CVE-2026-73844 | Low | 3.7 | 2026-08-14 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messag… |
CVE-2026-19841 | Low | 3.1 | 2026-08-14 | A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. This manipulation c… |
CVE-2026-19837 | Low | 2.7 | 2026-08-14 | A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search… |
CVE-2026-19835 | Low | 3.8 | 2026-08-14 | A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletio… |
CVE-2026-19763 | Low | 3.8 | 2026-08-14 | A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of t… |
CVE-2026-19749 | Low | 3.7 | 2026-08-13 | A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability… |
CVE-2026-19748 | Low | 3.7 | 2026-08-13 | A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the f… |
CVE-2026-17074 | Low | 3.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper privilege management. |
CVE-2026-17071 | Low | 2.7 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal. |
CVE-2026-17043 | Low | 3.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. |
CVE-2026-58511 | Low | 2.7 | 2026-08-13 | Webhook Authorization Header Returned in Plaintext via API |
CVE-2026-58445 | Low | 2.7 | 2026-08-13 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
CVE-2026-55984 | Low | 2.7 | 2026-08-13 | Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service |
CVE-2026-23603 | Low | 3.1 | 2026-08-13 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim |
CVE-2026-73575 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Co… |
CVE-2026-73574 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration before 10.1.17, a local file inclusion (LFI) vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu… |
CVE-2026-73573 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper vali… |
CVE-2026-73571 | Low | 3.1 | 2026-08-13 | An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending f… |
CVE-2025-62318 | Low | 3.7 | 2026-08-13 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive inform… |
CVE-2025-62315 | Low | 3.4 | 2026-08-13 | HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be a… |
CVE-2026-6469 | Low | 3.8 | 2026-08-13 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wron… |
CVE-2026-16241 | Low | 3.8 | 2026-08-13 | Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea… |
CVE-2026-14673 | Low | 3.8 | 2026-08-13 | Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression i… |
CVE-2026-14213 | Low | 3.7 | 2026-08-13 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the ap… |
CVE-2026-48791 | Low | 2.0 | 2026-08-13 | sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor e… |
CVE-2026-73425 | Low | 3.7 | 2026-08-12 | Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular express… |
CVE-2026-18096 | Low | 3.3 | 2026-08-12 | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause a denial of service due to a memory leak. |
CVE-2026-11937 | Low | 3.1 | 2026-08-12 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2025-9486 | Low | 3.3 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain condi… |
CVE-2026-18246 | Low | 3.0 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart par… |
CVE-2026-65926 | Low | 3.1 | 2026-08-12 | An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundl… |
CVE-2026-49262 | Low | 3.0 | 2026-08-12 | In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request For… |
CVE-2026-70467 | Low | 3.8 | 2026-08-12 | A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all… |
CVE-2026-18044 | Low | 3.7 | 2026-08-12 | The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its pr… |
CVE-2026-64951 | Low | 3.5 | 2026-08-12 | A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server proc… |
CVE-2026-73283 | Low | 2.5 | 2026-08-11 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. |
CVE-2026-73281 | Low | 3.5 | 2026-08-11 | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use ke… |
CVE-2026-48412 | Low | 2.7 | 2026-08-11 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploi… |
CVE-2026-73071 | Low | 3.3 | 2026-08-11 | Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_st… |
CVE-2026-11985 | Low | 3.6 | 2026-08-11 | On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FPU) forces the "Floating point ABI" choice, which defaults to CONFIG_FP_HARDABI. Both FP_HARDABI and… |
CVE-2026-66774 | Low | 3.7 | 2026-08-11 | SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Succ… |
CVE-2026-58245 | Low | 3.8 | 2026-08-11 | SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization… |
CVE-2026-58239 | Low | 3.7 | 2026-08-11 | SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the… |
CVE-2026-44762 | Low | 3.7 | 2026-08-11 | SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which co… |
CVE-2026-11812 | Low | 2.5 | 2026-08-10 | The UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c) drives every update operation through a single file-scope ctx structure that holds the C… |
CVE-2026-11811 | Low | 3.7 | 2026-08-10 | The UpdateHub over-the-air update client's start_coap_client() in subsys/mgmt/updatehub/updatehub.c leaks the CoAP/DTLS socket descriptor on its connection-set… |
CVE-2026-19411 | Low | 3.9 | 2026-08-10 | A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of se… |
CVE-2026-11809 | Low | 3.7 | 2026-08-10 | The UpdateHub OTA client in subsys/mgmt/updatehub/updatehub.c contains an out-of-bounds / uninitialized-memory read in z_impl_updatehub_probe(). The probe resp… |
CVE-2026-17016 | Low | 3.7 | 2026-08-10 | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total… |
CVE-2026-14211 | Low | 3.8 | 2026-08-10 | The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the custo… |
CVE-2026-12971 | Low | 2.2 | 2026-08-10 | The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to in… |
CVE-2026-19382 | Low | 2.3 | 2026-08-10 | A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the component MSR Index Handler… |
CVE-2026-19380 | Low | 2.3 | 2026-08-10 | A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipula… |
CVE-2026-12372 | Low | 3.7 | 2026-08-09 | A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()`… |
CVE-2026-19368 | Low | 3.3 | 2026-08-09 | A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the… |
CVE-2026-19361 | Low | 3.7 | 2026-08-09 | A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Exe… |
CVE-2026-19352 | Low | 3.1 | 2026-08-09 | A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of th… |
CVE-2026-17011 | Low | 3.8 | 2026-08-09 | The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the… |
CVE-2026-16957 | Low | 2.7 | 2026-08-09 | The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, al… |
CVE-2026-19324 | Low | 3.3 | 2026-08-09 | A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.re… |
CVE-2026-11742 | Low | 3.6 | 2026-08-07 | The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag byte and, for items… |
CVE-2026-19245 | Low | 3.3 | 2026-08-07 | A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of… |
CVE-2026-71849 | Low | 3.7 | 2026-08-07 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy do… |
CVE-2026-19230 | Low | 3.5 | 2026-08-07 | A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the c… |
CVE-2026-17435 | Low | 2.5 | 2026-08-07 | File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files.
When the file to be rotated is a symbolic link… |
CVE-2026-19209 | Low | 3.5 | 2026-08-07 | A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This mani… |
CVE-2026-19208 | Low | 3.7 | 2026-08-07 | A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulatio… |
CVE-2026-19207 | Low | 2.4 | 2026-08-07 | A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-… |
CVE-2026-61477 | Low | 2.3 | 2026-08-07 | An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value at… |
CVE-2026-49005 | Low | 2.4 | 2026-08-07 | The root password hash of the device can be obtained through unencrypted information in the firmware. |
CVE-2026-64652 | Low | 3.3 | 2026-08-06 | GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain… |
CVE-2026-48082 | Low | 3.7 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge end… |
CVE-2026-48074 | Low | 2.7 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes… |
CVE-2026-19167 | Low | 3.1 | 2026-08-06 | Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
CVE-2026-19161 | Low | 3.1 | 2026-08-06 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-19160 | Low | 3.1 | 2026-08-06 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-19110 | Low | 2.4 | 2026-08-06 | A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWid… |
CVE-2026-19061 | Low | 3.7 | 2026-08-06 | A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmwa… |
CVE-2026-19059 | Low | 3.3 | 2026-08-06 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulat… |
CVE-2026-14225 | Low | 2.7 | 2026-08-06 | The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the firs… |
CVE-2025-15674 | Low | 2.7 | 2026-08-06 | The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally password-protected con… |
CVE-2026-19046 | Low | 3.3 | 2026-08-06 | A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvir… |
CVE-2026-15599 | Low | 3.3 | 2026-08-06 | Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.
This issue affects… |
CVE-2025-14779 | Low | 3.8 | 2026-08-06 | The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails… |
CVE-2025-13736 | Low | 3.7 | 2026-08-06 | When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and… |
CVE-2025-12627 | Low | 2.4 | 2026-08-06 | The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who… |
CVE-2026-18839 | Low | 2.2 | 2026-08-05 | An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an ap… |
CVE-2026-70437 | Low | 3.7 | 2026-08-05 | Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the pro… |
CVE-2026-70430 | Low | 2.7 | 2026-08-05 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy confi… |
CVE-2026-70600 | Low | 3.1 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the… |
CVE-2026-70598 | Low | 3.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.0, 41.2.1, and 42.0.0-beta.3, of… |
CVE-2026-12730 | Low | 3.8 | 2026-08-05 | IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 th… |
CVE-2026-8029 | Low | 3.9 | 2026-08-05 | The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback… |
CVE-2026-16993 | Low | 3.7 | 2026-08-05 | The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access con… |
CVE-2026-16746 | Low | 2.7 | 2026-08-05 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowin… |
CVE-2025-15677 | Low | 3.5 | 2026-08-05 | The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing hi… |
CVE-2026-18852 | Low | 3.3 | 2026-08-05 | A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingY… |
CVE-2026-18817 | Low | 2.2 | 2026-08-04 | A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/sr… |
CVE-2026-70483 | Low | 3.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-… |
CVE-2026-16791 | Low | 3.9 | 2026-08-04 | A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker t… |