 07.11.2026 9.1
CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 03.11.2026 9.8
CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter 02.11.2026 9.8
CVE-2026-116769 Authentication bypass in Secure Access Servers 06.11.2026 9.3
CVE-2026-97718 CSRF in Secure Access Server v14.60 06.11.2026 9.4
CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 03.11.2026 9.8
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 05.11.2026 9.5
CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 05.11.2026 9.3
CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 05.11.2026 9.4
CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench 03.11.2026 9.4
CVE-2026-105769 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts 02.11.2026 9.3
CVE-2026-88811 Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy 03.11.2026 9.1
CVE-2026-94290 Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller 03.11.2026 9.1
CVE-2026-120442 ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass 05.11.2026 9.3
CVE-2026-120447 HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code 06.11.2026 9.2
CVE-2026-120459 python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key 02.11.2026 9.1
CVE-2026-116606 Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway 03.11.2026 9.3
CVE-2026-120213 @fastify/http-proxy vulnerable to prefix escape via decoded route parameters 02.11.2026 9.1
CVE-2025-11969 Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions 02.11.2026 9.4
CVE-2026-120345 WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection 05.11.2026 10
CVE-2026-120344 WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection 02.11.2026 10
CVE-2026-120322 Termix-SSH Termix transferToHost path traversal 02.11.2026 9.4
CVE-2026-120283 Linksys E8450 portal.cgi strcpy stack-based overflow 02.11.2026 10
CVE-2026-120281 WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow 06.11.2026 10
CVE-2026-120282 WAVLINK WN536AX6-A protocol.csp host_black os command injection 02.11.2026 9.4
CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection 02.11.2026 10
CVE-2026-120280 WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection 05.11.2026 10
CVE-2026-120277 WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection 06.11.2026 10
CVE-2026-120276 WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection 05.11.2026 10
CVE-2026-120240 WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection 02.11.2026 9.4
CVE-2026-120239 WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection 02.11.2026 9.4
CVE-2026-120238 WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection 06.11.2026 9.4
CVE-2026-62048 WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability 01.11.2026 9.3
CVE-2026-120338 Prefab UI Pyodide sandbox escape to host RCE 02.11.2026 9.9
CVE-2026-120232 Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption 02.11.2026 9.3
CVE-2026-120231 WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection 02.11.2026 9.4
CVE-2026-120230 WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection 06.11.2026 9.4
CVE-2026-120229 WAVLINK WN553X1-B ioos sub_416B50 os command injection 05.11.2026 9.4
CVE-2026-120228 WAVLINK WN553X1-B ioos Service sub_416D88 os command injection 02.11.2026 9.4
CVE-2026-120308 Beta9 host filesystem exposure via volume path traversal 02.11.2026 9.9
CVE-2026-120306 Beta9 build sandbox escape via chroot-only isolation 02.11.2026 9.9
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths 02.11.2026 9.9
CVE-2026-120227 WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection 02.11.2026 9.4
CVE-2026-120225 Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal 05.11.2026 9.4
CVE-2026-120224 Oray Pugongying X5 Pro API Authorization run_async_task improper authorization 02.11.2026 9.4
CVE-2026-120198 WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection 02.11.2026 10
CVE-2026-120197 WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection 02.11.2026 9.4
CVE-2026-120196 WAVLINK WN579X3-D wapi.cgi port_forward os command injection 06.11.2026 9.4
CVE-2026-120195 WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection 05.11.2026 10
CVE-2026-120189 D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow 05.11.2026 10
CVE-2026-118636 Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder 06.11.2026 9.8
CVE-2026-120201 Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header 02.11.2026 9.3
CVE-2026-120209 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token 02.11.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2026-123989 ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission 07.11.2026
CVE-2026-124307 Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition 07.11.2026
CVE-2026-124308 Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs 07.11.2026
CVE-2026-124309 Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting 07.11.2026
CVE-2026-124310 Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic 07.11.2026
CVE-2026-124311 Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk 07.11.2026
CVE-2026-124312 Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo 07.11.2026
CVE-2026-124313 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc 07.11.2026
CVE-2026-124314 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities 07.11.2026
CVE-2026-124315 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items 07.11.2026
CVE-2026-124316 Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests 07.11.2026
CVE-2026-124317 libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16 07.11.2026
CVE-2026-124318 Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields 07.11.2026
CVE-2026-99271 ALSA: line6: Clear prev_fbuf on capture buffer release 07.11.2026
CVE-2026-99272 smb: client: validate the data area in SMB2_read() 07.11.2026
CVE-2026-99273 ksmbd: reserve space for the UTF-16 terminator in stream info 07.11.2026
CVE-2026-99274 smb: client: fix fiemap wild read on empty truncated response 07.11.2026
CVE-2026-99275 smb: client: reject short SESSION_SETUP responses 07.11.2026
CVE-2026-99276 ksmbd: defer connection scavenging while session locks are busy 07.11.2026
CVE-2026-99277 ksmbd: hold a connection reference for each session channel 07.11.2026
CVE-2026-99278 ksmbd: limit sessions on each connection 07.11.2026
CVE-2026-99279 ksmbd: reclaim ended sessions on logoff and expiration 07.11.2026
CVE-2026-99280 ksmbd: drain session procfs readers before dropping table references 07.11.2026
CVE-2026-99281 tun: Require CAP_NET_ADMIN to attach to an ownerless device 07.11.2026
CVE-2026-99282 net/sched: sch_teql: fix use-after-free on lower qdisc drop 07.11.2026
CVE-2026-123988 SililaWijesinghe Food Ordering System admin exposure of information through directory listing 07.11.2026
CVE-2026-123966 Tenda AC19 saveParentControlInfo heap-based overflow 07.11.2026
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 07.11.2026
CVE-2026-120839 WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability 07.11.2026 8.8
CVE-2026-120841 WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability 07.11.2026 8.8
CVE-2026-123860 WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-123861 WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability 07.11.2026 5.3
CVE-2026-123964 OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loop 07.11.2026
CVE-2026-121575 WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-121579 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-121777 WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-122659 WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability 07.11.2026 5.4
CVE-2026-122660 WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-123467 WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-123483 WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-121775 WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-121784 WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-122663 WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-122669 WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-123183 WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-123462 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123474 WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123477 WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-123963 OpenBMB Internet of Agents Agent Registry app.py register missing authentication 07.11.2026
CVE-2026-109973 Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter 07.11.2026 6.4
CVE-2026-119156 Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name] 07.11.2026 7.2
CVE-2026-120579 Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute 07.11.2026 6.4
CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action 07.11.2026 9.1
CVE-2026-119498 WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability 07.11.2026 5.3
CVE-2026-121765 WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability 07.11.2026 7.1
CVE-2026-123776 RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process 07.11.2026
CVE-2026-102564 Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer 07.11.2026 6.5
CVE-2026-103914 Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter 07.11.2026 6.5
CVE-2026-104014 Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization 07.11.2026 9.8
CVE-2026-104746 Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta 07.11.2026 8.1
CVE-2026-104760 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute 07.11.2026 6.4
CVE-2026-104768 AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option 07.11.2026 7.5
CVE-2026-109214 User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input 07.11.2026 7.2
CVE-2026-109230 WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter 07.11.2026 7.2
CVE-2026-109991 FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter 07.11.2026 7.5
CVE-2026-111317 JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source 07.11.2026 7.2
CVE-2026-111370 WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters 07.11.2026 7.2
CVE-2026-115548 Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header 07.11.2026 7.2
CVE-2026-116537 Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter 07.11.2026 7.2
CVE-2026-116751 Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys 07.11.2026 7.5
CVE-2026-118047 Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook 07.11.2026 6.4
CVE-2026-118050 Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message 07.11.2026 6.4
CVE-2026-118056 Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter 07.11.2026 4.9
CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter 07.11.2026 9.1
CVE-2026-118267 WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert 07.11.2026 8.1
CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout 07.11.2026 9.8
CVE-2026-119183 JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta 07.11.2026 7.2
CVE-2026-120509 Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter 07.11.2026 4.7
CVE-2026-120683 Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter 07.11.2026 5.4
CVE-2026-120685 Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain 07.11.2026 5.4
CVE-2026-121976 Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter 07.11.2026 6.4
CVE-2026-121977 JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property 07.11.2026 5.4
CVE-2026-122059 WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute 07.11.2026 6.4
CVE-2026-122231 WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value 07.11.2026 7.2
CVE-2026-123418 Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter 07.11.2026 7.2
CVE-2026-93429 VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter 07.11.2026 7.2
CVE-2026-93755 Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header 07.11.2026 7.2
CVE-2026-93766 Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter 07.11.2026 7.2
CVE-2026-96565 WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field 07.11.2026 6.4
CVE-2026-121265 SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update 07.11.2026
CVE-2026-121571 WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-119496 WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-119513 WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-120837 WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-120857 WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123148 WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123468 WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-123470 WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-119523 WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-120364 WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-121724 WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-119525 WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-120365 WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-119478 WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability 07.11.2026 4.3
CVE-2026-119508 WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin <= 1.0.20 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-119490 WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-119492 WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability 07.11.2026 4.3
CVE-2026-119501 WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-121783 WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability 07.11.2026 6.5
CVE-2026-123961 TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow 07.11.2026
CVE-2026-119486 WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-119494 WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-119500 WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-119520 WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-120840 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-120842 WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-120850 WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-119493 WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-123960 TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow 07.11.2026
CVE-2026-123959 TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow 07.11.2026
CVE-2026-119465 WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability 07.11.2026 5.3
CVE-2026-119473 WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability 07.11.2026 4.3
CVE-2026-119507 WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-103900 WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter 07.11.2026 8.1
CVE-2026-104992 Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint 07.11.2026 6.5
CVE-2026-107616 Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint 07.11.2026 7.5
CVE-2026-110004 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter 07.11.2026 6.5
CVE-2026-118784 WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name 07.11.2026 6.4
CVE-2026-119155 wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter 07.11.2026 7.5
CVE-2026-119164 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter 07.11.2026 7.5
CVE-2026-120514 Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter 07.11.2026 5.4
CVE-2026-120532 wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms 07.11.2026 6.4
CVE-2026-120548 YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php 07.11.2026 5.3
CVE-2026-121762 WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability 07.11.2026 8.8
CVE-2026-95870 wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter 07.11.2026 7.5
CVE-2026-119484 WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability 07.11.2026 6.3
CVE-2026-119491 WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-119502 WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-119511 WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-120847 WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-120852 WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-120853 WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-121766 WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability 07.11.2026 5.4
CVE-2026-122668 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-123464 WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-123466 WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-123469 WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-61990 WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-119467 WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability 07.11.2026 5.4
CVE-2026-119510 WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-121768 WordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-123958 TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow 07.11.2026
CVE-2026-52713 WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability 07.11.2026 5.4
CVE-2026-66669 WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability 07.11.2026 8.8
CVE-2026-119489 WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-120849 WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-121781 WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-120848 WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability 07.11.2026 6.5
CVE-2026-121761 WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability 07.11.2026 4.3
CVE-2026-121767 WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-122675 WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability 07.11.2026 5.4
CVE-2026-124274 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-121778 WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-121779 WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability 07.11.2026 5.3
CVE-2026-39733 WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability 07.11.2026 5.3
CVE-2026-104738 Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters 07.11.2026 8.1
CVE-2026-123957 TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow 07.11.2026
CVE-2026-123881 OpenBMB Internet of Agents Message app.py fetch_chat_record access control 07.11.2026
CVE-2026-103917 Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter 07.11.2026 6.5
CVE-2026-115811 Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter 07.11.2026 7.2
CVE-2026-116558 Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget 07.11.2026 7.2
CVE-2026-116621 Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field 07.11.2026 6.4
CVE-2026-118048 WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label 07.11.2026 6.4
CVE-2026-118204 WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer 07.11.2026 6.4
CVE-2026-118800 aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute 07.11.2026 6.4
CVE-2026-118801 aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode 07.11.2026 4.3
CVE-2026-120479 WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form 07.11.2026 6.4
CVE-2026-120515 SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters 07.11.2026 6.4
CVE-2026-120530 WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography 07.11.2026 5.7
CVE-2026-120537 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint 07.11.2026 7.2
CVE-2026-121536 WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter 07.11.2026 5.3
CVE-2026-121792 GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter 07.11.2026 6.5
CVE-2026-122037 AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard 07.11.2026 7.2
CVE-2026-122265 Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter 07.11.2026 5.9
CVE-2026-87112 QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters 07.11.2026 8.8
CVE-2026-93370 Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint 07.11.2026 5.3
CVE-2026-83495 Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration 07.11.2026
CVE-2025-15708 Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug 07.11.2026
CVE-2026-117525 FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup 07.11.2026
CVE-2026-117588 WP Google Review Slider < 18.11 - Google API Settings Update via CSRF 07.11.2026
CVE-2026-118528 Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR 07.11.2026
CVE-2026-118529 Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout 07.11.2026
CVE-2026-118530 Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action 07.11.2026
CVE-2026-118532 Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field 07.11.2026
CVE-2026-118533 Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt 07.11.2026
CVE-2026-118534 Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR 07.11.2026
CVE-2026-119073 Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination 07.11.2026
CVE-2026-121379 Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion 07.11.2026
CVE-2026-121380 Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API 07.11.2026
CVE-2026-121491 Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header 07.11.2026
CVE-2026-121492 Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update 07.11.2026
CVE-2026-121796 Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload 07.11.2026
CVE-2026-121848 Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation 07.11.2026
CVE-2026-121857 Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend 07.11.2026
CVE-2026-121858 Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search 07.11.2026
CVE-2026-121866 Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update 07.11.2026
CVE-2026-122001 Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF 07.11.2026
CVE-2026-97189 Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields 07.11.2026
CVE-2026-97190 Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR 07.11.2026
CVE-2026-97191 Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path 07.11.2026
CVE-2026-18535 IBM API Connect Denial of Service 07.11.2026 9.6
CVE-2026-17384 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17386 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.1
CVE-2026-17393 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.1
CVE-2026-19124 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.8
CVE-2026-105002 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.5
CVE-2026-105459 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.8
CVE-2026-108178 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.2
CVE-2026-16679 IBM API Connect Path Traversal 07.11.2026 4.3
CVE-2026-16709 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.7
CVE-2026-16710 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.8
CVE-2026-16711 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.3
CVE-2026-16712 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-16714 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.5
CVE-2026-16715 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-16716 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.8
CVE-2026-16717 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-16718 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-16719 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.5
CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-16854 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-16880 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-16912 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17062 Multiple Vulnerabilities in IBM API Connect 07.11.2026 2.7
CVE-2026-17064 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17067 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.5
CVE-2026-17085 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.1
CVE-2026-17098 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.3
CVE-2026-17108 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17112 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17114 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17128 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.8
CVE-2026-17129 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.6
CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17137 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4
CVE-2026-17139 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17140 Multiple Vulnerabilities in IBM API Connect 07.11.2026 3.3
CVE-2026-17143 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.3
CVE-2026-17144 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.3
CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17147 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17154 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17155 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17167 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.3
CVE-2026-17172 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17187 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17188 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17190 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.7
CVE-2026-17202 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.3
CVE-2026-17211 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.3
CVE-2026-17214 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.8
CVE-2026-17215 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.3
CVE-2026-17225 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17228 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17230 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17231 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.8
CVE-2026-17232 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.1
CVE-2026-17233 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17236 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17237 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17238 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17239 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17240 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.5
CVE-2026-17241 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.5
CVE-2026-17244 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.4
CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17279 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17280 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.9
CVE-2026-17281 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17282 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17283 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17284 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.1
CVE-2026-17285 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17287 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17288 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17289 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17290 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17291 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.7
CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17293 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17294 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17295 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17296 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17297 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17298 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17299 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17301 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17302 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-17303 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17304 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17305 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.5
CVE-2026-17306 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.8
CVE-2026-17307 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.5
CVE-2026-17308 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.8
CVE-2026-17309 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8
CVE-2026-17310 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.5
CVE-2026-17311 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.1
CVE-2026-17312 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17313 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17314 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-17315 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.8
CVE-2026-17316 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.2
CVE-2026-17317 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17318 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17319 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.1
CVE-2026-17320 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17321 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.1
CVE-2026-17322 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.1
CVE-2026-17323 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.2
CVE-2026-17324 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.3
CVE-2026-17325 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17326 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.1
CVE-2026-17327 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17328 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17329 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17330 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17331 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.5
CVE-2026-17332 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.7
CVE-2026-17333 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8
CVE-2026-17334 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17335 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.8
CVE-2026-17336 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17337 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.4
CVE-2026-17338 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17339 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17340 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17341 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.2
CVE-2026-17342 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17343 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.1
CVE-2026-17344 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17345 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17352 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17353 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17354 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17355 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.2
CVE-2026-17356 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.7
CVE-2026-17357 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.6
CVE-2026-17358 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.2
CVE-2026-17359 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17360 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17361 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17363 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17365 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17366 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-17367 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17368 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.8
CVE-2026-17369 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.4
CVE-2026-17370 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17371 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-17372 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17373 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17374 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17375 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17376 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17377 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-17378 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17379 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.4
CVE-2026-17380 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17381 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17382 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17383 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17385 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17387 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17388 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17389 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.3
CVE-2026-17390 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17391 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.3
CVE-2026-17392 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17394 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17395 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.4
CVE-2026-17396 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17397 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17398 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17399 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17400 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.7
CVE-2026-17401 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.2
CVE-2026-17402 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17403 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9
CVE-2026-17404 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17405 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.8
CVE-2026-17406 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17407 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.5
CVE-2026-17408 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-17410 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17411 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.6
CVE-2026-17428 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5
CVE-2026-18689 Multiple Vulnerabilities in IBM API Connect 07.11.2026 4.3
CVE-2026-18836 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-18838 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-19121 Multiple Vulnerabilities in IBM API Connect 07.11.2026 8.3
CVE-2026-19122 Multiple Vulnerabilities in IBM API Connect 07.11.2026 3.8
CVE-2026-19126 Multiple Vulnerabilities in IBM API Connect 07.11.2026 5.9
CVE-2026-19128 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.5
CVE-2026-19129 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.8
CVE-2026-19131 Multiple Vulnerabilities in IBM API Connect 07.11.2026 6.5
CVE-2026-75590 Multiple Vulnerabilities in IBM API Connect 07.11.2026 7.2
CVE-2026-110534 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name 07.11.2026 6.4
CVE-2026-110705 Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action 07.11.2026 5.3
CVE-2026-119167 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass 07.11.2026 7.2
CVE-2026-120043 Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter 07.11.2026 7.5
CVE-2026-120477 Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter 07.11.2026 4.7
CVE-2026-93779 Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints 07.11.2026 6.5
CVE-2026-93902 Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields 07.11.2026 6.4
CVE-2026-9601 Stackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter 07.11.2026 6.4
CVE-2026-123218 IBM Aspera Faspex Authorization Bypass 07.11.2026 9.8
CVE-2026-119158 Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar 07.11.2026 7.2
CVE-2026-120560 Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters 07.11.2026 6.5
CVE-2026-120677 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content 07.11.2026 7.2
CVE-2026-120739 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor 07.11.2026 7.2
CVE-2026-121516 QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie 07.11.2026 6.1
CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter 07.11.2026 9.8
CVE-2026-17362 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-104913 Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json 07.11.2026 8.8
CVE-2026-115816 Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review 07.11.2026 6.4
CVE-2026-116562 Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter 07.11.2026 6.4
CVE-2026-118046 JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title 07.11.2026 6.4
CVE-2026-118054 LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter 07.11.2026 6.4
CVE-2026-118067 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter 07.11.2026 5.4
CVE-2026-119070 Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer 07.11.2026 7.2
CVE-2026-119098 LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer 07.11.2026 6.4
CVE-2026-119152 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field 07.11.2026 5.4
CVE-2026-119165 WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name 07.11.2026 6.4
CVE-2026-119175 Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content 07.11.2026 7.2
CVE-2026-119213 Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed 07.11.2026 3.7
CVE-2026-119218 Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix 07.11.2026 5.4
CVE-2026-119219 Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta 07.11.2026 5.4
CVE-2026-119616 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name 07.11.2026 5.9
CVE-2026-120082 GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content 07.11.2026 7.2
CVE-2026-120512 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value 07.11.2026 7.2
CVE-2026-120520 Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter 07.11.2026 5.3
CVE-2026-120540 iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker 07.11.2026 7.2
CVE-2026-120555 Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter 07.11.2026 5.3
CVE-2026-120737 Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter 07.11.2026 5.9
CVE-2026-120741 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint 07.11.2026 5.4
CVE-2026-121515 FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content 07.11.2026 5.4
CVE-2026-121519 Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter 07.11.2026 6.4
CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 07.11.2026 9.8
CVE-2026-71881 Cross-site scripting in Integrated Publishing Toolkit 06.11.2026
CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability 06.11.2026 10
CVE-2026-118786 NXP MCUXpresso SDK rpmsg-lite TZM Example before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions 06.11.2026 6.8
CVE-2026-118785 NXP MCUXpresso SDK TrustZone-M Examples before 26.06.01-lts Secure Memory Disclosure via NSC Veneer Functions 06.11.2026 6.7
CVE-2026-119519 WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability 06.11.2026 4.3
CVE-2026-120845 WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability 06.11.2026 6.5
CVE-2026-120851 WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability 06.11.2026 4.3
CVE-2026-122670 WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability 06.11.2026 5.4
CVE-2026-123471 WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability 06.11.2026 4.3
CVE-2026-27356 WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability 07.11.2026 5.3
CVE-2026-107931 06.11.2026
CVE-2026-50240 Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount 06.11.2026
CVE-2026-123791 OpenBMB Internet of Agents Agent Registry milvus_utils.py _primary_field_query data query logic injection 06.11.2026
CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials 06.11.2026
CVE-2026-103022 Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) 06.11.2026 5.3
CVE-2026-119800 Ryot: Cross-tenant collection read via `collectionContents` 06.11.2026 4.3
CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive 06.11.2026 5.4
CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files 06.11.2026 5.9
CVE-2026-104267 Botan: scrypt V-buffer heap overflow on 32-bit from constructor-accepted parameters 06.11.2026
CVE-2026-47738 liboqs: Uninitialized function-pointer dereference in OQS_KEM_encaps_derand for NTRU KEMs 06.11.2026 5.3
CVE-2026-48057 Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn 06.11.2026
CVE-2026-77442 Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR) 06.11.2026 5.9
CVE-2026-104254 liboqs: Heap out-of-bounds read in LMS/HSS signature verification via unvalidated signature length (hss_verify_inc.c:215) 06.11.2026 5.3
CVE-2026-44519 liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others) 06.11.2026 5.1
CVE-2026-69128 Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap) 06.11.2026
CVE-2026-123788 chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow 06.11.2026
CVE-2026-68933 Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage 06.11.2026 7.5
CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections 06.11.2026 9.1
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution 06.11.2026 9.8
CVE-2026-54589 Chartbrew: SSRF guard bypass via IPv6 NAT64/DNS64 addresses in API Data Connection outbound policy (validateOutboundUrl) 06.11.2026
CVE-2026-71397 Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server 06.11.2026
CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET 06.11.2026 9.8
CVE-2026-85708 Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens 06.11.2026 7.5
CVE-2026-85712 Chartbrew: Cross-tenant project takeover via body.team_id in /project routes 06.11.2026 8.8
CVE-2026-85726 Chartbrew: Blind NoSQL injection via date variable in embedded chart 06.11.2026 7.5
CVE-2026-85736 Chartbrew: Arbitrary file deletion as root via data connection SSL/SSH paths 06.11.2026 8.1
CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew 06.11.2026
CVE-2026-102610 fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution 06.11.2026 6.4
CVE-2026-123787 nexmoe VidBee Local HTTP Service local-api.ts information disclosure 06.11.2026
CVE-2026-71863 SecureDrop: Onion Service client auth credentials copied to Monitor Server 06.11.2026 2.6
CVE-2026-102657 esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal 06.11.2026 7.5
CVE-2026-124078 plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser 06.11.2026
CVE-2026-102344 Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server 06.11.2026 8.1
CVE-2025-55002 JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses 06.11.2026 5.5
CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL 06.11.2026
CVE-2026-86044 JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution 06.11.2026 9.6
CVE-2025-54991 JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS) 06.11.2026 5.5
CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value 06.11.2026 9.8
CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 06.11.2026 9.8
CVE-2026-63440 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU) 06.11.2026 5.9
CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets 06.11.2026
CVE-2026-85737 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin 06.11.2026 6.5
CVE-2026-59171 JSON-java: JSONTokener Unbounded Numeric String Resource-Exhaustion DoS 06.11.2026 5.9
CVE-2026-63437 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration 06.11.2026 6.5
CVE-2026-55449 CloudBeaver: Path Traversal in Resource Manager getProjectPath allows directory enumeration outside shared-projects sandbox 06.11.2026
CVE-2026-58490 Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults 06.11.2026 9.8
CVE-2026-63663 CloudBeaver: Path Traversal in updateResultsDataBatch Allows Unauthorized Server File Stream Access 06.11.2026 6.5
CVE-2026-63664 CloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass 06.11.2026 6.5
CVE-2026-65960 Tetragon: Unauthenticated Tetragon gRPC admin API accessible from hostNetwork pods 06.11.2026 8.8
CVE-2026-73860 CRIU: Parasite hijack triggered by snapshot of malicious software 06.11.2026
CVE-2026-123974 pytorch/serve: Local privilege escalation through insecure temporary path 06.11.2026 7.8
CVE-2026-55649 GeoNode has Stored XSS in Documents metadata abstract field 06.11.2026 6.3
CVE-2026-33050 GeoNode: OS command injection via uploaded file layer name 06.11.2026 8.8
CVE-2026-46429 GeoNode: Unrestricted File Upload 06.11.2026 5.5
CVE-2026-119217 06.11.2026
CVE-2026-109683 UPnP Newline Injection Vulnerability in TP-Link Archer BE805 06.11.2026
CVE-2026-120484 06.11.2026
CVE-2026-124025 Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print 06.11.2026
CVE-2026-124026 Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy 06.11.2026
CVE-2026-124027 ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage 06.11.2026
CVE-2026-124028 mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers 06.11.2026
CVE-2026-124029 Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names 06.11.2026
CVE-2026-124030 GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace 06.11.2026
CVE-2026-124031 GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4 06.11.2026
CVE-2026-124039 Gitleaks through 8.30.1 World-Readable Report Files via --report-path 06.11.2026
CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State 06.11.2026
CVE-2026-19703 06.11.2026
CVE-2026-19868 07.11.2026
CVE-2026-77708 06.11.2026
CVE-2026-77709 06.11.2026
CVE-2026-123995 Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI 06.11.2026
CVE-2026-123996 Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication 06.11.2026
CVE-2026-123997 Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI 06.11.2026
CVE-2026-123998 Hisense VIDAA Smart TV MQTT Broker Authentication Bypass 06.11.2026
CVE-2026-107154 06.11.2026
CVE-2026-123993 Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access 06.11.2026
CVE-2026-123994 Hisense VIDAA Smart TV DIAL Service Unauthenticated Access 06.11.2026
CVE-2026-82308 06.11.2026
CVE-2026-107155 07.11.2026
CVE-2026-56717 06.11.2026
CVE-2026-10146 06.11.2026
CVE-2026-10147 06.11.2026
CVE-2026-119924 Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser 06.11.2026 8.1
CVE-2026-47400 06.11.2026
CVE-2026-47401 06.11.2026
CVE-2026-47402 06.11.2026
CVE-2026-47403 06.11.2026
CVE-2026-47404 06.11.2026
CVE-2026-49122 06.11.2026
CVE-2026-49123 06.11.2026
CVE-2026-49124 06.11.2026
CVE-2026-49125 06.11.2026
CVE-2026-49126 06.11.2026
CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser 06.11.2026 9.8
CVE-2026-122113 CVE-2026-122113 06.11.2026
CVE-2026-123356 GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS) 06.11.2026 7.5
CVE-2026-123357 GROBID is vulnerable to OS command injection through crafted PDF filenames 06.11.2026 0
CVE-2026-90975 CVE-2026-90975 06.11.2026
CVE-2026-108262 DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 06.11.2026 6.5
CVE-2026-100080 xen-netback: Fix UAF when reading statistics data 06.11.2026
CVE-2026-100081 xen-netback: defer xenvif_mcast_addr_list_free() 06.11.2026
CVE-2026-100082 xen-blkback: Avoid UAF when reading I/O statistics 06.11.2026
CVE-2026-84473 CVE-2026-84473 06.11.2026
CVE-2024-36240 06.11.2026
CVE-2025-46896 06.11.2026
CVE-2025-64798 06.11.2026
CVE-2026-62345 Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML) 06.11.2026 7.6
CVE-2026-62346 Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML 06.11.2026 7.6
CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access 06.11.2026 10
CVE-2026-123976 EDFbrowser before 2.16 Out-of-Bounds Write via check_edf_file() Annotation Signals 06.11.2026
CVE-2026-62344 Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints 06.11.2026 7.5
CVE-2026-123973 06.11.2026 5
CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization 06.11.2026 6.3
CVE-2026-89017 Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass 06.11.2026
CVE-2026-102356 Kroki Mermaid companion SSRF via flowchart image URLs 06.11.2026 5
CVE-2026-102650 Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API 06.11.2026 7.5
CVE-2026-119758 ERPNext OCR 1.1.1 Path Traversal and SSRF via read_document 06.11.2026
CVE-2026-123876 Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation 06.11.2026
CVE-2026-102359 Kroki: TikZ Secure Mode Local File Read via LaTeX File I/O Primitives 06.11.2026 7.5
CVE-2026-118670 OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document 06.11.2026 8.8
CVE-2026-123824 Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true 06.11.2026