CVE-2026-101988: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via LDP messages received over an operational LDP session...

CVE-2026-101986: Improper Authentication

An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request...

CVE-2020-37281: Use of Default Cryptographic Key

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject...

CVE-2020-37282: Improper Neutralization of Special Elements used in an OS Command

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf or generateHtml. Attackers can embed $..., backticks, or a closing quote with shell metacharacters in the file name, which is...

CVE-2026-110616: Missing Authentication for Critical Function

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ management API because the authtoken field defaults to null and is never assigned. Attackers sending requests without Authorization or Origin headers to non-loopback...

CVE-2026-104141: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...

CVE-2026-98417: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98423: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the...

CVE-2026-104995: Improper Control of Filename for Include/Require Statement in PHP Program

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

CVE-2026-110868: Server-Side Request Forgery (SSRF)

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110606: Out-of-bounds Read

LibreCAD libdxfrw through LC2.2.0 LibreCAD through 2.2.1.5 contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader caused by calling strlen on non-NUL-terminated buffers. Attackers can supply a crafted AC1018, AC1024 or AC1027 DWG file without NUL bytes in the...

CVE-2026-73252: Integer Underflow (Wrap or Wraparound)

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-73804: Incorrect Privilege Assignment

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-96900: Authorization Bypass Through User-Controlled Key

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

CVE-2026-96904: Exposure of Sensitive Information to an Unauthorized Actor

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

CVE-2026-110619: Missing Authentication for Critical Function

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. Attackers can query /debug/pprof/ endpoints on frps dashboard or frp...

CVE-2026-110770: Improper Restriction of Excessive Authentication Attempts

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110453: Incorrect Authorization

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients...

CVE-2026-73135: Exposure of Sensitive Information to an Unauthorized Actor

Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. Those listings disclose repository metadata even though direct routes correctly deny access with a 404 response. The...

CVE-2016-15060: Buffer Copy without Checking Size of Input

A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the component PORT Command Handler. The manipulation results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2026-98388: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: exec: docloseonexec before taking execupdatelock docloseonexec currently happens while holding the execupdatelock, which is used in a lot of places that access process state to synchronize access checks. I recently added another...

CVE-2026-110310: Observable Response Discrepancy

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-102176: Buffer Copy without Checking Size of Input

A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in the SDK service process of Juniper Networks Junos OS allows an unauthenticated network attacker to cause a denial of service or compromise the Routing Engine by sending specific packets when the SDK service an...

CVE-2026-77371: Improper Access Control

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-110764: Authorization Bypass Through User-Controlled Key

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since...

CVE-2026-110873: Incorrect Authorization

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's errorworkflowid because the field is missing from OWNERONLYEXECUTIONFIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and...

CVE-2026-86566: Integer Underflow (Wrap or Wraparound)

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK...

CVE-2026-87093: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-110870: Improper Input Validation

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-98410: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HWRUNNING watchdog da9063wdtsuspend and da9063wdtresume only check watchdogactive, when the watchdog is left running by the driver sets WDOGHWRUNNING in da9063wdtprobe but userspac...

CVE-2026-110834: NULL Pointer Dereference

FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. Attackers can send IRPMJREAD or IRPMJWRITE before create or after close, causing CommReadFile or CommWriteFile to...

CVE-2026-103994: Heap-based Buffer Overflow

A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon vgd of Juniper Networks Junos OS allows a malicious or compromised SDN-controller to cause a complete outage of the OVSDB control plane and possibly remote code execution...

CVE-2026-102060: NULL Pointer Dereference

A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network...

CVE-2026-104086: Use of Uninitialized Resource

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler SquashfsHandler.cpp that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s noids field is set so that the final metadata block’s expected size ...

CVE-2026-110670: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

CVE-2026-79957: Authorization Bypass Through User-Controlled Key

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-92152: Improper Validation of Array Index

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOutout, bufferOutout, eventOutout, or...

CVE-2026-67414: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10common/src/amqp10binaryparser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the...

CVE-2026-91184: Improper Neutralization of Equivalent Special Elements

Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm and spec.jwt.realm field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as authbasic " ";. A namespaced authenticated attacker that configures...

CVE-2026-64856: Exposure of Sensitive Information to an Unauthorized Actor

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-110604: Off-by-one Error

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxmlstrtod when the locale decimal point is not '.'. Attackers can supply XML with a 63-digit REAL value followed by '.' to write a NUL byte past the 64-byte stack buffer, corrupting stack memory or crashing the...

CVE-2026-110646: Improper Neutralization of Special Elements used in an OS Command

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl value, which executeOnWindows passes unescaped to PHP exe...

CVE-2026-103422: Improper Neutralization of Input During Web Page Generation

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-102985: Missing Authorization

Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partialupdate places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's isactive field, including deactivating a project...

CVE-2026-108337: Weak Password Recovery Mechanism for Forgotten Password

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already...

CVE-2026-55498: Improper Link Resolution Before File Access

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...

CVE-2026-101943: Improper Input Validation

An Improper Input Validation vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a crafted BGP EVPN update message...

CVE-2026-104751: Missing Authorization

The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it...

CVE-2026-107178: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-75085: Out-of-bounds Read

The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154stm32wba.c computed the packet length of a received frame as pktlen = rxframe-length - IEEE802154FCSLENGTH without first checking that the radio-reported length could hold an FCS. pktlen is a uint8t, so a reported length of 0 or 1...