CVE-2026-19997 | Medium | 4.7 | 2026-08-17 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the comp… |
CVE-2026-19994 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management… |
CVE-2026-19986 | Medium | 5.4 | 2026-08-17 | A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file cont… |
CVE-2026-19979 | High | 8.3 | 2026-08-17 | A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19966 | Medium | 5.4 | 2026-08-17 | A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_conta… |
CVE-2026-16879 | High | 8.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-sup… |
CVE-2026-19838 | Medium | 4.3 | 2026-08-14 | A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the co… |
CVE-2026-19836 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th… |
CVE-2026-19834 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component… |
CVE-2026-19784 | Medium | 4.3 | 2026-08-14 | A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation caus… |
CVE-2026-73421 | | | 2026-08-13 | NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existe… |
CVE-2026-18509 | High | 8.2 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the att… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-3835 | Medium | 5.3 | 2026-08-13 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token vali… |
CVE-2026-10543 | High | 8.2 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. |
CVE-2026-72786 | Medium | 6.5 | 2026-08-12 | Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords… |
CVE-2026-18499 | High | 8.1 | 2026-08-12 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. |
CVE-2026-18144 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. |
CVE-2026-72907 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts th… |
CVE-2026-47663 | | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… |
CVE-2026-59118 | Critical | 9.3 | 2026-08-07 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-19066 | Medium | 4.3 | 2026-08-06 | A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students… |
CVE-2026-19064 | Medium | 4.3 | 2026-08-06 | A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php… |
CVE-2026-18367 | Critical | 9.3 | 2026-08-06 | A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos… |
CVE-2026-19006 | Medium | 6.3 | 2026-08-06 | A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exe… |
CVE-2026-18998 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the c… |
CVE-2026-18997 | Medium | 6.3 | 2026-08-06 | A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts o… |
CVE-2026-18992 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of… |
CVE-2026-70442 | Medium | 4.3 | 2026-08-05 | Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Ite… |
CVE-2026-18818 | Medium | 6.3 | 2026-08-04 | A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the… |
CVE-2026-18817 | Low | 2.2 | 2026-08-04 | A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/sr… |
CVE-2026-70472 | | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accep… |
CVE-2026-18773 | Medium | 6.3 | 2026-08-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py… |
CVE-2026-18723 | Medium | 6.3 | 2026-08-04 | A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-sta… |
CVE-2026-18722 | Medium | 6.3 | 2026-08-04 | A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw… |
CVE-2026-18720 | Medium | 5.3 | 2026-08-04 | A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the compone… |
CVE-2026-48115 | | | 2026-08-03 | Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerabi… |
CVE-2026-18631 | Medium | 6.3 | 2026-08-03 | A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/jav… |
CVE-2026-18584 | Medium | 5.4 | 2026-08-03 | A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /… |
CVE-2026-67332 | Medium | 6.4 | 2026-08-01 | @better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelate… |
CVE-2026-14538 | High | 7.7 | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1… |
CVE-2026-48499 | | | 2026-07-30 | Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated… |
CVE-2026-23981 | Medium | 4.3 | 2026-07-30 | An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do… |
CVE-2026-41187 | Medium | 6.5 | 2026-07-30 | Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNet… |
CVE-2026-66488 | Medium | 5.3 | 2026-07-29 | Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 |
CVE-2026-18207 | Medium | 6.5 | 2026-07-29 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique i… |
CVE-2026-47726 | | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog… |
CVE-2026-61487 | Medium | 6.5 | 2026-07-28 | Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated low-privilege user can bypass a per-de… |
CVE-2026-64743 | Medium | 6.5 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tah… |
CVE-2026-64711 | Medium | 5.5 | 2026-07-27 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… |
CVE-2026-43792 | Medium | 6.5 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.6, macOS Tahoe 26.6. An app may be able to access sensiti… |
CVE-2026-43775 | Medium | 5.5 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app may be able to acces… |
CVE-2026-43756 | Medium | 5.5 | 2026-07-27 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to… |
CVE-2026-64642 | High | 8.2 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications usin… |
CVE-2026-17531 | Medium | 5.0 | 2026-07-27 | A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts… |
CVE-2026-17530 | Medium | 6.3 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file Astr… |
CVE-2026-17529 | Medium | 6.3 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulati… |
CVE-2026-17434 | Medium | 6.3 | 2026-07-26 | A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the compone… |
CVE-2026-17433 | Medium | 5.3 | 2026-07-26 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts… |
CVE-2026-62835 | Critical | 9.3 | 2026-07-24 | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. |
CVE-2026-56160 | Critical | 9.1 | 2026-07-24 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-62563 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62444 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-61082 | Medium | 6.5 | 2026-07-21 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitab… |
CVE-2026-60957 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60911 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-60886 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60844 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update Service Request). Supported versions that are affected are… |
CVE-2026-60842 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Search). Supported versions that are affected are 12.2.5-12.2… |
CVE-2026-60152 | Medium | 5.4 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.6… |
CVE-2026-47053 | Medium | 5.6 | 2026-07-21 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.12. Easily exploi… |
CVE-2026-28312 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as… |
CVE-2026-16450 | Medium | 4.3 | 2026-07-21 | A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/s… |
CVE-2026-34239 | | | 2026-07-20 | Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected o… |
CVE-2026-32821 | High | 8.1 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32819 | Medium | 4.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32806 | High | 7.5 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-32807 | High | 7.5 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-27823 | | | 2026-07-20 | A vulnerability has been identified in EGroupware that may lead to Remote Code Execution (RCE). The issue allows an authenticated attacker to execute arbitrary… |
CVE-2026-63752 | Medium | 4.3 | 2026-07-20 | SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwri… |
CVE-2026-16224 | Medium | 4.3 | 2026-07-19 | A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component A… |
CVE-2026-16217 | Medium | 6.3 | 2026-07-19 | A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/de… |
CVE-2026-16214 | Medium | 6.3 | 2026-07-19 | A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashbo… |
CVE-2026-16200 | High | 7.3 | 2026-07-19 | A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the compone… |
CVE-2026-16199 | Medium | 6.3 | 2026-07-19 | A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed… |
CVE-2026-16195 | Medium | 6.3 | 2026-07-18 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of… |
CVE-2026-16126 | High | 7.3 | 2026-07-18 | A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c o… |
CVE-2026-16122 | Medium | 4.3 | 2026-07-18 | A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesA… |
CVE-2026-16121 | Medium | 6.3 | 2026-07-18 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The man… |
CVE-2026-16119 | Medium | 6.3 | 2026-07-18 | A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the… |
CVE-2024-58367 | Medium | 6.5 | 2026-07-18 | SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access un… |
CVE-2026-16075 | Medium | 4.3 | 2026-07-18 | A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard… |
CVE-2026-49977 | Medium | 4.3 | 2026-07-17 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class an… |
CVE-2026-61718 | Medium | 5.4 | 2026-07-16 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization b… |
CVE-2026-15909 | Medium | 6.3 | 2026-07-16 | A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/a… |
CVE-2026-53515 | High | 7.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint… |
CVE-2026-45337 | High | 7.6 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated ses… |
CVE-2026-49997 | Medium | 5.4 | 2026-07-15 | SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/… |
CVE-2026-58540 | High | 7.8 | 2026-07-14 | Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-58277 | High | 8.8 | 2026-07-14 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |