CVE-2026-75007 | Medium | 5.4 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead… |
CVE-2026-75004 | Medium | 4.3 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted r… |
CVE-2026-75002 | High | 7.1 | 2026-08-17 | In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privil… |
CVE-2026-19983 | High | 8.3 | 2026-08-17 | A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of t… |
CVE-2026-19982 | High | 7.4 | 2026-08-17 | A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC… |
CVE-2026-19981 | High | 7.4 | 2026-08-17 | A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19978 | Medium | 5.3 | 2026-08-17 | A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function child_process.exec o… |
CVE-2026-19976 | Medium | 6.6 | 2026-08-17 | A security vulnerability has been detected in COMFAST CF-N1-S 2.6.0.1. Impacted is the function sub_44A968 of the file /cgi-bin/mbox-config?method=SET§ion=… |
CVE-2026-19963 | High | 7.4 | 2026-08-17 | A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the a… |
CVE-2026-19962 | High | 7.4 | 2026-08-17 | A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of… |
CVE-2026-19960 | High | 7.4 | 2026-08-16 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation… |
CVE-2026-50523 | High | 7.8 | 2026-08-14 | Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code local… |
CVE-2026-19771 | High | 7.2 | 2026-08-14 | A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web I… |
CVE-2026-19747 | Critical | 9.8 | 2026-08-13 | A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAt… |
CVE-2026-73250 | | | 2026-08-11 | Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced install… |
CVE-2026-68792 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges loc… |
CVE-2026-65656 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2026-49179 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code… |
CVE-2026-47299 | High | 7.2 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges… |
CVE-2026-47285 | Medium | 6.5 | 2026-08-11 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose informati… |
CVE-2026-73078 | | | 2026-08-11 | Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.v… |
CVE-2026-72913 | | | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the… |
CVE-2026-72904 | | | 2026-08-10 | Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl'… |
CVE-2026-72869 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName par… |
CVE-2026-72736 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquote… |
CVE-2026-72735 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts s… |
CVE-2026-28672 | Critical | 9.8 | 2026-08-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger.
This issue affects Apache Ranger: from 0.6… |
CVE-2026-19379 | High | 7.3 | 2026-08-10 | A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipul… |
CVE-2026-19348 | Critical | 9.8 | 2026-08-09 | A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt… |
CVE-2026-19346 | High | 8.8 | 2026-08-09 | A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulat… |
CVE-2026-19334 | Medium | 5.3 | 2026-08-09 | A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manip… |
CVE-2026-19333 | Medium | 5.3 | 2026-08-09 | A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issu… |
CVE-2026-19332 | Medium | 5.3 | 2026-08-09 | A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component run_openlane/v… |
CVE-2026-19329 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/c… |
CVE-2026-19284 | Medium | 5.3 | 2026-08-08 | A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of… |
CVE-2026-19282 | Medium | 5.3 | 2026-08-08 | A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file… |
CVE-2026-19281 | Medium | 5.3 | 2026-08-08 | A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAss… |
CVE-2026-19279 | Medium | 5.3 | 2026-08-08 | A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of t… |
CVE-2026-19268 | Medium | 6.3 | 2026-08-08 | A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de424230. This impacts the function getUsageByDateRange of the… |
CVE-2026-19266 | Medium | 5.5 | 2026-08-08 | A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the co… |
CVE-2026-19263 | High | 7.3 | 2026-08-08 | A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file… |
CVE-2026-19243 | Medium | 6.3 | 2026-08-07 | A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/a… |
CVE-2026-19047 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/… |
CVE-2026-19045 | Medium | 5.3 | 2026-08-06 | A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils… |
CVE-2026-19044 | Medium | 5.3 | 2026-08-06 | A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component… |
CVE-2026-19041 | Medium | 6.3 | 2026-08-06 | A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/co… |
CVE-2026-19039 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh_exec of the file sr… |
CVE-2026-19036 | High | 7.2 | 2026-08-06 | A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the a… |
CVE-2026-19035 | High | 7.2 | 2026-08-06 | A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulatio… |
CVE-2026-19034 | High | 7.2 | 2026-08-06 | A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh… |
CVE-2026-19022 | Medium | 6.3 | 2026-08-06 | A vulnerability was determined in OpenHands up to 0.62.0. The affected element is the function initialize_repo of the file OpenHands/resolver/send_pull_request… |
CVE-2026-18980 | Medium | 6.3 | 2026-08-06 | A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such man… |
CVE-2026-7693 | High | 7.2 | 2026-08-05 | The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization… |
CVE-2026-18902 | High | 7.2 | 2026-08-05 | A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Per… |
CVE-2026-18900 | High | 7.2 | 2026-08-05 | A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation… |
CVE-2026-18814 | High | 7.2 | 2026-08-04 | A vulnerability was found in H3C NX15 V100R017. This impacts the function reload.reload_config of the file /api/esps. The manipulation results in command injec… |
CVE-2026-18813 | High | 7.2 | 2026-08-04 | A vulnerability has been found in H3C NX15 V100R017. This affects the function delete of the file /api/esps. The manipulation of the argument esps.apcm.version… |
CVE-2026-18812 | High | 7.2 | 2026-08-04 | A flaw has been found in H3C NX15 V100R017. The impacted element is the function esps.ipv6.wan of the file /api/esps. Executing a manipulation of the argument… |
CVE-2026-18811 | High | 7.2 | 2026-08-04 | A vulnerability was detected in H3C NX15 V100R017. The affected element is the function Add of the file /api/esps. Performing a manipulation of the argument es… |
CVE-2026-18787 | High | 8.8 | 2026-08-04 | A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the… |
CVE-2025-29296 | Critical | 9.8 | 2026-08-04 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C… |
CVE-2026-18686 | Critical | 9.8 | 2026-08-04 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component… |
CVE-2026-18685 | Critical | 9.8 | 2026-08-04 | A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component mod… |
CVE-2026-18684 | Critical | 9.8 | 2026-08-03 | A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem… |
CVE-2026-18641 | High | 7.3 | 2026-08-03 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com… |
CVE-2026-18616 | Critical | 9.8 | 2026-08-03 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component… |
CVE-2026-18615 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of… |
CVE-2026-18614 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Na… |
CVE-2026-18612 | Critical | 9.8 | 2026-08-03 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove_package/plugins.install_package of the file /cgi… |
CVE-2026-18602 | Critical | 9.8 | 2026-08-03 | A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the comp… |
CVE-2026-18601 | Critical | 9.8 | 2026-08-03 | A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-c… |
CVE-2026-18600 | High | 8.8 | 2026-08-03 | A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-h… |
CVE-2026-18599 | High | 8.0 | 2026-08-03 | A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of t… |
CVE-2026-18598 | High | 8.8 | 2026-08-03 | A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/l… |
CVE-2026-18590 | Medium | 6.3 | 2026-08-03 | A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password H… |
CVE-2026-18587 | High | 7.5 | 2026-08-03 | A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulatio… |
CVE-2026-67323 | High | 8.4 | 2026-08-01 | GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command inject… |
CVE-2026-38713 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-38710 | High | 7.2 | 2026-07-31 | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows atta… |
CVE-2026-38708 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-38711 | Critical | 9.8 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-43830 | Critical | 9.8 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-38709 | Critical | 9.8 | 2026-07-30 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discover… |
CVE-2026-35847 | Critical | 9.8 | 2026-07-30 | An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file |
CVE-2026-7849 | Critical | 9.8 | 2026-07-30 | Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subse… |
CVE-2026-54680 | Critical | 9.9 | 2026-07-29 | Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in… |
CVE-2026-16763 | Medium | 5.3 | 2026-07-23 | A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the com… |
CVE-2024-58354 | Critical | 9.9 | 2026-07-23 | cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses… |
CVE-2026-47670 | | | 2026-07-23 | DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate cre… |
CVE-2026-16735 | Medium | 5.3 | 2026-07-23 | A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of… |
CVE-2026-16733 | Medium | 5.3 | 2026-07-23 | A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the co… |
CVE-2026-16631 | Medium | 5.3 | 2026-07-23 | A vulnerability was detected in publint up to 0.1.4. This impacts the function child_process.exec of the file src/node/pack.js of the component package-manager… |
CVE-2026-16630 | Medium | 5.3 | 2026-07-22 | A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function child_process.exec of the file pack… |
CVE-2026-16629 | Medium | 5.3 | 2026-07-22 | A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileA… |
CVE-2026-16628 | Medium | 5.3 | 2026-07-22 | A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function child_process.exec of the component JIT Plugin Entry Handle… |
CVE-2026-16492 | Medium | 5.5 | 2026-07-22 | A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitI… |
CVE-2026-16489 | Medium | 5.3 | 2026-07-22 | A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX… |
CVE-2026-16488 | Medium | 5.0 | 2026-07-22 | A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of t… |
CVE-2026-47708 | | | 2026-07-21 | MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI… |
CVE-2026-47690 | High | 7.5 | 2026-07-21 | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3… |