CVE-2026-22072 | | | 2026-08-17 | Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. |
CVE-2026-12128 | Medium | 5.3 | 2026-08-15 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and inclu… |
CVE-2026-73845 | Medium | 5.3 | 2026-08-14 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/q… |
CVE-2026-19826 | High | 7.3 | 2026-08-14 | A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerial… |
CVE-2026-73658 | High | 8.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4Fet… |
CVE-2026-59109 | High | 8.8 | 2026-08-13 | SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-inv… |
CVE-2026-49827 | Critical | 9.8 | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbi… |
CVE-2026-73418 | High | 7.5 | 2026-08-12 | NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next… |
CVE-2026-19503 | Medium | 4.8 | 2026-08-12 | MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's disco… |
CVE-2026-69106 | High | 8.8 | 2026-08-12 | A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. |
CVE-2026-17109 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection. |
CVE-2026-20901 | | | 2026-08-11 | Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a priv… |
CVE-2026-71390 | Medium | 4.0 | 2026-08-11 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-70325 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70323 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70322 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70320 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70319 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-70318 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2026-70316 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70314 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally. |
CVE-2026-70313 | High | 7.8 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-70312 | Medium | 5.5 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. |
CVE-2026-65811 | High | 8.8 | 2026-08-11 | Improper input validation in Power BI allows an authorized attacker to execute code over a network. |
CVE-2026-63520 | High | 8.1 | 2026-08-11 | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-62917 | Medium | 4.6 | 2026-08-11 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-61363 | High | 7.5 | 2026-08-11 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-59134 | High | 7.5 | 2026-08-11 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2026-48436 | Medium | 6.5 | 2026-08-11 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-48384 | Medium | 4.9 | 2026-08-11 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges co… |
CVE-2026-27765 | | | 2026-08-11 | Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Applications may allow a denia… |
CVE-2026-21279 | High | 8.2 | 2026-08-11 | is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypa… |
CVE-2026-21273 | High | 8.7 | 2026-08-11 | is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability… |
CVE-2026-20913 | | | 2026-08-11 | Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an escalation of privileg… |
CVE-2026-20715 | | | 2026-08-11 | Improper input validation in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT) and some Intel(R) Standard Manageability may allow a d… |
CVE-2026-9214 | | | 2026-08-11 | Insufficient input validation vulnerability in the NETGEAR R7000 models
allows authenticated administrators connected to the local network to
make unauthoriz… |
CVE-2026-11738 | | | 2026-08-11 | Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorize… |
CVE-2026-11737 | | | 2026-08-11 | Insufficient input validation vulnerability in the listed
NETGEAR models allows authenticated administrators connected to the
local network to make unauthori… |
CVE-2026-11736 | | | 2026-08-11 | A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router sof… |
CVE-2026-48056 | Critical | 10.0 | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplie… |
CVE-2026-73158 | | | 2026-08-11 | Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later con… |
CVE-2026-71217 | High | 7.5 | 2026-08-11 | A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as… |
CVE-2026-72867 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/s… |
CVE-2026-72728 | Medium | 6.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist… |
CVE-2026-42537 | Critical | 9.8 | 2026-08-10 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-40920 | Critical | 9.8 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0.
Users are recommended to upgrade to version 2.9.0, which fixes this iss… |
CVE-2026-21083 | | | 2026-08-10 | Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. |
CVE-2026-21072 | | | 2026-08-10 | Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21071 | | | 2026-08-10 | Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21070 | | | 2026-08-10 | Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. |
CVE-2026-21066 | | | 2026-08-10 | Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21065 | | | 2026-08-10 | Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. |
CVE-2026-21061 | | | 2026-08-10 | Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is requir… |
CVE-2026-21060 | | | 2026-08-10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles. |
CVE-2026-21058 | | | 2026-08-10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. |
CVE-2026-9031 | | | 2026-08-07 | An input validation
vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation
of user-supplied data before it is processed by internal f… |
CVE-2026-50540 | Critical | 9.6 | 2026-08-07 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to ve… |
CVE-2026-47664 | | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, th… |
CVE-2026-47662 | | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… |
CVE-2026-62296 | High | 7.5 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum e… |
CVE-2026-62295 | High | 7.5 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fh… |
CVE-2026-62293 | Medium | 5.0 | 2026-08-07 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates… |
CVE-2026-54217 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An
attacker can send an email containing malicious JavaScrip… |
CVE-2026-54208 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an
unauthenticated attacker to create or write into exist… |
CVE-2026-54207 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts
an arbitrary path, which can be set to network locations usin… |
CVE-2026-54206 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a
@@INCLUDE command, which can be set to network locations usi… |
CVE-2026-54205 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm)
accepts a “pathname” parameter, which can be set to network… |
CVE-2026-54204 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot”
parameter, which can be set to network locations using UNC paths (e… |
CVE-2026-54199 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the
request body in the application's link storing functionality
(//… |
CVE-2026-19177 | High | 8.3 | 2026-08-06 | Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-19169 | High | 8.8 | 2026-08-06 | Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalati… |
CVE-2026-19164 | Critical | 9.6 | 2026-08-06 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape… |
CVE-2026-19153 | High | 8.1 | 2026-08-06 | Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-19143 | High | 8.6 | 2026-08-06 | Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a san… |
CVE-2026-15149 | Medium | 5.3 | 2026-08-06 | The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking… |
CVE-2026-14225 | Low | 2.7 | 2026-08-06 | The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the firs… |
CVE-2024-6541 | Medium | 6.8 | 2026-08-06 | The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated… |
CVE-2026-16316 | Medium | 4.3 | 2026-08-06 | OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV fra… |
CVE-2026-57817 | High | 8.1 | 2026-08-06 | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is i… |
CVE-2025-13909 | Medium | 4.3 | 2026-08-06 | The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-fact… |
CVE-2024-10302 | Medium | 4.0 | 2026-08-06 | The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be inc… |
CVE-2026-71318 | Medium | 4.8 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_is… |
CVE-2026-70607 | Medium | 5.3 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, som… |
CVE-2026-20303 | Critical | 9.9 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-20273 | High | 8.6 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive inter… |
CVE-2026-70603 | Medium | 6.0 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.6, 40.9.0, 41.1.1, and 42.0.0-beta.1, she… |
CVE-2026-46334 | | | 2026-08-05 | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the S… |
CVE-2026-70589 | Medium | 4.8 | 2026-08-04 | Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no lon… |
CVE-2026-16793 | High | 8.8 | 2026-08-04 | An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that… |
CVE-2026-18801 | | | 2026-08-04 | OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.
An attacker who can create o… |
CVE-2026-11835 | | | 2026-08-04 | Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows… |
CVE-2026-67978 | High | 7.5 | 2026-08-03 | An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame. |
CVE-2026-67974 | High | 7.5 | 2026-08-03 | A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial… |
CVE-2026-67969 | High | 7.5 | 2026-08-03 | An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl en… |
CVE-2026-69198 | | | 2026-08-03 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method i… |
CVE-2026-69192 | | | 2026-08-03 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading z… |
CVE-2026-69185 | High | 7.5 | 2026-08-03 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can ma… |
CVE-2026-21555 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21554 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |
CVE-2026-21553 | High | 7.5 | 2026-08-03 | In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed |