CVE-2026-17229: Loop with Unreachable Exit Condition

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop...

CVE-2026-58431: Incorrect Authorization

Public-only API token restriction is not enforced on team API routes...

CVE-2026-58417: Improper Access Control

REST API exposes organization membership of private organizations to public...

CVE-2026-58443: Incorrect Authorization

Public-only repository tokens can update private PR head branches...

CVE-2026-59506: Missing Authentication for Critical Function

: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...

CVE-2026-61966: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WPJAM Basic = 7.0.1 versions...

CVE-2026-56853: Allocation of Resources Without Limits or Throttling

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-23603: Server-Side Request Forgery (SSRF)

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim...

CVE-2026-66443: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-56654: Improper Access Control

Privilege Escalation via Access Token Scope Escalation in API...

CVE-2026-73344: Improper Neutralization of Input During Web Page Generation

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-66469: Missing Authorization

Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...

CVE-2026-66468: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

CVE-2026-28182: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-61965: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GeekyBot = 1.2.6 versions...

CVE-2026-58445: Observable Discrepancy

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-66463: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in iCARRY = 2.9 versions...

CVE-2026-27538: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-59765: Server-Side Request Forgery (SSRF)

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-58438: Missing Authorization

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...