AI Vulnerability Database
CVEs added in
September 2026
Every CVE that went into the database in September 2026, newest first. Each one opens its full write-up.
CVE-2026-103536
Missing Authentication (CWE-306) in ZongXR Supermarket
CVE-2026-103530
SSRF (CWE-918) in 9Router Search Endpoint Function
CVE-2026-103591
Arbitrary File Read (CWE-73) in DeepWiki-Open GET API
CVE-2026-51872
Code Injection (CWE-94) in Devika Runner Component
CVE-2026-51871
Code Injection (CWE-94) in Devika Runner Execution Path
CVE-2026-51870
OS Command Injection (CWE-78) in DeepTutor ExecTool
CVE-2026-51869
Sandbox Authorization Failure (CWE-284) in DB-GPT API
CVE-2026-51867
Broken Access Control (CWE-284) in AgentGPT API Router
CVE-2026-51866
Code Injection (CWE-94) in DB-GPT Skill Upload API Route
CVE-2026-51864
Directory Traversal (CWE-22) in DB-GPT Upload Endpoint
CVE-2026-51862
Directory Traversal (CWE-22) in DB-GPT skill_upload
CVE-2026-51861
Code Injection (CWE-94) in Bisheng Validation Component
CVE-2026-51860
Directory Traversal (CWE-22) in Bisheng Task Exec Component
CVE-2026-51859
Directory Traversal (CWE-22) in Bisheng save_download_file
CVE-2026-51858
Code Injection (CWE-94) in Camel TerminalToolkit Shell
CVE-2026-51857
Code Injection (CWE-94) in CAMEL CodeExecutionToolkit
CVE-2026-51856
Code Injection (CWE-94) in AgentScope RealtimeAgent
CVE-2026-51853
Directory Traversal (CWE-22) in agent-zero FileBrowser
CVE-2026-51852
Directory Traversal (CWE-22) in agent-zero FileBrowser
CVE-2026-51570
Path Traversal (CWE-22) in Agentscope insert_text_file
CVE-2026-51568
Path Traversal (CWE-22) in Agentscope write_text_file
CVE-2026-102150
Missing Authentication (CWE-306) in Kiteworks Forms
CVE-2026-102149
Missing Authorization (CWE-306) in Kiteworks Gateway
CVE-2026-102147
Stored XSS (CWE-79) in Kiteworks Core Admin Console
CVE-2026-102143
Unauthenticated File Upload (CWE-306) in Appliance UI
CVE-2026-102132
Authorization Bypass (CWE-284) in Kiteworks Core Admin
CVE-2026-102131
Improper Code Validation (CWE-94) in Kiteworks Gateway
CVE-2026-102130
Improper Code Generation (CWE-94) in Kiteworks Gateway
CVE-2026-102128
Improper Authentication (CWE-287) in Kiteworks Gateway
CVE-2026-102127
XXE (CWE-611) in Kiteworks Email Protection Gateway XML
CVE-2026-102126
Stored XSS (CWE-79) in Kiteworks Core Admin Portal
CVE-2026-102123
Path Traversal (CWE-22) in Kiteworks Setup Interface
CVE-2026-102121
Information Disclosure (CWE-200) in Kiteworks Advanced Forms
CVE-2026-102120
OS Command Injection (CWE-78) in Kiteworks Cluster
CVE-2026-102119
Path Traversal (CWE-22) in Administrative File Feature
CVE-2026-102116
Path Traversal (CWE-22) in Kiteworks Email Gateway Service
CVE-2026-102114
OS Command Injection (CWE-78) in Kiteworks Appliance
CVE-2026-102113
Improper Link Resolution (CWE-59) in Kiteworks Appliance
CVE-2026-102112
Privilege Escalation (CWE-269) in Kiteworks Appliance
CVE-2026-102109
SQL Injection (CWE-89) in Kiteworks Secure Data Forms
CVE-2026-102108
Unsafe Deserialization (CWE-502) in Kiteworks Gateway
CVE-2026-102106
Improper Authentication (CWE-287) in Kiteworks Admin Service
CVE-2026-102105
SSRF (CWE-918) in Kiteworks Email Protection Gateway
CVE-2026-102104
SSRF (CWE-918) in Kiteworks Email Protection Gateway
CVE-2026-102103
Server-Side Request Forgery (CWE-918) in Kiteworks Gateway
CVE-2026-102102
SSRF (CWE-918) in Kiteworks Email Protection Gateway
CVE-2026-102101
Unsafe Deserialization (CWE-502) in Kiteworks Core
CVE-2026-102100
Stored Cross-Site Scripting (CWE-79) in Kiteworks Core
CVE-2026-102099
Path Traversal (CWE-22) in Kiteworks Core Export Feature
CVE-2026-102098
SQL Injection (CWE-89) in Kiteworks Core Reporting
CVE-2026-102097
Code Injection (CWE-94) in Kiteworks Email Protection
CVE-2026-102096
OS Command Injection (CWE-78) in Kiteworks Core Appliance
CVE-2026-102095
SSRF (CWE-918) in Kiteworks Email Protection Gateway
CVE-2026-102093
Improper Privilege Management (CWE-269) in Kiteworks
CVE-2026-102092
Stored XSS (CWE-79) in Kiteworks Core Content Preview
CVE-2026-102091
Server-Side Request Forgery (CWE-918) in Kiteworks Forms
CVE-2026-102089
Path Traversal (CWE-22) in Kiteworks Email Gateway
CVE-2024-58387
Path Traversal (CWE-22) in Inspur Haiyue HCM Cloud
CVE-2023-54403
Path Traversal (CWE-22) in Yonyou U8 CRM Endpoint Handler
CVE-2023-54402
SSRF (CWE-918) in iDocView Document Upload Endpoint
CVE-2026-101885
Path Traversal (CWE-22) in ZeroClaw WASM Plugin Installer
CVE-2026-101880
Improper Authorization (CWE-863) in OpenClaw Windows
CVE-2026-55107
Code Injection (CWE-94) in Kobako mruby Execution Sandbox
CVE-2026-53605
Improper Privilege Management (CWE-269) in Reachy OS
CVE-2026-103474
Unrestricted Upload (CWE-434) in yii2-starter-kit Backend
CVE-2026-103473
Command Injection (CWE-78) in Deno Windows Runtime
CVE-2026-62308
Server-Side Request Forgery (CWE-918) in Tugtainer App
CVE-2026-55494
Broken Access Control (CWE-284) in Tugtainer Agent API
CVE-2026-55181
Authentication Bypass (CWE-284) in Tugtainer OIDC Endpoint
CVE-2026-55176
Broken Access Control (CWE-863) in Soft Machine APIs
CVE-2026-46711
Missing Authentication (CWE-306) in Soft Machine Workspace
CVE-2026-103232
SQL Injection (CWE-89) in RMS admin/table_booking.php
CVE-2026-102490
Privilege Escalation (CWE-269) in Zammad DEB/RPM Packages
CVE-2026-47591
Incorrect Authorization (CWE-863) in NVIDIA Linux GPU Driver
CVE-2026-47580
Missing Authorization (CWE-862) in NVIDIA GPU Driver
CVE-2026-47571
Authorization Bypass (CWE-863) in NVIDIA GPU Driver
CVE-2026-47559
Missing Authorization (CWE-862) in NVIDIA GPU Driver
CVE-2026-47552
Authorization Bypass (CWE-862) in NVIDIA Linux Driver
CVE-2026-47514
Kernel Information Disclosure (CWE-200) in NVIDIA GPU Driver
CVE-2026-47493
Missing Authorization (CWE-862) in NVIDIA vGPU Driver
CVE-2026-103231
SQL Injection (CWE-89) in Restaurant Order Cancellation
CVE-2026-103230
SQL Injection (CWE-89) in Restaurant Order Placement
CVE-2026-103229
SQL Injection (CWE-89) in AdithyaYelloju Restaurant
CVE-2026-103398
Path Traversal (CWE-73) in OpenSave Save Handler Routes
CVE-2026-103395
Unsafe Deserialization (CWE-502) in LightLLM RPyC Service
CVE-2026-103270
Missing Authentication (CWE-306) in LightLLM RL API
CVE-2026-101295
Path Traversal (CWE-22) in oc-mirror Catalog Extraction
CVE-2026-102913
SQL Injection (CWE-89) in Car Driving School System
CVE-2026-102911
OS Command Injection (CWE-78) in pi-llm-wiki MCP Tool
CVE-2026-102910
SQL Injection (CWE-89) in Reviewer Management System
CVE-2026-102909
SQL Injection (CWE-89) in Online Reviewer Assessment
CVE-2026-102908
SQL Injection (CWE-89) in Reviewer Management System
CVE-2026-102874
OS Command Injection (CWE-78) in AnyTool Execute Endpoint
CVE-2026-103056
Command Injection (CWE-78) in AiSOC Actions Service
CVE-2026-103054
Authorization Bypass (CWE-639) in AiSOC MSSP Module
CVE-2026-102794
Command Injection (CWE-74) in Ziroom ZHOME A0101 API
CVE-2026-102793
Command Injection (CWE-77) in Ziroom ZHOME A0101 API
CVE-2026-103041
Unsafe Deserialization (CWE-502) in LightLLM RPyC Service
CVE-2026-103040
Unsafe Deserialization (CWE-502) in LightLLM Profiler
CVE-2026-102792
OS Command Injection (CWE-77) in Ziroom ZHOME API
CVE-2026-84409
Stored XSS (CWE-79) in Device Software Update Portal UI
CVE-2026-72510
SQL Injection (CWE-89) in Business Allocation Search
CVE-2026-72507
SQL Injection (CWE-89) in Product Summary Reports Feature
CVE-2026-71302
Session Fixation (CWE-384) in Web Authentication Flow
CVE-2026-70356
Unrestricted File Upload (CWE-434) in TMS Endpoint
CVE-2026-68954
SQL Injection (CWE-89) in TMS Home Page Search Function
CVE-2026-68068
SQL Injection (CWE-89) in Transaction Queue Viewer
CVE-2026-63713
Time-Based SQL Injection (CWE-89) in Audit Logs Search
CVE-2026-96587
Hardcoded Credentials (CWE-798) in Viidure Android App
CVE-2026-102925
OS Command Injection (CWE-78) in virtualenv Activation
CVE-2026-79538
Code Injection (CWE-94) in MetaMCP MCP Inspector Proxy
CVE-2026-79537
IDOR (CWE-639) in MetaMCP MCP Transport Layer Dispatch
CVE-2026-67993
Login CSRF (CWE-352) in Upright Credentials Callback
CVE-2026-61519
Broken Access Control (CWE-863) in Liberu CRM Teams
CVE-2026-53988
Authentication Bypass (CWE-306) in Dockhand Webhooks
CVE-2026-102876
Authorization Bypass (CWE-639) in SurrealDB HTTP Sessions
CVE-2024-31026
Code Injection (CWE-94) in GUnet Open eClass Chat Module
CVE-2026-102831
Stored XSS (CWE-79) in JupyterLab Cell-Paste Handler
CVE-2026-102828
OS Command Injection (CWE-78) in simple-git Trailers
CVE-2026-102827
Command Injection (CWE-77) in simple-git Push Node.js
CVE-2026-102826
Command Injection (CWE-78) in simple-git Git Clone
CVE-2026-102823
Improper Input Validation (CWE-20) in Russh SSH Client
CVE-2026-102616
SQL Injection (CWE-89) in Y9 Workflow Engine OAuth2
CVE-2026-102811
Missing Authentication (CWE-306) in Marmite Dev Server
CVE-2026-102810
Path Traversal (CWE-22) in Marmite Development Server
CVE-2026-102677
Preload Cache Validation (CWE-345) in Electron Apps
CVE-2026-102697
Command Authorization Bypass (CWE-863) in Ollama Agent
CVE-2026-102676
Improper Privilege Management (CWE-269) in Electron Webview
CVE-2022-51019
OS Command Injection (CWE-78) in Akaunting Module Flow
CVE-2026-97687
TLS Verification Bypass (CWE-295) in urllib3 Proxies
CVE-2026-77177
Server-Side Template Injection (CWE-94) in Open GenAI Stack
CVE-2026-102600
Prototype Pollution (CWE-1321) in Socket.IO Cluster
CVE-2026-100308
Unsafe Deserialization (CWE-502) in Amazon GluonTS Models
CVE-2023-54400
SQL Injection (CWE-89) in Fumeng Cloud AjaxMethod Endpoint
CVE-2026-86035
Argument Injection (CWE-88) in Weblate Mercurial Backend
CVE-2026-49243
Cross-Site Scripting (CWE-79) in Webmin Admin Tool
CVE-2026-102491
SQL Injection (CWE-89) in kykms SqlInjectionUtil API
CVE-2026-102437
OS Command Injection (CWE-78) in Reasonix Studio App
CVE-2026-102293
Improper Authorization (CWE-285) in Tacomall API Admin
CVE-2026-102422
Shell Command Injection (CWE-78) in shell-quote quote()
CVE-2026-102249
Missing Authorization (CWE-862) in REBUILD File Editor
CVE-2026-102248
Improper Authentication (CWE-287) in Rebuild Login Endpoint
CVE-2026-102245
Missing Authentication (CWE-306) in SurfSense Webhook
CVE-2026-102243
Command Injection (CWE-77) in SurfSense MCP Connector
CVE-2026-102240
OS Command Injection (CWE-78) in Netcore NAP930 CGI
CVE-2026-101860
Improper Privilege (CWE-269) in RaspAP PluginInstaller
CVE-2026-101281
Improper Authentication (CWE-287) in OpenDMARC SPF
CVE-2026-101280
Authentication Bypass (CWE-287) in Trusted OpenDMARC
CVE-2026-102361
Missing Authentication (CWE-306) in mall4j Password API
CVE-2026-101264
Command Injection (CWE-74) in Ziroom ZHOME A0101 Device
CVE-2026-101263
Command Injection (CWE-74) in Ziroom ZHOME API Endpoint
CVE-2026-102335
Improper Authorization (CWE-863) in Nginx Proxy Manager
CVE-2026-102334
Missing Rate Limiting (CWE-307) in Nginx Proxy Manager
CVE-2026-101262
OS Command Injection (CWE-77) in Ziroom ZHOME API Endpoint
CVE-2026-101261
OS Command Injection (CWE-77) in Ziroom ZHOME API Endpoint
CVE-2026-101260
OS Command Injection (CWE-77) in Ziroom ZHOME API
CVE-2026-101091
SQL Injection (CWE-89) in SiYuan Block Query Embeds
CVE-2024-42002
Code Injection (CWE-94) in ROS 2 ros2topic CLI Tool
CVE-2026-102267
JWKS Redirect Validation (CWE-918) in PyJWT PyJWKClient
CVE-2026-101916
Improper Certificate Validation (CWE-295) in gRPC-JS
CVE-2026-101187
OS Command Injection (CWE-77) in Ziroom ZHOME USB API
CVE-2026-96760
Signature Verification Bypass (CWE-347) in Authlib
CVE-2026-75600
OS Command Injection (CWE-78) in FreePBX GraphQL API
CVE-2026-55160
Server-Side Request Forgery (CWE-918) in Stringer RSS Reader
CVE-2026-55157
OS Command Injection (CWE-78) in Token Optimizer MCP
CVE-2026-54710
PHP Code Injection (CWE-94) in FreePBX Superfecta Module
CVE-2026-54708
Path Traversal (CWE-22) in FreePBX Backup Module RCE
CVE-2026-54675
Path Traversal (CWE-22) in FreePBX Sound File Upload
CVE-2026-54674
OS Command Injection (CWE-78) in FreePBX UCP Access
CVE-2026-49994
Missing Authentication (CWE-306) in Bluehood API Endpoints
CVE-2026-45562
OS Command Injection (CWE-78) in FreePBX Music on Hold
CVE-2026-55096
DNS-Rebinding SSRF (CWE-918) in fast-mcp-telegram MCP
CVE-2026-101894
Path Traversal (CWE-22) in Node.js Decompress Package
CVE-2026-93348
Code Injection (CWE-94) in Unsloth Model Loading Path
CVE-2026-88804
Stored XSS (CWE-79) in SUSE Rancher Public UI Settings
CVE-2026-101077
Missing Authentication (CWE-287) in Netcore NR289-GE
CVE-2026-101076
OS Command Injection (CWE-78) in Netcore NR289-GE CGI
CVE-2026-93538
Cross-Tenant Authorization (CWE-639) in Rancher Fleet
CVE-2026-101075
OS Command Injection (CWE-78) in Netcore NR289-GE CGI
CVE-2026-101073
Improper Authentication (CWE-287) in Netcore CGI Dispatcher
CVE-2026-97335
Authorization Bypass (CWE-863) in Canonical LXD Storage
CVE-2026-85526
Path Traversal (CWE-22) in LXD Btrfs Storage Driver
CVE-2026-85185
Path Traversal (CWE-22) in Canonical LXD Btrfs Driver
CVE-2026-101072
OS Command Injection (CWE-78) in Netcore NR289-GE Router
CVE-2026-101067
Path Traversal (CWE-22) in dbgate File Upload Endpoint
CVE-2026-101066
Path Traversal (CWE-22) in dbgate Archive Link Creation
CVE-2026-78424
OS Command Injection (CWE-78) in NeuVector Enforcer
CVE-2026-101053
Improper Access Control (CWE-284) in Thinkware U3000
CVE-2026-101052
Hard-Coded Credentials (CWE-798) in Refly JWT Handler
CVE-2026-82386
XXE (CWE-611) in Apache Roller OPML Import Handler
CVE-2026-82384
Unsafe Deserialization (CWE-502) in Apache Roller XML-RPC
CVE-2026-82383
Missing Authentication (CWE-306) in Apache Roller Web
CVE-2026-82380
Cross-Site Request Forgery (CWE-352) in Apache Roller
CVE-2026-82378
Incorrect Authorization (CWE-863) in Apache Roller OAuth
CVE-2026-82377
Missing Authorization (CWE-862) in Apache Roller XML-RPC
CVE-2026-82376
XXE (CWE-611) in Apache Roller Trackback Response Parser
CVE-2026-82375
SSRF (CWE-918) in Apache Roller Outbound Requests
CVE-2026-82348
Authorization Bypass (CWE-639) in Apache Roller Weblogs
CVE-2026-101013
SQL Injection (CWE-89) in CloudClassroom PHP Project
CVE-2026-101012
SQL Injection (CWE-89) in CloudClassroom PHP Project
CVE-2026-101009
OS Command Injection (CWE-78) in aaPanel BaoTa Unzip
CVE-2026-101008
Command Injection (CWE-77) in aaPanel BaoTa File Handler
CVE-2026-101007
OS Command Injection (CWE-78) in aaPanel Database Backup
CVE-2026-101005
Server-Side Request Forgery (CWE-918) in October CMS Resizing
CVE-2026-101002
OS Command Injection (CWE-78) in Netcore NBR200V2
CVE-2026-101001
OS Command Injection (CWE-78) in Netcore NBR200V2
CVE-2026-101000
Missing Authorization (CWE-862) in Netcore NBR100V2
CVE-2026-100909
Server-Side Request Forgery (CWE-918) in OctoberCMS
CVE-2026-100901
Server-Side Request Forgery (CWE-918) in athlon1600 stream.php
CVE-2026-100896
OS Command Injection (CWE-78) in TOTOLINK N150RT Web UI
CVE-2026-100886
Improper Authentication (CWE-287) in Seetong Debug Service
CVE-2026-100885
Authorization Bypass (CWE-285) in Krayin Admin Setup
CVE-2026-101090
Host Header Injection (CWE-601) in Nezha OAuth2 Endpoint
CVE-2026-101084
Broken Access Control (CWE-639) in obot MCP Endpoint
CVE-2026-101065
Missing Authentication (CWE-306) in Obot Quickstart
CVE-2026-101064
SSRF (CWE-918) in Obot Remote MCP Registration API
CVE-2026-101062
OAuth Authorization Bypass (CWE-863) in Obot MCP API
CVE-2026-100875
SQL Injection (CWE-89) in CloudClassroom-PHP Details
CVE-2026-100874
SQL Injection (CWE-89) in CloudClassroom-PHP Project
CVE-2026-101060
Server-Side Request Forgery (CWE-918) in python-utcp
CVE-2026-101059
SSRF (CWE-918) in utcp-http OAuth2 Token Handling Flow
CVE-2026-101045
OS Command Injection (CWE-78) in Fleet macOS Scripts
CVE-2026-101044
Path Traversal (CWE-22) in pnpm pacquet Package Installs
CVE-2026-101032
OS Command Injection (CWE-78) in Navi Cheatsheets
CVE-2026-100871
Improper Authentication (CWE-287) in Sylius JWT APIs
CVE-2026-93302
Certificate Authentication Bypass (CWE-295) in wolfSSL
CVE-2026-89134
Improper Certificate Validation (CWE-295) in wolfSSL
CVE-2026-100746
Authentication Bypass (CWE-287) in Coolify GitHub Setup
CVE-2026-100865
Code Injection (CWE-94) in Heym Workflow Engine Core
CVE-2026-100864
Code Injection (CWE-94) in heym Expression Resolver
CVE-2026-100857
Code Injection (CWE-94) in AzuraCast Station Config Files
CVE-2026-100856
Code Injection (CWE-94) in AzuraCast Remote Relay Field
CVE-2026-100852
OS Command Injection (CWE-78) in AzuraCast Recording
CVE-2026-100851
Broken Access Control (CWE-200) in AzuraCast API Endpoint
CVE-2026-100850
SSRF (CWE-918) in AzuraCast AutoDJ Remote Playlists
CVE-2026-100849
Server-Side Request Forgery (CWE-918) in AzuraCast Webhooks
CVE-2026-100848
Server-Side Request Forgery (CWE-918) in AzuraCast App
CVE-2026-100847
DQL Injection (CWE-89) in AzuraCast SortOrder API Parameter
CVE-2026-100846
Unsafe Deserialization (CWE-502) in MONAI Auto3DSeg
CVE-2026-100845
Unsafe Deserialization (CWE-502) in MONAI NumpyReader
CVE-2026-100844
OS Command Injection (CWE-78) in MONAI nnUNetV2Runner
CVE-2026-100843
Unsafe Deserialization (CWE-502) in MONAI Auto3DSeg Utility
CVE-2026-100842
Code Injection (CWE-95) in MONAI Bundle Verification
CVE-2026-100841
Unsafe Deserialization (CWE-502) in MONAI Cache Data
CVE-2026-100840
Code Injection (CWE-95) in MONAI Bundle Config Engine RCE Risk
CVE-2026-100839
AML Injection (CWE-94) in Contrast Guest Kernel on SNP
CVE-2026-100835
Improper Certificate Validation (CWE-295) in Contrast
CVE-2026-100833
Improper Input Validation (CWE-20) in Contrast Policies
CVE-2026-100744
Missing Authorization (CWE-862) in Coolify Middleware
CVE-2026-100723
Sandbox Memory Disclosure (CWE-200) in vm2 zlib Buffers
CVE-2026-100721
Authorization Bypass (CWE-863) in vm2 NodeVM Resolver
CVE-2025-71426
Improper Authorization (CWE-285) in Contrast Runtime
CVE-2026-100739
SQL Injection (CWE-89) in CloudClassroom viewresult.php
CVE-2026-100720
Stored XSS (CWE-79) in Froxlor SSL Certificate APIs
CVE-2026-100709
Authentication Bypass (CWE-287) in Froxlor 2FA Tokens
CVE-2026-100708
Sensitive Data Exposure (CWE-200) in Froxlor Certificate API
CVE-2026-100707
Path Traversal (CWE-22) in Kyverno Namespace Policy
CVE-2026-100705
Server-Side Request Forgery (CWE-918) in Kyverno Legacy API
CVE-2026-100704
Authorization Bypass (CWE-863) in Kyverno Image Policy
CVE-2026-100703
Information Disclosure (CWE-200) in Kyverno Policies
CVE-2026-100697
Server-Side Request Forgery (CWE-918) in Adminer ClickHouse
CVE-2026-100686
Broken Access Control (CWE-269) in Budibase App Endpoint
CVE-2026-100685
Broken Access Control (CWE-863) in Budibase Chat API
CVE-2026-100684
Authentication Bypass (CWE-287) in Budibase OIDC Login
CVE-2026-100683
SQL Injection (CWE-89) in Budibase Column-Rename DDL
CVE-2026-100682
Path Traversal (CWE-22) in Budibase PWA Icon Upload
CVE-2026-100680
Arbitrary File Read (CWE-200) in Budibase OpenAPI Import
CVE-2026-100679
Authorization Bypass (CWE-639) in stoatchat MFA Flow
CVE-2026-100673
Stored XSS (CWE-79) in Grav Data Manager Extension
CVE-2026-100672
Missing Authentication (CWE-306) in Grav Comments Plugin
CVE-2026-100671
Sensitive Data Exposure (CWE-200) in Grav CMS Twig
CVE-2026-100670
Authorization Bypass (CWE-639) in Grav CMS Accounts
CVE-2026-100666
HTTP Request Smuggling (CWE-444) in Netty HttpCodec
CVE-2026-100665
Improper Certificate Validation (CWE-295) in Netty QUIC
CVE-2026-100664
HTTP Authority Confusion (CWE-20) in Netty HTTP/3 Codec
CVE-2026-100663
Improper Input Validation (CWE-20) in Netty HTTP/3
CVE-2026-100645
Stored XSS (CWE-79) in SiYuan Gallery UI Renderers
CVE-2026-100644
SQL Injection (CWE-89) in SiYuan Graph Query Endpoint
CVE-2026-100643
Stored XSS (CWE-79) in SiYuan Attribute View Fields
CVE-2026-100641
Stored XSS (CWE-79) in SiYuan Card Manager Desktop
CVE-2026-100639
DOM XSS (CWE-79) in SiYuan Gutter Button Component
CVE-2026-100638
Path Traversal (CWE-73) in SiYuan Notebook Icons
CVE-2026-100637
Path Traversal (CWE-73) in SiYuan checkoutRepo Endpoint
CVE-2026-100636
Path Traversal (CWE-22) in SiYuan Export Endpoint
CVE-2026-100627
Authorization Bypass (CWE-639) in Capgo Bundle API
CVE-2026-100623
Authorization Bypass (CWE-863) in Capgo org_users Table
CVE-2026-100622
Information Disclosure (CWE-200) in Capgo.app Cache
CVE-2026-100618
Broken Object Level Authorization (CWE-639) in Capgo
CVE-2026-100617
Missing Authorization (CWE-862) in Cap-go Channels
CVE-2026-100615
Authorization Bypass (CWE-269) in Cap-go API Key Manager
CVE-2026-100614
Cross-Tenant Authorization (CWE-639) in Capgo Worker
CVE-2026-100612
Broken Access Control (CWE-639) in Capgo SSO Providers
CVE-2026-100610
Broken Access Control (CWE-639) in Flowise History
CVE-2026-100608
Missing Authorization (CWE-862) in Flowise BullMQ Dashboard
CVE-2026-100607
Improper Authentication (CWE-287) in Flowise SSO Users
CVE-2026-100606
Authentication Bypass (CWE-287) in Flowise SSO Login
CVE-2026-100605
Missing Authorization (CWE-862) in Flowise Chat API
CVE-2026-100315
SQL Injection (CWE-89) in CloudClassroom PHP Project
CVE-2026-100314
SQL Injection (CWE-89) in CloudClassroom PHP Project
CVE-2026-100599
OS Command Injection (CWE-78) in OpenClaw Google Meet
CVE-2026-100596
Improper Authorization (CWE-862) in OpenClaw MCP Commands
CVE-2026-100589
Authorization Bypass (CWE-863) in OpenClaw Browser Tool
CVE-2026-100588
Authorization Bypass (CWE-863) in OpenClaw Browser Control
CVE-2026-100587
Missing Authorization (CWE-862) in OpenClaw Codex Command
CVE-2026-100586
Improper Authorization (CWE-269) in OpenClaw Codex
CVE-2026-100585
Missing Authorization (CWE-862) in OpenClaw MCP Bridge
CVE-2026-100579
Authorization Bypass (CWE-639) in OpenClaw Gateway API
CVE-2026-100578
Improper Privilege Management (CWE-269) in OpenClaw
CVE-2026-100575
Authorization Bypass (CWE-862) in OpenClaw Slack Agents
CVE-2026-100568
Information Exposure (CWE-200) in OpenClaw Cron Jobs
CVE-2026-100567
SSRF (CWE-918) in OpenClaw Remote CDP Gateway Validation
CVE-2026-100560
Authorization Bypass (CWE-863) in OpenClaw Command Runner
CVE-2026-100559
OS Command Injection (CWE-78) in OpenClaw Exec Parser
CVE-2026-100557
Authorization Bypass (CWE-863) in OpenClaw Skill Dispatch
CVE-2026-100555
SSRF (CWE-918) in OpenClaw Synology Chat Gateway App
CVE-2026-100552
Authorization Bypass (CWE-863) in OpenClaw Codex Tools
CVE-2026-100551
Improper Certificate Validation (CWE-295) in OpenClaw iOS
CVE-2026-100544
Missing Authorization (CWE-862) in OpenClaw Voice Calls
CVE-2026-100543
Information Exposure (CWE-200) in OpenClaw Gateway Service
CVE-2026-100535
Improper Authorization (CWE-863) in OpenClaw Memory
CVE-2026-100532
Missing Authorization (CWE-862) in OpenClaw WhatsApp
CVE-2026-100530
Improper Authorization (CWE-863) in OpenClaw Exec Approvals
CVE-2026-100520
Path Traversal (CWE-22) in Laranode File Manager Upload
CVE-2026-96795
Code Injection (CWE-94) in Horilla List View Export
CVE-2026-57443
Missing Authentication (CWE-306) in AetherBrowser API
CVE-2026-100391
SSRF (CWE-918) in MediaFlow Proxy /proxy Endpoints
CVE-2026-100372
Path Traversal (CWE-22) in ClipBucket Template Editor
CVE-2026-100368
OS Command Injection (CWE-78) in CliInvoke Wrappers
CVE-2026-97063
Improper Authentication (CWE-287) in X-SpringBoot
CVE-2026-97060
Broken Object Authorization (CWE-639) in X-SpringBoot
CVE-2026-97885
SQL Injection (CWE-89) in CloudClassroom updatefaculty.php
CVE-2026-97883
SQL Injection (CWE-89) in CloudClassroom updatequery.php
CVE-2026-97882
SQL Injection (CWE-89) in CloudClassroom Faculty Login
CVE-2026-97878
Auth Bypass (CWE-287) in StarTraining Druid Console
CVE-2026-97877
Hard-Coded Password (CWE-259) in StarTraining JWT Handler
CVE-2026-97871
Code Injection (CWE-94) in Zhonglun CloudPos JSBridge
CVE-2026-89032
Authorization Bypass (CWE-863) in LiteLLM Cache Layer
CVE-2026-67412
Missing Authorization (CWE-862) in RabbitMQ Federation
CVE-2026-67411
Authorization Bypass (CWE-863) in RabbitMQ MQTT Frontend
CVE-2026-67410
Information Exposure (CWE-200) in RabbitMQ OAuth2 UI
CVE-2026-67407
Authorization Bypass (CWE-862) in RabbitMQ MQTT Broker
CVE-2026-67237
Reflected XSS (CWE-79) in RabbitMQ Management Web UI
CVE-2026-67223
LDAP Injection (CWE-90) in RabbitMQ LDAP Auth Component
CVE-2026-62262
SQL Injection (CWE-89) in Piwigo Public Rating Search
CVE-2026-50547
Local File Inclusion (CWE-98) in InvoicePlane E-Invoices
CVE-2026-49850
CSRF (CWE-22) in InvoicePlane Invoice Deletion Routes
CVE-2026-44642
SQL Injection (CWE-89) in Piwigo Upgrade Authentication
CVE-2026-42324
SQL Injection (CWE-89) in Piwigo Album Sorting Queries
CVE-2026-42323
SQL Injection (CWE-89) in Piwigo Batch Manager Filters
CVE-2026-42322
Unrestricted Upload (CWE-434) in Piwigo Logo Handler
CVE-2026-33639
SQL Injection (CWE-89) in InvoicePlane Tax Settings UI
CVE-2026-97865
Unsafe Deserialization (CWE-502) in OWA Event Queue
CVE-2026-85750
Improper Input Validation (CWE-20) in Piwigo Uploads
CVE-2026-88421
Broken Access Control (CWE-284) in Puput BlogPage Component
CVE-2026-79153
Improper Access Control (CWE-269) in Seclore Client
CVE-2026-51773
SSRF (CWE-918) in OpenStack glance_store VMware Driver
CVE-2026-51772
Server-Side Request Forgery (CWE-918) in OpenStack Glance
CVE-2026-97818
Incorrect Authorization (CWE-863) in phpIPAM User API
CVE-2026-97735
Stored XSS (CWE-79) in ITFlow Ticket Email Parser Path
CVE-2026-97646
Authorization Bypass (CWE-285) in Student Management System
CVE-2026-97326
Server-Side Request Forgery (CWE-918) in Chat Server
CVE-2026-93291
Improper Certificate Validation (CWE-295) in Omni C20
CVE-2026-93289
Command Injection (CWE-78) in Device Pairing Process
CVE-2026-84399
Improper Authorization (CWE-863) in Botslab G980H
CVE-2026-77294
Server-Side Request Forgery (CWE-918) in TREK AI Parser
CVE-2026-77293
Broken Object Authorization (CWE-639) in TREK Collab
CVE-2026-61825
Stored XSS (CWE-79) in code16 Sharp Editor Component
CVE-2026-61823
Stored XSS (CWE-79) in Sharp Rich-Text Editor Panel
CVE-2026-57440
Cross-Site Scripting (CWE-79) in MediaWiki EmbedVideo
CVE-2026-48070
Path Traversal (CWE-22) in Docmost Avatar Cleanup Logic
CVE-2026-85057
Improper Access Control (CWE-284) in ZITADEL Actions
CVE-2026-85056
Authentication Bypass (CWE-287) in ZITADEL Login V2
CVE-2026-63645
Sensitive Information Exposure (CWE-200) in OpenObserve
CVE-2026-61788
Read-Only Bypass (CWE-863) in DBHub SQL Server
CVE-2026-61782
Information Exposure (CWE-200) in Rsdoctor Report Server
CVE-2026-61741
XXE (CWE-611) in http4s-scala-xml XML Message Decoders
CVE-2026-61732
Prompt Injection (CWE-74) in Decepticon Web Crawler
CVE-2026-57178
Improper Authentication (CWE-287) in Python Social Auth
CVE-2026-94612
SAML Assertion Validation (CWE-287) in authentik SAML
CVE-2026-94611
Credential Disclosure (CWE-200) in authentik APIs
CVE-2026-94609
Improper Privilege Management (CWE-269) in authentik
CVE-2026-94606
Auth Bypass (CWE-287) in authentik Email Enrollment
CVE-2026-91160
Missing Authorization (CWE-862) in OpenWA WebSocket Gateway
CVE-2026-91123
Path Traversal (CWE-22) in Discourse Iframe URL Guard
CVE-2026-91122
Stored XSS (CWE-79) in Discourse Video Placeholder
CVE-2026-79766
OS Command Injection (CWE-78) in Termix ACME SSL Routes
CVE-2026-79764
SSRF (CWE-918) in Termix Homepage Proxy Service
CVE-2026-63498
Stored XSS (CWE-79) in Snipe-IT Uploaded Files API
CVE-2026-62368
Stored XSS (CWE-79) in Snipe-IT Asset List Header Titles
CVE-2026-96750
Code Injection (CWE-94) in MongoDB Compass Shell Startup
CVE-2026-93425
OS Command Injection (CWE-78) in Dokploy PaaS Server
CVE-2026-77581
Server-Side Request Forgery (CWE-918) in BentoPDF CORS Proxy
CVE-2026-67233
Missing Authorization (CWE-862) in RabbitMQ Shovel
CVE-2026-63203
Missing Authorization (CWE-862) in Logto Account API
CVE-2026-56737
Authentication Bypass (CWE-287) in phpMyFAQ 2FA Flow
CVE-2026-56736
Stored XSS (CWE-79) in phpMyFAQ Admin Review Page
CVE-2026-52001
Information Disclosure (CWE-200) in mcp-remote SSE Transport
CVE-2026-51997
Improper Input Validation (CWE-20) in mcp-remote open
CVE-2026-51996
Arbitrary Code Injection (CWE-94) in mcp-remote utils
CVE-2026-51995
Information Disclosure (CWE-200) in mcp-remote Auth Metadata
CVE-2026-51994
SSRF (CWE-918) in mcp-remote Resource Metadata URL
CVE-2026-97360
Missing Authorization (CWE-862) in HFS2 File Access
CVE-2026-96762
Authorization Bypass (CWE-285) in Mooncake RPC Handler
CVE-2026-96603
Missing Authorization (CWE-862) in Admin Handler Code
CVE-2026-96602
SQL Injection (CWE-89) in Online Makeup Store Login
CVE-2026-96601
SQL Injection (CWE-89) in online-makeup-store Admin Login
CVE-2026-93352
Unrestricted Upload (CWE-434) in Laravel-Mediable Package
CVE-2026-96556
Improper Authorization (CWE-285) in CafeManagement
CVE-2026-67404
TLS Validation Failure (CWE-295) in RabbitMQ OAuth2
CVE-2026-67231
TLS Client Authentication Bypass (CWE-295) in RabbitMQ
CVE-2026-86064
Unauthenticated Log WebSocket (CWE-306) in Klever-Go
CVE-2026-77602
Code Injection (CWE-94) in OpenC3 COSMOS Config Paths
CVE-2026-77601
OS Command Injection (CWE-78) in OpenC3 COSMOS API
CVE-2026-77394
Stored XSS (CWE-79) in OpenC3 COSMOS Shared Screens
CVE-2026-76089
Broken Access Control (CWE-639) in Formie Notifications
CVE-2026-76087
Broken Access Control (CWE-639) in Formie Submissions
CVE-2026-76086
SSRF (CWE-918) in Formie Craft CMS Integration Settings
CVE-2026-96759
Code Injection (CWE-94) in Orval TanStack Generators
CVE-2026-96758
Code Injection (CWE-94) in Orval Form-Data Serializer
CVE-2026-96757
Code Injection (CWE-94) in Orval OpenAPI Generator Tool
CVE-2026-96756
Code Injection (CWE-94) in Orval Factory Generation
CVE-2026-96755
Code Injection (CWE-94) in Orval @orval/effect Generator
CVE-2026-96754
Code Injection (CWE-94) in Orval Hono Route Generator
CVE-2026-96656
Arbitrary File Write (CWE-73) in Plex Media Server
CVE-2026-95846
Improper Authorization (CWE-862) in Moquette MQTT Broker
CVE-2026-95843
Improper Input Validation (CWE-20) in Moquette MQTT
CVE-2026-93349
OS Command Injection (CWE-78) in Frictionless Explore
CVE-2026-85724
MQTT ACL Filter Injection (CWE-155) in Moquette Broker
CVE-2026-96673
SQL Injection (CWE-89) in Photoview Album Download
CVE-2026-79310
Server-Side Template Injection (CWE-94) in web.py 0.76
CVE-2026-96276
Path Traversal (CWE-22) in Flatpak SDK Extension Builder
CVE-2026-96275
Path Traversal (CWE-22) in Flatpak Extra Data Handler
CVE-2026-55610
Broken Access Control (CWE-639) in InvoiceShelf Users
CVE-2026-96560
Unsafe Deserialization (CWE-502) in LightLLM RPyC Service
CVE-2026-96512
Time-Based Authorization Bypass (CWE-863) in sudo Tool
CVE-2026-59167
Stored XSS (CWE-79) in SunEditor Content Sanitizer
CVE-2026-96455
Missing Authentication (CWE-306) in Reachy Mini API
CVE-2026-96442
Code Injection (CWE-94) in Emacs Flymake Syntax Checks
CVE-2026-96454
Missing Authorization (CWE-862) in Pake Tauri Apps
CVE-2026-95626
CSP Bypass (CWE-79) in Tauri Application Security Layer
CVE-2026-95927
SQL Injection (CWE-89) in Reviewer Management System
CVE-2026-95926
SQL Injection (CWE-89) in Online Reviewer Management System
CVE-2026-96272
Blind SQL Injection (CWE-89) in ClipBucket Search
CVE-2026-96271
Authorization Bypass (CWE-639) in Photoview shareAlbum
CVE-2026-95925
SQL Injection (CWE-89) in Online Reviewer Databank
CVE-2026-95924
SQL Injection (CWE-89) in Online Reviewer Assessments
CVE-2026-61685
SQL Injection (CWE-89) in ReactPress APIs
CVE-2026-95819
SQL Injection (CWE-89) in College-Notes-Gallery Login
CVE-2026-95814
Incorrect Authorization (CWE-863) in Vaultwarden Server
CVE-2026-77987
SSRF (CWE-918) in GitHub Enterprise Server Notebook Viewer
CVE-2026-67615
Java Deserialization Bypass (CWE-502) in openEQUELLA
CVE-2026-88624
Path Traversal (CWE-22) in openCode Worktree.remove
CVE-2026-88419
Unrestricted File Upload (CWE-434) in WuzhiCMS 5.0.0
CVE-2026-88418
CSRF (CWE-352) in CMSimple Admin Content-Saving Workflow
CVE-2026-88416
SQL Injection (CWE-89) in MCMS Custom Model Import Feature
CVE-2026-88344
Out-of-Bounds Read (CWE-22) in flatcc Schema Lexer Bug
CVE-2026-63104
Missing Authorization (CWE-862) in Kaneo Bulk Tasks
CVE-2026-61570
XXE (CWE-611) in MPXJ MerlinReader XML Document Parsing
CVE-2026-47116
Hard-Coded Credentials (CWE-798) in LTSecurity LTK3500SF
CVE-2026-94462
Insecure Direct Object Reference (CWE-639) in Spree
CVE-2026-88415
Stored XSS (CWE-79) in MCMS contentDetails Article Field
CVE-2026-88414
SQL Injection (CWE-89) in MCMS PageAction Endpoint
CVE-2026-77262
Path Traversal (CWE-22) in MCP Atlassian Upload Handler
CVE-2026-77259
Path Traversal (CWE-22) in MCP Atlassian Upload Handler
CVE-2026-77255
Path Traversal (CWE-22) in MCP Atlassian Jira Server
CVE-2026-77254
Missing Authentication (CWE-306) in MCP Atlassian HTTP
CVE-2026-77253
Path Traversal (CWE-22) in MCP Atlassian Upload Tools
CVE-2026-77248
Path Traversal (CWE-22) in MCP Atlassian Upload Handler
CVE-2026-77246
Confused Deputy (CWE-441) in MCP Atlassian Attachments
CVE-2026-57149
Code Injection (CWE-95) in Plone Classic Portlet UI
CVE-2026-37604
IP Spoofing (CWE-444) in pH7Builder Admin Login Controls
CVE-2026-95656
SSRF (CWE-918) in changedetection.io Preview Endpoint Bug
CVE-2026-94384
Missing Authorization (CWE-862) in Amazon Connect Lambda
CVE-2026-83597
Windows Privilege Escalation (CWE-269) in Netdata MSI
CVE-2026-77605
Path Resolution Confusion (CWE-706) in Notepad++ Workspace
CVE-2026-77274
SSRF (CWE-918) in MCP Atlassian URL Validation Flow
CVE-2026-77271
Path Traversal (CWE-22) in MCP Atlassian Attachments
CVE-2026-77261
SSRF (CWE-918) in MCP Atlassian Fetcher Components
CVE-2026-77260
Path Traversal (CWE-22) in MCP Atlassian Uploads
CVE-2026-77258
Path Traversal (CWE-22) in MCP Atlassian Attachments
CVE-2026-77244
Missing Authentication (CWE-287) in MCP Atlassian HTTP
CVE-2026-77243
Authorization Bypass (CWE-862) in MCP Atlassian Tools
CVE-2026-77242
TOCTOU SSRF (CWE-367) in MCP Atlassian URL Validation
CVE-2026-94456
Insecure Randomness (CWE-330) in Postiz OAuth Flows
CVE-2026-94455
Missing Authentication (CWE-306) in Enterprise Provisioning
CVE-2026-86059
Broken Access Control (CWE-862) in Dokploy Platform
CVE-2026-85740
SSRF (CWE-918) in LightRAG Markdown Image URL Parser
CVE-2026-85734
Missing Login Rate Limits (CWE-307) in LightRAG API
CVE-2026-83603
Unsafe Deserialization (CWE-502) in Netdata ndsudo
CVE-2026-83598
Windows Privilege Escalation (CWE-269) in Netdata Agent
CVE-2026-95655
Broken Access Control (CWE-639) in Aureus ChatterPanel
CVE-2026-95654
Authorization Bypass (CWE-863) in Databasement Invites
CVE-2026-75608
Broken Access Control (CWE-863) in Frigate go2rtc API
CVE-2026-75607
Missing Authorization (CWE-862) in Frigate WebSocket
CVE-2026-93088
Unsafe Deserialization (CWE-502) in SGLang Runtime
CVE-2026-79314
Broken Access Control (CWE-284) in x-ui Inbound Data
CVE-2026-65179
Unsafe Deserialization (CWE-502) in NeMo TabularTokenizer
CVE-2026-65178
Unsafe Deserialization (CWE-502) in NVIDIA NeMo Loader
CVE-2026-65130
OS Command Injection (CWE-78) in NVIDIA Infra Controller
CVE-2026-65128
SQL Injection (CWE-89) in NVIDIA Infrastructure Controller
CVE-2026-65121
Improper Authentication (CWE-287) in NVIDIA Infra Controller
CVE-2026-65118
Improper Certificate Checks (CWE-295) in NVIDIA IC
CVE-2026-65114
Missing Authentication (CWE-306) in NVIDIA Controller
CVE-2026-65113
Hard-Coded Credentials (CWE-798) in NVIDIA Linux Controller
CVE-2026-65111
Command Injection (CWE-77) in NVIDIA NeMo Speech API
CVE-2026-24267
Unsafe Deserialization (CWE-502) in NVIDIA NeMo Speech
CVE-2026-24239
Unsafe Deserialization (CWE-502) in NVIDIA NeMo Speech
CVE-2026-95271
Improper Authentication (CWE-287) in changedetection.io
CVE-2026-95511
Privilege Escalation (CWE-269) in CUPS Serial Backend
CVE-2026-94493
Missing Authentication (CWE-306) in Gigatech PDV5701
CVE-2026-93712
Path Traversal (CWE-22) in Dancer2 Static File Handler
CVE-2026-94540
Missing Authentication (CWE-306) in DesktopSMS Service
CVE-2026-94535
Authorization Bypass (CWE-639) in lamp-cloud Notices
CVE-2026-94534
IDOR (CWE-639) in lamp-cloud User Profile Endpoints
CVE-2026-79079
OS Command Injection (CWE-78) in Xiphos Source Components
CVE-2026-78847
Code Injection (CWE-95) in gray-matter JavaScript Engine
CVE-2026-59814
Stored XSS (CWE-79) in Joplin Server Public Shares
CVE-2026-88746
Cross-Site Scripting (CWE-79) in idccms makeDiy_deal
CVE-2026-88410
Missing Authentication (CWE-306) in FalkorDB graph.UDF
CVE-2026-88405
Code Injection (CWE-94) in Univer Remote Register Service
CVE-2026-88404
Code Injection (CWE-94) in Univer Script Execution Service
CVE-2026-88402
SQL Injection (CWE-89) in NocoBase checkSQL Function
CVE-2026-79916
OS Command Injection (CWE-78) in MaxKB AWS Config Files
CVE-2026-79316
Improper Access Control (CWE-284) in x-ui Management Panel
CVE-2026-77523
IDOR (CWE-639) in MaxKB Model Parameter Form API
CVE-2026-77521
OS Command Injection (CWE-78) in MaxKB Shell Sandbox
CVE-2026-67827
Code Injection (CWE-94) in ZLMediaKit HTTP API Endpoint
CVE-2026-55105
Stored XSS (CWE-79) in Joplin Fountain Note Renderer
CVE-2026-49453
Path Traversal (CWE-22) in Joplin Resource Synchronization
CVE-2026-73552
Input Validation (CWE-20) in Envoy HTTP RBAC Matching
CVE-2026-73548
HTTP Request Smuggling (CWE-444) in Envoy Edge Proxy
CVE-2026-73547
Null Pointer Dereference (CWE-476) in Envoy ext_authz
CVE-2026-73546
Stored XSS (CWE-79) in Envoy Admin Stats HTML Endpoint
CVE-2026-73513
Improper Input Validation (CWE-20) in Envoy oghttp2
CVE-2026-55897
Command Injection (CWE-78) in OpenWrt Reboot Web App
CVE-2026-94501
Missing Authorization (CWE-862) in jshERP User CRUD
CVE-2026-94497
Insecure Direct Object Reference (CWE-639) in jshERP
CVE-2026-94496
Missing Authorization (CWE-862) in jshERP Role Endpoints
CVE-2026-94495
Missing Authorization (CWE-862) in jshERP System Config
CVE-2026-94412
Authorization Bypass (CWE-862) in jshERP Password Reset
CVE-2026-94411
Missing Authorization (CWE-862) in jshERP 3.6 Endpoint
CVE-2026-63330
Missing Authorization (CWE-862) in Warpgate Recordings
CVE-2026-58491
Cross-Site Scripting (CWE-79) in Warpgate SSO Endpoint
CVE-2026-94488
Stored Cross-Site Scripting (CWE-79) in Telegram Exporter
CVE-2026-93012
OS Command Injection (CWE-78) in Email::Sender Sendmail
CVE-2026-62369
Path Traversal (CWE-22) in KubeEdge keadm on Windows
CVE-2026-62182
OS Command Injection (CWE-78) in KubeEdge Config Jobs
CVE-2026-48976
Broken Access Control (CWE-639) in HomeBox Notifiers
CVE-2026-48975
Broken Object Level Authorization (CWE-639) in HomeBox
CVE-2026-48826
Broken Access Control (CWE-639) in HomeBox Inventory
CVE-2026-84990
Sensitive Backup Disclosure (CWE-200) in ntopng Web UI
CVE-2026-83621
Missing Authorization (CWE-862) in ntopng Blacklist
CVE-2026-79920
Missing Authorization (CWE-862) in Ajenti Plugin Tasks
CVE-2026-77560
Case-Sensitive Host ACL Bypass (CWE-178) in Tinyauth
CVE-2026-63116
Authorization Bypass (CWE-862) in deepstream Records
CVE-2026-62371
OS Command Injection (CWE-78) in KubeEdge NodeUpgrade
CVE-2026-82412
OS Command Injection (CWE-78) in ntopng Scan Endpoints
CVE-2026-61687
OAuth Session Binding (CWE-384) in Hatchet Platform
CVE-2026-53940
Path Traversal (CWE-22) in Conda Entry-Point Writer
CVE-2026-36469
SSRF (CWE-918) in CuteNews Media Manager Component
CVE-2026-36467
Unrestricted File Upload (CWE-434) in CuteNews Web CMS
CVE-2026-55071
Command Injection (CWE-94) in MCP-for-Stata Server
CVE-2025-71421
Improper Privilege Management (CWE-269) in UVdesk Core
CVE-2026-94144
SQL Injection (CWE-89) in Drogon ORM Criteria Builder
CVE-2026-94143
SQL Injection (CWE-89) in Drogon ORM Mapper::orderBy
CVE-2026-94110
SQL Injection (CWE-89) in QCMS Content Detail Page Route
CVE-2026-94044
Path Traversal (CWE-22) in 03-lovepreetSingh MCP API
CVE-2026-94039
SSRF (CWE-918) in TaxHacker Invoice PDF Renderer Component
CVE-2026-94038
Server-Side Request Forgery (CWE-918) in dim-sum-app Deno
CVE-2026-94015
SQL Injection (CWE-89) in Drug Recommendation edit_user.php
CVE-2026-94106
OS Command Injection (CWE-78) in getID3 Shell Handlers
CVE-2026-94104
Unrestricted File Upload (CWE-434) in NivoCart File Manager
CVE-2026-93997
SQL Injection (CWE-89) in Drug Recommendation System
CVE-2026-93980
SQL Injection (CWE-89) in Internship Admin Login Form
CVE-2026-93979
SQL Injection (CWE-89) in Code-Projects Employer Login
CVE-2026-93978
SQL Injection (CWE-89) in Internship Management System
CVE-2026-93974
SQL Injection (CWE-89) in Online Reviewer Databank Handler
CVE-2026-93973
SQL Injection (CWE-89) in Online Reviewer System Application
CVE-2026-93972
SQL Injection (CWE-89) in SourceCodester Reviewer System
CVE-2026-93970
Hard-Coded Credentials (CWE-798) in SxDevOps Settings
CVE-2026-93969
Hard-Coded Credentials (CWE-259) in SxDevOps RBAC Service
CVE-2026-93959
SQL Injection (CWE-89) in Reviewer Management System
CVE-2026-93958
OS Command Injection (CWE-78) in D-Link R95 DHMAPI
CVE-2026-93992
Path Traversal (CWE-22) in Gopeed Archive Extractor
CVE-2026-93991
Authorization Bypass (CWE-639) in Argo Workflows API
CVE-2026-93985
Code Injection (CWE-94) in OpenPanel Webhooks Validator
CVE-2026-93742
OS Command Injection (CWE-77) in Totolink formWsc
CVE-2026-93923
Stored XSS (CWE-79) in SiYuan Outline Dock Renderer
CVE-2026-93922
Stored XSS (CWE-79) in SiYuan Daily Note Picker Dialog
CVE-2026-68928
Exposed Android Service (CWE-926) in Acode Terminal
CVE-2026-93872
Unsafe Deserialization (CWE-502) in Cotonti Comments
CVE-2026-93839
Authentication Bypass (CWE-306) in LightLLM WebSocket
CVE-2026-92708
Information Disclosure (CWE-200) in Svelte devalue
CVE-2026-61821
Missing Authorization (CWE-862) in pg_partman PostgreSQL
CVE-2026-61820
SQL Injection (CWE-89) in pg_partman Background Worker
CVE-2026-61819
SQL Injection (CWE-89) in pg_partman Job Monitoring
CVE-2026-61818
SQL Injection (CWE-89) in pg_partman undo_partition
CVE-2026-61817
SQL Injection (CWE-89) in pg_partman SQL Functions API
CVE-2026-61781
SQL Injection (CWE-89) in pg_partman Partitioning Extension
CVE-2017-20284
Path Traversal (CWE-22) in Caucho Resin resin-doc
CVE-2021-48008
SQL Injection (CWE-89) in Chanjet CRM Webservice Endpoint
CVE-2019-25776
SQL Injection (CWE-89) in Weaver E-cology Mobile API
CVE-2026-91127
Stored XSS (CWE-79) in File Viewer DOC Renderer Module
CVE-2026-85058
Authorization Bypass (CWE-862) in Moquette MQTT Broker
CVE-2026-84975
TLS Certificate Validation Bypass (CWE-295) in PJSIP
CVE-2026-81180
Code Injection (CWE-20) in SysReptor Professional App
CVE-2026-62279
Authorization Bypass (CWE-639) in LubeLogger Records
CVE-2026-62278
Path Traversal (CWE-22) in LubeLogger File Upload
CVE-2026-61552
Code Injection (CWE-94) in Icinga 2 Objects API Endpoint
CVE-2026-61550
Missing Authorization (CWE-862) in Icinga 2 Node Agent
CVE-2025-66455
Unsafe Deserialization (CWE-502) in LMDeploy DistServe
CVE-2026-93559
Missing Authentication (CWE-306) in Jellyfish FastAPI
CVE-2026-77240
Authorization Bypass (CWE-639) in WACRM Supabase DB
CVE-2026-77239
Improper Authorization (CWE-285) in WACRM CRM Flows
CVE-2026-61833
Authorization Bypass (CWE-285) in zot Artifact Registry
CVE-2026-61672
Case-Sensitive Filter Bypass (CWE-697) in Capsule K8s
CVE-2026-58197
Improper Access Control (CWE-284) in ToolHive MCP Servers
CVE-2026-88259
Missing Authentication (CWE-306) in CareCam CM2507
CVE-2026-86520
Hardcoded Credentials (CWE-798) in Bransys ELD Platform
CVE-2026-75031
Code Injection (CWE-94) in Interchange Quick Question
CVE-2025-61682
Stored XSS (CWE-79) in Semantic MediaWiki Extension
CVE-2025-53837
Code Injection (CWE-95) in the XWiki Rendering Engine
CVE-2026-93659
Stored XSS (CWE-79) in Concrete CMS Checkout Views
CVE-2026-77929
Unrestricted File Upload (CWE-434) in ClipBucket v5
CVE-2026-93604
Sandbox Escape (CWE-284) in vm2 Node.js Crypto Module
CVE-2026-93603
Sandbox Escape (CWE-94) in vm2 JavaScript Bridge Trap
CVE-2026-93597
SSRF (CWE-918) in ArcadeDB IPv6 Transition Guard Logic
CVE-2026-93594
Authorization Bypass (CWE-863) in ArcadeDB Database Engine
CVE-2026-93593
Broken Access Control (CWE-863) in ArcadeDB TimeSeries
CVE-2026-93591
SQL Injection (CWE-89) in SiYuan Graph Query Endpoint
CVE-2026-88622
Command Injection (CWE-77) in NUUO Privilege Import
CVE-2026-75157
Incorrect Authorization (CWE-863) in Airflow Asset API
CVE-2026-93371
Command Injection (CWE-77) in yt-dlp-web-ui Generic Download
CVE-2026-93456
CSRF (CWE-352) in django-page-cms Admin Mutation Views
CVE-2026-93426
SQL Injection (CWE-89) in SigNoz v5 Query Range API
CVE-2026-54767
Missing Authentication (CWE-306) in WeGIA Deletion
CVE-2026-54734
SSRF (CWE-918) in Prebid Server Java Bidder Adapter Requests
CVE-2026-54671
Broken Object Authorization (CWE-639) in WeGIA Interno
CVE-2026-54670
Path Traversal (CWE-22) in WeGIA Contribution Controller
CVE-2026-54647
SQL Injection (CWE-89) in CubeCart Admin Settings Page
CVE-2026-54646
SQL Injection (CWE-89) in CubeCart Admin Maintenance
CVE-2026-54612
Path Traversal (CWE-22) in Vvveb Editor File Handling
CVE-2026-54520
Path Traversal (CWE-22) in AI Agent Automation Backend
CVE-2026-54519
Broken Access Control (CWE-862) in AI Agent Memory
CVE-2026-54506
Stored XSS (CWE-79) in Vvveb User Profile Component
CVE-2026-50158
Unrestricted File Write (CWE-73) in yutu Caption Tool
CVE-2026-77615
Cross-Site Scripting (CWE-79) in Paella Player Web UI
CVE-2026-54597
Time-Based SQL Injection (CWE-89) in ITFlow Sharing
CVE-2026-54596
SQL Injection (CWE-89) in ITFlow Recurring Invoices
CVE-2026-54510
CSRF Bypass (CWE-352) in Speakr Web Application Routes
CVE-2026-54460
Missing Authentication (CWE-306) in OpenReception Passkeys
CVE-2026-54354
SQL Injection (CWE-89) in MapServer PostGIS Filters
CVE-2026-54339
Server-Side Request Forgery (CWE-918) in Glean RSS Tool
CVE-2026-52483
OS Command Injection (CWE-78) in MitraStar Router API
CVE-2026-45143
Stored XSS (CWE-79) in Chamilo LMS Message Inbox
CVE-2026-45140
Remote Code Execution (CWE-94) in Chamilo LMS Server
CVE-2025-55787
SQL Injection (CWE-89) in MailData Archiving System
CVE-2026-54752
Pickle Deserialization (CWE-502) in NetBox DTL Tests
CVE-2026-54618
Missing Authentication (CWE-306) in Obsidian Web MCP
CVE-2026-45726
Sensitive Data Exposure (CWE-200) in Omni Resources
CVE-2026-54617
Path Traversal (CWE-22) in GravitLauncher File Server
CVE-2026-54504
Unauthenticated API (CWE-306) in MCP Document Server
CVE-2026-54253
Reflected XSS (CWE-79) in TS3 Manager Download API
CVE-2026-54239
CBC Token Tampering (CWE-345) in FaustWP WordPress Plugin
CVE-2026-52851
SQL Injection (CWE-89) in Traccar Permissions API Endpoint
CVE-2026-47252
Code Injection (CWE-94) in Anyquery macOS SQL Plugins
CVE-2026-92926
SQL Injection (CWE-89) in Matrimonial System Preferences
CVE-2026-54446
Missing Authentication (CWE-306) in NetLicensing MCP
CVE-2026-54053
Path Traversal (CWE-22) in Many Notes ZIP Vault Import
CVE-2026-93292
SQL Injection (CWE-89) in SigNoz Trace-Funnel API Endpoints
CVE-2026-92980
Unrestricted Upload (CWE-434) in HortusFox-Web Import
CVE-2026-93014
Path Traversal (CWE-22) in RosarioSIS File Handling
CVE-2026-86864
Argument Injection (CWE-88) in pgAdmin 4 Backup Tool
CVE-2026-85719
Proxy Credential Exposure (CWE-319) in AsyncHttpClient
CVE-2026-76834
Unsafe Deserialization (CWE-502) in b2evolution CMS
CVE-2026-92986
Stored XSS (CWE-79) in SiYuan Backlink Dock Tree UI
CVE-2026-92985
Stored XSS (CWE-79) in SiYuan Bookmark Dock Tree UI
CVE-2026-92984
Session Fixation (CWE-384) in HUBzero CMS Web Platform
CVE-2026-85077
HTTP Response Splitting (CWE-113) in Sanic Framework
CVE-2026-77614
Session Fixation (CWE-384) in Opencast Default Auth
CVE-2026-63472
Improper Authentication (CWE-287) in Vendure External Auth
CVE-2026-63459
Stored XSS (CWE-79) in Vendure RichTextDescriptionCell
CVE-2026-92972
Missing Authentication (CWE-306) in SGLang Routing
CVE-2026-92970
Path Traversal (CWE-22) in HUBzero CMS File Uploads
CVE-2026-92960
Information Exposure (CWE-200) in vm2 Node Sandbox
CVE-2026-92958
Builtin Denylist Bypass (CWE-269) in vm2 NodeVM Sandbox
CVE-2026-92957
NodeVM Builtin Deny-List Bypass (CWE-269) in vm2 Sandbox
CVE-2026-92947
Information Disclosure (CWE-200) in vm2 Buffer Pool
CVE-2026-92937
Sandbox Escape (CWE-94) in vm2 Node.js Runtime Host
CVE-2026-92919
Path Traversal (CWE-22) in admin3 File Upload Handler
CVE-2026-92917
Information Disclosure (CWE-200) in Grav Twig Sandbox
CVE-2026-92916
Information Exposure (CWE-200) in Grav Clockwork Profiler
CVE-2026-92914
Authentication Bypass (CWE-287) in AVideo LoginControl
CVE-2026-92913
Weak PRNG (CWE-330) in AVideo Account Activation Codes
CVE-2026-92860
Improper Input Validation (CWE-20) in Pulse Quick Setup
CVE-2026-92903
SQL Injection (CWE-89) in Snowflake CLI Automation
CVE-2026-78428
Session Fixation (CWE-384) in SAML/OIDC SSO Login Flow
CVE-2026-86320
Code Injection (CWE-94) in flatpak-builder Git Hooks
CVE-2026-65388
Open Redirect (CWE-601) in Containerization Registry Client
CVE-2026-61596
IDOR (CWE-639) in djust Object-Scoped View Rendering
CVE-2026-92594
Information Disclosure (CWE-200) in Craft CMS GraphQL
CVE-2026-92593
Server-Side Template Injection (CWE-94) in Craft CMS
CVE-2026-92582
Cross-Site Request Forgery (CWE-352) in AVideo API
CVE-2026-92580
OS Command Injection (CWE-78) in AVideo CloneSite Plugin
CVE-2026-92578
Authentication Bypass (CWE-287) in WWBN AVideo Login
CVE-2026-92577
Broken Access Control (CWE-639) in AVideo API Endpoint
CVE-2026-92576
SSRF (CWE-918) in HKUDS nanobot WebFetchTool Component
CVE-2026-61594
Missing Authorization (CWE-862) in djust WebSockets
CVE-2026-61592
Session Hijacking (CWE-384) in djust SSE Transport
CVE-2026-92816
Path Traversal (CWE-22) in ComfyUI Dataset Save Nodes
CVE-2026-92815
SSRF (CWE-918) in changedetection.io Browser Steps
CVE-2026-92812
Path Traversal (CWE-22) in Decap CMS Local Proxy
CVE-2026-92806
CSRF (CWE-352) in phpList Mass Subscriber Removal Handler
CVE-2026-92805
Missing Authentication (CWE-306) in UVdesk Wizard Endpoints
CVE-2026-92804
Server-Side Request Forgery (CWE-918) in Nango Platform
CVE-2026-92801
Authorization Bypass (CWE-863) in cc-connect Feishu
CVE-2026-92796
Improper Authorization (CWE-863) in Manticore Search SQL
CVE-2026-92794
Missing Authorization (CWE-862) in OpenSign Documents
CVE-2026-92793
Authorization Bypass (CWE-863) in GoAdmin Logout Check
CVE-2026-92792
Authentication Bypass (CWE-287) in OpenNHP Attestation
CVE-2026-92791
Path Traversal (CWE-22) in Uber Kraken Tags Endpoint
CVE-2026-92788
Improper Authorization (CWE-863) in Coze Studio SQL
CVE-2026-92787
JWT Signature Bypass (CWE-798) in Feast Authorization
CVE-2026-92785
Unsafe Deserialization (CWE-502) in Angel Master RPC
CVE-2026-92784
Code Injection (CWE-94) in Refine Inferencer Component
CVE-2026-92783
Broken Access Control (CWE-862) in Yeti RBAC Deletion
CVE-2026-92782
Incorrect Authorization (CWE-863) in Chroma Collections
CVE-2026-92780
Missing Authorization (CWE-862) in KnowStreaming APIs
CVE-2026-92776
Broken Access Control (CWE-863) in Wiki.js Page Rules
CVE-2026-92773
Authorization Bypass (CWE-639) in Trigger.dev GitHub App
CVE-2026-92772
Authorization Bypass (CWE-862) in Leantime HTMX Plugin
CVE-2026-92763
Improper Authorization (CWE-862) in Rundeck Import
CVE-2026-92762
Missing Authorization (CWE-862) in Pelican Panel Startup
CVE-2026-92761
Broken Access Control (CWE-862) in WebVirtCloud Panel
CVE-2026-92753
Authorization Bypass (CWE-862) in PatrowlManager APIs
CVE-2026-92752
IDOR (CWE-639) in metasfresh Attachments and Comments
CVE-2026-92751
CSRF (CWE-352) in CMAK Kafka Cluster Admin Web Console
CVE-2026-92748
Path Traversal (CWE-22) in Empire Upload Endpoints
CVE-2026-75513
SQL Injection (CWE-89) in Marten LINQ/Tenant Filters
CVE-2026-63506
Authorization Bypass (CWE-639) in Tina CMS Auth Provider
CVE-2025-56563
SSRF (CWE-918) in Zenith Satellite Tracker sat_proxy.php
CVE-2026-92729
Missing Authentication (CWE-306) in SigNoz Trace API
CVE-2026-86043
Incorrect Authorization (CWE-863) in Skipper OPA Filter
CVE-2026-81876
Infinite Loop (CWE-835) in HAPI FHIR Java SHCParser
CVE-2026-81875
Resource Exhaustion (CWE-400) in HAPI FHIR SHCParser
CVE-2026-63325
Code Injection (CWE-94) in Redocly CLI Respect Command
CVE-2026-92720
Missing Authentication (CWE-306) in Kubero Notifications
CVE-2026-92719
SSRF (CWE-918) in Quickwit SQS File Source API Endpoint
CVE-2026-92717
Missing Authentication (CWE-306) in Covenant SignalR Hub
CVE-2026-92716
Cross-Tenant IDOR (CWE-639) in Shuffle API Endpoint
CVE-2026-92604
Path Traversal (CWE-22) in Scirius PCAP Upload Endpoint
CVE-2026-92406
SQL Injection (CWE-89) in SourceCodester Inventory System
CVE-2026-47094
IDOR (CWE-639) in SIMAC MyPHR Employee Records Endpoint
CVE-2026-92602
SSRF (CWE-918) in TDuck Survey Webhook Controller
CVE-2026-92405
SQL Injection (CWE-89) in SourceCodester Inventory
CVE-2026-92401
Improper Authentication (CWE-287) in ChangeWeDer CRM
CVE-2026-92398
OS Command Injection (CWE-78) in Ruijie RG-EW3000GX
CVE-2026-85756
OS Command Injection (CWE-78) in SSH.NET ScpClient
CVE-2026-85731
Path Traversal (CWE-22) in oras-go OCI Layer Extraction
CVE-2026-59974
Path Traversal (CWE-22) in Stanza Archive Extraction
CVE-2026-92397
OS Command Injection (CWE-78) in Ruijie RG-EW3000GX
CVE-2026-61595
Cross-Tenant Authorization (CWE-862) in djust LiveView
CVE-2026-61593
Cross-Site Request Forgery (CWE-352) in djust SSE Endpoints
CVE-2025-59953
Unsafe Deserialization (CWE-502) in LMDeploy RPC Server
CVE-2026-92566
SSRF (CWE-918) in DataGear HTTP Preview API Endpoint
CVE-2026-92380
Server-Side Request Forgery (CWE-918) in WuzhiCMS Remote
CVE-2026-92366
SQL Injection (CWE-89) in Matrimonial System Search
CVE-2026-92087
Authorization Bypass (CWE-285) in Fastify Auth Plugin
CVE-2026-88064
Improper Input Validation (CWE-20) in Backstage TechDocs
CVE-2026-82964
Permission Escalation (CWE-281) in Avast Sandbox Driver
CVE-2026-76825
Sandbox Escape (CWE-693) in RestrictedPython Formatter
CVE-2026-63671
Cross-Site Scripting (CWE-79) in Nuxt MDC Sanitizer
CVE-2026-92469
Authorization Bypass (CWE-639) in File-Center Module zlt2000
CVE-2026-92466
Missing Authorization (CWE-862) in ZLT Microservices
CVE-2026-61590
Missing Authentication (CWE-306) in djust Observability
CVE-2026-92456
Missing Authorization (CWE-862) in yshop-crm Redis
CVE-2026-76187
Improper Authentication (CWE-287) in Airflow Keycloak
CVE-2026-92299
Missing Authorization (CWE-862) in Jitsi Electron SDK
CVE-2026-92215
Server-Side Request Forgery (CWE-918) in A2UI FileResolver
CVE-2026-76856
CSRF (CWE-352) in Netcore NR255-V Management Firmware
CVE-2026-73807
Missing Authorization (CWE-862) in mySCADA myPRO API
CVE-2026-61560
Path Traversal (CWE-22) in @zereight MCP GitLab Server
CVE-2026-10144
Command Injection (CWE-78) in Rsbuild Browser Open
CVE-2026-91939
PHP Object Injection (CWE-502) in Cotonti Comments Plugin
CVE-2026-88065
Broken Access Control (CWE-639) in tts-be API Endpoints
CVE-2026-68950
Hard-Coded Credentials (CWE-798) in Root FTP Service
CVE-2026-68070
Missing Authentication (CWE-306) in Affected Products
CVE-2026-66890
Hard-Coded Credentials (CWE-798) in Affected FTP Services
CVE-2026-66887
Missing Authorization (CWE-862) in Affected Product CGIs
CVE-2026-61559
SSRF (CWE-918) in @zereight/mcp-gitlab API Service
CVE-2026-54544
Server-Side Request Forgery (CWE-918) in Fireshare APIs
CVE-2026-89040
Path Traversal (CWE-22) in Tencent MSEC Platform
CVE-2026-76820
Server-Side Request Forgery (CWE-918) in OpenCTI Sync
CVE-2026-69217
HTTP Request Smuggling (CWE-444) in Http4s Ember Parser
CVE-2026-69205
HTTP Request Smuggling (CWE-444) in Http4s Ember Parser
CVE-2026-79411
Improper Privilege Management (CWE-269) in Bagisto
CVE-2026-79410
Improper Input Validation (CWE-20) in Bagisto Cart Path
CVE-2026-61668
Improper Certificate Validation (CWE-295) in DIRAC Pilot
CVE-2026-61667
SQL Injection (CWE-89) in DIRAC Dataset Manager Service
CVE-2026-58485
SSRF (CWE-918) in mcp-searxng URL Reader Component
CVE-2026-56829
Missing Authorization (CWE-862) in Shopper Admin Panel
CVE-2026-56827
Broken Access Control (CWE-862) in Shopper Admin Panel
CVE-2026-56825
Missing Authorization (CWE-862) in Shopper Admin Panel
CVE-2026-55225
Kubernetes Privilege Escalation (CWE-269) in Strimzi
CVE-2026-54549
SSRF (CWE-918) in Meta Ads MCP Image Upload Server
CVE-2026-54547
Authentication Bypass (CWE-287) in Meta Ads MCP Server
CVE-2026-52484
Command Injection (CWE-78) in MitraStar GPT-2742GX4X5
CVE-2026-45579
Code Injection (CWE-95) in DIRAC Request Counter API
CVE-2025-66974
Improper Input Validation (CWE-20) in Prolink Smart Plug
CVE-2026-91853
OS Command Injection (CWE-78) in TOTOLINK X5000R OVPN
CVE-2026-63443
SSRF (CWE-918) in Coder Agent Connection API Client
CVE-2026-59160
Missing Authentication (CWE-306) in Yeger turbo-graph
CVE-2026-55692
Stored XSS (CWE-79) in MediaWiki EmbedVideo Extension
CVE-2026-55691
Stored XSS (CWE-79) in MediaWiki EmbedVideo Extension
CVE-2026-55690
Stored XSS (CWE-79) in MediaWiki EmbedVideo Extension
CVE-2026-53710
Code Injection (CWE-94) in Context Forge Python Sandbox
CVE-2026-91989
Path Traversal (CWE-22) in Atomic Agents Dashboard
CVE-2026-91988
Cleartext HTTP (CWE-319) in Atomic Agents MCP Registry
CVE-2026-91985
Sensitive Data Exposure (CWE-200) in Vikunja Shares
CVE-2026-91973
Brute-Force Protection Bypass (CWE-307) in Vikunja CalDAV
CVE-2026-91972
Missing Rate Limiting (CWE-307) in Vikunja Auth API
CVE-2026-91965
Information Exposure (CWE-200) in WWBN AVideo Live
CVE-2026-91943
Server-Side Request Forgery (CWE-918) in Crawl4AI PDF
CVE-2026-91940
Arbitrary File Write (CWE-22) in crawl4ai PDF Strategy
CVE-2026-91938
Server-Side Request Forgery (CWE-918) in Flowise Loaders
CVE-2026-91935
SSRF (CWE-918) in Flowise Chat-Model Node Requests
CVE-2026-91934
Path Traversal (CWE-22) in Flowise SQLite Chain Node
CVE-2026-91933
Broken Access Control (CWE-639) in Flowise Realtime
CVE-2026-91932
Input Validation Bypass (CWE-20) in Flowise MCP Server
CVE-2026-91931
OS Command Injection (CWE-78) in Flowise Custom MCP
CVE-2026-91929
Broken Access Control (CWE-862) in Flowise Enterprise
CVE-2026-91848
SQL Injection (CWE-89) in WuzhiCMS Article Data API
CVE-2026-88619
Missing Authorization (CWE-862) in SmartAdmin Jobs
CVE-2026-85013
OS Command Injection (CWE-78) in environment-modules
CVE-2026-65831
Authorization Bypass (CWE-863) in ArcadeDB JS API Endpoint
CVE-2026-59973
Server-Side Request Forgery (CWE-918) in FrontMCP Adapter
CVE-2026-59965
Authorization Bypass (CWE-863) in Payload Alt-Text Plugin
CVE-2026-54077
SSRF (CWE-918) in ArcadeDB IMPORT DATABASE Handler
CVE-2026-54076
Improper Authorization (CWE-862) in ArcadeDB Schema
CVE-2026-37152
Hardcoded Password (CWE-798) in TOTOLINK X5000R Router
CVE-2024-14029
HTTP Request Smuggling (CWE-444) in Tornado Server
CVE-2023-54397
HTTP Request Smuggling (CWE-444) in Tornado Web Server
CVE-2026-88617
Authorization Bypass (CWE-863) in SmartAdmin Config
CVE-2026-88616
Improper Authorization (CWE-863) in RuoYi-Vue-Plus Workflow
CVE-2026-79425
Server-Side Request Forgery (CWE-918) in CRMEB Upload
CVE-2026-79303
SQL Injection (CWE-89) in Kaiten Database SQL Queries
CVE-2026-59971
Unauthenticated SQL Access (CWE-306) in MySQL MCP Server
CVE-2026-57586
OS Command Injection (CWE-78) in CodeRAG Gradle Sync
CVE-2026-55178
Broken Access Control (CWE-862) in GeoLens Data APIs
CVE-2026-55158
OS Command Injection (CWE-78) in Conflibot Workflows
CVE-2026-53957
Server-Side Request Forgery (CWE-918) in Contentful MCP
CVE-2026-91998
Authorization Bypass (CWE-863) in Casdoor MCP API Endpoint
CVE-2026-91996
Missing Authentication (CWE-306) in lamp-cloud Anno API
CVE-2026-91924
Missing Authorization (CWE-862) in pgweb Connect API
CVE-2026-91923
SSRF (CWE-918) in KubeSphere Git Credential Endpoint
CVE-2026-57148
Hardcoded JWT Secret (CWE-798) in PraisonAI Platform
CVE-2026-57147
Hard-Coded JWT Secret (CWE-798) in PraisonAI Platform
CVE-2026-57141
JavaScript Code Injection (CWE-94) in PraisonAI Code Mode
CVE-2026-57140
Missing Authentication (CWE-306) in PraisonAI AgentOS
CVE-2026-57139
Unauthenticated MCP Access (CWE-306) in PraisonAI TS
CVE-2026-57137
Authorization Bypass (CWE-862) in PraisonAI Agent Loop
CVE-2026-57136
OS Command Injection (CWE-78) in PraisonAI Sandbox
CVE-2026-57134
Improper Authentication (CWE-287) in PraisonAI MCP
CVE-2026-57133
OS Command Injection (CWE-78) in PraisonAI shell()
CVE-2026-57112
Missing Authentication (CWE-306) in PraisonAI SSE Server
CVE-2026-62379
Arbitrary Class Instantiation (CWE-470) in OpenAM Auth
CVE-2026-45048
Broken Access Control (CWE-285) in OpenAM Sessions
CVE-2026-91004
SQL Injection (CWE-89) in Online Faculty Clearance
CVE-2026-90880
OS Command Injection (CWE-77) in D-Link DSL-3782 Router
CVE-2026-90879
SQL Injection (CWE-89) in FilePress Publish Module
CVE-2026-90877
SQL Injection (CWE-89) in Faculty Clearance System
CVE-2026-90876
SQL Injection (CWE-89) in Online Faculty Clearance System
CVE-2026-90858
Authorization Bypass (CWE-285) in Online Clinic System
CVE-2026-90856
Improper Privilege Management (CWE-266) in College Signup Flow
CVE-2026-91771
Path Traversal (CWE-22) in Weights & Biases wandb
CVE-2026-90849
SQL Injection (CWE-89) in College Notes Gallery System
CVE-2026-91751
Path Traversal (CWE-22) in Flextype Entries REST API
CVE-2026-90846
SQL Injection (CWE-89) in PHPGurukul Expense Tracker
CVE-2026-90844
SQL Injection (CWE-89) in PHPGurukul Daily Login Form
CVE-2026-90843
OS Command Injection (CWE-78) in WebMap Nmap Scan Handler
CVE-2026-90841
SQL Injection (CWE-89) in PHPGurukul Report Endpoint
CVE-2026-90840
Improper Authentication (CWE-287) in PHPGurukul Admin
CVE-2026-91200
Path Traversal (CWE-22) in DevSpace Sync Stream Handler
CVE-2026-91144
Authorization Bypass (CWE-639) in ZFile Download Endpoint
CVE-2026-90819
HTTP Response Splitting (CWE-93) in A2A Java Server
CVE-2026-53714
Missing Authentication (CWE-306) in Envoy Gateway xDS
CVE-2026-53713
Path Validation Bypass (CWE-20) in Envoy Gateway Lua
CVE-2026-82028
SQL Injection (CWE-89) in Magistrala Reader Services
CVE-2026-73496
Path Traversal (CWE-22) in MCP Atlassian Uploads
CVE-2026-54632
Malformed Packet Handling (CWE-20) in SIPSorcery RTP
CVE-2026-54629
Path Traversal (CWE-22) in Anyquery SQLite Server Port
CVE-2026-54628
Server-Side Request Forgery (CWE-918) in Anyquery Server
CVE-2026-50006
Path Traversal (CWE-22) in Anyquery MySQL-Compatible Server
CVE-2026-47253
Path Traversal (CWE-22) in Anyquery Plugin Cache API
CVE-2026-19816
Authorization Bypass (CWE-863) in PackageKit dnf5 Backend
CVE-2026-90809
Argument Injection (CWE-88) in nanobot Shell ExecTool
CVE-2026-82035
Path Traversal (CWE-22) in PyMuPDF Object Extraction
CVE-2026-59178
Missing Authentication (CWE-306) in ESPHome Dashboard
CVE-2026-91079
Server-Side Request Forgery (CWE-918) in Huly Print Service
CVE-2026-90946
Path Traversal (CWE-73) in DeepWiki-Open WebSocket Endpoint
CVE-2026-90944
Missing Authentication (CWE-306) in Krayin CRM Inbound
CVE-2026-90942
Authorization Bypass (CWE-863) in Casdoor Certificates
CVE-2026-90805
SQL Injection (CWE-89) in Online Clinic doctorlogin.php
CVE-2026-73494
HTTP Request Smuggling (CWE-444) in Blaze HTTP Parser
CVE-2026-54567
Case-Sensitive Extension Bypass (CWE-178) in Flask-Reuploaded
CVE-2026-54182
OS Command Injection (CWE-78) in Backpack CRUD Stats
CVE-2026-54180
Authorization Bypass (CWE-639) in Backpack CRUD Panel
CVE-2026-54178
Path Traversal (CWE-22) in Backpack CRUD Upload Handlers
CVE-2026-54087
Stored XSS (CWE-79) in EasyAdmin File/Image Uploads
CVE-2026-61701
Unsafe Deserialization (CWE-502) in Laravel MagicLink
CVE-2026-59960
OS Command Injection (CWE-78) in Argos SDK CI Runner
CVE-2026-57579
Missing Authorization (CWE-862) in Alchemy CMS API
CVE-2026-55416
SQL Injection (CWE-89) in Pimcore Custom Reports Adapter
CVE-2026-55072
SQL Injection (CWE-89) in Pimcore ClassDefinition Model
CVE-2026-90943
Stored XSS (CWE-79) in Filament Comments Extension
CVE-2026-57145
Path Traversal (CWE-22) in PraisonAI MultiEdit Tool
CVE-2026-57132
Authentication Bypass (CWE-287) in PraisonAI Agents
CVE-2026-57131
Missing Authentication (CWE-306) in PraisonAI Jobs API
CVE-2026-57127
Missing Authentication (CWE-306) in PraisonAI Recipes
CVE-2026-57124
OS Command Injection (CWE-78) in PraisonAI UI Host
CVE-2026-57119
Path Traversal (CWE-22) in PraisonAI Jobs API Server
CVE-2026-56839
Path Traversal (CWE-22) in PraisonAI CODE_TOOLS Wrappers
CVE-2026-47701
Credential Disclosure (CWE-200) in OpenTelemetry Operator
CVE-2026-90789
SQL Injection (CWE-89) in Leave Management login.php
CVE-2026-57130
IMAP Command Injection (CWE-77) in PraisonAI Email Tools
CVE-2026-57129
Path Traversal (CWE-22) in PraisonAI MentionsParser
CVE-2026-57126
SSRF (CWE-918) in PraisonAI SpiderTools URL Fetching
CVE-2026-57125
Missing Authentication (CWE-306) in PraisonAI Runs API
CVE-2026-57123
Missing Authentication (CWE-306) in PraisonAI MCP Server
CVE-2026-90787
Improper Privilege Management (CWE-269) in Soarkey
CVE-2026-90938
Missing Authentication (CWE-306) in LangBot Plugin WS
CVE-2026-90933
Missing Authorization (CWE-862) in Laradashboard API
CVE-2026-90932
Path Traversal (CWE-73) in LaraDashboard Core Upgrade
CVE-2026-90929
Incorrect Authorization (CWE-863) in File Browser Upload
CVE-2026-78299
Path Traversal (CWE-22) in Eclipse Embedded CDT CMSIS
CVE-2026-90919
Unsafe Deserialization (CWE-502) in LightLLM Config Server
CVE-2026-90898
Unauthenticated Command Execution (CWE-306) in Bifrost MCP
CVE-2026-90708
SQL Injection (CWE-89) in Yot CMS Cookie Handler Login
CVE-2026-90703
OS Command Injection (CWE-78) in D-Link DWR-M921 Router
CVE-2026-90702
OS Command Injection (CWE-78) in D-Link DWR-M921 Router
CVE-2026-90701
SQL Injection (CWE-89) in Online Clinic listdoctor.php
CVE-2026-90699
OS Command Injection (CWE-78) in D-Link DWR-M920 Router
CVE-2026-90691
Path Traversal (CWE-22) in HexStrike AI Files Endpoint
CVE-2026-90690
OS Command Injection (CWE-78) in HexStrike AI API
CVE-2026-90620
Missing Authentication (CWE-306) in HexStrike API Endpoint
CVE-2026-90619
OS Command Injection (CWE-78) in HexStrike Execute
CVE-2026-90618
OS Command Injection (CWE-78) in PentestAgent Runtime
CVE-2026-90617
OS Command Injection (CWE-78) in PentestAgent MCP HTTP
CVE-2026-31278
Cleartext Credential Exposure (CWE-319) in BioStar
CVE-2026-90603
Unrestricted Upload (CWE-434) in Open-Generative-AI
CVE-2026-90601
Improper Authentication (CWE-287) in Graphiti REST API
CVE-2026-90579
Missing Authentication (CWE-287) in Cheshire Cat AI
CVE-2026-90566
Improper Authorization (CWE-266) in Rizwan17 Registration
CVE-2026-90526
SQL Injection (CWE-89) in School Registration System
CVE-2026-90524
Missing Authentication (CWE-287) in Tourism System
CVE-2026-90523
Improper Privilege Management (CWE-266) in Tourism System
CVE-2026-90777
Unsafe Deserialization (CWE-502) in ESPnet Checkpoints
CVE-2026-90516
SQL Injection (CWE-89) in SourceCodester School Fee System
CVE-2026-90515
SQL Injection (CWE-89) in School Registration delete
CVE-2026-90774
Path Traversal (CWE-22) in Rustypaste Upload Handler
CVE-2026-90772
Stored XSS (CWE-79) in Amundsen Frontend Search UI
CVE-2026-90770
OS Command Injection (CWE-78) in Spug Monitor API Endpoint
CVE-2026-90769
Server-Side Request Forgery (CWE-918) in Open Notebook
CVE-2026-90768
Authorization Bypass (CWE-862) in CAPEv2 REST API Endpoints
CVE-2026-90561
Stored XSS (CWE-79) in Strapi WYSIWYG Preview Component
CVE-2026-90514
SQL Injection (CWE-89) in School Registration System
CVE-2026-90509
Hard-Coded Credentials (CWE-259) in Orion Visor API
CVE-2026-90504
Missing Authentication (CWE-287) in WARP-Clash-API
CVE-2026-90493
Improper Access Control (CWE-284) in IDM Kernel Driver
CVE-2026-90651
Improper Certificate Validation (CWE-295) in Socket Firewall
CVE-2026-90553
Code Injection (CWE-94) in vLLM Processor Loading
CVE-2026-90537
Missing Authorization (CWE-862) in AVideo Scheduler
CVE-2026-90535
Missing Authorization (CWE-862) in Flowise TTS Endpoint
CVE-2026-90444
OS Command Injection (CWE-78) in File Transfer Interface
CVE-2026-49846
Path Traversal (CWE-22) in libks HTTP Request URI Parser
CVE-2026-54166
Server-Side Request Forgery (CWE-918) in Shelf Import
CVE-2026-49464
Broken Object Authorization (CWE-639) in NL Portal Taak
CVE-2026-53952
Broken Access Control (CWE-285) in GetSimple CMS Setup
CVE-2026-52630
SQL Injection (CWE-89) in Woltlab WCF User Action API
CVE-2026-79396
Hardcoded Credentials (CWE-798) in Xiongmai IP Camera
CVE-2026-79395
Authentication Bypass (CWE-287) in XM530 IP Cameras
CVE-2026-79362
PHP Code Injection (CWE-94) in WoltLab Cache Files
CVE-2026-54072
Open Redirect (CWE-601) in Authorizer /authorize Endpoint
CVE-2026-89262
Authorization Bypass (CWE-639) in MoguBlog Comments API
CVE-2026-89260
XML External Entity (CWE-611) in MoguBlog WeChat Handler
CVE-2026-89066
OS Command Injection (CWE-78) in projen Task Synthesis
CVE-2026-89065
Path Traversal (CWE-23) in Projen Manifest Cleanup Logic
CVE-2026-89013
Authorization Bypass (CWE-863) in Dolibarr Storage
CVE-2026-89010
OS Command Injection (CWE-78) in WAVLINK WN535M1/M3
CVE-2026-82583
SQL Injection (CWE-89) in NextGen Connect Database API
CVE-2026-82578
XXE (CWE-611) in XML Batch XPath Processing Service
CVE-2026-78224
XXE Injection (CWE-611) in XSLT Transformer Processing
CVE-2026-38056
Missing Authorization (CWE-862) in iDirect iQ200 VSAT
CVE-2026-71416
Origin Validation Bypass (CWE-287) in Headroom WebSocket
CVE-2026-89256
Stored XSS (CWE-79) in AVideo Bookmark Plugin HTML
CVE-2026-89255
Stored XSS (CWE-79) in AVideo LoginControl Plugin Profile
CVE-2026-89254
Stored XSS (CWE-79) in AVideo CustomizeUser Plugin UI
CVE-2026-89253
Stored XSS (CWE-79) in WWBN AVideo Donation Profile
CVE-2026-89250
Missing Authentication (CWE-306) in WWBN AVideo Endpoint
CVE-2026-89249
Stored XSS (CWE-79) in AVideo YPTWallet Request Handler
CVE-2026-89243
Stored XSS (CWE-79) in WWBN AVideo User Groups Panel
CVE-2026-89242
Server-Side Request Forgery (CWE-918) in WWBN AVideo Login
CVE-2026-86793
Code Injection (CWE-94) in SGLang Weight Update API
CVE-2026-78134
Incorrect Access Control (CWE-863) in strongSwan EAP
CVE-2025-57231
Path Traversal (CWE-22) in Docmost Avatar Attachments
CVE-2026-89054
Missing Authorization (CWE-862) in OpenNMS Horizon
CVE-2026-89049
SSRF (CWE-918) in AWS SSM Agent Port Forwarding Function
CVE-2026-88056
SSRF (CWE-918) in Angular Server-Side Rendering URL
CVE-2026-68006
HTTP Request Smuggling (CWE-444) in Puma HTTP Parser
CVE-2026-88044
Improper Authorization (CWE-863) in rclone RC Servers
CVE-2026-52098
Code Injection (CWE-94) in Flowise Prediction Endpoint
CVE-2026-88959
Broken Access Control (CWE-862) in Anchor CMS Users
CVE-2026-88939
Authorization Bypass (CWE-863) in knowns project.set
CVE-2026-88937
Path Traversal (CWE-22) in Knowns Template Codegen Engine
CVE-2026-88899
External Control of File Name or Path (CWE-73) in OpenCode
CVE-2026-88018
Authentication Bypass (CWE-287) in rclone S3 Server
CVE-2026-88009
HTTP Request Smuggling (CWE-444) in Traefik HTTP Proxy
CVE-2026-88008
HTTP/2 Tunnel Bypass (CWE-444) in Traefik Reverse Proxy
CVE-2026-88007
Authentication Bypass (CWE-287) in Traefik HTTP/3 Entrypoint
CVE-2026-88895
Improper Authentication (CWE-287) in CyberPanel API
CVE-2026-88893
Information Disclosure (CWE-200) in OpenPanel Shares
CVE-2026-88891
Improper Authorization (CWE-269) in OpenPanel Projects
CVE-2026-88890
SQL Injection (CWE-89) in OpenPanel Analytics Filters
CVE-2026-88889
OS Command Injection (CWE-78) in Renovate Maven Wrapper
CVE-2026-88888
Command Injection (CWE-78) in Renovate Mix Manager
CVE-2026-88887
Open Redirect (CWE-601) in Renovate Registry Pagination
CVE-2026-88886
OS Command Injection (CWE-78) in Renovate Gradle Wrapper
CVE-2026-88885
Command Injection (CWE-78) in Renovate gomod Manager
CVE-2026-88882
Open Redirect (CWE-601) in Renovate NuGet Pagination
CVE-2026-88881
CWE-601 Open Redirect in Renovate GitHub Pagination
CVE-2026-88880
Open Redirect (CWE-601) in Renovate GitLab Pagination
CVE-2026-88877
Authentication Bypass (CWE-639) in Traefik Ingress
CVE-2026-88876
Broken Access Control (CWE-200) in AVideo PlayerSkins
CVE-2026-88874
Information Exposure (CWE-200) in AVideo Live Streams
CVE-2026-88873
CSRF (CWE-352) in WWBN AVideo Log Archive Endpoint
CVE-2026-88872
CSRF (CWE-352) in AVideo Channel Password Function
CVE-2026-88870
CSRF (CWE-352) in WWBN AVideo LoginControl PGP Endpoints
CVE-2026-88869
Stored XSS (CWE-79) in AVideo AD_Server Plugin Endpoint
CVE-2026-88868
Stored XSS (CWE-79) in AVideo LiveLinks Plugin Pages
CVE-2026-88867
Stored XSS (CWE-79) in WWBN AVideo Category Handling
CVE-2026-88866
Stored XSS (CWE-79) in AVideo LoginControl Web Plugin
CVE-2026-88865
Authorization Bypass (CWE-639) in AVideo Restream Feature
CVE-2026-88864
Broken Access Control (CWE-284) in Capgo SSO Table
CVE-2026-88863
Improper Privilege Management (CWE-269) in Capgo Invite API
CVE-2026-88862
Broken Access Control (CWE-863) in Capgo API Backend
CVE-2026-64838
Path Traversal (CWE-22) in ICEcoder File Operations
CVE-2026-64837
OS Command Injection (CWE-78) in ICEcoder Properties
CVE-2026-64836
Path Traversal (CWE-22) in ICEcoder File Control Endpoint
CVE-2026-38626
SQL Injection (CWE-89) in Garlic-Hub ItemsRepository
CVE-2026-87803
Authorization Bypass (CWE-863) in Countly DBViewer
CVE-2026-84042
Privilege Escalation (CWE-269) in crun libkrun Runtime
CVE-2026-57967
Missing Authentication (CWE-306) in Apache Artemis CORE
CVE-2026-19584
Code Injection (CWE-94) in Velociraptor Notebook Backups
CVE-2026-87925
SQL Injection (CWE-89) in inventory-management-system
CVE-2026-71809
Authentication Bypass (CWE-259) in Siam Ordering Server
CVE-2026-87999
SSRF (CWE-918) in Open WebUI Web Retrieval
CVE-2026-87998
Improper Authorization (CWE-863) in Open WebUI Knowledge
CVE-2026-87996
DNS Rebinding (CWE-367) in Open WebUI URL Loader Component
CVE-2026-87995
Stored XSS (CWE-79) in Open WebUI Terminal Preview
CVE-2026-87922
Missing Authentication (CWE-306) in Inventory AJAX Backend
CVE-2026-87921
SQL Injection (CWE-89) in Inventory Management System
CVE-2026-87016
OAuth Identity Confusion (CWE-155) in Open WebUI SQLite
CVE-2026-71805
Arbitrary File Upload (CWE-434) in LZ-litchi API Endpoint
CVE-2026-71808
SQL Injection (CWE-89) in Siam Ordering Admin Mappers
CVE-2026-71801
Hardcoded Credentials (CWE-798) in SPMS-Server Auth
CVE-2026-87911
OS Command Injection (CWE-78) in postgres-mcp-server
CVE-2026-79324
Broken Access Control (CWE-639) in Mageplaza GDPR Module
CVE-2026-71614
Code Injection (CWE-94) in GPAC DVB MPE Media Parser
CVE-2026-79323
Information Disclosure (CWE-200) in Magefan Blog GraphQL
CVE-2026-79322
SQL Injection (CWE-89) in Mageplaza Magento Blog Extension
CVE-2026-54694
Stored XSS (CWE-79) in SkillTree Quiz Runs Interface
CVE-2026-52482
Information Exposure (CWE-200) in SJRC F11 inetd Shell
CVE-2026-87930
PHP Object Injection (CWE-502) in MaxSite CMS Sessions
CVE-2026-81640
Hardcoded Credentials (CWE-798) in Camera Wi-Fi AP
CVE-2026-77974
Missing Authentication (CWE-306) in Firmware Updater
CVE-2026-86775
Path Traversal (CWE-22) in knowns Document API Handler
CVE-2026-86771
SSRF (CWE-918) in Snipe-IT Acceptance PDF Generator
CVE-2026-86762
Broken Access Control (CWE-862) in Snipe-IT REST API
CVE-2026-86759
Missing Authorization (CWE-862) in Snipe-IT History
CVE-2026-86754
Broken Access Control (CWE-863) in Snipe-IT OAuth Routes
CVE-2026-86751
External Resource Injection (CWE-73) in Snipe-IT Notes
CVE-2026-86750
Authorization Bypass (CWE-863) in Snipe-IT REST API
CVE-2026-86741
External Resource Inclusion (CWE-73) in Snipe-IT Emails
CVE-2026-86099
Path Traversal (CWE-22) in Chainlit Socket.IO Handler
CVE-2024-58381
Unsafe Deserialization (CWE-502) in PocketMine Login
CVE-2023-54393
Improper Input Validation (CWE-20) in PocketMine-MP
CVE-2026-87821
SSRF (CWE-918) in Lara Dashboard Markdown Fetch Endpoint
CVE-2026-87817
Code Injection (CWE-94) in GitPython Repository Hooks
CVE-2026-87815
Path Traversal (CWE-73) in SiYuan Riff API Endpoint
CVE-2026-87814
Stored XSS (CWE-79) in SiYuan Search Asset Preview Feature
CVE-2026-87813
Stored XSS (CWE-79) in SiYuan Asset Search Results
CVE-2026-87811
Stored XSS (CWE-79) in SiYuan Notebook Template Paths
CVE-2026-87807
SQL Injection (CWE-89) in Siyuan Full-Text Search
CVE-2026-87806
Authentication Bypass (CWE-287) in Parse Server LDAP
CVE-2026-80099
Authentication Bypass (CWE-287) in Newfold Plugins
CVE-2026-53939
Predictable Key Generation (CWE-330) in cjose JWE Library
CVE-2026-53581
Path Traversal (CWE-22) in OPNsense NTP Configuration
CVE-2026-86083
Code Injection (CWE-94) in n8n Legacy Expression Engine
CVE-2026-86076
Code Injection (CWE-94) in n8n Expression Compiler AST
CVE-2026-86819
Improper Authorization (CWE-862) in Waves Central macOS
CVE-2026-86810
Improper Authentication (CWE-287) in Open-Web-Analytics
CVE-2026-86808
Missing Authentication (CWE-306) in Moltis Vault Handlers
CVE-2026-86806
Server-Side Request Forgery (CWE-918) in GeoLibre Library
CVE-2026-84942
Stored XSS (CWE-79) in OpenSearch Dashboards Vega Engine
CVE-2026-84869
Missing Authorization (CWE-862) in ScreenConnect Client
CVE-2026-78834
Code Injection (CWE-94) in CMSimple CoAuthors Plugin Feature
CVE-2026-86673
Hard-Coded Credentials (CWE-259) in ningzichun Database
CVE-2026-86669
Improper Authentication (CWE-287) in iWebShop Login
CVE-2026-86074
SSRF (CWE-918) in n8n Instance AI Credentials Flow
CVE-2026-81822
Weak Hashing (CWE-327) in PIMBoards Project File Store
CVE-2026-86073
OAuth Authorization Bypass (CWE-863) in n8n Token Endpoint
CVE-2026-79570
SQL Injection (CWE-89) in mfish-nocode-pro DB API Endpoint
CVE-2026-79569
SQL Injection (CWE-89) in Movie_Recommend /loadingmore
CVE-2026-78997
Universal XSS (CWE-79) in UC Browser for Android App
CVE-2026-47625
Missing Authorization (CWE-862) in NVIDIA Triton Server
CVE-2026-86840
Improper Authorization (CWE-862) in Bifrost Pallets
CVE-2026-86738
CSS Injection (CWE-79) in Snipe-IT Custom CSS Field
CVE-2026-86733
Command Injection (CWE-78) in Snipe-IT Backup Restore
CVE-2026-86732
Remote Code Execution (CWE-94) in Craft CMS element-index
CVE-2026-86730
Code Injection (CWE-94) in Craft CMS Field Layout API
CVE-2026-86729
Unrestricted Login Attempts (CWE-307) in AVideo API
CVE-2026-86728
Missing Authentication (CWE-306) in AVideo PlayLists
CVE-2026-86727
Missing Authentication (CWE-306) in AVideo Live Stats
CVE-2026-86725
Broken Access Control (CWE-639) in AVideo SocialMedia Plugin
CVE-2026-86723
Authentication Bypass (CWE-287) in AVideo LoginControl
CVE-2026-86722
Authentication Bypass (CWE-287) in AVideo 2FA Flow
CVE-2026-86721
Authorization Bypass (CWE-287) in AVideo Live Streams
CVE-2026-86720
Broken Access Control (CWE-639) in AVideo Restreaming
CVE-2026-86718
CSRF (CWE-352) in WWBN AVideo History API
CVE-2026-86666
Unrestricted File Upload (CWE-434) in iWebShop-5 5.15
CVE-2026-86600
Workload Identity SSRF (CWE-441) in Snowflake Drivers
CVE-2026-79574
Code Injection (CWE-94) in mpush Gateway Server v0.8.1
CVE-2026-79572
XXE (CWE-611) in Distribution Management Level Rules
CVE-2026-86665
Missing Authorization (CWE-862) in iWebShop-5 Update
CVE-2026-79577
Authentication Bypass (CWE-284) in sso-master /cas/login
CVE-2026-79576
Auth Bypass (CWE-287) in Digital-Infrastructure SSO
CVE-2026-79575
Predictable JWT Secret (CWE-330) in yfexam-exam v2.0
CVE-2026-79571
Broken Access Control (CWE-284) in SellerAuthorizeAspect
CVE-2026-78837
SQL Injection (CWE-89) in AppNitro MachForm ap_form_{id}
CVE-2026-74239
Path Traversal (CWE-22) in XenForo Style Archive Importer
CVE-2026-73315
SSRF (CWE-918) in XenForo PayPal Webhook Handler Endpoint
CVE-2026-86712
Cross-Site Scripting (CWE-79) in SiYuan Paste Handler
CVE-2026-86544
Authorization Bypass (CWE-863) in Knowns Code Actions
CVE-2026-86543
Missing Authentication (CWE-306) in Knowns Management API
CVE-2026-86542
Path Traversal (CWE-22) in knowns Import Route Handler
CVE-2026-86541
Path Traversal (CWE-22) in knowns Code Replacement
CVE-2026-86540
OS Command Injection (CWE-78) in knowns Project Config
CVE-2026-86539
Server-Side Request Forgery (CWE-918) in Knowns API
CVE-2026-86538
Path Traversal (CWE-22) in knowns Template Preview Endpoint
CVE-2026-86439
Path Traversal (CWE-22) in Knowns MCP File Access Tools
CVE-2026-86438
Missing Authorization (CWE-862) in Lara Dashboard Module
CVE-2026-86437
Authorization Bypass (CWE-863) in Lara Dashboard Admin
CVE-2026-86431
XSS (CWE-79) in league/commonmark AttributesExtension
CVE-2026-86427
Argument Injection (CWE-77) in LibreNMS Graph Titles
CVE-2026-86426
Authentication Bypass (CWE-287) in LibreNMS REST API
CVE-2026-86419
Server-Side Request Forgery (CWE-918) in MISP Egress
CVE-2026-86306
Improper Authentication (CWE-287) in light0011 Cookie
CVE-2026-86305
Unrestricted Upload (CWE-434) in light0011 CMS System
CVE-2022-51017
Improper Input Validation (CWE-20) in PocketMine-MP Server
CVE-2026-86300
Improper Authentication (CWE-287) in Tenda AC9 Router
CVE-2026-86299
OS Command Injection (CWE-78) in Linksys RE7000 Handler
CVE-2026-86298
SQL Injection (CWE-89) in Class Exam Timetabling System
CVE-2026-86292
Missing Authentication (CWE-306) in Traffic Offense User
CVE-2026-86290
SQL Injection (CWE-89) in SourceCodester ajax.php API
CVE-2026-86282
SQL Injection (CWE-89) in Tourism Management System
CVE-2026-86277
Authorization Bypass (CWE-285) in Syllabus LMS System
CVE-2026-86276
Hard-Coded Credentials (CWE-798) in Syllabus LMS System
CVE-2026-86273
Server-Side Request Forgery (CWE-918) in SIGA PDF Endpoint
CVE-2026-86268
SQL Injection (CWE-89) in School Management System
CVE-2026-86263
Authorization Bypass (CWE-639) in hosp_order Cancel
CVE-2026-86262
Authorization Bypass (CWE-639) in Hosp Order Handler
CVE-2026-86261
Authorization Bypass (CWE-639) in Hosp Order Controller
CVE-2026-86225
SQL Injection (CWE-89) in Class Exam Timetabling System
CVE-2026-86224
SQL Injection (CWE-89) in Class Exam Timetabling admin modal
CVE-2026-86223
SQL Injection (CWE-89) in SourceCodester Course Module
CVE-2026-86222
SQL Injection (CWE-89) in SourceCodester Course Handler
CVE-2026-86221
SQL Injection (CWE-89) in Class Exam Timetabling System
CVE-2026-86220
SQL Injection (CWE-89) in Class Exam Timetabling System
CVE-2026-86259
SSRF (CWE-918) in OpenMAIC Non-Production Deployments
CVE-2026-86214
Improper Authentication (CWE-287) in College System
CVE-2026-86213
SQL Injection (CWE-89) in College-Management-System
CVE-2026-86242
Code Injection (CWE-94) in Bifrost HTTP Transport API
CVE-2026-86211
SQL Injection (CWE-89) in Inventory Management Login
CVE-2026-86210
SQL Injection (CWE-89) in Class Exam Timetabling System
CVE-2026-86209
SQL Injection (CWE-89) in Class Exam System delete_user.php
CVE-2026-86208
SQL Injection (CWE-89) in Class and Exam Timetabling System
CVE-2026-86180
SQL Injection (CWE-89) in PHP Task Management Login
CVE-2026-86168
SQL Injection (CWE-89) in code-projects CMS login.php
CVE-2026-86167
OS Command Injection (CWE-78) in Tenda HG10 Boa CGI
CVE-2026-86162
SQL Injection (CWE-89) in SourceCodester Voting System
CVE-2026-86161
SQL Injection (CWE-89) in Online Voting System 1.0
CVE-2026-86160
SQL Injection (CWE-89) in SourceCodester Online Voting System
CVE-2026-86159
SQL Injection (CWE-89) in Online Voting System 1.0
CVE-2026-18056
Authentication Bypass (CWE-287) in HivePress Plugin
CVE-2026-86190
Broken Access Control (CWE-200) in WWBN AVideo API
CVE-2026-86189
Path Traversal (CWE-73) in AVideo FFmpeg Notify Endpoint
CVE-2026-86188
Cross-Site Scripting (CWE-79) in AVideo YPTSocket Plugin
CVE-2026-86185
TLS Verification Bypass (CWE-295) in Bilibili Desktop
CVE-2026-86184
Authentication Bypass (CWE-306) in Lara Dashboard App
CVE-2026-86177
Missing Authorization (CWE-862) in Pterodactyl Panel
CVE-2026-86173
SSRF (CWE-918) in MindsDB Web Crawler Request Handler
CVE-2026-86124
Missing Authentication (CWE-306) in AutoAgent TCP Server
CVE-2026-86123
SSRF (CWE-918) in SQL Chat Unauthenticated API Endpoints
CVE-2026-86121
Missing Authentication (CWE-306) in Cua Computer Server
CVE-2026-86119
Server-Side Request Forgery (CWE-918) in Webstudio Proxy
CVE-2026-86117
Authentication Bypass (CWE-287) in Coolify OAuth Handler
CVE-2026-52775
SQL Injection (CWE-89) in YesWiki ReactionManager PHP
CVE-2026-52771
SQL Injection (CWE-89) in YesWiki Page Deletion API
CVE-2026-52770
SQL Injection (CWE-89) in YesWiki Bazar Listing APIs
CVE-2026-52769
Server-Side Request Forgery (CWE-918) in YesWiki API
CVE-2026-52766
Missing Authorization (CWE-862) in YesWiki Erase Action
CVE-2026-86091
Missing Authorization (CWE-862) in ntopng Pools API
CVE-2026-86090
Missing Authorization (CWE-862) in ntopng REST API
CVE-2026-82684
Missing Authorization (CWE-862) in TPDIN-Monitor-WEB3
CVE-2026-85702
Missing Authentication (CWE-306) in FreeGPT WebUI API
CVE-2026-82712
Cross-Site Request Forgery (CWE-352) in TPDIN-Monitor-WEB3
CVE-2026-79426
Arbitrary File Deletion (CWE-73) in CRMEB Admin API
CVE-2026-79423
OS Command Injection (CWE-78) in SeaCMS Admin Config
CVE-2026-50894
Unrestricted File Upload (CWE-434) in easyadmin v2
CVE-2025-67066
SQL Injection (CWE-89) in oasys sysoa Paging Endpoint
CVE-2026-79391
Missing Authentication (CWE-306) in Trueview MQTT
CVE-2026-79390
Cleartext MQTT Transmission (CWE-284) in Trueview TI8161
CVE-2026-71625
Privilege Escalation (CWE-269) in ThinkSNS+ ResetPassword
CVE-2026-63464
Server-Side Request Forgery (CWE-918) in Nebula Webhooks
CVE-2026-53932
OS Command Injection (CWE-78) in Laravel Backup Restore
CVE-2026-85638
Authorization Bypass (CWE-285) in Trape core/user.py
CVE-2026-80119
Physical Memory Disclosure (CWE-497) in DirectIo64.sys
CVE-2026-80118
Physical Memory Disclosure (CWE-497) in DirectIo64.sys
CVE-2026-78839
Unrestricted File Upload (CWE-434) in AppNitro MachForm v30
CVE-2026-9317
Missing Authentication (CWE-306) in Nango Runner Server
CVE-2026-61686
Unsafe Deserialization (CWE-502) in SolidInvoice Platform
CVE-2026-84961
TLS Certificate Validation Bypass (CWE-295) in undici
CVE-2026-78745
Improper Access Control (CWE-284) in HiDPT Android ADB
CVE-2026-75430
Missing Authentication (CWE-306) in PowerJob Worker
CVE-2026-31020
Server-Side Template Injection (CWE-94) in DocsGPT
CVE-2026-75429
Unauthenticated RCE (CWE-287) in PowerJob /friend/process
CVE-2026-75171
Session Fixation (CWE-384) in HubCore Platform 14.1.1
CVE-2026-75169
Unrestricted Upload (CWE-434) in MBS X-Serie ugwupload.cgi
CVE-2026-75166
Improper Privilege Management (CWE-269) in X-Serie Gateway
CVE-2026-75161
OS Command Injection (CWE-77) in X-Serie Gateway Firmware
CVE-2026-75160
Improper Privilege Management (CWE-269) in X-Serie Gateway
CVE-2026-44402
Unrestricted Upload (CWE-434) in Voltronic upload.cgi
CVE-2022-35499
Reflected XSS (CWE-79) in Trimble TM4WEB Bill Viewer
CVE-2026-85699
Server-Side Request Forgery (CWE-918) in jina-ai Reader
CVE-2026-85696
OS Command Injection (CWE-78) in SadTalker Video Mux
CVE-2026-85695
Authentication Bypass (CWE-306) in FastChat Workers
CVE-2026-85694
Code Injection (CWE-94) in LaVague Python Extractor
CVE-2026-85691
Server-Side Request Forgery (CWE-918) in MegaParse API
CVE-2026-85690
Path Traversal (CWE-22) in Plandex ApplyFiles Function
CVE-2026-85688
Missing Authentication (CWE-306) in TEN TMAN Designer
CVE-2026-85687
Path Traversal (CWE-73) in Surya Screenshot Server
CVE-2026-85686
Server-Side Request Forgery (CWE-918) in ms-swift API
CVE-2026-85685
Path Traversal (CWE-22) in AgentScope Workspace API
CVE-2026-85684
Path Traversal (CWE-73) in Marker FastAPI Upload Handler
CVE-2026-85675
SSRF (CWE-918) in OWL Document Processing Toolkit API
CVE-2026-85674
Code Injection (CWE-94) in aider Repository Loading
CVE-2026-85673
SSRF (CWE-918) in LLaMA-Factory Media URL Endpoint
CVE-2026-85672
OS Command Injection (CWE-78) in zerox File Downloads
CVE-2026-85671
Authentication Bypass (CWE-306) in QAnything API Endpoints
CVE-2026-85668
Arbitrary File Read (CWE-73) in Xinference Auto-Register
CVE-2026-85667
Missing Authentication (CWE-306) in xiaobei Webhooks
CVE-2026-85666
Server-Side Request Forgery (CWE-918) in OGX API Endpoint
CVE-2026-85663
Missing Authentication (CWE-306) in Aim Tracking Server
CVE-2026-85661
Path Traversal (CWE-22) in excel-mcp-server File Tools
CVE-2026-85660
OS Command Injection (CWE-78) in cli-mcp-server 0.2
CVE-2026-85651
Missing Authorization (CWE-862) in Trigger.dev Replay
CVE-2026-85623
Command Injection (CWE-94) in goose Recipe Extensions
CVE-2026-85620
Authorization Bypass (CWE-863) in Postgres MCP Pro SQL
CVE-2026-85619
Broken Access Control (CWE-863) in AppFlowy Cloud Data
CVE-2026-85608
SSRF (CWE-918) in Douyin TikTok Download API Endpoints
CVE-2026-85607
Authorization Bypass (CWE-639) in Blinko Chat API
CVE-2026-85606
Path Traversal (CWE-22) in Firecrawl MCP Server
CVE-2026-85516
SQL Injection (CWE-89) in Vehicle Management System
CVE-2026-85617
Authorization Bypass (CWE-639) in Snipe-IT Bulk Delete
CVE-2026-85616
Authorization Bypass (CWE-639) in Snipe-IT Reports Actions
CVE-2026-85614
Server-Side Request Forgery (CWE-918) in OpenPanel API
CVE-2026-85613
Cross-Site Scripting (CWE-79) in OpenPanel Favicon Proxy
CVE-2026-85612
SSRF (CWE-918) in OpenPanel Favicon and OG Endpoints
CVE-2026-85610
Code Injection (CWE-94) in OpenPanel Chart Formulas
CVE-2026-85609
SSRF (CWE-918) in Openpanel Site Checker API Endpoint
CVE-2026-85604
PHP Code Injection (CWE-94) in Grav Twig Sort Filter
CVE-2026-85599
Stored XSS (CWE-79) in Grav Shortcode Core Components
CVE-2026-85597
TLS Auth Bypass (CWE-863) in Traefik Multi-Host Routers
CVE-2026-85596
Authentication Bypass (CWE-287) in Traefik Ingress
CVE-2026-85595
Authentication Bypass (CWE-287) in Traefik digestAuth
CVE-2026-85594
Authorization Bypass (CWE-639) in Traefik Ingress Provider
CVE-2026-85512
Missing Authorization (CWE-862) in Class Exam System
CVE-2026-84504
Improper Input Validation (CWE-20) in Fastify Routes
CVE-2026-84469
Input Validation Bypass (CWE-20) in Fastify Request Routing
CVE-2026-85525
Certificate Validation (CWE-295) in Snowflake Drivers
CVE-2026-57777
Blind SQL Injection (CWE-89) in WordPress WooCommerce
CVE-2026-85403
SQL Injection (CWE-89) in Doctor Appointment System
CVE-2026-85402
SQL Injection (CWE-89) in Doctor Appointment booking.php
CVE-2026-85399
SQL Injection (CWE-89) in Hospital Information System
CVE-2026-85398
SQL Injection (CWE-89) in Hospital Information System
CVE-2026-85397
SQL Injection (CWE-89) in Hospital Information System
CVE-2026-85380
Server-Side Request Forgery (CWE-918) in UEditor catchimage
CVE-2026-85379
SQL Injection (CWE-89) in light0011 CMS Query Builder
CVE-2026-85451
Hard-Coded Credentials (CWE-798) in MOOS SuicidalSleeper
CVE-2026-85439
OS Command Injection (CWE-78) in MOOS-IvP alogsplit
CVE-2026-85433
Missing Authorization (CWE-862) in essential-moos pShare
CVE-2026-85428
Missing Authentication (CWE-306) in MOOSDB HTTP Server
CVE-2026-85426
OS Command Injection (CWE-78) in MOOS-IvP uMemWatch
CVE-2026-85425
OS Command Injection (CWE-78) in MOOS-IvP iSay Handler
CVE-2026-85424
Missing Authentication (CWE-306) in MOOS core-moos Protocol
CVE-2026-85378
Authorization Bypass (CWE-285) in light0011 CMS Chapter
CVE-2026-85225
SQL Injection (CWE-89) in Doctor Appointment Login Page
CVE-2026-85224
OS Command Injection (CWE-78) in D-Link DNS-320 File Sharing
CVE-2026-85223
OS Command Injection (CWE-78) in D-Link DNS-340L CGI Handler
CVE-2026-85222
OS Command Injection (CWE-78) in D-Link DNS-340L CGI
CVE-2026-85208
Unrestricted Upload (CWE-434) in Medicine Order Controller
CVE-2026-85061
DOM-Based XSS (CWE-79) in MapLibre GL JS Attribution UI
CVE-2026-82527
SQL Injection (CWE-89) in R2R Retrieval Search API
CVE-2026-53728
External Open Redirect (CWE-601) in Medplum IdP Callback
CVE-2026-44506
Information Disclosure (CWE-200) in Medplum OAuth Endpoint
CVE-2026-85396
Path Traversal (CWE-22) in rubyzip ZIP Extraction Bug
CVE-2026-85395
Missing Authorization (CWE-862) in UnoPim Admin ACL
CVE-2026-85391
Hardcoded JWT Secret (CWE-798) in Peppermint Service
CVE-2026-85390
Missing Authorization (CWE-862) in Checkmate Routes
CVE-2026-85388
SQL Injection (CWE-89) in Worklenz Pagination Helpers
CVE-2026-82526
SQL Injection (CWE-89) in R2R Vector Index API Endpoint
CVE-2026-85187
SQL Injection (CWE-89) in Online Medicine Delivery System
CVE-2026-85012
OS Command Injection (CWE-78) in CodeCatalyst Blueprints
CVE-2026-63219
Missing Authorization (CWE-862) in GeoNetwork Upload
CVE-2026-58400
XSLT Code Injection (CWE-94) in GeoNetwork Catalog
CVE-2026-85237
OTP Brute-Force (CWE-307) in MISP Email OTP Flow Endpoint
CVE-2026-85236
CSRF (CWE-352) in MISP cullEmptyEvents Deletion Endpoint
CVE-2026-85138
SQL Injection (CWE-89) in SeaCMS WeChat Module Content
CVE-2026-85137
Code Injection (CWE-94) in SeaCMS Locoy Collector PHP
CVE-2026-75035
Authorization Bypass (CWE-639) in Rancher Token Store
CVE-2026-71963
OS Command Injection (CWE-78) in Hermes Agent Assistant
CVE-2026-55658
Missing Authorization (CWE-862) in Gardens Streaming
CVE-2026-85221
Improper TLS Validation (CWE-295) in MISP CurlClient
CVE-2026-85214
Authorization Bypass (CWE-639) in vhr HR Profile Management
CVE-2026-85213
Missing Authorization (CWE-862) in Kill Bill Admin API
CVE-2026-85212
Authorization Bypass (CWE-862) in CRMEB verifyAuth()
CVE-2026-85211
Broken Access Control (CWE-639) in Label Studio Proxy API
CVE-2026-85182
Authorization Bypass (CWE-639) in vhr Password Endpoint
CVE-2026-85180
SSRF (CWE-918) in Ollama Tensor-Layer Model Downloads
CVE-2026-85179
Server-Side Request Forgery (CWE-918) in Label Studio Webhook
CVE-2026-85178
Broken Access Control (CWE-639) in Helicone Vault API
CVE-2026-85176
File Path Traversal (CWE-73) in DbGate jsldata controller
CVE-2026-84989
Missing Authorization (CWE-862) in ntopng Tag APIs
CVE-2026-75033
Cross-Cluster Secret Exposure (CWE-639) in Rancher
CVE-2026-71404
Authorization Bypass (CWE-639) in Rancher RBAC Controller
CVE-2026-85169
Code Injection (CWE-94) in n8n Expression Sandbox Escape
CVE-2026-85168
OS Command Injection (CWE-78) in n8n Git Integration
CVE-2026-85165
Expression Sandbox Bypass (CWE-95) in n8n Workflows
CVE-2026-85164
Server-Side Request Forgery (CWE-918) in AVideo API
CVE-2026-85160
CSRF/Path Traversal (CWE-73) in AVideo stopLive.php
CVE-2026-85155
SQL Injection (CWE-89) in AVideo Channels API Endpoint
CVE-2026-85154
Broken Access Control (CWE-269) in AVideo Admin Tokens
CVE-2026-85124
Path Traversal (CWE-22) in Fastify HTTP Proxy Plugin
CVE-2026-84292
URI Authority Injection (CWE-116) in fast-uri Parser
CVE-2026-82524
Unrestricted File Upload (CWE-434) in UnoPim Admin Portal
CVE-2026-84381
Cleartext Transmission (CWE-319) in HTTPX2 WebSockets
CVE-2026-53649
Cross-Origin Request Forgery (CWE-352) in Joro API Proxy
CVE-2026-49832
Remote Code Execution (CWE-94) in DSpace Velocity Templates
CVE-2026-79755
OS Command Injection (CWE-78) in Nuclio Docker Platform
CVE-2026-53635
Missing Authorization (CWE-862) in Open edX Pricing
CVE-2026-52833
Code Injection (CWE-94) in Nuclio Java Function Builds
CVE-2026-52831
OS Command Injection (CWE-78) in Nuclio CronJob Containers
CVE-2026-45730
Authorization Bypass (CWE-862) in Nuclio Dashboard
CVE-2026-53611
OS Command Injection (CWE-78) in Looking Glass Platform
CVE-2026-84803
Stored XSS (CWE-79) in SiYuan Asset Serving Endpoint
CVE-2026-84801
Missing Authorization (CWE-862) in Craft CMS Reset
CVE-2026-84800
Missing Authorization (CWE-862) in Craft Assets API
CVE-2026-84798
Missing Authorization (CWE-862) in Craft CMS Entries
CVE-2026-84796
Site Scope Bypass (CWE-639) in Craft CMS GraphQL Mutations
CVE-2026-84795
Privilege Escalation (CWE-269) in Craft CMS Registration
CVE-2026-84794
Missing Authorization (CWE-862) in Craft CMS Assets
CVE-2026-84441
Path Traversal (CWE-22) in Piwigo Image Handler i.php
CVE-2026-84715
Improper Authorization (CWE-862) in FeatherPanel Subusers
CVE-2026-84485
Missing Authentication (CWE-306) in APITable Directory
CVE-2026-84702
Path Traversal (CWE-22) in FaceFusion Job File Handling
CVE-2026-84700
Missing Authentication (CWE-306) in Pika Replication
CVE-2026-84696
Missing Authentication (CWE-306) in Phison PS3111-S11
CVE-2026-84695
Stored XSS (CWE-79) in BookStack Drawing Upload Endpoint
CVE-2026-84694
OS Command Injection (CWE-78) in Coolify SSH Deploy
CVE-2026-84478
Path Traversal (CWE-73) in WWBN AVideo Login Endpoint
CVE-2026-84423
Missing Authentication (CWE-306) in Casdoor Upload API
CVE-2026-84208
SQL Injection (CWE-89) in AVideo User_Location Plugin
CVE-2026-84374
Path Traversal (CWE-22) in Laravel Excel Disk Copy Method
CVE-2026-76851
SSRF (CWE-918) in GitHub Enterprise Pre-Receive Hooks
CVE-2026-75604
Path Traversal (CWE-22) in Next.js Windows Cache Storage
CVE-2026-18730
SSRF (CWE-918) in GitHub Enterprise Server Manage API
CVE-2026-84370
SVG Link XSS (CWE-79) in SVGO Node.js SVG Optimizer
CVE-2026-84366
Cleartext Transmission (CWE-319) in Scrapy S3 Handler
CVE-2026-71981
PHP Object Injection (CWE-502) in Cypht Logout Handler
CVE-2026-8712
Server-Side Request Forgery (CWE-918) in Wyoming API
CVE-2026-52111
Broken Access Control (CWE-284) in Fast Note Sync Service
CVE-2026-51974
Code Injection (CWE-94) in Fooocus Metadata Parser
CVE-2026-51956
BOLA (CWE-284) in Grashjs Atlas CMMS Company Records
CVE-2026-84202
Unsafe YAML Deserialization (CWE-502) in ModelScope Loader
CVE-2026-84201
Path Traversal (CWE-22) in appium-mcp-server Tools API
CVE-2026-61779
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61778
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61777
Unsafe Deserialization (CWE-502) in NVIDIA Megatron
CVE-2026-61776
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61775
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61774
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61773
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61772
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61771
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61770
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61769
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61768
Unsafe Deserialization (CWE-502) in NVIDIA Megatron
CVE-2026-61767
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61766
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61765
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61764
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61763
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61762
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61761
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61760
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61759
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61758
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61757
Unsafe Deserialization (CWE-502) in NVIDIA Megatron
CVE-2026-61756
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61755
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61754
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61753
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-61752
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61751
Unsafe Deserialization (CWE-502) in Megatron Bridge
CVE-2026-61750
Unsafe Deserialization (CWE-502) in NVIDIA Megatron Bridge
CVE-2026-51770
Improper Access Control (CWE-284) in TOTOLINK T6 cs_broker
CVE-2026-51769
Improper Access Control (CWE-284) in TOTOLINK T6 Router
CVE-2026-51768
Improper Access Control (CWE-284) in TOTOLINK T6 cs_broker
CVE-2026-51767
Broken Access Control (CWE-284) in TOTOLINK T6 MQTT
CVE-2026-84111
SQL Injection (CWE-89) in Chanjet CRM Report Handler
CVE-2026-51766
Improper Access Control (CWE-284) in TOTOLINK T6 Router
CVE-2026-51765
Improper Access Control (CWE-284) in TOTOLINK T6 cs_broker
CVE-2026-51764
Improper Access Control (CWE-284) in TOTOLINK T6 Router
CVE-2026-51763
Improper Access Control (CWE-284) in TOTOLINK T6 MQTT
CVE-2026-51762
Improper Access Control (CWE-284) in TOTOLINK T6 meshInfoKick
CVE-2026-51760
Improper Access Control (CWE-284) in TOTOLINK T6 Mesh
CVE-2026-51757
Improper Access Control (CWE-284) in TOTOLINK T6 MQTT
CVE-2026-51754
Improper Access Control (CWE-284) in TOTOLINK T6 MQTT
CVE-2026-51751
Improper Access Control (CWE-284) in TOTOLINK T6 cs_broker
CVE-2026-51750
Improper Access Control (CWE-284) in TOTOLINK T6 Router
CVE-2026-51747
Improper Access Control (CWE-284) in TOTOLINK T6 Router
CVE-2026-51744
Broken Access Control (CWE-284) in TOTOLINK T6 MQTT
CVE-2026-51743
Improper Access Control (CWE-284) in TOTOLINK T6 Router
CVE-2026-51741
Improper Access Control (CWE-284) in TOTOLINK T6 Logs
CVE-2026-84200
Authorization Bypass (CWE-284) in Kyverno Exceptions
CVE-2026-84199
Server-Side Request Forgery (CWE-918) in Kyverno APICall
CVE-2026-84196
SSRF (CWE-918) in Kyverno apiCall.service.url Field
CVE-2026-84195
Credential Exposure (CWE-200) in Kyverno apiCall Service
CVE-2026-84192
Stored XSS (CWE-79) in LibreNMS Legacy PHP Templates
CVE-2026-84190
OS Command Injection (CWE-77) in LibreNMS About Endpoint
CVE-2026-84189
Stored XSS (CWE-79) in LibreNMS Oxidized Integration
CVE-2026-84187
Missing Authentication (CWE-284) in AVideo Live Plugin
CVE-2026-83595
Cross-Site Request Forgery (CWE-352) in AVideo API
exploitable in your codebase.