AI Vulnerability Database
CVEs added in
October 2026
Every CVE that went into the database in October 2026, newest first. Each one opens its full write-up.
CVE-2026-120198
Command Injection (CWE-77) in WAVLINK WL-WN530BE1-A
CVE-2026-120197
OS Command Injection (CWE-78) in WAVLINK WL-WN530HG4B
CVE-2026-120196
OS Command Injection (CWE-78) in WAVLINK WN579X3-D CGI
CVE-2026-120195
OS Command Injection (CWE-78) in WAVLINK Setup Wizard
CVE-2026-120191
Missing Authentication (CWE-306) in Presenton API Endpoints
CVE-2026-120207
CSRF (CWE-352) in Thelia Page Module Delete Endpoints
CVE-2026-120205
Stored Cross-Site Scripting (CWE-79) in Thelia Coupon Summary
CVE-2026-120203
Code Injection (CWE-94) in ShowDoc Mock Templates
CVE-2026-120040
Privilege Escalation (CWE-269) in WordPress Mail Logs
CVE-2026-116522
Stored XSS (CWE-79) in Relevanssi WordPress Plugin
CVE-2026-111254
Stored XSS (CWE-79) in W3 Total Cache WordPress Plugin
CVE-2026-63378
Python Code Injection (CWE-94) in TAKO AI Agent for Okta
CVE-2026-63377
Missing Authentication (CWE-306) in TAKO AI Agent API
CVE-2026-63339
Privilege Escalation (CWE-269) in IXP Manager Web App
CVE-2026-63338
Broken Object Level Authorization (CWE-639) in IXP API
CVE-2026-63184
Untrusted $ref Resolution (CWE-829) in Refitter Tool
CVE-2026-16760
Unsafe Deserialization (CWE-502) in Fickling Library
CVE-2026-118938
Unsafe Deserialization (CWE-502) in Fickling Pickle Loader
CVE-2026-62990
Stored XSS (CWE-79) in Shopper Admin Media Uploads
CVE-2026-62989
Missing Authorization (CWE-862) in Shopper Variants
CVE-2026-62967
Broken Authorization (CWE-862) in ZTNET User Endpoint
CVE-2026-62958
Out-of-Bounds Read (CWE-125) in libriscv ELF Binary Loader
CVE-2026-62863
Missing Authentication (CWE-306) in MoLing SSE Server
CVE-2026-62853
Code Injection (CWE-94) in ThingLinks Rule Engine API
CVE-2026-62849
SQL Injection (CWE-89) in ThingLinks TDS Insert APIs
CVE-2026-62848
Unsafe Deserialization (CWE-502) in Metalama VS Integration
CVE-2026-58412
Improper Authorization (CWE-863) in Filecoin Pin Action
CVE-2026-61620
SQL Injection (CWE-89) in HoneySQL DSL Formatter API
CVE-2026-55598
Server-Side Request Forgery (CWE-918) in PinePods API
CVE-2026-119337
Missing Authorization (CWE-862) in RAGFlow Agents API
CVE-2026-119335
OS Command Injection (CWE-78) in Pi-hole PID File Path
CVE-2026-119331
Origin Validation Error (CWE-346) in Ladybird CSSOM
CVE-2026-116249
Path Traversal (CWE-22) in pgAdmin 4 Storage Paths
CVE-2026-116247
Credential Exposure (CWE-522) in pgAdmin 4 Server Mode
CVE-2026-116245
Credential Exposure (CWE-522) in pgAdmin 4 Server Mode
CVE-2026-116244
Kerberos Credential Exposure (CWE-522) in pgAdmin 4 Connections
CVE-2026-116242
SSH Credential Exposure (CWE-522) in pgAdmin Tunnels
CVE-2026-116241
OS Command Injection (CWE-78) in pgAdmin 4 Import Tool
CVE-2026-116239
Authentication Bypass (CWE-287) in pgAdmin 4 Server
CVE-2026-116238
Authentication Lockout Bypass (CWE-307) in pgAdmin 4
CVE-2026-62331
Path Traversal (CWE-22) in Praktor Telegram Uploads
CVE-2026-62264
Missing Authentication (CWE-306) in PDF Reader MCP HTTP
CVE-2026-59978
Improper Input Validation (CWE-20) in AdminNeo Web App
CVE-2026-119620
Unrestricted File Upload (CWE-434) in cak-filemanagement
CVE-2026-119619
SQL Injection (CWE-89) in cak-filemanagement admin
CVE-2026-61826
Missing Authorization (CWE-862) in Bazarr Plex API
CVE-2026-61804
Stored XSS (CWE-79) in myTinyWMS Product Management
CVE-2026-115642
Authorization Bypass (CWE-863) in Keystone Middleware
CVE-2026-119717
Code Injection (CWE-94) in pybars4 Handlebars Templates
CVE-2026-119716
Code Injection (CWE-94) in pybars3 Templating Engine
CVE-2026-119713
OS Command Injection (CWE-78) in Paperclip Workspaces
CVE-2026-119710
Authorization Bypass (CWE-862) in PipesHub Connectors
CVE-2026-119707
Missing Authorization (CWE-862) in SonicJS API Routes
CVE-2026-119706
Unsafe Deserialization (CWE-502) in LMDeploy API Server
CVE-2026-119288
Command Injection (CWE-78) in Zuke Windows Builds
CVE-2026-119287
Missing Authorization (CWE-862) in Zuke MCP Registry
CVE-2026-118238
OS Command Injection (CWE-78) in Tenda W18E Diagnose
CVE-2026-117183
Path Traversal (CWE-22) in astro-notion-blog FeaturedImage
CVE-2026-61739
Broken Access Control (CWE-862) in CoPilot Sigma APIs
CVE-2026-61738
Path Traversal (CWE-22) in SOCFortress CoPilot Reports
CVE-2026-61730
Unauthenticated Data Exposure (CWE-200) in CoPilot Reports
CVE-2026-61729
Missing Authentication (CWE-306) in SOCFortress CoPilot
CVE-2026-61728
Stored XSS (CWE-79) in SOCFortress CoPilot Portal App
CVE-2026-61708
Broken Access Control (CWE-284) in CoPilot Upload API
CVE-2026-45145
Unsafe PHP Deserialization (CWE-502) in Chamilo LMS Core
CVE-2026-45144
Stored XSS (CWE-79) in Chamilo LMS Public Profiles
CVE-2026-119662
Hardcoded Credentials (CWE-798) in Songloft Endpoint
CVE-2026-119656
SQL Injection (CWE-89) in CoreShop Agent API Endpoint
CVE-2026-119655
SQL Injection (CWE-89) in CoreShop Goods Page API Endpoint
CVE-2026-119654
Missing Authorization (CWE-862) in DataCap Admin APIs
CVE-2026-119649
Improper Authorization (CWE-863) in Orchard CMS Media
CVE-2026-112905
Broken Access Control (CWE-285) in Vvveb Auth Tokens
CVE-2026-110799
Authentication Bypass (CWE-287) in Vvveb Password Reset
CVE-2026-119572
Authentication Bypass (CWE-287) in Traefik K8s Ingress
CVE-2026-119586
Command Injection (CWE-77) in SQLite .recover Shell
CVE-2026-119549
SSRF (CWE-918) in Jellyfin User Image Rendering Path
CVE-2026-119426
CSRF (CWE-352) in phpMyAdmin SQL Query Web Interfaces
CVE-2026-119419
SQL Injection (CWE-89) in CakePHP Collation Handling
CVE-2026-119418
SQL Injection (CWE-89) in CakePHP WindowExpression
CVE-2026-119409
OS Command Injection (CWE-78) in OPNsense Firmware Updater
CVE-2026-119407
CSRF (CWE-352) in Element Web and Desktop Sessions
CVE-2026-65874
SQL Injection (CWE-89) in Apache Fineract Read APIs
CVE-2026-64618
SQL Injection (CWE-89) in Apache Fineract Search API
CVE-2026-61719
Stored XSS (CWE-79) in WeGIA Medical Record History
CVE-2026-61707
Server-Side Template Injection (CWE-94) in CoPilot
CVE-2026-61671
Broken Object Authorization (CWE-639) in WeGIA CRUD
CVE-2026-61645
Unrestricted File Upload (CWE-434) in Docat Upload API
CVE-2026-119190
Certificate Validation Confusion (CWE-295) in node-forge
CVE-2026-51912
Directory Traversal (CWE-22) in OpenBMB XAgent Upload
CVE-2026-51905
Broken Access Control (CWE-284) in SuperAGI Config API
CVE-2026-51903
Broken Access Control (CWE-284) in SuperAGI Agent API
CVE-2026-51863
CVE-2026-51851
Path Traversal (CWE-22) in Agent Zero File Browser
CVE-2026-11587
SQL Injection (CWE-89) in Centreon ACL Management Module
CVE-2026-119115
Incorrect Authorization (CWE-863) in AWS PCA Issuer
CVE-2026-118763
Credential Exposure (CWE-522) in sigstore-js OCI Client
CVE-2026-118759
Missing Authorization (CWE-862) in Kubeflow Logs API
CVE-2026-118758
Path Traversal (CWE-22) in Kubeflow Artifact Handler
CVE-2026-107058
Improper Authentication (CWE-287) in Shelter Binder API
CVE-2026-107053
Path Traversal (CWE-22) in foobnix Librera PDF Reader
CVE-2026-107050
Code Injection (CWE-94) in RetroArch Code Loading Path
CVE-2026-107049
Improper Authorization (CWE-863) in Forkyz Storage Settings
CVE-2026-119145
Path Traversal (CWE-22) in Frappe File Upload Handler
CVE-2026-119129
Missing Authorization (CWE-862) in ZITADEL Login V2 Flow
CVE-2026-119120
Unsafe Deserialization (CWE-502) in Crawl4AI API Server
CVE-2026-107037
Broken Access Control (CWE-284) in NoNonsense Notes
CVE-2026-107034
Improper Access Control (CWE-284) in LeafPad Note Data
CVE-2026-107028
Improper Access Control (CWE-284) in wbpxre150 App
CVE-2026-107020
Open Redirect (CWE-601) in FeedEx LoadLinkLaterActivity
CVE-2026-107017
Broken Access Control (CWE-284) in Canvoki Shortcut Activity
CVE-2026-107016
Improper Access Control (CWE-284) in Fossify Contacts
CVE-2026-107015
Broken Access Control (CWE-284) in Simple Contacts Pro
CVE-2026-79589
CVE-2026-119049
Authorization Bypass (CWE-639) in FreeMail Mailbox
CVE-2026-49142
SQL Injection (CWE-89) in OpenEMR Syndromic Module
CVE-2026-119028
Code Injection (CWE-94) in oapi-codegen Go Generator
CVE-2026-119027
Go Code Injection (CWE-94) in oapi-codegen Templates
CVE-2026-119025
OS Command Injection (CWE-78) in open on Windows/WSL
CVE-2026-115821
Stored XSS (CWE-79) in NewsmanApp WordPress Plugin
CVE-2026-118905
Command Injection (CWE-78) in nvm Version Selection
CVE-2026-85749
Authorization Bypass (CWE-566) in MailWatch Quarantine
CVE-2026-61572
Server-Side Request Forgery (CWE-918) in AVideo Platform
CVE-2026-61571
Missing Authentication (CWE-306) in AVideo Encoder
CVE-2026-61569
SQL Injection (CWE-89) in AVideo Streamer Login Flow
CVE-2026-61567
OS Command Injection (CWE-78) in AVideo Live Streaming
CVE-2026-61564
PHP Code Injection (CWE-94) in AVideo Installer Endpoint
CVE-2026-54455
SQL Injection (CWE-89) in OpenCATS Activity DataGrid
CVE-2026-54453
Code Injection (CWE-94) in OpenCATS License Config File
CVE-2026-118755
OS Command Injection (CWE-78) in Volmarg Personal PMS
CVE-2026-118692
OS Command Injection (CWE-78) in CherryTree Link Handlers
CVE-2026-118690
Missing Authentication (CWE-306) in Signal K Server
CVE-2026-118682
TLS Certificate Validation Bypass (CWE-295) in ClashMi
CVE-2026-118660
SSRF (CWE-918) in Happy DOM HTML Resource Loading API
CVE-2026-118659
SSRF (CWE-918) in Happy DOM Server Renderer Service
CVE-2026-63190
Missing Authentication (CWE-306) in FearlessCMS Admin
CVE-2026-61542
Missing Authentication (CWE-306) in Gearsystem MCP HTTP
CVE-2026-118650
URL Decoding Mismatch (CWE-177) in Echo Web Framework
CVE-2026-118683
Configuration Code Injection (CWE-94) in MONAI Bundle
CVE-2026-118679
SSRF (CWE-918) in n8n Slack Trigger Webhook Endpoint
CVE-2026-118676
Authorization Bypass (CWE-863) in n8n Workflow Runs
CVE-2026-118675
Authorization Bypass (CWE-863) in n8n Shared Workflows
CVE-2026-118648
Stored XSS (CWE-79) in n8n Webhook Response Handling
CVE-2026-118642
Authorization Bypass (CWE-863) in n8n Sub-Workflows
CVE-2026-118257
Stored XSS (CWE-79) in Vue I18n srcdoc HTML Sanitizer
CVE-2026-59979
Broken Access Control (CWE-639) in YosemiteCrew APIs
CVE-2026-56828
Broken Access Control (CWE-285) in Shopper Admin Panel
CVE-2026-44179
Code Injection (CWE-95) in XWiki Remote Macros Extension
CVE-2026-116778
OS Command Injection (CWE-78) in FOG Storage Node API
CVE-2026-59185
IDOR (CWE-639) in identrail GitHub App Connection API
CVE-2026-59179
Path Traversal (CWE-22) in OpenHop Server API Routes
CVE-2026-59164
Missing Authorization (CWE-862) in NORA Registry UI
CVE-2026-52729
Missing Authorization (CWE-862) in Xibo Layout Actions
CVE-2026-115904
OS Command Injection (CWE-78) in Topluyo Desktop Linux
CVE-2026-114278
OS Command Injection (CWE-78) in che-machine-exec Service
CVE-2026-109381
Privilege Escalation (CWE-269) in Mage Eventpress Plugin
CVE-2026-118378
SQL Injection (CWE-89) in Tabularis SQLite Driver Component
CVE-2026-117607
Unrestricted File Upload (CWE-434) in Xerte Toolkits
CVE-2026-110879
Unsafe Deserialization (CWE-502) in Jackson Databind Library
CVE-2026-59158
Exposed API Key (CWE-522) in Nuxt Ollama Integration
CVE-2026-58257
Path Traversal (CWE-22) in GRR Database Restore Feature
CVE-2026-58256
PHP Code Injection (CWE-94) in GRR LDAP Connector Settings
CVE-2026-58255
Improper Privilege Management (CWE-269) in Cronicle
CVE-2026-58205
Reflected XSS (CWE-79) in GRR maj.php Installation Files
CVE-2026-57200
Authorization Bypass (CWE-863) in Asterisk ARI WebSocket
CVE-2026-116692
Arbitrary Code Execution (CWE-94) in MLflow Scorers
CVE-2026-116690
Path Traversal (CWE-22) in MLflow Model Version API
CVE-2026-116688
Prototype Pollution (CWE-79) in CKEditor 5 Rich Editor
CVE-2026-118170
Broken Access Control (CWE-862) in Strapi Review Workflows
CVE-2026-117516
SQL Injection (CWE-89) in Travel Agency Contact Handler
CVE-2026-117515
SQL Injection (CWE-89) in PHP Travel Agency System App
CVE-2026-116682
Path Traversal (CWE-22) in FileBrowser Quantum Server
CVE-2026-116676
OS Command Injection (CWE-78) in Atlantis Workspaces
CVE-2026-117514
SQL Injection (CWE-89) in PHP Travel Agency Admin Pages
CVE-2026-117513
SQL Injection (CWE-89) in Travel Agency Admin Search
CVE-2026-117512
Unrestricted File Upload (CWE-434) in PHP Travel Agency
CVE-2026-116672
IDOR (CWE-639) in Authlib Client Registration APIs
CVE-2026-117511
OS Command Injection (CWE-78) in node-tesseract CLI
CVE-2026-104189
Missing Share Authorization (CWE-306) in Nextcloud 3D Viewer
CVE-2026-78845
Code Injection (CWE-94) in Aidot UPnP Root Description
CVE-2026-117604
Authorization Bypass (CWE-200) in Grav Debugger Profiler
CVE-2026-117573
OS Command Injection (CWE-78) in hagent MCP Tools
CVE-2026-117569
OS Command Injection (CWE-78) in Kali-GPT MCP Server
CVE-2026-117568
OS Command Injection (CWE-78) in mcp-ffmpeg MCP Tools
CVE-2026-117567
OS Command Injection (CWE-78) in esp-mcp MCP Tools
CVE-2026-117561
OS Command Injection (CWE-78) in Codefriar sf-mcp
CVE-2026-117560
OS Command Injection (CWE-78) in ATXP Gemini CLI Extension
CVE-2026-117559
Command Injection (CWE-78) in DroidMind Android Tools
CVE-2026-117558
OS Command Injection (CWE-78) in ai-sdlc MCP Server
CVE-2026-117553
Open Redirect (CWE-601) in Umbraco CMS OAuth Clients
CVE-2026-65151
SQL Injection (CWE-89) in NVIDIA NeMo Agent Toolkit
CVE-2026-65145
Missing Authentication (CWE-306) in NVIDIA NeMo Toolkit
CVE-2026-65120
Server-Side Request Forgery (CWE-918) in NVIDIA TensorRT-LLM
CVE-2026-24269
Server-Side Request Forgery (CWE-918) in NVIDIA TensorRT-LLM
CVE-2026-117536
CSRF (CWE-352) in REDAXO Backend User Administration
CVE-2026-117532
Authentication Bypass (CWE-287) in REDAXO History Plugin
CVE-2026-116898
Missing Authorization (CWE-639) in REDAXO Media Pool
CVE-2026-116896
Missing Authorization (CWE-862) in REDAXO Backup Addon
CVE-2026-116890
Missing Authorization (CWE-862) in MediaWiki smwtask API
CVE-2026-116880
CSRF (CWE-352) in Semantic MediaWiki Special:SMWAdmin
CVE-2026-116876
Improper Authorization (CWE-862) in Semantic MediaWiki
CVE-2026-116873
Missing Authorization (CWE-862) in Semantic MediaWiki
CVE-2026-116623
Missing Authorization (CWE-862) in Simple CMS Admin
CVE-2026-116819
Information Disclosure (CWE-200) in OpenPanel Projects
CVE-2026-116818
SQL Injection (CWE-89) in OpenPanel Live Visitors API
CVE-2026-116811
Code Injection (CWE-94) in OpenPanel JavaScript Runtime
CVE-2026-116808
SQL Injection (CWE-89) in OpenPanel Profile API Service
CVE-2026-111422
OS Command Injection (CWE-78) in Airflow SSH Jobs
CVE-2026-116580
Unsafe Deserialization (CWE-502) in Seroval fromJSON
CVE-2026-116576
OS Command Injection (CWE-78) in systeminformation services()
CVE-2026-116506
Command Injection (CWE-77) in TOTOLINK A950RG Router
CVE-2026-116505
OS Command Injection (CWE-77) in TOTOLINK A950RG Router
CVE-2026-116504
Command Injection (CWE-77) in TOTOLINK A950RG Upgrade
CVE-2026-115924
Path Traversal (CWE-22) in Rembg Image API Endpoint
CVE-2026-104596
Out-of-Bounds Read (CWE-200) in libosmocore GSM Parser
CVE-2026-115915
Improper Input Validation (CWE-20) in vLLM ImageIO
CVE-2026-102649
Missing Authentication (CWE-306) in Burrito Webhook
CVE-2026-115912
Unsafe Deserialization (CWE-502) in vLLM Multimodal
CVE-2026-115908
Path Traversal (CWE-22) in Rust zip Archive Extraction
CVE-2026-115418
SQL Injection (CWE-89) in AWS CDK Redshift Component
CVE-2026-107091
Code Injection (CWE-94) in HUION Driver Installer DLL
CVE-2026-106677
CVE-2026-90885
XXE (CWE-611) in Apache Camel Saxon Component Module
CVE-2026-36698
CVE-2026-31158
SQL Injection (CWE-89) in SOFTTRADE CRM Login Page
CVE-2026-106781
Improper Privilege Management (CWE-269) in CH341SER
CVE-2026-116485
Authentication Bypass (CWE-306) in danmu_api Config
CVE-2026-116219
OS Command Injection (CWE-78) in Dolibarr export.php
CVE-2026-116218
SQL Injection (CWE-89) in Dolibarr BankAccount API
CVE-2026-115193
Stored XSS (CWE-79) in Mautic Contact Detail View UI
CVE-2026-115192
SQL Injection (CWE-89) in Mautic Dashboard API Endpoint
CVE-2026-115191
SQL Injection (CWE-89) in Mautic AJAX Contact Lookup
CVE-2026-115190
PHP Object Injection (CWE-502) in Mautic Segment Filters
CVE-2026-115188
Unrestricted File Upload (CWE-434) in Mautic Imports
CVE-2026-107092
Directory Traversal (CWE-22) in NexoPOS Update API
CVE-2026-115717
SSRF (CWE-918) in Frappe Builder WebP Conversion API
CVE-2026-116257
Missing Authentication (CWE-306) in BillaBear Installer
CVE-2026-116256
Server-Side Request Forgery (CWE-918) in RhaPHP Mp Proxy
CVE-2026-116112
SQL Injection (CWE-89) in edoc-doctor admin/add-new.php
CVE-2026-116110
Auth Bypass (CWE-287) in GiantappMan LiveWallPaper
CVE-2026-116106
Improper Access Control (CWE-284) in HeyCyan FileProvider
CVE-2026-116094
Server-Side Request Forgery (CWE-918) in EyouCMS function.php
CVE-2026-116062
SQL Injection (CWE-89) in SourceCodester OPILS System
CVE-2026-116061
SQL Injection (CWE-89) in SourceCodester edit_dealer.php
CVE-2026-116060
SQL Injection (CWE-89) in Performance Indicator System
CVE-2026-115823
CVE-2026-116211
SQL Injection (CWE-89) in YesWiki PageManager::save()
CVE-2026-116208
Missing Authorization (CWE-862) in YesWiki ActivityPub
CVE-2026-116207
SQL Injection (CWE-89) in YesWiki Search API Endpoint
CVE-2026-116204
Cross-Site Request Forgery (CWE-352) in YesWiki Despam
CVE-2026-116199
Authentication Bypass (CWE-285) in Snipe-IT Google SSO
CVE-2026-116191
Path Traversal (CWE-22) in Rclone WebDAV Server Endpoint
CVE-2026-116183
Object-Level Authorization Bypass (CWE-639) in phpMyFAQ
CVE-2026-116176
SSRF (CWE-918) in vLLM P2pNcclConnector Worker API
CVE-2026-116171
Path Traversal (CWE-22) in SiYuan Windows Import API
CVE-2026-116163
Authentication Bypass (CWE-287) in Parse Server Auth
CVE-2026-116068
Authorization Bypass (CWE-639) in Dokploy Multi-Tenant
CVE-2026-116067
Path Traversal (CWE-22) in Paisa Backup File Endpoints
CVE-2026-116050
SQL Injection (CWE-89) in Employee Registration Form
CVE-2026-116049
SQL Injection (CWE-89) in EmployeeRecruitmentSystem
CVE-2026-116048
SQL Injection (CWE-89) in EmployeeRecruitment Registration
CVE-2026-116006
Improper Authentication (CWE-287) in ruoyi-vue-pro SMS
CVE-2026-116000
SSRF (CWE-918) in PrivateGPT URI Artifact Loader API
CVE-2026-115932
Path Traversal (CWE-22) in Postiz Media Publishing
CVE-2026-116009
Path Traversal (CWE-22) in Camaleon CMS Media Action
CVE-2026-115931
Improper File Handling (CWE-73) in Postiz Backend API
CVE-2026-115935
CRLF Injection (CWE-94) in Craft API Response Headers
CVE-2026-115895
Code Injection (CWE-94) in Happy DOM ESM Module Compiler
CVE-2026-65825
Online PIN Brute Force (CWE-307) in OpenReception Booking
CVE-2026-79977
Unauthenticated Endpoint Update (CWE-346) in WireGuard
CVE-2026-112342
Authorization Bypass (CWE-863) in Tandoor Recipes App
CVE-2026-115810
SSRF (CWE-918) in Tandoor Recipes Pestle Importer Workflow
CVE-2026-57845
Unsafe Deserialization (CWE-502) in Hugging Face Datasets
CVE-2026-52356
OS Command Injection (CWE-78): DAP1160L diagnostic.php
CVE-2025-45528
Code Injection (CWE-94) in Nitro PDF Pro for macOS App
CVE-2026-55486
Reflected XSS (CWE-79) in Goobi viewer Auth Endpoints
CVE-2026-55459
Improper Authentication (CWE-287) in Goobi Viewer App
CVE-2026-55457
Authentication Bypass (CWE-287) in Goobi Viewer Web API
CVE-2026-53942
Code Injection (CWE-94) in Conda GitHub Actions Workflow
CVE-2026-46652
Path Traversal (CWE-22) in Goobi Viewer Downloader
CVE-2026-46651
Missing Authentication (CWE-306) in Goobi WebSocket
CVE-2026-39902
OS Command Injection (CWE-78) in Cacti Web Framework
CVE-2026-106765
CVE-2026-106764
Code Injection (CWE-94) in @rog0x/mcp-git-tools Package
CVE-2026-106763
OS Command Injection (CWE-78) in SageMath MCP Server
CVE-2026-115457
Stored XSS (CWE-79) in baserCMS Comment Shortcode
CVE-2026-114624
Unsafe Deserialization (CWE-502) in baserCMS Widgets
CVE-2026-114622
Path Traversal (CWE-22) in baserCMS Theme File Plugin
CVE-2026-114621
SQL Injection (CWE-89) in baserCMS Admin API Paths
CVE-2026-63120
Path Traversal (CWE-22) in pghoard Backup Restore Tool
CVE-2026-57146
Missing Authentication (CWE-306) in PraisonAI A2U Routes
CVE-2026-57142
Command Injection (CWE-78) in PraisonAI Recipe Runner
CVE-2026-57121
Improper Authorization (CWE-285) in PraisonAI Platform
CVE-2026-57117
OS Command Injection (CWE-78) in PraisonAI Compute
CVE-2026-57116
Missing Authentication (CWE-306) in PraisonAI AgentOS
CVE-2026-57114
SSRF Validation Bypass (CWE-918) in PraisonAI Webhooks
CVE-2026-57113
Path Traversal (CWE-22) in PraisonAI Template Cache
CVE-2026-56840
Stored XSS (CWE-79) in PraisonAI Approval Dashboard
CVE-2026-56838
Command Injection (CWE-78) in PraisonAI Stream Path
CVE-2026-56837
Missing Webhook Authentication (CWE-306) in PraisonAI
CVE-2026-56836
Missing Authentication (CWE-306) in PraisonAI Recipe
CVE-2026-56835
Missing Authorization (CWE-862) in PraisonAI Slack Bot
CVE-2026-56834
Path Traversal (CWE-22) in PraisonAI Artifact Toolkit
CVE-2026-56833
Path Traversal (CWE-22) in PraisonAI Dynamic Context
CVE-2026-56832
Improper Authorization (CWE-863) in PraisonAI Discord
CVE-2026-115726
OS Command Injection (CWE-78) in Aider Configuration
CVE-2026-25784
Insecure Default (CWE-1188) in BlueSpice Container
CVE-2026-54630
Unrestricted File Upload (CWE-434) in Part-DB Attachments
CVE-2026-92450
Hardcoded Credentials (CWE-798) in Kiloview E3 NDI
CVE-2026-110825
Missing Authentication (CWE-306) in Kiloview E3 ONVIF
CVE-2026-110243
OS Command Injection (CWE-78) in Kiloview E3 NDI Service
CVE-2026-107861
OS Command Injection (CWE-78) in Kiloview E3 Firmware
CVE-2026-114616
Improper Authentication (CWE-287) in Authlib HMAC
CVE-2026-111594
Cleartext Transmission (CWE-319) in InterSystems IRIS
CVE-2026-109122
OS Command Injection (CWE-78) in Kiloview E3 NDI Encoder
CVE-2026-115506
XML Entity Expansion (CWE-776) in libexpat XML Parser
CVE-2026-115414
OS Command Injection (CWE-78) in AWS SAM Terraform
CVE-2026-115384
Stack Buffer Overflow (CWE-20) in Wasmtime Async Callbacks
CVE-2026-115376
Authorization Bypass (CWE-284) in Incus Custom Volumes
CVE-2026-115375
Path Traversal (CWE-22) in Incus Instance Backup Import
CVE-2026-115371
Improper Authorization (CWE-522) in Incus Storage Buckets
CVE-2026-115355
Path Traversal (CWE-22) in Mistune Include Directive
CVE-2026-115353
Path Traversal (CWE-22) in Mistune RST Include Directive
CVE-2026-114612
Privilege Escalation (CWE-269) in LiteLLM AI Proxy
CVE-2025-65200
Script Injection (CWE-79) in LocalStack Deploy Endpoint
CVE-2026-97635
Stored Cross-Site Scripting (CWE-79) in Agent Zero UI
CVE-2026-114611
Improper Certificate Validation (CWE-295) in OCO MDM
CVE-2026-113874
Improper Authorization (CWE-863) in SmileCDR HAPI FHIR
CVE-2026-115513
Stored XSS (CWE-79) in OpenCATS MRU Navigation Panel
CVE-2026-114607
Authentication Bypass (CWE-287) in Better Auth Magic Link
CVE-2026-51954
CVE-2026-61791
Stored XSS (CWE-83) in OCO-Server Command Button UI
CVE-2026-114510
Cypher Injection (CWE-943) in Flexible GraphRAG Adapter
CVE-2026-92709
Path Traversal (CWE-22) in rsyslog omfile dynaFile facility
CVE-2026-115332
SQL Injection (CWE-89) in Lotus Subscription Filters
CVE-2026-115331
SQL Injection (CWE-89) in Lotus Billable Metric Queries
CVE-2026-115330
SQL Injection (CWE-89) in Lotus Custom Metrics API Endpoint
CVE-2026-115328
SQL Injection (CWE-89) in JSON-SCADA History Read API
CVE-2026-115325
Authorization Bypass (CWE-639) in Netmaker Ext Clients
CVE-2026-115324
SQL Injection (CWE-89) in mem0 Databricks SQL Store
CVE-2026-115323
Missing Authorization (CWE-862) in EverShop Address API
CVE-2025-71434
SQL Injection (CWE-89) in Weaver E-cology API Endpoint
CVE-2024-58396
Path Traversal (CWE-22) in YouDataSum CPAS Audit V4
CVE-2024-58393
SQL Injection (CWE-89) in i-Netsolution Ecommerce Platform
CVE-2022-51024
Path Traversal (CWE-22) in Kavita Cover Upload API
CVE-2022-51023
SQL Injection (CWE-89) in PHPOK Project API Endpoint
CVE-2022-51022
Path Traversal (CWE-22) in YiShaAdmin File Download
CVE-2022-51021
SQL Injection (CWE-89) in NotificationX WordPress Plugin
CVE-2021-48017
Path Traversal (CWE-22) in OrbiTeam BSCW Server 5.x
CVE-2021-48016
PHP Code Injection (CWE-94) in DedeCMS ShowMsg() Path
CVE-2021-48015
Path Traversal (CWE-22) in JeeWMS File Download Handler
CVE-2021-48014
Path Traversal (CWE-22) in FineReport 9.0 WebReport
CVE-2021-48013
Path Traversal (CWE-22) in Weaver E-cology 8.0 File Download
CVE-2019-25779
Path Traversal (CWE-22) in WooThemes Diarise Plugin
CVE-2019-25778
SQL Injection (CWE-89) in SeaCMS Comment API Endpoint
CVE-2018-25439
Path Traversal (CWE-22) in MetInfo CMS thumb.php Endpoint
CVE-2018-25438
Path Traversal (CWE-22) in Group-Office compress.php
CVE-2017-20287
Path Traversal (CWE-22) in Javo Spot WordPress Theme
CVE-2026-114730
SSRF Filter Bypass (CWE-918) in Roundcube Webmail URL Filter
CVE-2026-114724
PHP Object Injection (CWE-502) in Roundcube Sessions
CVE-2026-114664
Blind SQL Injection (CWE-89) in Frappe Framework get_events
CVE-2026-114662
CSRF (CWE-352) in Obot CLI Authentication Login Flow
CVE-2026-114661
Missing Authorization (CWE-862) in OpenRemote Gateway
CVE-2026-114658
Improper Authorization (CWE-269) in Grav Login Plugin
CVE-2026-114642
Improper Certificate Validation (CWE-295) in Traefik
CVE-2026-114639
Authentication Bypass (CWE-287) in Traefik Backend
CVE-2026-114638
Improper Authentication (CWE-287) in Traefik K8s Provider
CVE-2026-114636
Access-Control Bypass (CWE-306) in Traefik K8s Ingress
CVE-2026-114577
SQL Injection (CWE-89) in php-travel-agency-system Admin
CVE-2026-114575
Command Injection (CWE-77) in TOTOLINK A950RG Module
CVE-2026-114441
SQL Injection (CWE-89) in PHP Travel Agency admin/update.php
CVE-2026-114440
SQL Injection (CWE-89) in PHP Travel Agency Admin Panel
CVE-2026-114439
Missing Authentication (CWE-287) in php-travel-agency-system
CVE-2026-29001
PHP Object Injection (CWE-502) in TastyIgniter Admin
CVE-2026-114135
Authorization Bypass (CWE-862) in Jupyter Server Gateway
CVE-2026-114267
Missing Authorization (CWE-862) in Food Order System
CVE-2026-114493
SSRF (CWE-918) in LocalAI Gallery URL Validation Logic
CVE-2026-114263
SQL Injection (CWE-89) in ProjectWorlds Report Search
CVE-2026-114262
Unrestricted Upload (CWE-434) in File Management System
CVE-2026-114261
Missing Authentication (CWE-287) in MomoTommy Files API
CVE-2026-114259
Unrestricted Upload (CWE-434) in File Management PHP
CVE-2026-114258
SQL Injection (CWE-89) in File Management System PHP
CVE-2026-114123
Missing Authentication (CWE-306) in D365 F&O MCP Server
CVE-2026-114463
Authorization Bypass (CWE-863) in Hermes Gateway API
CVE-2026-114257
SQL Injection (CWE-89) in file-management-system-php
CVE-2026-114256
SQL Injection (CWE-89) in File Management System Folders
CVE-2026-114255
SQL Injection (CWE-89) in File Management System PHP
CVE-2026-114254
SQL Injection (CWE-89) in File Management System PHP
CVE-2026-113779
Privilege Escalation (CWE-502) in pfSense REST API
CVE-2026-114249
Improper Authorization (CWE-285) in Policy Holder Form
CVE-2026-86249
Authentication Bypass (CWE-287) in brpc HTTP Server
CVE-2026-114403
Unsafe Deserialization (CWE-502) in PHPPresentation
CVE-2026-114391
Authorization Bypass (CWE-863) in ZenTao PMS AJAX Methods
CVE-2026-114387
Missing Authorization (CWE-862) in Shopper Admin Panel
CVE-2026-114245
Improper Authorization (CWE-285) in Insurance Admin Form
CVE-2026-114243
SQL Injection (CWE-89) in Insurance Management System
CVE-2026-114242
SQL Injection (CWE-89) in Insurance Management System
CVE-2026-114109
Path Traversal (CWE-22) in uv Python Wheel Installer
CVE-2026-114108
Missing Authentication (CWE-306) in Vibe-Trading API
CVE-2026-114106
Path Traversal (CWE-22) in HKUDS Vibe-Trading Agent
CVE-2026-114098
Path Traversal (CWE-22) in Dulwich stash.py pop() Logic
CVE-2026-114097
Path Traversal (CWE-22) in Dulwich Branch Filter API
CVE-2026-114094
Path Traversal (CWE-22) in Dulwich Git Checkout on Windows
CVE-2026-114090
Missing Authentication (CWE-306) in Trigger.dev CLI
CVE-2026-114089
Cross-Site Request Forgery (CWE-352) in Trigger.dev CLI
CVE-2026-114085
Missing Auth (CWE-306) in Trigger.dev Supervisor API
CVE-2026-114084
SQL Injection (CWE-89) in Trigger.dev Realtime API
CVE-2026-114083
Path Traversal (CWE-22) in Trigger.dev Packets API
CVE-2026-114082
Missing Authorization (CWE-862) in Trigger.dev Streams
CVE-2026-114081
SQL Injection (CWE-89) in Trigger.dev TSQL Compiler
CVE-2026-114078
Authorization Bypass (CWE-639) in Trigger.dev Schedules
CVE-2026-114077
Authorization Bypass (CWE-639) in Trigger.dev Deployments
CVE-2026-114069
Improper Authorization (CWE-269) in Trigger.dev Envvars
CVE-2026-114068
Broken Access Control (CWE-639) in Trigger.dev Waitpoints
CVE-2026-114066
Missing Authorization (CWE-639) in Trigger.dev Batches
CVE-2026-114063
Path Traversal (CWE-22) in SvelteKit Preview Server
CVE-2026-114059
Improper Authorization (CWE-863) in ArcadeDB Gremlin
CVE-2026-114053
Code Injection (CWE-94) in vLLM Dynamic Processor Code
CVE-2026-113736
Empty Password (CWE-258) in D-Link DHP-W610AV HNAP
CVE-2026-113776
Command Injection (CWE-78) in virtualenv Activation
CVE-2026-113732
Command Injection (CWE-78) in virtualenv FishActivator
CVE-2026-113728
SSRF (CWE-918) in Bulwark Webmail iCal Fetch Endpoint
CVE-2026-113727
Insecure Direct Object Reference (CWE-639) in OpenChoreo
CVE-2026-113726
Command Injection (CWE-78) in virtualenv zsh Prompt
CVE-2026-113704
SSRF (CWE-918) in a2a-rs Push Notification Handler
CVE-2016-20104
Path Traversal (CWE-22) in EyeLock nano NXT Devices
CVE-2016-20103
Path Traversal (CWE-22) in Cherry WordPress Plugin
CVE-2016-20100
Path Traversal (CWE-22) in Memphis Documents WordPress
CVE-2015-20128
SQL Injection (CWE-89) in FooSun DotNetCMS Web App
CVE-2015-20125
Path Traversal (CWE-22) in Aspose PDF Exporter WordPress
CVE-2015-20124
Path Traversal (CWE-22) in Aspose WordPress Exporter
CVE-2015-20123
Path Traversal (CWE-22) in Aspose Doc Exporter WordPress
CVE-2014-125134
Path Traversal (CWE-22) in ChurcHope WordPress Theme
CVE-2014-125133
Path Traversal (CWE-22) in NativeChurch WordPress Theme
CVE-2012-20002
Path Traversal (CWE-22) in TinyMCE Thumbnail Gallery
CVE-2026-113725
Command Injection (CWE-78) in virtualenv Activation
CVE-2026-113722
OS Command Injection (CWE-78) in virtualenv Launchers
CVE-2026-112380
Missing Authorization (CWE-862) in Kiro Crew WhatsApp
CVE-2026-111767
Broken Access Control (CWE-639) in MCP TypeScript taskStore
CVE-2026-113802
OS Command Injection (CWE-78) in Wavlink WL-WN530BE1-A
CVE-2026-113672
Path Traversal (CWE-22) in Argo CD repo-server JSONnet
CVE-2026-113506
OS Command Injection (CWE-78) in aaPanel File Manager
CVE-2026-113682
Authentication Bypass (CWE-287) in light-4j BasicAuth
CVE-2026-113613
Path Traversal (CWE-22) in FlexGet Decompress Plugin
CVE-2026-113606
Authorization Bypass (CWE-639) in Stirling-PDF Storage
CVE-2026-111765
Credential Leakage (CWE-522) in A2A Android Client
CVE-2026-111764
Missing Authorization (CWE-862) in A2A Java Task Store
CVE-2026-95168
Code Injection (CWE-94) in thefuck CLI Rule Loading
CVE-2026-113397
OS Command Injection (CWE-74) in DrayTek Vigor2960
CVE-2026-113396
OS Command Injection (CWE-77) in DrayTek Vigor2960
CVE-2026-113395
Path Traversal (CWE-22) in DrayTek Vigor2960 CGI Handler
CVE-2026-113394
Path Traversal (CWE-22) in DrayTek Vigor2960 Router
CVE-2026-113392
Path Traversal (CWE-22) in DrayTek Vigor2960 Apmupload
CVE-2026-113391
OS Command Injection (CWE-77) in Vigor2960 Upload Endpoint
CVE-2026-113390
OS Command Injection (CWE-78) in DrayTek Vigor2960
CVE-2026-105941
SSRF (CWE-918) in Kroxylicious Azure Key Vault KMS
CVE-2026-113389
OS Command Injection (CWE-77) in DrayTek Vigor2960
CVE-2026-105949
Auth Bypass (CWE-287) in Cruise Control Admin APIs
CVE-2026-113358
Missing Authentication (CWE-306) in LavaLite Filer
CVE-2026-113356
PHP Object Injection (CWE-502) in DokuWiki Draft Handling
CVE-2026-113352
Path Traversal (CWE-22) in uTox File Transfer Module
CVE-2026-92287
Improper Input Validation (CWE-20) in Parquet KMS Client
CVE-2026-86467
Login CSRF (CWE-352) in Apache Airflow AWS SAML Auth
CVE-2026-105299
Header Confusion (CWE-444) in Pingora Proxy Gateway
CVE-2026-77937
Authentication Bypass (CWE-639) in Letta API Server
CVE-2026-77935
IDOR (CWE-639) in Coze Studio Workflow API Route Access
CVE-2026-77932
Missing Authentication (CWE-306) in DB-GPT Agent API
CVE-2026-77930
Improper Authorization (CWE-862) in EvoScientist Agent
CVE-2026-75128
Missing Authentication (CWE-306) in Langchain-Chatchat
CVE-2026-109444
Authorization Bypass (CWE-862) in OpenSRE Presenter
CVE-2026-109442
Unauthenticated RCE (CWE-306) in piflow Chat Agent API
CVE-2026-112371
Code Injection (CWE-94) in H3C Magic NX15 RPC Interface
CVE-2026-112370
OS Command Injection (CWE-78) in H3C Magic NX15 usrlist
CVE-2026-53995
Path Traversal (CWE-22) in MLflow FileStore Backend
CVE-2026-112900
Argument Injection (CWE-88) in Pillow EPS Handler Plugin
CVE-2026-112301
OS Command Injection (CWE-78) in imagemagick-php Font
CVE-2026-112778
Improper Authorization (CWE-862) in Traefik Kubernetes
CVE-2026-112776
Authorization Bypass (CWE-863) in Craft CMS GraphQL
CVE-2026-112775
Authentication Bypass (CWE-287) in Craft CMS Accounts
CVE-2026-112774
Code Injection (CWE-94) in Craft CMS Field Layout UI
CVE-2026-112773
Code Injection (CWE-94) in Craft CMS Twig Sandbox RCE
CVE-2026-112772
Code Injection (CWE-94) in Craft CMS Twig Sandbox Escape
CVE-2026-112770
Code Injection (CWE-94) in Craft CMS Twig Group Filter
CVE-2026-112252
SQL Injection (CWE-89) in Wubang Five-in-One /ws.asmx
CVE-2026-109437
Unauthenticated RCE (CWE-306) in Cognition REST API
CVE-2026-107084
CSRF (CWE-352) in Slims Admin Loan History Actions
CVE-2026-107083
SQL Injection (CWE-89) in SLiMS Reporting Details
CVE-2026-107082
SQL Injection (CWE-89) in Slims 9 Bulian Bibliography
CVE-2026-112308
SSRF Vulnerability (CWE-918) in CrewAI Selenium Tool
CVE-2026-112307
PHP Code Injection (CWE-94) in sqlparse OutputPHPFilter
CVE-2026-112306
SQL Injection (CWE-89) in NocoBase Collection Plugin
CVE-2026-112304
Unsafe Deserialization (CWE-502) in docTR Checkpoints
CVE-2026-112153
SQL Injection (CWE-89) in Criminal Management Officer
CVE-2026-112152
SQL Injection (CWE-89) in Criminal Management Search
CVE-2026-111058
Missing Authorization (CWE-862) in Mercury Kernels
CVE-2026-111057
Regex Blocklist Bypass (CWE-185) in Mercury Jupyter
CVE-2026-107081
SQL Injection (CWE-89) in SLiMS Bulian AJAX Endpoints
CVE-2026-112151
SQL Injection (CWE-89) in Criminal Management System
CVE-2026-112150
SQL Injection (CWE-89) in Criminal-Management-System
CVE-2026-112149
Unrestricted Upload (CWE-434) in Criminal-Management-System
CVE-2026-112292
Missing Authorization (CWE-862) in CheckCle PocketBase
CVE-2026-112287
Broken Object Authorization (CWE-639) in Krayin CRM Email
CVE-2026-112264
Command Injection (CWE-78) in BentoML Docker Builds
CVE-2026-112263
OS Command Injection (CWE-78) in Television format_command
CVE-2026-112262
Missing Authorization (CWE-862) in RisingWave Files
CVE-2026-112146
Hard-Coded Credentials (CWE-798) in D-Link MQTT Broker
CVE-2026-112143
Missing Auth (CWE-306) in Events-Management-System
CVE-2026-112142
SQL Injection (CWE-89) in Events-Management dodelete.php
CVE-2026-112141
SQL Injection (CWE-89) in Events-Management-System
CVE-2026-88900
Unsafe Deserialization (CWE-502) in Apache Camel JGroups
CVE-2026-112139
SQL Injection (CWE-89) in Clinic Admin Mutation Handler
CVE-2026-88901
XML External Entity (CWE-611) in Apache Camel Smooks
CVE-2026-85251
Sensitive Information Exposure (CWE-200) in Camel HTTP
CVE-2026-85250
XML External Entity (CWE-611) in Apache Camel XPath
CVE-2026-83531
Code Injection (CWE-94) in Apache Camel Dynamic Router
CVE-2026-80344
SSRF (CWE-918) in Apache Camel AS2 Messaging Component
CVE-2026-80312
Improper Authentication (CWE-287) in Apache Camel OAuth
CVE-2026-79986
Path Traversal (CWE-22) in Apache Camel Azure Files
CVE-2026-79985
Path Traversal (CWE-22) in Apache Camel SMB Component
CVE-2026-79984
Path Traversal (CWE-22) in Apache Camel Mina SFTP Component
CVE-2026-79983
Path Traversal (CWE-22) in Apache Camel FTP Component
CVE-2026-78165
Unsafe Deserialization (CWE-502) in Camel Redis Component
CVE-2026-78164
Template Injection (CWE-1336) in Apache Camel HTTP Components
CVE-2026-78162
Unsafe Deserialization (CWE-502) in Apache Camel Hazelcast
CVE-2026-112104
Missing Authentication (CWE-287) in Bandcamp Remote Server
CVE-2026-112044
Improper Authentication (CWE-287) in eShop Catalog API
CVE-2026-112025
Improper Access Control (CWE-284) in Light0011 Captcha
CVE-2026-109553
CVE-2026-107618
CSRF (CWE-352) in Repository Topics Management Route
CVE-2024-4457
OS Command Injection (CWE-78) in WSO2 Management Console
CVE-2026-111990
SQL Injection (CWE-89) in Hospital Management System
CVE-2026-78497
Code Injection (CWE-95) in JQ::Lite Perl Query Engine
CVE-2026-112015
Path Traversal (CWE-22) in Omnigent Agent Bundles
CVE-2026-112005
Path Traversal (CWE-22) in WhoDB Query Editor Access
CVE-2026-112001
Incorrect Authorization (CWE-863) in ProjectSend API
CVE-2026-112000
Missing Authorization (CWE-862) in Vanus Gateway APIs
CVE-2026-111999
Missing Authentication (CWE-306) in Vanus Event Gateway
CVE-2026-111873
SQL Injection (CWE-89) in Online Exam System AJAX Endpoint
CVE-2026-111872
SQL Injection (CWE-89) in Online-Examination-System
CVE-2026-111871
SQL Injection (CWE-89) in Online-Examination-System
CVE-2026-111866
SQL Injection (CWE-89) in nemoTyrant manong func.php
CVE-2026-111927
Improper Hostname Validation (CWE-522) in Coder Platform
CVE-2026-111911
Authentication Bypass (CWE-287) in phpMyFAQ WebAuthn
CVE-2026-111909
Missing Authorization (CWE-269) in phpMyFAQ User API
CVE-2026-111908
Broken Object Authorization (CWE-639) in phpMyFAQ API
CVE-2026-111907
CSRF (CWE-352) in phpMyFAQ Database Migration API Endpoint
CVE-2026-111898
Authentication Bypass (CWE-287) in phpMyFAQ Keycloak
CVE-2026-111897
Authorization Bypass (CWE-862) in phpMyFAQ Attachments
CVE-2026-111884
Missing Reauthentication (CWE-308) in phpMyFAQ Users
CVE-2026-111882
Authentication Bypass (CWE-287) in phpMyFAQ SSO Callbacks
CVE-2026-111110
Stored XSS (CWE-79) in GetPaid Invoice Forms Plugin
CVE-2026-110757
CSV Record Splitting (CWE-116) in Text::CSV_XS Perl
CVE-2026-110756
Improper Output Neutralization (CWE-116) in Text::CSV_XS
CVE-2026-96627
Improper Privilege Management (CWE-266) in Arcane Users
CVE-2026-96626
Credential Exposure (CWE-522) in Arcane Registry API
CVE-2026-49410
Cross-Site Request Forgery (CWE-352) in OpenHuman Desktop App
CVE-2026-111044
Improper Authorization (CWE-863) in Sunshine Pairing
CVE-2026-108374
Missing Authorization (CWE-862) in ERPNext Status APIs
CVE-2026-61726
Broken Access Control (CWE-284) in Tandoor Recipes API
CVE-2026-59970
Server-Side Request Forgery (CWE-918) in Tandoor AI
CVE-2026-59963
Broken Object Authorization (CWE-639) in Tandoor Recipes
CVE-2026-30971
OS Command Injection (CWE-78) in ZoneMinder Control
CVE-2026-102608
OS Command Injection (CWE-78) in ZoneMinder Events
CVE-2026-102607
OS Command Injection (CWE-78) in ZoneMinder Export
CVE-2026-111723
Missing Authorization (CWE-862) in LingGuo-Drama Admin API
CVE-2026-111722
IDOR (CWE-639) in LingGuo-Drama Project API Endpoints
CVE-2026-111708
Authentication Bypass (CWE-269) in WhaTicket Signup
CVE-2026-111706
Missing Authentication (CWE-306) in 99AI Chat Export
CVE-2026-111704
Missing Authentication (CWE-306) in LangChat REST API
CVE-2026-111702
IDOR (CWE-639) in ChatOllama Knowledge Base Access APIs
CVE-2026-111701
Missing Authentication (CWE-306) in OtterMind Nubase
CVE-2026-111700
SQL Injection (CWE-89) in WebVella ERP EQL Query API
CVE-2026-111695
IDOR (CWE-639) in Shaiwz data-platform Datasources
CVE-2026-111687
Code Injection (CWE-95) in WeRSS RSS Template Engine
CVE-2026-111686
SQL Injection (CWE-89) in IceCMS Article API Endpoint
CVE-2026-111685
SQL Injection (CWE-89) in IceCMS Resource Endpoint
CVE-2026-111684
Authorization Bypass (CWE-639) in Magistrala Certs
CVE-2026-111681
Missing Authorization (CWE-862) in EFAK User Management API
CVE-2026-111680
Authorization Bypass (CWE-639) in APIPark Team APIs
CVE-2026-111675
Authentication Bypass (CWE-307) in Course-tencent-cloud
CVE-2026-111673
Missing Authentication (CWE-306) in IceCMS User API
CVE-2026-111671
IDOR (CWE-639) in Cube-studio Notebook Lifecycle APIs
CVE-2026-111663
SSRF (CWE-918) in Chaskiq GraphQL Upload Handler Flaw
CVE-2026-111650
Missing Authentication (CWE-306) in ChronoFrame API
CVE-2026-111644
Missing Authentication (CWE-306) in Misaka Danmu Server
CVE-2026-111643
Authentication Bypass (CWE-306) in Misaka Danmu Server
CVE-2026-111641
Missing Authentication (CWE-306) in FastapiAdmin App
CVE-2026-111639
Authentication Bypass (CWE-287) in bbs-go Google Login
CVE-2026-111638
Missing Authorization (CWE-862) in sshportal Shell
CVE-2026-111634
SQL Injection (CWE-89) in Helical Insight Reporting
CVE-2026-111627
Authorization Bypass (CWE-863) in HestiaCP Cron API
CVE-2026-111626
Authentication Bypass (CWE-306) in Damselfly API Routes
CVE-2026-111613
Missing Authentication (CWE-306) in AllData JDBC API
CVE-2026-111607
IDOR (CWE-639) in Jeepay Merchant Payment Configuration
CVE-2026-111606
Missing Authorization (CWE-862) in Huly Person Merge
CVE-2026-111605
Authorization Bypass (CWE-639) in Jpom SSH File Controller
CVE-2026-109587
Incorrect Authorization (CWE-863) in FreeRTOS MPU Port
CVE-2026-97380
Authorization Bypass (CWE-863) in MariaDB GRANT PROXY
CVE-2026-86047
SQL Injection (CWE-89) in MariaDB SQL Serialization
CVE-2026-86008
Privilege Escalation (CWE-269) in Mailu Domain Admin
CVE-2026-57169
Missing Authentication (CWE-306) in Dockhand Terminal
CVE-2026-92263
OS Command Injection (CWE-78) in SparkyFitness Backup
CVE-2026-57488
Integer Overflow (CWE-190) in pupnp HTTP Request Parser
CVE-2026-48503
Integer Underflow (CWE-191) in libIEC61850 MMS File Service
CVE-2026-44977
Stored XSS (CWE-79) in Countly Star-Rating Plugin Component
CVE-2026-42269
Path Traversal (CWE-22) in Countly Data Migration Route
CVE-2026-41582
Path Traversal (CWE-22) in Countly Public Image Routes
CVE-2026-97851
Missing Authorization (CWE-862) in DICOM Storage API
CVE-2026-95183
Prompt Injection (CWE-94) in DeepSeek Harness dsh Feature
CVE-2026-88755
OS Command Injection (CWE-78) in Z.ai ZCode MCP Workspace
CVE-2026-106705
Improper Access Control (CWE-284) in ELADMIN Roles
CVE-2026-105667
Missing Authentication (CWE-306) in HL7 Archive Listener
CVE-2026-105279
Missing Authentication (CWE-306) in DICOM Image Archive
CVE-2026-107617
Hard-Coded Credentials (CWE-798) in EseeCloud Devices
CVE-2026-111391
Code Injection (CWE-95) in SGLang Dumper Filter Endpoint
CVE-2026-109193
Stored XSS (CWE-79) in HivePress WP Directory Plugin
CVE-2026-111122
Stored DOM XSS (CWE-79) in SiteOrigin WordPress CSS
CVE-2026-107764
Stored XSS (CWE-79) in SiteOrigin CSS WordPress Plugin
CVE-2026-110590
Authorization Bypass (CWE-862) in Klarna WooCommerce
CVE-2026-109221
Path Traversal (CWE-22) in Groundhogg WordPress Plugin
CVE-2026-111451
Command Injection (CWE-78) in Wheels CLI Deployment Tooling
CVE-2026-111446
Improper Authorization (CWE-863) in Wheels Dev Tools
CVE-2026-111444
SQL Injection (CWE-89) in Wheels MySQL Query Paths
CVE-2026-111389
SQL Injection (CWE-89) in Frappe HRMS API Endpoints
CVE-2026-111210
SSRF (CWE-918) in bitcoinj Payment Request Handler Code
CVE-2026-111369
Incorrect Authorization (CWE-863) in ClassroomIO Lessons
CVE-2026-111366
Authorization Bypass (CWE-639) in cool-admin-midway
CVE-2026-111359
Insecure Direct Object Reference (CWE-639) in CRMEB API
CVE-2026-111356
Insufficient Rate Limiting (CWE-307) in MacCMS Reset
CVE-2026-111352
Improper Authorization (CWE-863) in ThinkCMF REST API
CVE-2026-111322
Missing Authentication (CWE-306) in Archon Control API
CVE-2026-111312
Missing Authentication (CWE-306) in OpenHealth API
CVE-2026-111277
Missing Authorization (CWE-862) in NivoCart Invoices
CVE-2026-105040
Mass Assignment (CWE-639) in Eilik NestJS Auth Service
CVE-2026-105039
Missing Authorization (CWE-862) in EnergizeLab Middleware
CVE-2026-105038
Missing Authentication (CWE-306) in Eilik AI Services
CVE-2026-105037
External File Path Control (CWE-73) in station-middleware
CVE-2026-105034
Improper Authentication (CWE-287) in Eilik NestJS Auth
CVE-2026-105033
Hardcoded Credentials (CWE-798) in EnergizeLab AI Station
CVE-2026-105032
Path Traversal (CWE-22) in Eilik AI Skill Upload Service
CVE-2026-106708
CSRF (CWE-352) in XXL-JOB User Management Endpoints
CVE-2026-106700
Missing Authorization (CWE-862) in ELADMIN User API
CVE-2026-57496
Path Traversal (CWE-22) in NetLicensing MCP Service
CVE-2026-55872
Stored XSS (CWE-79) in GYM One Admin User Interface
CVE-2026-55239
SQL Injection (CWE-89) in Tianji Analytics Queries API
CVE-2026-36436
Plaintext LDAP Credentials (CWE-522) in BRPerfX Admin
CVE-2026-111235
Authorization Bypass (CWE-862) in OpenNMS REST API
CVE-2026-111231
Authorization Bypass (CWE-863) in pfSense CE WebGUI
CVE-2026-111229
OS Command Injection (CWE-78) in pfSense Captive Portal
CVE-2026-111226
OS Command Injection (CWE-78) in pfSense WebGUI Settings
CVE-2026-111224
OS Command Injection (CWE-78) in pfSense OpenVPN Script
CVE-2026-111223
Configuration Injection (CWE-74) in pfSense IPsec Mobile
CVE-2026-111218
OS Command Injection (CWE-78) in Netgate pfSense CE
CVE-2026-111217
OS Command Injection (CWE-78) in pfSense CARP VHID
CVE-2026-111216
OS Command Injection (CWE-78) in pfSense Gateway Monitor
CVE-2026-111215
OS Command Injection (CWE-78) in pfSense Wireless
CVE-2026-111214
OS Command Injection (CWE-78) in pfSense QinQ Editor
CVE-2026-111160
Unsafe Deserialization (CWE-502) in LightLLM API Endpoint
CVE-2026-109383
Improper Certificate Validation (CWE-295) in undici
CVE-2026-104828
Cross-Site Scripting (CWE-79) in HtmlUnit Neko Parser
CVE-2026-55103
Improper Authentication (CWE-345) in Discourse ActivityPub
CVE-2026-61611
Insufficient Throttling (CWE-307) in Lychee Albums
CVE-2026-71490
Authorization Bypass (CWE-863) in OPNsense MVC ACL Layer
CVE-2026-63442
Log Injection (CWE-117) in OPNsense WebGUI Login Flow
CVE-2026-58390
Stored XSS (CWE-79) in OPNsense OpenVPN Dashboard Widget
CVE-2026-57155
Path Traversal (CWE-22) in OPNsense GeoIP Alias Importer
CVE-2026-53582
XPath Injection (CWE-643) in OPNsense Trust Module
CVE-2026-53574
SQL Injection (CWE-89) in EspoCRM Attachment Streams
CVE-2026-47168
Unsafe Deserialization (CWE-502) in EspoCRM Background Jobs
CVE-2026-110957
OS Command Injection (CWE-78) in Wavlink WL-WN530BE2-A
CVE-2026-110746
Path Traversal (CWE-22) in TotalAV SYSTEM IPC Service
CVE-2026-104586
OS Command Injection (CWE-94) in AUTOM8N borg_restore.cgi
CVE-2026-93649
Open Redirect (CWE-601) in Eclipse Adoptium Download Page
CVE-2026-110724
Rate Limit Bypass (CWE-639) in api-gateway Key Resolver
CVE-2024-22031
Authorization Bypass (CWE-863) in Rancher Projects
CVE-2023-32198
Improper Certificate Validation (CWE-295) in Steve
CVE-2026-18548
Stored XSS (CWE-79) in Groundhogg WordPress Plugin for
CVE-2026-110911
SQL Injection (CWE-89) in Wheels Dynamic Query APIs
CVE-2026-110908
OS Command Injection (CWE-78) in pfSense FRR Filter
CVE-2026-76066
Authorization Bypass (CWE-862) in IntentKit Tool Execution
CVE-2026-110873
Improper Authorization (CWE-863) in Heym Workflows
CVE-2026-110868
Server-Side Request Forgery (CWE-918) in Renovate Client
CVE-2026-110867
Improper Authorization (CWE-863) in Renovate Presets
CVE-2026-110864
Authentication Bypass (CWE-287) in Better Auth OAuth
CVE-2026-110863
Authentication Bypass (CWE-287) in Better Auth SSO Plugin
CVE-2026-110862
Authentication Bypass (CWE-287) in Better Auth OAuth
CVE-2026-110838
Missing Authentication (CWE-306) in FreeRDP Shadow Server
CVE-2026-71854
Broken Access Control (CWE-306) in OpenAEV Lessons API
CVE-2026-61843
Missing Authorization (CWE-862) in FileRise Uploads
CVE-2026-57492
Missing Authentication (CWE-306) in FileRise Setup
CVE-2026-57490
MFA Bypass (CWE-308) in FileRise WebDAV Authentication
CVE-2026-110670
SQL Injection (CWE-89) in sar2html Archive Processing
CVE-2026-104108
OIDC Account Takeover (CWE-287) in FileRise Identity
CVE-2026-103977
TOTP Brute-Force (CWE-307) in FileRise Login Handler
CVE-2026-55684
SQL Injection (CWE-89) in WeGIA Billing Endpoint Handler
CVE-2026-55683
SQL Injection (CWE-89) in WeGIA Billing Web Endpoint
CVE-2026-55682
Session Hijacking (CWE-384) in WeGIA PHP Web Manager
CVE-2026-55681
SQL Injection (CWE-89) in WeGIA Product Restore Module
CVE-2026-55680
SQL Injection (CWE-89) in WeGIA Billing Update Endpoint
CVE-2026-55383
Broken Access Control (CWE-285) in InvoiceShelf Routes
CVE-2026-55382
Broken Object Level Authorization (CWE-639) in InvoiceShelf
CVE-2026-55381
IDOR (CWE-639) in InvoiceShelf Estimate Conversion API
CVE-2026-110668
SQL Injection (CWE-89) in cemtan sar2html 4.0.0 App
CVE-2026-102986
Broken Access Control (CWE-639) in Plane Public Assets
CVE-2026-85714
SQL Injection (CWE-94) in Stirling-PDF Database Import
CVE-2026-73261
Improper Input Validation (CWE-20) in Mongoose TCP/IP
CVE-2026-55787
SSRF (CWE-918) in Flyto2 Core URL Validation Checks
CVE-2026-55786
OS Command Injection (CWE-78) in Flyto2 HTTP MCP Route
CVE-2026-54525
OS Command Injection (CWE-78) in Markdown Preview Enhanced
CVE-2026-53999
Confused Deputy (CWE-441) in Radius K8s Controller
CVE-2026-110770
Brute-Force (CWE-307) in Databasus Password Reset Flow
CVE-2026-110761
PHP Object Injection (CWE-502) in ILIAS Test Imports
CVE-2026-110667
Hard-Coded Credentials (CWE-259) in sar2html.py Tool
CVE-2026-110536
OS Command Injection (CWE-78) in D-Link DIR-868L HNAP
CVE-2026-102944
Cookie Leakage (CWE-522) in cpp-httplib Redirect Handling
CVE-2026-55573
Unsafe Deserialization (CWE-502) in e107 Installer
CVE-2026-55572
SQL Injection (CWE-89) in e107 alt_auth Authentication
CVE-2026-54554
Information Disclosure (CWE-200) in FOG adInfo() API
CVE-2026-108390
Uncontrolled Search Path (CWE-427) in Hestia Panel
CVE-2026-104103
Archive Path Traversal (CWE-22) in Ludwig Dataset Loader
CVE-2026-92153
Path Traversal (CWE-22) in F´ FileUplink Handler
CVE-2026-77524
Privilege Escalation (CWE-269) in KEDA Vault Authentication
CVE-2026-91159
Content Injection (CWE-79) in Discourse oEmbed Processing
CVE-2026-91157
Broken Access Control (CWE-863) in Discourse Uploads
CVE-2026-91156
Authorization Bypass (CWE-862) in Discourse Chat Channel
CVE-2026-86002
Code Injection (CWE-95) in Dokku Docker Options Plugin
CVE-2026-53614
Privilege Escalation (CWE-269) in util-linux mount
CVE-2026-110719
Server-Side Request Forgery (CWE-918) in Portkey Gateway
CVE-2026-103929
Command Injection (CWE-78) in mise Default Shell Settings
CVE-2026-73804
Improper Privilege Management (CWE-266) in Gitea API
CVE-2026-73802
Container Escape (CWE-269) in Gitea Runner Docker Jobs
CVE-2026-73800
Code Injection (CWE-94) in Gitea Reusable Workflows
CVE-2026-71184
Authorization Bypass (CWE-863) in Gitea PR Actions
CVE-2026-66877
Authorization Bypass (CWE-284) in Gitea Actions Self-Hosted
CVE-2026-59774
Path Traversal (CWE-22) in Gitea Org-mode Renderer
CVE-2026-110650
OS Command Injection (CWE-78) in thumbnail Python
CVE-2026-110649
OS Command Injection (CWE-78) in Stills Media Paths
CVE-2026-110648
OS Command Injection (CWE-78) in @offactory/compress-fonts
CVE-2026-110647
OS Command Injection (CWE-78) in Turnpress Converter
CVE-2026-110646
OS Command Injection (CWE-78) in Beganovich snappdf
CVE-2026-110645
OS Command Injection (CWE-78) in Video-stitch Node.js
CVE-2026-110644
OS Command Injection (CWE-78) in nodejs-whisper Audio
CVE-2026-110643
OS Command Injection (CWE-78) in transcribe2texts App
CVE-2026-110642
OS Command Injection (CWE-78) in xhtml2pdf Viewer
CVE-2026-110641
OS Command Injection (CWE-78) in Runnerty Decompress
CVE-2026-110640
OS Command Injection (CWE-78) in Whisper-node Package
CVE-2026-110639
OS Command Injection (CWE-78) in @mborne/extract Package
CVE-2026-110638
OS Command Injection (CWE-78) in doc-recog PDF Reader
CVE-2026-110637
OS Command Injection (CWE-78) in buildebooks CLI Tool
CVE-2026-110636
OS Command Injection (CWE-78) in pypdftk PDF Tool
CVE-2026-110635
OS Command Injection (CWE-78) in webp-converter Helpers
CVE-2026-110634
OS Command Injection (CWE-78) in git-diff API Parser
CVE-2026-110628
SSRF (CWE-918) in Kan Attachment Download API Route
CVE-2026-110623
Missing Authorization (CWE-862) in Papermerge APIs
CVE-2026-110622
Missing Authorization (CWE-862) in Papermerge Core
CVE-2026-110621
Missing Authorization (CWE-862) in Swetrix Cloud Projects
CVE-2026-110618
Missing Authentication (CWE-306) in SmsForwarder APIs
CVE-2026-110616
Missing Authentication (CWE-306) in NullHub Management API
CVE-2026-110615
Missing Authorization (CWE-862) in jshERP User API
CVE-2025-71433
Missing Authorization (CWE-862) in Kaneo Workspaces
CVE-2020-37282
OS Command Injection (CWE-78) in office-converter API
CVE-2026-110690
Path Traversal (CWE-23) in Cloud Commander Pack API
CVE-2026-82026
Missing Authorization (CWE-862) in Radar WebSocket
CVE-2026-105429
OS Command Injection (CWE-78) in NetBird SSH Manager
CVE-2026-110447
OS Command Injection (CWE-78) in Collabora CODE Server
CVE-2026-110392
OS Command Injection (CWE-78) in Samsung Open QA-Board
CVE-2026-92817
Improper Authorization (CWE-863) in Ignition Perspective
CVE-2026-49950
Unsafe Deserialization (CWE-502) in Xorbits Xoscar
CVE-2026-86022
OS Command Injection (CWE-78) in VNote External Program
CVE-2026-86016
Stored XSS (CWE-79) in VNote Markdown Note Preview Viewer
CVE-2026-63174
Broken Access Control (CWE-862) in Agora Space Import
CVE-2026-63172
Missing Authorization (CWE-862) in Omnispace Agora Project
CVE-2026-63165
SQL Injection (CWE-89) in Omnispace Agora Calendar Function
CVE-2026-63163
Broken Access Control (CWE-639) in Agora Downloads
CVE-2026-63162
Path Traversal (CWE-22) in Omnispace Agora Uploads
CVE-2026-63161
Session Fixation (CWE-384) in Omnispace Agora Project
CVE-2026-63160
Plaintext Token Storage (CWE-522) in Omnispace Agora
CVE-2026-63154
SQL Identifier Injection (CWE-89) in Agora User Import
CVE-2026-63153
Broken Access Control (CWE-639) in Agora setAffectations
CVE-2026-63152
Second-Order SQL Injection (CWE-89) in Agora Project
CVE-2026-63149
Predictable Passwords (CWE-330) in Agora Project Accounts
CVE-2026-63146
Code Injection (CWE-94) in Omnispace Agora Installer
CVE-2026-55601
OS Command Injection (CWE-78) in MultiTail -ex/-eX Feature
CVE-2026-16753
IDOR (CWE-639) in Lowcoder Library Query Execution Endpoint
CVE-2026-110005
OS Command Injection (CWE-78) in Komodo Periphery Agent
CVE-2026-104585
Command Injection (CWE-77) in MobSF Dynamic ADB Module
CVE-2026-104252
Reflected XSS (CWE-79) in Vitess vttablet Debug API
CVE-2026-110255
Response-Disclosing SSRF (CWE-918) in Finsys Dockhand
CVE-2026-110238
Authorization Bypass (CWE-639) in Rapyd Admin Users
CVE-2026-110236
OS Command Injection (CWE-78) in KDE Dolphin File Manager
CVE-2026-110233
OS Command Injection (CWE-78) in Rovr Windows Files
CVE-2026-110220
SSRF (CWE-918) in Kubeflow Model Registry Controller
CVE-2026-110216
Missing Authorization (CWE-862) in youlai-boot API
CVE-2026-110215
Missing Authorization (CWE-862) in Youlai-Boot Roles
CVE-2026-110211
Missing Authorization (CWE-862) in iFlytek SkillHub
CVE-2026-110208
Missing Authorization (CWE-862) in Wukong AICRM API
CVE-2026-110207
Missing Authorization (CWE-862) in Wukong AICRM Platform
CVE-2026-110112
Authorization Bypass (CWE-863) in Dockhand OIDC Login
CVE-2026-104875
Authorization Bypass (CWE-639) in Ente Recovery API
CVE-2026-104584
OS Command Injection (CWE-78) in reNgine Scan Engine
CVE-2026-37107
Improper Privilege Management (CWE-269) in HTMLy admin.php
CVE-2026-108385
Code Injection (CWE-94) in dataclasses-avroschema Enums
CVE-2026-108384
Code Injection (CWE-94) in dataclasses-avroschema Generators
CVE-2026-108383
Code Injection (CWE-94) in dataclasses-avroschema Library
CVE-2026-108382
Code Injection (CWE-94) in dataclasses-avroschema Enums
CVE-2026-108381
Code Injection (CWE-94) in dataclasses-avroschema Models
CVE-2026-108380
Python Code Injection (CWE-94) in dataclasses-avroschema
CVE-2026-108379
Python Code Injection (CWE-94) in dataclasses-avroschema
CVE-2026-108378
Code Injection (CWE-94) in dataclasses-avroschema Generator
CVE-2026-108377
Code Injection (CWE-94) in Python dataclasses-avroschema
CVE-2026-108376
Code Injection (CWE-94) in dataclasses-avroschema Models
CVE-2026-108375
Code Injection (CWE-94) in Python Avro Code Generator
CVE-2026-106173
Path Traversal (CWE-22) in Fortinet FortiSIEM Server
CVE-2026-85990
Broken Access Control (CWE-862) in Leantime JSON-RPC
CVE-2026-78799
Directory Traversal (CWE-22) in IK-Q3000 Wi-Fi Router
CVE-2026-77459
Authorization Bypass (CWE-863) in Argo CD Delete Hooks
CVE-2026-61642
HTTP Request Smuggling (CWE-444) in Squid Caching Proxy
CVE-2026-55562
Stored XSS (CWE-79) in Cronicle Admin Activity Logs
CVE-2026-55183
Missing Authentication (CWE-306) in RClone Manager
CVE-2026-54641
Broken Object Level Authorization (CWE-639) in OpenRemote
CVE-2026-54640
XXE (CWE-611) in OpenRemote KNX Protocol Handler Service
CVE-2026-54454
Unrestricted File Upload (CWE-434) in OpenCATS Import
CVE-2026-110128
Missing Authentication (CWE-306) in fuint Order API
CVE-2026-110124
IDOR (CWE-639) in FastBee DeviceController Devices
CVE-2026-110123
Missing Authorization (CWE-862) in Maku-boot Config
CVE-2026-110119
IDOR (CWE-639) in Yshopmall Member Address API Endpoint
CVE-2026-110116
Path Traversal (CWE-22) in Risesoft-y9 FileManager
CVE-2026-110115
Path Traversal (CWE-22) in Risesoft File Manager API
CVE-2026-110108
Missing Authorization (CWE-862) in MateCloud Storage
CVE-2026-110097
Ikaros Authentication Bypass (CWE-287) via TOTP Login
CVE-2026-103030
Sensitive Data Exposure (CWE-200) in Dio HTTP/2 Adapter
CVE-2026-102989
Reflected XSS (CWE-79) in TanStack Start Server Functions
CVE-2026-78802
Code Injection (CWE-94) in SK-WR6640X Wi-Fi 6 Router
CVE-2026-55695
Code Injection (CWE-94) in FearlessCMS Update Handler
CVE-2026-55675
CI Code Injection (CWE-94) in Salty Docs CI Workflows
CVE-2026-55376
OS Command Injection (CWE-78) in Heym Python Tools
CVE-2026-110025
Unrestricted Upload (CWE-434) in phpwcms Extension Handler
CVE-2026-109525
Missing Authorization (CWE-862) in Online Booking System
CVE-2026-53709
Broken Authentication (CWE-287) in MCP Context Forge
CVE-2026-109523
SQL Injection (CWE-89) in Online Booking AJAX Endpoint
CVE-2026-109522
SQL Injection (CWE-89) in Online-Appointment Admin CRUD
CVE-2026-109521
SQL Injection (CWE-89) in Online-Appointment Booking
CVE-2026-107460
SSRF DNS Rebinding (CWE-918) in Apache Fesod Sheet
CVE-2026-74043
Path Traversal (CWE-22) in Wazuh File Upload Handlers
CVE-2026-74040
Arbitrary File Overwrite (CWE-862) in Wazuh Master
CVE-2026-74036
Improper Authorization (CWE-863) in Wazuh SCA Manager
CVE-2026-74035
Authorization Bypass (CWE-863) in Wazuh User Updates
CVE-2026-74034
Missing Authorization (CWE-862) in Wazuh Agent Upgrade
CVE-2026-109961
Newline Injection (CWE-74) in Froxlor Ftps API Endpoint
CVE-2026-109960
Stored XSS (CWE-79) in Froxlor Customer Overview Page
CVE-2026-109956
Path Traversal (CWE-22) in NLTK Weka Classifier API
CVE-2026-109519
Path Traversal (CWE-22) in YouTransfer Template Rendering
CVE-2026-65180
Unsafe Deserialization (CWE-502) in Megatron-LM Checkpoints
CVE-2026-65173
Missing Authentication (CWE-306) in NVIDIA AIStore
CVE-2026-65172
Missing Authorization (CWE-862) in NVIDIA AIStore ETL
CVE-2026-65170
Server-Side Request Forgery (CWE-918) in AIStore HT Backend
CVE-2026-65164
Path Traversal (CWE-22) in NVIDIA AIStore dSort Jobs
CVE-2026-65161
Path Traversal (CWE-22) in NVIDIA AIStore Promote API
CVE-2026-65141
Eval Injection (CWE-95) in NVIDIA Isaac Lab Platform
CVE-2026-65110
Unsafe Checkpoint Loading (CWE-502) in NVIDIA Megatron-LM
CVE-2026-65103
Path Traversal (CWE-22) in NVIDIA AIStore Rename Handler
CVE-2026-65101
SSRF (CWE-918) in NVIDIA AIStore Distributed Sort Component
CVE-2026-109116
Authorization Bypass (CWE-639) in Restaurant System
CVE-2026-109115
SQL Injection (CWE-89) in Restaurant Password Reset
CVE-2026-109114
Improper Authentication (CWE-287) in Restaurant System
CVE-2026-109108
OS Command Injection (CWE-78) in Wavlink VPN Upload
CVE-2026-108970
SQL Injection (CWE-89) in Online-Examination Registration
CVE-2026-108968
SQL Injection (CWE-89) in Performance Indicator System
CVE-2026-108967
SQL Injection (CWE-89) in Performance Indicator System
CVE-2026-108966
SQL Injection (CWE-89) in SourceCodester Indicator System
CVE-2026-108965
SQL Injection (CWE-89) in Performance Indicator System
CVE-2026-108964
SQL Injection (CWE-89) in Performance Indicator System
CVE-2026-108956
SQL Injection (CWE-89) in Online Reviewer User Handler
CVE-2026-89111
OAuth2 SSRF (CWE-918) in SAP Cloud SDK for Python Apps
CVE-2026-87689
Missing Authentication (CWE-306) in Metasploit Web API
CVE-2026-109673
Stored XSS (CWE-79) in Frappe ERPNext Dashboard Portals
CVE-2026-109671
Stored XSS (CWE-79) in Frappe ERPNext Profile Field
CVE-2026-109667
Privilege Escalation (CWE-269) in Frappe ERPNext Platform
CVE-2026-109653
Stored XSS (CWE-79) in Frappe ERPNext Record Views
CVE-2026-109640
Missing Authorization (CWE-862) in Frappe ERPNext APIs
CVE-2026-109633
Stored XSS (CWE-79) in Frappe ERPNext Booking Page
CVE-2026-109617
Missing Authorization (CWE-862) in ERPNext Endpoints
CVE-2026-109616
Missing Authorization (CWE-862) in Frappe ERPNext API
CVE-2026-109613
Missing Authorization (CWE-862) in Frappe ERPNext App
CVE-2026-109612
Stored XSS (CWE-79) in Frappe ERPNext Report View UI
CVE-2026-109608
SQL Injection (CWE-89) in Frappe ERPNext Endpoints
CVE-2026-109604
Stored XSS (CWE-79) in Frappe ERPNext Tool View UI
CVE-2026-109573
SQL Injection (CWE-89) in phpMyFAQ Autocomplete API
CVE-2026-109572
Missing Authorization (CWE-862) in Open WebUI Terminal
CVE-2025-71432
Reflected XSS (CWE-79) in Frappe ERPNext Web Interface
CVE-2024-58390
Improper Privilege Management (CWE-269) in Frappe App
CVE-2026-84312
OAuth Login CSRF (CWE-352) in Nginx UI Admin Portal
CVE-2026-84317
Improper Input Validation (CWE-20) in Nginx UI MCP Tool
CVE-2026-84316
Improper Input Validation (CWE-20) in Nginx UI Config
CVE-2026-84315
Missing Authorization (CWE-862) in Nginx UI Web App
CVE-2026-84313
Authentication Bypass (CWE-287) in Nginx UI Passkeys
CVE-2026-109568
Missing Authorization (CWE-639) in Shaark API Controllers
CVE-2026-109567
Improper Privilege Management (CWE-269) in Rapyd Admin
CVE-2026-109566
Hard-Coded Credentials (CWE-798) in Rapyd Admin Panel
CVE-2026-109560
Command Authorization Bypass (CWE-863) in Continue CLI
CVE-2026-109559
Navigation Allowlist Bypass (CWE-863) in EdgeEver Desktop
CVE-2026-109558
Stored XSS (CWE-79) in EdgeEver TemplatesPane.tsx UI
CVE-2026-109557
Stored XSS (CWE-79) in EdgeEver Drag Preview Component
CVE-2026-108929
Argument Injection (CWE-88) in Netcore NR268 DDNS Service
CVE-2025-71429
OS Command Injection (CWE-78) in GPT-SoVITS UVR5 WebUI
CVE-2021-48011
Path Traversal (CWE-22) in Servor Web File Serving
CVE-2020-37279
OS Command Injection (CWE-78) in Node easy-pdf-merge
CVE-2026-95837
Improper Privilege Management (CWE-269) in containerd CRI
CVE-2026-109575
Missing Authentication (CWE-306) in HAProxy Data API
CVE-2026-109423
TLS Certificate Validation (CWE-295) in NetEase Cloud Music
CVE-2026-65954
Code Injection (CWE-95) in PHPCSUtils Array Key Sniff
CVE-2026-59977
Cross-Site Request Forgery (CWE-352) in ConvertX Deletion
CVE-2026-59976
Path Traversal (CWE-22) in ConvertX Image Converter
CVE-2026-57143
SSRF (CWE-918) in PraisonAI SearxNG Search Provider
CVE-2026-57118
Missing Access Control (CWE-306) in PraisonAI Agents
CVE-2026-108921
Missing Authentication (CWE-287) in Kusalka LMS Endpoints
CVE-2026-77366
Broken Object Authorization (CWE-639) in obsidian-tc
CVE-2026-108918
OS Command Injection (CWE-77) in Edimax BR-6208AC
CVE-2026-108917
Command Injection (CWE-77) in Edimax BR-6208AC Router
CVE-2026-108916
OS Command Injection (CWE-77) in Edimax BR-6208AC Router
CVE-2026-84286
Out-of-Bounds Read (CWE-125) in ExLlamaV3 EXL3 Loader
CVE-2026-109372
Authentication Bypass (CWE-287) in ZITADEL SAML IdP
CVE-2026-109371
Missing Authentication (CWE-306) in ZITADEL Login UI
CVE-2026-109361
Unsafe Deserialization (CWE-502) in MONAI nnUNetV2
CVE-2026-109360
Unsafe Deserialization (CWE-502) in MONAI SENet Models
CVE-2026-109357
LDAP Filter Injection (CWE-90) in LibreNMS LDAP Auth
CVE-2026-109353
SQL Injection (CWE-89) in LibreNMS Notifications Handler
CVE-2026-109347
Code Injection (CWE-94) in Adminer SQLite Database
CVE-2026-109343
Cross-Tenant Access (CWE-639) in SurrealDB USE Statement
CVE-2026-109341
Authorization Bypass (CWE-200) in SurrealDB JSON Patch
CVE-2026-109334
Cross-Tenant Access (CWE-639) in SurrealDB SQL API
CVE-2026-109325
Information Exposure (CWE-200) in Grav Clockwork Profiler
CVE-2026-109318
OS Command Injection (CWE-78) in Grav Git Sync Plugin
CVE-2026-109317
Improper Privilege Management (CWE-269) in Grav API
CVE-2026-109314
Information Disclosure (CWE-200) in Grav Login Plugin
CVE-2026-109313
Authentication Bypass (CWE-287) in Grav Login Plugin
CVE-2026-109312
Authentication Bypass (CWE-287) in Grav Login Plugin
CVE-2026-109308
Code Injection (CWE-94) in Craft CMS Update Handler
CVE-2026-109291
Stored XSS (CWE-79) in Open WebUI Citation Embeds
CVE-2026-109290
Stored XSS (CWE-79) in Open WebUI DocxPreview.svelte
CVE-2026-109238
Server-Side Request Forgery (CWE-918) in Crawl4AI API
CVE-2026-109237
Unsafe Deserialization (CWE-502) in Crawl4AI Config
CVE-2026-108907
Improper Authentication (CWE-287) in Netcore NR268 CGI
CVE-2026-109399
Improper Certificate Validation (CWE-295) in SWUpdate
CVE-2026-109397
Unrestricted File Upload (CWE-434) in Thelia Platform
CVE-2026-109394
Authentication Bypass (CWE-639) in Thirty bees Passwords
CVE-2026-109391
Unsafe Deserialization (CWE-502) in Square Squash API
CVE-2026-108900
SQL Injection (CWE-89) in Exponent CMS XML-RPC Login
CVE-2026-108899
Improper Authorization (CWE-285) in Zoraxy Proxy Server
CVE-2026-108896
OS Command Injection (CWE-78) in Linksys E1700 Router
CVE-2026-108895
OS Command Injection (CWE-78) in Linksys E1700 DMZ
CVE-2026-109201
Missing Authorization (CWE-862) in LogicalDOC SOAP
CVE-2026-109199
Code Injection (CWE-94) in LogicalDOC Email Templates
CVE-2026-108894
OS Command Injection (CWE-78) in Linksys E1700 Router
CVE-2026-109185
Missing Authorization (CWE-862) in jshERP UserController
CVE-2026-109164
IDOR (CWE-639) in TDuck Survey Form Submission API
CVE-2026-108953
OS Command Injection (CWE-78) in mac-shell-mcp MCP
CVE-2026-108836
Server-Side Request Forgery (CWE-918) in Ollama Pull API
CVE-2026-108826
SQL Injection (CWE-89) in Zen Cart PayPal IPN Handler
CVE-2026-108818
Authentication Bypass (CWE-287) in agno Auth Module
CVE-2026-108807
SQL Injection (CWE-89) in EmployeeRecruitmentSystem
CVE-2026-108806
SQL Injection (CWE-89) in EmployeeRecruitmentSystem
CVE-2026-108805
SQL Injection (CWE-89) in EmployeeRecruitment Login
CVE-2026-108804
OS Command Injection (CWE-78) in TRENDnet Web Router Models
CVE-2026-87690
Path Traversal (CWE-22) in Metasploit iOS Gather Module
CVE-2026-108799
SQL Injection (CWE-89) in XCMS Password Recovery API
CVE-2026-108905
Hard-Coded API Key (CWE-798) in pH7Builder Dating CMS
CVE-2026-108902
Path Traversal (CWE-22) in pH7Builder Picture Module
CVE-2026-108865
Authentication Bypass (CWE-287) in AmoyLab Unla OAuth2
CVE-2026-108863
Missing Authentication (CWE-306) in Katanemo Plano
CVE-2026-108853
IDOR (CWE-639) in UnicomAI Wanwu Application Deletion
CVE-2026-108758
Authorization Bypass (CWE-639) in Easy!Appointments
CVE-2026-108753
Hard-Coded Credentials (CWE-798) in Agnai Docker Config
CVE-2026-108746
Incorrect Authorization (CWE-863) in Vearch Role Management
CVE-2026-108744
OS Command Injection (CWE-78) in pbi-cli desktop_sync
CVE-2026-108739
Missing Authentication (CWE-306) in OpenAgents Workspace
CVE-2026-108718
Missing Authorization (CWE-862) in Rill OAuth Server
CVE-2026-108576
OS Command Injection (CWE-78) in TOZED X300 Diagnostics
CVE-2026-108540
OS Command Injection (CWE-78) in Spug File Transfer
CVE-2026-108522
Improper Authentication (CWE-287) in Sencho Login API
CVE-2026-108708
Missing Authorization (CWE-862) in Wukong_HRM Application
CVE-2026-108707
Improper Authentication (CWE-287) in Wukong_HRM APIs
CVE-2026-108695
Incorrect Authorization (CWE-863) in MultiVendorX Plugin
CVE-2026-108657
Missing Authorization (CWE-862) in JeecgBoot Tenant
CVE-2026-108628
Missing Authorization (CWE-862) in JeecgBoot Endpoint
CVE-2026-108623
Missing Authorization (CWE-862) in JeecgBoot Audit Logs
CVE-2026-108598
Code Injection (CWE-94) in Floci VTL Template Engine
CVE-2026-108553
Cross-Site Request Forgery (CWE-352) in OpenRefine get-rows
CVE-2026-108551
Code Injection (CWE-94) in OpenAPI TypeScript Codegen
CVE-2026-108550
Incorrect Authorization (CWE-863) in SkillHub Merge
CVE-2026-108549
Missing Authentication (CWE-306) in cc-connect MAX
CVE-2026-108548
Authentication Bypass (CWE-287) in AstronRPA Gateway
CVE-2026-108546
OS Command Injection (CWE-78) in Spotweb NZB Handler
CVE-2026-108161
OS Command Injection (CWE-78) in FusionPBX Recordings
CVE-2026-107657
Stored XSS (CWE-79) in HivePress WordPress Profiles
CVE-2026-96667
Stored XSS (CWE-79) in WordPress Real Estate Manager
CVE-2026-93775
Stored XSS (CWE-79) in Podlove Podcast Publisher Plugin
CVE-2026-92975
Privilege Escalation (CWE-269) in Groundhogg WordPress
CVE-2026-83526
Arbitrary File Upload (CWE-434) in WordPress FV Player
CVE-2026-104725
Privilege Escalation (CWE-269) in Groundhogg WordPress
CVE-2026-89301
Path Traversal File Deletion (CWE-862) in rtMedia Plugin
CVE-2026-57458
Authorization Scope Bypass (CWE-269) in Vikunja OAuth
CVE-2026-108263
Code Injection (CWE-95) in Astron Agent Workflow API
CVE-2026-108261
Origin Validation (CWE-346) in Tina CMS Admin Preview
CVE-2026-108260
Stored XSS (CWE-79) in Tina tina-markdown Component
CVE-2026-108259
JavaScript Code Injection (CWE-94) in Tina CMS CLI
CVE-2026-78797
Remote Code Injection (CWE-94) in iStoreOS tasks-lib.lua
CVE-2026-107845
Stored XSS (CWE-79) in Contao Comments Administration
CVE-2026-107823
Improper Output Encoding (CWE-116) in MariaDB Views
CVE-2026-55797
OS Command Injection (CWE-78) in Argo CD Repo-Server
CVE-2026-108159
Cross-Site Scripting (CWE-79) in AstronRPA Desktop Chat
CVE-2026-108157
Improper Authentication (CWE-287) in Pingvin Share OAuth
CVE-2026-108156
External File Path Control (CWE-73) in LobsterAI IPC
CVE-2026-108113
Unrestricted Upload (CWE-434) in ILIAS QTI Import Handler
CVE-2026-107813
Missing Authorization (CWE-862) in Nginx UI Cluster
CVE-2026-107811
Missing Authorization (CWE-862) in Nginx UI API Endpoints
CVE-2026-107809
CSRF (CWE-352) in Nginx UI Admin Management Interface
CVE-2026-107808
Authentication Bypass (CWE-287) in Nginx UI Login Portal
CVE-2026-78796
OS Command Injection (CWE-78) in Netcore B11 Router
CVE-2026-78795
Information Disclosure (CWE-200) in Netcore B11 Router
CVE-2026-39460
Plaintext Credentials (CWE-522) in Device Configuration
CVE-2026-33367
Missing Authentication (CWE-306) in SNMP Management
CVE-2026-108109
Brute-Force OTP (CWE-307) in PHPNuxBill Reset Flow
CVE-2026-108108
Authentication Bypass (CWE-287) in PHPNuxBill RADIUS
CVE-2026-108107
SQL Injection (CWE-89) in PHPNuxBill FreeRADIUS API
CVE-2026-108101
Unrestricted File Upload (CWE-434) in HortusFox Web
CVE-2026-105278
Hardcoded Credentials (CWE-798) in openPDC Docker Image
CVE-2026-104081
Path Traversal (CWE-22) in KodExplorer ZIP Archive
CVE-2026-105281
Missing Authentication (CWE-306) in openPDC Publisher
CVE-2026-100730
Unsafe Deserialization (CWE-502) in openPDC Console
CVE-2026-103413
Improper Input Validation (CWE-20) in Apache Karavan
CVE-2026-103412
Path Traversal (CWE-22) in Apache Camel Karavan API
CVE-2026-107935
Path Traversal (CWE-22) in gvproxy Expose Endpoint Handler
CVE-2026-19574
ASID Isolation Failure (CWE-284) in ARM64 MMU Backend
CVE-2026-107910
Authentication Bypass (CWE-287) in FalkorDB Bolt Endpoint
CVE-2026-107728
Authorization Bypass (CWE-863) in Strawberry GraphQL
CVE-2026-107720
JWT Signature Validation Bypass (CWE-347) in fast-jwt
CVE-2026-11318
Missing Authentication (CWE-306) in Deskin XPC Service
CVE-2026-107782
Incorrect Authorization (CWE-863) in System Informer phsvc
CVE-2026-107781
SSRF (CWE-918) in Skyeye OnlyOffice Callback Handler
CVE-2026-107780
OS Command Injection (CWE-78) in Skyeye TTS Endpoint
CVE-2026-107779
Missing Authentication (CWE-306) in Skyeye xxl-job
CVE-2026-107318
TLS Validation Bypass (CWE-295) in Fastify reply-from
CVE-2026-101024
Path Traversal (CWE-23) in Satel Netco Design Export
CVE-2026-107704
OS Command Injection (CWE-78) in image_optimizer Gem
CVE-2026-107703
OS Command Injection (CWE-78) in node-convert convert.js
CVE-2026-107700
Code Injection (CWE-94) in dot-access Path Handling
CVE-2026-107699
OS Command Injection (CWE-78) in ppt2png Node.js Package
CVE-2026-107385
SQL Injection (CWE-89) in MariaDB Connector/Node.js
CVE-2026-107384
SQL Injection (CWE-89) in MariaDB Node.js Connector
CVE-2026-107383
Uninitialized Heap Disclosure (CWE-200) in MariaDB Connector
CVE-2026-95210
Improper Certificate Validation (CWE-295) in GnuTLS
CVE-2026-107377
Path Traversal (CWE-22) in datamodel-code-generator
CVE-2026-107375
SQL Injection (CWE-89) in JHipster Reactive SQL Apps
CVE-2026-107362
Server-Side Request Forgery (CWE-918) in Malcolm FilePond
CVE-2026-107337
CSRF (CWE-352) in Malcolm Kiosk Flask Script Endpoint
CVE-2026-107333
Authorization Bypass (CWE-863) in Malcolm Nginx Proxy
CVE-2026-107303
Stored XSS (CWE-79) in JHipster Blob OpenFile Helper
CVE-2026-107709
Path Traversal (CWE-22) in Bower decompress-zip Library
CVE-2026-107295
Cross-Site Request Forgery (CWE-352) in Pydantic AI Web
CVE-2026-95208
Improper Certificate Validation (CWE-295) in wolfSSL
CVE-2026-93034
Unsafe Deserialization (CWE-502) in SGLang ZMQ Messaging
CVE-2026-105833
Insecure Direct Object Reference (CWE-522) in EspoCRM
CVE-2026-105110
OS Command Injection (CWE-78) in Iskratel Innbox GPON
CVE-2026-17609
Arbitrary Directory Deletion (CWE-434) in Super Forms
CVE-2026-17196
Unrestricted Upload (CWE-434) in Super Forms Plugin
CVE-2026-107232
HTTP Credential Exposure (CWE-319) in AsyncHttpClient
CVE-2026-107230
Connection Identity Confusion (CWE-863) in AsyncHttpClient
CVE-2026-62253
Missing Authentication (CWE-306) in Homer Telecom APIs
CVE-2026-62252
Hardcoded Credentials (CWE-798) in Homer Authentication
CVE-2026-62251
SQL Injection (CWE-89) in Homer Statistics Query Handler
CVE-2026-62176
Code Injection (CWE-94) in PraisonAI deploy/api.py Module
CVE-2026-106557
Path Traversal (CWE-22) in Backstage TechDocs Plugin
CVE-2026-107270
IDOR (CWE-639) in Gophish Resource Management APIs
CVE-2026-107207
SSRF (CWE-306) in LMCache Monitoring Proxy Service
CVE-2026-107206
Missing Authentication (CWE-306) in LMCache HTTP Server
CVE-2026-107205
Missing Authentication (CWE-306) in LMCache Coordinator
CVE-2026-107204
Missing Authentication (CWE-306) in LMCache /run_script
CVE-2026-107202
OS Command Injection (CWE-77) in h-ui Admin API Endpoint
CVE-2026-106560
Path Traversal (CWE-22) in Backstage Confluence Module
CVE-2026-106558
Unsafe Deserialization (CWE-502) in Backstage TechDocs
CVE-2026-106556
OS Command Injection (CWE-78) in Backstage TechDocs
CVE-2026-46434
Improper Privilege Management (CWE-269) in wger App
CVE-2026-43976
Authorization Bypass (CWE-863) in wger Gym Management
CVE-2026-106059
Command Injection (CWE-78) in GitAhead for macOS
CVE-2026-106058
OS Command Injection (CWE-78) in GitAhead Filters
CVE-2026-106057
OS Command Injection (CWE-78) in patool on Windows
CVE-2026-106056
OS Command Injection (CWE-78) in Rundeck Windows Nodes
CVE-2026-105192
Unsafe Deserialization (CWE-502) in LMCache Transport
CVE-2026-83540
Authentication Bypass (CWE-287) in wolfSSHd Windows
CVE-2026-81535
Missing Authorization (CWE-862) in wolfSSH Forwarding
CVE-2026-86684
Authorization Bypass (CWE-863) in Gitea Push Mirrors
CVE-2026-65142
Unsafe Deserialization (CWE-502) in NVIDIA Model-Optimizer
CVE-2026-106509
Code Injection (CWE-94) in Backstage TechDocs Build
CVE-2026-106503
Authorization Bypass (CWE-284) in Backstage Scaffolder
CVE-2026-106501
Sensitive Data Exposure (CWE-200) in Backstage Scaffolder
CVE-2026-106498
Improper Authorization (CWE-863) in Backstage Catalog
CVE-2026-105267
Improper Authorization (CWE-863) in Gitea Tag Deletion
CVE-2026-101023
OAuth Token Validation Bypass (CWE-287) in Gitea Server
CVE-2026-106492
Improper Privilege Management (CWE-269) in Backstage
CVE-2026-106488
Improper Authentication (CWE-287) in Backstage OIDC
CVE-2026-106486
Path Traversal (CWE-22) in Backstage Bitbucket Plugin
CVE-2026-106459
SSRF (CWE-918) in Backstage Sentry Scaffolder Backend
CVE-2026-106455
SSRF (CWE-918) in Backstage TechDocs Node Plugin Package
CVE-2026-96404
Authentication Bypass (CWE-287) in Gitea Web Installer
CVE-2026-94205
Incorrect Authorization (CWE-863) in Gitea Actions Runner
CVE-2026-89430
TOCTOU SSRF (CWE-367) in Gitea Push Mirror Service
CVE-2026-79960
Incorrect Authorization (CWE-863) in Gitea Push Hooks
CVE-2026-73278
Authentication Bypass (CWE-287) in Gitea OAuth2/OIDC
CVE-2026-70357
SSRF (CWE-918) in Gitea Repository Migration Workflow
CVE-2026-106446
Code Injection (CWE-94) in Handlebars AST Compiler Engine
CVE-2026-104636
Server-Side Request Forgery (CWE-918) in Gitea Git Client
CVE-2026-104632
Authorization Bypass (CWE-285) in Gitea Actions Jobs
CVE-2026-96890
SSRF (CWE-918) in GitHub Enterprise Secret Scanning
CVE-2026-106511
Missing Authorization (CWE-862) in MultiversX Multisig
CVE-2026-106443
Improper Input Validation (CWE-20) in WeasyPrint Images
CVE-2026-106441
Code Injection (CWE-94) in Hydra Logging Configuration
CVE-2026-104073
Server-Side Template Injection (CWE-79) in NetBox Links
CVE-2026-106103
Path Traversal (CWE-22) in Quasar IconGenie CLI Tool
CVE-2025-45871
SQL Injection (CWE-89) in LogicalDOC Workflows Servlet
CVE-2026-95140
Path Traversal (CWE-22) in kkFileView FileController
CVE-2026-106102
Cross-Site Scripting (CWE-79) in Quasar SSR getHead()
CVE-2026-106100
Authorization Bypass (CWE-639) in Payload MongoDB Adapter
CVE-2026-105868
Stored XSS (CWE-434) in Payload CMS XML File Uploads
CVE-2026-105866
Account Lockout DoS (CWE-307) in Payload CMS Local Auth
CVE-2026-105865
Path Traversal (CWE-22) in Payload Upload Cleanup Logic
CVE-2026-105862
Stored XSS (CWE-79) in Payload CMS SVG Upload Feature
CVE-2026-105861
Untrusted Redirect (CWE-346) in Payload CMS Uploads
CVE-2026-105860
Missing Authorization (CWE-862) in Payload Multi-Tenant
CVE-2026-105859
Broken Access Control (CWE-639) in Payload CMS Endpoint
CVE-2026-105858
Code Injection (CWE-94) in Payload First Registration
CVE-2026-105857
Code Injection (CWE-94) in Payload CMS Form Builder
CVE-2026-105856
SQL Injection (CWE-89) in Payload CMS JSON Field Data
CVE-2026-105855
Broken Access Control (CWE-284) in Payload Password Field
CVE-2026-105852
Missing Authorization (CWE-862) in Payload CMS Queries
CVE-2026-105851
Broken Access Control (CWE-284) in Payload Duplicate
CVE-2026-105849
Sensitive Data Exposure (CWE-201) in Payload CMS API
CVE-2026-105848
Excessive API Exposure (CWE-749) in Payload Stripe Plugin
CVE-2026-104850
OAuth Credential Confusion (CWE-345) in MCP Client SDK
CVE-2026-105845
SQL Injection (CWE-89) in Payload CMS Database Adapters
CVE-2026-105798
Stored XSS (CWE-79) in SimpleChat Group Document Uploads
CVE-2026-105797
OS Command Injection (CWE-78) in SimpleChat Plugins
CVE-2026-105796
Code Injection (CWE-94) in Kiota Java/PHP Generators
CVE-2026-105793
OS Command Injection (CWE-78) in UFO Mobile MCP Tool
CVE-2026-104069
Unrestricted File Upload (CWE-434) in HortusFox Themes
CVE-2026-91140
OS Command Injection (CWE-78) in ARCGenAI-Generator
CVE-2026-106040
Missing Authorization (CWE-862) in Mooncake Store Master
CVE-2026-106038
Missing Authentication (CWE-306) in Mooncake Store
CVE-2026-106037
Missing Authentication (CWE-306) in Mooncake Store API
CVE-2026-105920
SQL Injection (CWE-89) in Kusalkasilva LMS Signup Endpoint
CVE-2026-105788
OS Command Injection (CWE-78) in Microsoft UFO Mobile
CVE-2026-82531
PHP Code Injection (CWE-94) in Smarty Template Cache
CVE-2026-105919
SQL Injection (CWE-89) in LMS Administrator Login Endpoint
CVE-2026-105835
Missing TOTP Rate Limiting (CWE-307) in PLANKA Auth API
CVE-2026-105918
SQL Injection (CWE-89) in Kusalkasilva LMS Login Endpoint
CVE-2026-105807
SQL Injection (CWE-89) in Simple Student searchquery.php
CVE-2026-105776
SQL Injection (CWE-89) in IOCL Employee Tracking Site
CVE-2026-105704
Auth Bypass (CWE-287) in SourceCodester Drug Auth Guard
CVE-2026-105571
Improper Authorization (CWE-285) in Lilishop Mobile Binding
CVE-2026-105486
Missing Authentication (CWE-306) in OSSRS SRS System API
CVE-2026-105783
CORS Origin Validation (CWE-346) in Joplin Web Clipper
CVE-2026-105763
Credential Exposure (CWE-522) in Twenty CRM Platform
CVE-2026-105762
SSRF (CWE-918) in Dify Remote File Upload Endpoint
CVE-2026-105471
SQL Injection (CWE-89) in Online Appointment Booking
CVE-2026-105761
IDOR (CWE-639) in Dify MCP Server Management Endpoint
CVE-2026-105470
SQL Injection (CWE-89) in Online Appointment Booking System
CVE-2026-105469
SQL Injection (CWE-89) in Online-Appointment AJAX Endpoint
CVE-2026-105751
Path Traversal (CWE-22) in Docling ODF Image Backend
CVE-2026-105744
Path Traversal (CWE-22) in Docling Tectonic Backend
CVE-2026-105468
SQL Injection (CWE-89) in Online Appointment Login
CVE-2026-105740
OS Command Injection (CWE-78) in Langflow MCP Servers
CVE-2026-105697
OS Command Injection (CWE-78) in Langflow MCP Server
CVE-2026-102262
Path Traversal (CWE-22) in Newell Brands DYMO ID App
CVE-2026-95265
SSRF (CWE-918) in Feehi CMS UEditor Catchimage Endpoint
CVE-2026-95263
Incorrect Access Control (CWE-284) in Feehi CMS Backend
CVE-2026-105691
OS Command Injection (CWE-78) in Penpot SVG Exporter
CVE-2026-105679
Stored XSS (CWE-79) in Ghost Local Storage Adapter
CVE-2026-105677
Code Injection (CWE-94) in Ghost Theme Translation Loading
CVE-2026-105675
Information Exposure (CWE-203) in Ghost Invite System
CVE-2026-105651
Stored XSS (CWE-79) in Ghost External Bookmark Images
CVE-2026-105650
Stored Cross-Site Scripting (CWE-79) in Ghost CMS Platform
CVE-2026-105649
Stored XSS (CWE-79) in Ghost SVG Media Upload Handler
CVE-2026-88424
SQL Injection (CWE-89) in FineAdmin ButtonService API
CVE-2026-105643
Stored XSS (CWE-79) in Ghost CMS Editor Embed Cards
CVE-2026-105642
Code Injection (CWE-94) in Ghost SVG Image Processing
CVE-2026-105641
Hardcoded Credentials (CWE-798) in Plane Deployments
CVE-2026-105640
Authentication Bypass (CWE-287) in Plane OAuth Login
CVE-2026-105639
Broken Authentication (CWE-287) in Plane Invitations
CVE-2026-105638
OTP Brute Force (CWE-307) in Plane Magic-Code Login
CVE-2026-105637
Broken Object Authorization (CWE-639) in Plane Assets
CVE-2026-105636
Server-Side Request Forgery (CWE-918) in Plane Webhooks
CVE-2026-105635
Broken Access Control (CWE-862) in Plane Invitations
CVE-2026-105634
Improper Authorization (CWE-269) in Plane Project Roles
CVE-2026-105387
SQL Injection (CWE-89) in Online Appointment System
CVE-2026-105386
SQL Injection (CWE-89) in HospitalManagementSystem print.php
CVE-2026-105633
Broken Object Level Authorization (CWE-639) in Plane
CVE-2026-105631
Broken Access Control (CWE-639) in Plane Asset APIs
CVE-2026-105630
Stored XSS (CWE-79) in Plane SVG Attachment Uploads
CVE-2026-105629
IDOR (CWE-639) in Plane Estimate Point Deletion Endpoint
CVE-2026-105628
SSRF (CWE-918) in Plane OAuth Avatar Sync Component
CVE-2026-105385
SQL Injection (CWE-89) in HospitalManagementSystem
CVE-2026-105384
SQL Injection (CWE-89) in UNION HospitalManagementSystem
CVE-2026-104979
Stored XSS (CWE-79) in Plane Intake Issue Viewset Endpoint
CVE-2026-104978
Broken Access Control (CWE-863) in Plane Invitations
CVE-2026-104977
Server-Side Request Forgery (CWE-918) in Plane Unfurling
CVE-2026-104975
Cross-Tenant IDOR (CWE-639) in Plane Asset Endpoints
CVE-2026-104974
Improper Access Control (CWE-284) in Plane Accounts
CVE-2026-104973
Server-Side Request Forgery (CWE-918) in Plane Webhooks
CVE-2026-104971
Broken Access Control (CWE-639) in Plane Asset APIs
CVE-2026-104905
PHP Object Injection (CWE-502) in FacturaScripts App
CVE-2026-12171
Code Injection (CWE-94) in auto-changelog CLI Utility
CVE-2026-105383
SQL Injection (CWE-89) in HospitalManagementSystem
CVE-2026-105382
Improper Authorization (CWE-285) in HospitalManagementSystem
CVE-2026-88396
Unrestricted File Upload (CWE-22) in ApiAdmin Panel v5.0
CVE-2026-88395
SQL Injection (CWE-89) in GouGuOA /home/message/rubbish
CVE-2026-88393
PHP Code Injection (CWE-94) in WookTeam Task Export API
CVE-2026-104891
Wallet Verification Bypass (CWE-290) in mppx Gates
CVE-2026-104890
Unrestricted File Upload (CWE-434) in Kunstmaan CMS
CVE-2026-88394
Directory Traversal (CWE-22) in WookTeam Export API
CVE-2026-88392
Directory Traversal (CWE-22) in Unimall v4 Upload Handler
CVE-2026-88391
Command Injection (CWE-94) in Northstar H2 Console App
CVE-2026-105290
SSRF (CWE-918) in FeelCRM GoogleController Endpoint
CVE-2026-105284
Improper Authorization (CWE-285) in Totolink A3002MU
CVE-2026-105253
SQL Injection (CWE-89) in Online Admission System Login
CVE-2026-105247
SQL Injection (CWE-89) in Online Reviewer Assessments
CVE-2026-105246
SQL Injection (CWE-89) in SourceCodester Reviewer Portal
CVE-2026-105238
Server-Side Request Forgery (CWE-918) in NextChat Proxy Handler
CVE-2019-25777
Unsafe YAML Deserialization (CWE-502) in Perl YAML Module
CVE-2017-20285
Unsafe YAML Deserialization (CWE-502) in Perl YAML
CVE-2026-105232
SQL Injection (CWE-89) in Food-Waste Registration Page
CVE-2026-105231
SQL Injection (CWE-89) in Food Waste Admin Signup.php
CVE-2026-105230
SQL Injection (CWE-89) in Food-Waste Delivery System
CVE-2026-105229
SQL Injection (CWE-89) in Food Waste User Registration
CVE-2026-105185
SQL Injection (CWE-89) in Online Admission examinee.php
CVE-2026-105184
SQL Injection (CWE-89) in Online Admission System 1.0
CVE-2026-105183
SQL Injection (CWE-89) in Online Admission System Admin
CVE-2026-105182
SQL Injection (CWE-89) in Online Reviewer Management System
CVE-2026-105293
Path Traversal (CWE-22) in Legcord Theme IPC Handlers
CVE-2026-105223
Improper Certificate Validation (CWE-295) in Kube Client
CVE-2026-105172
SQL Injection (CWE-89) in Online Admission System 1.0
CVE-2026-105170
Missing Authentication (CWE-306) in Food-Waste Admin
CVE-2026-105169
SQL Injection (CWE-89) in Food-Waste Delivery Handler
CVE-2026-105222
Improper TLS Validation (CWE-295) in Google Maps Laravel
CVE-2026-105221
Improper Certificate Validation (CWE-295) in gist RubyGem
CVE-2026-105220
Cross-Site Scripting (CWE-79) in Twine 2 Editor
CVE-2026-105167
SQL Injection (CWE-89) in Food-Waste admin/donate.php
CVE-2026-105166
SQL Injection (CWE-89) in Food Waste Management System
CVE-2026-105218
Improper Certificate Validation (CWE-295) in gopay
CVE-2026-105216
Improper Certificate Validation (CWE-295) in go-micro
CVE-2026-105089
Stored XSS (CWE-79) in WWBN AVideo Video Trailer URLs
CVE-2026-105086
Stored XSS (CWE-79) in WWBN AVideo Title Storage Logic
CVE-2026-105213
Improper Authentication (CWE-287) in ZITADEL Login V2
CVE-2026-105212
Authentication Bypass (CWE-287) in ZITADEL Login UI
CVE-2026-105211
Authentication Bypass (CWE-200) in ZITADEL Login V2
CVE-2026-105210
Missing Authentication (CWE-287) in ZITADEL Login V1
CVE-2026-105209
Improper Authorization (CWE-862) in ZITADEL Passkeys
CVE-2026-105207
Missing Authentication (CWE-306) in ZITADEL IDP Linking
CVE-2026-105148
Server-Side Request Forgery (CWE-918) in R2R API Endpoint
CVE-2026-105147
Hard-Coded Credentials (CWE-798) in R2R JWT Handler
CVE-2026-105135
Code Injection (CWE-74) in MindSearch Planner Agent
CVE-2026-105126
Improper Privilege Management (CWE-269) in LaraDashboard
CVE-2026-105123
Unrestricted File Upload (CWE-434) in WCMS Media API
CVE-2026-105115
Unauthenticated Class Instantiation (CWE-306) in OpenAM
CVE-2026-105105
Missing Authentication (CWE-306) in NASA AIT Server
CVE-2026-96270
Stored Cross-Site Scripting (CWE-79) in Ultimate Member
CVE-2026-93428
Authorization Bypass (CWE-862) in Ultimate Member AJAX
CVE-2026-104478
Path Traversal (CWE-22) in Formwork BackupController
CVE-2026-97363
Missing Rate Limiting (CWE-307) in WebSocket Application API
CVE-2026-95102
Missing Authentication (CWE-306) in WebSocket Endpoints
CVE-2026-94592
Hardcoded Credentials (CWE-798) in Armatura One DB
CVE-2026-82044
Server-Side Request Forgery (CWE-918) in UTMStack API
CVE-2026-82042
Authentication Bypass (CWE-306) in UTMStack Admin API
CVE-2026-82041
Missing Authorization (CWE-862) in UTMStack Agents
CVE-2026-82039
SQL Injection (CWE-89) in UTMStack Asset Group Search
CVE-2026-104991
Broken Access Control (CWE-862) in Phproject REST API
CVE-2026-104019
OS Command Injection (CWE-78) in SageMaker Studio
CVE-2026-103958
Server-Side Request Forgery (CWE-918) in Loom for AWS
CVE-2026-103956
Missing Authentication (CWE-306) in Loom for AWS Agent
CVE-2023-54405
Unrestricted File Upload (CWE-434) in H3C CVM Endpoint
CVE-2020-37278
SSRF and File Read (CWE-918) in Weaver e-Bridge App
CVE-2014-125130
Path Traversal (CWE-22) in CodeArt Google MP3 Plugin
CVE-2026-104851
Server-Side Template Injection (CWE-94) in Python fsspec
CVE-2026-51922
Code Injection (CWE-94) in AgentScope Shell Command
CVE-2026-51918
Code Injection (CWE-94) in FinRobot CodingUtils Method
CVE-2026-51917
Code Injection (CWE-94) in FinRobot CodingUtils.modify_code
CVE-2026-51916
Broken Access Control (CWE-284) in SuperAGI Knowledge
CVE-2026-51915
Broken Access Control (CWE-284) in SuperAGI Tool Controller
CVE-2026-51914
Broken Access Control (CWE-284) in SuperAGI Templates
CVE-2026-51911
Code Injection (CWE-94) in Vanna Plotly Figure Method
CVE-2026-51907
Path Traversal (CWE-22) in TaskingAI QR Code Plugin
CVE-2026-51906
Path Traversal (CWE-22) in TaskingAI DALL-E Image Tool
CVE-2026-51904
Broken Access Control (CWE-284) in SuperAGI Agents
CVE-2026-51901
Broken Access Control (CWE-284) in SuperAGI Scheduler
CVE-2026-51898
Code Injection (CWE-94) in pandas-ai 3.0 CodeExecutor
CVE-2026-101104
Missing Authorization (CWE-862) in Meari IoT Cloud API
CVE-2026-104637
Unrestricted Upload (CWE-434) in HospitalManagementSystem
CVE-2026-104609
SQL Injection (CWE-89) in HospitalManagementSystem
CVE-2026-104472
Missing Authorization (CWE-862) in YesWiki Attachments
CVE-2026-104471
Unrestricted File Upload (CWE-434) in YesWiki Bazar
CVE-2026-104470
SSRF and XSS (CWE-79) in YesWiki Bazar valeur Action
CVE-2026-104467
Authorization Bypass (CWE-862) in YesWiki API Service
CVE-2026-104464
SSRF (CWE-918) in YesWiki Bazar Subscription Sync Job
CVE-2026-104463
SSRF (CWE-918) in YesWiki Public Forms Actor Inbox
CVE-2026-104462
SQL Injection (CWE-89) in YesWiki Bazar Nuagetag Action
CVE-2026-104460
Blind SQL Injection (CWE-89) in YesWiki Search Action
CVE-2026-104457
SQL Injection (CWE-89) in YesWiki Bazar Filtertags Action
CVE-2026-104456
SQL Injection (CWE-89) in YesWiki ACL Access Service
CVE-2026-104448
Cross-Site Request Forgery (CWE-352) in YesWiki AJAX
CVE-2026-104447
CSRF (CWE-352) in YesWiki Autoupdate UpdateAction Module
CVE-2026-104444
Authorization Bypass (CWE-639) in YesWiki Comments API
CVE-2026-104443
Authorization Bypass (CWE-863) in YesWiki Triples API
CVE-2026-104418
Path Traversal (CWE-22) in Ghost Theme Translation
CVE-2026-104416
Information Disclosure (CWE-203) in Ghost Admin API
CVE-2026-104414
Stored XSS (CWE-79) in Ghost oEmbed Photo Responses
CVE-2026-104413
Stored XSS (CWE-79) in Ghost Bookmark Card Image Fetching
CVE-2026-104411
Stored XSS (CWE-79) in Ghost Local Storage Adapter
CVE-2026-104410
Authorization Bypass (CWE-862) in SiYuan Preview Endpoint
CVE-2026-97641
Stored XSS (CWE-79) in Relevanssi WordPress Plugin
CVE-2026-97342
Stored XSS (CWE-79) in JetFormBuilder WordPress Plugin
CVE-2026-63577
Name Constraint Bypass (CWE-295) in Bouncy Castle C#
CVE-2026-63576
Certificate Validation Bypass (CWE-295) in BC-CSharp
CVE-2026-63573
Padding Oracle (CWE-203) in Bouncy Castle C# CMS RSA
CVE-2026-63567
Padding Oracle (CWE-203) in Bouncy Castle bc-csharp
CVE-2026-15897
Privilege Escalation (CWE-269) in Super Forms Plugin
CVE-2026-104123
SQL Injection (CWE-89) in Reviewer Management System
CVE-2026-104120
Server-Side Request Forgery (CWE-918) in MCP Fetch Tool
CVE-2026-103766
SQL Injection (CWE-89) in ClipBucket Ads Manager Panel
CVE-2026-103765
Missing Authentication (CWE-306) in Mooncake Metadata
CVE-2026-51897
Improper Access Control (CWE-284) in RAGFlow get_dataset
CVE-2026-51893
Access Control Flaw (CWE-284) in RAGFlow trace_mindmap
CVE-2026-51888
Directory Traversal (CWE-22) in Langflow Knowledge API
CVE-2026-51886
Code Injection (CWE-94) in Langflow Validation Route
CVE-2026-51884
Path Traversal (CWE-22) in Langchain Chatchat Upload
CVE-2026-51883
Path Traversal (CWE-22) in Langchain-Chatchat Upload
CVE-2026-51882
Path Traversal (CWE-22) in Langchain-Chatchat Files
CVE-2026-51881
Code Injection (CWE-94) in deeptutor ExecTool Service
CVE-2026-51880
Path Traversal (CWE-22) in deeptutor EditFileTool API
CVE-2026-51879
Authorization Bypass (CWE-639) in deeptutor TutorBot
CVE-2026-51876
Authorization Bypass (CWE-285) in DeepTutor Book Flow
CVE-2026-51875
Path Traversal (CWE-22) in Devika Feature Agent Code
CVE-2026-51874
Path Traversal (CWE-22) in Devika Patcher Agent Function
CVE-2026-51873
Directory Traversal (CWE-22) in Devika Coder Function
CVE-2026-104051
Information Disclosure (CWE-522) in PictShare API Endpoint
CVE-2026-56662
CSRF (CWE-352) in GetSimple CMS CE Update Form Endpoint
CVE-2026-56661
Server-Side Request Forgery (CWE-918) in GetSimple CMS
CVE-2026-56660
Unrestricted File Upload (CWE-434) in GetSimple CMS
CVE-2026-54049
Stored XSS (CWE-79) in Sakai Conversations Tool Feature
CVE-2026-55232
Server-Side Request Forgery (CWE-918) in Vvveb oEmbed Proxy
CVE-2026-55231
Path Traversal (CWE-22) in Vvveb Backup File Access
CVE-2026-55230
Stored XSS (CWE-79) in Vvveb CMS HTML Content Sanitizer
CVE-2026-55083
Unsafe Java Deserialization (CWE-502) in DHIS2 RCE
CVE-2026-104059
Cross-Site Request Forgery (CWE-352) in Lektor Admin API
CVE-2026-103921
Improper Certificate Validation (CWE-295) in GraphQL Tools
CVE-2024-58388
Path Traversal (CWE-22) in Sharp Multifunction Printers
CVE-2026-88789
XML External Entity (CWE-611) in Camel Quarkus XSLT
CVE-2026-103758
Authorization Bypass (CWE-863) in Obot MCP Gateway
CVE-2026-103757
Server-Side Request Forgery (CWE-918) in Budibase AI
CVE-2026-103292
Stored XSS (CWE-79) in Ghost JSON-LD Head Helper Output
CVE-2026-103278
Path Traversal (CWE-23) in Ghost Admin Iframe Page
CVE-2026-103277
Cross-Site Scripting (CWE-79) in Ghost oEmbed Preview
CVE-2026-103272
Information Disclosure (CWE-203) in Ghost Content API
CVE-2026-103271
Broken Access Control (CWE-863) in Ghost Content API
CVE-2026-103268
Authorization Bypass (CWE-862) in Ghost Staff Accounts
CVE-2026-103266
Authorization Bypass (CWE-863) in Ghost Stripe Flow
CVE-2026-103264
Authentication Bypass (CWE-287) in Fleet Device API
CVE-2026-103259
Session Token Leakage (CWE-863) in n8n Dynamic Credentials
CVE-2026-103257
Path Traversal (CWE-22) in n8n API Resource Handler
CVE-2026-103256
Cleartext Credential Exposure (CWE-522) in n8n Nodes
CVE-2026-103255
Path Traversal (CWE-73) in n8n Supabase Integration
CVE-2026-103253
SQL Injection (CWE-89) in n8n Oracle Database Node
CVE-2026-103252
Authorization Bypass (CWE-639) in n8n Credential API
CVE-2026-103251
Missing Authorization (CWE-862) in n8n Queue Mode
CVE-2026-103249
Stored DOM XSS (CWE-79) in n8n Resource Locator Dropdown
CVE-2026-103248
SQL Injection (CWE-89) in n8n Supabase Filter Mode
CVE-2026-103247
Authorization Bypass (CWE-639) in n8n Shared Workflows
CVE-2026-103246
Authorization Bypass (CWE-639) in n8n Agent Tooling
CVE-2026-103244
Authentication Bypass (CWE-306) in Ground-Station App
CVE-2026-15983
Arbitrary File Deletion (CWE-73) in WordPress Super Forms
CVE-2026-15989
Privilege Escalation (CWE-269) in Super Forms Plugin
exploitable in your codebase.