CVE-2026-53959 | Medium | 6.5 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows any authenticated user to enumerate account information for ever… |
CVE-2026-76041 | | | 2026-08-18 | Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (C… |
CVE-2026-62988 | Critical | 9.0 | 2026-08-18 | Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and… |
CVE-2026-63640 | Medium | 4.3 | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_he… |
CVE-2026-75915 | High | 7.5 | 2026-08-18 | CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment… |
CVE-2026-62684 | Low | 2.7 | 2026-08-18 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the… |
CVE-2026-69189 | High | 7.6 | 2026-08-18 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLS… |
CVE-2026-74972 | Medium | 4.3 | 2026-08-18 | Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbir… |
CVE-2026-74971 | Medium | 4.3 | 2026-08-18 | Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Th… |
CVE-2026-75839 | Medium | 4.3 | 2026-08-18 | ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints… |
CVE-2026-75587 | Low | 3.6 | 2026-08-17 | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with acces… |
CVE-2026-42164 | Critical | 9.8 | 2026-08-17 | Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the ba… |
CVE-2026-71424 | Critical | 9.6 | 2026-08-17 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints exp… |
CVE-2026-64778 | Medium | 6.5 | 2026-08-17 | The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 2… |
CVE-2026-64760 | Medium | 5.5 | 2026-08-17 | An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive ke… |
CVE-2026-57485 | High | 8.5 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in… |
CVE-2026-68520 | Medium | 5.3 | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes pub… |
CVE-2026-64859 | Critical | 9.1 | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user look… |
CVE-2026-49307 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49302 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49301 | Medium | 6.2 | 2026-08-17 | Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-19992 | Low | 3.1 | 2026-08-17 | A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the… |
CVE-2026-19717 | High | 7.5 | 2026-08-16 | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unau… |
CVE-2026-19613 | Medium | 6.5 | 2026-08-16 | The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field value… |
CVE-2026-73047 | Medium | 6.2 | 2026-08-15 | siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduce… |
CVE-2026-16611 | High | 7.5 | 2026-08-15 | The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowi… |
CVE-2026-16541 | Medium | 6.5 | 2026-08-15 | The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the reque… |
CVE-2026-66272 | Medium | 5.3 | 2026-08-14 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker… |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-72834 | Medium | 4.3 | 2026-08-14 | filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire… |
CVE-2026-73304 | Medium | 4.9 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by pack… |
CVE-2026-18068 | Medium | 4.3 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion. |
CVE-2026-72670 | High | 7.7 | 2026-08-13 | A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally… |
CVE-2026-58511 | Low | 2.7 | 2026-08-13 | Webhook Authorization Header Returned in Plaintext via API |
CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2026-58442 | Medium | 6.5 | 2026-08-13 | Repository migration SSRF via multi-answer DNS allow-list bypass |
CVE-2026-58434 | High | 7.5 | 2026-08-13 | Private Repository Metadata Remains Accessible After Access Revocation |
CVE-2026-58432 | Medium | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive… |
CVE-2026-58427 | High | 7.5 | 2026-08-13 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 |
CVE-2026-58425 | Medium | 4.3 | 2026-08-13 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) |
CVE-2026-57897 | Medium | 6.5 | 2026-08-13 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs |
CVE-2026-55982 | Critical | 9.1 | 2026-08-13 | OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes |
CVE-2026-50105 | Medium | 4.3 | 2026-08-13 | RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) |
CVE-2026-73622 | High | 7.5 | 2026-08-13 | GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate s… |
CVE-2026-73604 | Medium | 6.5 | 2026-08-13 | Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in pl… |
CVE-2026-59503 | Critical | 9.1 | 2026-08-13 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor |
CVE-2026-59499 | High | 8.6 | 2026-08-13 | CWE-200: Exposure of Sensitive
Information to an Unauthorized Actor |
CVE-2026-73411 | | | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : o… |
CVE-2026-73406 | High | 7.5 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/inde… |
CVE-2026-73308 | Medium | 5.7 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing t… |
CVE-2026-72804 | High | 8.6 | 2026-08-12 | SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-leve… |
CVE-2026-18673 | | | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interf… |
CVE-2026-65017 | Medium | 6.5 | 2026-08-12 | Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mod… |
CVE-2026-54183 | Medium | 4.3 | 2026-08-12 | Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not des… |
CVE-2026-47234 | Medium | 4.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and… |
CVE-2026-19073 | Medium | 5.3 | 2026-08-12 | The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not… |
CVE-2026-18943 | Medium | 6.5 | 2026-08-12 | The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscri… |
CVE-2026-18049 | High | 7.5 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an o… |
CVE-2026-16253 | High | 7.5 | 2026-08-12 | The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unau… |
CVE-2026-14925 | High | 7.5 | 2026-08-12 | The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated a… |
CVE-2026-13168 | Medium | 6.5 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and abov… |
CVE-2026-12976 | Medium | 6.5 | 2026-08-12 | The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's… |
CVE-2026-73246 | High | 7.5 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java… |
CVE-2026-73230 | | | 2026-08-11 | Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32… |
CVE-2026-73229 | Medium | 4.3 | 2026-08-11 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRende… |
CVE-2026-48771 | High | 8.2 | 2026-08-11 | ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side dat… |
CVE-2026-48767 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token… |
CVE-2026-73082 | | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoi… |
CVE-2026-66301 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a… |
CVE-2026-65769 | Medium | 6.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61924 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61921 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-61918 | Medium | 6.5 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2026-59130 | Medium | 5.6 | 2026-08-11 | No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally. |
CVE-2026-54123 | Medium | 5.5 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally. |
CVE-2026-20737 | | | 2026-08-11 | Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow… |
CVE-2026-48766 | High | 7.6 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys b… |
CVE-2026-72744 | Medium | 6.2 | 2026-08-11 | Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools wo… |
CVE-2026-72549 | Medium | 5.3 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to… |
CVE-2026-72548 | High | 7.5 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant rec… |
CVE-2026-72539 | Medium | 6.5 | 2026-08-11 | An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scri… |
CVE-2026-11985 | Low | 3.6 | 2026-08-11 | On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and… |
CVE-2026-72915 | High | 7.5 | 2026-08-10 | Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use… |
CVE-2026-72873 | Medium | 6.5 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns prov… |
CVE-2026-72726 | Medium | 6.5 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot c… |
CVE-2026-72760 | | | 2026-08-10 | Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another… |
CVE-2026-61899 | High | 7.5 | 2026-08-10 | Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are re… |
CVE-2026-19074 | Medium | 5.3 | 2026-08-10 | The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensiti… |
CVE-2026-18946 | High | 7.5 | 2026-08-10 | The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly acce… |
CVE-2026-18470 | High | 7.5 | 2026-08-10 | The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately… |
CVE-2026-17542 | High | 7.5 | 2026-08-10 | The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated… |
CVE-2026-17541 | High | 7.5 | 2026-08-10 | The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its fil… |
CVE-2026-17022 | High | 7.5 | 2026-08-10 | The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confi… |
CVE-2026-14206 | High | 7.5 | 2026-08-10 | The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthent… |
CVE-2026-19363 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorize… |
CVE-2026-19357 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The mani… |
CVE-2026-19356 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The ma… |
CVE-2026-18357 | High | 7.5 | 2026-08-09 | The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unaut… |
CVE-2026-18032 | High | 7.5 | 2026-08-09 | The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guar… |
CVE-2026-16988 | High | 7.5 | 2026-08-09 | The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allow… |