CVE-2026-109925: Unknown Productive Commerce: The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a…

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-122060: Unknown WP Recipe Maker: The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password…

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected...

CVE-2026-114432: Unknown Contact Form 7: The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a…

The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site. On a stock Debian ...

CVE-2026-123521: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows…

Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable...

CVE-2026-97677: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into…

IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the content...

CVE-2026-113698: IBM Db2: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table...

CVE-2026-122085: Unknown Event Tickets Manager for WooCommerce: The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce…

The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an email address of their...

CVE-2026-123572: hickory-dns: Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS…

Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas, or invalid escapes i...

CVE-2026-123518: go-vikunja vikunja: Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write…

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

CVE-2026-123567: sveltejs devalue: Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__…

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

CVE-2026-81209: IBM: IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0…

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.21, 6.2.2.0 - 6.2.2.11 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.21, 6.2.2.0 - 6.2.2.11 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials...

CVE-2026-6715: IBM Concert: IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating…

IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the...

CVE-2026-84228: IBM Guardium Data Protection: IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to…

IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation...

CVE-2026-8642: IBM: IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that…

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions...

CVE-2026-8860: IBM: IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for…

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs...

CVE-2026-84237: IBM Guardium Data Protection: IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to…

IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-8639: IBM: IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...

CVE-2026-93005: IBM Process Mining: IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through…

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients...

CVE-2026-124456: openemr: OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the…

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-16697: IBM: IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and…

IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources...

CVE-2026-2477: IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce…

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthoriz...

CVE-2026-123584: hickory-dns: The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP…

The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can spoof malformed...

CVE-2026-104639: Unknown Razorpay for WooCommerce: The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an…

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret administrators to perform SQL injection attacks...

CVE-2026-123504: go-vikunja vikunja: Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members…

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in targeturl values to post to receiving channel...

CVE-2026-123548: OpenIdentityPlatform OpenAM: OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and…

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-doma...

CVE-2026-124485: openemr: OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that…

OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pidEquals and denialReasonIsNotLike parameters to remove patien...

CVE-2026-124476: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the…

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied formpid or the patientidcc value in Sphere data to onsiteportalactivity without checking it against the session patient. Authenticated portal patients can submit...

CVE-2026-124551: classroomio: ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any…

ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz...

CVE-2026-123523: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account...

CVE-2026-123494: go-vikunja vikunja: Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data…

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the...

CVE-2026-110132: Unknown Sync Post With Other Site: The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for…

The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning content authorship...

CVE-2026-14963: IBM Cognos Command Center: IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to…

IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to execute unauthorized processes due to cross-site request forgery...

CVE-2026-123602: hickory-dns: The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2…

The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 recursor feature is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a...

CVE-2026-123507: go-vikunja vikunja: Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break…

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in...

CVE-2026-123592: hickory-dns: The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash…

The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a signed target only in dot positions c...

CVE-2026-112369: IBM Process Mining: IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to…

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms...

CVE-2026-123581: hickory-dns: Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC…

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the query. Attackers can...

CVE-2026-123590: hickory-dns: Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3…

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 accept NSEC and NSEC3 records for DNSSEC nonexistence proofs when any other record with the same owner name passes signature validation. Attackers able to supply DNS responses can mix validly signed recor...

CVE-2026-123563: sveltejs devalue: Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip…

Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing...

CVE-2026-124493: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that…

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...

CVE-2026-124478: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of…

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility...

CVE-2026-123560: ZcashFoundation zebra: Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync…

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so th...

CVE-2026-123522: go-vikunja vikunja: Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by…

Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.projectid to their own project, routing full task contents t...

CVE-2026-123513: go-vikunja vikunja: Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by…

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token...

CVE-2026-124428: craftcms cms: Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control…

Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without permission checks, t...

CVE-2026-123594: hickory-dns: Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation…

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain an NSEC validation flaw that returns a secure proof for NXDOMAIN responses when the covering NSEC's Next Domain Name is a strict descendant of the query name, which actually proves the name exists...

CVE-2026-123603: hickory-dns: hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and…

hickory-proto and hickory-resolver 0.26.0 before 0.26.2, hickory-server 0.25.0-alpha.1 before 0.26.2, and hickory-recursor 0.25.0-alpha.3 through 0.26.0-alpha.1 fail to canonicalize IPv4-mapped IPv6 addresses when checking denyanswers, denyserver, or AccessControlSet rules. Attackers can use...

CVE-2026-123571: hickory-dns: Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows…

Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow, crashing builds wit...

CVE-2026-123519: go-vikunja vikunja: Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process…

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

CVE-2026-123525: go-vikunja vikunja: Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers,…

Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments o...