CVE-2026-73194 | | | 2026-08-15 | DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.
preparse… |
CVE-2026-19639 | Medium | 4.3 | 2026-08-14 | An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their ass… |
CVE-2026-53794 | Medium | 5.3 | 2026-08-13 | rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity chec… |
CVE-2026-19566 | High | 7.5 | 2026-08-12 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
The _encode method accepts an… |
CVE-2026-19518 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-71394 | | | 2026-08-10 | GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the… |
CVE-2026-19028 | | | 2026-08-06 | H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the… |
CVE-2026-19026 | | | 2026-08-05 | H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nel… |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-20313 | High | 7.7 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-70378 | High | 7.5 | 2026-08-05 | imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes… |
CVE-2026-40272 | High | 7.0 | 2026-07-29 | Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to e… |
CVE-2026-54890 | High | 7.5 | 2026-07-27 | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Ex… |
CVE-2026-59532 | High | 7.5 | 2026-07-27 | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. |
CVE-2026-59531 | High | 7.5 | 2026-07-27 | Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. |
CVE-2026-58662 | Critical | 9.1 | 2026-07-27 | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0… |
CVE-2026-66374 | High | 8.1 | 2026-07-25 | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. |
CVE-2026-11721 | High | 7.5 | 2026-07-22 | It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. Th… |
CVE-2026-10822 | Medium | 6.5 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.
BIND will first… |
CVE-2026-32665 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC conn… |
CVE-2026-47667 | High | 7.5 | 2026-07-21 | CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the fi… |
CVE-2026-59695 | | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by… |
CVE-2026-59694 | | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per payment by a… |
CVE-2026-59252 | | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet, resulting in denial of… |
CVE-2026-57364 | Medium | 6.5 | 2026-07-13 | Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &a… |
CVE-2026-57023 | High | 7.5 | 2026-07-09 | An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series… |
CVE-2026-57019 | Medium | 6.5 | 2026-07-09 | An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an u… |
CVE-2026-59930 | Medium | 4.3 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and TableOfContents directive generate heading IDs as predictabl… |
CVE-2026-59879 | High | 7.5 | 2026-07-08 | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functiona… |
CVE-2026-59997 | Medium | 4.2 | 2026-07-08 | internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would… |
CVE-2026-43928 | | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks a… |
CVE-2026-54234 | High | 7.5 | 2026-07-06 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding work… |
CVE-2022-4990 | | | 2026-07-03 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validat… |
CVE-2022-4989 | | | 2026-07-03 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memor… |
CVE-2026-55952 | High | 7.5 | 2026-07-02 | The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equa… |
CVE-2026-57623 | Critical | 9.0 | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. |
CVE-2026-11906 | Medium | 6.5 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2026-56035 | High | 8.6 | 2026-06-26 | Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. |
CVE-2026-54092 | Medium | 6.5 | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unche… |
CVE-2026-12755 | Low | 2.7 | 2026-06-25 | Improper input validation in the PAM AD discovery endpoints in
Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated
user with the UserGro… |
CVE-2026-57062 | Low | 2.9 | 2026-06-23 | CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes… |
CVE-2026-57053 | Medium | 4.0 | 2026-06-23 | GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The af… |
CVE-2026-53540 | Low | 3.7 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound… |
CVE-2026-55392 | Medium | 5.5 | 2026-06-18 | NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-s… |
CVE-2026-55706 | Medium | 5.8 | 2026-06-17 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. |
CVE-2026-49110 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions. |
CVE-2026-49078 | High | 7.5 | 2026-06-15 | Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions. |
CVE-2026-45441 | High | 7.5 | 2026-06-15 | Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions. |
CVE-2026-42657 | Medium | 5.3 | 2026-06-15 | Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions. |
CVE-2026-12059 | High | 8.8 | 2026-06-12 | The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote attackers to bypass the enforced… |
CVE-2026-49218 | High | 7.5 | 2026-06-10 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the… |
CVE-2026-11596 | Medium | 4.7 | 2026-06-10 | In ScreenConnect™ versions prior to 26.2, input
validation within the Host Pass creation functionality could allow an
authenticated user with Host Pass creatio… |
CVE-2026-53689 | High | 7.1 | 2026-06-10 | libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in… |
CVE-2026-52905 | Medium | 5.5 | 2026-06-09 | In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: disallow non-power of two min_region_sz on damon_start()
Commit d8f867fa08… |
CVE-2026-49777 | Critical | 10.0 | 2026-06-05 | Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted.
… |
CVE-2026-47329 | Low | 3.3 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be t… |
CVE-2026-9801 | Medium | 4.9 | 2026-05-28 | A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protoc… |
CVE-2026-44635 | High | 7.5 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (… |
CVE-2026-9704 | Medium | 6.8 | 2026-05-27 | A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JW… |
CVE-2026-7254 | Medium | 5.3 | 2026-05-27 | IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users. |
CVE-2026-46033 | High | 7.1 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved:
crypto: authencesn - reject short ahash digests during instance creation
authencesn requi… |
CVE-2026-3676 | Medium | 6.5 | 2026-05-27 | IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an au… |
CVE-2026-42744 | Medium | 6.5 | 2026-05-27 | Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Manipulating Hidden Fields.This… |
CVE-2026-42732 | Medium | 6.5 | 2026-05-27 | Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Input Data Manipulation.This is… |
CVE-2026-8047 | High | 7.5 | 2026-05-26 | The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated… |
CVE-2026-39829 | High | 7.5 | 2026-05-22 | The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could… |
CVE-2025-15645 | Medium | 4.6 | 2026-05-19 | Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handl… |
CVE-2026-8813 | High | 7.5 | 2026-05-19 | This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together… |
CVE-2026-44826 | High | 7.5 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign… |
CVE-2026-0428 | | | 2026-05-15 | Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to write invalid d… |
CVE-2025-66660 | | | 2026-05-15 | Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cause incorrect shar… |
CVE-2025-14869 | High | 7.5 | 2026-05-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have a… |
CVE-2026-44459 | Low | 3.8 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp… |
CVE-2026-25863 | High | 7.5 | 2026-05-04 | Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailPars… |
CVE-2025-70071 | Medium | 5.9 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray() |
CVE-2025-70069 | High | 7.5 | 2026-05-04 | An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method |
CVE-2026-1577 | Medium | 6.5 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-14688 | Medium | 5.3 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2026-6915 | Medium | 6.3 | 2026-04-29 | An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with a… |
CVE-2026-41677 | Critical | 9.1 | 2026-04-24 | rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the leng… |
CVE-2026-1352 | Medium | 6.5 | 2026-04-23 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2026-33471 | Critical | 9.6 | 2026-04-22 | nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then… |
CVE-2026-6839 | Medium | 6.6 | 2026-04-22 | Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Op… |
CVE-2026-41285 | Medium | 4.3 | 2026-04-21 | In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local networ… |
CVE-2026-2403 | Medium | 4.3 | 2026-04-14 | CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a… |
CVE-2025-3756 | Medium | 6.5 | 2026-04-13 | A vulnerability exists in the command handling of the IEC 61850 communication stack included in the product revisions listed as affected in this CVE. An attack… |
CVE-2026-40093 | High | 8.1 | 2026-04-09 | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >=… |
CVE-2026-1101 | Medium | 6.5 | 2026-04-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowe… |
CVE-2026-1092 | High | 7.5 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have al… |
CVE-2025-12664 | High | 7.5 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have all… |
CVE-2026-35489 | High | 7.3 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint… |
CVE-2026-34756 | Medium | 6.5 | 2026-04-06 | vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the vLLM Ope… |
CVE-2026-34545 | High | 7.3 | 2026-04-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3… |
CVE-2026-30573 | High | 7.5 | 2026-04-01 | A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0. The vulnerability is located in the add-sales.php file. The app… |
CVE-2026-30575 | High | 7.5 | 2026-03-27 | A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file. The application fails to validate the… |
CVE-2026-25345 | Critical | 9.9 | 2026-03-25 | Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Prope… |
CVE-2025-13078 | Medium | 6.5 | 2026-03-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have al… |
CVE-2026-33349 | Medium | 5.9 | 2026-03-24 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the D… |
CVE-2019-25551 | Medium | 6.2 | 2026-03-21 | Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the P… |