CVE-2026-97406

XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials...

CVE-2026-75747

Rejected reason: this CVE was issued in error...

CVE-2026-75751

Rejected reason: this CVE was issued in error...

CVE-2026-75997

Rejected reason: this CVE was issued in error...

CVE-2026-48279

Rejected reason: this CVE was issued in error...

CVE-2026-21266

Rejected reason: this CVE was issued in error...

CVE-2026-21270

Rejected reason: this CVE was issued in error...

CVE-2026-21356

Rejected reason: this CVE was issued in error...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest compariso...

CVE-2026-113808

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113810

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting certificate creation for user. The stored XSS can only be triggered during validation by the administrator...

CVE-2026-113708

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

CVE-2026-113709

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

CVE-2026-113712

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting XSS vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page,...

CVE-2026-113713

virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappda...

CVE-2026-113643

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass...

CVE-2026-111088

A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen...

CVE-2026-111767

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...

CVE-2026-100134

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-100132

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must visit a maliciously...