778 of 778 advisories
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration, rated critical at CVSS 9.1.
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to reflected cross-site scripting, where a victim must open a specifically crafted URL while authenticated to QRadar to trigger it, rated high at CVSS 8.1.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability, rated critical at CVSS 9.9.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command, rated high at CVSS 8.8.
IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control, rated critical at CVSS 9.3.
IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data, rated high at CVSS 8.4.
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix, rated high at CVSS 8.4.
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication, rated high at CVSS 8.8.
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication, rated high at CVSS 8.1.
OpenAM before 16.1.4 lets unauthenticated attackers exhaust server resources by sending serialized Java data without size or structure limits to remote SDK endpoints, classic login pages, or the administration console, rated high at CVSS 8.7 under version 4.0; fixed in 16.1.4.
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, letting anonymous attackers set restricted attributes including group membership and join administrative groups, rated critical at CVSS 9.8; fixed in 16.1.4.
OpenAM before 16.1.4 accepts unsigned SAML assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false, letting unauthenticated attackers forge assertions and obtain sessions as any mapped user including administrators, rated critical at CVSS 9.8; fixed in 16.1.4.
OpenAM 14.0.0 before 16.1.4 lets unauthenticated attackers read live session tokens from the notification WebSocket by bypassing the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, rated critical at CVSS 10.0; fixed in 16.1.4.
devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled even if the caller catches the returned promise, letting an attacker able to influence the timing or failure of serialized asynchronous values terminate the Node.js process, rated high at CVSS 8.7 under version 4.0; fixed in 5.9.3.
The DNS wire-format message parser in hickory-proto 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data, letting remote attackers send a UDP datagram or spoofed response with counts set to 65535 to force about 18MB of allocation per message, rated high at CVSS 8.7 under version 4.0; fixed in 0.26.2.
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone, letting attackers forge DNSSEC nonexistence proofs, rated high at CVSS 8.7 under version 4.0; fixed in 0.26.2.
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap, letting an attacker deliver one response built from genuinely signed parent NSEC3 records to cache NXDOMAIN or NODATA with AD=1, rated high at CVSS 8.8; fixed in 0.26.2.
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset, letting attackers controlling any secure zone produce valid signatures over arbitrary records in unrelated zones, rated high at CVSS 8.8; fixed in 0.26.2.
imgproxy 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that lets remote attackers trigger a heap buffer overflow via a crafted data_size value, rated critical at CVSS 9.8; fixed in 4.0.16.
imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction when an ICO entry declares a tiny data size, letting unauthenticated remote attackers corrupt adjacent heap chunk metadata and crash the worker, rated high at CVSS 8.7 under version 4.0; fixed in 4.0.17.
imgproxy 3.3.0 before 4.0.16 contains an unbounded memory allocation flaw in the ICO loader that fails to validate the data_size field, letting attackers supply a crafted 23-byte ICO file declaring a roughly 4GB data size to trigger memory exhaustion and worker crashes, rated high at CVSS 8.7 under version 4.0; fixed in 4.0.16.
Craft CMS 5.0.0 before 5.11.2 contains an authorization bypass that lets anonymous GraphQL clients read out-of-scope section entries through prev/next fields, chaining from one visible entry to enumerate titles, slugs, and custom-field content from withheld sections, rated critical at CVSS 9.8; fixed in 5.11.2.
Craft CMS 5.0.0 before 5.11.2 contains a privilege escalation flaw that lets unauthenticated public registrants reclaim deactivated non-admin accounts while retaining their direct permissions, enabling privileged account takeover when email verification is disabled, rated high at CVSS 8.7 under version 4.0; fixed in 5.11.2.
Craft CMS 5.10.0 before 5.11.2 contains a remote code execution flaw that lets non-administrator control panel users obtain HMAC-signed Twig renderObjectTemplate evaluation and execute OS commands as the PHP worker, rated high at CVSS 8.8; fixed in 5.11.2.
Scriban before 7.5.3 contains a resource exhaustion flaw that lets untrusted template authors exhaust memory and CPU because builtins like math.format and recursion guards can be bypassed, rated high at CVSS 8.7 under version 4.0; fixed in 7.5.3.
Scriban before 7.5.2 contains an information disclosure and object manipulation flaw that lets template authors access .NET internals of function values through reflection member accessors, using array.map to read Target, Method, or ReturnType on imported delegates and overwrite service properties and captured closure secrets, rated critical at CVSS 9.1 under version 4.0; fixed in 7.5.2.
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit, letting template authors trigger an uncatchable StackOverflowException that terminates the host process, rated high at CVSS 8.7 under version 4.0; fixed in 7.5.3.
Kyverno 1.19.1 contains an authorization bypass in the apiCall namespace clamp that lets namespace tenants issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath, running as the admission-controller ServiceAccount to read other namespaces and create mutating webhooks, escalating to cluster admin, rated critical at CVSS 9.9; fixed in 1.19.2.
Kyverno before 1.19.2 contains an authorization bypass that lets namespaced tenants generate any resource kind in any namespace by templating a generate rule's kind and namespace with variables, causing the privileged background controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces, rated high at CVSS 8.8; fixed in 1.19.2.
OpenEMR 7.0.1 before 8.4.0 ignores the enforce_onetime_use and max_access_count flags in OneTimeAuth, never revokes consumed service_auth tokens, and checks login PINs without rate limiting or strict comparison, letting attackers replay a captured token or brute-force the PIN to open patient portal sessions exposing PHI, rated critical at CVSS 9.8; fixed in 8.4.0.
OpenEMR before 8.3.0 contains path traversal in the FaxSMS module RCFaxClient and SignalWireClient disposeDocument functions, letting authenticated low-privilege users read and overwrite arbitrary files via the unsanitized file_path parameter, retrieving cleartext files like sqlconf.php database credentials and keys or overwriting web-server-writable files with ciphertext, rated high at CVSS 8.8; fixed in 8.3.0.
OpenEMR before 8.3.0 contains an insecure direct object reference in OnsitePortalActivityController Update, which checks the request's patientId instead of the stored record's owner, letting authenticated portal patients send PUT requests with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains stored cross-site scripting in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into preview HTML, letting authenticated users upload a crafted CCDA/CCD document that executes script in a clinician's session when previewed, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains broken access control and path traversal in the fax/sms module disposeDocument action via an unvalidated file_path parameter, letting authenticated low-privilege users read sqlconf.php to recover database credentials and write arbitrary files as the web user, enabling remote code execution, rated critical at CVSS 9.9; fixed in 8.3.0.
OpenEMR before 8.3.0 contains an insecure direct object reference in many encounter-form view and save endpoints that lack patient and encounter ownership checks, letting authenticated clinical users enumerate sequential form id values to read and overwrite other patients' clinical records, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains a missing authorization flaw in library/ajax/upload.php that lets any authenticated user read and overwrite document data by supplying an arbitrary doc_id, enumerating doc_id values with fetch and save actions to disclose patient health information and tamper with medical records across all patients, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains stored cross-site scripting that lets authenticated users with CAMOS access inject HTML by saving malicious CAMOS content through ajax_save.php, storing a script payload that executes unencoded when the entry is printed via the non-print_html branch of rx_print.php, performing actions and reading data as the victim user, rated critical at CVSS 9.3 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.4.0 contains local file inclusion in the ESign router, which passes the unsanitized module parameter into a require_once, and the fax module writes attacker-named files to a predictable temp path without extension checks, letting authenticated attackers upload a PHP file named Controller.php and include it to execute arbitrary code, rated high at CVSS 8.8; fixed in 8.4.0.
OpenEMR before 8.3.0 contains SQL injection in the Fee Sheet drug-inventory lookup where DrugSalesService sellDrug interpolates the prod warehouse POST field into an ORDER BY clause, letting low-privileged authenticated users run a time-based blind oracle to extract patient data and bcrypt password hashes, rated critical at CVSS 9.9; fixed in 8.3.0.
OpenEMR before 8.3.0 contains a missing authorization flaw in interface/billing/sl_eob_invoice.php that lets any authenticated user read and modify billing data for any encounter, iterating the id parameter to read patient names and billing notes and post payments, adjustments, deletions, or billing notes against any patient's account, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains a missing authorization flaw in interface/billing/sl_eob_patient_note.php that lets any authenticated user read and modify patient billing notes, enumerating the patient_id parameter and submitting POST requests using the embedded CSRF token to view or tamper with confidential billing data, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains a missing authorization flaw that lets low-privileged authenticated users delete arbitrary patient recall records via the delete_Recall action, sending POST requests to interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks, rated high at CVSS 8.8; fixed in 8.3.0.
OpenEMR before 8.4.0 contains an authorization bypass that lets low-privileged authenticated users read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header, reusing the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI, rated high at CVSS 8.8; fixed in 8.4.0.
OpenEMR before 8.4.0 contains an incorrect authorization flaw because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check, letting authenticated staff users reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide, rated high at CVSS 8.7 under version 4.0; fixed in 8.4.0.
OpenEMR before 8.4.0 contains a missing authorization flaw in portal onsite-document APIs that lets any authenticated core user access cross-patient documents, omitting the patientId parameter and supplying arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data, rated high at CVSS 8.8; fixed in 8.4.0.
OpenEMR before 8.3.0 contains a missing authorization flaw in the classic document controller that lets low-privilege authenticated users recategorize other patients' documents, invoking move_action_process to move a document into a patients demo category, then retrieving it with an empty patient_id to exfiltrate PHI and tamper with charts, rated high at CVSS 8.8; fixed in 8.3.0.
OpenEMR before 8.3.0 contains an authorization bypass that lets authenticated clinicians lacking high-sensitivity permission read and modify encounter-bound forms via load_form.php, requesting the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submitting save.php to tamper with clinical records, rated high at CVSS 8.6 under version 4.0; fixed in 8.3.0.
OpenEMR before 8.3.0 contains path traversal in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms, letting authenticated attackers read and write arbitrary files via the file_path parameter, using action download to read credentials and source code or action setup with base64 content to write web-executable files for code execution, rated critical at CVSS 9.1; fixed in 8.3.0.
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host, rated critical at CVSS 9.8.
IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal, rated critical at CVSS 9.1.
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization, rated high at CVSS 8.1.
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization, letting remote attackers execute arbitrary commands on the underlying operating system with the privileges of the affected service, rated critical at CVSS 9.8.
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation, where an attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console, rated high at CVSS 8.8.
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system due to the improper control of user input code, rated high at CVSS 8.8.
IBM Langflow OSS 1.0.0 through 1.12.2 lets an authenticated flow author write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard, and via a crafted on-disk index also read arbitrary files accessible to the service process, including configuration files, secrets, or database files stored under the application's data directory, rated high at CVSS 8.1.
Microsoft Entra Device Registration lets an unauthorized attacker elevate privileges over the network through an authorization bypass using a user-controlled key, rated critical at CVSS 10.0 with changed scope and no privileges or user interaction required.
LatePoint for WordPress up to and including 5.7.6 lets an unauthenticated attacker reset any customer password by passing the literal value IS NOT NULL as the password reset token, rated critical at CVSS 9.1; fixed in 5.7.7.
An authenticated attacker with client management permissions can bypass script-policy upload restrictions during client creation or import and upload a malicious JavaScript policy that executes on the Keycloak server, rated critical at CVSS 9.1.
IBM Aspera Faspex 5.0.0 through 5.0.19 lets an authorized user craft a specific message that bypasses user authorization and gains full administrative privileges, rated critical at CVSS 9.8; IBM fixed it in 5.0.19 PL1.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 does not sufficiently enforce authentication against a connected directory service, letting a remote attacker obtain valid access tokens for other users and assume their identity, rated critical at CVSS 9.8.
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker obtain sensitive information through an XML external entity injection, rated critical at CVSS 9.9.
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker bypass security restrictions through a confused deputy vulnerability, rated critical at CVSS 9.9.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker execute arbitrary code by setting object fields that should only be controlled by the system, rated critical at CVSS 9.9.
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker execute arbitrary SQL commands because special elements in an SQL command are not properly neutralized, rated critical at CVSS 9.9.
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker gain unauthorized access to sensitive API catalog and runtime configuration data because client-supplied information is not sufficiently verified, rated critical at CVSS 9.8.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets a remote attacker perform account takeover through an open redirect, because the redirect address used during sign-in is not validated and authentication results can be sent to an attacker-controlled location, rated critical at CVSS 9.6.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets a remote authenticated attacker perform arbitrary file reads and server-side request forgery because externally referenced content in submitted definitions is resolved without restriction, rated critical at CVSS 9.6.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 lets an unauthenticated attacker bypass authentication because a cryptographic signature is not properly verified, rated critical at CVSS 9.8.
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker obtain sensitive information and take control of gateway configuration through an authentication bypass via an alternate path, rated critical at CVSS 9.8.
IBM API Connect 12.1.0.0 through 12.1.1.2 lets a remote attacker execute arbitrary code through a path traversal vulnerability, rated critical at CVSS 9.8.
IBM API Connect 12.1.0.0 through 12.1.1.2 uses hard-coded credentials that let a remote attacker gain full administrative control, rated critical at CVSS 9.8.
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 lets an unauthenticated attacker inject SQL through the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements, giving database read and write access and a path to administrator.
Craft CMS 5.8.17 before 5.11.2 lets an authenticated control panel user invoke attacker-selected static PHP callables through getOwners() because the criteria are applied to the element query without cleansing, promoting every account to administrator.
Agenta before 0.122.5 lets a workspace member with workflow edit rights redirect workflow invocations to an arbitrary revision URL, following redirects while forwarding a minted secret-resolve Authorization token, reaching internal and cloud metadata endpoints and leaking the token.
CivetWeb through 1.16, built with HTTP/2 enabled, retains freed :method and :path pointers in handle_http2(), so an unauthenticated remote attacker can send a later HEADERS frame omitting those pseudo-headers to influence the method or path access rules see, or crash the server.
The npm package plist before 5.0.1 lets unauthenticated attackers crash a Node.js process with a small crafted binary plist, because parseBinary resolves shared object references recursively without memoization, causing exponential resolution calls and out-of-memory growth.
Skyline DataMiner BrokerGateway contains an embedded API key that unauthenticated attackers can retrieve even while pairing mode is disabled, then use to obtain the unrestricted DataMinerUser.creds NATS credential and gain trusted message-bus access via TCP port 4222.
A stale login flag in Keycloak's Organization identity-first login flow lets an attacker in two organizations switch paths and be treated as a victim user.
GiveWP up to and including 4.19.1 lets authenticated GiveWP Managers assign privileged WordPress roles to every new donor account, up to and including Administrator through the settings import path. Wordfence rates it CVSS 3.1 8.8.
Dulwich before 1.2.20 resolves a duplicate tree header in a commit object to the last occurrence instead of the first, diverging from core git. Poetry 2.5.1 ships this version and uses dulwich by default, so a crafted commit can make reviewers see a benign tree while Poetry installs a malicious one. Dulwich rates it CVSS 3.1 8.8.
Kyverno before 1.19.2 checks generate-rule admission against the controller's permissions instead of the author's, so a namespace admin can make the background controller create or clone resources in other namespaces or at cluster scope. Kyverno rates it CVSS 3.1 9.8.
Kyverno 1.17.0 before 1.19.2 lets namespace tenants overwrite resources in other namespaces through NamespacedMutatingPolicy mutate-existing rules, because a CEL expression can fabricate a target in another namespace. Kyverno rates it CVSS 3.1 9.9.
Kyverno 1.17.0 before 1.19.2 builds its cleanup controller context loader with a nil policy, so a namespaced CleanupPolicy with apiCall or globalReference context entries can read Secrets in other namespaces and modify validatingwebhookconfigurations. Kyverno rates it CVSS 3.1 9.9.
Kyverno before 1.19.2 lets low-privileged users hang the admission webhook with self-referential variable templates in substituteVariablesIfAny, causing unbounded substitution loops that exhaust CPU and memory and block cluster-wide admission. Kyverno rates it CVSS 4.0 8.3.
Kyverno before 1.19.2 lets namespaced policy authors exhaust admission controller CPU with pathological wildcard patterns evaluated by ValidateMatchExcludeConflict, pinning cores and causing cluster-wide webhook timeouts. Kyverno rates it CVSS 4.0 8.3.
Kyverno before 1.19.2 has a policy bypass in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the enablePolicyException, exceptionNamespace, and policy kind gates. Kyverno rates it CVSS 4.0 8.3.
Kyverno before 1.19.2 has an authorization bypass in the Generation Handler: users with create or update permissions can trigger synchronized generate policies by spoofing internal generate.kyverno.io labels and clone sensitive Secrets from restricted namespaces. Kyverno rates it CVSS 3.1 8.5.
Kyverno 1.19.1 before 1.19.2 validates a Policy context.apiCall urlPath after cleaning it but executes the raw path, so a namespace user can hide traversal segments behind # or ? and reach cluster-scoped endpoints with Kyverno's ServiceAccount. Kyverno rates it CVSS 3.1 9.9.
Kyverno 1.16.0 before 1.19.2 does not validate path segments in the resource argument of resource.get() and resource.post(), so namespaced CEL policies can insert .. segments and read or write arbitrary cluster objects with the admission controller's ServiceAccount. Kyverno rates it CVSS 3.1 9.9.
Kyverno 1.19.1 before 1.19.2 has a namespace isolation bypass in APICall Fetch(): path.Clean treats ? as a path character, so a URLPath like /api/v1/nodes?x=/namespaces/default/ passes validation while client-go requests the cluster-scoped endpoint. Kyverno rates it CVSS 4.0 8.3.
Kyverno 1.17.0 before 1.19.2 lets namespace-scoped tenants modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression output that lacks namespace checks. Kyverno rates it CVSS 3.1 9.9.
Kyverno before 1.19.2 has an unchecked type assertion in its variable-substitution engine: resources with non-string fields referenced by shallow {{- variable }} substitution cause a panic, yielding webhook denial of service and policy bypass under failurePolicy Ignore. Kyverno rates it CVSS 4.0 8.7.
Kyverno before 1.19.2 has an unchecked type assertion in buildStatementMap: an OCI referrer manifest with a non-string type field can bypass image verification under failurePolicy Ignore or crash-loop the reports-controller. Kyverno rates it CVSS 4.0 8.7.
Kyverno 1.17.0 before 1.19.2 has a missing authorization check in the mutate-existing background processor: namespaced tenants can modify resources outside their namespace through NamespacedMutatingPolicy CEL expressions. Kyverno rates it CVSS 3.1 8.5.
Kyverno before 1.19.2 has a denial-of-service flaw in the In and NotIn operators: an unchecked type assertion lets attackers crash the policy engine with resources whose JMESPath-evaluated values yield arrays of integers, booleans, or mixed types. Kyverno rates it CVSS 4.0 8.7.
Kyverno before 1.19.2 has a missing authorization flaw: namespaced Policy authors can read resources in other namespaces by templating generate.clone or cloneList namespace values, so the background controller copies a victim namespace's sensitive ConfigMap into the attacker's namespace. Kyverno rates it CVSS 4.0 8.3.
Kyverno 1.18.0 before 1.19.2 keys cached verifyImages results by image reference string rather than the verified digest, so an attacker who can move a registry tag can have an unverified image admitted and pinned. Kyverno rates it CVSS 3.1 9.1.
Kyverno 1.11.0 before 1.19.2 has an unbounded decompression flaw in extractStatement: highly compressed attestation layers can decompress beyond maxPayloadSize, exhausting memory and causing admission controller OOM kills. Kyverno rates it CVSS 4.0 8.7.
Kyverno 1.11.0 before 1.19.2 has an unbounded decompression flaw in FetchSignatureBlob: highly compressed notary signature layers can decompress beyond maxPayloadSize, exhausting memory and causing admission controller OOM kills. Kyverno rates it CVSS 4.0 8.7.
Keycloak's Dynamic Client Registration does not validate protocol mapper claim names, letting an attacker forge identity fields and mint signed tokens as another user.
LiteSpeed Cache up to and including 7.9.1 stores WooCommerce Store API cart and checkout responses as public cache objects without varying on the Cart-Token or session, so an unauthenticated attacker can read another shopper's billing details and live session token. Wordfence rates it CVSS 3.1 8.2.
When the Keycloak Admin CLI is given a custom truststore, it accepts any self-signed certificate with a matching hostname, letting a network attacker impersonate the server and steal admin credentials.
Keycloak links a federated identity to a local account by email without checking whether the identity provider verified that email, letting an attacker take over the victim's account.
IBM MQ 9.2, 9.3, 9.4, and 10.0 releases could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code via an integer overflow when processing subscription requests with crafted buffer size values. IBM rates it high at CVSS 8.8.
IBM MQ Managed File Transfer could allow an authenticated attacker to execute arbitrary code on an agent host due to improper validation of metadata used during script execution. IBM rates it high at CVSS 8.5.
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path flaw: opening a crafted repository can make the tool run a malicious git.exe placed in the repository root at session start, before any trust prompt. Rated high at CVSS 3.1 8.8.
Mistral Vibe before 2.25.7 contains a remote code execution flaw: a crafted repository can configure malicious Git clean or process filter drivers that run when the tool checks Git status at startup, before any trust prompt. Rated high at CVSS 3.1 8.8.
Mistral Vibe before 3.0.3 contains a remote code execution flaw: a crafted repository can set gpg.program and signature display options so that Git log executes the attacker's program during project context collection, before any trust prompt. Rated high at CVSS 3.1 8.8.
The WPO365 Login plugin before 45.2 fails to persist processed SAML message IDs, so an attacker who captures a validly signed SAML response can replay it to log in as the victim, including administrators. Rated critical at CVSS 4.0 9.1.
IBM MQ Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing. IBM rates it high at CVSS 8.1.
IBM MQ could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata. IBM rates it high at CVSS 8.8.
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability. IBM rates it critical at CVSS 9.8.
ACF Extended PRO up to and including 0.9.2.6 lets unauthenticated attackers call arbitrary WordPress functions with controlled arguments through insufficiently validated form configuration in render_field.
Easy Digital Downloads up to and including 3.7.2 trusts a guest checkout email as proof of identity, so an unauthenticated attacker who completes a PayPal purchase with an administrator email receives an authenticated session as that administrator.
SureCart up to and including 4.9.5 lets unauthenticated attackers brute-force the 6-digit passwordless login code for any user, including administrators, because the verification path has no per-account attempt counter, lockout, or rate limit.
FreeRDP before 3.32.2 aborts or exits the client process when a malicious RDP server or man-in-the-middle offers a malformed PNG or truncated JPEG clipboard payload, because the WinPR image readers call libpng and libjpeg without the error-handling context those libraries require.
SurrealDB 3.1.0 through before 3.3.0 lets any authenticated user of a JWT or Bearer access method hijack another users MCP session by presenting their own valid low-privilege token together with the victims session id, because the session fingerprint uses the access method name instead of a per-user identity.
Argo CD Image Updater passes a proxy URL configured on an SSH Git repository unsanitized into a shell-interpreted SSH command, so a user able to set a malicious proxy value can inject shell metacharacters to execute arbitrary commands and access credentials in the Image Updater process.
An authenticated LobeHub Chat user can supply a traversal filename that escapes the temp directory during document parsing, overwriting application files such as startServer.js for remote code execution. LobeChat server-database deployments from 1.84.26 before 2.1.49 are affected.
python-jose through 3.5.0 accepts zero-length HMAC secrets, so an application whose HS256, HS384, or HS512 verification key resolves to empty lets unauthenticated attackers forge JWTs.
ReadyMedia 1.3.0 through 1.3.3 lets remote attackers corrupt stack memory with a crafted DFF audio file carrying an oversized PROP chunk, reaching code execution on unprotected builds.
Dell OpenManage Enterprise before 4.8.0 lets a low privileged attacker with adjacent network access inject command arguments and execute commands.
Konflux CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up, so a local attacker with CI environment access can read them and gain repository access.
An attacker with permission to trigger automated Konflux workflow runs can inject malicious filter commands through crafted issue titles, exposing API credentials, deployment keys, and internal notes in workflow logs.
An attacker with repository write access can inject shell commands into Konflux environment export scripts, which manifest synchronization scripts then evaluate, giving arbitrary code execution inside the CI/CD workflow environment.
The Konflux user interface proxy automatically disables TLS certificate verification for internal backend connections when no default service certificate authority exists, letting an adjacent attacker intercept a cluster-scoped impersonation token and gain full cluster control.
Predictable, web-accessible staging paths used during full-package WordPress core upgrades let unauthenticated attackers execute code on the server during the upgrade window.
Jpom 2.10.0 through 2.11.12 lets unauthenticated attackers gain super-administrator access by injecting a condition expression into the JPOM-USER-TOKEN header, then execute commands through the script features.
Gravity Forms for WordPress, in versions up to and including 3.1.2, lets an unauthenticated attacker inject a PHP object through a Post Custom Field, which can lead to remote code execution where a gadget chain is available. Rated critical at CVSS 3.1 9.8.
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 lets authenticated workflow authors run JavaScript in the main process via deprecated Function nodes.
CakePHP through 5.4.3 lets attackers inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression.
Traefik 3.7.0-ea.1 before 3.7.15 silently disables mTLS configured via the auth-tls-secret annotation, letting unauthenticated attackers reach backends that require client certificates.
LMDeploy 0.9.0 through 0.18.0 lets unauthenticated attackers run OS commands by sending pickled data to the /update_weights endpoint.
Flowise through 3.1.4 lets authenticated users execute OS commands by abusing allowlisted modules when ALLOW_BUILTIN_DEP is enabled.
Formidable Forms for WordPress, in versions up to and including 6.35, lets an authenticated attacker with subscriber-level access install arbitrary plugins, because a permission callback relies on a shared token instead of checking install and activate capabilities. Rated high at CVSS 3.1 8.8.
IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote authenticated attacker execute arbitrary code due to improper neutralization of special elements used in code. IBM rates it high at CVSS 8.8.
IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote attacker who can reach the message broker execute arbitrary code through deserialization of untrusted data. IBM rates it high at CVSS 8.1.
IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote authenticated attacker execute arbitrary code through deserialization of untrusted data. IBM rates it high at CVSS 8.8.
IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated attacker execute arbitrary code through improper neutralization of special elements used in an OS command. IBM rates it high at CVSS 8.8.
IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated attacker execute arbitrary code because of missing authorization. IBM rates it critical at CVSS 9.9.
IBM Langflow OSS lets a remote authenticated attacker execute arbitrary code through improper neutralization of code in eval and exec handling. IBM rates it critical at CVSS 9.9.
IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated attacker execute arbitrary code through improper control of code generation. IBM rates it critical at CVSS 9.9.
IBM Langflow OSS 1.0.0 through 1.12.8 lets a remote attacker execute arbitrary code through improper control of code generation, with no authentication required. IBM rates it critical at CVSS 9.8.
IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote attacker with a low-privileged authenticated account bypass the administrator-only restriction and execute arbitrary code by configuring a built-in code-execution component. IBM rates it high at CVSS 8.8.
IBM Langflow OSS lets a remote authenticated attacker execute arbitrary commands through improper control of code generation. IBM rates it high at CVSS 8.8.
Agno through 3.1.11 lets model-controlled input choose any pandas function in PandasTools, so a prompt-injected model can call read_pickle on attacker-controlled data and execute code on the agent host. It is rated critical at CVSS 4.0 9.2.
ZITADEL 4.0.0 through 4.19.4 lets an unauthenticated attacker poison password-reset, invite, and email-verification links via untrusted host headers and harvest the single-use codes. ZITADEL rates it high at CVSS 4.0 8.6.
ZITADEL 4.0.0 through 4.19.4 lets an unauthenticated attacker forge a verification proof cookie and set the first credential of a user who has none, taking over the account. ZITADEL rates it critical at CVSS 4.0 9.1.
Frappe Framework before 15.111.0 and 16.x before 16.21.0 lets an authenticated attacker holding a common operational role inject template expressions that the server evaluates in an unrestricted context. It is rated high at CVSS 8.8.
OpenEMR before 8.5.0 lets an authenticated user with Clinician-level privileges exploit SQL injection in the Syndromic Surveillance module to extract all user credentials and reset any password, taking over administrative accounts. It is rated high at CVSS 8.8.
IBM Langflow OSS 1.0.0 through 1.12.8 lets a remote attacker bypass security restrictions due to improper authentication, with no authentication required. IBM rates it critical at CVSS 9.8.
A link-following flaw in unauthenticated web handlers lets a low-privileged user overwrite arbitrary files as root on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
An attacker with write access to the model cache directory can get arbitrary code execution and privilege escalation on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
A low-privileged attacker can delete arbitrary files and run arbitrary commands through the AccessManager audit rule deletion path on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
A crafted salt minion ID lets a remote attacker run arbitrary commands as root on Juniper Session Smart Conductor. Juniper rates it critical at CVSS 9.8.
An authenticated REST user can read, overwrite, or delete arbitrary certificate and private-key files on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
An unauthenticated attacker on the local network can achieve remote code execution on Juniper Session Smart Router with a malicious DHCP reply. Juniper rates it 8.8.
Missing authentication on a root endpoint lets an unauthenticated network attacker gain administrative privileges on Juniper Session Smart Routers that have not yet been onboarded. Juniper rates it critical at CVSS 9.8.
An attacker with config-write privileges can run arbitrary commands as root through the YANG configuration on Juniper Session Smart Router and Conductor. Juniper rates it 8.8.
An authenticated user can read or overwrite restricted files on shares using the experimental vfs_ceph_rgw module by requesting a file with mismatched casing. Rated 8.1.
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, bypassing the fix for CVE-2026-54512 and allowing arbitrary class instantiation where polymorphic deserialization is exposed. CVSS 3.1 9.8.
An authenticated attacker can make the OpenShift AI gateway inject another tenant's API keys into requests, letting them spend the victim tenant's LLM quota. Red Hat rates it critical at CVSS 9.1.
Failed operations in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes store credential secrets in execution error data, letting execution viewers recover them. Rated 8.2.
The n8n Quick Base node sends the Where filter to the API as raw query text, so untrusted input can make Get Many return every record or Delete remove every record. Rated 8.7.
Failed SeaTable Trigger polls store raw request headers in execution data, letting execution viewers recover the SeaTable API token. Rated 8.2.
Some n8n webhook response paths omit the sandbox Content-Security-Policy, letting an authenticated member serve HTML that runs on the n8n origin in a victim's session. Rated 8.4 on CVSS 4.0.
A crafted workflow ID makes the Data Table project check match every project, letting an authenticated member read, modify, and delete rows in all projects. Rated 8.7 on CVSS 4.0.
A malicious MONAI bundle can run arbitrary Python when a victim loads or runs it, because bundle logging configuration is evaluated. Rated 8.8.
A Wasmtime guest with sandbox write access can move host directories into its sandbox by renaming a relative symlink, escaping the sandbox on macOS and FreeBSD hosts. Rated 8.8 on CVSS 4.0.
The Rank Math SEO plugin for WordPress, in versions up to and including 1.0.276, deserializes untrusted input in the updateMeta REST API endpoint, so a contributor-level attacker can inject a PHP object and, through the chain in the record, write a webshell to the uploads directory. CVSS 3.1 8.8.
An unauthenticated remote attacker can crash Cisco ASA and FTD devices by sending a crafted request to the SSL remote access VPN when secondary authentication is configured. Rated 8.6.
When EAP runs with secmgr, an unauthenticated attacker can make the openjdk-orb load arbitrary classes from a remote URL into the server JVM. Red Hat rates it 8.1.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain a reflected cross-site scripting flaw that can inject malicious scripts into a page a victim visits, potentially gaining elevated access or control over the victim's account or session, with scope changed. CVSS 3.1 9.3.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain a code injection flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an OS command injection flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that an attacker with high privileges can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.1.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that a low-privileged attacker can use to bypass security measures and gain unauthorized read and limited write access, with scope changed and no user interaction. CVSS 3.1 9.1.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an incorrect authorization flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that an unauthenticated attacker can use to execute arbitrary SQL commands and, per Adobe, arbitrary code in the context of the current user, with scope changed. CVSS 3.1 10.0.
Veeam Backup for Microsoft 365 8.0 through 8.5.0.1014 contains an SQL injection flaw that lets an authenticated organization-transfer peer inject SQL into the source server's configuration database, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account. CVSS 4.0 9.0.
Tanium Threat Response contains an unauthorized code execution vulnerability that a low-privileged network attacker can exploit, addressed by Tanium in advisory TAN-2026-064 with fixed builds for the 4.9, 4.12, and 4.17 branches. CVSS 3.1 8.8.
Google Brotli 1.0.3 through 1.2.0 contain a decoder buffer overflow that lets a remote unauthenticated attacker corrupt adjacent decoder state, disclose memory, cause denial of service, or potentially execute arbitrary code with a crafted Brotli-compressed stream. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026. CVSS 4.0 9.2.
TeamViewer clients (Full Client, Portable, and Remote Control App) before 15.83 contain an integer overflow in the remote-control screen processing component that may allow a malicious remote host to cause denial of service or potentially execute arbitrary code with the viewer's privileges when a user connects to it. CVSS 3.1 8.8.
GFI KerioConnect before 10.0.8 Patch 2 contains a stored cross-site scripting flaw in Webmail: a crafted SVG email attachment bypasses sanitization of event-handler attributes and runs in a victim's authenticated session when opened, enabling theft of credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild. CVSS 3.1 8.2.
The @fastify/express plugin 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option, can route an absolute-form request to a scoped handler while the Express layer no longer sees that path, so path-scoped authentication, authorization, or rate-limiting middleware is skipped. CVSS 3.1 9.1.
EPICS Base 7.0.10 and prior contain an integer overflow in network request processing that can allocate memory with an incorrect size, so subsequent handling of attacker-supplied data may corrupt memory, deny service, or potentially execute code remotely, with no privileges or interaction required. CVSS 3.1 9.8.
Atlantis 0.4.0 through before 0.47.1 passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined into a shell command, so an authenticated contributor whose pull request is eligible for a plan can execute arbitrary commands as the Atlantis service account, with its cloud and version-control credentials. CVSS 3.1 8.8.
CKEditor 5 from 45.0.0 until 47.7.4 and from 48.0.0 until 48.5.1 uses a vulnerable es-toolkit version whose prototype pollution behavior can be reached while processing incoming style attribute values, so crafted editor content can cause unauthorized JavaScript execution in the browser. CVSS 3.1 8.1.
MLflow 3.12.0 release candidates through before 3.17.0 accept request-selected third-party scorer modules without requiring an exact allowed module, letting a caller place a Python module under a writable allowed package and have the server import and construct it through the scorer invoke endpoint. Authentication-disabled deployments need no credentials. CVSS 3.1 9.8.
Mistral Vibe before 3.0.3 runs git filter drivers defined in an untrusted repository's own configuration when creating a worktree, before the trusted-folder check, so opening a crafted repository with --worktree executes attacker commands with the user's privileges. CVSS 3.1 8.8.
Octopus Server performed OIDC token issuer validation inconsistently, so a token issued by a suitably configured non-legitimate issuer could be accepted as a token belonging to a service account from a legitimate trusted issuer, where a service account has an OIDC identity configured. CVSS 4.0 8.7.
Mozilla Firefox before 159 contains a privilege escalation flaw in the DOM: Navigation component that CISA's scoring rates CVSS 3.1 8.8, fixed in Firefox 159 and Thunderbird 159. CVSS 3.1 8.8.
Supermicro BMC firmware does not correctly enforce integrity and encryption requirements for IPMI commands, so an attacker who can reach the BMC may craft packets that execute arbitrary commands on an active RMCP+ session. The vendor rates it critical at CVSS 3.1 9.8 and lists per-model fixed BMC firmware for 402 motherboard SKUs.
Adobe Commerce, Commerce B2B, Magento Open Source, and Commerce Events contain an unrestricted file upload flaw that can result in arbitrary code execution in the context of the current user when a victim interacts with a crafted URL or compromised page. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026. CVSS 3.1 9.3.
Adobe Connect Desktop App and Android Mobile App contain a code injection flaw that an unauthenticated attacker can use to execute arbitrary code in the context of the current user when a victim visits a maliciously crafted URL or interacts with a compromised page, with scope changed. CVSS 3.1 9.6.
A logic flaw in Supermicro BMC IPMI handling lets an attacker with a low-privilege account send specially crafted RAKP+ messages and escalate that account to administrator privileges on the BMC. The vendor rates it high at CVSS 3.1 8.8 and lists per-model fixed BMC firmware for 402 motherboard SKUs.
The Kirki plugin for WordPress, in versions up to and including 6.2.5, deserializes untrusted input through an AJAX branch with no capability check, so an authenticated subscriber-level attacker can inject a PHP object and, through the chain in the record, overwrite an administrator password and gain administrative access. CVSS 3.1 8.8.
Microsoft Edge (Chromium-based) before 154.0.4258.48 contains a double free that allows an unauthorized attacker to execute code over a network when a user interacts with malicious content. CVSS 3.1 8.8.
Microsoft Edge (Chromium-based) before 154.0.4258.48 contains a type confusion flaw that allows an unauthorized attacker to execute code over a network when a user interacts with malicious content. CVSS 3.1 8.8.
TeamViewer Full Client for Linux and macOS before 15.83 contains an out-of-bounds write in the screen-image decoder that lets a remote attacker execute arbitrary code by supplying crafted screen-image data during a remote-control session, or by persuading a user to open a crafted session recording. CVSS 3.1 8.8.
WatchGuard Fireware OS contains an XPath injection flaw in its SSH authentication process that allows a remote unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data with a specially crafted request. CVSS 4.0 8.7.
WatchGuard Fireware OS contains a stack-based buffer overflow in its SIP proxy that allows a remote unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. CVSS 4.0 9.2.
WatchGuard Fireware OS's FireCluster synchronization daemon contains a missing authentication flaw that allows a remote unauthenticated attacker to invoke privileged system-level administrative actions through the FireCluster management IP when clustering is enabled. CVSS 4.0 9.2.
WatchGuard Fireware OS contains an integer overflow in the WebSocket connection handling used by its Access Portal that allows a remote unauthenticated attacker to reach code execution. CVSS 4.0 9.2.
OpenHands Software Agent SDK before 1.52.0 binds the sandbox agent server to all network interfaces with authentication disabled by default, so anyone who can reach the published container port can execute shell commands as root in the sandbox. CVSS 3.1 9.8.
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2-compressed images, so a crafted image can overwrite stack memory during decoding and crash the process or corrupt memory. CVSS 3.1 8.1.
Parse Server contains an authentication bypass for apps whose custom auth adapter subclasses the exported AuthAdapter class: the subclass validation methods are never called and an inherited default accepts any authData, so attackers can sign up, link identities, or log in as existing users for that provider. CVSS 4.0 9.1.
vLLM from 0.9.2 before 0.24.0, when running with P2pNcclConnector, copies the X-Request-Id header into the request ID and extracts a decode address from it with no allow-list, so an API caller can force a prefill worker to connect to an attacker host and send it the NCCL unique_id and KV-cache tensors. CVSS 3.1 8.2.
rclone before 1.75.2 contains a path traversal vulnerability in serve webdav: an unauthenticated MKCOL request with a dot-dot path plants a node above the served root, after which PUT, MOVE, COPY, and MKCOL can create, overwrite, or delete files above the root, including files belonging to other tenants. CVSS 4.0 8.7.
Snipe-IT before 8.6.3 contains an authentication bypass in the Google SSO callback, which logs in the user whose username matches the Google account email without enforcing the activated flag, so deactivated users with email-shaped usernames and still-live Google identities regain sessions at their original permission level, including admin. CVSS 3.1 8.1.
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability: the nonce check in the SAML acs handler is non-atomic and the nonce column has no unique constraint, so concurrent requests carrying one captured assertion can each obtain an authenticated victim session that evades identity-provider-driven revocation. CVSS 3.1 8.8.
open62541 1.5.0 before 1.5.7 has an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions, so a malicious OPC UA server can make a client overflow the heap when it loads remote DataTypes, crashing it or enabling code execution. Fixed in 1.5.7. CVSS 3.1 8.1.
Grav 2.0.15 through 2.2.12 still lets page editors smuggle a data directive past the callable allowlist, using unset-name@ or an integer field key, to invoke arbitrary public static methods such as Folder::delete. The vendor says the 2.2.2 fix was incomplete and 2.2.13 fixes this route. CVSS 3.1 8.8.
Aider through 0.86.2 auto-loads a repo .aider.conf.yml with no trust prompt, and its notifications-command and editor values are later run through a shell, so opening an attacker repo in Aider can run commands as the user. CVSS 4.0 8.5.
The @hapi/content package from 6.0.1 before 6.0.3 has a regular expression denial of service flaw in Content.disposition(), so an unauthenticated multipart upload with a long parameter and no equals sign can block the event loop. CVSS 4.0 8.7.
Hugging Face Datasets through 5.1.0 can be made to run arbitrary Python code from a crafted pickle file loaded through the deprecated pandas builder, when a user loads it with the pandas dataset name. CVSS 3.1 8.8.
Traefik before 2.11.58 and 3.7.14 skips its SNI check when request TLS state is nil, which happens for HTTP/2 requests with the http scheme pseudo-header on Go 1.27 builds, so unauthenticated clients can reach routers requiring client certificates without presenting one. Official builds use Go 1.26 and are not exposed, per the Traefik advisory. CVSS 3.1 8.7.
Traefik 3.7.13, fixed in 3.7.14, builds an extra HTTP router for ssl-passthrough Ingresses in the Kubernetes Ingress NGINX provider without applying the Ingress auth and allow-list annotations, so unauthenticated clients on the HTTP entry point can reach protected backends with nothing logged. CVSS 3.1 8.7.
Traefik from 3.2.0 before 3.7.14, when experimental FastProxy is enabled, pools plain HTTP backend connections without pinning NTLM or Negotiate authenticated connections to their frontend connection, so an unauthenticated client can be served as a victim on a reused backend connection. CVSS 3.1 8.7.
Traefik from 3.7.0 before 3.7.14 merges client CAs in its Kubernetes Ingress NGINX provider when auth-tls-secret names collide after dot-to-dash normalization, so a host requiring its own client CA can accept certificates from another host CA while its legitimate clients are refused. CVSS 3.1 8.7.
Traefik from 2.11.0 before 2.11.58 and from 3.0.0 before 3.7.14 keeps a backend connection authenticated by a first-request Negotiate token in its globally shared pool, so an unrelated unauthenticated client can be assigned that socket and act with the victim identity. CVSS 3.1 8.7.
Traefik from 3.7.0 before 3.7.14 forwards client-supplied Ssl-Client headers on the plaintext HTTP router for Ingresses using auth-tls-pass-certificate-to-upstream, so when ssl-redirect is disabled an unauthenticated attacker can impersonate any mutual TLS identity a backend trusts from those headers. CVSS 3.1 8.7.
Traefik from 2.11.0 before 2.11.58 and from 3.0.0 before 3.7.14 stores its NTLM and Kerberos backend round tripper in a connection slot not keyed by ServersTransport, so an unauthenticated client can arm it on one service and have another service backend connection made with the first service TLS settings, bypassing its root CAs, server name and certificate verification. CVSS 3.1 8.7.
mem0 0.1.117 before 1.0.8 interpolates stored memory text, metadata and message names into SQL in its Databricks vector store insert and update paths, so an attacker who can influence stored memories can execute injected SQL on the configured Databricks SQL warehouse. CVSS 3.1 8.1, CVSS 4.0 9.2.
Mistune before 3.3.0, when the RST include directive is enabled, accepts unconstrained relative and absolute include paths, so any markdown the renderer processes can read arbitrary files readable by the rendering process and embed them in the rendered HTML. CVSS 3.1 8.6, CVSS 4.0 9.2.
Mistune before 3.3.0 does not validate that include directive paths stay within the source directory, and renders error messages and included file contents without HTML escaping, so attackers can read arbitrary files and perform cross-site scripting even when escape is set to True. CVSS 4.0 8.7.
Incus 7.3.0 before 7.5.0 rejects block.create_options only on direct volume creation, so a restricted project user can set it through volume update, copy or move and have it appended to the mkfs command line run as root when a pool formats the new volume. CVSS 3.1 8.5, CVSS 4.0 9.0.
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 does not validate the dependent custom volume names inside an instance backup, so a client allowed to create instances can use dot-dot sequences to have the daemon create root-owned directories with controlled content at arbitrary host paths. CVSS 3.1 9.9.
Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 treats a custom volume create with a source volume but no source type as a copy, without the source access check that applies to explicit copies, so a project-restricted client can copy and read any other project volumes, snapshots and configuration. CVSS 4.0 8.3.
Incus before 6.0.7, 6.1.0 before 7.0.2 and 7.1.0 before 7.5.0 replays instance and volume migration streams with rsync or btrfs receive, which follow symlinks planted in the stream, so a malicious migration source can write attacker-controlled files to arbitrary host paths as root. CVSS 3.1 9.9.
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 does not validate the result types of component-model-async callback functions, so a malicious guest can write about 16 KB of chosen data to the native stack, overwrite return addresses, crash the host or escape the sandbox. CVSS 3.1 9.9.
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3 and 47.0.0 before 47.0.4 inherits a cap-std flaw where symlinks with trailing slashes escape the filesystem sandbox on macOS and Linux kernels without openat2, letting guests read and write host files. CVSS 4.0 8.8.
Splunk Enterprise below 10.4.4, 10.2.8, 10.0.11 and 9.4.16 does not apply SPL safeguards for risky commands to scheduled searches, so a user with the schedule_search capability can run risky SPL that can disclose or alter Splunk data or disrupt availability. CVSS 3.1 8.8.
Splunk Enterprise below 10.4.4 and 10.2.8 derives the PostgreSQL sidecar superuser password from the search head cluster identifier that appears in search job logs, so a user without admin or power roles can derive it and run arbitrary operating system commands as the Splunk user on search head cluster members. CVSS 3.1 8.8.
PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 uses longjmp for out-of-memory errors in contexts that can leave request memory uninitialized, so request cleanup can read or branch on that memory and multiple out-of-memory strategies can give unauthenticated remote code execution. CVSS 3.1 9.8.
PHP before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 can leave global state pointing into freed request memory when a reset is missed or state is repopulated after reset, so a later request on the same worker can act on stale state before initialization and give remote code execution. CVSS 3.1 9.8.
FreeRDP before 3.32.1 has a heap-based buffer overflow in the server-side rdpsnd channel: an integer wraparound in block-alignment arithmetic bypasses validation, so a malicious RDP client can cause an unbounded heap write during server audio playback. CVSS 3.1 8.8.
vLLM from 0.7.3 before 0.31.0 forwards a request-supplied code_revision to Transformers AutoProcessor loading, so a client can select which revision of a model processor is imported when trust_remote_code is enabled, executing arbitrary Python in the vLLM API process. CVSS 3.1 8.1 (CVSS 4.0 9.2).
Dulwich before 1.2.9 does not validate DOS drive letter prefixes in Git tree path elements on Windows, so a malicious repository with a tree entry named like a drive prefix can write files outside the worktree and reach code execution. CVSS 3.1 8.8.
uv before 0.11.15 has a path traversal flaw that lets malicious wheels write files outside the scripts directory through crafted console_scripts or gui_scripts entry point names, placing executables in PATH directories for code execution. CVSS 3.1 8.8.
PHPOffice PHPPresentation through 1.2.0 passes content loaded through IOFactory to unserialize in its Serialized reader, so a crafted presentation file in a ZIP can instantiate arbitrary PHP objects and enable gadget-chain code execution, file writes, or denial of service. CVSS 3.1 8.1 (CVSS 4.0 9.2).
Cisco grouped out-of-bounds write issues under CVE-2026-20043 in a Snort 3 hardening release affecting Open Source Snort 3 and Cisco products that embed it, including Secure Firewall Threat Defense, Cyber Vision and the UTD Snort IPS engine, with fixed releases listed in the Cisco advisory. CVSS 3.1 9.0.
Cisco grouped issues concerning improper control of generation of code under CVE-2026-76473 in an October 2026 hardening release for Cisco Unified Communications products including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, with software updates released and no workarounds. CVSS 3.1 9.8.
Cisco grouped improper authentication issues under CVE-2026-76474 in an October 2026 hardening release for Cisco Unified Communications products including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, with software updates released and no workarounds. CVSS 3.1 9.8.
Cisco grouped improper neutralization of input during web page generation issues under CVE-2026-76475 in an October 2026 hardening release for Cisco Unified Communications products including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, with software updates released and no workarounds. CVSS 3.1 9.3.
Duplicator and Duplicator Pro for WordPress, in versions up to and including 1.5.17 and 4.6.10, deserialize untrusted database content during migration, letting a stored serialized object reach command execution in the free plugin or file deletion and possible takeover in Pro. CVSS 3.1 8.8.
Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user when a victim opens a malicious file. CVSS 3.1 8.8.
IBM Sterling Connect:Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management. CVSS 3.1 8.4.
Cruise Control registers Jetty security constraints on exact paths with no catch-all, while its servlet strips leading path segments before routing, so crafted paths reach all 15 admin endpoints without authentication. CVSS 3.1 8.8.
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification, so any authenticated user can delete another user's messages, overwrite message content, or hijack a session. CVSS 3.1 8.3.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. CVSS 3.1 8.8.
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials. CVSS 3.1 8.8.
IBM MQ can allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code through a heap buffer overflow when processing MQPUT operations with malformed message options. CVSS 3.1 8.8.
IBM MQ can allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code through a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. CVSS 3.1 8.8.
IBM MQ can allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. CVSS 3.1 8.8.
A subset of Rank Math SEO PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware that can persist on a WordPress site and expose its credentials and secrets. CVSS 3.1 9.8.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 invokes non-string arrow arguments to the Twig group filter as callables without the checkArrow guard, so authenticated Control Panel users can write a webshell via FileHelper::writeToFile and execute code as the web user. CVSS 3.1 8.8.
Craft CMS 5.0.0 before 5.11.0 passes Asset::getMimeType transform keys unfiltered to Craft::createObject, so authenticated Control Panel users can attach Yii behaviors or event handlers through as or on keys and execute code as the web user. CVSS 3.1 8.8.
Craft CMS 5.0.0 before 5.11.0 passes uncleansed criteria from getNext, getPrev, and getOwners into Craft::configure, so authenticated Control Panel users can inject Yii as or on keys and execute code as the web user when the element query runs. CVSS 3.1 8.8.
Craft CMS 5.8.0 before 5.11.0 JSON-decodes ContentBlock field layouts after cleanseConfig runs, so authenticated administrators with allowAdminChanges enabled can smuggle as or on keys into Craft::createObject and execute OS commands as the web user. CVSS 4.0 8.7 (CVSS 3.1 7.2).
Craft CMS 5.0.0 before 5.11.0 does not invalidate a verification code when an active user verifies an email change, so an attacker who obtains the code can reuse it at users/set-password to reset the victim's password and take over the account. CVSS 4.0 8.7 (CVSS 3.1 7.5).
Craft CMS 5.0.0 before 5.11.0 does not enforce requireAllowedSite() on several GraphQL mutations, so a token scoped to one site can create entries in another site and delete entries, categories, tags, and assets shared across sites. CVSS 3.1 9.8.
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 checks Twig create() class names case-sensitively while PHP resolves classes case-insensitively, so attackers with template-execution rights can instantiate SplFileObject in lowercase to read .env secrets or write a PHP file for code execution. CVSS 4.0 8.7 (CVSS 3.1 7.2).
Grav 2.0.15 before 2.2.2 lets page editors smuggle data directives past the callable allowlist by renaming a Flex form field with replace-name@, invoking arbitrary public static methods such as Folder::delete to delete directories, overwrite files, or read files. CVSS 3.1 8.8.
IBM MQ can allow a remote attacker to execute arbitrary code through a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. CVSS 3.1 8.1.
Red Hat says bootc hosts using the default containers signature policy can apply unsigned content when a mutable image tag is updated, letting an attacker who can update that tag place arbitrary OS content that runs as the host root filesystem on reboot. CVSS 3.1 8.1.
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path, which does not validate the MIC offset in a crafted AUTHENTICATE_MESSAGE. CVSS 4.0 8.3 (CVSS 3.1 7.4).
phpMyFAQ from 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks, including on administrator accounts. CVSS 3.1 8.1.
phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, does not require the current password when changing an account email, so an attacker with a hijacked session can point the account at their own mailbox and take it over through password reset, including superadmin accounts. CVSS 3.1 8.3.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption flaw in its unauthenticated faqs and search API endpoints, which load all database records into memory and can be flooded to exhaust CPU and memory. CVSS 4.0 8.7 (CVSS 3.1 7.5).
phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, checks only the global edit_faq permission on the FAQ update endpoint, so authenticated editors can modify restricted FAQs they cannot view, bypass moderation, and change publication state. CVSS 3.1 8.3.
phpMyFAQ before 4.1.9 has a missing authorization flaw in the deleteUser API that lets authenticated non-superadmin users holding delete_user permission delete superadmin accounts, removing administrative access and accountability. CVSS 3.1 8.1.
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass in its WebAuthn registration endpoints that lets an unauthenticated attacker register a passkey on any account and log in, bypassing passwords and TOTP. CVSS 3.1 9.8.
Fleet before 4.89.0 contains an unbounded recursion flaw in Apple MDM enrollment property list parsing, so an unauthenticated attacker can crash the server with a crafted binary plist payload of about 150 bytes. CVSS 4.0 8.7 (CVSS 3.1 7.5).
Fleet before 4.83.0 contains a denial of service flaw in gzip-compressed request handling, so unauthenticated attackers can send small, highly compressed bodies that expand during decoding and crash the whole Fleet instance. CVSS 4.0 8.7 (CVSS 3.1 7.5).
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 trusts any domain that is a string prefix of a workspace-proxy access URL, so an attacker can capture a redirected application_connect API key and replay it against the victim workspace. CVSS 4.0 8.7 (CVSS 3.1 7.7).
FreeRDP servers from 3.0.0 before 3.32.0 grow an unbounded receive buffer when a pre-authentication client streams bytes that are not a valid NLA frame. CVSS 4.0 8.7.
FreeRDP clients on macOS and iOS before 3.32.0 compute an audio buffer size in 32-bit arithmetic, so a malicious RDP server can wrap the size and trigger a heap out-of-bounds write. CVSS 3.1 8.8.
FreeRDP clients before 3.32.0 write one row past the destination planes when combining AVC444 video frames with an odd height, giving a malicious server a heap out-of-bounds write. CVSS 3.1 8.8.
Frappe HRMS before 14.38.2, 15.64.0, and 16.18.0 leaves some endpoints open to SQL injection, letting any authenticated account, however low-privilege, extract sensitive database information. CVSS 4.0 8.3.
A heap-based buffer overflow in Microsoft Word lets an unauthenticated attacker execute code when a victim opens a crafted document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word, tracked separately from its sibling October Word flaws, lets an attacker execute code via a crafted document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution when a crafted document is opened. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word enables remote code execution through a malicious document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution via a crafted document, and the vendor record covers Mac builds as well as Windows. Microsoft rates it CVSS 3.1 8.8.
A stack-based buffer overflow in Microsoft Word lets an attacker execute code when a crafted document is opened, on Windows and listed Mac builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution through a malicious document across the listed Windows and Mac Office builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word permits code execution via a crafted document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows an attacker to execute code with a crafted document across Microsoft 365 Apps and LTSC builds, including Mac. Microsoft rates it CVSS 3.1 8.8.
A stack-based buffer overflow in Microsoft Word enables code execution through a crafted document on the listed Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word lets a crafted document execute code on affected Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
A use-after-free flaw in Microsoft Word allows code execution via a crafted document on affected Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
An off-by-one error in Microsoft Word allows an attacker to execute code through a crafted document on the listed Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
Microsoft disclosed a remote code execution vulnerability in Microsoft Office itself, tied to a heap-based buffer overflow, affecting 365 Apps and LTSC builds including Mac. Microsoft rates it CVSS 3.1 8.8.
A stack-based buffer overflow in Microsoft Word allows code execution via a crafted document on affected Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
A use-after-free flaw in Microsoft Excel allows code execution via a crafted spreadsheet, and the vendor record also lists Office Online Server before 16.0.10417.20228 as affected. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word permits code execution through a crafted document on Microsoft 365 Apps and LTSC builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution via a malicious document across the listed Windows and Mac Office builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word, with a numeric truncation weakness also listed, allows code execution via a crafted document. Microsoft rates it CVSS 3.1 8.8.
A numeric truncation error in Microsoft Word allows an attacker to execute code through a crafted document on 365 Apps and LTSC builds. Microsoft rates it CVSS 3.1 8.8.
A path traversal flaw in Microsoft SharePoint Server Subscription Edition lets an authorized low-privilege attacker execute code over the network. Microsoft rates it CVSS 3.1 8.8.
The FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input before authentication, letting unauthenticated attackers inject keystrokes into a host session. CVSS 4.0 8.7.
GitPython before 3.2.0 has a regular expression denial of service in actor and date parsing that crafted commit or tag objects can trigger. CVSS 4.0 8.7.
GitPython from 3.1.30 before 3.2.0 checks unsafe pull options only in keyword arguments, letting a positional refspec carry an upload-pack option into command execution. CVSS 3.1 8.1, CVSS 4.0 9.2.
GitPython before 3.2.0 lets a branch name be parsed as a git option in Head.checkout, so a crafted repository can leak local file contents through error messages. CVSS 4.0 8.7.
Better Auth from 1.4.0-beta.18 before 1.7.7 reuses OAuth state values as magic link tokens, letting unauthenticated attackers sign in as other users. CVSS 3.1 9.1.
The Better Auth SSO package from 1.7.0-rc.2 before 1.7.3 lets an authenticated user register a personal SSO provider and sign in as another user. CVSS 3.1 8.1, CVSS 4.0 8.6.
Better Auth from 1.5.0-beta.12 before 1.7.7 has an OAuth Proxy authentication bypass when the proxy shares the global secret and cookie-stored state is used. CVSS 4.0 9.1.
Renovate before 44.60.1 lets a shared preset set restricted environment variables, which can affect child processes on self-hosted instances. CVSS 3.1 8.5, CVSS 4.0 9.0.
Renovate before 44.79.0 can be pointed at arbitrary internal URLs through presets or custom datasources, exposing internal services and cloud metadata. CVSS 3.1 8.5.
Nodemailer from 3.0.0 before 10.0.13 has a regular expression denial of service in EHLO handling that a malicious or intercepted SMTP server can trigger. CVSS 4.0 8.7.
An OS command injection flaw in pfSense CE 2.7.0 through 2.9.0 lets a user with QinQ edit privilege store a crafted parent interface name that is later interpolated into ifconfig shell commands, executing as root. The disclosure record rates it CVSS 4.0 8.6 (CVSS 3.1 7.2).
An OS command injection flaw in pfSense CE through 2.9.0 lets a user with gateway edit privilege place shell metacharacters in an IPv6 link-local zone index, which is passed unescaped into the dpinger monitoring command and runs as root. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
An OS command injection flaw in pfSense CE through 2.9.0 lets a user with Virtual IP edit privilege store a CARP VHID containing shell metacharacters, which executes through ifconfig calls or CARP status rendering. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
An OS command injection flaw in pfSense CE 2.4.5 through 2.9.0 lets a WebGUI user with Advanced Admin Access place newline or command-substitution payloads in sshguard settings, which are written to sshguard.conf and sourced as root on restart. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
A command injection flaw in pfSense CE 2.7.0 through 2.9.0 in captive portal high-availability sync handling lets a privileged user inject shell commands that reach pfctl operations. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
An authorization bypass in pfSense CE through 2.9.0 lets read-only WebGUI users replace config.xml because the restore and install paths ignore the deny-config-write privilege, leading to root-level code execution after reload or reboot. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
A Jinja2 template injection flaw in Ansible Operator Plugins lets a low-privileged Kubernetes user run code inside the operator pod through crafted custom resource values, taking over its service account. Red Hat rates it CVSS 3.1 8.5.
A flaw in the DPDK GSO library: when software GSO copies packet headers into a new mbuf it does not check that the header fits in the source first segment or the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation, so a remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write. Red Hat rates it CVSS 3.1 8.6.
A heap-based buffer overflow in eventd on Junos OS and Junos OS Evolved lets an unprivileged local attacker cause a denial of service or escalate privileges to root with crafted IPC event messages. Juniper rates it CVSS 4.0 8.6 (CVSS 3.1 7.8).
A NULL pointer dereference in the routing protocol daemon (RPD) of Junos OS and Junos OS Evolved lets a configured peer sending a BGP UPDATE cause a denial of service when an import policy with source-based-forwarding next-hop next-table references a routing table that does not exist. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference in the rpd routing daemon of Junos OS and Junos OS Evolved lets an unauthenticated configured BGP peer cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP neighbor cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An improper handling of length parameter inconsistency vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated network attacker cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An improper input validation vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated network attacker cause a denial of service via a crafted BGP EVPN update message. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An integer overflow or wraparound vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An integer overflow or wraparound vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a remote attacker with an established EVPN BGP peering relationship cause a denial of service via EVPN BGP route processing, disrupting control-plane adjacencies on EVPN-enabled routing instances. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A heap-based buffer overflow in the Secure Vector Routing (SVR) component of Junos OS on SRX Series lets an unauthenticated network attacker cause a denial of service and potentially compromise confidentiality and integrity with malformed IPv4 packets. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
An improper authentication vulnerability in the J-Web management interface and its NETCONF session handling in Junos OS and Junos OS Evolved lets an unauthenticated network attacker obtain root-level device configuration access via a reachable J-Web service when web management is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
A stack-based buffer overflow in the UTM Anti-Spam SBL of Junos OS on SRX Series lets an unauthenticated remote attacker execute arbitrary code or deny service with a malformed DNS packet when Anti-Spam SBL inspection is enabled. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated adjacent LDP peer crash rpd or execute arbitrary code with a malformed LDP Label Mapping message. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP/EVPN peer execute root code on Junos OS, or crash rpd on Junos OS Evolved, via protocol-valid route advertisements for an EVPN-VPWS service. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP peer crash rpd, or execute code on Junos OS, with a flow-spec update that is selected for re-advertisement. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
An SQL injection vulnerability in ipfd on Junos OS SRX Series lets an unauthenticated network attacker execute code with root privileges through a configured Security Intelligence feed connection. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A reachable assertion vulnerability in the na-grpcd process of Junos OS Evolved lets a remote unauthenticated attacker cause a denial of service via a gRPC telemetry subscription request. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A stack-based buffer overflow in the authd process of Junos OS lets an attacker able to influence a configured RADIUS server crash authd or execute code with root privileges through a malicious RADIUS response. Juniper rates it CVSS 3.1 8.8.
A heap-based buffer overflow in the secure-dot1xd process of Junos OS and Junos OS Evolved lets an unauthenticated adjacent network attacker execute code as root or deny service with an EAPOL frame sent to an 802.1X-authenticated interface. Juniper rates it CVSS 3.1 8.8.
An improper validation of specified quantity in input vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a configured BGP MVPN peer cause a denial of service via a BGP MVPN signaling update. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A reachable assertion vulnerability in the rpd process of Junos OS and Junos OS Evolved lets an authenticated network-based attacker cause a denial of service via BGP-LS routing updates. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A reachable assertion vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker with access to a configured BGP-LS peer cause an rpd crash via crafted BGP-LS Link NLRI advertisements. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A reachable assertion vulnerability in fwstatsd of Junos OS Evolved lets an authenticated network attacker cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An integer overflow or wraparound vulnerability in the routing daemon (rpd) of Junos OS and Junos OS Evolved lets an authenticated BGP peer cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A mismatched memory management routines vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an authenticated network attacker cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An improper control of a resource through its lifetime vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an adjacent eBGP peer cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An incorrect calculation of buffer size vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured eBGP neighbor cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a remote BGP peer cause a denial of service when multiple UPDATEs occur over a single TCP session with bgp family l2vpn auto-discovery-only configured. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated configured MSDP peer or adjacent PIM sender cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An incomplete cleanup vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a configured MVPN neighbor cause a denial of service via a BGP MVPN update when an inter-region segmented VRF with protocols mvpn inter-region-template is configured. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An OS command injection vulnerability in TACACS handling on Junos OS Evolved lets a low-privileged TACACS+-authenticated user execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
An XML injection vulnerability in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series lets an unauthenticated network attacker commit arbitrary device configuration with root privileges through a malicious response from a configured custom URL-feed server. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A stack-based buffer overflow in the l2cpd process of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker deny service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the l2cpd daemon of Junos OS and Junos OS Evolved lets an unauthenticated adjacent attacker deny service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP, with repeated triggering disrupting LLDP and other Layer 2 protocols device-wide. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the jdhcpd process of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker deny service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the cfmd process of Junos OS on MX Series and Junos OS Evolved on PTX Series lets an unauthenticated adjacent-network attacker execute arbitrary code as root or deny service via a specific CFM message sent to a configured down-MEP with enhanced CFM mode enabled. Juniper rates it CVSS 3.1 8.8.
An OS command injection vulnerability in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved on EX, SRX, and QFX Series lets an adjacent unauthenticated attacker execute arbitrary commands with root privileges via a rogue DHCP server. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker execute arbitrary code as root via a crafted DHCP SZTP bootstrap message, on platforms that support Secure-ZTP. Juniper rates it CVSS 3.1 8.8.
A use of externally-controlled format string vulnerability in the ipfd daemon of Junos OS on SRX Series lets an unauthenticated network attacker execute code with root privileges via a compromised or impersonated configured HTTPS feed server. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A reachable assertion vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker cause an rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An OS command injection vulnerability in the Junos OS CLI lets a local low-privileged attacker take complete control of the device: a specific request csds command does not sanitize user input, so it can be interpreted as a command and executed with root privileges. Juniper rates it CVSS 4.0 8.5 (CVSS 3.1 7.8), affecting MX Series releases from 24.4.
A stack-based buffer overflow in the iked IKE key-management daemon of Junos OS on SRX Series lets an authenticated remote-access VPN client execute code with root privileges or deny service via the remote-access VPN authentication and JIMS identity-publishing path. Juniper rates it CVSS 3.1 8.8.
A heap-based buffer overflow in the sdxd service-deployment daemon of Junos OS and Junos OS Evolved lets a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection execute code as root or cause a denial of service with a crafted frame. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
A buffer copy without checking the size of input vulnerability in the SDK service process of Junos OS lets an unauthenticated network attacker deny service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the BGP routing daemon of Junos OS and Junos OS Evolved lets a configured BGP flowspec peer compromise the routing engine or deny service via flowspec route re-advertisement when BGP update-threading is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress: it may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before proper external authentication can happen. F5 rates it CVSS 4.0 8.7 (CVSS 3.1 7.5), affecting the 5.6.0 line before 5.7.0.
A vulnerability exists in NGINX Plus and NGINX Open Source when a location uses the alias directive together with rewrite and a set or return directive referencing the request_filename variable, or when that variable is used in an access log format: crafted HTTP requests can cause a heap buffer overflow in the worker process, restarting it, and can execute code where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A flaw in DPDK lib/vhost: the VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap that a local low-privilege attacker can turn into code execution with changed scope. Red Hat rates it CVSS 3.1 8.8.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Microsoft rates CVE-2026-88164 CVSS 3.1 8.8 for SharePoint Server Subscription Edition before 16.0.20326.20190.
NGINX Gateway Fabric renders the realm fields of a namespaced AuthenticationFilter verbatim into the shared data-plane nginx.conf, so a namespaced authenticated attacker can craft a realm value that injects arbitrary NGINX directives into that Gateway's data-plane config, potentially reading co-located tenants' mounted secrets, SSRF via proxy_pass, the pod ServiceAccount token, or hijacking other tenants' routes. F5 rates it CVSS 3.1 8.8, affecting 2.4.0 before 2.8.0.
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable: crafted HTTP requests can cause a heap buffer overflow in the worker process, restarting it, and possibly code execution where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
An authentication and authorization bypass exists in F5 NGINX Kubernetes Ingress Controller when configured with the ExternalAuth policy or Ingress external authentication: client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal authentication subrequest, so an unauthenticated remote attacker may spoof request attributes the external authentication provider evaluates and reach protected paths. F5 rates it CVSS 4.0 8.7 (CVSS 3.1 7.5), affecting 5.5.0 before 5.7.0.
NGINX Plus and NGINX Open Source have a vulnerability in ngx_http_core_module: when asynchronous file I/O is enabled in certain configurations, processing a Server Side Includes page containing include virtual commands may trigger a use-after-free in the worker process, causing memory corruption or a crash, and possibly code execution where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
Frappe before 14.81.4 and 15.x before 15.41.0 has an improper privilege management flaw in a document action that lets a Website User escalate to System Manager. CVSS 3.1 8.8.
Adobe Commerce has a stored script injection flaw: an attacker can plant JavaScript in a form field and have it run in the browser of whoever views the page, with changed scope. Adobe rates it CVSS 3.1 9.3.
Microsoft Message Queuing (MSMQ) has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Microsoft Office Excel has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Excel has a use after free flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Excel has a use after free flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Dynamics NAV 2017 and 2018 (Business Central's predecessors) deserialize untrusted data in a way an authorized low-privilege attacker can use to execute code over the network. Microsoft rates it CVSS 3.1 8.8.
The Windows Remote Desktop Gateway service has a use-after-free flaw an unauthenticated attacker can use over the network to execute code. Microsoft rates it CVSS 3.1 8.1.
Microsoft's QUIC implementation has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code on Windows 11 and recent Windows Server releases. Microsoft rates it CVSS 3.1 9.8.
The Windows media video decoder has a heap-based buffer overflow a remote attacker can use to execute code when a victim interacts with crafted media. Microsoft rates it CVSS 3.1 8.8.
Windows Network Policy Server (NPS) has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Windows RPC Runtime has a type confusion flaw a remote attacker can use to execute code when a victim interacts. Microsoft rates it CVSS 3.1 8.8.
The Windows Text Shaping component has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Windows Hyper-V has a use-after-free flaw an authorized local attacker can use to execute code with changed scope. Microsoft rates it CVSS 3.1 8.8.
Windows WebDAV improperly resolves path equivalence, which an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Windows Text Shaping has an out-of-bounds read a remote attacker can use to execute code when a victim interacts with crafted content. Microsoft rates it CVSS 3.1 8.8.
Microsoft Dynamics NAV has a path traversal flaw an authorized low-privilege attacker can use over the network to affect files or data. Microsoft rates it CVSS 3.1 8.8.
Visual Studio Code does not properly confine pathnames to a restricted directory, and Microsoft says an unauthorized attacker can use that to execute code over a network when a user interacts. Microsoft rates it CVSS 3.1 9.6.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 improperly validates file paths during archive extraction, letting an authenticated attacker execute arbitrary code. IBM rates it CVSS 3.1 8.8.
Microsoft Office Access has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Access has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Visio has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Visio has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office OneNote has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a improper access control flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a missing authorization flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a incorrect authorization flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a code injection flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server does not properly verify cryptographic signatures, which an unauthenticated attacker can use to affect data over the network. Microsoft rates it CVSS 3.1 8.1.
A type confusion flaw spanning .NET Framework and Visual Studio can let a remote attacker elevate privileges when a victim interacts. Microsoft rates it CVSS 3.1 8.8.
ASP.NET Core has a code injection flaw in the WebAssembly server component that a remote attacker can use to execute code when a victim interacts. Microsoft rates it CVSS 3.1 8.8.
Visual Studio Tools for Applications has a code injection flaw a remote attacker can use to execute code when a victim interacts with crafted content. Microsoft rates it CVSS 3.1 8.8.
The Windows Remote Desktop Client has a use-after-free flaw a remote attacker can use to execute code when a victim connects or interacts. Microsoft rates it CVSS 3.1 8.8.
Adobe Experience Manager does not neutralize special elements in operating system commands, so a low-privileged attacker can execute arbitrary commands with changed scope. Adobe rates it CVSS 3.1 9.9.
Adobe Commerce does not safely neutralize special elements used by its template engine, and an unauthenticated attacker can turn that into arbitrary code execution with changed scope. Adobe rates it CVSS 3.1 10.0.
The Microsoft Windows Search Component has a use-after-free flaw Microsoft describes as letting an unauthorized attacker elevate privileges over a network. Microsoft rates it CVSS 3.1 9.8.
Microsoft QUIC has a heap-based buffer overflow an unauthenticated attacker can trigger over the network; the affected list spans Windows, .NET 8 through 11, and Visual Studio. Microsoft rates it CVSS 3.1 9.8.
Adobe Experience Manager improperly validates input in a path a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion lets an attacker upload a file of a dangerous type without adequate restriction, which can become arbitrary code execution with changed scope and no authentication. Adobe rates it CVSS 3.1 10.0.
ColdFusion improperly controls code generation, so a low-privileged attacker can inject code that the server executes with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion has an incorrect authorization vulnerability a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion improperly validates input in a path that can result in arbitrary code execution, though Adobe's vector requires high attack complexity. Adobe rates it CVSS 3.1 9.0.
ColdFusion has an incorrect authorization vulnerability a low-privileged attacker can use to bypass a security feature, with high confidentiality and integrity impact. Adobe rates it CVSS 3.1 9.6.
ColdFusion improperly controls code generation in a path an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 9.1.
ColdFusion has a server-side request forgery vulnerability Adobe says can result in privilege escalation, reachable without authentication or user interaction. Adobe rates it CVSS 3.1 10.0.
ColdFusion has a further code generation flaw in APSB26-144 that an unauthenticated attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 10.0.
Adobe Experience Manager has an improper input validation flaw a highly privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.1.
Adobe Experience Manager has a stored script injection flaw: an attacker's JavaScript can be saved and later run in a victim's browser with changed scope. Adobe rates it CVSS 3.1 9.3.
Adobe Experience Manager has a second stored script injection flaw in the same bulletin, also rated 9.3 with changed scope. Adobe rates it CVSS 3.1 9.3.
phpMyFAQ before 4.1.9 has an SQL injection flaw in its autocomplete escaping that unauthenticated attackers can reach through the search parameter when the database runs in NO_BACKSLASH_ESCAPES mode, exposing credentials and configuration secrets. CVSS 3.1 8.1, CVSS 4.0 9.2.
ERPNext before 15.121.0 and 16.x before 16.34.0 has SQL injection in several endpoints lacking input validation, letting any authenticated user read sensitive information and escalate to a privileged account. CVSS 3.1 8.8.
ERPNext before 15.119.1 and 16.x before 16.32.0 does not validate user-controlled message fields before template rendering, letting an authenticated attacker run expressions that read and write arbitrary database data. CVSS 3.1 8.8.
ERPNext before 15.111.0 and 16.x before 16.22.0 has a record-creation endpoint that inserts records with permission checks disabled, letting any authenticated user create privileged accounts and take full control. CVSS 3.1 8.8.
FreeRDP 3.0.0-beta1 through the releases before 3.32.0 have a use-after-free flaw in smartcard handling that a remote attacker can use to corrupt memory or crash the client. The project rates it CVSS 3.1 8.8.
NLTK through 3.10.3 does not validate WekaClassifier model paths well enough, so a crafted model path can escape its containment and write or probe files outside the allowed roots. VulnCheck rates it CVSS 4.0 8.3 (CVSS 3.1 7.0).
IBM Planning Analytics 2.0 and 2.1 has an improper authentication flaw that could let a remote attacker gain unauthorized administrative access. IBM rates it CVSS 3.1 8.8.
IBM Planning Analytics 2.0 and 2.1 improperly validates sub-requests, letting a remote attacker bypass authentication and escalate privileges. IBM rates it CVSS 3.1 8.8.
IBM Planning Analytics 2.0 and 2.1 improperly validates file paths, letting a remote attacker read arbitrary host files and overwrite certain application files without authentication. IBM rates it CVSS 3.1 8.2.
Adobe Experience Manager checks authorization incorrectly in a path an unauthenticated attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 10.0.
Adobe Experience Manager has another incorrect authorization vulnerability in the same bulletin that can be used by an unauthenticated attacker to execute arbitrary code. Adobe rates it CVSS 3.1 10.0.
The Windows iSCSI component has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Libarchive component bundled with Windows has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Windows iSCSI has an out-of-bounds write an unauthenticated attacker can trigger over the network to execute code, separate from the other iSCSI flaws in this month's updates. Microsoft rates it CVSS 3.1 9.8.
Windows iSCSI has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Windows Imaging Component has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Windows Internet Information Services (IIS) has a stack-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Windows Rich Text Edit Control has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Microsoft PostScript Printer Driver has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Microsoft PostScript Printer Driver has a second heap-based buffer overflow in the same month's updates, also allowing unauthenticated network code execution. Microsoft rates it CVSS 3.1 9.8.
The Windows System Information Console has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Microsoft Exchange Server has an input neutralization flaw during web page generation: script an attacker plants can run in a victim's browser with changed scope. Microsoft rates it CVSS 3.1 9.3.
Wazuh manager 4.1.0 through the releases before 4.14.8 do not check the origin of agent upgrade commands properly, so an enrolled agent may be able to read arbitrary files as root. VulnCheck rates it CVSS 4.0 8.7.
Wazuh agent 4.3.0 through the releases before 4.14.8 trust SCA policy files by path, so whoever controls the manager side may be able to run unsigned policy commands as root on agents. VulnCheck rates it CVSS 4.0 8.6.
Wazuh manager 4.0.0 through the releases before 4.14.8 did not properly invalidate revoked run_as tokens, so a former administrator's token may keep working. VulnCheck rates it CVSS 4.0 8.6.
Wazuh 3.9.0 through the releases before 4.14.8 let a cluster worker overwrite protected manager files such as ossec.conf, which can become root code execution across the manager and its agents. The project rates it CVSS 3.1 9.1.
Wazuh 4.14.3 through the releases before 4.14.8 validate remote commands case-sensitively in one component and not in another, so an authenticated manager user can smuggle a command entry that logcollector later runs as root. CVSS 3.1 9.1.
Adobe Experience Manager has an incorrect authorization vulnerability a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion has an incorrect authorization vulnerability that could result in arbitrary code execution, exploitable from an adjacent network without authentication. Adobe rates it CVSS 3.1 9.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly neutralize special elements in OS commands, letting an authenticated attacker execute arbitrary commands. IBM rates it CVSS 3.1 8.8.
IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker use a path traversal flaw to cause a denial of service. IBM rates it CVSS 3.1 9.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to unauthorized actors, letting an authenticated attacker read data they should not see. IBM rates it CVSS 3.1 9.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly neutralizes special elements, letting an authenticated remote attacker execute arbitrary code. IBM rates it CVSS 3.1 8.8.
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly validates pathnames, letting an authenticated remote attacker execute arbitrary code. IBM rates it CVSS 3.1 9.6.
Adobe Experience Manager has a reflected script injection flaw: an attacker can craft input that AEM reflects into a page so script runs in a victim's browser. Adobe rates it CVSS 3.1 9.3.
IBM Planning Analytics 2.0 and 2.1 has a stack-based buffer overflow that an authenticated remote attacker can use to execute arbitrary code. IBM rates it CVSS 3.1 8.1.
Windows Schannel improperly verifies cryptographic signatures, a flaw Microsoft scores 9.0 with changed scope that an unauthenticated attacker can use over a network. Microsoft rates it CVSS 3.1 9.0.
SAP S/4HANA's Manage Substitution/Validation Rules does not sufficiently validate input for its domain-specific scripting language, letting an authenticated attacker get input interpreted as ABAP code and fully compromise the system. SAP rates it CVSS 3.1 9.9.
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries in administrative functionality, letting an MII administrator provision an elevated account on the underlying Java application server. SAP rates it CVSS 3.1 9.1.
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in portal functionality, letting a low-privileged attacker invoke internal operations on a preconfigured remote system, up to full compromise of that system. SAP rates it CVSS 3.1 9.9.
SAP Commerce Cloud does not sufficiently validate user input before it reaches a database query, letting an authenticated user inject arbitrary SQL and read, modify, or delete sensitive data. SAP rates it CVSS 3.1 8.8.
ColdFusion Remote Development Services (RDS) improperly limits pathnames, which Adobe says could lead to arbitrary file system read and write. Adobe rates it CVSS 3.1 9.3.
Adobe Experience Manager has a further incorrect authorization vulnerability in APSB26-152 that an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 10.0.
Adobe Commerce has another stored script injection flaw in the same bulletin: script saved by an attacker runs for later page viewers with changed scope. Adobe rates it CVSS 3.1 9.3.
Adobe Commerce improperly validates input in a path a highly privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.1.
Adobe Commerce checks authorization incorrectly in a path an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 9.8.
IBM i 7.3 through 7.6 does not properly validate user-supplied input, letting an authenticated attacker execute arbitrary script code. IBM rates it CVSS 3.1 8.3.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 exposes session tokens in HTML responses, letting an authenticated attacker obtain sensitive information. IBM rates it CVSS 3.1 8.1.
IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let an unauthenticated remote attacker bypass access controls configured on gRPC service methods. IBM rates it CVSS 3.1 9.1.
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 has an authentication bypass when the samlWeb-2.0 feature is enabled. IBM rates it CVSS 3.1 9.1.
IBM WebSphere Application Server 8.5 and 9.0 have an improper authentication weakness an authenticated attacker can use to bypass authorization and impersonate an administrator across the cell. IBM rates it CVSS 3.1 8.0.
The Windows DNS Server service has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
IBM i 7.3 through 7.6 has an improper data sanitization flaw in the HTTP Server Administration web application that can let an authenticated attacker read sensitive information or execute arbitrary code. IBM rates it CVSS 3.1 9.9.
Microsoft Office Outlook has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code, affecting Microsoft 365 Apps and Office LTSC lines. Microsoft rates it CVSS 3.1 9.8.
The Windows Partition Management Driver has an out-of-bounds read Microsoft scores 9.8, describing it as allowing an unauthorized attacker to execute code over a network. Microsoft rates it CVSS 3.1 9.8.
Windows Text Shaping has a second heap-based buffer overflow this month, also allowing unauthenticated network code execution. Microsoft rates it CVSS 3.1 9.8.
Windows Error Reporting has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
OpenSSH for Windows has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Non-admin Crawl4AI API clients can wrap forbidden configuration objects in dictionary wrappers to defeat the untrusted-config gate, read the server SECRET_KEY and provider keys through the config dump, and forge admin tokens. Fixed in 0.9.4.
Unauthenticated Crawl4AI API clients can enable link preview on crawl requests so the URL seeder fetches internal, private, and cloud metadata links from a controlled page and returns their parsed head data. Fixed in 0.9.4.
Any website can post unvalidated messages to Open WebUI's SyncStatsModal, redirect an authenticated stats export to the authentication endpoint with a traversal chat id, and receive the signed-in user's JWT for full API access. Fixed in 0.11.4.
Non-admin Craft CMS users with the System Messages permission can escape the Twig sandbox through the has some and has every operators, invoking PHP callables to execute code as the web server user. Fixed in Craft CMS 5.10.14.
Authenticated Craft CMS control panel users with the performUpdates permission can inject behavior configuration through the raw updates parameter of the cache-updates action and execute arbitrary code. Fixed in 4.18.7 and 5.10.14.
LibreNMS in LDAP or Active Directory authorization mode inserts usernames unescaped into LDAP search filters, so an unauthenticated attacker sending a wildcard username over HTTP Basic authentication can match all users and groups and gain admin access. Fixed in 26.9.0.
The hosted ZITADEL Login V1 change-username handler acts on the account bound to a login flow before any factor is verified, so an unauthenticated attacker can rename any active human user, including administrators, and lock them out. Fixed in 4.18.0.
The ZITADEL Login V2 UI accepts forged unsigned session cookies, so unauthenticated attackers who guess time-ordered session IDs can obtain rotated tokens and take over accounts, including MFA-completed administrator sessions. Fixed in 4.19.2.
Customizing a generated Quarkus REST Data Panache operation with @MethodProperties, without re-declaring security roles, drops the class-level security requirements and leaves the endpoint open to unauthenticated access.
An authenticated attacker can send a crafted request to IBM Db2 Mirror for i 7.4, 7.5, or 7.6 that bypasses authorization and input validation checks, executes malicious code, and gains elevated privileges.
Versions through 0.31.0 interpolate spec-controlled values into single-quoted string literals without escaping; a crafted spec can execute arbitrary JavaScript when a generated client is imported or a service method is called.
Azure SRE Agent had a missing authorization check that an authenticated attacker could abuse over the network to elevate privileges, rated critical at CVSS 9.6.
A missing authentication check on a critical function in Azure App Service for Linux let attackers run code over the network without any credentials, rated critical at CVSS 9.8.
Azure API Center exposed sensitive information to unauthorized actors over the network, rated high at CVSS 8.7 with changed scope and high confidentiality and integrity impact.
Microsoft Dataverse deserialized untrusted data without validating it, letting unauthenticated attackers execute code over the network, rated critical at CVSS 9.8.
An authorization bypass via a user-controlled key in Microsoft Bookings let unauthenticated attackers elevate privileges over the network, rated critical at CVSS 9.9.
Microsoft Partner Center did not properly validate certificates, letting unauthenticated attackers elevate privileges over the network, rated a perfect 10.0 on CVSS.
ILIAS lets question authors inject ImageMagick options through uploaded image filenames, allowing remote code execution on the server.
System Informer's privileged helper accepts connections from any Authenticode-signed process, letting local attackers reach SYSTEM-level APIs.
IBM DataPower Gateway can let a remote attacker in as an administrator with an empty password during LDAP authentication.
IBM DataPower Gateway can be tricked into reading attacker-defined external entities when processing XML data, exposing files or draining memory.
IBM DataPower Gateway is vulnerable to a remotely triggerable buffer overflow that can crash the appliance or worse.
A remote attacker can bypass security restrictions in IBM Security Verify Access due to improper authentication.
A remote authenticated attacker can execute arbitrary code on IBM Security Verify Access due to a protection mechanism failure.
An unauthenticated user can embed arbitrary JavaScript in the IBM Security Verify Access Web UI, potentially stealing credentials from trusted sessions.
A remote authenticated attacker can inject arguments in IBM Security Verify Access to perform unauthorized actions.
A remote authenticated attacker can execute arbitrary commands on IBM Security Verify Access through improper neutralization of command arguments.
A remote attacker can bypass authentication in IBM Security Verify Access due to improper authentication handling.
A remote authenticated attacker can bypass security restrictions in IBM Security Verify Access due to improper authentication.
IBM Security Verify Access deserializes untrusted data, letting a remote unauthenticated attacker execute arbitrary code on the system.
A second deserialization flaw in IBM Security Verify Access lets a remote unauthenticated attacker execute arbitrary code on the system.
A crafted TDS LOGIN7 packet can trigger a heap out-of-bounds read in IBM Guardium Data Protection, risking information disclosure or denial of service.
A crafted MongoDB SCRAM username with excessive length can corrupt memory in IBM Guardium Data Protection, risking denial of service or code execution.
Crafted TDS login fragments can overflow a fixed-size reassembly buffer in IBM Guardium Data Protection, risking denial of service or code execution.
An unauthenticated attacker who can influence monitored database traffic can plant a script that runs in the browser of an authenticated Guardium user.
IBM Guardium Data Protection 12.2 ships a hard-coded recovery key in its passkey component, letting a local attacker recover the root password.
IBM Guardium Data Protection 12.1 and 12.2.2 leave the edge-controller unauthenticated, so a remote attacker can execute arbitrary container images and take over managed edge clusters.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker read sensitive files through improper restriction of a pathname to its intended directory. IBM rates it high at CVSS 8.1.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote, unauthenticated attacker execute arbitrary code through an improperly constrained code generation path. IBM rates it critical at CVSS 9.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper access control. IBM rates it high at CVSS 8.8.
Candlepin in Red Hat Satellite 6 grants access when any one of several checked parameters is authorized instead of requiring all of them, letting a low-privilege authenticated attacker read and modify subscription resources across organizations. Red Hat rates it high at CVSS 8.1.
An unauthenticated attacker can abuse improper checks in the Cisco License On-Prem password reset process to reset the password of any account, including administrators.
Splunk Enterprise search head cluster members expose a Patroni REST API without authentication, letting remote attackers run OS commands. Fixed in 10.4.3 and 10.2.7.
Cisco's October 2026 NX-OS hardening release addresses internally found improper-neutralization vulnerabilities grouped under CVE-2026-76453, rated 8.8.
The Cisco Smart Licensing Utility API of Cisco License On-Prem lacks authentication and input validation, letting remote attackers write arbitrary files or cause denial of service.
Cisco's October 2026 NX-OS hardening release addresses internally found improper-handling-of-exceptional-conditions issues grouped under CVE-2026-76458, rated 8.6.
Cisco's October 2026 NX-OS hardening release addresses internally found out-of-bounds write issues grouped under CVE-2026-76459, with Cisco assigning a maximum CVSS of 9.8.
Cisco's October 2026 Meraki hardening release addresses internally found improper-input-validation issues grouped under CVE-2026-76468, rated 8.2.
Cisco's October 2026 Meraki hardening release addresses internally found improper-neutralization issues grouped under CVE-2026-76472, rated 8.8.
Cisco's October 2026 hardening release for Cisco License On-Prem addresses internally found missing-authentication vulnerabilities grouped under CVE-2026-76480, rated 9.8.
Improper input validation in the NGOAM feature of Cisco NX-OS Software lets an unauthenticated remote attacker execute arbitrary code with root privileges on Nexus 3000 and 9000 switches.
CVE-2026-76486 affects Nexus 3000/9000 switches with NGOAM plus SRv6 or NV Overlay enabled, allowing unauthenticated remote code execution with root privileges.
Cisco's October 2026 hardening release for Application Policy Infrastructure Controller addresses internally found improper-resource-control vulnerabilities grouped under CVE-2026-76500, rated 9.8.
CVE-2026-76501 affects Nexus switches with both NGOAM and SRv6 enabled, letting an unauthenticated remote attacker execute arbitrary code with root privileges.
A heap buffer over-read in libexpat's XML_ParseBuffer, fixed by upstream commit 13c5f63, lets attackers recover heap and libc pointers and defeat address randomization.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper control of code generation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper neutralization of special elements used in code. IBM rates it high at CVSS 8.1.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper control of code generation, with effects that cross the component's security scope. IBM rates it high at CVSS 8.5.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote, unauthenticated attacker run arbitrary OS commands through improper neutralization of special elements in an OS command. IBM rates it critical at CVSS 9.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote attacker execute arbitrary code through a dependency confusion flaw. IBM rates it high at CVSS 8.8; no authentication is required, only a user action such as installing or updating.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code by slipping past the code security scanner's incomplete blocklist. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper input validation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary OS commands through improper neutralization of special elements used in an OS command. IBM rates it high at CVSS 8.1.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker escape the code sandbox and execute arbitrary code through improper neutralization of special elements used in code. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper input validation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary OS commands through code injection rooted in improper input validation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker read sensitive data or inject malicious data through improper access control in the vertex result caching subsystem. IBM rates it high at CVSS 8.3.
Planka 2.2.0 through 2.2.1 does not limit incorrect TOTP codes submitted to the verify endpoint, letting an attacker who knows a user's password guess six-digit codes inside the ten-minute pending-token window and obtain a full access token.
Mooncake Store through 0.3.13.post1 exposes object-deletion RPCs without authentication, letting unauthenticated attackers delete arbitrary objects, wipe keys matching a regex, or clear the entire store, causing cache loss and request failures.
An unauthenticated attacker who knows the exact file path can read files from the web root of affected Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye Data Center instances. Atlassian rates it critical at CVSS 9.3.
Smarty before 4.5.8 and 5.x before 5.8.5 mishandles the top-level nocache hash during extends-based template inheritance, letting attacker-supplied data carrying a forged SmartyNocache marker be written verbatim into the regenerated PHP cache file and executed as PHP on include.
The HyperShift operator copies user-supplied kubeconfig secrets into the privileged control plane namespace without validation, so an authenticated tenant user can smuggle in an executable plugin and gain code execution in the control plane.
Legcord 1.1.0 through 1.3.0 fails to validate theme IDs in its theme IPC handlers, letting script in the Discord page escape the themes directory to launch executables, delete directories, and write files.
Legcord 1.1.0 through 1.3.0 lets script in the Discord page write any config key, so an attacker can persistently add Chromium proxy flags and route all client traffic through an interception proxy.
Camunda 7's first-run setup check only counts members of the default camunda-admin group, so when admins exist through other routes the setup endpoint can become reachable again, letting an unauthenticated attacker create a new administrator.
AVideo's safeString() strips tags before decoding entities and runs twice, so doubly-encoded entities in video titles survive sanitization and execute as stored XSS on trending, gallery, embed, and playlist pages.
AVideo renders the video trailer1 URL unescaped in YouPHPFlix2 templates and channel playlists, letting users with upload permission inject script that executes in viewers' browsers.
MindSearch's unauthenticated POST /solve endpoint passes planner-agent Python straight to exec() with full builtins and process globals, giving any network attacker root code execution in the default Docker deployment.
Unauthenticated attackers who know a victim's login name can link their own external identity provider account to the victim's ZITADEL user and sign in as them, with no primary-factor check.
ZITADEL encrypts IdP intent tokens without authentication, letting attackers tamper with their own token so it is accepted for another user's external login intent and steal IdP tokens or sessions.
ZITADEL validates the organization from a request header instead of the target user's organization when issuing passkey enrollment codes, letting attackers from one org register authenticators on users in another org.
ZITADEL's hosted Login V1 UI processes second-factor enrollment on identify-only sessions before any primary factor is verified, letting attackers enroll their own TOTP, SMS, or U2F factors on victim accounts.
ZITADEL Login V2 exposes one-time passcodes through the returnCode delivery type, letting unauthenticated attackers read OTP-Email and OTP-SMS codes from server responses and take over accounts, including admin accounts.
ZITADEL's hosted Login V1 and V2 UIs allow passkey or authenticator enrollment on identify-only sessions before any primary factor is verified, so unauthenticated attackers can register their own authenticator and log in as the victim.
ZITADEL Login V2 checks only the individual user's status and not the organization's inactive state, so users of deactivated organizations can still sign in, create sessions, and refresh tokens.
ZITADEL's hosted Login V1 UI trusts attacker-supplied external identity fields before any IdP callback completes, letting unauthenticated attackers pre-create accounts bound to a victim's external identity.
go-micro's shared TLS helper sets InsecureSkipVerify to true by default, letting network attackers impersonate services and intercept gRPC, HTTP, broker, and registry traffic including auth tokens.
gopay disables TLS certificate verification in its default HTTP client, letting man-in-the-middle attackers impersonate payment provider APIs to read merchant credentials and rewrite payment responses.
mammoth.js's style-map tokeniser has overlapping regex alternatives that an attacker can exploit with a crafted .docx, blocking the Node.js event loop in a regular-expression denial of service.
Mooncake transfer engine before 0.3.13 trusts pointer values in TCP transport session headers, letting unauthenticated attackers read or overwrite process memory, including KV cache contents.
Mooncake through 0.3.13.post1 exposes an unauthenticated /metadata handler that lets attackers rewrite transfer engine metadata, poison segment descriptors, and redirect KV cache transfers.
An authenticated EST user can obtain CA-signed certificates with arbitrary subject names because a Dogtag PKI enrollment check treats the request as agent-privileged.
389-ds-base keeps plaintext bytes buffered across a StartTLS upgrade, letting an on-path attacker inject an LDAP message whose response a client mistakes for a successful bind.
Zod's array schema validation accumulated an unbounded number of per-element error objects with no cap or early exit, letting attackers exhaust server memory with a single large array.
Registering a node tool on an n8n inline agent decrypted and used whatever credential the caller named, with no ownership check, letting an ordinary member exfiltrate plaintext secrets to a host of their choosing.
n8n's MongoDB Chat Memory node passed an unvalidated sessionId straight into a MongoDB query, letting unauthenticated callers read other users' conversation histories and perform unauthorized writes and deletes.
Tornado's CurlAsyncHTTPClient accumulated decompressed response bytes with no size accounting, letting a remote server OOM-kill the whole application with a small gzip bomb.
Ghost's content API let unauthenticated visitors retrieve gated post content directly, bypassing the paywall restrictions publishers rely on.
A Ghost session-handling bug let any authenticated staff user log in as any other staff user with only the password, bypassing two-factor authentication entirely.
A command injection flaw in Foreman's errors:fetch_log rake task let users with sudo rights to the task inject shell metacharacters and run arbitrary code.
OS command injection flaws in Foreman's database dump and import rake tasks let users with foreman-rake sudo rights append malicious shell commands to file path parameters.
An authenticated Foreman user with low-level Viewer permissions could abuse template preview endpoints to disclose sensitive host data, including root passwords, and potentially run commands as the Foreman service account.
A DontCheckLogin parameter skips authentication on getemaildata.php, and an unvalidated filePath parameter lets remote attackers read arbitrary files, including database and service credentials.
The exec-approval shell unwrapper fails to split pipeline stages and command substitutions, so a benign allow rule silently approves and executes a smuggled command on the Windows host.
system.execApprovals.set accepts broad wildcard allow rules such as *.* that match nearly every command, letting a caller weaken the exec-approval policy into arbitrary code execution.
LightLLM through 1.2.0 exposes an unauthenticated RPyC server with pickle deserialization in the router profiler service when started with --enable_profiling, letting attackers execute arbitrary code by sending crafted serialized objects.
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization on all interfaces, letting attackers send crafted serialized objects to execute arbitrary code.
LightLLM through 1.2.0 lets unauthenticated attackers exhaust KV-transfer worker memory through the NCCL control channel's exposed_set_value method when started with --pd_trans_mode nccl, crashing workers and triggering node failure.
Deno 2.7.0 through 2.9.7 on Windows escapes shell arguments for the wrong shell type, so an argument containing a quote can break out of quoting and run arbitrary OS commands.
iperf3 before 3.22 crashes its UDP receive worker into an unrecoverable infinite loop when it receives a crafted control-channel parameter message followed by a single 16-byte UDP datagram, pinning a thread at 100 percent CPU until SIGKILL.
Nginx Proxy Manager through 2.16.0 has no rate limiting on the login and 2FA endpoints, so unauthenticated attackers can brute-force credentials and TOTP codes to gain full administrative control.
mall4j through 4.0 leaves PUT /user/updatePwd without authentication, letting anyone reset any storefront account password by supplying the target username in the request body.
When max-incoming-payload-size is unlimited, libsoup's SoupWebsocketConnection grows its incoming buffer from an attacker-controlled frame length until it wraps, causing a heap buffer overflow while reading frame data.
When building a masked WebSocket client frame for a very large outgoing payload, libsoup passes truncated size values to allocation APIs while the masking routine uses the full length, causing a heap buffer overflow.
CTranslate2 before 4.8.1 fails to validate payload length against the allocated buffer when loading binary model files, allowing a crafted model to cause a heap-based buffer overflow and arbitrary code execution.
VLC media player before 3.0.24 fails to validate member names in .vlt skin archives, allowing a crafted skin to write arbitrary files and execute code through Lua script injection.
SurrealDB before 3.3.0 verifies credentials against the Surreal-Auth-NS and Surreal-Auth-DB headers but builds the session from the unauthenticated Surreal-NS and Surreal-DB headers, letting an authenticated user cross tenant boundaries.
A remote authenticated attacker can execute arbitrary code on IBM DataStage on Cloud Pak for Data 5.4.0.0 because archive extraction does not properly validate entry paths.
A privileged authenticated CLI user of IBM Guardium Data Protection 12.2 can inject shell commands into the certificate export function and execute them with root privileges.
An authenticated remote attacker can exploit path traversal in the IBM Guardium Data Protection 12.2 Datasource REST component to delete arbitrary files and degrade system integrity.
Unsloth Zoo before 2026.8.14 builds a Python import statement from model_type values without an allowlist, so a crafted config.json newline injects arbitrary Python that runs when the model is loaded.
LiteLLM's JWT flow falls back to an email-based user lookup without checking the email_verified claim, so a token from the configured identity provider with a victim's email inherits the victim's role, including proxy_admin.
The InputSql function in class/database.py of aaPanel BaoTa passes the attacker-supplied Password parameter into a shell command, so an authenticated panel user can execute arbitrary commands as root. A working public exploit exists and no vendor fix has been published.
The merge_split_file endpoint in aaPanel BaoTa builds a shell command around the attacker-supplied split_file_path argument, so an authenticated panel user can execute arbitrary commands as root. A working public exploit exists and no vendor fix has been published.
The panelTask.bt_task._unzip function in aaPanel BaoTa interpolates the attacker-supplied Password argument into a shell command, so an authenticated panel user can execute arbitrary commands as root. A working public exploit exists and no vendor fix has been published.
A prefix-match flaw in vm2's NodeVM external-module resolver lets untrusted guest code load non-allowlisted modules through the host require, escaping the sandbox.
MONAI's bundle engine resolves _target_ values to arbitrary importables and passes $ expressions to eval(), so a malicious bundle runs code on load.
A local user with write access to a shared MONAI cache directory can plant a malicious pickle that executes code in another user's pipeline.
The algo_from_pickle function in MONAI's auto3dseg module runs pickle.loads() on attacker-supplied files, executing arbitrary system commands.
The nnUNetV2Runner concatenates user-controlled config values into a shell command, so a crafted YAML runs arbitrary commands as the training user.
The NumpyReader unconditionally loads .npy and .npz files with allow_pickle=True, so a malicious data file executes code in the data pipeline.
In MONAI before 1.5.2, algo_from_pickle passes attacker-supplied pickle files straight to pickle.loads, executing arbitrary code in the application.
AzuraCast's sortOrder API parameter accepts arbitrary DQL expressions with no authentication, exposing user credentials and station settings.
AzuraCast fails to quote streamer usernames in Liquidsoap config generation, so an authenticated station user gets command execution as the Liquidsoap user.
An incomplete sanitization migration in AzuraCast lets users with RemoteRelays permission inject Liquidsoap interpolation syntax into relay passwords for code execution.
AzuraCast's config writer fails to sanitize Liquidsoap string interpolation, so Media or Profile users can inject shell commands that run when the station restarts.
Sylius built admin password-reset links from the unvalidated request Host header, letting unauthenticated attackers divert reset tokens to their own domains and seize admin accounts.
Sylius issued Admin and Shop API JWTs without firewall identification, so a token from a shop account registered with an admin email was accepted by the Admin API.
Sylius 2.x did not revalidate payment amounts during cart recalculation, so an attacker could pay a small amount, enlarge the order, and have it marked fully paid.
pnpm expanded ${VAR} placeholders in proxy settings from a repo-controlled pnpm-workspace.yaml, routing install traffic and secrets like NPM_TOKEN through attacker hosts.
Fleet-maintained macOS install and uninstall scripts generated from Homebrew cask metadata failed to escape shell metacharacters at every site, allowing root command execution via upstream cask content.
Obot before 0.23.0 exposed OAuth dynamic client registration without authentication or redirect-URI limits, letting attackers mint victim-scoped tokens usable across the whole API.
Obot before 0.23.0 did not validate destinations when privileged users registered remote MCP servers, enabling SSRF against internal services and cloud metadata endpoints.
The documented Obot Docker quickstart listened on 0.0.0.0:8080 with auth disabled, mapping every request to an Owner-role synthetic user, while mounting the host Docker socket.
Obot before 0.21.1 did not enforce Access Control Rules on the /mcp-connect endpoint, letting any authenticated user reach restricted MCP servers and their stored OAuth credentials.
Nezha 2.2.3 reflects an attacker-supplied Host header into the OAuth2 redirect_uri when dashboard_host is empty, letting an attacker capture authorization codes and take over accounts.
Flowise through 3.1.4 (enterprise/platform mode with SSO) has an authentication bypass in the SSO login path: when an SSO callback arrives with an email matching a user in INVITED status, the server copies the stored single-use invitation tempToken into the registration check instead of requiring the caller-supplied token. Anyone who can authenticate at a configured SSO provider with a pending invitee's email can take over the invitation and its organization access. No patched version is available.
Flowise through 3.1.4 resolves SSO and local-password users solely by email, without storing provider or subject-identifier bindings. An attacker can authenticate as any existing user by claiming their email at any configured SSO provider, gaining complete access to chatflows, credentials, and API keys. No patched version is available.
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. In queue mode with the dashboard enabled outside cloud mode, the /admin/queues mount validates the JWT but performs no role, permission, or workspace scoping, so any authenticated user, including the lowest-privileged member of any tenant, can view queues and job payloads across the instance (chat inputs, credentials in overrideConfig, chatflow definitions) and use write actions like retry, remove, and promote. No patched version is available.
Parse Server before 8.6.90 (and 9.0.0 before 9.10.1-alpha.9) does not validate the type of client-supplied installation fields before building database queries in the device-token deduplication logic. An unauthenticated remote attacker who knows only the public application ID can inject query operators to make the elevated deduplication cleanup delete every device registration in the application, killing push delivery until every client re-registers. No workaround other than upgrading exists.
Netty's HttpServerCodec tracks the HTTP method of each still-unanswered pipelined request in an unbounded queue. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on one connection while withholding reads can grow that queue without bound, exhausting heap and denying service. Fixed in 4.1.138.Final and 4.2.18.Final.
Netty's StompSubframeDecoder allocates a chunk buffer while waiting for a frame's terminating NUL byte and never releases it if the byte never arrives. A remote peer can leak one allocator buffer per connection by sending a well-formed frame body and withholding the NUL terminator, accumulating memory for the process lifetime. Fixed in 4.1.138.Final and 4.2.18.Final.
Netty's HTTP/3 codec retains unbounded per-stream QPACK encoder state keyed by the peer-controlled QUIC stream ID, released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation. A remote, unauthenticated HTTP/3 client that advertises a non-zero dynamic-table capacity and omits the mandatory acknowledgments can grow heap without bound over a single connection. Fixed in 4.2.18.Final.
Netty's HTTP/3 QPACK prefixed-integer decoder does not bound the number of continuation bytes it processes. A remote, unauthenticated peer can send an endless run of continuation bytes on a QPACK unidirectional stream; each decode re-scans the whole accumulated buffer, yielding quadratic CPU cost and unbounded heap growth. Fixed in 4.2.18.Final.
Netty's HTTP/3 QPACK encoder-stream instruction decoder accepts an attacker-declared string-literal length of up to roughly 2 GiB with no per-instruction cap. A remote, unauthenticated peer that declares a huge literal length and trickles fewer bytes than declared makes the per-connection buffer grow without bound, ending in OutOfMemoryError. Fixed in 4.2.18.Final.
Netty's HTTP/3 codec mishandles HTTP/1 CONNECT authority-form request-targets when converting to HTTP/3: the CONNECT target's host is emitted as the scheme, the path becomes /, and the HTTP/1 Host header becomes the authority, or the target is dropped entirely. In an HTTP/1-to-HTTP/3 proxy, a client can bypass tunnel allow-lists and egress policy with a CONNECT whose Host header names a different authority than the request-target. Fixed in 4.2.18.Final.
Netty's HTTP/3 codec builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form request-target, contrary to the HTTP/1.1 rule that the request-target authority must win. A remote client can send 'GET https://trusted.example/admin' with 'Host: attacker.example' so authorization and routing decisions split from what the upstream HTTP/3 peer receives. Fixed in 4.2.18.Final.
Netty 4.2.11.Final through 4.2.17.Final contains an incomplete hostname-verification fix in the QUIC certificate verification path when using a plain X509TrustManager: the BoringSSL verify callback discards the SSLEngine, so endpoint identification never runs even when HTTPS verification is configured. A network-path attacker can present a certificate for the wrong hostname that the trust manager accepts. Fixed in 4.2.18.Final.
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In web.config for IIS, every deny rule sets ignoreCase='false', overriding the IIS default; on case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder or extension (e.g. requesting /user/CONFIG/system.YAML) so no deny rule matches and the static file handler returns the file, disclosing configuration secrets or account password hashes. Fixed in 2.0.25; operators must re-copy the corrected sample files after upgrading because the installer heal does not touch web.config or lighttpd.conf.
Grav CMS 2.0.14 through 2.0.24 has a privilege escalation in the group and account blueprints: the access map guard 'admin.super' is resolved by the field's exact path, so a submitted flat dot-notation key like 'access.admin.super' matches no blueprint rule, survives filtering, and is written by setNestedProperty, which splits on dots and rebuilds the nested value. An authenticated backend operator with admin.users but not admin.super can grant admin.super to their own account or group, escalating to full super-admin with control over configuration, plugins, themes, the file manager, and all accounts. Fixed in 2.0.25.
Grav 2.0.19 through 2.0.24 (and 1.7.x with content Twig explicitly enabled) renders page content from a page-write user through a Twig sandbox that allowlists get_cookie(), returning any cookie of the current request, including the session cookie, server-side where HttpOnly offers no protection. The finished output is stored in a page-content cache keyed without any session or user dimension. A page published by a page-write user can capture the session identifier of the next administrator who views it, and the cache then serves that identifier to unauthenticated visitors, who replay the cookie to authenticate as the administrator. Fixed in 2.0.25; 1.7.x is outside the backport scope.
The Comments plugin for Grav CMS through 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check: it branches on isAdmin(), which only indicates the admin service is registered on the route rather than that the visitor is authenticated, and it echoes the JSON before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled, an unauthenticated remote attacker can request the comments admin route and retrieve every comment from the last 7 days, including commenter email addresses and the absolute server filesystem path of the data file. Fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath.
The Grav Data Manager plugin 1.0.1 through 1.4.4 renders stored data entries in the item-detail view without escaping, applying Twig's raw filter, in some cases after a striptags call that PHP's strip_tags bypasses by preserving allowed tags with attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with the administrator's privileges and CSRF token. Fixed in 1.4.5.
Budibase before 3.45.0 fails to disable external JSON reference resolution in the OpenAPI/Swagger import validator. An authenticated builder can embed file:// references in an OpenAPI specification submitted to the import endpoint and exfiltrate arbitrary local files, including environment variables carrying JWT secrets, API keys, and database credentials. Fixed in 3.45.0.
Budibase Server before 3.45.0 extracts user-supplied ZIP archives in the PWA icon upload endpoint without proper symlink validation. A BUILDER-role attacker can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution. Fixed in 3.45.0.
Budibase before 3.45.0 builds MySQL and MSSQL column-rename DDL by interpolating identifiers directly into a raw query string without applying its identifier-quoting helpers. An attacker with DDL rights on a connected datasource can create a column whose name contains a backtick or quote plus SQL; when a builder later renames that column through the UI, the embedded quote terminates the identifier and the injected SQL runs as the Budibase datasource user (MySQL connections allow stacked statements), enabling arbitrary reads, writes, or destructive operations outside Budibase's permission model. Fixed in 3.45.0.
Budibase 3.41.0 before 3.45.0 has an authentication bypass in the OIDC/SSO login path: when no existing user matches the incoming SSO subject, the server looks up pending invites by the IdP-asserted email alone, without validating an invite code or requiring email_verified. An attacker who can register at a trusted IdP and assert a victim's invited email claims the pending invite with all its privileges, including builder and admin.global, for full tenant compromise. Fixed in 3.45.0.
Budibase before 3.45.0 fails to scope the GET /api/chat-links endpoint by workspace. A builder with access to a single workspace can enumerate chat identity link records across all workspaces in the tenant, retrieving user IDs and external chat service identifiers from workspaces they have no permission to access. Fixed in 3.45.0.
Budibase before 3.45.0 fails to validate per-app authorization in POST /api/global/groups/:groupId/apps. A builder of a single workspace can exploit the missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings. Fixed in 3.45.0.
Hugo v0.161.0 through v0.165.0 runs Node.js tools (PostCSS, TailwindCSS, Babel) under the Node.js permission model to restrict file reads to the project directory, but the model validates only the lexical path and follows symlinks pointing outside the allowed set. A contributor can commit a symlink such as assets/css/x.css pointing at a sensitive file plus a PostCSS plugin that reads it, disclosing any file the Hugo build process can read, potentially embedded in the published site. Fixed in v0.166.0, which fails the build when a symlink resolves outside the allowed paths.
Hugo after v0.123.0 and before v0.166.0 stopped symlink confinement checks at the mount root itself, so a theme or vendored module could contain a symlink at a mount root (for example themes/mytheme/assets pointing outside the module). Files behind the symlink were readable during builds via resources.Get and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Fixed in v0.166.0.
Hugo v0.162.0 before v0.166.0 has a case-sensitive validation flaw in the security.http.urls IP-literal deny rule: mixed-case URL schemes in resources.GetRemote calls bypass the restriction, letting a build fetch from restricted IP addresses like localhost. Fixed in v0.166.0.
Adminer 6.0.0 through 6.0.1, with the official ClickHouse driver plugin loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL, making the Adminer server POST 'SELECT version()' to that host; when the target returns a non-2xx status, the raw response body lands on the login page. That enables internal network and port reconnaissance and leaks sensitive details from internal error pages. Fixed in 6.0.2.
nodemailer before 10.0.6 has a denial-of-service vulnerability in the addressparser free-text fallback regex, which exhibits quadratic backtracking. Crafted email header values with long whitespace-free runs can block the Node.js event loop for tens of seconds, taking the service down. Fixed in 10.0.6.
IBM Guardium Data Protection 12.2 passes attacker-controlled arguments from a crafted GIM bundle to the tar command, letting an authenticated attacker execute arbitrary commands with elevated privileges on the Central Manager.
BerriAI LiteLLM before 1.101.0-rc.1 has a tenant isolation bypass in the semantic cache layer that lets an authenticated user retrieve other tenants' cached responses, including PII, financial data, and source code.
A race condition in QEMU's 9pfs subsystem lets a malicious guest craft a fid path from stale heap data, escape the shared directory boundary, and read or write arbitrary host files or execute code as the QEMU process user.
A remote code execution flaw in Outlook rated HIGH at CVSS 8.8 lets an attacker run code as the user once a crafted message is opened or previewed.
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 lets a remote unauthenticated attacker send crafted SQL statements to view, add, modify, or delete information in the back-end database.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements used in an OS command, allowing a remote authenticated attacker to execute arbitrary code with low privileges.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements used in an OS command, letting a remote authenticated attacker execute arbitrary commands on the host.
Improper neutralization of special elements in an OS command in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to run arbitrary commands on the server.
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly neutralizes environment variables, allowing a remote authenticated attacker to execute arbitrary commands on the host.
IBM DataStage on Cloud Pak for Data 5.4.0.0 deserializes untrusted data without safety checks, allowing a remote authenticated attacker to execute arbitrary code on the server.
A path traversal flaw in pulpcore's content upload API lets an authenticated low-privilege user read any file the Pulp server can access; deployments with Pulp Container risk exposure of the token signing private key and forged access to all private container repositories.
SigNoz before 0.143.0 signed session tokens with an empty key when no JWT secret was configured, letting unauthenticated attackers forge admin session tokens.
DCMTK through 3.7.0 copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames, so a crafted DICOM instance triggers heap over-reads that crash the application or leak adjacent heap memory.
HFS2 2.4.0 and earlier lets an unauthenticated attacker embed template syntax in an uploaded filename, bypass the dispatcher authorization check, and execute arbitrary commands on the host with a crafted exec macro.
A remote attacker with no credentials can execute arbitrary code on IBM Financial Transaction Manager for RedHat OpenShift because user-controlled input reaches the new Function constructor.
IBM Financial Transaction Manager for RedHat OpenShift deserializes untrusted data, letting a remote attacker with no credentials execute arbitrary code.
A remote authenticated attacker can bypass symbolic-link validation in IBM Financial Transaction Manager for RedHat OpenShift to read sensitive files, rated critical at CVSS 9.9.
IBM Concert 1.0.0 through 3.0.0 incorporates specially crafted input into OS commands, allowing an unauthenticated remote attacker to execute arbitrary commands with the application's privileges.
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local user overflow a buffer and execute arbitrary code on the system.
IBM Concert 1.0.0 through 3.0.0 accesses memory after it has been freed, allowing an attacker who can influence program input to corrupt memory, crash the application, or execute arbitrary code.
An incomplete blocklist on the AWX container group pod_spec_override field lets an AAP platform administrator inject initContainers and service account overrides, escalating to OpenShift namespace-level access and secret exfiltration.
The AWX CopyAPIView POST handler never performs the object-level read check that the GET handler does, letting users copy job templates they are not allowed to read.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements in OS commands, letting a remote authenticated attacker execute arbitrary commands.
Improper escaping of connector property values during OSH script generation in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker execute arbitrary code.
A further OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker execute arbitrary commands through improperly neutralized special elements.
The automation controller's job output view expands ANSI OSC 8 hyperlinks into clickable anchors without filtering schemes, letting a low-privilege user plant javascript: links that execute in a higher-privileged viewer's session.
An administrator-controlled log message template in automation controller is rendered with a live user object, allowing format string traversal that reads the Django secret key and database password into forwardable logs.
Copying a WorkflowJobTemplate in automation controller skips permission checks on instance groups, letting a workflow admin launch attacker-influenced automation in the control-plane execution context.
A compromised Flatpak repository can write attacker-controlled content to arbitrary host filesystem locations through extract_extra_data, running as root on system installs via symlink following and unsanitized path traversal.
An apostrophe in an OpenAPI path segment breaks out of single-quoted route literals in @orval/hono output, injecting arbitrary JavaScript that executes when the generated module is imported.
Schema defaults containing ${...} syntax are converted into template literals by the @orval/effect generator, executing injected JavaScript at module scope when the generated code is built or imported.
orval emits the operationId into generated TanStack Query mutator metadata without escaping, so a crafted operationId in an OpenAPI spec injects JavaScript that runs when the generated hooks are called.
A chained authorization flaw in Meta Box AIO (and the standalone Meta Box Frontend Submission and Meta Box User Profile plugins) lets unauthenticated attackers overwrite any page with a crafted shortcode and register an Administrator account. Fixed in Meta Box AIO 3.12.0.
SolarWinds Observability Self-Hosted contains an unauthenticated remote code execution flaw from insufficient integrity checks, affecting non-default, non-secure configurations. CVSS 9.8.
SolarWinds Observability Self-Hosted is affected by an unauthenticated remote code execution flaw from deserialization of untrusted data in a specific communication mode. CVSS 8.8.
A path traversal flaw in Adobe Connect lets an unauthenticated attacker read arbitrary files outside the intended scope. CVSS 8.6.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
A SQL injection flaw in Adobe Connect lets a low-privileged attacker execute arbitrary SQL and reach code execution with changed scope. CVSS 9.9.
A stored cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
A stored cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
A reflected cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
An incorrect authorization flaw in Adobe Campaign Classic lets an unauthenticated attacker reach arbitrary code execution without user interaction. CVSS 9.1.
An incorrect authorization flaw in Adobe Experience Manager Forms JEE lets an unauthenticated attacker execute arbitrary code with changed scope. CVSS 10.0.
An unauthenticated-facing but credentialed command injection via the undocumented mfc eeprom write command lets any authenticated user run arbitrary shell commands as root on Lantronix SLC8000, EMG8500/7500 and sibling out-of-band management devices. CVSS 9.9.
A command injection in the set cifs password command on Lantronix out-of-band devices lets authenticated users with the services permission run arbitrary commands as root. CVSS 9.1.
A stack-based buffer overflow in the undocumented mfc eeprom read command on Lantronix out-of-band devices lets any authenticated user potentially execute arbitrary code by supplying oversized input. CVSS 9.9.
A server-side request forgery in the WebSSH/WebTelnet listener of Lantronix out-of-band devices lets an unauthenticated attacker redirect SSH terminal connections to arbitrary hosts and probe internal networks. CVSS 8.6.
An OS command injection in the set nfs download command on Lantronix out-of-band devices lets authenticated users with the services permission execute arbitrary commands as root. CVSS 9.1.
An OS command injection in the set script schedule command on Lantronix out-of-band devices lets authenticated users with the services permission execute arbitrary commands as root. CVSS 9.1.
A path-truncation flaw in the web management portal of Lantronix out-of-band devices lets unauthenticated attackers bypass session checks, read sensitive config files, and upload files anywhere, leading to remote code execution. CVSS 10.0.
A path traversal flaw in the web management upload endpoint of Lantronix out-of-band devices lets authenticated attackers write arbitrary files anywhere on the filesystem, leading to remote code execution. CVSS 9.1.
An improper input validation flaw in Adobe Experience Manager Forms JEE lets an attacker with high privileges execute arbitrary code. CVSS 9.1.
A server-side request forgery flaw in Adobe Experience Manager Forms JEE lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.6.
An improper input validation flaw in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code, though exploitation depends on conditions beyond the attacker's control. CVSS 8.5.
A SQL injection flaw in Adobe Campaign Classic lets an attacker with high privileges execute arbitrary SQL commands and reach code execution. CVSS 9.1.
A SQL injection flaw in Adobe Campaign Classic lets a low-privileged attacker bypass security measures and gain unauthorized read and limited write access. CVSS 9.1.
A server-side request forgery flaw in Adobe Campaign Classic lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.9.
A server-side request forgery flaw in Adobe Campaign Classic can be exploited without authentication to escalate privileges against internal resources. CVSS 9.9.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
An improper code-generation flaw in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code with changed scope. CVSS 9.9.
An unauthenticated local file inclusion flaw in the HUSKY Products Filter for WooCommerce Professional plugin lets visitors include and execute arbitrary .php files via the 'shortcode' parameter, because the only nonce check uses a value emitted into every front-end page.
A privilege escalation flaw in CUPS with the cups-filters serial backend lets a local user in the lpadmin group point a printer's device URI at an arbitrary path, so the root-privileged backend writes attacker-controlled data to any file. A public proof of concept exists.
Vaultwarden through 1.37.3 fails to validate organization membership status in cipher access queries, so revoked and unconfirmed members retain read, write, delete, and attachment access to organization secrets. CVSS 8.6.
CRI-O's container checkpoint/restore feature validates restore metadata insufficiently, so a privileged user restoring from crafted checkpoint content can perform unintended operations on the host filesystem. The feature is not enabled by default.
A tie-breaking bug in the pki-core v2 REST ACL filter resolves colliding literal and wildcard ACL keys by lexicographic comparison instead of specificity, letting the Certificate Manager Agents group's lower-privileged profiles.approve override the Administrator-only profiles.create required by POST /v2/profiles/raw.
Kamailio's CDP Diameter receiver has a heap-based buffer overflow in shm_malloc that can be triggered remotely with a crafted message. A public exploit exists. Fixed in 6.0.8 with upstream patch commits available for other branches.
Expat through 2.8.4 fails to validate low surrogates after high surrogates in UTF-16 input, letting lone high surrogates swallow following code units and hide markup from the parser. Fixed upstream via PR #1282.
Argo Workflows 4.1.0 through 4.1.3 skips cluster-scoped access review in ListArchivedWorkflows when the metadata.namespace selector uses the NotEquals operator, letting namespace-scoped users read archived workflows from other namespaces. Fixed in 4.1.4.
Mistral Vibe before 2.25.5 executes git hooks during worktree creation before trust validation, so opening a crafted repository can run arbitrary shell commands with the user's privileges. Fixed in 2.25.5.
getID3 before 1.9.26 concatenates media filenames into shell commands without escaping, letting attackers inject arbitrary OS commands that run with the PHP process's privileges. Fixed in 1.9.26.
OpenShift's console exposes devfile endpoints that let remote attackers force internal requests or exhaust console memory.
Deserialization of untrusted data can let a remote unauthenticated attacker execute arbitrary code on IBM Guardium Data Protection 12.2.
A flaw in vm2's bridge lets sandboxed code reach the host global object and execute arbitrary commands when a non-strict host function is exposed.
NodeVM's denylist omits child_process, so sandboxed code can execute arbitrary host commands when builtins are broadly allowed.
A logic error in the Pixel cellular modem allows adjacent-network privilege escalation with no user interaction; the September 2026 patch level fixes it.
An unauthenticated API request can bypass authentication on Cisco Identity Services Engine and ISE Passive Identity Connector, and Cisco warns successful exploitation can lead to root command execution.
A SQL injection flaw in the email parsing of Cisco AsyncOS for Secure Email Gateway lets an unauthenticated attacker execute arbitrary commands with root privileges by sending a malicious email.
JFrog Artifactory validates token signatures but not token scopes, so an attacker with a low-privileged token can escalate to administrative privileges. Wiz observed in-the-wild chaining into full admin takeover.
A missing-authorization flaw in the ScreenConnect client lets an attacker transfer and execute files through an active remote session without host confirmation. ConnectWise fixed it in ScreenConnect 26.6.5; CISA confirms active exploitation.
A path traversal flaw in GitLab's repository commits API lets an unauthenticated attacker read arbitrary files from a self-managed server. Fixed in GitLab 19.1.8, 19.2.6, and 19.3.2; CISA confirms active exploitation.
A heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE lets an attacker execute code via crafted packets. SOCRadar links in-the-wild exploitation to the PivotC2 malware campaign; CISA confirms active exploitation.
An authentication bypass in NetScaler ADC and Gateway lets an unauthenticated remote attacker skip authentication on Gateway and AAA deployments. Fixed in builds 14.1-73.32 and 13.1-63.21; CISA confirms active exploitation.
An authentication bypass in Cisco Secure Firewall Management Center lets an unauthenticated remote attacker execute scripts as root. Cisco confirms active exploitation by multiple threat clusters, including ransomware and state-sponsored actors.
An out-of-bounds write in Chrome's V8 engine lets a remote attacker run code inside the browser sandbox via a crafted page. Fixed in Chrome 153.0.8010.36; Google confirms an exploit exists in the wild.
A template-engine flaw in Adobe Commerce and Magento Open Source lets an unauthenticated attacker inject PHP and get code execution during email rendering. Adobe shipped emergency hotfix VULN-39341; exploitation began before the patch.
A link-following flaw in the Windows Update Stack lets a local attacker escalate to SYSTEM. Microsoft patched it on September 8, 2026, and confirms it was exploited as a zero-day.
A heap-based buffer overflow in Windows ALPC lets code running in a low-privilege AppContainer escalate to SYSTEM. Microsoft patched it on September 8, 2026, and confirms in-the-wild exploitation.
Starlette versions before 1.0.1 rebuild request.url from an unvalidated Host header, so middleware gating on the URL path can be bypassed with a crafted header.
An OAuth2 passthrough fallback in LiteLLM's MCP Streamable HTTP endpoint lets an unauthenticated attacker use a fabricated Bearer token to establish an authenticated MCP session and reach configured tools.
An unsafe dynamic class loading flaw in PaperCut NG/MF lets attackers execute Java bytecode on the server; PaperCut confirms active exploitation and customer incidents.
ownCloud core 10.6.0 through 10.13.0 accepts pre-signed URLs even when no signing key is configured, allowing unauthenticated access to any user's files.
CVE-2019-1068, a remote code execution flaw in SQL Server from 2019, was added to the KEV catalog in 2026: unpatched legacy database servers are being hit.
An attacker with write access to a Gitea repository can abuse the diffpatch API to plant an executable Git hook and run arbitrary commands as the Gitea service account.
A URI-normalization inconsistency between Oracle HTTP Server and the WebLogic proxy plug-in lets an unauthenticated attacker bypass access controls and reach or modify backend application data.
An unauthenticated attacker can send specially crafted SMTP requests to Zimbra Collaboration Suite and trigger OS command injection through SNMP notification processing when the zimbra-snmp package is installed.
An unauthenticated MLflow webhook test can follow redirects into internal services or cloud metadata endpoints and return their responses.
A critical double-free flaw in the Windows IKE service can allow an unauthenticated network attacker to execute code on a reachable system.
A critical JWT authentication weakness can let an unauthenticated network attacker bypass SharePoint security controls and access protected data.
A critical directory-traversal flaw in the vCenter Syslog server can allow an unauthenticated network attacker to execute arbitrary code.
A critical state-management flaw can let a network attacker authenticate to macOS Screen Sharing without valid credentials.
Ray's browser-based request protection relies on a User-Agent check that Firefox and Safari can bypass, and combined with DNS rebinding it lets a malicious website execute code on a developer's Ray instance.
A heap-inspection flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD lets an unauthenticated attacker force the device to reload, causing a denial of service.
A use-after-free race in the Windows AFD driver let local attackers escalate to SYSTEM. Microsoft patched it August 11, 2026; Check Point attributes zero-day exploitation to the Lazarus Group's Operation Dream Job.
An unauthenticated SQL-injection path can lead to Metabase administrator access, exposed database credentials, and data theft.
An incomplete earlier fix lets attackers bypass Apache Tomcat's EncryptInterceptor, sending unencrypted cluster messages that reach Java deserialization and enable unauthenticated remote code execution.
Attackers who previously compromised a FortiGate at the filesystem level can bypass the patch for Fortinet's symlink persistence mitigation and read sensitive files via crafted HTTPS requests.
CISA reports that unsafe deserialization in the TeamCity agent polling protocol can permit unauthenticated remote code execution.
An improper authentication vulnerability in Azure Key Vault allows an unauthorized attacker to elevate privileges over the network, rated CVSS 10.0.
A sandbox escape in TeamCity's Kotlin DSL handling allows code execution on the server, fixed in TeamCity 2025.11.6 and 2026.1.2.
An unauthenticated attacker can obtain an application login token from an internet-exposed Check Point Management Server and log in via SmartConsole with full administrative privileges.
Deserialization of untrusted data in SharePoint lets an unauthorized attacker execute code over the network with no authentication, rated CVSS 9.8.
An invalid pointer in Firefox's Disability Access APIs allows a sandbox escape, fixed in Firefox 153 and Thunderbird 153.
A SQL injection in WordPress's author__not_in query parameter, chained with a REST API flaw, gives unauthenticated remote code execution on default installs.
Insufficient access control granularity in AD FS allows an authorized local attacker to elevate to administrator; Microsoft reports functional exploit code and detected exploitation.
A CVSS 10.0 path traversal in ColdFusion 2025.9 / 2023.20 and earlier allows unauthenticated remote code execution, and Adobe confirms limited in-the-wild exploitation.
CISA says default Langflow deployments may permit unauthenticated attackers to achieve full remote code execution.
SimpleHelp 5.5.15 and earlier accept OIDC identity tokens without verifying their signature, letting an unauthenticated attacker log in as any user.
Gemini CLI in headless CI mode auto-trusted workspace folders, so a malicious .gemini/.env file could execute code on the host before sandboxing applied.
Traefik's StripPrefix middleware normalizes crafted paths after routing, letting unauthenticated requests reach backends that a separate router meant to protect.
When @n8n/mcp-browser runs in HTTP transport mode, its MCP endpoint accepts session and tool requests with no authentication, exposing browser control to any network client.
Langflow OSS combines a Python builtins injection flaw with default auto-login, giving unauthenticated attackers remote code execution on the host.
An improper authentication flaw in Azure Active Directory lets an unauthorized attacker elevate privileges over the network, with a CVSS 10.0 rating.
CISA says an unauthenticated attacker can execute arbitrary commands through unsanitized input in multiple LoadMaster command endpoints.
| Published | Advisory | Technology | Signal | Priority |
|---|---|---|---|---|
IBM WebSphere Extreme ScaleCVE-2026-101117 | Application server, Java, Enterprise software | Disclosed | Act now | |
IBM QRadarCVE-2026-105467 | SIEM, Security monitoring, Enterprise software | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-107331 | Data integration, Cloud Pak for Data, Enterprise software | Disclosed | Act now | |
IBM TRIRIGA Application PlatformCVE-2026-110273 | Facilities management, Enterprise software | Disclosed | High priority | |
IBM Process MiningCVE-2026-114464 | Process mining, Analytics, Enterprise software | Disclosed | Act now | |
IBM Qiskit SDKCVE-2026-116499 | Quantum computing, Python, Developer infrastructure | Disclosed | High priority | |
IBM Qiskit SDKCVE-2026-116501 | Quantum computing, Python, Developer infrastructure | Disclosed | High priority | |
IBM webMethods Integration ServerCVE-2026-117545 | Integration, Middleware, Enterprise software | Disclosed | High priority | |
IBM webMethods Integration ServerCVE-2026-118904 | Integration, Middleware, Enterprise software | Disclosed | High priority | |
OpenIdentityPlatform OpenAMCVE-2026-123543 | Identity and access management, Authentication, Single sign-on | Disclosed | High priority | |
OpenIdentityPlatform OpenAMCVE-2026-123549 | Identity and access management, Authentication, Single sign-on | Disclosed | Act now | |
OpenIdentityPlatform OpenAMCVE-2026-123550 | Identity and access management, Authentication, Single sign-on | Disclosed | Act now | |
OpenIdentityPlatform OpenAMCVE-2026-123551 | Identity and access management, Authentication, Single sign-on | Disclosed | Act now | |
sveltejs devalueCVE-2026-123562 | JavaScript, Web application, Developer infrastructure | Disclosed | High priority | |
hickory-dns Hickory DNSCVE-2026-123570 | DNS, Networking, Developer infrastructure | Disclosed | High priority | |
hickory-dns Hickory DNSCVE-2026-123580 | DNS, Networking, Developer infrastructure | Disclosed | High priority | |
hickory-dns Hickory DNSCVE-2026-123595 | DNS, Networking, Developer infrastructure | Disclosed | High priority | |
hickory-dns Hickory DNSCVE-2026-123605 | DNS, Networking, Developer infrastructure | Disclosed | High priority | |
imgproxy imgproxyCVE-2026-123614 | Image processing, Web application | Disclosed | Act now | |
imgproxy imgproxyCVE-2026-123615 | Image processing, Web application | Disclosed | High priority | |
imgproxy imgproxyCVE-2026-123616 | Image processing, Web application | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-124427 | Content management, Web application | Disclosed | Act now | |
Craft CMS Craft CMSCVE-2026-124429 | Content management, Web application | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-124430 | Content management, Web application | Disclosed | High priority | |
Scriban ScribanCVE-2026-124437 | .NET, Templating, Developer infrastructure | Disclosed | High priority | |
Scriban ScribanCVE-2026-124438 | .NET, Templating, Developer infrastructure | Disclosed | Act now | |
Scriban ScribanCVE-2026-124439 | .NET, Templating, Developer infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-124440 | Kubernetes, Policy engine, Cloud infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-124441 | Kubernetes, Policy engine, Cloud infrastructure | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124445 | Electronic health records, Healthcare, Web application | Disclosed | Act now | |
OpenEMR OpenEMRCVE-2026-124446 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124447 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124448 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124450 | Electronic health records, Healthcare, Web application | Disclosed | Act now | |
OpenEMR OpenEMRCVE-2026-124459 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124461 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124463 | Electronic health records, Healthcare, Web application | Disclosed | Act now | |
OpenEMR OpenEMRCVE-2026-124467 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124469 | Electronic health records, Healthcare, Web application | Disclosed | Act now | |
OpenEMR OpenEMRCVE-2026-124471 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124472 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124477 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124480 | Electronic health records, Healthcare, FHIR | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124483 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124484 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124486 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124488 | Electronic health records, Healthcare, Web application | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-124490 | Electronic health records, Healthcare, Web application | Disclosed | Act now | |
IBM ConcertCVE-2026-15266 | Generative AI, Enterprise software | Disclosed | Act now | |
IBM OptimCVE-2026-17466 | Test data management, Enterprise software | Disclosed | Act now | |
IBM Storage TS4500 LibraryCVE-2026-19133 | Storage, Tape library, Enterprise hardware | Disclosed | High priority | |
IBM ConcertCVE-2026-6715 | Generative AI, Enterprise software | Disclosed | Act now | |
IBM Security Verify DirectoryCVE-2026-8639 | Identity and access management, Directory services, Enterprise software | Disclosed | High priority | |
IBM BobCVE-2026-9764 | Developer infrastructure, Enterprise software | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97677 | AI, Low-code, Developer infrastructure | Disclosed | High priority | |
Microsoft Entra Device RegistrationCVE-2026-109469 | Identity and access management, Cloud infrastructure | Disclosed | Act now | |
LatePoint LatePointCVE-2026-118066 | WordPress, Web application | Disclosed | Act now | |
Red Hat KeycloakCVE-2026-120984 | Identity and access management, Authentication, Single sign-on | Disclosed | Act now | |
IBM Aspera FaspexCVE-2026-123218 | File transfer, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-16720 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-16884 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-16920 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17117 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17132 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17278 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17297 | API management, Enterprise software | Disclosed | High priority | |
IBM API ConnectCVE-2026-17299 | API management, Enterprise software | Disclosed | High priority | |
IBM API ConnectCVE-2026-17301 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17313 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17340 | API management, Enterprise software | Disclosed | Act now | |
IBM API ConnectCVE-2026-17360 | API management, Enterprise software | Disclosed | Act now | |
Craft CMS Craft CMSCVE-2026-123488 | Content management, Web applications | Disclosed | Act now | |
Craft CMS Craft CMSCVE-2026-123490 | Content management, Web applications | Disclosed | High priority | |
Agenta AgentaCVE-2026-123786 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
CivetWeb CivetWebCVE-2026-124040 | Web servers, Embedded systems, Developer infrastructure | Disclosed | Act now | |
TooTallNate plist.jsCVE-2026-124078 | Developer infrastructure, JavaScript, Web applications | Disclosed | High priority | |
Skyline Communications DataMinerCVE-2026-89017 | Network management, Media infrastructure | Disclosed | High priority | |
Keycloak KeycloakCVE-2026-112208 | Identity and access management, Authentication, Single sign-on | Disclosed | Act now | |
GiveWP GiveWPCVE-2026-118193 | WordPress, E-commerce, Donations | Disclosed | High priority | |
Dulwich DulwichCVE-2026-122299 | Developer infrastructure, Python, Supply chain | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122302 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122303 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122304 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122305 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122306 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122307 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122308 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122310 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122311 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122312 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122313 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122314 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122315 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122316 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122319 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122320 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122321 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | Act now | |
Kyverno KyvernoCVE-2026-122322 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Kyverno KyvernoCVE-2026-122323 | Kubernetes, Policy engine, Critical infrastructure | Disclosed | High priority | |
Keycloak KeycloakCVE-2026-92857 | Identity and access management, Authentication, OAuth, OpenID Connect | Disclosed | Act now | |
LiteSpeed Cache LiteSpeed CacheCVE-2026-93389 | WordPress, Web server, E-commerce | Disclosed | High priority | |
Keycloak KeycloakCVE-2026-96453 | Identity and access management, Administration tooling, TLS | Disclosed | High priority | |
Keycloak KeycloakCVE-2026-97175 | Identity and access management, Authentication, Single sign-on | Disclosed | Act now | |
IBM IBM MQCVE-2026-11376 | Messaging, Enterprise infrastructure | Disclosed | High priority | |
IBM IBM MQCVE-2026-11724 | Messaging, File transfer, Enterprise infrastructure | Disclosed | High priority | |
Mistral AI Mistral VibeCVE-2026-122133 | AI, Developer tools, Coding agents | Disclosed | High priority | |
Mistral AI Mistral VibeCVE-2026-122134 | AI, Developer tools, Coding agents | Disclosed | High priority | |
Mistral AI Mistral VibeCVE-2026-122135 | AI, Developer tools, Coding agents | Disclosed | High priority | |
WPO365 WPO365 LoginCVE-2026-122220 | WordPress, Authentication, Single sign-on | Disclosed | Act now | |
IBM IBM MQCVE-2026-13271 | Messaging, File transfer, Enterprise infrastructure | Disclosed | High priority | |
IBM IBM MQCVE-2026-13292 | Messaging, File transfer, Enterprise infrastructure | Disclosed | High priority | |
IBM Watson Speech Services CartridgeCVE-2026-82418 | AI, Speech recognition, Containers | Disclosed | Act now | |
ACF Extended ACF Extended PROCVE-2026-120534 | WordPress, Content management, Developer infrastructure | Disclosed | Act now | |
Easy Digital Downloads Easy Digital DownloadsCVE-2026-120538 | WordPress, E-commerce, Payment processing | Disclosed | High priority | |
SureCart SureCartCVE-2026-120574 | WordPress, E-commerce, Authentication | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-121386 | Remote desktop, Developer infrastructure | Disclosed | High priority | |
SurrealDB SurrealDBCVE-2026-121419 | Databases, Developer infrastructure, AI | Disclosed | High priority | |
Argo Argo CD Image UpdaterCVE-2026-121621 | GitOps, Kubernetes, Developer infrastructure | Disclosed | Act now | |
LobeHub LobeHub ChatCVE-2026-120315 | AI, Collaboration, Developer infrastructure | Disclosed | High priority | |
mpdavis python-joseCVE-2026-120459 | Authentication, Python, Developer infrastructure | Disclosed | Act now | |
ReadyMedia ReadyMediaCVE-2026-29508 | Media server, DLNA, Embedded devices | Disclosed | High priority | |
Dell OpenManage EnterpriseCVE-2026-91909 | Systems management, Enterprise infrastructure, Server management | Disclosed | High priority | |
Konflux Konflux CICVE-2026-114217 | Developer infrastructure, CI/CD | Disclosed | High priority | |
Konflux Konflux CICVE-2026-116086 | Developer infrastructure, CI/CD | Disclosed | High priority | |
Konflux Konflux CICVE-2026-116964 | Developer infrastructure, CI/CD | Disclosed | High priority | |
Konflux Konflux CICVE-2026-117681 | Developer infrastructure, CI/CD, Kubernetes | Disclosed | High priority | |
WordPress WordPressCVE-2026-119977 | Web application, Content management | Disclosed | High priority | |
dromara JpomCVE-2026-120201 | Developer infrastructure, DevOps | Disclosed | Act now | |
RocketGenius Gravity FormsCVE-2026-103039 | WordPress, CMS, Web | Disclosed | Act now | |
n8n n8nCVE-2026-119408 | Automation, Workflow automation, Developer infrastructure | Disclosed | High priority | |
CakePHP CakePHPCVE-2026-119419 | Web framework, PHP, Developer infrastructure | Disclosed | High priority | |
Traefik TraefikCVE-2026-119572 | Kubernetes, Ingress, Networking | Disclosed | High priority | |
InternLM LMDeployCVE-2026-119706 | AI, Machine learning, LLM inference | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-119978 | AI, LLM applications, Developer infrastructure | Disclosed | High priority | |
Strategy11 Formidable FormsCVE-2026-89435 | WordPress, CMS, Web | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-101288 | AI, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-104317 | AI, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-104324 | AI, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-107326 | AI, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-107327 | AI, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-107328 | AI, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-107329 | AI, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-110186 | AI, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-110196 | AI, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-110309 | AI, Developer infrastructure | Disclosed | High priority | |
Agno AgnoCVE-2026-119050 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-119127 | Identity and access management, Authentication | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-119128 | Identity and access management, Authentication | Disclosed | Act now | |
Frappe Frappe FrameworkCVE-2026-119144 | Web frameworks, Business applications | Disclosed | High priority | |
OpenEMR OpenEMRCVE-2026-49142 | Healthcare, Electronic health records | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93680 | AI, Developer infrastructure | Disclosed | Act now | |
Juniper Networks Session Smart Router and Session Smart ConductorCVE-2026-103401 | Networking, SD-WAN | Disclosed | High priority | |
Juniper Networks Session Smart Router and Session Smart ConductorCVE-2026-103402 | Networking, SD-WAN | Disclosed | High priority | |
Juniper Networks Session Smart Router and Session Smart ConductorCVE-2026-103403 | Networking, SD-WAN | Disclosed | High priority | |
Juniper Networks Session Smart ConductorCVE-2026-103406 | Networking, SD-WAN | Disclosed | Act now | |
Juniper Networks Session Smart Router and Session Smart ConductorCVE-2026-103407 | Networking, SD-WAN | Disclosed | High priority | |
Juniper Networks Session Smart RouterCVE-2026-103408 | Networking, SD-WAN | Disclosed | High priority | |
Juniper Networks Session Smart RouterCVE-2026-103409 | Networking, SD-WAN | Disclosed | Act now | |
Juniper Networks Session Smart Router and Session Smart ConductorCVE-2026-106079 | Networking, SD-WAN | Disclosed | High priority | |
Samba SambaCVE-2026-109411 | File sharing, Storage | Disclosed | High priority | |
FasterXML jackson-databindCVE-2026-110879 | Java, Developer infrastructure, Serialization | Disclosed | Act now | |
Red Hat Red Hat OpenShift AICVE-2026-117574 | AI, Cloud | Disclosed | Act now | |
n8n n8nCVE-2026-118643 | Automation, Developer infrastructure | Disclosed | High priority | |
n8n n8nCVE-2026-118645 | Automation, Developer infrastructure | Disclosed | High priority | |
n8n n8nCVE-2026-118647 | Automation, Developer infrastructure | Disclosed | High priority | |
n8n n8nCVE-2026-118648 | Automation, Developer infrastructure | Disclosed | High priority | |
n8n n8nCVE-2026-118649 | Automation, Developer infrastructure | Disclosed | High priority | |
Project MONAI MONAICVE-2026-118683 | AI, Machine learning, Healthcare | Disclosed | High priority | |
Bytecode Alliance WasmtimeCVE-2026-118688 | WebAssembly, Developer infrastructure | Disclosed | High priority | |
Rank Math Rank Math SEOCVE-2026-1928 | WordPress, CMS, Web | Disclosed | High priority | |
Cisco Cisco Secure Firewall ASA and FTDCVE-2026-76418 | Networking, VPN | Disclosed | High priority | |
Red Hat Red Hat JBoss Enterprise Application PlatformCVE-2026-84725 | Java, Application servers | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-104350 | Enterprise software, Marketing automation, Web | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-104351 | Enterprise software, Marketing automation, Web | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-104353 | Enterprise software, Marketing automation, Web | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-104354 | Enterprise software, Marketing automation, Web | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-105489 | Enterprise software, Marketing automation, Web | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-105779 | Enterprise software, Marketing automation, Web | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-105780 | Enterprise software, Marketing automation, Web | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-105781 | Enterprise software, Marketing automation, Web | Disclosed | Act now | |
Veeam Veeam Backup for Microsoft 365CVE-2026-106076 | Backup, SaaS protection, Enterprise software | Disclosed | High priority | |
Tanium Threat ResponseCVE-2026-108329 | Endpoint security, Enterprise software | Disclosed | High priority | |
Google BrotliCVE-2026-111497 | Compression, Libraries, Open source | Known exploited | Act now | |
TeamViewer TeamViewerCVE-2026-111585 | Remote access, Endpoint software | Disclosed | High priority | |
GFI KerioConnectCVE-2026-112353 | Email, Collaboration, Web | Disclosed | Act now | |
Fastify @fastify/expressCVE-2026-112362 | Node.js, Web framework, Open source | Disclosed | High priority | |
The EPICS Community EPICS BaseCVE-2026-114595 | Industrial control systems, Critical infrastructure, Open source | Disclosed | Act now | |
Runatlantis AtlantisCVE-2026-116676 | Infrastructure as code, DevOps, Open source | Disclosed | High priority | |
CKEditor CKEditor 5CVE-2026-116688 | Web, JavaScript, Libraries, Open source | Disclosed | High priority | |
MLflow MLflowCVE-2026-116692 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
Mistral AI Mistral VibeCVE-2026-116843 | AI, Developer infrastructure, Open source | Disclosed | High priority | |
Octopus Deploy Octopus ServerCVE-2026-116870 | DevOps, Deployment automation, Identity | Disclosed | High priority | |
Mozilla FirefoxCVE-2026-118008 | Browser, Web | Disclosed | High priority | |
Supermicro BMC firmwareCVE-2026-18450 | Server hardware, BMC, Infrastructure | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-48356 | E-commerce, Web, Open source | Known exploited | Act now | |
Adobe Adobe ConnectCVE-2026-48360 | Collaboration, Web conferencing, Mobile | Disclosed | High priority | |
Supermicro BMC firmwareCVE-2026-65220 | Server hardware, BMC, Infrastructure | Disclosed | High priority | |
Themeum KirkiCVE-2026-75891 | WordPress, CMS, Web | Disclosed | High priority | |
Microsoft Microsoft Edge (Chromium-based)CVE-2026-83831 | Browser, Web | Disclosed | High priority | |
Microsoft Microsoft Edge (Chromium-based)CVE-2026-85898 | Browser, Web | Disclosed | High priority | |
TeamViewer TeamViewerCVE-2026-92372 | Remote access, Endpoint software | Disclosed | High priority | |
WatchGuard Fireware OSCVE-2026-93434 | Firewall, Network security | Disclosed | High priority | |
WatchGuard Fireware OSCVE-2026-93857 | Firewall, Network security | Disclosed | Act now | |
WatchGuard Fireware OSCVE-2026-93865 | Firewall, Network security | Disclosed | Act now | |
WatchGuard Fireware OSCVE-2026-93866 | Firewall, Network security | Disclosed | Act now | |
OpenHands Software Agent SDKCVE-2026-112346 | AI, Developer infrastructure, Open source | Disclosed | Act now | |
ImageMagick ImageMagickCVE-2026-116149 | Image processing, Open source, Library | Disclosed | High priority | |
Parse Server Parse ServerCVE-2026-116163 | Backend, Open source, Authentication | Disclosed | High priority | |
vLLM vLLMCVE-2026-116176 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
rclone rcloneCVE-2026-116191 | File transfer, Open source, Storage | Disclosed | High priority | |
Snipe-IT Snipe-ITCVE-2026-116199 | Asset management, Open source, Authentication | Disclosed | High priority | |
Snipe-IT Snipe-ITCVE-2026-116201 | Asset management, Open source, Authentication | Disclosed | High priority | |
open62541 open62541CVE-2026-116014 | OPC UA, Industrial automation, Open source | Disclosed | High priority | |
Grav GravCVE-2026-116019 | Web application, Open source, CMS | Disclosed | High priority | |
Aider-AI AiderCVE-2026-115726 | AI, Developer infrastructure, Developer tools | Disclosed | High priority | |
hapijs @hapi/contentCVE-2026-115728 | Node.js, Web development, Developer infrastructure | Disclosed | High priority | |
Hugging Face DatasetsCVE-2026-57845 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Traefik TraefikCVE-2026-114635 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
Traefik TraefikCVE-2026-114636 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
Traefik TraefikCVE-2026-114637 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
Traefik TraefikCVE-2026-114638 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
Traefik TraefikCVE-2026-114639 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
Traefik TraefikCVE-2026-114640 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
Traefik TraefikCVE-2026-114642 | Reverse proxy, Kubernetes, Cloud native | Disclosed | High priority | |
mem0ai mem0CVE-2026-115324 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Lepture MistuneCVE-2026-115353 | Python, Markdown, Libraries | Disclosed | High priority | |
Lepture MistuneCVE-2026-115355 | Python, Markdown, Libraries | Disclosed | High priority | |
Linux Containers IncusCVE-2026-115372 | Containers, Virtualization, Cloud infrastructure | Disclosed | Act now | |
Linux Containers IncusCVE-2026-115375 | Containers, Virtualization, Cloud infrastructure | Disclosed | Act now | |
Linux Containers IncusCVE-2026-115376 | Containers, Virtualization, Cloud infrastructure | Disclosed | High priority | |
Linux Containers IncusCVE-2026-115377 | Containers, Virtualization, Cloud infrastructure | Disclosed | Act now | |
Bytecode Alliance WasmtimeCVE-2026-115384 | WebAssembly, Runtime, Developer infrastructure | Disclosed | Act now | |
Bytecode Alliance WasmtimeCVE-2026-115392 | WebAssembly, Runtime, Developer infrastructure | Disclosed | High priority | |
Splunk Splunk EnterpriseCVE-2026-76291 | SIEM, Log management, Enterprise | Disclosed | Act now | |
Splunk Splunk EnterpriseCVE-2026-76298 | SIEM, Log management, Enterprise | Disclosed | Act now | |
PHP Group PHPCVE-2026-109618 | Web, PHP, Server-side | Disclosed | Act now | |
PHP Group PHPCVE-2026-109619 | Web, PHP, Server-side | Disclosed | Act now | |
FreeRDP FreeRDPCVE-2026-114045 | Remote desktop, Infrastructure | Disclosed | High priority | |
vLLM vLLMCVE-2026-114053 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Dulwich DulwichCVE-2026-114094 | Developer infrastructure, Version control, Python | Disclosed | High priority | |
Astral uvCVE-2026-114109 | Developer infrastructure, Python, Package management | Disclosed | High priority | |
PHPOffice PHPPresentationCVE-2026-114403 | PHP, Libraries, Web | Disclosed | High priority | |
Cisco Snort 3CVE-2026-20043 | Network security, Intrusion prevention, Firewall | Disclosed | Act now | |
Cisco Cisco Unified Communications ManagerCVE-2026-76473 | Unified communications, Voice, Enterprise | Disclosed | Act now | |
Cisco Cisco Unified Communications ManagerCVE-2026-76474 | Unified communications, Voice, Enterprise | Disclosed | Act now | |
Cisco Cisco Unified Communications ManagerCVE-2026-76475 | Unified communications, Voice, Enterprise | Disclosed | Act now | |
Duplicator Duplicator and Duplicator ProCVE-2026-82814 | WordPress, CMS, Web | Disclosed | High priority | |
Adobe Acrobat for EdgeCVE-2026-100134 | PDF, Browser, Endpoint | Disclosed | High priority | |
IBM IBM Sterling Connect:Direct for UnixCVE-2026-105453 | File transfer, Enterprise software, Infrastructure | Disclosed | High priority | |
Red Hat Cruise Control for Apache KafkaCVE-2026-105949 | Kafka, Streaming, Infrastructure | Disclosed | High priority | |
IBM IBM Langflow OSSCVE-2026-107366 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM IBM TRIRIGA Application PlatformCVE-2026-107400 | Enterprise software, Web application, Infrastructure | Disclosed | High priority | |
IBM IBM Verify Identity AccessCVE-2026-109126 | Identity and access management, Enterprise software, Infrastructure | Disclosed | High priority | |
IBM IBM MQCVE-2026-10572 | Messaging, Enterprise software, Infrastructure | Disclosed | High priority | |
IBM IBM MQCVE-2026-10574 | Messaging, Enterprise software, Infrastructure | Disclosed | High priority | |
IBM IBM MQCVE-2026-10743 | Messaging, Enterprise software, Infrastructure | Disclosed | High priority | |
Rank Math Rank Math SEO PROCVE-2026-111862 | WordPress, Web application, Supply chain | Disclosed | Act now | |
Craft CMS Craft CMSCVE-2026-112770 | Web application, Open source, CMS | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-112772 | Web application, Open source, CMS | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-112773 | Web application, Open source, CMS | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-112774 | Web application, Open source, CMS | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-112775 | Web application, Open source, CMS, Identity | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-112776 | Web application, Open source, CMS | Disclosed | Act now | |
Craft CMS Craft CMSCVE-2026-112777 | Web application, Open source, CMS | Disclosed | High priority | |
Grav GravCVE-2026-112780 | Web application, Open source, CMS | Disclosed | High priority | |
IBM IBM MQCVE-2026-12665 | Messaging, Enterprise software, Infrastructure | Disclosed | High priority | |
Red Hat bootcCVE-2026-16487 | Operating system, Containers, Linux | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111880 | Remote access, Open source | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111882 | Web application, Open source, Identity | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111884 | Web application, Open source, Identity | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111901 | Web application, Open source | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111908 | Web application, Open source | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111909 | Web application, Open source, Identity | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111911 | Web application, Open source, Identity | Disclosed | Act now | |
fleetdm FleetCVE-2026-111923 | Device management, Open source, Infrastructure | Disclosed | High priority | |
fleetdm FleetCVE-2026-111924 | Device management, Open source, Infrastructure | Disclosed | High priority | |
Coder CoderCVE-2026-111927 | Developer infrastructure, Open source, Workspaces | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111378 | Remote desktop, Open source software | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111380 | Remote desktop, Open source software | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111382 | Remote desktop, Open source software | Disclosed | High priority | |
Frappe Frappe HRMSCVE-2026-111389 | Human resources, Open source software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108426 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108427 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108428 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108429 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108430 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108431 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108432 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108437 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108439 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108440 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108441 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108442 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108443 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft OfficeCVE-2026-108444 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108445 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft ExcelCVE-2026-108446 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108447 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108449 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108450 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108451 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-108452 | Collaboration server, Enterprise software, Web application | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-110838 | Remote desktop, Open source software | Disclosed | High priority | |
GitPython GitPythonCVE-2026-110856 | Developer infrastructure, Python, Open source software | Disclosed | High priority | |
GitPython GitPythonCVE-2026-110858 | Developer infrastructure, Python, Open source software | Disclosed | Act now | |
GitPython GitPythonCVE-2026-110859 | Developer infrastructure, Python, Open source software | Disclosed | High priority | |
Better Auth Better AuthCVE-2026-110862 | Authentication, Web applications, Developer infrastructure | Disclosed | Act now | |
Better Auth Better Auth SSOCVE-2026-110863 | Authentication, Single sign-on, Web applications | Disclosed | High priority | |
Better Auth Better AuthCVE-2026-110864 | Authentication, Web applications, Developer infrastructure | Disclosed | Act now | |
Renovate RenovateCVE-2026-110867 | Developer infrastructure, Dependency automation, CI/CD | Disclosed | Act now | |
Renovate RenovateCVE-2026-110868 | Developer infrastructure, Dependency automation, CI/CD | Disclosed | High priority | |
Nodemailer NodemailerCVE-2026-110869 | Email, Node.js, Open source software | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111214 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111216 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111217 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111226 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111229 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111231 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Red Hat Ansible Operator PluginsCVE-2026-92982 | Kubernetes, Operator framework, Cloud infrastructure | Disclosed | High priority | |
DPDK DPDKCVE-2026-100236 | Data plane, Virtualization, Open source | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101927 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101939 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101940 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101941 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101942 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101943 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101944 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101945 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101950 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101954 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101955 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101981 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101982 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101990 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101997 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OS EvolvedCVE-2026-102012 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102014 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102015 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102016 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102020 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102022 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OS EvolvedCVE-2026-102023 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102024 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102025 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102026 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102027 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102028 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102029 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102030 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OS EvolvedCVE-2026-102031 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-102037 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102049 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102050 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102052 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102055 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102059 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102061 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102062 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102064 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102079 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102174 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102175 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-102176 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102178 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
F5 NGINX Ingress ControllerCVE-2026-104939 | Kubernetes, Ingress controller, Identity | Disclosed | High priority | |
F5 NGINX Plus and NGINX Open SourceCVE-2026-15176 | Web server, Load balancer, Critical infrastructure | Disclosed | High priority | |
DPDK DPDKCVE-2026-86567 | Data plane, Virtualization, Open source | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-88164 | Collaboration, Enterprise software | Disclosed | High priority | |
F5 NGINX Gateway FabricCVE-2026-91184 | Kubernetes, Gateway API, Multi-tenancy | Disclosed | High priority | |
F5 NGINX Plus and NGINX Open SourceCVE-2026-93479 | Web server, Load balancer, Critical infrastructure | Disclosed | High priority | |
F5 NGINX Ingress ControllerCVE-2026-94197 | Kubernetes, Ingress controller, Identity | Disclosed | High priority | |
F5 NGINX Plus and NGINX Open SourceCVE-2026-97205 | Web server, Load balancer, Critical infrastructure | Disclosed | High priority | |
Frappe Frappe FrameworkCVE-2024-58390 | Web framework, Open source | Disclosed | High priority | |
Adobe Adobe CommerceCVE-2026-100133 | E-commerce, Web application | Disclosed | Act now | |
Microsoft Windows Message QueuingCVE-2026-100202 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft Office ExcelCVE-2026-100210 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office ExcelCVE-2026-100211 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office ExcelCVE-2026-100212 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Dynamics NAVCVE-2026-100214 | ERP, Enterprise software | Disclosed | High priority | |
Microsoft Remote Desktop GatewayCVE-2026-100218 | Remote access, Operating system | Disclosed | High priority | |
Microsoft Microsoft QUICCVE-2026-100219 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Media Video DecoderCVE-2026-100220 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Windows Network Policy ServerCVE-2026-100222 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows RPC RuntimeCVE-2026-102203 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Windows Text ShapingCVE-2026-102210 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Hyper-VCVE-2026-102214 | Virtualization, Operating system | Disclosed | High priority | |
Microsoft Windows WebDAVCVE-2026-102217 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Windows Text ShapingCVE-2026-102225 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Microsoft Dynamics NAVCVE-2026-102226 | ERP, Enterprise software | Disclosed | High priority | |
Microsoft Visual Studio CodeCVE-2026-102238 | Developer tools, Open source | Disclosed | Act now | |
IBM TRIRIGA Application PlatformCVE-2026-102627 | Enterprise software, Facilities management | Disclosed | High priority | |
Microsoft Microsoft Office AccessCVE-2026-102849 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office AccessCVE-2026-102850 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office VisioCVE-2026-102856 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office VisioCVE-2026-102857 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office OneNoteCVE-2026-102858 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102860 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102861 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102862 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102863 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102866 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft .NET FrameworkCVE-2026-102869 | Developer tools, Runtime | Disclosed | High priority | |
Microsoft ASP.NET CoreCVE-2026-102870 | Developer tools, Web application, Open source | Disclosed | High priority | |
Microsoft Visual StudioCVE-2026-103572 | Developer tools | Disclosed | High priority | |
Microsoft Remote Desktop ClientCVE-2026-103575 | Remote access, Operating system | Disclosed | High priority | |
Adobe Adobe Experience ManagerCVE-2026-103848 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-103849 | E-commerce, Web application | Disclosed | Act now | |
Microsoft Windows Search ComponentCVE-2026-105010 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft QUICCVE-2026-105016 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-105895 | Content management, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-105899 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-105903 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106612 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106619 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106620 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106621 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106622 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106624 | Application server, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-106626 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-106629 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-106630 | Content management, Web application | Disclosed | Act now | |
phpMyFAQ phpMyFAQCVE-2026-109573 | Web application, Open source | Disclosed | High priority | |
Frappe ERPNextCVE-2026-109608 | ERP, Open source | Disclosed | High priority | |
Frappe ERPNextCVE-2026-109652 | ERP, Open source | Disclosed | High priority | |
Frappe ERPNextCVE-2026-109667 | ERP, Open source | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-109676 | Remote access, Open source | Disclosed | High priority | |
NLTK NLTKCVE-2026-109956 | Machine learning, Open source, Developer infrastructure | Disclosed | High priority | |
IBM Planning AnalyticsCVE-2026-19620 | Business analytics, Enterprise software | Disclosed | High priority | |
IBM Planning AnalyticsCVE-2026-19622 | Business analytics, Enterprise software | Disclosed | High priority | |
IBM Planning AnalyticsCVE-2026-19627 | Business analytics, Enterprise software | Disclosed | High priority | |
Adobe Adobe Experience ManagerCVE-2026-48382 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-48383 | Content management, Web application | Disclosed | Act now | |
Microsoft Windows iSCSICVE-2026-69634 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows LibarchiveCVE-2026-69639 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows iSCSICVE-2026-69705 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows iSCSICVE-2026-69883 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Imaging ComponentCVE-2026-69886 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Internet Information ServicesCVE-2026-70024 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Rich Text Edit ControlCVE-2026-70096 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft PostScript Printer DriverCVE-2026-70147 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft PostScript Printer DriverCVE-2026-70153 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows System Information ConsoleCVE-2026-70157 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft Exchange ServerCVE-2026-70279 | Email, Enterprise infrastructure | Disclosed | Act now | |
Wazuh Wazuh managerCVE-2026-74034 | Security monitoring, Open source, Infrastructure | Disclosed | High priority | |
Wazuh Wazuh agentCVE-2026-74036 | Security monitoring, Open source, Infrastructure | Disclosed | High priority | |
Wazuh Wazuh managerCVE-2026-74037 | Security monitoring, Open source, Infrastructure | Disclosed | High priority | |
Wazuh Wazuh managerCVE-2026-74040 | Security monitoring, Open source, Infrastructure | Disclosed | Act now | |
Wazuh Wazuh managerCVE-2026-74041 | Security monitoring, Open source, Infrastructure | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-75732 | Content management, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-75994 | Application server, Web application | Disclosed | Act now | |
IBM DataStage on Cloud Pak for DataCVE-2026-82096 | Data integration, Cloud platform | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-82101 | Data integration, Cloud platform | Disclosed | Act now | |
IBM DataStage on Cloud Pak for DataCVE-2026-82103 | Data integration, Cloud platform | Disclosed | Act now | |
IBM DataStage on Cloud Pak for DataCVE-2026-82108 | Data integration, Cloud platform | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-82110 | Data integration, Cloud platform | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-83662 | Content management, Web application | Disclosed | Act now | |
IBM Planning AnalyticsCVE-2026-85457 | Business analytics, Enterprise software | Disclosed | High priority | |
Microsoft Windows SchannelCVE-2026-85818 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
SAP S/4HANACVE-2026-89107 | ERP, Enterprise software | Disclosed | Act now | |
SAP Manufacturing Integration and IntelligenceCVE-2026-89108 | Manufacturing, Enterprise software | Disclosed | Act now | |
SAP NetWeaver Visual ComposerCVE-2026-89110 | Enterprise software, Application platform | Disclosed | Act now | |
SAP Commerce CloudCVE-2026-89113 | E-commerce, Enterprise software | Disclosed | High priority | |
Adobe ColdFusionCVE-2026-90530 | Application server, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-90532 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-91013 | E-commerce, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-92464 | E-commerce, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-92909 | E-commerce, Web application | Disclosed | Act now | |
IBM IBM iCVE-2026-93886 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
IBM TRIRIGA Application PlatformCVE-2026-93892 | Enterprise software, Facilities management | Disclosed | High priority | |
IBM WebSphere Application Server LibertyCVE-2026-93895 | Application server, Enterprise infrastructure | Disclosed | Act now | |
IBM WebSphere Application Server LibertyCVE-2026-93909 | Application server, Enterprise infrastructure, Identity | Disclosed | Act now | |
IBM WebSphere Application ServerCVE-2026-95680 | Application server, Enterprise infrastructure, Identity | Disclosed | High priority | |
Microsoft Windows DNS ServerCVE-2026-96113 | Operating system, Network infrastructure | Disclosed | Act now | |
IBM IBM iCVE-2026-96119 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft Office OutlookCVE-2026-97016 | Office productivity, Email | Disclosed | Act now | |
Microsoft Windows Partition Management DriverCVE-2026-97805 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Text ShapingCVE-2026-97814 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Error ReportingCVE-2026-97815 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft OpenSSH for WindowsCVE-2026-97816 | Operating system, Remote access | Disclosed | Act now | |
Crawl4AI Crawl4AICVE-2026-109237 | AI, Web crawling, Developer infrastructure | Disclosed | High priority | |
Crawl4AI Crawl4AICVE-2026-109238 | AI, Web crawling, Cloud infrastructure | Disclosed | Act now | |
Open WebUI Open WebUICVE-2026-109286 | AI, Web applications | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-109305 | CMS, Web applications, PHP | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-109308 | CMS, Web applications, PHP | Disclosed | High priority | |
LibreNMS LibreNMSCVE-2026-109357 | Network monitoring, Identity and access management | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-109371 | Identity and access management, Authentication | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-109373 | Identity and access management, Authentication | Disclosed | Act now | |
Red Hat Quarkus REST Data PanacheCVE-2026-87744 | Java, Web applications, Developer infrastructure | Disclosed | Act now | |
IBM Db2 Mirror for iCVE-2026-96012 | Databases, Enterprise infrastructure | Disclosed | Act now | |
ferdikoomen openapi-typescript-codegenCVE-2026-108551 | Developer tools, JavaScript/TypeScript, API tooling | Disclosed | Act now | |
Microsoft Azure SRE AgentCVE-2026-69435 | Cloud, Azure, Hosted services | Disclosed | Act now | |
Microsoft Azure App Service for LinuxCVE-2026-77900 | Cloud, Azure, PaaS, Hosted services | Disclosed | Act now | |
Microsoft Azure API CenterCVE-2026-83943 | Cloud, Azure, APIs, Hosted services | Disclosed | High priority | |
Microsoft Microsoft DataverseCVE-2026-88131 | Cloud, Dataverse, Power Platform, Hosted services | Disclosed | Act now | |
Microsoft Microsoft BookingsCVE-2026-94510 | Cloud, Microsoft 365, Hosted services | Disclosed | Act now | |
Microsoft Microsoft Partner CenterCVE-2026-96207 | Cloud, Partner ecosystem, Hosted services | Disclosed | Act now | |
ILIAS ILIASCVE-2026-107639 | E-learning, Web application, Open source | Disclosed | High priority | |
System Informer System InformerCVE-2026-107782 | Windows, System utilities, Open source | Disclosed | High priority | |
IBM DataPower GatewayCVE-2026-14502 | API gateway, Enterprise infrastructure, Integration | Disclosed | Act now | |
IBM DataPower GatewayCVE-2026-14905 | API gateway, Enterprise infrastructure, Integration | Disclosed | High priority | |
IBM DataPower GatewayCVE-2026-14992 | API gateway, Enterprise infrastructure, Integration | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-16823 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-16916 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-17189 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-18740 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-19482 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-19491 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-19494 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-78401 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-78406 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-82334 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-82335 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-82344 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-84244 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-84250 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-84272 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-103360 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-104334 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-104335 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Red Hat Red Hat Satellite 6CVE-2026-106471 | Systems management, Subscription management, Enterprise infrastructure | Disclosed | High priority | |
Cisco Cisco License On-PremCVE-2026-20328 | Network infrastructure, License management | Disclosed | Act now | |
Splunk Splunk EnterpriseCVE-2026-76268 | SIEM, Security operations, Data analytics | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76453 | Network infrastructure, Data center switching, Compute | Disclosed | High priority | |
Cisco Cisco License On-PremCVE-2026-76454 | Network infrastructure, License management | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76458 | Network infrastructure, Data center switching, Compute | Disclosed | High priority | |
Cisco Cisco NX-OS SoftwareCVE-2026-76459 | Network infrastructure, Data center switching, Compute | Disclosed | Act now | |
Cisco Cisco MerakiCVE-2026-76468 | Network infrastructure, Wireless, Security appliances, Cameras | Disclosed | High priority | |
Cisco Cisco MerakiCVE-2026-76472 | Network infrastructure, Wireless, Security appliances, Cameras | Disclosed | High priority | |
Cisco Cisco License On-PremCVE-2026-76480 | Network infrastructure, License management | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76485 | Network infrastructure, Data center switching | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76486 | Network infrastructure, Data center switching | Disclosed | Act now | |
Cisco Cisco Application Policy Infrastructure Controller (APIC)CVE-2026-76500 | Network infrastructure, Data center, SDN | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76501 | Network infrastructure, Data center switching | Disclosed | Act now | |
libexpat libexpatCVE-2026-77214 | Developer infrastructure, Libraries | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-88962 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93445 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93449 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93674 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-93675 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-97655 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97673 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97674 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97676 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97678 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97679 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97680 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Planka PlankaCVE-2026-105835 | Project management, Web application | Disclosed | High priority | |
kvcache-ai MooncakeCVE-2026-106038 | AI, Machine learning, Developer infrastructure, Caching | Disclosed | Act now | |
Atlassian Atlassian Data Center productsCVE-2026-21589 | Developer infrastructure, Collaboration | Disclosed | Act now | |
Smarty SmartyCVE-2026-82531 | PHP, Web application, Templating | Disclosed | Act now | |
Red Hat Multicluster Engine for KubernetesCVE-2026-101919 | Kubernetes, Multi-cluster, Cloud infrastructure | Disclosed | High priority | |
Legcord LegcordCVE-2026-105293 | Desktop application, Messaging, Electron | Disclosed | Act now | |
Legcord LegcordCVE-2026-105294 | Desktop application, Messaging, Electron | Disclosed | Act now | |
Camunda Camunda 7CVE-2026-77226 | Process automation, BPM, Enterprise infrastructure | Disclosed | Act now | |
WWBN AVideoCVE-2026-105086 | Media, Web application | Disclosed | Act now | |
WWBN AVideoCVE-2026-105089 | Media, Web application | Disclosed | Act now | |
Shanghai AI Laboratory / InternLM MindSearchCVE-2026-105135 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105207 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105208 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105209 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105210 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105211 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105212 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105213 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105215 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
micro go-microCVE-2026-105216 | Developer infrastructure, Microservices | Disclosed | Act now | |
go-pay gopayCVE-2026-105218 | Payments, Developer infrastructure | Disclosed | Act now | |
mwilliamson mammoth.jsCVE-2026-105219 | Developer infrastructure, Web application | Disclosed | High priority | |
kvcache-ai Mooncake transfer engineCVE-2026-103764 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
kvcache-ai MooncakeCVE-2026-103765 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
Red Hat Red Hat Certificate SystemCVE-2026-104988 | PKI, Certificate authority, Identity infrastructure | Disclosed | High priority | |
Red Hat 389 Directory Server (389-ds-base)CVE-2026-86345 | Identity, Directory services, Infrastructure | Disclosed | High priority | |
Zod ZodCVE-2023-54404 | JavaScript, TypeScript, Validation libraries | Disclosed | High priority | |
n8n n8nCVE-2026-103246 | Automation, AI, Developer infrastructure | Disclosed | Act now | |
n8n n8nCVE-2026-103250 | Automation, AI, Chatbots | Disclosed | Act now | |
Tornado TornadoCVE-2026-103262 | Python, Web frameworks, HTTP clients | Disclosed | High priority | |
Ghost GhostCVE-2026-103271 | CMS, Publishing, JavaScript | Disclosed | High priority | |
Ghost GhostCVE-2026-103283 | CMS, Publishing, Authentication | Disclosed | Act now | |
Red Hat ForemanCVE-2026-12540 | Infrastructure management, Configuration management | Disclosed | High priority | |
Red Hat ForemanCVE-2026-12541 | Infrastructure management, Configuration management | Disclosed | High priority | |
Red Hat ForemanCVE-2026-96659 | Infrastructure management, Configuration management | Disclosed | Act now | |
Yonyou U8 CRMCVE-2023-54403 | CRM, Enterprise software | Disclosed | High priority | |
openclaw OpenClaw Windows NodeCVE-2026-101880 | AI agents, Windows | Disclosed | High priority | |
openclaw OpenClaw Windows NodeCVE-2026-101882 | AI agents, Windows | Disclosed | High priority | |
ModelTC LightLLMCVE-2026-103040 | AI, Machine learning, LLM inference | Disclosed | Act now | |
ModelTC LightLLMCVE-2026-103041 | AI, Machine learning, LLM inference | Disclosed | Act now | |
ModelTC LightLLMCVE-2026-103042 | AI, Machine learning, LLM inference | Disclosed | High priority | |
denoland DenoCVE-2026-103473 | JavaScript runtime, Developer infrastructure | Disclosed | Act now | |
ESnet iperf3CVE-2026-102253 | Networking, Developer infrastructure | Disclosed | High priority | |
NginxProxyManager nginx-proxy-managerCVE-2026-102334 | Reverse proxy, Infrastructure | Disclosed | High priority | |
gz-yami mall4jCVE-2026-102361 | E-commerce, Web application | Disclosed | Act now | |
Red Hat libsoupCVE-2026-102558 | Developer infrastructure, Enterprise software | Disclosed | High priority | |
Red Hat libsoupCVE-2026-102559 | Developer infrastructure, Enterprise software | Disclosed | High priority | |
OpenNMT CTranslate2CVE-2026-102566 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
VideoLAN VLCCVE-2026-102875 | Desktop software, Media | Disclosed | High priority | |
SurrealDB SurrealDBCVE-2026-102876 | Database, Developer infrastructure | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-84421 | Data integration, Enterprise software, Cloud Pak for Data | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-84436 | Data security, Enterprise software | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-84842 | Data security, Enterprise software, REST API | Disclosed | High priority | |
Unsloth unsloth-zooCVE-2026-93348 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
BerriAI LiteLLMCVE-2026-93355 | AI, API gateway, Developer infrastructure | Disclosed | High priority | |
aaPanel BaoTaCVE-2026-101007 | Web hosting, Server management, Developer infrastructure | Disclosed | High priority | |
aaPanel BaoTaCVE-2026-101008 | Web hosting, Server management, Developer infrastructure | Disclosed | Act now | |
aaPanel BaoTaCVE-2026-101009 | Web hosting, Server management, Developer infrastructure | Disclosed | High priority | |
vm2 vm2CVE-2026-100721 | JavaScript, Node.js, Developer infrastructure | Disclosed | Act now | |
Project-MONAI MONAICVE-2026-100840 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100841 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100843 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100844 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100845 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100846 | Python, AI, Machine learning | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100847 | PHP, Web applications, Media streaming | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100852 | PHP, Web applications, Media streaming | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100856 | PHP, Web applications, Media streaming | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100857 | PHP, Web applications, Media streaming | Disclosed | High priority | |
Sylius SyliusCVE-2026-100870 | E-commerce, PHP, Symfony | Disclosed | High priority | |
Sylius SyliusCVE-2026-100871 | E-commerce, PHP, Symfony | Disclosed | High priority | |
Sylius SyliusCVE-2026-100872 | E-commerce, PHP, Symfony | Disclosed | High priority | |
pnpm pnpmCVE-2026-101043 | JavaScript, Package managers, Developer infrastructure | Disclosed | High priority | |
fleetdm FleetCVE-2026-101045 | Device management, macOS, MDM | Disclosed | High priority | |
obot-platform ObotCVE-2026-101062 | AI agents, MCP, OAuth | Disclosed | High priority | |
obot-platform ObotCVE-2026-101064 | AI agents, MCP | Disclosed | High priority | |
obot-platform ObotCVE-2026-101065 | AI agents, MCP, Docker | Disclosed | Act now | |
obot-platform ObotCVE-2026-101084 | AI agents, MCP, OAuth | Disclosed | Act now | |
nezhahq NezhaCVE-2026-101090 | Monitoring, OAuth2, Self-hosted | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-100606 | AI, LLM applications, Authentication | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-100607 | AI, LLM applications, Authentication | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-100608 | AI, LLM applications, Job queues | Disclosed | High priority | |
parse-community Parse ServerCVE-2026-100631 | Backend infrastructure, Mobile backends, Push notifications | Disclosed | High priority | |
Netty NettyCVE-2026-100656 | Java, Networking, Web servers | Disclosed | High priority | |
Netty NettyCVE-2026-100657 | Java, Networking, Messaging | Disclosed | High priority | |
Netty NettyCVE-2026-100660 | Java, Networking, HTTP/3, QUIC | Disclosed | High priority | |
Netty NettyCVE-2026-100661 | Java, Networking, HTTP/3, QUIC | Disclosed | High priority | |
Netty NettyCVE-2026-100662 | Java, Networking, HTTP/3, QUIC | Disclosed | High priority | |
Netty NettyCVE-2026-100663 | Java, Networking, Proxies, HTTP/3 | Disclosed | High priority | |
Netty NettyCVE-2026-100664 | Java, Networking, Proxies, HTTP/3 | Disclosed | High priority | |
Netty NettyCVE-2026-100665 | Java, Networking, QUIC, TLS | Disclosed | High priority | |
Grav GravCVE-2026-100669 | CMS, Web servers, IIS | Disclosed | High priority | |
Grav GravCVE-2026-100670 | CMS, Web applications | Disclosed | High priority | |
Grav GravCVE-2026-100671 | CMS, Web applications | Disclosed | High priority | |
Grav Grav Comments pluginCVE-2026-100672 | CMS, Plugins | Disclosed | High priority | |
Grav Grav Data Manager pluginCVE-2026-100673 | CMS, Plugins | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100680 | Low-code platforms, Web applications | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100682 | Low-code platforms, Web applications | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100683 | Low-code platforms, Databases | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100684 | Low-code platforms, Authentication | Disclosed | Act now | |
Budibase BudibaseCVE-2026-100685 | Low-code platforms, Web applications | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100686 | Low-code platforms, Web applications | Disclosed | High priority | |
Hugo HugoCVE-2026-100690 | Static site generators, Build pipelines | Disclosed | High priority | |
Hugo HugoCVE-2026-100692 | Static site generators, Build pipelines | Disclosed | High priority | |
Hugo HugoCVE-2026-100693 | Static site generators, Build pipelines | Disclosed | High priority | |
Adminer AdminerCVE-2026-100697 | Database tools, Web applications | Disclosed | High priority | |
nodemailer nodemailerCVE-2026-100700 | Node.js, Email infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-85542 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
BerriAI LiteLLMCVE-2026-89032 | AI, Machine learning, API gateway | Disclosed | Act now | |
QEMU QEMUCVE-2026-93834 | Virtualization, Enterprise infrastructure, Cloud infrastructure | Disclosed | Act now | |
Microsoft Microsoft OutlookCVE-2026-70125 | Email client, Office productivity | Disclosed | Act now | |
IBM Enterprise Build of QuarkusCVE-2026-77874 | Java, Application framework, Enterprise software | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81539 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81545 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81548 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81552 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-82093 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
Red Hat pulpcoreCVE-2026-90959 | Repository management, Container registry, DevOps | Disclosed | High priority | |
SigNoz SigNozCVE-2026-97055 | Observability, Monitoring, Developer infrastructure | Disclosed | Act now | |
OFFIS DCMTKCVE-2026-97059 | Medical imaging, DICOM, Developer infrastructure | Disclosed | High priority | |
rejetto HFS2CVE-2026-97359 | File sharing, Web server, Developer infrastructure | Disclosed | Act now | |
IBM Financial Transaction Manager (FTM) for RedHat OpenShiftCVE-2026-18162 | Financial services, OpenShift, Kubernetes | Disclosed | Act now | |
IBM Financial Transaction Manager (FTM) for RedHat OpenShiftCVE-2026-18163 | Financial services, OpenShift, Kubernetes | Disclosed | Act now | |
IBM Financial Transaction Manager (FTM) for RedHat OpenShiftCVE-2026-18169 | Financial services, OpenShift, Kubernetes | Disclosed | Act now | |
IBM IBM ConcertCVE-2026-6721 | Enterprise software, AI operations | Disclosed | Act now | |
IBM IBM ConcertCVE-2026-6730 | Enterprise software, AI operations | Disclosed | Act now | |
IBM IBM ConcertCVE-2026-6928 | Enterprise software, AI operations | Disclosed | Act now | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-75884 | Kubernetes, OpenShift, Automation | Disclosed | Act now | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-76648 | Automation, API security | Disclosed | High priority | |
IBM IBM DataStage on Cloud Pak for DataCVE-2026-80379 | Data engineering, Enterprise software | Disclosed | High priority | |
IBM IBM DataStage on Cloud Pak for DataCVE-2026-80412 | Data engineering, Enterprise software | Disclosed | High priority | |
IBM IBM DataStage on Cloud Pak for DataCVE-2026-80425 | Data engineering, Enterprise software | Disclosed | High priority | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-84683 | Automation, Web application | Disclosed | High priority | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-84691 | Automation, Logging | Disclosed | High priority | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-84719 | Automation, Kubernetes, OpenShift | Disclosed | Act now | |
Flatpak FlatpakCVE-2026-96275 | Linux, Package management, Sandboxing | Disclosed | High priority | |
orval-labs orvalCVE-2026-96754 | JavaScript, TypeScript, Developer infrastructure, API tooling | Disclosed | Act now | |
orval-labs orvalCVE-2026-96755 | JavaScript, TypeScript, Developer infrastructure, API tooling | Disclosed | Act now | |
orval-labs orvalCVE-2026-96759 | JavaScript, TypeScript, Developer infrastructure, API tooling | Disclosed | Act now | |
Meta Box Meta Box AIOCVE-2026-13355 | WordPress, CMS plugins, Developer infrastructure | Disclosed | Act now | |
SolarWinds Observability Self-HostedCVE-2026-28324 | IT monitoring, Observability | Disclosed | Act now | |
SolarWinds Observability Self-HostedCVE-2026-28325 | IT monitoring, Observability | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-34689 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-73369 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe ConnectCVE-2026-75682 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-75684 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-75689 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-75698 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-75699 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-75721 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-75728 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe AEM 6.5 Forms JEECVE-2026-75745 | Content management, Web applications | Disclosed | Act now | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80144 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80145 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80146 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80149 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80151 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80152 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80155 | Out-of-band management, Data center infrastructure | Disclosed | Act now | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80156 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Adobe AEM 6.5 Forms JEECVE-2026-81995 | Content management, Web applications | Disclosed | High priority | |
Adobe AEM 6.5 Forms JEECVE-2026-82000 | Content management, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82003 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82009 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82011 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82013 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-83660 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-89275 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-89276 | Marketing automation, Web applications | Disclosed | High priority | |
realmag777 HUSKY – Products Filter for WooCommerce ProfessionalCVE-2026-92969 | WordPress, WooCommerce, CMS plugins | Disclosed | High priority | |
OpenPrinting CUPSCVE-2026-95511 | Linux, Printing infrastructure, Open source | Disclosed | High priority | |
Vaultwarden VaultwardenCVE-2026-95814 | Password management, Self-hosted | Disclosed | High priority | |
Red Hat CRI-OCVE-2026-15801 | Kubernetes, Containers, Cloud infrastructure | Disclosed | High priority | |
Red Hat Red Hat Certificate SystemCVE-2026-80110 | Certificate authority, Linux servers, Identity infrastructure | Disclosed | High priority | |
Kamailio KamailioCVE-2026-93962 | Telecommunications, SIP infrastructure, VoIP | Disclosed | High priority | |
libexpat ExpatCVE-2026-93990 | Parsing libraries, Developer infrastructure, XML | Disclosed | High priority | |
argoproj Argo WorkflowsCVE-2026-93991 | Kubernetes, CI/CD, Developer infrastructure | Disclosed | High priority | |
mistralai Mistral VibeCVE-2026-93993 | AI, Developer tools, Agentic coding | Disclosed | High priority | |
James Heinrich getID3CVE-2026-94106 | Media processing, PHP libraries, Developer infrastructure | Disclosed | High priority | |
Red Hat Red Hat OpenShift Container Platform 4CVE-2026-75885 | Kubernetes, OpenShift, Container platforms | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-81657 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
vm2 vm2CVE-2026-93603 | JavaScript, Node.js, Developer infrastructure | Disclosed | Act now | |
vm2 vm2CVE-2026-93605 | JavaScript, Node.js, Developer infrastructure | Disclosed | Act now | |
Google PixelCVE-2026-58704 | Mobile devices, Android, Cellular baseband | Known exploited | Act now | |
Cisco Identity Services EngineCVE-2026-76460 | Identity and access management, Network security | Known exploited | Act now | |
Cisco Secure Email GatewayCVE-2026-76461 | Email security, Network security | Known exploited | Act now | |
JFrog ArtifactoryCVE-2026-42016 | Developer infrastructure, Artifact management, Supply chain | Known exploited | Act now | |
ConnectWise ScreenConnectCVE-2026-84869 | Remote access, IT support, Managed services | Known exploited | Act now | |
GitLab GitLabCVE-2026-85706 | DevOps, CI/CD, Source control | Known exploited | Act now | |
Fortinet FortiOSCVE-2025-25249 | Firewalls, Network security, SD-WAN | Known exploited | Act now | |
Citrix NetScalerCVE-2026-19490 | VPN, Network infrastructure, Remote access | Known exploited | Act now | |
Cisco Secure Firewall Management CenterCVE-2026-20079 | Firewalls, Network management, Security operations | Known exploited | Act now | |
Google ChromeCVE-2026-87491 | Web browsers, End-user devices | Known exploited | Act now | |
Adobe Adobe CommerceCVE-2026-75650 | E-commerce, Web applications, Payment processing | Known exploited | Act now | |
Microsoft WindowsCVE-2026-81963 | Operating systems, Endpoints | Known exploited | Act now | |
Microsoft WindowsCVE-2026-85880 | Operating systems, Endpoints | Known exploited | Act now | |
Kludex StarletteCVE-2026-48710 | Python, Web frameworks, ASGI, Developer infrastructure | Known exploited | Act now | |
BerriAI LiteLLMCVE-2026-59822 | AI, Developer infrastructure, API gateway | Known exploited | Act now | |
PaperCut PaperCut NG/MFCVE-2026-82078 | Print management, Enterprise applications, Java | Known exploited | Act now | |
ownCloud ownCloudCVE-2023-49105 | File sharing, WebDAV, Self-hosted services | Known exploited | Act now | |
Microsoft SQL ServerCVE-2019-1068 | Databases, Windows Server, Enterprise applications | Known exploited | Act now | |
Gitea GiteaCVE-2026-60004 | Developer infrastructure, Source control | Known exploited | Act now | |
Oracle Oracle HTTP ServerCVE-2026-21962 | Application servers, Enterprise middleware | Known exploited | Act now | |
Synacor Zimbra Collaboration SuiteCVE-2026-73570 | Email infrastructure, Collaboration | Known exploited | Act now | |
MLflow MLflowCVE-2026-64849 | AI, Machine learning, Developer infrastructure | Known exploited | Act now | |
Microsoft Windows IKE Service ExtensionsCVE-2026-33824 | Windows, IPsec, VPN infrastructure | Known exploited | Act now | |
Microsoft SharePoint ServerCVE-2026-55040 | Collaboration, Document management, On-premises infrastructure | Known exploited | Act now | |
Broadcom VMware vCenterCVE-2026-59310 | Virtualization, Infrastructure management | Known exploited | Act now | |
Apple macOSCVE-2026-65400 | Endpoints, Remote access, macOS | Known exploited | Act now | |
Ray-Project RayCVE-2025-62593 | AI, Machine learning, Developer infrastructure | Known exploited | Act now | |
Cisco Secure Firewall ASA and FTDCVE-2026-20349 | Network security, VPN | Known exploited | Act now | |
Microsoft WindowsCVE-2026-68820 | Operating systems, Endpoints, Kernel drivers | Known exploited | Act now | |
Metabase MetabaseCVE-2026-72898 | Analytics, Data platforms | Active exploitation | Act now | |
Apache TomcatCVE-2026-34486 | Java, Application servers | Known exploited | Act now | |
Fortinet FortiOSCVE-2025-68686 | Network security, VPN, Firewall infrastructure | Known exploited | Act now | |
JetBrains TeamCityCVE-2026-63077 | CI/CD, Developer infrastructure | Known exploited | Act now | |
Microsoft Azure Key VaultCVE-2026-62825 | Cloud, Secrets management, Microsoft Azure | Disclosed | Act now | |
JetBrains TeamCityCVE-2026-65906 | CI/CD, Developer infrastructure, Build systems | Disclosed | High priority | |
Check Point SmartConsoleCVE-2026-16232 | Network security, Security management, Firewall infrastructure | Known exploited | Act now | |
Microsoft SharePointCVE-2026-50522 | Collaboration, Enterprise applications, Windows Server | Known exploited | Act now | |
Mozilla FirefoxCVE-2026-16367 | Web browser, End-user devices, Email client | Disclosed | High priority | |
WordPress WordPress CoreCVE-2026-60137 | Content management, Web applications, PHP | Known exploited | Act now | |
Microsoft Active Directory Federation ServicesCVE-2026-56155 | Identity and access management, Active Directory, Windows Server | Known exploited | Act now | |
Adobe ColdFusionCVE-2026-48282 | Web application servers, Enterprise applications, Java | Known exploited | Act now | |
IBM LangflowCVE-2026-9198 | AI, Agent workflows | Known exploited | Act now | |
SimpleHelp SimpleHelpCVE-2026-48558 | Remote access, IT support tooling, Identity and access management | Known exploited | Act now | |
Google Gemini CLICVE-2026-12537 | AI, Developer infrastructure, CI/CD | Disclosed | High priority | |
Traefik TraefikCVE-2026-48020 | Networking, Reverse proxy, Cloud infrastructure | Disclosed | Act now | |
n8n n8nCVE-2026-54309 | Automation, AI, Developer infrastructure | Disclosed | Act now | |
IBM LangflowCVE-2026-10561 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
Microsoft Azure Active DirectoryCVE-2026-45480 | Cloud, Identity and access management, Microsoft Azure | Disclosed | Act now | |
Progress LoadMasterCVE-2026-8037 | Infrastructure, Load balancers | Known exploited | Act now |
Either the filters are too specific, or security has finally been solved. Probably the filters.