CVE-2026-4129

NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...

CVE-2026-81051

Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Security Version Number Mutable to Older Versions vulnerability. A low-privileged attacker with physical access can potentially exploit this flaw to bypass the system's protection mechanism, resulting in high impact across conf...

CVE-2026-88012

Traefik , the open-source HTTP reverse proxy and load balancer, has a flaw in how HTTP/3 entrypoints handle respondingTimeouts.readTimeout . The timeout is enforced at the TCP layer, but HTTP/3 operates over QUIC , which has no corresponding stream deadline. This means an unauthenticated attacker...

CVE-2026-81048

Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by a Command Injection vulnerability (Improper Neutralization of Special Elements used in a Command). An unauthenticated attacker with adjacent network access could exploit this to achieve Remote Code Execution , with a CVSS 3.1 score ...

CVE-2026-81052

Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this flaw to achieve arbitrary code execution , resulting in high impact to confidentiality, integr...

CVE-2026-88011

Traefik , an open-source HTTP reverse proxy and load balancer, is vulnerable to ForwardAuth identity spoofing via a dot-form header alias (e.g., X.Authenticated.User). Because Go treats dot-form headers as distinct from their dash-form equivalents (e.g., X-Authenticated-User), a client-supplied d...

CVE-2026-88940

knowns through version 0.33.0 fails to validate the path query parameter in the workspace browse endpoint , allowing remote, unauthenticated attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identi...

CVE-2026-88939

knowns through 0.33.0 unconditionally exempts the project.set action from permission guard checks, allowing read-only agent sessions to bypass restrictions. An attacker with a read-only session can invoke project.set to repoint the server at another project directory, thereby obtaining write acce...

CVE-2026-88938

knowns through version 0.33.0 is affected by a path traversal vulnerability in the code.find MCP tool . The tool fails to confine its path argument to the project root, allowing an AI agent session to supply absolute paths or relative traversal sequences and retrieve full file contents from outsi...

CVE-2026-88937

knowns through version 0.33.0 is affected by a path traversal vulnerability in its code generation template engine (internal/codegen/template_engine.go). The engine fails to properly validate template destination paths, allowing an attacker who supplies a malicious template to read and write arbi...

CVE-2026-88899

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. This allows remote, unauthenticated attackers to supply arbitrary directory paths, enabling file operations outside the project root on the host system. The vulnera...

CVE-2026-88914

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-11446

CVE-2026-11446 affects the WordPress plugin Booktics – Booking Calendar for Appointments and Service Businesses in versions ≤ 1.0.23 . The vulnerability is a missing authorization flaw, meaning certain functionality accessible without proper permission checks could allow an unauthorized user to p...

CVE-2026-18251

IBM i Navigator for i is vulnerable to information disclosure due to improper validation of the WebSocket origin (CWE-1385). A remote attacker with no authentication, but requiring user interaction, can obtain sensitive information (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The vulnerabilit...

CVE-2026-18515

CVE-2026-18515 affects IBM i Navigator for i in versions 7.3 through 7.6. The vulnerability stems from improper path validation (CWE-22, Path Traversal), allowing a remote authenticated attacker to place files into locations in the file system that should be blocked by Navigator configuration. Th...

CVE-2026-18151

IBM i Navigator for i is affected by a race condition during the WebSocket handshake process , allowing a remote authenticated attacker to obtain sensitive information. The vulnerability is classified as CWE-362 (Race Condition) with a CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). ...

CVE-2026-88009

Traefik , an open-source HTTP reverse proxy and load balancer, is affected by a request-target handling flaw prior to 2.11.57 and 3.7.13 . A rootless HTTP/1 request target is stored by Go in URL.Opaque while URL.Path remains empty. The rewriteRequestBuilder evaluates routing, path sanitization, f...

CVE-2026-88008

Traefik (open source HTTP reverse proxy and load balancer) versions 2.11.26 through 2.11.57 and 3.7.13 forward a client-supplied Connection header requesting Upgrade: h2c along with HTTP2-Settings to a shared backend. If that backend accepts h2c and returns 101 Switching Protocols , Traefik enter...

CVE-2026-18065

IBM i Navigator for i and Digital Certificate Manager for i (and separately, IBM Db2 Mirror for i ) are vulnerable to Authentication Bypass by Spoofing (CWE-290) due to a session IP binding bypass , allowing a remote unauthenticated attacker to gain access to sensitive information. The vulnerabil...

CVE-2026-7438

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-88007

Traefik versions 2.11.0 through 2.11.57 and 3.7.13 contain a backend connection reuse flaw in the HTTP/3 entrypoint. The ConnContext does not call service.AddTransportOnContext, causing kerberosRoundTripper to share a single backend transport across all frontend connections rather than using a de...

CVE-2026-88898

AppFlowy-Cloud versions 0.7.2 through 0.9.64 contain a missing authorization check in the bulk publish endpoint , which fails to verify that the caller is authorized against the target workspace. An authenticated user can exploit this to publish content into other tenants' namespaces, writing vie...

CVE-2026-88897

Flextype CMS versions up to 1.0.0-alpha.3 transmit API authentication credentials via URL query string parameters in REST API routes. Because query strings are commonly logged, an attacker with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API a...

CVE-2026-17047

IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6 ) is vulnerable to Cross-Site Request Forgery (CSRF) due to improper request validation in its GUI component. A remote attacker could exploit this to obtain sensitive information , requiring user interaction but no prior authentication (CVSS 3.1 ba...

CVE-2026-88006

Open WebUI (a self-hosted AI platform) is affected by an authentication bypass in its OAuth token exchange endpoint from version 0.8.0 through 0.11.1 . The endpoint issues a session for a provider access token without executing the OAuth role management that the normal login callback performs. As...

CVE-2026-88005

Open WebUI versions 0.8.0 through 0.9.0 are affected by a bypass in the OAuth token exchange endpoint . The endpoint issues a valid session for a provider access token without enforcing the email domain allowlist that the standard OAuth login callback applies. As a result, an account whose email ...

CVE-2026-15461

Zephyr RTOS HL78xx modem GNSS driver contains a type confusion caused by a struct member offset mismatch: struct gnss_nmea0183_match_data was placed as the second member instead of the first, so NMEA parse callbacks read and write state at a shifted offset. The GSV callback reads a bogus pointer ...

CVE-2026-88004

Traefik (open source HTTP reverse proxy and load balancer) versions 3.2.0 through 3.7.12 have a header sanitization bypass. The entrypoint defenses aliasHeadersStrategy , underscoreHeadersStrategy , and forwardedHeaders inspect only req.Header but not req.Trailer. An unauthenticated client can pl...

CVE-2026-88924

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the gvfsd-admin daemon of gvfs (GNOME Virtual Filesystem). The privileged daemon calls the link-following chown() on a socket pathname inside a user-controlled directory; a local attacker can replace that pathname with a symbolic link ...

CVE-2026-84821

CVE-2026-84821 affects the WP Fast Total Search WordPress plugin in versions

CVE-2026-84816

CVE-2026-84816 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress WPCS (Currency Switcher) plugin , affecting versions ≤ 1.3.2 . The flaw allows a remote, unauthenticated attacker to inject script via network access, requiring user interaction, with changed scope and ...

CVE-2026-84819

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-81805

CVE-2026-81805 is an unauthenticated privilege escalation vulnerability affecting the SiteSkite WordPress plugin in versions 2.1.5 and earlier . A remote attacker with no prior authentication can escalate privileges on the target site, resulting in high impact on confidentiality, integrity, and a...

CVE-2026-81803

CVE-2026-81803 affects the WordPress RepairBuddy plugin in versions 4.1224 and below . A Subscriber-level (low-privilege) user can achieve Remote Code Execution (RCE) , meaning any authenticated user with the lowest typical WordPress role could potentially execute arbitrary code on the server. Th...

CVE-2026-81804

ZHBackup – Backup, Restore & Migration WordPress plugin versions up to and including 2.4.2 are affected by an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows an attacker to retrieve sensitive data over the network without any prior authentication or user interaction. The CV...

CVE-2026-81801

Subscriber Settings Change in WP-Stateless = 4.4.1 versions...

CVE-2026-81800

CVE-2026-81800 affects the WordPress plugin Verified Reviews (Avis Vérifiés) in versions ≤ 2.4.6 , where an unauthenticated SQL injection vulnerability is present. The flaw allows a remote attacker with no prior access to execute crafted SQL queries, resulting in a high confidentiality impact and...

CVE-2026-81799

An unauthenticated Broken Access Control vulnerability was discovered in the Return Refund and Exchange For WooCommerce WordPress plugin, affecting versions ≤ 4.6.4 . The flaw was identified by babyhack (@OPCIA) and carries a CVSS 3.1 score of 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C...

CVE-2026-81795

CVE-2026-81795 affects the WordPress plugin Page Visits Counter – Lite in versions ≤ 1.2.3 , introducing an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw requires user interaction and has a CHANGED scope , meaning successful exploitation can impact the victim's browser sessio...

CVE-2026-81796

Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...

CVE-2026-81794

CVE-2026-81794 affects the Shirt Product Designer for WooCommerce plugin version 1.0.4 , introducing an unauthenticated Broken Access Control vulnerability. An attacker can exploit this over the network with low complexity, no required privileges, and no user interaction, resulting in a high impa...

CVE-2026-81793

An unauthenticated Broken Access Control vulnerability affects the WordPress Salon booking system plugin in versions 10.31.5 and earlier . Discovered by Tiago Ventura (@perses), the flaw allows attackers to access or modify data with low integrity and low availability impact without requiring any...

CVE-2026-81791

The WordPress EventON plugin , versions

CVE-2026-81789

Advanced Product Fields Extended for WooCommerce WordPress plugin, versions ≤ 3.1.6 , is affected by an unauthenticated arbitrary file deletion vulnerability. The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating a network-exploitable issue requiring no...

CVE-2026-81788

CVE-2026-81788 affects the WordPress IMPress for IDX Broker plugin in versions

CVE-2026-81787

CVE-2026-81787 affects the WordPress plugin IMPress for IDX Broker (versions ≤ 3.3.0 ). The vulnerability is an unauthenticated Broken Authentication flaw, meaning an attacker with network access and no prior credentials can exploit it. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:...

CVE-2026-81786

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81784

An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...

CVE-2026-81785

CVE-2026-81785 affects the WordPress BuddyForms plugin , versions 2.9.0 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any credentials or user interaction. The CVSS v3.1 score is 6.5 (Medium) , with low...

CVE-2026-81783

CVE-2026-81783 affects the WordPress plugin MailMunch – Grow your Email List , versions ≤ 3.2.5 . The vulnerability is a Broken Authentication flaw exploitable by users with the Subscriber role. Discovered by Jakub Herman , it carries a CVSS 3.1 score of 7.1 (HIGH) with the vector AV:N/AC:L/PR:L/...