AI Vulnerability Database
CVEs added in
July 2026
Every CVE that went into the database in July 2026, newest first. Each one opens its full write-up.
CVE-2026-68771
Unsafe Deserialization (CWE-502) in ComfyUI Load Node
CVE-2026-52134
Auth Bypass (CWE-284) in libiec61850 GOOSE Handler
CVE-2026-68770
Code Execution (CWE-94) via SentenceTransformers Loader
CVE-2026-65981
Authorization Bypass (CWE-639) in Coturn Mobility Mode
CVE-2025-69948
SQL Injection (CWE-89) in Loan Management Admin API
CVE-2025-69946
SQL Injection (CWE-89) in Loan Management AJAX API
CVE-2026-62999
Path Traversal (CWE-22) in Copier Trusted Template URLs
CVE-2026-53599
Dangerous File Upload (CWE-434) in REDAXO Mediapool
CVE-2026-53510
Code Injection (CWE-94) in Savon SOAP Ruby Client
CVE-2026-18394
Authorization Bypass (CWE-863) in Strands HTTP Tool
CVE-2026-53503
Divide-by-zero DoS (CWE-369) in Thumbor Filter
CVE-2026-53500
Server-Side Request Forgery (CWE-918) in Thumbor
CVE-2026-18481
Stored XSS (CWE-79) in AWS Ops Wheel participant URLs
CVE-2026-54725
SSRF via Vault Annotations (CWE-918) in K8s Webhook
CVE-2026-52855
Sensitive Config Exposure (CWE-200) in Wings Eggs
CVE-2026-17566
Command Injection (CWE-78) in pgAdmin 4 Import/Export
CVE-2026-17351
SQL Injection (CWE-89) in pgAdmin 4 AI Assistant
CVE-2026-17349
Credential Exposure via Server Cloning (CWE-522) in pgAdmin
CVE-2026-17347
OS Command Injection (CWE-78) in pgAdmin 4 Hook
CVE-2026-17346
SQL Injection (CWE-89) in pgAdmin 4 statistics views
CVE-2026-11770
LDAP Injection (CWE-90) in 389 Directory Server RUV Op
CVE-2026-63223
Unrestricted File Upload (CWE-434) in CodeIgniter
CVE-2026-63222
Path Traversal (CWE-22) in CodeIgniter UploadedFile::move
CVE-2026-63221
SQL Injection (CWE-89) in CodeIgniter deleteBatch
CVE-2026-56673
Path Traversal (CWE-22) in ComfyUI Media Load Nodes
CVE-2026-56672
Stored XSS (CWE-79) in ComfyUI userdata endpoint
CVE-2026-56671
Path Traversal (CWE-22) in ComfyUI Model Preview API
CVE-2026-56670
Stored XSS (CWE-79) via SVG handling in ComfyUI
CVE-2026-55502
Authorization Bypass (CWE-863) in Cloudreve OAuth Policy
CVE-2026-43830
Command Injection (CWE-77) in Firmware Verification
CVE-2026-14541
Authentication Bypass (CWE-287) in Google MCP Toolbox
CVE-2026-14538
Authorization Bypass (CWE-285) in Google mcp-toolbox SQL
CVE-2026-14537
Incorrect Authorization (CWE-863) in MCP Toolbox API
CVE-2026-66421
Stored XSS (CWE-79) in OpenClaw Dashboard Sessions
CVE-2026-62246
Privilege Issues (CWE-284) in Kamaji Tenant Control Planes
CVE-2026-12562
Missing Authentication (CWE-306) in RCU II+ Debug Service
CVE-2026-68502
Missing Authentication (CWE-306) in LazyOwn C2 Command Path
CVE-2026-68500
Broken Authorization (CWE-639) in Sylius Mollie Plugin
CVE-2026-66418
Stored XSS (CWE-79) in OpenClaw Dashboard Logs
CVE-2026-52539
Hardcoded JWT Secret (CWE-798) in Outstatic CMS Auth
CVE-2026-35847
OS Command Injection (CWE-77) in dnsmgr ping utility
CVE-2025-69947
SQL Injection (CWE-89) in Tailor Management System 1.0
CVE-2025-69941
SQL Injection (CWE-89) in Tailor Management System
CVE-2025-69938
SQL Injection (CWE-89) in CodeAstro Membership System
CVE-2025-69937
SQL Injection (CWE-89) in CodeAstro Membership System
CVE-2025-69936
SQL Injection (CWE-89) in CodeAstro Membership System
CVE-2025-69935
SQL Injection (CWE-89) in CodeAstro Membership System
CVE-2025-69934
SQL Injection (CWE-89) in CodeAstro Member Delete
CVE-2025-69933
SQL Injection (CWE-89) in CodeAstro Member Profile
CVE-2025-69931
SQL Injection (CWE-89) in CodeAstro Membership System
CVE-2025-69930
SQL Injection (CWE-89) in Membership Card Endpoint
CVE-2025-65336
SQL Injection (CWE-89) in Fruits Bazar price lookup
CVE-2026-67594
Missing Authentication (CWE-306) in Spikster API Routes
CVE-2026-67527
Missing Authorization (CWE-862) in OpenProject FileLinks
CVE-2026-67208
Auth Bypass and RCE (CWE-306) in Juggle H2 Console
CVE-2026-67206
Unrestricted File Upload (CWE-434) in Wolf CMS FileManager
CVE-2026-66416
CSRF (CWE-352) in Leantime Laravel Middleware Stack
CVE-2026-66415
SSRF & File Inclusion (CWE-918) in Leantime Import API
CVE-2026-61536
Arbitrary Python Import (CWE-94) in Banks Tool Engine
CVE-2026-18245
Code Injection (CWE-94) in AWS Amplify UI Codegen
CVE-2026-15978
Missing Remote Auth (CWE-306) in SGLang Weight API
CVE-2026-15977
Credential Leakage (CWE-522) via SGLang server_info
CVE-2026-15976
Unsafe Pickle Deserialization (CWE-502) in SGLang
CVE-2026-15971
Dynamic Code Eval RCE (CWE-95) in SGLang Dumper
CVE-2026-15969
Unauthenticated RCE via Pickle (CWE-502) in SGLang API
CVE-2026-62663
Path Traversal (CWE-22) in Banks Media Filters
CVE-2026-57862
SSRF via Hex IP Bypass (CWE-918) in Kanboard URLs
CVE-2026-6540
Path Traversal (CWE-22) in Calico Dikastes Policies
CVE-2026-67349
Missing Authentication (CWE-306) in OpenCost API
CVE-2026-67348
IDOR (CWE-639) in Julep execution details API
CVE-2026-67346
SSRF via Unsafe URL Validation (CWE-918) in Swarms App
CVE-2026-41186
Unauthenticated pprof Exposure (CWE-200) in Calico
CVE-2026-57859
PHP Unsafe Deserialization (CWE-502) in e107 e_array
CVE-2026-17543
SQL Injection (CWE-89) in PHP Runtime Parameter Handling
CVE-2026-18361
Stored Cross-Site Scripting (CWE-79) in IRIS Datastore
CVE-2026-18360
Stored XSS (CWE-79) in IRIS Custom Attributes
CVE-2026-16969
Stored Cross-Site Scripting (CWE-79) in IRIS Assets
CVE-2026-58066
SAML Signature Wrapping Auth Bypass (CWE-287) in Rocket.Chat
CVE-2025-69949
SQL Injection (CWE-89) in Hospital Management System
CVE-2025-69945
SQL Injection (CWE-89) in Hospital Management System
CVE-2025-69944
SQL Injection (CWE-89) in Hospital Management System
CVE-2025-69943
SQL Injection (CWE-89) in Hospital Management System
CVE-2025-69942
Critical SQL Injection (CWE-89) in Hospital System 4.0
CVE-2025-67408
SQL Injection (CWE-89) in CASAP Enrollment System
CVE-2025-67407
SQL Injection (CWE-89) in CASAP Enrollment update_student
CVE-2025-67406
SQL Injection (CWE-89) in Advocate Case Activation
CVE-2025-67405
SQL Injection (CWE-89) in CASAP password update
CVE-2025-67404
SQL Injection (CWE-89) in CASAP Enrollment System 1.0
CVE-2025-67403
SQL Injection (CWE-89) in CASAP Enrollment System
CVE-2026-50782
XML External Entity (CWE-611) in Jinher OA C6 Endpoint
CVE-2025-65340
SQL Injection (CWE-89) in Hospital Management System
CVE-2026-67429
Path Traversal (CWE-22) in Flyto2 Core File Writing
CVE-2026-67428
SSRF (CWE-918) in Flyto2 Core HTTP Workflow Modules
CVE-2026-67427
Env Expansion Bypass (CWE-693) in Flyto2 Core Engine
CVE-2026-67426
SSRF and Secret Exposure (CWE-918) in Flyto2 Core
CVE-2026-67425
API Key Disclosure (CWE-201) in Flyto2 llm.chat Core
CVE-2026-67424
SSRF via Unvalidated Redirects (CWE-918) in Flyto2 Core
CVE-2026-59898
WebSocket Protocol Confusion (CWE-444) in Netty Framework
CVE-2026-54680
Config Injection (CWE-74) in Kubernetes Logging
CVE-2026-51992
SQL Injection (CWE-89) in ClickHouse dictionary creation
CVE-2026-15144
Rate Limit Bypass (CWE-307) in Fastify IPv6 Buckets
CVE-2026-13697
Cache-Control Parsing Flaws Leak Private Data in undici
CVE-2026-60113
Missing Auth (CWE-306) in AIT DSN SLE API Manager
CVE-2026-60112
Missing Authentication (CWE-306) in AIT Command GUI
CVE-2026-54735
SSRF (CWE-918) in Prebid Server Bidder Adapters
CVE-2026-54666
Code Injection (CWE-94) in swagger-typescript-api
CVE-2026-54664
Template Injection (CWE-94) in swagger-typescript-api
CVE-2026-54662
TS Code Injection (CWE-94) in swagger-typescript-api
CVE-2026-54661
Code Injection (CWE-94) in Swagger TypeScript API
CVE-2026-54660
Token Exfiltration (CWE-200) via Remote OpenAPI Refs
CVE-2026-64863
Authorization Bypass (CWE-284) in goshs WebDAV MOVE
CVE-2026-62325
Missing Authentication (CWE-306) in goshs SFTP server
CVE-2026-54719
Missing Auth for Bulk ZIP (CWE-862) in goshs Server
CVE-2026-54658
SQL Injection (CWE-89) in Hypequery ClickHouse Layer
CVE-2026-54650
Path Traversal (CWE-22) in openhole HTTP Tunneling Proxy
CVE-2026-47219
HTTP/2 Method Parsing DoS (CWE-20) in find-my-way
CVE-2026-55415
Code Injection (CWE-94) via imports in datamodel generator
CVE-2026-55391
DNS Rebinding SSRF (CWE-918) in datamodel-code-generator
CVE-2026-55390
XML Schema path traversal (CWE-22) in code generator
CVE-2026-55389
Path Traversal (CWE-22) in datamodel-code-generator
CVE-2026-54691
SSRF (CWE-918) in datamodel-code-generator HTTP client
CVE-2026-54690
SSRF via Remote JSON Schema $ref (CWE-918) in Tool
CVE-2026-54656
Code Injection (CWE-94) in Pydantic v2 Model Generator
CVE-2026-54655
Code Injection (CWE-94) via JSON Schema in Generator
CVE-2026-54654
Code Injection (CWE-94) via Comments in datamodel Generator
CVE-2026-54653
Code Injection (CWE-94) in datamodel-code-generator
CVE-2026-54621
Code Injection (CWE-94) in datamodel-code-generator
CVE-2026-57510
Broken Object Authorization (CWE-639) in SuperPlane
CVE-2026-55555
File Existence Oracle (CWE-203) in Dompdf CSS Parser
CVE-2026-55554
Path Traversal (CWE-20) in Dompdf Chroot Validation Checks
CVE-2026-48060
XSS via CSRF Cookie Handling (CWE-79) in Litestar
CVE-2026-49258
Broken Access Control (CWE-639) in Nebula Mesh UI
CVE-2026-18107
Privilege Context Confusion (CWE-269) in CRIU rseq Handling
CVE-2026-59931
SSRF via Redirects (CWE-918) in PhpSpreadsheet WEBSERVICE
CVE-2026-54635
Broken Auth (CWE-287) in pytonapi Webhook Dispatcher
CVE-2026-67185
Path Traversal (CWE-22) in TinyWeb HttpBuilder
CVE-2026-67182
HTTP Request Smuggling (CWE-444) in Rouille Proxy
CVE-2026-54605
Redirect Handling Data Exposure (CWE-200) in Ruby OAuth
CVE-2026-54603
Bearer Token Leak via Redirect (CWE-601) in OAuth2 Gem
CVE-2026-66748
Ruby Code Injection (CWE-94) in Camaleon CMS Fields
CVE-2026-54545
Path Traversal (CWE-22) in wakaru JavaScript CLI Tool
CVE-2026-45293
Eval Injection (CWE-95) in WordPress Coding Standards
CVE-2026-43910
Improper URL Redirection (CWE-441) in Appium Java Client
CVE-2026-66713
Java Deserialization (CWE-502) in Axis2 Tribes Cluster
CVE-2026-17524
Directory Traversal (CWE-22) in zip-lib Extraction Logic
CVE-2026-16481
SSRF (CWE-918) in Google MCP FHIR Fetch Tool OAuth
CVE-2026-64642
Auth Bypass (CWE-285) in Next.js Turbopack i18n Apps
CVE-2026-55579
Hardcoded Default Admin Password (CWE-798) in Pheditor
CVE-2026-55578
OS Command Injection (CWE-78) in Pheditor Terminal
CVE-2026-54540
Command Injection (CWE-78) in Pheditor Terminal Shell
CVE-2026-48030
OS Command Injection (CWE-78) in Pheditor Terminal
CVE-2026-45623
Path Traversal (CWE-22) in PostCSS Source Map Parser
CVE-2026-17552
SSRF (CWE-918) via URL Rewrite in Plack::App::Prerender
CVE-2026-66396
Stored XSS (CWE-79) in SiYuan Gallery and Kanban Covers
CVE-2026-66395
Reflected XSS (CWE-79) in SiYuan Electron Bazaar
CVE-2026-66394
Stored XSS (CWE-79) via SVG Sanitization in SiYuan
CVE-2025-50455
SQL Injection (CWE-89) in EasyAppointments search API
CVE-2026-66050
Path Traversal (CWE-22) in NitroShare LAN File Server
CVE-2026-17497
Command Injection (CWE-78) via Tauri Shell in NoteGen
CVE-2026-17496
Prompt-Induced XSS (CWE-79) in NoteGen Chat Preview
CVE-2026-63720
Code Injection (CWE-94) in datamodel-code-generator
CVE-2026-66012
Missing Authorization (CWE-862) in SiYuan MCP Endpoint
CVE-2026-16766
Shell Command Injection (CWE-78) in Perl Wkhtmltopdf View
CVE-2026-61884
Missing Authentication (CWE-306) in Tycon TPDIN-Monitor
CVE-2025-71408
Eval Injection (CWE-95) in NLTK Collocations Module
CVE-2026-54342
Improper TLS Certificate Validation (CWE-295) in epa4all
CVE-2026-48021
TLS Trust Failure (CWE-295) in epa4all VAU Handshake
CVE-2026-65711
OS Command Injection (CWE-78) in sysPass Backup Path
CVE-2026-65710
Authorization Bypass (CWE-639) in sysPass Public Links
CVE-2026-65709
Broken Object-Level Authorization (CWE-639) in sysPass API
CVE-2026-65708
IDOR Access Control (CWE-639) in sysPass Vault
CVE-2026-66027
Broken Access Control (CWE-862) in Suna Queue API
CVE-2026-65693
SSTI (CWE-94) in Microweber CMS Mail Templates
CVE-2026-15704
ABAC AuthZ Bypass (CWE-863) in BaSyx Go Router
CVE-2026-16870
Memory Corruption & SSRF (CWE-121) in Snowflake Client
CVE-2026-65694
Path Traversal (CWE-22) in Microweber CMS Static Files
CVE-2026-65604
Input Validation Flaw (CWE-20) in Skipper OPA Bridge
CVE-2026-63732
Command Injection (CWE-78) via MCP Plugins in 9router
CVE-2026-63313
Server-Side Request Forgery (CWE-918) in 9Router SSRF API
CVE-2026-16765
SQL Injection (CWE-89) in Online Classroom loginlink
CVE-2025-71389
Code Injection (CWE-94) in Cal.com Next.js RSC Handler
CVE-2024-58355
Stored XSS (CWE-80) in Cal.com booking-question labels
CVE-2024-58354
Command Injection (CWE-77) in cal.com GitHub Actions
CVE-2024-58353
Stored XSS (CWE-80) in Cal.com public booking pages
CVE-2026-47724
Missing Authorization (CWE-862) in Nebula Mesh API
CVE-2026-38764
Kernel Privilege Escalation (CWE-269) in Protegent 360
CVE-2026-63359
SQL Injection (CWE-89) in Appriss VINE Applications
CVE-2026-63765
Auth Bypass (CWE-306) in Chatwoot Direct Uploads
CVE-2026-65919
Path Traversal (CWE-22) in Meshery File APIs
CVE-2026-65702
Path Traversal (CWE-22) in Vanna File Storage Layer
CVE-2026-65701
Path Traversal (CWE-22) in SoftVC VITS wav2wav API
CVE-2026-65700
Path Traversal (CWE-22) in h2oGPT Files API
CVE-2026-47743
Access Control and XSS (CWE-639, CWE-79) in Shopper
CVE-2026-47668
Code Injection (CWE-94) in DbGate JSON Script Runner
CVE-2026-65917
IDOR (CWE-639) in CyberPanel incremental backups
CVE-2026-65916
Missing Authorization (CWE-862) in CyberPanel Backup API
CVE-2026-15616
Missing MFA Enforcement (CWE-308) in Logto SSO Flows
CVE-2026-15611
Improper Auth Verification (CWE-287) in Logto SSO Linking
CVE-2026-65898
Stored XSS (CWE-79) via DOMPurify Hook Config Mutation
CVE-2026-65897
Privilege Escalation (CWE-269) in Grav API Plugin
CVE-2026-65896
Path Traversal (CWE-73) in Grav API move endpoint
CVE-2026-65895
Missing Authorization (CWE-862) in Grav API Plugin
CVE-2026-65606
XSS (CWE-79) via SiYuan custom protocol tab header
CVE-2026-65605
Stored XSS (CWE-79) in SiYuan Attribute View Cells
CVE-2026-16723
Critical JSON Deserialization (CWE-502) in fastjson RCE
CVE-2026-15074
Path Traversal Guard Bypass (CWE-22) in Fastify Static
CVE-2026-16632
Input Validation Flaw (CWE-20) in facil.io WebSockets
CVE-2026-38766
Privilege Escalation (CWE-269) in Protegent 360 v2.0.0.4
CVE-2026-38765
Privilege Escalation (CWE-269) in Protegent 360 Driver
CVE-2025-60835
Directory Traversal (CWE-35) in IZArc unrar.dll Module
CVE-2026-14881
Command Injection (CWE-78) via Compass OIDC Import
CVE-2026-16624
Broken Authorization (CWE-639) in Cal.com Team Webhooks
CVE-2026-65013
Broken Object-Level Authorization (CWE-639) in Onlook
CVE-2026-65603
Privilege Escalation (CWE-269) in Grav Login Plugin
CVE-2026-65602
Authorization Bypass (CWE-863) in Traefik TCP Routes
CVE-2026-65601
Authorization Bypass (CWE-863) in Traefik Gateway API
CVE-2026-65596
Missing Domain Check (CWE-863) in n8n GraphQL Node
CVE-2026-65595
Privilege Misassignment (CWE-269) in n8n Token Exchange
CVE-2026-65590
Shell Command Injection (CWE-78) in n8n computer-use
CVE-2026-65016
Privilege Escalation (CWE-639) in n8n SSO Role Provisioning
CVE-2026-65015
Missing Authorization Checks (CWE-863) in n8n AI Agents
CVE-2026-56820
Improper TLS Certificate Validation (CWE-295) in Netty
CVE-2026-56817
XXE (CWE-611) via XmlDecoder in Netty XML pipeline
CVE-2026-65319
Missing Authentication (CWE-306) in Feedbin Entries API
CVE-2026-65318
Unauthenticated SSRF (CWE-918) in Verba RAG Import
CVE-2026-65317
SSRF (CWE-918) via Origin Bypass in Verba RAG API
CVE-2026-47731
Path Traversal (CWE-22) in AMMOS BSC HTTP Logging API
CVE-2026-47247
Heap Data Exposure (CWE-200) via libheif Grid Decoding
CVE-2026-16484
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-65057
Server-Side Request Forgery (CWE-918) in Keep Healthcheck
CVE-2026-65056
SSRF (CWE-918) in mcp-webresearch visit_page tool
CVE-2026-63764
SSRF via Unsafe Redirect Handling (CWE-918) in lmdeploy
CVE-2026-52476
SQL Injection (CWE-89) in aiflowy DatacenterQuery
CVE-2026-52474
Information Exposure (CWE-200) in aiflowy JobUtil.java
CVE-2026-52472
SQL Injection (CWE-89) in Wgcloud PortInfoMapper.xml
CVE-2026-52470
SQL Injection (CWE-89) in Crocus RecordStateMapper.xml
CVE-2026-52469
SQL Injection (CWE-89) in Crocus DeviceInfoMapper
CVE-2026-47697
Cross-tenant Access Control (CWE-863) in Shelf
CVE-2026-47690
GitHub Actions secret exposure (CWE-1336) in MeltanoHub
CVE-2026-47688
Missing Authorization (CWE-862) in FOG Client Endpoint
CVE-2026-47687
Stored XSS (CWE-79) in FOG Inventory Report Helper
CVE-2026-47685
Stored XSS (CWE-79) in FOG Host Inventory Service
CVE-2026-30633
Directory Traversal (CWE-22) in Knowns Document Tools
CVE-2026-30631
OS Command Injection (CWE-78) in bytebot-ai I/O Path
CVE-2026-50759
Missing Authentication (CWE-306) in Exo Explore API
CVE-2026-50758
Reflected XSS (CWE-79) in next-ai-draw-io mcp Parameter
CVE-2026-50757
Directory Traversal (CWE-22) in next-ai-draw-io MCP
CVE-2026-30632
Directory Traversal (CWE-22) in Knowns create_doc Tool
CVE-2026-55084
Error-Based SQL Injection (CWE-89) in DHIS2 SqlView API
CVE-2026-47419
IDOR (CWE-639) in PraisonAI Platform Agents API
CVE-2026-47418
IDOR Access Control Flaw (CWE-639) in PraisonAI
CVE-2026-47417
IDOR (CWE-639) in PraisonAI workspace comments
CVE-2026-47416
Privilege Escalation (CWE-269) in PraisonAI Workspace
CVE-2026-47415
IDOR (CWE-639) in PraisonAI workspace issues API
CVE-2026-47414
IDOR on Label Management (CWE-639) in PraisonAI
CVE-2026-47413
Privilege Escalation (CWE-269) in PraisonAI Workspaces
CVE-2026-47412
Authorization Bypass (CWE-269) in PraisonAI Workspace
CVE-2026-47410
Hardcoded JWT Secret (CWE-321) in PraisonAI
CVE-2026-47409
Authorization Bypass (CWE-269) in PraisonAI Workspace
CVE-2026-47406
IDOR (CWE-639) in PraisonAI Issue Dependencies API
CVE-2026-47405
Broken Access Control (CWE-284) in PraisonAI Platform
CVE-2026-47399
Object-Level Access Control Flaw (CWE-639) in PraisonAI
CVE-2026-47398
Code Injection (CWE-94) via YAML module paths in PraisonAI
CVE-2026-15829
SQL Injection (CWE-89) in MCP Toolbox BigQuery Forecast Tool
CVE-2026-15792
Input Validation Flaw (CWE-20) in BuildKit Daemon
CVE-2026-15791
Path Traversal (CWE-22) in BuildKit Low-Level API
CVE-2026-15789
Path Traversal (CWE-22) in BuildKit Upload Handling
CVE-2026-64825
Path Traversal (CWE-22) in Home Assistant Backups
CVE-2026-64824
Path Traversal (CWE-22) in Home Assistant Backups
CVE-2026-47396
Missing Auth on Agent Control API (CWE-306) in PraisonAI
CVE-2026-47393
Missing Auth (CWE-306) in PraisonAI API Generator
CVE-2026-47391
Unauthenticated eval() Tool (CWE-95) in PraisonAI A2A
CVE-2025-66390
Authorization Misconfig (CWE-284) in Azure API Mgmt
CVE-2026-16445
Command Injection (CWE-78) in dracut initrd networking
CVE-2026-65008
Arbitrary Code Execution (CWE-94) in Grav Blueprints
CVE-2026-65007
Missing Authorization (CWE-862) in Grav API Plugin
CVE-2026-64625
OS Command Injection (CWE-78) in AVideo Live Plugin
CVE-2026-55550
Privilege Bypass (CWE-269) in NextCRM MCP API
CVE-2026-55544
Broken Access Control (CWE-284) in NextCRM MCP APIs
CVE-2026-51031
SSRF (CWE-918) in FlareSolverr /v1 API endpoint
CVE-2026-47255
Input Validation and Access Control Flaws in AgenticMail
CVE-2026-53595
Authentication Bypass (CWE-287) in FreeScout Invites
CVE-2026-47198
Improper Input Validation (CWE-20) in Paymenter Checkout
CVE-2026-47130
Broken Object Authorization (CWE-639) in NextCRM API
CVE-2026-47129
Broken Access Control (CWE-862) in NextCRM roles
CVE-2026-44508
Integer Overflow Data Leak (CWE-190) in Rsync Tool
CVE-2026-63767
Unsafe Pickle Deserialization (CWE-502) in ktransformers
CVE-2026-63766
OS Command Injection (CWE-78) in GPT-SoVITS Web UI
CVE-2026-53593
File Upload Bypass (CWE-434) in FreeScout Agents
CVE-2026-53591
Authentication Bypass (CWE-287) in FreeScout Replies
CVE-2026-44231
Auth Credential Disclosure (CWE-200) in RT REST API
CVE-2026-63771
HTTP Header Injection (CWE-113) in Adminer Cookies
CVE-2026-63769
Server-Side Request Forgery (CWE-918) in Huginn API
CVE-2026-63731
Server-Side Request Forgery (CWE-918) in HyperDX
CVE-2026-63107
SSRF (CWE-918) via Host Header in LimeSurvey API
CVE-2026-55626
Session Isolation Bypass (CWE-287) in xrdp Xvnc Backend
CVE-2026-48812
Broken Auth on Legacy Attachments (CWE-287) in FreeScout
CVE-2026-39878
Stored XSS (CWE-79) in Chamilo LMS Registration
CVE-2026-58484
Path Traversal (CWE-22) in Network-AI Backup Pruning
CVE-2026-54051
Command Injection (CWE-78) in Network-AI Sandbox
CVE-2026-46555
Auth & Path Bypass (CWE-22/306) in WhatsApp MCP
CVE-2026-35048
Improper Input Validation (CWE-20) in Piwigo Installer
CVE-2026-32825
Excessive Password Attempts (CWE-307) in dataCycle-CORE
CVE-2026-32824
Open Redirect (CWE-601) in dataCycle-CORE Email Flows
CVE-2026-32821
Authorization Bypass (CWE-285) in dataCycle-CORE API
CVE-2026-32820
Directory Traversal (CWE-22) in dataCycle-CORE Docs
CVE-2026-32806
Authorization Bypass (CWE-285) in dataCycle-CORE Views
CVE-2026-63429
Unauthenticated File Upload (CWE-434) in HeyForm API
CVE-2026-51027
Information Exposure (CWE-200) in FileThingie ft2.php
CVE-2026-46415
IP Blocking Bypass (CWE-284) in Caddy Defender
CVE-2026-35198
Stored Cross-Site Scripting (CWE-79) in HeyForm Builder
CVE-2026-32807
Broken Access Control (CWE-285) in dataCycle-CORE Links
CVE-2026-28220
Unsafe JSON Deserialization (CWE-502) in Wazuh DAPI
CVE-2026-54910
Path Traversal (CWE-22) in FileBrowser Quantum API
CVE-2026-52349
Directory Traversal (CWE-22) in Menyoo File Operations
CVE-2026-45270
Stored XSS (CWE-79) in CI4MS Pages Backend Module
CVE-2026-16252
SQL Injection (CWE-89) in Shenzhou Shihan Display 8.2.2
CVE-2026-64622
Missing Auth on ApprovalInbox APIs (CWE-862) in network-ai
CVE-2026-63763
Confused Deputy (CWE-639) in SurrealDB Field Logic
CVE-2026-63757
Missing Auth Checks (CWE-306) in SurrealDB /rpc Sessions
CVE-2026-63739
Path Traversal (CWE-22) in SurrealDB Analyzer Mapper
CVE-2026-63735
Improper Access Control (CWE-639) in SurrealDB APIs
CVE-2026-16242
Missing Client Certificate Checks (CWE-306) in Konnectivity
CVE-2026-44359
CI Workflow RCE (CWE-94) via Fork Code in Meshtastic
CVE-2026-42566
Input Validation Flaw (CWE-20) in Meshtastic BLE Sync
CVE-2026-16228
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-16227
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-16210
Missing Authentication (CWE-287) in SimpleUI AjaxAdmin
CVE-2026-16209
Missing Authentication (CWE-287) in Gerapy Upload API
CVE-2026-16200
Improper Authorization (CWE-285) in rt-claw RPC Handler
CVE-2026-10130
Auth Bypass via Token Misbinding (CWE-863) in QueryWeaver
CVE-2026-16154
SQL Injection (CWE-89) in SourceCodester Timetabling
CVE-2026-16152
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-16128
Server-Side Request Forgery (CWE-918) in rt-claw HTTP
CVE-2026-16127
Server-Side Request Forgery (CWE-918) in rt-claw HTTP
CVE-2026-16126
Broken Access Control (CWE-285) in rt-claw Swarm RPC
CVE-2026-16125
Server-Side Request Forgery (CWE-918) in rt-claw HTTP
CVE-2026-16117
Path Prefix Bypass (CWE-20) in Fastify HTTP Proxy
CVE-2025-71398
SSRF (CWE-918) in SurrealDB HTTP Functions Redirects
CVE-2025-71392
Command Injection (CWE-77) in SurrealDB CLI Export
CVE-2025-71390
Network ACL Bypass (CWE-863) in SurrealDB HTTP Functions
CVE-2026-9147
Code Injection (CWE-94) in uproot ROOT file parsing
CVE-2026-15631
Path Traversal (CWE-22) in Fastify WebSocket Proxy
CVE-2026-16084
Server-Side Request Forgery (CWE-918) in PicoClaw
CVE-2026-55518
Broken Access Control (CWE-639) in Avo Rails Admin
CVE-2026-54498
XSS (CWE-79) via around_render in Ruby ViewComponent
CVE-2026-54159
PHP Object Injection (CWE-74) in PrestaShop ps_facetedsearch
CVE-2026-53727
SSRF (CWE-918) in css_parser Remote Resource Loading
CVE-2026-52348
SQL Injection (CWE-89) in cool-admin-java CrudOption
CVE-2026-52203
Sensitive Information Exposure (CWE-200) in MCMS
CVE-2026-48062
Arbitrary File Upload (CWE-434) in CodeIgniter ext_in
CVE-2026-60137
SQL Injection (CWE-89) via author__not_in in WordPress
CVE-2026-52199
Command Injection (CWE-77) in UZ801_v2.1 LTE Router
CVE-2026-51833
SSRF (CWE-918) in XenForo RSS Feed Handling
CVE-2026-50289
OS Command Injection (CWE-78) in systeminformation
CVE-2026-50163
Hardlink Path Validation Flaw (CWE-22) in oras-go
CVE-2026-50151
SSRF Credential Forwarding (CWE-918) in oras-go OCI
CVE-2026-45260
Missing Auth on WebDAV MOVE (CWE-862) in Pimcore
CVE-2026-44739
SQL Injection (CWE-89) in Pimcore Custom Reports
CVE-2026-42168
OS Command Injection (CWE-78) in django-pyas2 Partner
CVE-2026-36669
Arbitrary File Upload (CWE-434) in Feng Office 3.11
CVE-2025-51677
Output Encoding Flaw (CWE-116) in OpenRISC OR1200 Core
CVE-2026-58195
OS Command Injection (CWE-78) in Agentic-Flow MCP
CVE-2026-45309
Path Traversal (CWE-22) in AsyncSSH AuthorizedKeysFile
CVE-2026-45162
PHP Object Injection (CWE-502) in Pimcore Storage
CVE-2026-63101
Missing Authentication (CWE-306) in Open Event Server
CVE-2026-49211
Information Exposure (CWE-200) in Symfony UX Autocomplete
CVE-2026-63094
Open Redirect (CWE-601) in SigNoz SSO OAuth Flow
CVE-2026-16016
SSRF (CWE-918) in poco-claw task callback handling
CVE-2026-13410
TLS Verification Disabled (CWE-295) in Google Auth Plugin
CVE-2026-62241
Hard-coded JWT Secret (CWE-321) in clawvet API
CVE-2026-62238
SQL Injection (CWE-89) in OpenRemote Export Endpoint
CVE-2026-62234
SSRF via Unrestricted cURL Protocols (CWE-918) in Grav
CVE-2026-62233
Broken AuthZ (CWE-639) in Grav API Admin Endpoints
CVE-2026-62232
AuthZ Flaw (CWE-862) in Grav 2FA Regeneration Task
CVE-2026-62231
Authorization Bypass (CWE-863) in Grav API Plugin
CVE-2026-62229
Path Traversal Auth Bypass (CWE-22) in OpenClaw Exec
CVE-2026-62228
Authorization Bypass (CWE-863) in OpenClaw Node Exec
CVE-2026-62227
Server-Side Request Forgery (CWE-918) in OpenClaw
CVE-2026-62226
SSRF Authorization Bypass (CWE-918) in OpenClaw Tabs
CVE-2026-62223
Authorization Bypass (CWE-863) in OpenClaw Pairing
CVE-2026-62219
Authorization Bypass (CWE-863) in OpenClaw Agent Hooks
CVE-2026-62218
Missing Authorization Checks (CWE-862) in OpenClaw Pairing
CVE-2026-62217
Authorization Bypass (CWE-863) in QQBot Exec Approvals
CVE-2026-62209
Authorization Bypass (CWE-863) in OpenClaw ClickClack
CVE-2026-62207
AuthZ Bypass (CWE-862) in OpenClaw Admin Tools
CVE-2026-62206
Missing Authorization (CWE-862) in OpenClaw Discord Mod
CVE-2026-62205
Missing Authorization (CWE-862) in OpenClaw MS Teams
CVE-2026-62202
Privilege Escalation (CWE-863) in OpenClaw Cron Jobs
CVE-2026-62201
SSRF (CWE-918) in OpenClaw Sandbox Exec-Server
CVE-2026-39359
Path Traversal (CWE-22) in Wazuh Manager Daemons
CVE-2026-44182
YAML Injection (CWE-74) in Jupyter Enterprise Gateway
CVE-2026-43978
Privilege Escalation (CWE-269) in wger Trainer Login
CVE-2026-43977
Broken Access Control (CWE-639) in Wger Routine Logs
CVE-2026-44180
Input Validation Bypass (CWE-20) in Jupyter Enterprise Gateway
CVE-2026-55173
OS Command Injection (CWE-78) in WWBN AVideo Encoder
CVE-2026-44023
SSRF and Path Traversal (CWE-918) in Docling Core
CVE-2026-44019
File Access and DoS (CWE-73) via Docling Image Input
CVE-2026-38158
SQL Injection (CWE-89) in UReport previewData API
CVE-2026-33692
Configuration Exposure (CWE-20) in WWBN AVideo Docker
CVE-2026-62290
Authorization Bypass (CWE-863) in cert-manager ACME
CVE-2026-54526
Privilege Bypass (CWE-284) via ArtifactGC Pod Patch
CVE-2026-46512
Code Injection (CWE-94) in Frogman PBX Dialplan Writer
CVE-2026-46353
Authorization Bypass (CWE-284) in BigBlueButton API
CVE-2026-46351
Predictable Session Tokens (CWE-330) in BigBlueButton
CVE-2026-46336
Path Traversal (CWE-22) in Manyfold File Rename Logic
CVE-2026-45336
Hard-Coded Secret Key (CWE-798) in HireFlow Auth
CVE-2026-63088
SSRF (CWE-918) via partial DNS checks in StoatChat
CVE-2026-63087
Missing Authentication (CWE-306) in Grafana OnCall APIs
CVE-2026-63086
Server-Side Request Forgery (CWE-918) in TGI API
CVE-2026-63085
Authorization Bypass (CWE-863) in Axelor User Updates
CVE-2026-46621
Remote Code Execution via Python Algorithms in Yamcs
CVE-2026-46562
Script Injection (CWE-94) in Yamcs Algorithm Engine
CVE-2026-45576
Path Traversal (CWE-22) in zrok2 Copy Sync Pipeline
CVE-2026-45568
Path Traversal (CWE-22) in zrok Python SDK ProxyShare
CVE-2026-44632
Code Injection (CWE-94) in Yamcs Algorithm Engine
CVE-2026-59867
SSRF and File Inclusion (CWE-918) in Kiota Generator
CVE-2026-57206
Missing Auth on Plugin Validation (CWE-306) in SimpleChat
CVE-2026-53598
Path Traversal (CWE-22) in Prompty File Include Handling
CVE-2026-45695
Command Injection (CWE-78) in Kopia HTTP SFTP Backend
CVE-2026-14890
Unsafe Pickle Deserialization (CWE-502) in SGLang Backup
CVE-2025-45868
Blind SQL Injection (CWE-89) in LogicalDOC Servlet
CVE-2026-59862
Code Injection (CWE-94) in Kiota Python Generator
CVE-2026-59861
Code Injection (CWE-94) in Kiota Ruby Client Generator
CVE-2026-63306
Server-Side Request Forgery (CWE-918) in StoatChat
CVE-2026-63305
OS Command Injection (CWE-78) in AVideo ffmpeg API
CVE-2026-63304
OS Command Injection (CWE-78) in AVideo FFmpeg API
CVE-2026-1609
Improper Access Control (CWE-284) in Keycloak JWT Grants
CVE-2026-55652
Header Login Bypass (CWE-287) in Wekan Kanban Auth
CVE-2026-55234
Authorization Bypass (CWE-284) in Wekan Board Updates
CVE-2026-54458
Stored DOM XSS (CWE-79) in AVideo YPTSocket Plugin
CVE-2026-52891
OS Command Injection (CWE-78) in Wekan Avatar Upload
CVE-2026-52890
Path Traversal & DoS (CWE-22) in Wekan Attachments
CVE-2026-45313
Privilege Escalation (CWE-284) via Sandboxie GUI Hooks
CVE-2026-30623
Command Injection (CWE-77) in LiteLLM MCP Server Config
CVE-2026-30618
Remote Code Execution (CWE-94) in xszyou Fay MCP
CVE-2026-26718
CSRF (CWE-352) in XXL-Job Glue IDE Script Management
CVE-2025-65720
Command Injection (CWE-77) in GPT Researcher HTML Flow
CVE-2026-62312
Command Injection (CWE-78) in 9Router MCP Plugin Routing
CVE-2026-54052
Improper Tenant Access Control (CWE-639) in n8n-MCP
CVE-2026-52887
SQL Injection (CWE-89) in NocoBase In-App Messages
CVE-2026-49352
Hardcoded JWT Secret (CWE-798) in 9Router Auth Flow
CVE-2026-46339
Unauth MCP Plugin Command Exec (CWE-78) in 9Router
CVE-2026-52870
Broken Task Authorization (CWE-862) in MCP Python SDK
CVE-2026-52869
Session Fixation (CWE-639) in MCP Python HTTP Transports
CVE-2026-50144
Heap Buffer Overflow (CWE-787) in ncnn Param Loader
CVE-2026-45738
Stored XSS (CWE-79) in Argo CD application links
CVE-2026-62350
Arbitrary Code Execution (CWE-94) via TDengine UDF Upload
CVE-2026-46485
Improper Config Access Control (CWE-284) in Dashy OIDC
CVE-2026-15895
OS Command Injection (CWE-78) in jsii-diff npm loader
CVE-2026-62948
Stored XSS (CWE-79) in OpenWrt LuCI DHCP Lease View
CVE-2026-59258
Broken Access Control (CWE-863) in Immich Album Roles
CVE-2026-59255
Missing Authorization (CWE-862) in BloodHound API
CVE-2026-58660
Broken Access Control (CWE-639) in Kanboard Tasks
CVE-2026-58658
Missing Authentication (CWE-306) in GPUStack Worker APIs
CVE-2026-53516
OAuth Account Linking Flaw (CWE-287) in Better Auth
CVE-2026-53515
Access Control Flaw (CWE-269) in Better Auth SSO Plugin
CVE-2026-53514
AuthZ Bypass (CWE-287) in Better Auth Invitations
CVE-2026-53513
SSRF and OIDC Trust Flaws (CWE-918) in Better Auth
CVE-2026-53512
OAuth Refresh Token Auth Bypass (CWE-287) in Better Auth
CVE-2026-45337
Authorization Bypass (CWE-285) in Better Auth Device Flow
CVE-2026-62378
Stored XSS (CWE-79) in RustFS Console PDF Preview
CVE-2026-59955
Auth Bypass (CWE-287) in Apollo ConfigService Raw APIs
CVE-2026-59954
Auth Bypass via AppId Normalization (CWE-287) in Apollo
CVE-2026-48799
Improper Auth Checks (CWE-345) in Postiz Payments
CVE-2026-45793
Information Exposure (CWE-200) in PHP Composer IO
CVE-2026-55242
Template Injection (CWE-1336) in ERPNext Permission Layer
CVE-2026-50148
Path Traversal (CWE-73) enabling RCE in Metabase
CVE-2026-47164
Improper Access Control (CWE-284) in Vaultwarden SSO
CVE-2026-47158
SSO CSRF (CWE-352) in Vaultwarden OAuth Flow
CVE-2026-46709
Command Injection (CWE-78) via Path Drop in Tabby Terminal
CVE-2026-45806
SSRF (CWE-918) via Remote Image Import in Penpot
CVE-2026-44986
Broken Authentication (CWE-287) in Penpot Profiles
CVE-2026-61836
Cache Key Authorization Bypass (CWE-639) in Directus API
CVE-2026-61835
SSRF (CWE-918) via 0.0.0.0 in Directus File Import
CVE-2026-61644
Improper Auth Context (CWE-863) in FastGPT Dataset API
CVE-2026-54563
Authorization Bypass (CWE-863) in Cloudreve WebDAV
CVE-2026-54560
Missing OAuth Scope Validation (CWE-863) in Cloudreve
CVE-2026-43637
Path Traversal (CWE-22) in Cornac Dataset Archive Loader
CVE-2026-15809
Input Validation Flaw (CWE-116) in CRI-O HOME Handling
CVE-2026-61873
Arbitrary File Write (CWE-73) in Grav Form Plugin
CVE-2026-61457
File Upload Extension Bypass (CWE-434) in Grav API
CVE-2026-61451
Open Redirect (CWE-601) in Grav API Password Reset Flow
CVE-2026-61446
Code Injection (CWE-94) in PraisonAI Plugin Manager
CVE-2026-61443
Path Traversal (CWE-22) in PraisonAI Skill Script Runner
CVE-2026-61438
OS Command Injection (CWE-78) in PraisonAI Workflow Engine
CVE-2026-61436
Authentication Bypass (CWE-287) in PraisonAI Webhooks
CVE-2026-61435
Auth Bypass (CWE-287) in PraisonAI Call API Agent
CVE-2026-61433
Code Injection (CWE-94) in PraisonAI API Generator
CVE-2026-61430
SSRF via DNS Rebinding (CWE-918) in PraisonAI Crawl
CVE-2026-61427
Auth Bypass & Input Validation (CWE-20) in PraisonAI MCP
CVE-2026-58655
Server-side Twig Injection (CWE-94) in Grav Flex Objects
CVE-2026-57996
Privilege Escalation (CWE-269) in phpMyFAQ User API
CVE-2026-56699
Injection in OpenSearch Bulk NDJSON (CWE-74) Wazuh
CVE-2026-56398
Stored XSS (CWE-20) via SVG profile images in Open WebUI
CVE-2026-56339
Information Disclosure (CWE-203) in Capgo Supabase RPC
CVE-2026-57821
SQL Injection (CWE-89) in Apache Fineract Office API
CVE-2026-56287
Boolean SQL Injection (CWE-89) in Fineract Client API
CVE-2026-35152
SQL Injection (CWE-89) in Apache Fineract Reports API
CVE-2026-15752
Missing Backend User AuthZ (CWE-862) in Xianyu API
CVE-2026-59733
Path Traversal, ID Confusion in Rclone Restic Service
CVE-2026-54684
Directory Traversal (CWE-22) in jadx XAPK Plugin Loader
CVE-2026-49981
Sandbox Policy Caching Flaw (CWE-693) in Twig Templates
CVE-2026-48808
Sandbox Bypass (CWE-693) via Twig Column Filter Policy
CVE-2026-48807
Sandbox Bypass (CWE-693) in Twig Template Filters
CVE-2026-48806
Sandbox Bypass (CWE-863) in Twig ArrayExpression
CVE-2026-46640
Code Injection (CWE-94) via Twig Dynamic Macro Resolution
CVE-2026-46633
Code Injection (CWE-94) via Twig template name handling
CVE-2026-45363
JWT HMAC Verification Bypass (CWE-287) in ruby-jwt
CVE-2026-61520
SSRF (CWE-918) in SMF Image Proxy Internal Requests
CVE-2026-53486
Path Traversal and Link Abuse in Node.js decompress
CVE-2026-52101
Sensitive Info Exposure (CWE-200) in linux-server API
CVE-2026-52100
CSRF (CWE-352) in linux-server uploadPutHandler
CVE-2026-49853
Authorization Header Leak (CWE-200) in Tornado HTTP Client
CVE-2026-53633
Overly Permissive CDP API (CWE-749) in Vitest Browser
CVE-2026-48736
SSRF via IPv6 Transition Prefixes (CWE-918) in Symfony
CVE-2026-48489
Access Control Bypass (CWE-863) via Symfony Failure Path
CVE-2026-47429
Path Traversal (CWE-22) in Vitest UI/API Server
CVE-2026-47428
Reflected XSS (CWE-79) in Vitest Browser Test Runner
CVE-2026-47423
DOMPurify XSS Flaw (CWE-79) via selectedcontent Tag
CVE-2026-45071
XML External Entity (CWE-611) in Symfony Crawler
CVE-2026-13001
Input Validation Flaw (CWE-20) in Podlove File Uploads
CVE-2026-45304
YAML Alias Expansion (CWE-776) in Symfony Parser
CVE-2026-45133
Recursive YAML Parsing (CWE-776) in Symfony Input
CVE-2026-45075
Authorization Bypass (CWE-863) in Symfony HEAD Routing
CVE-2026-45073
SQL Injection (CWE-89) in Symfony Cache PdoAdapter
CVE-2026-45077
Unauthenticated PHP Deserialization (CWE-502) in Symfony
CVE-2026-15747
BREACH Exposure of CSRF Token (CWE-204) in Mojolicious
CVE-2026-59891
Credential Leakage (CWE-522) in sigstore-js Registry Auth
CVE-2026-15703
SQL Injection (CWE-89) in Simple Shopping Cart Admin
CVE-2026-62643
SSRF via CSS Sanitization (CWE-918) in Roundcube
CVE-2026-55651
Excessive Data Exposure (CWE-200) in EasyAppointments
CVE-2026-15392
Path Traversal (CWE-22) via Symlinks in Perl DBD::File
CVE-2026-15736
SQL Injection and File Exposure (CWE-89) in Snowflake
CVE-2026-15416
Missing Authentication (CWE-306) in Argo CD Repo-Server
CVE-2026-15677
Unrestricted File Upload (CWE-434) in Job Portal 1.0
CVE-2026-15676
SQL Injection (CWE-89) in Online Job Portal Admin
CVE-2026-15675
SQL Injection (CWE-89) in Online Job Portal Admin
CVE-2026-57856
Path Traversal (CWE-22) in Cockpit CMS Bucket API
CVE-2026-57855
Missing Authorization (CWE-284) in Cockpit Bucket API
CVE-2026-62328
Unauthenticated API Data Exposure (CWE-359) in 9Router
CVE-2026-62327
Missing Auth on Usage Stats API Leaks Plaintext Keys
CVE-2026-62242
SSRF (CWE-918) in Spring Boot Admin Server proxy
CVE-2026-62240
SSRF (CWE-918) via URL Validation Bypass in CrewAI
CVE-2026-62197
SSRF via CDP Discovery (CWE-918) in OpenClaw
CVE-2026-62196
AuthZ Bypass (CWE-863) via WhatsApp Group IDs
CVE-2026-62194
Privilege Escalation (CWE-732) via OpenClaw Plugins
CVE-2026-62192
Authorization Bypass (CWE-863) in OpenClaw Discord Guild
CVE-2026-62191
AuthZ Bypass (CWE-862) in OpenClaw Message Mutations
CVE-2026-62190
Authorization Bypass (CWE-863) in OpenClaw Flock Wrapper
CVE-2026-62188
Incorrect Authorization (CWE-863) in Feishu Tools
CVE-2026-62187
Authorization Bypass (CWE-863) in OpenClaw Feishu Tools
CVE-2026-62186
AuthZ Bypass (CWE-862) in OpenClaw HTTP Overrides
CVE-2026-62184
Improper Log Input Validation (CWE-116) in banIP
CVE-2026-61458
Brute-Force Protection Failure (CWE-307) in PasswordPusher
CVE-2026-59801
Missing Auth Checks (CWE-306) in 9Router Provider APIs
CVE-2026-58500
Stored XSS (CWE-79) in MCP Appium locator UI
CVE-2026-51821
SQL Injection (CWE-89) in Shenzhou Shihan Login API
CVE-2026-51538
Incorrect Access Control (CWE-284) in OpENer Sessions
CVE-2026-15597
SQL Injection (CWE-89) in Exam Timetable Edit Feature
CVE-2026-58410
Broken Access Control (CWE-639) in ChurchCRM Family API
CVE-2026-58409
Unrestricted File Upload (CWE-434) in ChurchCRM Plugins
CVE-2026-55773
Policy Expression Injection (CWE-94) in CedarJava
CVE-2026-55771
Logic Error in Entity Equality (CWE-697) in CedarJava
CVE-2026-49972
File Upload RCE (CWE-434) in Laravel-Mediable
CVE-2026-49970
Path Traversal (CWE-22) in Laravel-Mediable Uploads
CVE-2026-49969
Server-Side Request Forgery (CWE-918) in Laravel-Mediable
CVE-2026-26396
Path Traversal (CWE-22) in OpenBMB XAgent file API
CVE-2025-45869
SSRF (CWE-918) in LogicalDOC ShareFileCallback
CVE-2026-61463
Privilege Escalation (CWE-269) via Shiori Account API
CVE-2026-61462
Path Traversal (CWE-73) in mcp-gitlab Job Routing Logic
CVE-2026-59245
Privilege Escalation (CWE-269) in Airflow FAB Auth
CVE-2026-15557
Improper Authentication (CWE-287) in waoowaoo API Auth
CVE-2026-14453
SSTI (CWE-94) in Centreon Open Tickets Module
CVE-2026-15542
Improper Auth (CWE-287) in Isaiah WebSocket Login
CVE-2026-15541
Missing Authorization (CWE-862) in Isaiah Websocket API
CVE-2026-15517
SQL Injection (CWE-89) in Jinher OA PlanGiveOut.aspx
CVE-2026-15511
OS Command Injection (CWE-78) in Comfast CF-WR631AX Router
CVE-2026-61876
Stored Cross-Site Scripting (CWE-79) in LuCI DHCPv6 UI
CVE-2026-61875
Stored XSS (CWE-79) in luci-app-upnp Port Mapping UI
CVE-2026-59260
Privilege Misconfiguration (CWE-269) in OpenWrt Samba4
CVE-2026-56313
Access Control Flaw (CWE-285) in Capgo SSO Prelink Endpoint
CVE-2026-56260
Path Traversal File Write (CWE-22) in Crawl4AI API
CVE-2026-56259
Credential Exposure (CWE-200) in Crawl4AI Docker API
CVE-2026-56241
Authorization Bypass (CWE-285) in Capgo Role Binding
CVE-2026-56238
Information Disclosure (CWE-200) in Capgo global_stats API
CVE-2026-15497
Code Injection via JWT Filter (CWE-94) in Sonic-Agent
CVE-2026-15488
Unrestricted File Upload (CWE-434) in shiroiAdmin
CVE-2026-15481
OS Command Injection (CWE-77) in Trendnet TEW-635BRM
CVE-2026-61447
Code Injection (CWE-94) via LLM Python Agent in PraisonAI
CVE-2026-61445
Path Traversal (CWE-22) in PraisonAI AICoder Tools
CVE-2026-61442
Missing Authorization (CWE-862) in PraisonAI PATCH APIs
CVE-2026-61429
SSRF via DNS Rebinding (CWE-918) in PraisonAI Crawl4AI
CVE-2026-61426
Insecure Default Auth (CWE-200) in PraisonAI API
CVE-2026-60090
SQL Injection (CWE-89) in PraisonAI Vector Stores
CVE-2026-56303
API Key Metadata Exposure (CWE-200) in Capgo RPC
CVE-2026-55175
Unsafe YAML Deserialization (CWE-502) in Spinnaker Rosco
CVE-2026-42952
Excessive Authentication Attempts (CWE-307) in EV Backend
CVE-2026-20744
Authentication Bypass (CWE-284) in EV Charging WebSocket
CVE-2026-14480
Path Traversal File Write (CWE-73) in OpenPLC Runtime
CVE-2026-49213
SSRF via IPv6 Unspecified Address (::) in Typebot
CVE-2026-44795
Unsafe YAML Deserialization (CWE-502) in Spinnaker
CVE-2026-58499
Path Traversal (CWE-22) in EverOS Memory Ingestion API
CVE-2026-57219
OAuth Client Secret Disclosure (CWE-200) in RabbitMQ
CVE-2026-57215
Improper Authorization (CWE-863) in RabbitMQ Reply-To
CVE-2026-55880
Insecure Direct Object Reference (CWE-639) in OpenReplay
CVE-2026-55879
Stored XSS (CWE-79) in OpenReplay Analytics Dashboard
CVE-2026-55659
Stored and Reflected XSS (CWE-79) in Grist Pages
CVE-2026-55405
SQL Injection (CWE-89) in LangChain4j Embedding Stores
CVE-2026-55229
Blind SSRF (CWE-918) via Gotenberg LibreOffice Forms API
CVE-2026-57850
Missing Authorization Scope Checks (CWE-862) in RustDesk
CVE-2026-55789
XML Injection (CWE-91) in Logto SAML IdP Responses
CVE-2026-55466
Stored XSS (CWE-79) via Inline File Attachments in Snipe-IT
CVE-2026-55377
Improper Auth Step-Up (CWE-287) in Logto Account Center
CVE-2026-61461
SQL Injection (CWE-89) in Dify MyScale Vector Store
CVE-2026-61460
IDOR (CWE-639) in Krayin CRM Record Controllers
CVE-2026-59151
SAML Auth Bypass (CWE-287) Enables Prowler Tenant Hijack
CVE-2026-55516
Improper Access Control (CWE-639) in Snipe-IT API
CVE-2026-55460
Authorization Bypass (CWE-863) in Snipe-IT Bulk User Delete
CVE-2026-54329
Authorization Bypass (CWE-862) in Snipe-IT Accessories API
CVE-2026-53450
Server-Side Request Forgery (CWE-918) via Coturn TURN
CVE-2026-53448
SQL Injection (CWE-89) in Coturn HTTPS Admin Panel
CVE-2025-30007
OS Command Injection (CWE-78) in HestiaCP DNS Handler
CVE-2026-56668
Scope Validation Flaw (CWE-862) in ZITADEL OAuth2
CVE-2026-56667
Stored XSS (CWE-79) in ZITADEL Login V2 Redirect URIs
CVE-2026-55672
OAuth Client Confusion (CWE-287) in ZITADEL Flows
CVE-2026-56675
Auth Bypass via Loopback Trust (CWE-287) in 9Router
CVE-2026-55641
Host Header Trust (CWE-290) in 9Router LLM Proxy
CVE-2026-55638
Missing Codex Route Authorization (CWE-862) in 9Router
CVE-2026-54919
TLS Certificate Validation Bypass (CWE-295) in cpp-httplib
CVE-2026-51119
Privilege Escalation (CWE-269) in Invixium IXM WEB
CVE-2026-39903
Authorization Bypass (CWE-863) in SMF Attachment Moderation
CVE-2025-70796
Path Traversal (CWE-22) in WTI Web Management Interface
CVE-2026-56676
TOCTOU SSRF (CWE-367, CWE-918) in 9Router LLM Proxy
CVE-2026-55501
Rate Limit Bypass (CWE-307) in 9Router Dashboard Auth
CVE-2026-55500
Authentication Bypass (CWE-200) in 9Router Settings API
CVE-2026-54149
OS Command Injection (CWE-78) via MCP Tools in MaxKB
CVE-2026-61444
Code Injection (CWE-94) in PraisonAI Deployment API
CVE-2026-61434
Command Injection (CWE-78) via find Exec in PraisonAI
CVE-2026-60091
Blind SSRF (CWE-918) in PraisonAI Jobs API Runs
CVE-2026-56765
Authorization Bypass (CWE-639) in Vikunja Sharing APIs
CVE-2026-56279
Missing Authorization (CWE-862) in Capgo RPC API
CVE-2026-56261
SSRF (CWE-918) via Webhooks in Crawl4AI Docker API
CVE-2026-38059
Missing Authentication (CWE-306) in iDirect iQ200 APIs
CVE-2026-38057
CSRF (CWE-352) on Reboot API in iDirect iQ200 Modem
CVE-2026-29519
Reflected XSS (CWE-79) in Lucee CFML URL Path Parsing
CVE-2026-22659
Authorization Bypass (CWE-863) in FlaskBB Topic Actions
CVE-2026-15330
SSRF (CWE-918) in CowAgent Vision Tool Image Fetching
CVE-2026-14894
Arbitrary File Upload (CWE-434) in Super Forms Plugin
CVE-2026-15319
Improper Access Control (CWE-284) in PicoClaw Launcher
CVE-2026-54769
Code Injection (CWE-94) in Langroid LLM Tooling APIs
CVE-2026-50181
Path Traversal (CWE-22) in Langroid File Tools
CVE-2026-59858
Code Injection (CWE-94) via Vim C omni-completion tags
CVE-2026-59856
Code Injection (CWE-94) in Vim PHP Omni-Completion
CVE-2026-59834
SQL Injection (CWE-89) in SiYuan Search API Endpoint
CVE-2026-59832
Path Traversal (CWE-22) in SiYuan Snippet Handler
CVE-2026-33655
SSRF via Hostname IP Bypass (CWE-918) in New API
CVE-2026-58143
CSRF (CWE-352) in Cotonti admin config upload rules
CVE-2026-58123
Missing Authentication (CWE-306) in Hermes WebUI API
CVE-2026-55604
IDOR Session Hijacking (CWE-639) in DeepSeek MCP
CVE-2026-53963
Stored XSS (CWE-79) in Discourse 2FA Delete Dialog
CVE-2026-49256
Sensitive Tag Metadata Exposure (CWE-200) in Discourse
CVE-2026-45788
Information Exposure (CWE-200) in Discourse Uploads
CVE-2026-44787
Privilege Management Flaw (CWE-269) in Discourse Signup
CVE-2026-55212
Authorization flaw (CWE-285) in Pimcore Studio API
CVE-2026-55208
Time-Based SQL Injection (CWE-89) in Pimcore Studio
CVE-2026-51926
User Enumeration (CWE-203) in FSM Client login.php
CVE-2026-51925
Local File Inclusion (CWE-639) in docuForm Client
CVE-2026-51924
Broken Access Control (CWE-639) in docuForm Client
CVE-2026-51923
IDOR (CWE-639) in docuForm Client user settings
CVE-2025-45422
Access Control Flaw (CWE-284) in Proximus b-box Router
CVE-2026-59148
Unauthenticated Admin API (CWE-306) in Mockoon Server
CVE-2026-54695
Missing Auth on Telephony Control (CWE-862) in Pipecat
CVE-2026-13492
Arbitrary File Deletion (CWE-22) in UsersWP Plugin
CVE-2025-63579
Sensitive Data Exposure (CWE-200) in Kyocera Printers
CVE-2026-61343
Path Traversal (CWE-23) in LibreBooking Template Save
CVE-2026-59827
Java Deserialization (CWE-502) in Metabase H2 Queries
CVE-2026-59826
Code Injection (CWE-94) via H2 DB config in Metabase
CVE-2026-59734
OS Command Injection (CWE-78) in Coolify Health Checks
CVE-2026-59726
Authless MCP Bridge Command Exec (CWE-306) in Ruflo
CVE-2026-59721
Command Injection (CWE-77) via SMTP URL in Hoppscotch
CVE-2026-59720
Access Control Data Exposure (CWE-284) in Hoppscotch
CVE-2026-59221
Path Traversal (CWE-22) in Open WebUI Terminal Proxy
CVE-2026-55420
OS Command Injection (CWE-78) in Discourse PDF Uploads
CVE-2026-59224
Authentication Bypass (CWE-287) in Open WebUI Terminals
CVE-2026-59216
Session Confusion RCE (CWE-94) in Open WebUI Sockets
CVE-2026-59214
Stored XSS (CWE-79) in Open WebUI Pyodide Workflows
CVE-2026-58459
Command Injection (CWE-78) in gpsd gpsprof plotting
CVE-2026-51606
Improper Input Handling (CWE-20) in Tenda CP3 RTSP Service
CVE-2026-51599
Input Validation Flaw (CWE-20) in MIPC252W RTSP Service
CVE-2026-15190
SQL Injection (CWE-89) in Shopping Cart login.php
CVE-2026-15137
SQL Injection (CWE-89) in Interview Management System
CVE-2026-15135
SQL Injection (CWE-89) in Online Food Order System
CVE-2026-15134
SQL Injection (CWE-89) in Online Leave Management
CVE-2026-54781
SAML Token Validation Flaw (CWE-287) in CoreWCF
CVE-2026-54499
Unsafe Model Deserialization (CWE-502) in Stanza NLP
CVE-2026-55878
Path Traversal (CWE-22) in Symfony UX Recipe Install
CVE-2026-55471
XXE (CWE-611) in HAPI FHIR Saxon XSLT XML Transform
CVE-2026-52200
Code Injection (CWE-94) in OEM UZ801 4G LTE Router API
CVE-2026-44161
SSRF (CWE-918) via Endpoint Placeholders in Fluentd
CVE-2026-44025
Auth Bypass (CWE-306) in Fluentd Monitor Agent APIs
CVE-2026-44024
Path Traversal (CWE-22) in Fluentd out_file Plugin
CVE-2026-35552
Missing Authorization (CWE-862) in CAXperts Admin API
CVE-2026-31309
Improper Authorization (CWE-862) in Mysterium Node API
CVE-2026-58192
Path Traversal (CWE-22) in Appium Storage Plugin
CVE-2026-55596
Stored XSS (CWE-79) via Media Embeds in Plate Editor
CVE-2026-54591
Path Traversal (CWE-22) in AsyncSSH SCP Client
CVE-2026-54527
Stored XSS (CWE-79) in JupyterLab Git rename history view
CVE-2026-35210
AuthZ Bypass (CWE-639) in OpenCTI Confidence Controls
CVE-2026-60104
Improper Access Control (CWE-639) in Bitwarden Server
CVE-2026-59948
Path Traversal (CWE-22) in PHP Composer Package Install
CVE-2026-59822
Broken Auth Fallback (CWE-287) in LiteLLM MCP HTTP
CVE-2026-59821
Code Injection (CWE-94) in LiteLLM Guardrail Engine
CVE-2026-59806
Open Redirect & SSRF (CWE-601/918) in Gradio API
CVE-2026-58253
Auth Bypass (CWE-287) on NATS Inter-Server Connections
CVE-2026-58213
Command Injection (CWE-74) via MQTT in NATS Server
CVE-2026-55760
Path Traversal (CWE-22) in Handlebars.java Templates
CVE-2026-55404
Injection in shortcut generation (CWE-74) in yt-dlp
CVE-2026-60102
OS Command Injection (CWE-78) in Horde VFS SMB Driver
CVE-2026-59261
Credential Override Exposure (CWE-522) in OpenClaw
CVE-2026-59724
Prototype Pollution DoS (CWE-20) in Socket.IO Engine.IO
CVE-2026-59702
SSRF (CWE-918) in repomix /api/pack URL handling
CVE-2026-55874
Path Traversal (CWE-22) in SeaweedFS S3 Copy API
CVE-2026-54652
Log Exposure & Priv Esc (CWE-269) in Frigate API
CVE-2026-24700
OS Command Injection (CWE-78) in Cisco Small Routers
CVE-2026-24699
OS Command Injection (CWE-78) in Cisco RV Routers
CVE-2026-24698
OS Command Injection (CWE-78) in Cisco RV Routers
CVE-2026-24697
OS Command Injection (CWE-78) in Cisco Small Routers
CVE-2026-15067
SQL Injection (CWE-89) in Snowflake Terraform Provider
CVE-2026-15062
SQL Injection (CWE-89) in Snowflake Snowpark Python SDK
CVE-2026-59257
SQL Injection (CWE-89) in n8n Legacy MySQL v1 Node
CVE-2026-56776
Authorization Bypass (CWE-863) in n8n Workflow Tests
CVE-2026-56250
Missing Authorization (CWE-862) in Capgo R2 Bundles
CVE-2026-56246
Broken Access Control (CWE-285) in Capgo Org API
CVE-2026-56226
Information Exposure (CWE-200) in Capgo Supabase RPC
CVE-2026-54061
Missing Auth on Snapshot Import RPC (CWE-306) in Dgraph
CVE-2026-6230
Blind SQL Injection (CWE-89) in Tainacan WordPress Plugin
CVE-2026-55436
TLS Cert Validation Flaw (CWE-295) in Coder AI Proxy
CVE-2026-55431
Session Token Exposure (CWE-522) in Coder CLI Apps
CVE-2026-55429
Broken Access Control (CWE-639) in Coder Workspace Apps
CVE-2026-55428
Authorization Flaw (CWE-285) in Coder Tailnet Routing
CVE-2026-55427
SSH Config Injection (CWE-74) via Coder config-ssh
CVE-2026-59705
Missing Authentication (CWE-306) in mem0 Memory API
CVE-2026-59704
Missing Authorization (CWE-862) in Cap AI Video API
CVE-2026-55077
Authorization Flaw (CWE-285) in Coder Password Reset
CVE-2026-55076
Authentication Bypass (CWE-287) in Coder OIDC Email Linking
CVE-2026-51937
Missing Authentication (CWE-306) in Oneblog APIs
CVE-2026-37271
Improper BLE Authentication (CWE-287) in Fire-Boltt Watch
CVE-2026-37270
Auth Bypass via Hardcoded Creds in Trueview Camera
CVE-2026-14380
Code Injection via DBI Profile (CWE-95) in Perl DBI
CVE-2026-59706
Missing Auth (CWE-306) in mem0 Config and LLM API
CVE-2026-55418
Insecure Direct Object Reference (CWE-639) in FastGPT
CVE-2026-55075
OIDC Auth Flaws (CWE-287) in Coder Login Flow
CVE-2026-54607
SSRF (CWE-918) via OpenAPI Import in FastGPT HTTP Tool
CVE-2026-59707
Server-Side Request Forgery (CWE-918) in LocalAI API
CVE-2026-58583
Privilege Escalation (CWE-269) in FluxInk Driver
CVE-2026-58473
Broken Access Control (CWE-306) in Cognee LLM Settings
CVE-2026-49471
Unauthenticated Flask API (CWE-306) in Serena MCP Tool
CVE-2026-44454
Command Injection (CWE-78) in Coder Dotfiles Module
CVE-2026-7017
Improper Credential Forwarding (CWE-522) in HTTP::Tiny
CVE-2026-59800
OS Command Injection (CWE-78) in 9Router Tailscale API
CVE-2026-59708
Missing Authorization Checks (CWE-862) in Ghostfolio API
CVE-2026-44938
Weak PSS Label Handling (CWE-522) in Fleet Deployer
CVE-2026-33264
Unsafe DAG Deserialization (CWE-502) in Apache Airflow
CVE-2026-34158
Command Injection (CWE-78) in Coolify Docker Helper
CVE-2026-42200
Path Traversal (CWE-22) in Coolify PostgreSQL Setup
CVE-2026-42143
Shell Command Injection (CWE-78) in Coolify Volumes
CVE-2026-34171
CSRF Password Reset (CWE-352) in Coolify Invitations
CVE-2026-34168
Command Injection (CWE-78) in Coolify Volume Removal
CVE-2026-34152
Command Injection (CWE-78) in Coolify SSH Deployments
CVE-2026-34058
OS Command Injection (CWE-78) in Coolify Server Control
CVE-2026-34057
OS Command Injection (CWE-78) in Coolify Import Flow
CVE-2026-34048
Authorization Bypass (CWE-285) in Coolify Terminal
CVE-2026-34047
Authorization Bypass (CWE-863) in Coolify Terminal WebSocket
CVE-2026-34044
Insecure Direct Object Reference (CWE-639) in Coolify Logs
CVE-2026-34037
Improper Access Control (CWE-639) in Coolify Cloning
CVE-2026-34035
OS Command Injection (CWE-78) in Coolify Logs
CVE-2026-34034
OS Command Injection (CWE-78) via Coolify Sentinel Token
CVE-2026-42204
Command Injection (CWE-78) via Coolify Docker Commands
CVE-2026-42153
OS Command Injection (CWE-78) in Coolify PostgreSQL Checks
CVE-2026-34599
Command Injection (CWE-78) in Coolify GetLogs Component
CVE-2026-34153
OS Command Injection (CWE-78) in Coolify Storage
CVE-2026-59713
OIDC Login CSRF (CWE-352) in Leantime verifyState()
CVE-2026-59712
Broken Access Control (CWE-639) in Leantime JSON-RPC API
CVE-2026-57573
SSRF (CWE-918) in Crawl4AI Docker streaming crawler
CVE-2026-57572
Command Injection (CWE-88) in Crawl4AI Docker API
CVE-2026-57571
Path Traversal (CWE-22) in Crawl4AI File Download Logic
CVE-2026-54765
Authorization Filter Confusion (CWE-863) in Traefik Gateway
CVE-2026-54234
Input Validation Flaw (CWE-20) in vLLM Sampler Engine
CVE-2026-34038
Command Injection (CWE-78) in Coolify Deployment Flows
CVE-2026-14471
SQL Injection (CWE-89) in mcp-gateway metrics-service
CVE-2025-53831
Stored XSS (CWE-79) in DrawIO Integration for ownCloud
CVE-2026-59196
Path Traversal (CWE-22) in pnpm Lockfile Alias Handling
CVE-2026-59195
Path Traversal (CWE-22) via pnpm config symlink names
CVE-2026-59194
Path Traversal (CWE-22) in pnpm Patch Removal Feature
CVE-2025-53830
SSRF (CWE-918) in Anti-Virus for ownCloud 10
CVE-2025-53829
Path Traversal (CWE-23) enabling code execution in ownCloud
CVE-2025-53828
SSRF (CWE-918) enabling code execution in ownCloud
CVE-2026-49297
Path Traversal (CWE-22) in Airflow GCS File Operators
CVE-2026-44937
SSRF Webhook Forgery (CWE-918) in Rancher Fleet
CVE-2026-14802
OS Command Injection (CWE-78) in React Dev Utils
CVE-2026-14778
Improper Authorization (CWE-285) in LMS Enrollment API
CVE-2026-14772
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-14771
SQL Injection (CWE-89) in Exam Timetabling System
CVE-2026-14770
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-14769
SQL Injection (CWE-89) in Real State Services pay.php
CVE-2026-14768
SQL Injection (CWE-89) in Real State Services 1.0
CVE-2026-14764
SQL Injection (CWE-89) in Hotel Event Management
CVE-2026-14763
SQL Injection (CWE-89) in Hotel Tour Reservations Page
CVE-2026-14762
SQL Injection (CWE-89) in Hotel Reservation Admin
CVE-2026-14756
SQL Injection (CWE-89) in Tour Management Admin Page
CVE-2026-14755
SQL Injection (CWE-89) in hotel reservations admin
CVE-2026-14753
Authorization Bypass (CWE-285) in Stumasy Note Handler
CVE-2026-14750
SQL Injection (CWE-89) in Stumasy Notes Authorization
CVE-2026-14749
Code Injection (CWE-94) in Stumasy IMBA Calculator
CVE-2026-14747
SQL Injection (CWE-89) in Real State Services amen
CVE-2026-14746
SQL Injection (CWE-89) in Real State Services amen
CVE-2026-14745
SQL Injection (CWE-89) in Real State Services 1.0
CVE-2026-14744
SQL Injection (CWE-89) in Real State Services 1.0
CVE-2026-14743
SQL Injection (CWE-89) in Real State Services loc param
CVE-2026-14734
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-14733
SQL Injection (CWE-89) in Course Edit Endpoint
CVE-2026-14732
SQL Injection (CWE-89) in Exam Editing Endpoint
CVE-2026-14722
Code Injection (CWE-94) in TidGi Git Import Service
CVE-2026-14713
SQL Injection (CWE-89) in Pizzafy admin order API
CVE-2026-14705
SQL Injection (CWE-89) in Online Examination Login
CVE-2026-14700
SQL Injection (CWE-89) in PHP Internship Login Flow
CVE-2026-14695
SQL Injection (CWE-89) in Grocery System Registration
CVE-2026-14690
Improper Authorization (CWE-285) in Grocery Users API
CVE-2026-14688
SQL Injection (CWE-89) in Hotel Admin Login Panel
CVE-2026-14660
SQL Injection (CWE-89) in Online Job Portal login.php
CVE-2026-14654
SQL Injection (CWE-89) in Shopping Cart Admin Panel
CVE-2026-14653
SQL Injection (CWE-89) in Simple Shopping Cart Admin
CVE-2026-14652
SQL Injection (CWE-89) in Simple Shopping Cart Admin
CVE-2026-14649
SQL Injection (CWE-89) in Online Voting System 1.0
CVE-2026-14648
SQL Injection (CWE-89) in Online Voting Login Form
CVE-2026-14642
SQL Injection (CWE-89) in Class Timetabling System
CVE-2026-14641
SQL Injection (CWE-89) in course editing endpoint
CVE-2026-14640
SQL Injection (CWE-89) in Apartment Visitor Login
CVE-2026-14637
Unsafe PHP Deserialization (CWE-502) in ShoppingCart
CVE-2026-12746
OAuth CSRF (CWE-352) in Dancer2 OAuth Provider Plugin
CVE-2026-12740
OAuth CSRF (CWE-352) in Plack::Middleware::OAuth
CVE-2026-14635
Path Traversal (CWE-22) in Vendor Image Upload Endpoint
CVE-2026-14534
Pickle Safety Bypass (CWE-184) in Fickling Library
CVE-2026-14622
Missing Authentication (CWE-287) in AJAX Admin Endpoint
CVE-2025-71380
Command Execution Abuse (CWE-284) via n8n Node
CVE-2025-71375
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71372
Unsafe Pickle Deserialization (CWE-502) in Picklescan
CVE-2025-71369
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71367
Unsafe Deserialization (CWE-502) in picklescan Checks
CVE-2025-71366
Unsafe Pickle Handling (CWE-502) in picklescan Tool
CVE-2025-71364
RCE via Undetected Unsafe Pickle (CWE-502) in picklescan
CVE-2025-71362
Unsafe Deserialization (CWE-502) via NumPy eval calls
CVE-2025-71360
Undetected Malicious Pickle (CWE-502) in picklescan
CVE-2025-71359
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71356
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71353
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71347
Undetected Unsafe Deserialization (CWE-502) in picklescan
CVE-2025-71345
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71343
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2025-71342
Unsafe Pickle Deserialization (CWE-502) in picklescan
CVE-2026-58424
PR Approval Bypass (CWE-285) in Forked Workflows
CVE-2026-58423
Auth Bypass (CWE-287) in Git LFS SSH Sub-Verb Handling
CVE-2026-58422
Improper Authorization (CWE-284) in OAuth Callback Flow
CVE-2026-58421
ReDoS in CODEOWNERS Matching (CWE-284) DoS Risk
CVE-2026-58419
Information Disclosure (CWE-200) in Issue Notification API
CVE-2026-28744
Authorization Scope Bypass (CWE-863) in Gitea Tokens
CVE-2026-28740
Broken Access Control (CWE-639) in Gitea LFS Reuse
CVE-2026-28737
Stored XSS (CWE-79) via glTF viewer in Gitea
CVE-2026-28699
OAuth2 Scope Bypass (CWE-284) in Gitea Access Control
CVE-2026-27780
Authorization Bypass (CWE-863) in Gitea Hooks
CVE-2026-27779
Canonical URL Spoofing (CWE-284) in Gitea URL Logic
CVE-2026-27775
Privilege Cache Misuse (CWE-863) in Gitea Hooks
CVE-2026-27771
Missing Access Control (CWE-862) in Gitea Composer
CVE-2026-27660
Authorization Bypass (CWE-284) in Gitea Draft Releases
CVE-2026-27657
IDOR Email Change (CWE-639) in Gitea User Accounts
CVE-2026-26292
Authorization Bypass (CWE-284) in Gitea LFS Migration
CVE-2026-26247
OAuth2 PKCE S256 Bypass (CWE-284) in Gitea Auth Flow
CVE-2026-26231
Privilege Misconfiguration (CWE-863) in Gitea Edits Path
CVE-2026-25712
Access Control Flaw (CWE-284) in Gitea Org APIs
CVE-2026-25038
Information Exposure (CWE-200) in Gitea Org Labels
CVE-2026-24690
Authorization Bypass (CWE-284) in Gitea Pull Requests
CVE-2026-24451
Authorization Bypass (CWE-284) in Gitea Fork Sync
CVE-2026-22874
SSRF Weakness (CWE-918) in Gitea Webhooks and Migrations
CVE-2026-22555
Authorization Bypass (CWE-284) in Gitea Org Fork API
CVE-2026-22547
Input Validation Flaw (CWE-20) in Gitea Repositories
CVE-2026-20896
Auth Header Trust Misconfig (CWE-284) in Gitea Docker
CVE-2026-20706
Authorization Bypass (CWE-284) in Gitea Archive Endpoint
CVE-2026-13341
Input Validation Flaw (CWE-20) in Konnect MCP APIs
CVE-2026-10055
Server-Side Request Forgery (CWE-918) in Eclipse Theia
CVE-2026-10054
Missing Terminal RPC Auth (CWE-306) in Eclipse Theia
CVE-2026-13768
Hardcoded IoT Hub Owner Key (CWE-798) in Gardyn Devices
CVE-2026-58460
Path Traversal (CWE-22) in React Native Sharing Intent
CVE-2026-52830
Path Traversal Auth Bypass (CWE-22) in Telegram MCP
CVE-2026-38969
HTTP Request Smuggling (CWE-444) in Ruby WEBrick
CVE-2026-59095
Server-Side Request Forgery (CWE-918) in LobeChat API
CVE-2026-58467
Path Traversal (CWE-22) in Cockpit CMS File Handling
CVE-2026-58455
OS Command Injection (CWE-78) in Dockwatch compose API
CVE-2026-44941
Path Traversal (CWE-23) in libzypp repomd keyhint parsing
CVE-2026-56004
Command Injection (CWE-78) in OBS tar_scm Mercurial Handler
CVE-2026-58652
Command Injection (CWE-78) in OpenWrt Travelmate Service
CVE-2026-8147
Improper Access Control (CWE-284) in MLflow Traces
CVE-2026-54263
Reflected XSS (CWE-79) in Wagtail Admin Image URLs
CVE-2026-52186
SQL Injection (CWE-89) in UTT nv518G gohead Handler
CVE-2026-38891
Input Validation Flaw (CWE-20) in Gazebo ROS DiffDrive
CVE-2026-58263
Mutation XSS (CWE-79) in Jodit Editor Sanitizer
CVE-2026-55153
JNDI Injection & Gadget Abuse (CWE-470) in c3p0 Core
CVE-2026-54074
Code Injection (CWE-94) in Tina CLI migration utility
CVE-2026-58457
OS Command Injection (CWE-78) in Aitemi M300 Repeater
CVE-2026-14265
Java Deserialization (CWE-502) in AWS JDBC Wrapper Cache
CVE-2026-53492
CDI Annotation Trust Flaw (CWE-20) in containerd CRI
CVE-2026-51947
Unsafe Deserialization (CWE-502) in Pivotal CRM Engine
CVE-2026-49119
Path Traversal (CWE-22) in Gradio FileExplorer
CVE-2026-13760
OS Command Injection (CWE-78) in AWS CDK Docker Build
CVE-2026-46680
Privilege Context Bypass (CWE-269) in containerd Runtime
CVE-2026-58454
Remote Code Injection (CWE-94) in JAIOTlink IP Cameras
CVE-2026-58452
OS Command Injection (CWE-78) in JAIOTlink C492A-W6 Camera
CVE-2026-57516
Unsafe Deserialization (CWE-502) in Ray WebDataset Reader
CVE-2026-34117
OS Command Injection (CWE-78) in Guardian exec Call
CVE-2026-34116
OS Command Injection (CWE-78) in Guardian transcribe.php
CVE-2026-34115
Command Injection (CWE-78) in Guardian exec() Handler
CVE-2026-34114
Command Injection (CWE-78) in Guardian translate_text.php
CVE-2026-34113
OS Command Injection (CWE-78) in Guardian exec() Call
CVE-2026-34112
OS Command Injection (CWE-78) in Guardian speechmac.php
CVE-2026-34111
OS Command Injection (CWE-78) in Guardian exec() Call
CVE-2026-34110
OS Command Injection (CWE-78) in Guardian PHP exec()
CVE-2026-34109
OS Command Injection (CWE-78) in Guardian speech.php
CVE-2026-34108
OS Command Injection (CWE-78) in Guardian text.php
CVE-2026-34107
OS Command Injection (CWE-78) in Guardian translate.php
CVE-2026-34106
OS Command Injection (CWE-78) in Guardian subtitles.php
CVE-2026-34105
SQL Injection (CWE-89) in Guardian translate_text.php
CVE-2026-34104
SQL Injection (CWE-89) in Guardian designer.php
CVE-2026-34103
SQL Injection (CWE-89) in Guardian subtitles handler
CVE-2026-34102
SQL Injection (CWE-89) in Guardian job_info_get.php
CVE-2026-34101
Error-Based SQL Injection (CWE-89) in Guardian System
CVE-2026-34100
SQL Injection (CWE-89) in Guardian media.php Query
CVE-2026-34099
SQL Injection (CWE-89) in Guardian job_info handler
CVE-2026-58127
Authless .NET Remoting RCE (CWE-306/502) in MediaWriter
CVE-2026-58126
Unauthenticated RCE via .NET Remoting in PACS Scan 5.2.1
CVE-2026-24251
Unsafe Code Resource Control (CWE-502) in Megatron
CVE-2026-24250
Unsafe Deserialization (CWE-502) in NVIDIA Megatron
CVE-2026-24249
Code Injection (CWE-94) via Deserialization in Megatron
CVE-2026-24248
Code Injection (CWE-94) in NVIDIA Megatron Bridge
CVE-2026-24247
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-24245
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-24244
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-24243
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-24242
Server-Side Request Forgery (CWE-918) in Megatron
CVE-2026-24240
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-23537
Missing Authorization (CWE-862) in Feast Save Endpoint
exploitable in your codebase.