CVE-2026-76133: Use of a Broken or Risky Cryptographic Algorithm

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate...

CVE-2026-82700: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

CVE-2026-81287: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-19410: Time-of-check Time-of-use (TOCTOU) Race Condition

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-82688: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtualvol.cgi of the component Virtual Volume Handler. The manipulation of the argument fsharename/ftarget/fname leads to os command...

CVE-2026-14696: Missing Release of Memory after Effective Lifetime

When Ethernet bridging is enabled CONFIGNETETHERNETBRIDGE, ethbridgeinputprocess in subsys/net/l2/ethernet/bridge/bridgeinput.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called ethbridgehandlelocall...

CVE-2026-81319: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ash-project ashcloak allows an attacker who can influence the bytes of an encrypted column to crash the BEAM node, by triggering unbounded atom creation or a decompression bomb during decryption. AshCloak.Calculations.Decrypt decodes the decrypte...

CVE-2026-55425: Exposure of Sensitive Information Due to Incompatible Policies

Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in graylog2-server/src/main/java/org/graylog2/rest/resources/system/contentpacks/titles/EntityTitleServiceImpl.java allows an authenticated user to request...

CVE-2026-38638: Uncontrolled Resource Consumption

An issue in the withargv function /unistd/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37751: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-80662: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXLRASCAPABILITYLENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18...

CVE-2026-51663: Improper Access Control

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-13108: Uncontrolled Resource Consumption

WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service...

CVE-2023-36855: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused...

CVE-2026-78002: Incorrect Calculation of Buffer Size

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory...

CVE-2026-59305: Incorrect Behavior Order

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-81688: Missing Encryption of Sensitive Data

opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

CVE-2021-48000: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected...

CVE-2026-47852: Insecure Temporary File

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-19223: Improper Control of Generation of Code

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19225: Improper Control of Generation of Code

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19760: Improper Neutralization of Input During Web Page Generation

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2025-61163: Permissive Cross-domain Policy with Untrusted Domains

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2026-80527: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2025-51679: Sequence of Processor Instructions Leads to Unexpected Behavior

An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior...

CVE-2022-50998: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2022-51000: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-55533: Improper Authentication

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, createauthmiddleware allows requests when auth=api-key lacks PRAISONAIAPIKEY or JWT authentication lacks PRAISONAIJWTSECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests...

CVE-2026-79038: Incorrect Authorization

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-71346: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-79070: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-41707: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-79199: Incorrect Authorization

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-65093: Uncontrolled Search Path Element

NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure...

CVE-2026-79151: Improper Input Validation

Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Medium...

CVE-2026-79191: Incorrect Authorization

Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-13214: Out-of-bounds Write

The OCPP 1.6 client in subsys/net/lib/ocpp/ocppj.c contains a stack buffer overflow in parsegetconfigmsg. When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer skeyCISTR50, declar...

CVE-2026-16231: Improper Neutralization of Input During Web Page Generation

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-79189: Out-of-bounds Write

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-55527: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized userid into self.userpath. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitize...

CVE-2026-79131: Out-of-bounds Write

Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-13081: Undefined Security Weakness

Rejected reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities...

CVE-2025-26238: Improper Control of Generation of Code

In D-Link DI-8100G 17.12.20A1, the flag parameter in mspinfo can be exploited to execute arbitrary code...

CVE-2026-39915: Improper Neutralization of CRLF Sequences in HTTP Headers

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

CVE-2026-77923: Incorrect Authorization

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-71300: Improper Input Validation

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is...

CVE-2026-78136: Improper Neutralization of Directives in Dynamically Evaluated Code

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-74667: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74659: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire brmrpalloctestskb builds MRP test frames on an skb from devallocskb, which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is append...

CVE-2026-16576: Improper Access Control

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...