boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Monday, October 12, 2026 · all times UTC← 2026-10-11 · archive

Security Box Score — October 12, 2026 — page 2

Edition of October 12, 2026, continued — page 2 of 2. Back to page 1

Results (continued, ranked) — ranks 401–683 of 683
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2023-544066.9—frappefrappeCWE-372Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts
CVE-2023-544076.9—frappefrappeCWE-532Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
CVE-2026-1052806.9—hexpmhexCWE-354Hex writes unverified package tarballs to standard output in mix hex.package …
CVE-2026-1089396.9—EricLBuehlermistral.rsCWE-918EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery
CVE-2026-1089406.9—EricLBuehlerMistral.rsCWE-22EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal
CVE-2026-1089506.9—opensource-socialnetworkopensource-socialnetworkCWE-862Open Source Social Network (OSSN) through 10.1 Missing Authorization via Albu…
CVE-2026-1092066.9—LogicalDOCLogicalDOC Community EditionCWE-204LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet
CVE-2026-1092396.9—unclecodecrawl4aiCWE-918Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch
CVE-2026-1092486.9—FreeRDPFreeRDPCWE-125FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFile…
CVE-2026-1092596.9—ImageMagickImageMagickCWE-200ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure i…
CVE-2026-1092626.9—ImageMagickImageMagickCWE-401ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder
CVE-2026-1092656.9—ImageMagickImageMagickCWE-125ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
CVE-2026-1092666.9—ImageMagickImageMagickCWE-79ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via CIP E…
CVE-2026-1092676.9—ImageMagickImageMagickCWE-674ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL De…
CVE-2026-1092696.9—ImageMagickImageMagickCWE-125ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure v…
CVE-2026-1092736.9—ImageMagickImageMagickCWE-908ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure i…
CVE-2026-1092766.9—ImageMagickImageMagickCWE-459ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in J…
CVE-2026-1093046.9—craftcmscmsCWE-200Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read vi…
CVE-2026-1093096.9—siyuan-notesiyuanCWE-22SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
CVE-2026-1093166.9—getgravgrav-plugin-data-managerCWE-862Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
CVE-2026-1093236.9—getgravgrav-plugin-star-ratingsCWE-862Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authori…
CVE-2026-1093396.9—surrealdbsurrealdbCWE-770SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output B…
CVE-2026-1093646.9—ZcashFoundationzebraCWE-693Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
CVE-2026-1093796.9—cockpit-hqcockpitCWE-208Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
CVE-2026-1094256.9—tink-cryptotink-goCWE-1286Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets
CVE-2026-1096006.9—frappefrappeCWE-862Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
CVE-2026-1096346.9—frappeerpnextCWE-89Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
CVE-2026-1096416.9—frappeerpnextCWE-862Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpo…
CVE-2026-1072266.8—AsyncHttpClientasync-http-clientCWE-384AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or…
CVE-2026-1092446.8—FreeRDPFreeRDPCWE-732FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert
CVE-2026-1092496.8—FreeRDPFreeRDPCWE-125FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance Fil…
CVE-2026-1095746.7—gohugoiohugoCWE-22Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
CVE-2026-1095956.7—gohugoiohugoCWE-22Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
CVE-2026-1095966.7—gohugoiohugoCWE-59Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount A…
CVE-2026-185336.5—IBMMaximo Application Suite - Location Service for Esri ComponentCWE-94IBM Maximo Application Suite - Location Service for Esri Component Code Execu…
CVE-2026-412106.5—moonlight-streammoonlight-qtCWE-787Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup pat…
CVE-2026-539226.5—openwrtodhcpdCWE-121odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (sta…
CVE-2026-773646.5—The-40-Thievesobsidian-tcCWE-200obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
CVE-2026-784046.5—IBMDb2CWE-269IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility
CVE-2026-936936.5—ProgressShareFile Storage Zones ControllerCWE-20Unauthenticated queue manipulation through connector SSRF and response inject…
CVE-2026-944516.5—Red HatExploit IntelligenceCWE-20Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-pana…
CVE-2026-1054666.5—IBMDb2CWE-770IBM® Db2® is vulnerable to a denial of service when inserting into a table wi…
CVE-2026-1078626.5—ExpressTechQuiz And Survey MasterCWE-79WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS…
CVE-2026-1084786.5—BdThemesElement Pack Elementor AddonsCWE-79WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scriptin…
CVE-2026-1084826.5—LeapWorxPremium Addons for ElementorCWE-79WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Script…
CVE-2026-185416.4—IBMPlanning AnalyticsCWE-79IBM Planning Analytics Local is affected by security vulnerabilities
CVE-2026-854716.4—Red Hatmirror registry for Red Hat OpenShiftCWE-918Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially …
CVE-2026-1091946.4—Red HatRed Hat Quay 3CWE-639Quay: build trigger uuid idor in quay api
CVE-2025-714316.3—frappefrappeCWE-90Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
CVE-2026-843206.3—0xJackynginx-uiCWE-22Nginx UI: Auto backup name allows path traversal outside validated storage path
CVE-2026-1052836.3—ash-projectash_typescriptCWE-209Internal error terms inspected into AshTypescript RPC error responses
CVE-2026-1092606.3—ImageMagickImageMagickCWE-401ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder
CVE-2026-1092616.3—ImageMagickImageMagickCWE-401ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder
CVE-2026-1092636.3—ImageMagickImageMagickCWE-401ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder
CVE-2026-1092646.3—ImageMagickImageMagickCWE-674ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG De…
CVE-2026-1092686.3—ImageMagickImageMagickCWE-416ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Wr…
CVE-2026-1092716.3—ImageMagickImageMagickCWE-415ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder
CVE-2026-1092726.3—ImageMagickImageMagickCWE-476ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript D…
CVE-2026-1092756.3—ImageMagickImageMagickCWE-74ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG D…
CVE-2026-1092786.3—ImageMagickImageMagickCWE-401ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-D…
CVE-2026-1093026.3—parse-communityparse-serverCWE-863Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Sch…
CVE-2026-1093656.3—ZcashFoundationzebraCWE-345Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
CVE-2026-1093666.3—ZcashFoundationzebraCWE-354Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
CVE-2026-756216.2—IBMAspera Enterprise WebAppsCWE-250IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges
CVE-2025-278956.1—IBMDB2 Recovery Expert for Linux, UNIX and WindowsCWE-79DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting
CVE-2025-278966.1—IBMDB2 Recovery Expert for Linux, UNIX and WindowsCWE-79IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting
CVE-2025-278976.1—IBMDB2 Recovery Expert for Linux, UNIX and WindowsCWE-79IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting
CVE-2025-279026.1—IBMDB2 Recovery Expert for Linux, UNIX and WindowsCWE-1022IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure
CVE-2026-859676.1—Progress Software CorporationMarkLogic ServerCWE-79Cross-site scripting in Progress MarkLogic Server
CVE-2026-1041406.1—qgisQGISCWE-79QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribut…
CVE-2026-1092556.1—FreeRDPFreeRDPCWE-122FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length
CVE-2022-510206.0—mherflowerCWE-352Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
CVE-2026-891406.0—Temporal Technologies, Inc.Temporal ServerCWE-639Temporal Server internal completion callbacks are not bound to their namespac…
CVE-2026-1092516.0—FreeRDPFreeRDPCWE-129FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry
CVE-2026-1092526.0—FreeRDPFreeRDPCWE-476FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC…
CVE-2026-1092536.0—FreeRDPFreeRDPCWE-125FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read
CVE-2026-1092546.0—FreeRDPFreeRDPCWE-416FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path
CVE-2026-1092566.0—FreeRDPFreeRDPCWE-122FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion
CVE-2026-1093066.0—craftcmscmsCWE-862Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licens…
CVE-2023-544095.9—frappefrappeCWE-80Frappe before 13.46.1 XSS via html2text Weak Sanitization
CVE-2026-199385.9—zephyrprojectzephyrCWE-416Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Si…
CVE-2026-1030615.9—GleamGleamCWE-22Path traversal in Gleam via unvalidated package application names
CVE-2026-1035025.9—hexpmhex_coreCWE-295hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
CVE-2026-1035035.9—hexpmhexCWE-295Hex trusts its bundled CA certificates when cacerts_path is set
CVE-2026-1036585.9—GNUAspellCWE-122GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-b…
CVE-2026-1094485.9—PostgreSQLpsqlODBCCWE-124psqlODBC SQLBindParameter heap memory corruption when binding more than 32767…
CVE-2026-415045.8—corazawafcorazaCWE-93OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forge…
CVE-2026-415085.8—corazawafcorazaCWE-693OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (r…
CVE-2026-1047745.8—corazawafcorazaCWE-172OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF By…
CVE-2026-199375.7—zephyrprojectzephyrCWE-772Bluetooth Mesh Access layer permanently leaks delayable-message contexts, dis…
CVE-2026-1025395.7—super-productivitysuper-productivityCWE-312Super Productivity: SuperSync E2EE setup uploads and stores all user operatio…
CVE-2026-1043325.5—IBMDb2CWE-121IBM® Db2® Denial of Service
CVE-2026-1088265.5—n/aZen CartCWE-74Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection
CVE-2026-1088365.5—n/aOllamaCWE-918Ollama Pull API name.go IsValid server-side request forgery
CVE-2026-1088975.5—Smart Media4U TechnologySHAREit AppCWE-749Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
CVE-2026-1088995.5—tobychuizoraxyCWE-266tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth impro…
CVE-2026-1089005.5—ExponentCMSCWE-74Exponent CMS XML-RPC xmlrpc.php userLogin sql injection
CVE-2026-1089165.5—EdimaxBR-6208ACCWE-74Edimax BR-6208AC formAccept command injection
CVE-2026-1089215.5—KusalkaSilvaLearning-Management-SystemCWE-287KusalkaSilva Learning-Management-System State-Changing Endpoints remove_annou…
CVE-2026-1089375.5—code-projectsOnline Ticket Reservation SystemCWE-200code-projects Online Ticket Reservation System medallion.sql file information…
CVE-2026-1089385.5—code-projectsMatrimonial SystemCWE-425code-projects Matrimonial System matrimony.sql file access
CVE-2026-619945.4—RocketGeekWP-MembersCWE-862WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability
CVE-2026-750635.4—IBMPlanning AnalyticsCWE-79IBM Planning Analytics Local is affected by security vulnerabilities
CVE-2026-818585.4—IBMiCWE-125IBM i is Affected By A Denial of Service Vulnerability in Host Servers
CVE-2026-843215.4—0xJackynginx-uiCWE-613Nginx UI: Standalone short tokens survive administrative revocation in cache …
CVE-2026-859765.4—Progress Software CorporationMarkLogic ServerCWE-113HTTP response splitting in Progress MarkLogic Server Query Console
CVE-2026-1074185.4—ArrayticsBookticsCWE-862WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
CVE-2023-544105.3—frappefrappeCWE-285Frappe before 13.22.0 Improper Authorization via Document Rename
CVE-2024-583915.3—frappefrappeCWE-79Frappe before 15.4.0 XSS via Printview Parameters
CVE-2026-174845.3—IBMiCWE-200IBM i is Information Disclosure
CVE-2026-174875.3—IBMiCWE-200IBM i is Information Disclosure
CVE-2026-183185.3—IBMiCWE-307IBM i Information Disclosure
CVE-2026-835365.3—Red HatRed Hat OpenStack Platform 18.0CWE-400Openstack-network-exporter: http.server has no readheadertimeout / readtimeou…
CVE-2026-1030805.3—VillaThemeSalevoCWE-472WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
CVE-2026-1041025.3—9001copypartyCWE-22copyparty FTP: upload outside defined volumes (limited path traversal)
CVE-2026-1084775.3—ArrayticsBookticsCWE-862WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
CVE-2026-1084865.3—WPMU DEVForminatorCWE-862WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability
CVE-2026-1089245.3—getkirbyKirbyCWE-285getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
CVE-2026-1091655.3—TDuckCloudtduck-survey-formCWE-639TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form K…
CVE-2026-1091675.3—TDuckCloudtduck-survey-formCWE-639TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme …
CVE-2026-1091715.3—guchengwuyueyshop-crmCWE-862yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check
CVE-2026-1091725.3—guchengwuyueyshop-crmCWE-862yshop-crm through 2.1.3 Missing Authorization via contract-receivables check …
CVE-2026-1091735.3—guchengwuyueyshop-crmCWE-862yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint
CVE-2026-1091755.3—moxi624MoguBlogCWE-639MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
CVE-2026-1091765.3—moxi624MoguBlogCWE-639MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk …
CVE-2026-1091775.3—moxi624MoguBlogCWE-639MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit
CVE-2026-1091785.3—jishenghuajshERPCWE-862jshERP through 3.6 Missing Authorization via /log Audit Endpoints
CVE-2026-1091795.3—jishenghuajshERPCWE-862jshERP through 3.6 Missing Authorization via /log/list and /log/info
CVE-2026-1091805.3—jishenghuajshERPCWE-639jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs
CVE-2026-1091815.3—jishenghuajshERPCWE-863jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list
CVE-2026-1091825.3—jishenghuajshERPCWE-863jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel
CVE-2026-1091835.3—jishenghuajshERPCWE-862jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter
CVE-2026-1091845.3—jishenghuajshERPCWE-862jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList
CVE-2026-1091885.3—jishenghuajshERPCWE-862jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints
CVE-2026-1092005.3—LogicalDOCLogicalDOC Community EditionCWE-918LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet…
CVE-2026-1092045.3—LogicalDOCLogicalDOC Community EditionCWE-640LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound Ps…
CVE-2026-1092835.3—open-webuiopen-webuiCWE-863Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
CVE-2026-1092845.3—open-webuiopen-webuiCWE-862Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
CVE-2026-1092875.3—open-webuiopen-webuiCWE-639Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
CVE-2026-1092895.3—open-webuiopen-webuiCWE-613Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSo…
CVE-2026-1092965.3—open-webuiopen-webuiCWE-639Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
CVE-2026-1093035.3—parse-communityparse-serverCWE-639Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields B…
CVE-2026-1093195.3—getgravgrav-plugin-guestbookCWE-862Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moder…
CVE-2026-1093205.3—getgravgrav-plugin-apiCWE-613Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
CVE-2026-1093225.3—getgravgrav-plugin-guestbookCWE-79Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
CVE-2026-1093285.3—AdmidioadmidioCWE-79Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
CVE-2026-1093305.3—JovancodingNetwork-AICWE-1385Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardSe…
CVE-2026-1093365.3—surrealdbsurrealdbCWE-863SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
CVE-2026-1093375.3—surrealdbsurrealdbCWE-203SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
CVE-2026-1093405.3—surrealdbsurrealdbCWE-862SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CAS…
CVE-2026-1093425.3—surrealdbsurrealdbCWE-306SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method
CVE-2026-1093485.3—GitoxideLabsgix-mailmapCWE-407Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing
CVE-2026-1093525.3—librenmslibrenmsCWE-79LibreNMS before 26.9.0 Stored XSS via wireless sensor description
CVE-2026-1093545.3—librenmslibrenmsCWE-22LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter
CVE-2026-1093555.3—librenmslibrenmsCWE-79LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
CVE-2026-1093565.3—librenmslibrenmsCWE-862LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController
CVE-2026-1093625.3—heymrunheymCWE-613Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
CVE-2026-1093765.3—FrappeERPNextCWE-863ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
CVE-2026-1093775.3—FrappeERPNextCWE-862ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
CVE-2026-1093785.3—SPIPSPIPCWE-918SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
CVE-2026-1093935.3—WebkulQloAppsCWE-639QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Ha…
CVE-2026-1095625.3—snapotter-hqSnapOtterCWE-862SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API
CVE-2026-1095655.3—zoferapyd-adminCWE-79Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
CVE-2026-1095705.3—Fire-BolttBSW013CWE-306Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
CVE-2026-1095985.3—frappefrappeCWE-862Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
CVE-2026-1095995.3—frappefrappeCWE-862Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modif…
CVE-2026-1096115.3—frappeerpnextCWE-862Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
CVE-2026-1096225.3—frappeerpnextCWE-862Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing…
CVE-2026-1096235.3—frappeerpnextCWE-862Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing…
CVE-2026-1096295.3—frappeerpnextCWE-862Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email E…
CVE-2026-1096305.3—frappeerpnextCWE-862Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
CVE-2026-1096355.3—frappeerpnextCWE-862Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation End…
CVE-2026-1096425.3—frappeerpnextCWE-862Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
CVE-2026-1096515.3—frappeerpnextCWE-918Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration …
CVE-2026-1096545.3—frappeerpnextCWE-862Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email E…
CVE-2026-1096625.3—frappeerpnextCWE-79Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
CVE-2026-1096645.3—frappeerpnextCWE-862Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record …
CVE-2026-1096655.3—frappeerpnextCWE-862Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Dea…
CVE-2026-1096685.3—frappeerpnextCWE-862Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
CVE-2026-1096695.3—frappeerpnextCWE-862Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Stat…
CVE-2026-1096755.3—frappesuiteCWE-639Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and …
CVE-2026-62325.2—SemtechLR1110 TransceiverCWE-787Out-of-bounds write in LR11xx Transceiver
CVE-2023-544085.1—frappefrappeCWE-79Frappe before 14.31.0 HTML Injection via Weak Escaping
CVE-2024-583895.1—HoloVizPanelCWE-601HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter
CVE-2025-714305.1—frappefrappeCWE-79Frappe before 15.91.1 Stored XSS via Leaderboard User Names
CVE-2026-494845.1—codeforivscode-ibmiCWE-377Code for IBM i: Temporary files are visible to all users
CVE-2026-928325.1—IBMAspera Enterprise WebAppsCWE-319IBM Aspera Enterprise Webapps Information Disclosure
CVE-2026-1089525.1—RT-Threadrt-threadCWE-843RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver
CVE-2026-1093005.1—open-webuiopen-webuiCWE-79Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
CVE-2026-1093275.1—AdmidioadmidioCWE-79Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via syste…
CVE-2026-1093445.1—cure53DOMPurifyCWE-79DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
CVE-2026-1093455.1—cure53DOMPurifyCWE-79DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
CVE-2026-1093745.1—zitadelzitadelCWE-863ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impe…
CVE-2026-1093925.1—PimcorePimcoreCWE-79Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
CVE-2026-1095975.1—gohugoiohugoCWE-79Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
CVE-2026-1096025.1—frappefrappeCWE-79Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
CVE-2026-1096575.1—frappeerpnextCWE-79Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
CVE-2026-1096705.1—frappeerpnextCWE-79Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
CVE-2026-1084765.0—VideoWhisper.comPaid Videochat Turnkey SiteCWE-862WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Contro…
CVE-2026-1093754.9—VerceldeepsecCWE-59Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarb…
CVE-2026-199364.8—zephyrprojectzephyrCWE-362Bluetooth Mesh delayable message queue: unsynchronized list access leads to N…
CVE-2026-1088354.8—YungengxinYun Jia Security GuardCWE-266Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges m…
CVE-2026-1092704.8—ImageMagickImageMagickCWE-401ImageMagick before 7.1.2-32 Memory Leak via -process Option
CVE-2026-1092774.8—ImageMagickImageMagickCWE-404ImageMagick before 7.1.2-32 Policy Bypass via -script Operation
CVE-2026-1092814.8—ImageMagickImageMagickCWE-125ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
CVE-2026-1096034.8—frappefrappeCWE-918Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
CVE-2026-958384.6—containerdcontainerdCWE-400containerd: Unpack DoS via repeated opaque whiteouts
CVE-2026-166784.5—IBMVirtualization Management InterfaceCWE-772IBM Power Systems Firmware Denial of Service
CVE-2026-183434.4—IBMiCWE-269IBM i is Affected By An Improper Privilege Management Vulnerability
CVE-2026-544594.3—error311FileRiseCWE-352FileRise: Missing CSRF enforcement for file creation and share-link creation
CVE-2026-750764.3—IBMAspera Enterprise WebAppsCWE-200IBM Aspera Enterprise Webapps Information Disclosure
CVE-2026-976914.3—get-convexconvex-backendCWE-284Convex: Unauthorized data access
CVE-2026-1025964.3—NangoHQnangoCWE-862Nango: Production flow RBAC bypass on private flow-read routes
CVE-2026-1026634.3—OpenListTeamOpenListCWE-200OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check…
CVE-2026-1064954.3—backstagebackstageCWE-284Backstage: Improper access control in backend action invocation
CVE-2026-1084754.3—VideoWhisper.comBroadcast Live VideoCWE-862WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulner…
CVE-2026-1092434.1—FreeRDPFreeRDPCWE-732FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Ke…
CVE-2026-936944.0—ProgressShareFile Storage Zones ControllerCWE-321Untrusted request routing and forged acknowledgements permit copy-workflow ma…
CVE-2026-426893.7—PixeliteEvents ManagerCWE-362WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability
CVE-2026-1035263.7—TheliaTheliaCWE-204CVE-2026-103526
CVE-2026-1043643.3—IBMDb2CWE-20IBM® Db2® Denial of Service
CVE-2026-1091953.1—Red HatRed Hat Quay 3CWE-639Quay: repository auto-prune policy uuid idor in quay api
CVE-2026-1089412.4—LinketicCityGaussianCWE-94Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection
CVE-2026-818562.3—hexpmhexCWE-150Terminal escape sequence injection in Hex via unneutralized server-supplied o…
CVE-2026-1092402.3—FreeRDPFreeRDPCWE-617FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
CVE-2026-1092412.3—FreeRDPFreeRDPCWE-476FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel
CVE-2026-1092852.3—open-webuiopen-webuiCWE-863Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
CVE-2026-1093322.3—JovancodingNetwork-AICWE-346Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
CVE-2026-1093962.3—TheliaTheliaCWE-1236Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
CVE-2026-1095612.3—aaif-goosegooseCWE-863goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Ann…
CVE-2026-1095642.3—learnhouseLearnHouseCWE-862LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
CVE-2026-1095712.3—Fire-BolttBSW013CWE-306Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosu…
CVE-2026-966182.1—hexpmhexCWE-409Hex exhausts memory and disk on oversized or compressed responses from an unt…
CVE-2026-1052742.1—erlangrebar3CWE-409hex_core decompresses registry and Erlang term API responses without size limits
CVE-2026-1088242.1—n/aDataEaseCWE-74DataEase Utils.java Utils.buildCalcField sql injection
CVE-2026-1088252.1—yangzongzhuanRuoYiCWE-266yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
CVE-2026-1088312.1—meetechojanus-gatewayCWE-259meetecho janus-gateway Admin API admin.js hard-coded credentials
CVE-2026-1088342.1—Cairo-dockGlx-DockCWE-79Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
CVE-2026-1088902.1—BlackBeltTechnologypi-agent-dashboardCWE-266BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalM…
CVE-2026-1089092.1—NetcoreNR268CWE-352Netcore NR268 CGI Endpoint cross-site request forgery
CVE-2026-1089192.1—SourceCodesterDrug Recommendation SystemCWE-79SourceCodester Drug Recommendation System Student Registration add_student.ph…
CVE-2026-1089202.1—SourceCodesterDrug Recommendation SystemCWE-79SourceCodester Drug Recommendation System Admin Record Tables user_record.php…
CVE-2026-1089222.1—KusalkaSilvaLearning-Management-SystemCWE-284KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestri…
CVE-2026-1089232.1—1024-labsmart-adminCWE-2661024-lab smart-admin Support Config Query queryByKey access control
CVE-2026-1089262.1—itsourcecodeBaptism Information Management SystemCWE-74itsourcecode Baptism Information Management System ebaptism.php sql injection
CVE-2026-1089272.1—itsourcecodeBaptism Information Management SystemCWE-74itsourcecode Baptism Information Management System pbaptism.php sql injection
CVE-2026-1089282.1—itsourcecodeOnline Admission SystemCWE-74itsourcecode Online Admission System sum.php sql injection
CVE-2026-1089312.1—NetcoreNR268CWE-79Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting
CVE-2026-1089322.1—NetcoreNR268CWE-79Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
CVE-2026-1092472.1—FreeRDPFreeRDPCWE-22FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName
CVE-2026-1093072.1—craftcmscmsCWE-79Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
CVE-2026-1050812.0—ImageMagickImageMagickCWE-59ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedBy…
CVE-2026-1088292.0—n/aZen CartCWE-74Zen Cart Module Configuration modules.php sql injection
CVE-2026-1088982.0—NetisWF2409ECWE-79Netis WF2409E Wireless Settings cross site scripting
CVE-2026-1089012.0—Shenzhen HCC TechnologyMPOS M6 PLUSCWE-1021Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer
CVE-2026-1089302.0—NetcoreNR268CWE-200Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disc…
CVE-2026-1092582.0—ImageMagickImageMagickCWE-476ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
CVE-2026-1092742.0—ImageMagickImageMagickCWE-59ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick…
CVE-2026-1092792.0—ImageMagickImageMagickCWE-362ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via…
CVE-2026-1092802.0—ImageMagickImageMagickCWE-476ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
CVE-2026-1092822.0—ImageMagickImageMagickCWE-843ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in IN…
CVE-2026-1088891.9—YungengxinCloud BillingCWE-782Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_140004…
CVE-2026-1089081.9—NetcoreNR268CWE-79Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
CVE-2026-1089331.9—EdimaxBR-6208ACCWE-79Edimax BR-6208AC formFilter cross site scripting
CVE-2026-1089341.9—EdimaxBR-6208ACCWE-79Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting
CVE-2026-1089351.9—EdimaxBR-6208ACCWE-79Edimax BR-6208AC Port Forwarding formPortFw cross site scripting
CVE-2026-1089361.9—EdimaxBR-6208ACCWE-79Edimax BR-6208AC QoS Page formQoS cross site scripting
CVE-2026-1088301.3—meetechojanus-gatewayCWE-362meetecho janus-gateway VideoRoom janus_videoroom.c race condition
CVE-2026-1088271.2—n/aZen CartCWE-74Zen Cart Administrative Module Management general.php zen_call_function code …
CVE-2026-1088281.2—n/aZen CartCWE-74Zen Cart Admin Panel configuration.php eval sql injection
CVE-2026-84286await—Turboderp-orgExLlamaV3—OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
CVE-2026-85499await—Apache Software FoundationApache SkyWalking BanyanDBCWE-863Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restriction…
CVE-2026-92116await—Apache Software FoundationApache AlluraCWE-601Apache Allura: OAuth1 missing callback validation
CVE-2026-92119await—Apache Software FoundationApache AlluraCWE-915Apache Allura: REST API Mass Assignment
CVE-2026-92120await—Apache Software FoundationApache AlluraCWE-294Apache Allura: Oauth1 Replay Attack
CVE-2026-103523await—TheliaThelia—CVE-2026-103523
CVE-2026-103524await—TheliaThelia—CVE-2026-103524
CVE-2026-103527await—TheliaThelia—CVE-2026-103527
CVE-2026-103528await—TheliaThelia—CVE-2026-103528
CVE-2026-103529await—TheliaThelia—CVE-2026-103529
CVE-2026-103535await—TheliaThelia—CVE-2026-103535
CVE-2026-103537await—TheliaThelia—CVE-2026-103537
CVE-2026-107248await—TheliaThelia—CVE-2026-107248