CVE-2026-77427 | Medium | 5.9 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise insta… |
CVE-2026-110769 | High | 8.6 | 2026-10-14 | holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent… |
CVE-2026-110631 | Critical | 9.8 | 2026-10-14 | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core… |
CVE-2026-14765 | High | 7.7 | 2026-10-14 | Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary… |
CVE-2026-53709 | Critical | 9.8 | 2026-10-13 | MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verif… |
CVE-2026-89120 | High | 7.1 | 2026-10-13 | A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single t… |
CVE-2026-89105 | Medium | 4.2 | 2026-10-13 | The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potent… |
CVE-2026-109569 | High | 8.8 | 2026-10-12 | sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter att… |
CVE-2026-78018 | Medium | 6.3 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability… |
CVE-2026-78013 | Medium | 5.2 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability… |
CVE-2026-104078 | High | 7.8 | 2026-10-08 | Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary co… |
CVE-2026-104077 | High | 7.8 | 2026-10-08 | Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient s… |
CVE-2026-76276 | Medium | 4.3 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve or… |
CVE-2026-33586 | | | 2026-10-07 | Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from” and “From” fields when sending
emails through OVH mail servers.
Due to OVH… |
CVE-2026-105744 | High | 7.5 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, calle… |
CVE-2026-103956 | Critical | 10.0 | 2026-10-02 | Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authorit… |
CVE-2026-85086 | | | 2026-10-02 | Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings.
This issue affects Apac… |
CVE-2026-85494 | High | 7.5 | 2026-10-02 | Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initi… |
CVE-2026-94634 | | | 2026-10-02 | Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings.
… |
CVE-2026-71448 | | | 2026-10-01 | : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse.
This issue affects EasyIO FS32: bef… |
CVE-2026-100260 | Medium | 5.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
CVE-2026-100291 | Critical | 9.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This… |
CVE-2026-102676 | High | 8.3 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an… |
CVE-2026-73596 | Low | 3.8 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability… |
CVE-2026-93354 | High | 8.1 | 2026-09-24 | Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and… |
CVE-2026-97055 | High | 8.1 | 2026-09-24 | SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIG… |
CVE-2026-86246 | Critical | 9.1 | 2026-09-23 | Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOT… |
CVE-2026-89139 | | | 2026-09-21 | Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose funct… |
CVE-2026-93338 | Medium | 5.3 | 2026-09-18 | Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain… |
CVE-2026-54907 | Medium | 5.3 | 2026-09-17 | Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and passwo… |
CVE-2026-61793 | | | 2026-09-17 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the docume… |
CVE-2026-57148 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signin… |
CVE-2026-57147 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRE… |
CVE-2026-57139 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction a… |
CVE-2026-52824 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_uniq… |
CVE-2026-53660 | | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie wit… |
CVE-2026-57127 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or J… |
CVE-2026-49462 | Medium | 5.3 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-79394 | High | 7.5 | 2026-09-11 | An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.183… |
CVE-2026-87827 | | | 2026-09-09 | Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A… |
CVE-2026-86464 | | | 2026-09-08 | In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included inse… |
CVE-2026-77348 | High | 8.2 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP… |
CVE-2026-53507 | | | 2026-08-31 | oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff ac… |
CVE-2026-75062 | | | 2026-08-26 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior… |
CVE-2026-55581 | High | 8.4 | 2026-08-25 | mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash i… |
CVE-2026-77915 | Critical | 9.8 | 2026-08-24 | rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Admi… |
CVE-2026-62388 | High | 7.5 | 2026-08-22 | NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. A… |
CVE-2026-75926 | High | 8.6 | 2026-08-18 | Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach th… |
CVE-2025-59321 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to b… |
CVE-2026-33921 | Medium | 5.2 | 2026-08-11 | The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of t… |
CVE-2026-63563 | Medium | 6.5 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configu… |
CVE-2026-62416 | Medium | 5.3 | 2026-08-03 | Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files un… |
CVE-2026-16504 | Critical | 9.8 | 2026-07-31 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True. |
CVE-2026-16503 | Critical | 9.1 | 2026-07-31 | Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database… |
CVE-2026-67208 | Critical | 9.8 | 2026-07-30 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting… |
CVE-2026-66066 | | | 2026-07-30 | Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libv… |
CVE-2026-65881 | High | 7.5 | 2026-07-28 | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the ext… |
CVE-2026-9680 | Medium | 5.8 | 2026-07-28 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP end… |
CVE-2026-47668 | Critical | 10.0 | 2026-07-23 | DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via co… |
CVE-2026-55708 | Low | 3.1 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' commands of 'unbound-control' create a bare local zones tr… |
CVE-2026-47393 | Critical | 9.8 | 2026-07-21 | PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_a… |
CVE-2026-62415 | Critical | 9.1 | 2026-07-21 | Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by de… |
CVE-2026-60024 | Critical | 9.8 | 2026-07-17 | Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by de… |
CVE-2026-10671 | High | 7.1 | 2026-07-14 | In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel ob… |
CVE-2026-62185 | High | 7.6 | 2026-07-13 | Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attacke… |
CVE-2026-61439 | High | 7.5 | 2026-07-11 | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-lev… |
CVE-2026-54800 | Medium | 4.8 | 2026-07-09 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affec… |
CVE-2026-14474 | High | 8.8 | 2026-07-07 | A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree… |
CVE-2026-56285 | High | 8.6 | 2026-06-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated at… |
CVE-2026-46386 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERW… |
CVE-2026-55454 | Critical | 9.9 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authenti… |
CVE-2026-54158 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell con… |
CVE-2026-54067 | Critical | 9.9 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing </style> breaks out of its surrounding <style> tag w… |
CVE-2026-54066 | High | 7.5 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitize… |
CVE-2026-48509 | Critical | 9.1 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, the parameterless MessagePackInputFormatter() constructor uses default seria… |
CVE-2026-48502 | High | 7.5 | 2026-06-22 | MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attac… |
CVE-2026-50519 | Medium | 6.5 | 2026-06-19 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a n… |
CVE-2026-20265 | Medium | 4.3 | 2026-06-17 | In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to ma… |
CVE-2026-0134 | Medium | 4.0 | 2026-06-16 | In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local… |
CVE-2026-9262 | Medium | 6.5 | 2026-06-16 | Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-54359 | | | 2026-06-12 | MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is disabled, state-cha… |
CVE-2026-44892 | High | 7.5 | 2026-06-12 | Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http… |
CVE-2026-40994 | High | 8.2 | 2026-06-11 | Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on Request… |
CVE-2026-46517 | High | 7.8 | 2026-06-10 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables H… |
CVE-2026-36616 | Medium | 5.9 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default… |
CVE-2026-36612 | Medium | 6.4 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts). |
CVE-2026-44825 | High | 8.1 | 2026-06-01 | Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote att… |
CVE-2026-9039 | | | 2026-05-28 | A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended sole… |
CVE-2026-35672 | High | 7.5 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to cr… |
CVE-2026-24197 | Medium | 6.5 | 2026-05-26 | NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memo… |
CVE-2026-46430 | Medium | 4.3 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platfo… |
CVE-2026-45728 | High | 7.5 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode… |
CVE-2026-44670 | | | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape… |
CVE-2026-44588 | | | 2026-05-14 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via g… |
CVE-2026-33376 | High | 7.4 | 2026-05-13 | When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate ea… |
CVE-2026-43892 | High | 8.8 | 2026-05-12 | AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code… |
CVE-2026-30805 | Critical | 9.1 | 2026-05-12 | Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800 |
CVE-2026-6866 | High | 7.5 | 2026-05-12 | CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when cred… |
CVE-2026-27662 | High | 7.7 | 2026-05-12 | Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
This could a… |
CVE-2026-41432 | High | 7.1 | 2026-05-08 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in th… |