CVE-2026-17079 | Medium | 6.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side in… |
CVE-2026-18428 | High | 8.8 | 2026-08-13 | A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to… |
CVE-2026-0293 | | | 2026-08-13 | A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protecti… |
CVE-2026-73288 | | | 2026-08-12 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objec… |
CVE-2025-59326 | Critical | 9.8 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be… |
CVE-2026-73217 | | | 2026-08-11 | Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtu… |
CVE-2026-73083 | | | 2026-08-11 | Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with impo… |
CVE-2026-69278 | High | 7.8 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-62902 | Medium | 6.5 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-54981 | High | 7.8 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature… |
CVE-2026-39452 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an escalation of privilege… |
CVE-2026-28757 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalation of privilege. Unpr… |
CVE-2026-28707 | | | 2026-08-11 | Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged softwar… |
CVE-2026-24693 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Applications may allow an escalation of pr… |
CVE-2026-21400 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escalation of privilege… |
CVE-2026-21387 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege. Unprivileged soft… |
CVE-2026-20906 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an escalation of privi… |
CVE-2026-20903 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation of privilege. Syste… |
CVE-2026-20770 | | | 2026-08-11 | Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applications may allow an es… |
CVE-2026-20755 | | | 2026-08-11 | Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversar… |
CVE-2026-20728 | | | 2026-08-11 | Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may allow an escalation… |
CVE-2026-20702 | | | 2026-08-11 | Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivileged software adver… |
CVE-2026-72781 | High | 8.8 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Becau… |
CVE-2026-19168 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19152 | High | 8.3 | 2026-08-06 | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-19150 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-13342 | Medium | 5.3 | 2026-08-06 | The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing t… |
CVE-2025-15039 | Critical | 9.4 | 2026-08-06 | The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific… |
CVE-2024-6832 | Medium | 5.9 | 2026-08-06 | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locki… |
CVE-2026-70608 | High | 7.2 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed ifra… |
CVE-2026-70444 | Medium | 4.3 | 2026-08-05 | A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credent… |
CVE-2026-70601 | High | 7.5 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, app… |
CVE-2026-18015 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cra… |
CVE-2026-17943 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML p… |
CVE-2026-17936 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-17931 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-17923 | Medium | 6.5 | 2026-07-30 | Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chr… |
CVE-2026-17919 | Medium | 6.8 | 2026-07-30 | Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via physi… |
CVE-2026-17899 | High | 8.8 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-17882 | Medium | 6.5 | 2026-07-30 | Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass site is… |
CVE-2026-17865 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pot… |
CVE-2026-17856 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-17779 | Medium | 5.4 | 2026-07-30 | Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML pa… |
CVE-2026-17776 | Medium | 5.8 | 2026-07-30 | Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-17764 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (… |
CVE-2026-17710 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pote… |
CVE-2026-17695 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cr… |
CVE-2026-17677 | High | 8.8 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via… |
CVE-2026-17676 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17674 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML pag… |
CVE-2026-17669 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape… |
CVE-2026-17659 | Medium | 4.2 | 2026-07-30 | Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to byp… |
CVE-2026-67427 | High | 8.6 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any hos… |
CVE-2026-64728 | Medium | 6.5 | 2026-07-27 | A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS… |
CVE-2026-64708 | Medium | 5.5 | 2026-07-27 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may b… |
CVE-2026-28912 | High | 7.8 | 2026-07-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be able to elevate privileges. |
CVE-2026-28900 | Medium | 5.5 | 2026-07-27 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP arch… |
CVE-2026-28849 | Medium | 5.5 | 2026-07-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may bypass Ga… |
CVE-2026-66391 | Medium | 6.5 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.
This issue affects Apache Wicket: from 9.0.0 through 9.23.0… |
CVE-2026-48037 | | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundatio… |
CVE-2026-48033 | | | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can… |
CVE-2026-65899 | Medium | 6.1 | 2026-07-23 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundar… |
CVE-2025-50330 | High | 8.8 | 2026-07-22 | An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe. |
CVE-2025-50329 | Critical | 9.8 | 2026-07-22 | An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe. |
CVE-2025-50327 | High | 8.8 | 2026-07-22 | An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-… |
CVE-2025-50325 | Medium | 5.4 | 2026-07-22 | BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mecha… |
CVE-2025-50324 | High | 8.8 | 2026-07-22 | An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component. |
CVE-2025-44090 | High | 8.8 | 2026-07-22 | An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file. |
CVE-2025-44089 | High | 8.8 | 2026-07-22 | An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file. |
CVE-2026-60166 | Low | 3.1 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allo… |
CVE-2026-60164 | Low | 3.1 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allo… |
CVE-2026-46403 | Medium | 6.3 | 2026-07-21 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes `ExecuteReadOnlyWithTypedArguments` as a read-only execution… |
CVE-2026-56585 | Low | 3.1 | 2026-07-21 | HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce un… |
CVE-2026-47392 | Critical | 9.9 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `execute_code()` in `praison… |
CVE-2026-16407 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16406 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16394 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16390 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.1… |
CVE-2026-16388 | Critical | 9.8 | 2026-07-21 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16383 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16382 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16380 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16377 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16370 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16356 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-44982 | High | 7.2 | 2026-07-16 | CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request bo… |
CVE-2026-56087 | Medium | 6.1 | 2026-07-15 | Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with physical access could potentially exploit… |
CVE-2026-49981 | High | 8.2 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is con… |
CVE-2026-48808 | High | 7.5 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to… |
CVE-2026-48807 | Critical | 9.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters… |
CVE-2026-48806 | Critical | 9.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke _… |
CVE-2026-48805 | Critical | 9.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreEx… |
CVE-2026-46639 | Medium | 6.5 | 2026-07-14 | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument… |
CVE-2026-46638 | High | 8.1 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without… |
CVE-2026-46634 | Critical | 9.8 | 2026-07-14 | Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> n… |
CVE-2026-49459 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve e… |
CVE-2026-49458 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-or… |
CVE-2026-50646 | High | 7.8 | 2026-07-14 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. |
CVE-2026-47305 | High | 7.8 | 2026-07-14 | Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. |
CVE-2026-50661 | Medium | 6.1 | 2026-07-14 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |