CVE-2026-29027

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-29026

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-29025

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-29024

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-29012

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-29011

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-29010

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28999

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28998

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28534

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28533

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-26349

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-26348

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-26229

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-25549

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-25074

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-24438

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23765

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23692

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23691

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23690

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23677

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23676

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-23675

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22658

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22657

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22656

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22655

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22654

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22653

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22652

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-22651

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-72734

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer...

CVE-2026-72733

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax...

CVE-2026-72732

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...

CVE-2026-12624

Vault’s ACL policy engine did not consistently enforce a wildcard glob deny rule against LIST requests made with a trailing slash on the denied path. This may allow a token holding a broader allow rule alongside a narrower wildcard deny rule to enumerate the names of entries beneath a path it was...

CVE-2026-71577

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server token...

CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-72731

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-72730

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72729

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6,...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-72728

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1...

CVE-2026-72727

Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default...

CVE-2026-72726

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72725

Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72724

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

CVE-2026-56620

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting...

CVE-2026-48158

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...