CVEs NewScan detects

Every CVE NewScan detects, newest first, with the technology it affects and the day the detection landed. Most are version-matched against a fingerprinted component — those link to a page with the affected range, the release that fixes it, and how the scanner reports it. The rest are reported by a check that observes the vulnerability or its precondition directly rather than matching a version, so the row names that check instead of linking to a version range. The list is generated from the detection packs themselves and grows daily — local, in-band scanning is free, so you can check any of these against your own systems without a licence.

860 CVEs · 413 critical · 349 high · 95 medium · 3 low · 644 with a detail page

Published CVEs by month

Ten years of NVD publications. Severity lines use the left scale; the grey total bars use the right scale. Major GPT and Codex releases are marked in cyan.

  • Critical
  • High
  • Medium
  • Low
  • Total
  • GPT / Codex release
Monthly published CVEs by severity and total, with major GPT and Codex releases From 2016-12 through 2026-11. Four lines show critical, high, medium, and low severity counts on the left axis. Grey bars show all published CVEs on the right axis. Cyan vertical markers identify major public GPT and Codex releases. CVEs by severity Total CVEs 0 0 2.5k 5k 5k 10k 7.5k 15k 10k 20k 2016-12: 517 total CVEs2017-01: 1,083 total CVEs2017-02: 1,041 total CVEs2017-03: 1,300 total CVEs2017-04: 1,570 total CVEs2017-05: 1,010 total CVEs2017-06: 1,033 total CVEs2017-07: 1,268 total CVEs2017-08: 1,540 total CVEs2017-09: 1,227 total CVEs2017-10: 1,399 total CVEs2017-11: 1,066 total CVEs2017-12: 1,105 total CVEs2018-01: 1,273 total CVEs2018-02: 1,325 total CVEs2018-03: 1,337 total CVEs2018-04: 1,667 total CVEs2018-05: 1,162 total CVEs2018-06: 1,783 total CVEs2018-07: 2,167 total CVEs2018-08: 1,013 total CVEs2018-09: 1,169 total CVEs2018-10: 1,468 total CVEs2018-11: 983 total CVEs2018-12: 1,163 total CVEs2019-01: 1,212 total CVEs2019-02: 838 total CVEs2019-03: 1,182 total CVEs2019-04: 1,533 total CVEs2019-05: 1,316 total CVEs2019-06: 1,254 total CVEs2019-07: 1,618 total CVEs2019-08: 2,001 total CVEs2019-09: 1,531 total CVEs2019-10: 1,566 total CVEs2019-11: 1,677 total CVEs2019-12: 1,577 total CVEs2020-01: 1,656 total CVEs2020-02: 1,394 total CVEs2020-03: 1,754 total CVEs2020-04: 2,187 total CVEs2020-05: 1,017 total CVEs2020-06: 1,786 total CVEs2020-07: 1,417 total CVEs2020-08: 1,155 total CVEs2020-09: 1,593 total CVEs2020-10: 1,563 total CVEs2020-11: 1,271 total CVEs2020-12: 1,529 total CVEs2021-01: 1,524 total CVEs2021-02: 1,456 total CVEs2021-03: 1,446 total CVEs2021-04: 1,818 total CVEs2021-05: 1,473 total CVEs2021-06: 1,712 total CVEs2021-07: 1,582 total CVEs2021-08: 2,085 total CVEs2021-09: 1,902 total CVEs2021-10: 1,701 total CVEs2021-11: 1,508 total CVEs2021-12: 1,942 total CVEs2022-01: 2,016 total CVEs2022-02: 1,942 total CVEs2022-03: 2,058 total CVEs2022-04: 2,046 total CVEs2022-05: 2,021 total CVEs2022-06: 2,279 total CVEs2022-07: 1,969 total CVEs2022-08: 2,317 total CVEs2022-09: 2,197 total CVEs2022-10: 1,849 total CVEs2022-11: 1,958 total CVEs2022-12: 2,421 total CVEs2023-01: 2,337 total CVEs2023-02: 2,122 total CVEs2023-03: 2,516 total CVEs2023-04: 2,330 total CVEs2023-05: 2,418 total CVEs2023-06: 2,384 total CVEs2023-07: 2,305 total CVEs2023-08: 2,477 total CVEs2023-09: 2,148 total CVEs2023-10: 2,680 total CVEs2023-11: 2,449 total CVEs2023-12: 2,650 total CVEs2024-01: 2,594 total CVEs2024-02: 2,778 total CVEs2024-03: 3,309 total CVEs2024-04: 3,621 total CVEs2024-05: 4,999 total CVEs2024-06: 3,078 total CVEs2024-07: 3,113 total CVEs2024-08: 2,896 total CVEs2024-09: 2,514 total CVEs2024-10: 3,564 total CVEs2024-11: 4,056 total CVEs2024-12: 3,431 total CVEs2025-01: 4,275 total CVEs2025-02: 3,673 total CVEs2025-03: 3,998 total CVEs2025-04: 4,034 total CVEs2025-05: 3,980 total CVEs2025-06: 3,681 total CVEs2025-07: 3,776 total CVEs2025-08: 3,628 total CVEs2025-09: 4,321 total CVEs2025-10: 4,273 total CVEs2025-11: 3,020 total CVEs2025-12: 5,491 total CVEs2026-01: 4,302 total CVEs2026-02: 4,616 total CVEs2026-03: 6,234 total CVEs2026-04: 5,810 total CVEs2026-05: 6,936 total CVEs2026-06: 7,942 total CVEs2026-07: 9,770 total CVEs2026-08: 12,255 total CVEs2026-09: 14,928 total CVEs2026-10: 17,051 total CVEs2026-11: 7,088 total CVEs GPT1 · 2018-06-11 · OpenAI published its first generative pre-trained transformer. GPT1 GPT2 · 2019-02-14 · OpenAI introduced GPT-2 and its staged release. GPT2 GPT3 · 2020-06-11 · OpenAI opened the GPT-3-powered API beta. GPT3 Codex API · 2021-08-10 · OpenAI released Codex through its API in private beta. Codex API GPT4 · 2023-03-14 · OpenAI released GPT-4 with text and image input. GPT4 GPT4o · 2024-05-13 · OpenAI released its natively multimodal GPT-4o model. GPT4o Codex agent · 2025-05-16 · OpenAI launched Codex as a cloud software-engineering agent. Codex agent GPT5 · 2025-08-07 · OpenAI released GPT-5 as a unified model system. GPT5 Codex app · 2026-02-02 · OpenAI introduced the Codex desktop app for multi-agent work. Codex app 2017201820192020202120222023202420252026

AI markers cover major public GPT and Codex launches from OpenAI. Hover or focus a short label for its date and note; select it to open the release announcement.

Source: NIST NVD CVE 2.0 feeds, updated 2026-11-13. Rejected records are excluded. Severity uses the newest available primary NVD CVSS metric; unscored CVEs appear only in the total. November 2026 is month to date.

CVETechSeverity DescriptionAdded
CVE-2026-126290 NocoDB high NocoDB before 2026.07.0 lets any base member read private integration configurations, including stored credentials 2026-11-13
CVE-2026-126288 NocoDB high NocoDB before 2026.06.2: the unauthenticated public OAuth client route returns the full client record - client-secret bcrypt hash, a live registration access token and the owner's … 2026-11-13
CVE-2026-124653 mine-cloudvod high Mine CloudVod < 2.6.6 hands signed upload policies and temporary cloud-storage credentials (Alibaba OSS, Tencent COS, Dogecloud) to unauthenticated callers of its REST routes 2026-11-13
CVE-2026-126292 NocoDB medium NocoDB before 2026.06.1 returns the stored user record, password hash included, from the profile-update response 2026-11-13
CVE-2026-121518 customer-reviews-woocommerce medium Customer Reviews for WooCommerce <= 5.127.0 exposes non-public review and Q&A fields through the frontend 'search' parameter to unauthenticated visitors 2026-11-13
CVE-2026-126545 AVideo critical Reported by NewScan's component version range: AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting n… 2026-11-11
CVE-2026-126544 AVideo critical Reported by NewScan's component version range: AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting n… 2026-11-11
CVE-2026-126543 AVideo critical Reported by NewScan's component version range: AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting n… 2026-11-11
CVE-2026-126542 AVideo critical AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting not bound to the site's merchant, Live restream … 2026-11-11
CVE-2026-126541 AVideo critical Reported by NewScan's component version range: AVideo through 29.7.1: social-login account takeover by display name (any user incl. admins, CVSS 9.3), PayPal IPN wallet crediting n… 2026-11-11
CVE-2026-126188 activestorage critical Reported by NewScan's component version range: Rails activestorage before 8.0.5.2: Active Storage advisories - a CVSS 9.8 critical (CVE-2026-126082), Blob#open (8.8), service URL, … 2026-11-11
CVE-2026-126186 activestorage critical Reported by NewScan's component version range: Rails activestorage before 8.0.5.2: Active Storage advisories - a CVSS 9.8 critical (CVE-2026-126082), Blob#open (8.8), service URL, … 2026-11-11
CVE-2026-126085 activestorage critical Reported by NewScan's component version range: Rails activestorage before 8.0.5.2: Active Storage advisories - a CVSS 9.8 critical (CVE-2026-126082), Blob#open (8.8), service URL, … 2026-11-11
CVE-2026-126084 activestorage critical Reported by NewScan's component version range: Rails activestorage before 8.0.5.2: Active Storage advisories - a CVSS 9.8 critical (CVE-2026-126082), Blob#open (8.8), service URL, … 2026-11-11
CVE-2026-126082 activestorage critical Rails activestorage before 8.0.5.2: Active Storage advisories - a CVSS 9.8 critical (CVE-2026-126082), Blob#open (8.8), service URL, filename and GCS handling, and blob data exposu… 2026-11-11
CVE-2026-126074 activestorage critical Reported by NewScan's component version range: Rails activestorage before 8.0.5.2: Active Storage advisories - a CVSS 9.8 critical (CVE-2026-126082), Blob#open (8.8), service URL, … 2026-11-11
CVE-2026-126071 activestorage critical Covered by the activestorage batch fix for CVE-2026-126082 2026-11-11
CVE-2026-126083 actionpack high Covered by the actionpack batch fix for CVE-2026-126081 2026-11-11
CVE-2026-126081 actionpack high Rails actionpack before 8.0.5.2: Action Pack advisories - ActionController::Parameters#each_key exposes unpermitted keys (mass assignment, CVSS 7.5), signed/encrypted cookie read c… 2026-11-11
CVE-2026-126080 activesupport high Rails activesupport before 8.0.5.2: Active Support constant-lookup LoadError handling (CVSS 7.5) 2026-11-11
CVE-2026-126077 actionpack high Reported by NewScan's component version range: Rails actionpack before 8.0.5.2: Action Pack advisories - ActionController::Parameters#each_key exposes unpermitted keys (mass assign… 2026-11-11
CVE-2026-126076 actionpack high Reported by NewScan's component version range: Rails actionpack before 8.0.5.2: Action Pack advisories - ActionController::Parameters#each_key exposes unpermitted keys (mass assign… 2026-11-11
CVE-2026-126075 activesupport high Covered by the activesupport batch fix for CVE-2026-126080 2026-11-11
CVE-2026-126073 actionpack high Reported by NewScan's component version range: Rails actionpack before 8.0.5.2: Action Pack advisories - ActionController::Parameters#each_key exposes unpermitted keys (mass assign… 2026-11-11
CVE-2026-126072 actionpack high Reported by NewScan's component version range: Rails actionpack before 8.0.5.2: Action Pack advisories - ActionController::Parameters#each_key exposes unpermitted keys (mass assign… 2026-11-11
CVE-2026-126067 actionpack high Reported by NewScan's component version range: Rails actionpack before 8.0.5.2: Action Pack advisories - ActionController::Parameters#each_key exposes unpermitted keys (mass assign… 2026-11-11
CVE-2026-33168 actionview medium Covered by the actionview batch fix for CVE-2026-126070 2026-11-11
CVE-2026-126079 actionview medium Reported by NewScan's component version range: Rails actionview before 8.0.5.2: Action View sanitizer and text-helper cross-site scripting (strip_tags, TextHelper, the HTML5 saniti… 2026-11-11
CVE-2026-126078 actionview medium Reported by NewScan's component version range: Rails actionview before 8.0.5.2: Action View sanitizer and text-helper cross-site scripting (strip_tags, TextHelper, the HTML5 saniti… 2026-11-11
CVE-2026-126070 actionview medium Rails actionview before 8.0.5.2: Action View sanitizer and text-helper cross-site scripting (strip_tags, TextHelper, the HTML5 sanitizer, and the incomplete fix for CVE-2026-33168) 2026-11-11
CVE-2026-126069 actionview medium Reported by NewScan's component version range: Rails actionview before 8.0.5.2: Action View sanitizer and text-helper cross-site scripting (strip_tags, TextHelper, the HTML5 saniti… 2026-11-11
CVE-2026-116779 FreeSWITCH critical FreeSWITCH <= 1.11.2: an inbound SIP MESSAGE addressed to `api+<command>` runs a FreeSWITCH API command (command execution, CISA KEV, CVSS 9.8) 2026-11-10
CVE-2026-102895 HTTP high Reported by NewScan's named-CVE check: test_header_trust 2026-11-10
CVE-2026-124489 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124488 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124487 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124486 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124485 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124484 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124483 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124482 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124481 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124480 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124479 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124478 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124477 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124476 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124475 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124473 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124472 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124471 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124470 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124469 OpenEMR critical OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.3.0 and 8.4.0 - cross-patient IDOR and missing … 2026-11-09
CVE-2026-124468 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124467 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124466 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124464 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124463 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124462 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124461 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124460 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124459 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124457 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124456 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124455 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124453 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124452 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124451 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124450 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124449 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124448 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124447 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124446 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-124445 OpenEMR critical OpenEMR 8.3.x: OneTimeAuth token replay and PIN brute force (CVSS 9.3), plus 13 further advisories fixed in 8.4.0 - unauthenticated SSRF via OAuth2 client registration, ESign local… 2026-11-09
CVE-2026-124444 OpenEMR critical Reported by NewScan's component version range: OpenEMR before 8.3.0: SQL injection in the Fee Sheet drug-inventory lookup (CVSS 9.4), plus 41 further OpenEMR advisories fixed in 8.… 2026-11-09
CVE-2026-123553 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123552 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123551 OpenAM critical OpenAM before 16.1.4: unauthenticated session-token theft from the notification WebSocket, SAML v2.0 SP authentication bypass via unsigned ECP/Artifact assertions, SAML 1.x issuer … 2026-11-08
CVE-2026-123550 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123548 OpenAM critical Reported by NewScan's component version range: OpenAM before 16.1.4: unauthenticated session-token theft from the notification WebSocket, SAML v2.0 SP authentication bypass via uns… 2026-11-08
CVE-2026-123547 OpenAM critical Reported by NewScan's component version range: OpenAM before 16.1.4: unauthenticated session-token theft from the notification WebSocket, SAML v2.0 SP authentication bypass via uns… 2026-11-08
CVE-2026-123546 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123545 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123544 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123543 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123542 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123541 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123540 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123539 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123538 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123537 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-123536 OpenAM critical Covered by the OpenAM batch fix for CVE-2026-123551 2026-11-08
CVE-2026-118066 latepoint critical LatePoint <= 5.7.6 unauthenticated account takeover - the query builder mishandles special parameter values, letting an anonymous caller reset any customer's password (CVSS 9.1) 2026-11-08
CVE-2026-123535 tornado high Covered by the tornado batch fix for CVE-2026-123534 2026-11-08
CVE-2026-123534 tornado high Tornado before 6.6: path traversal in RequestHandler.static_url()/get_version() hashes files outside static_path, plus Set-Cookie attribute injection through an unvalidated max_age 2026-11-08
CVE-2026-86005 bull-board critical Reported by NewScan's unauthenticated interface: Unauthenticated Bull Board job-queue dashboard (Chartbrew mount) - anyone can read, retry, promote and delete background jobs 2026-11-07
CVE-2026-19868 SonicWall SMA/SSL-VPN high SonicOS SSLVPN SAML authentication bypass - a valid credential for an alternate auth method skips SAML and its MFA (exploited in the wild) 2026-11-07
CVE-2026-116606 Barracuda Email Security Gateway critical Barracuda Email Security Gateway pre-authentication authorization bypass on /cgi-mod/index.cgi, chained to remote root (CVSS 9.3) 2026-11-06
CVE-2026-111560 Barracuda Email Security Gateway high Barracuda Email Security Gateway OS command injection, reachable pre-auth when chained with CVE-2026-116606 (CVSS 8.6) 2026-11-06
CVE-2026-100109 ultimate-security-for-woocommerce critical Security For WooCommerce 1.0.10-1.0.16 lets an unauthenticated visitor create a user of a chosen role (usfw_create_temporary_user has no capability check) - site takeover, and NO f… 2026-11-05
CVE-2026-93389 litespeed-cache high LiteSpeed Cache <= 7.9.1 serves cached WooCommerce customer data to unauthenticated visitors - one shopper's sensitive order/account data is disclosed to the next anonymous request… 2026-11-05
CVE-2026-121966 Traefik high Traefik ForwardAuth shares one auth-server connection pool across all clients - with an NTLM/Negotiate (connection-bound) auth server, an unauthenticated client's subrequest rides … 2026-11-05
CVE-2026-56065 doofinder-for-woocommerce high Doofinder Search and Discovery for WP & WooCommerce <= 2.17.2 writes sensitive data into an externally-accessible file inside its own plugin directory - an unauthenticated visitor … 2026-11-04
CVE-2026-121431 AzuraCast high AzuraCast <= 0.23.8 batch: Supervisor and Liquidsoap configuration injection from station-operator fields (root RCE), Shoutcast sc_serv.conf override, and a webhook SSRF filter byp… 2026-11-04
CVE-2026-121429 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-121431 2026-11-04
CVE-2026-121428 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-121431 2026-11-04
CVE-2026-121427 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-121431 2026-11-04
CVE-2026-119977 WordPress high WordPress core 4.7 - 7.1.3 stages a full-package core upgrade at a predictable, web-accessible path, so an unauthenticated attacker who wins the upgrade window executes code (CISA … 2026-11-04
CVE-2026-88809 Rancher high Rancher Manager /meta/proxy checks its destination allowlist too late, so a blocked internal host is still proxied (SSRF, CVSS 7.1) 2026-11-03
CVE-2026-120656 Go pprof high Reported by NewScan's exposure path probe: Exposed Go pprof debug endpoints 2026-11-03
CVE-2026-120459 JSON Web Token high Reported by NewScan's named-CVE check: crack_jwt_secret 2026-11-03
CVE-2026-97229 GitLab critical GitLab unauthenticated CI/CD regular-expression integer overflow remote code execution (CISA KEV) 2026-11-01
CVE-2026-87719 GitLab critical GitLab EE Duo Chat GraphQL unsafe deserialization exposes Advanced Search credentials 2026-11-01
CVE-2026-85706 GitLab critical GitLab unauthenticated repository-commits API path traversal and arbitrary file read (CISA KEV) 2026-11-01
CVE-2026-119096 uncanny-learndash-toolkit critical Uncanny Toolkit for LearnDash (WordPress) through 3.8.2 - a parser differential between the plugin's account-verification lookup and WordPress core's sanitize_user() skips the gate… 2026-11-01
CVE-2026-110264 GitLab critical GitLab unauthenticated crafted-regex integer overflow remote code execution 2026-11-01
CVE-2024-31459 Cacti critical Covered by the Cacti batch fix for CVE-2023-39361 2026-11-01
CVE-2023-39361 Cacti critical Cacti graph_view.php SQL injection via rfilter reachable by guest users 2026-11-01
CVE-2022-46169 Cacti critical Cacti remote_agent.php pre-auth command injection allows unauthenticated remote code execution 2026-11-01
CVE-2026-15723 GitLab high GitLab SAML and LDAP auto-linking account takeover through LDAP injection 2026-11-01
CVE-2026-112212 GitLab high GitLab OAuth/OIDC discovery cache poisoning through trusted user-controlled endpoint URLs 2026-11-01
CVE-2026-111357 Ivanti Connect Secure high Ivanti Connect Secure dsinvoked broker trusts DSCache configuration data -> privilege escalation to root, exploited in the wild (CISA KEV) - step 3 of the UTA0576 chain 2026-11-01
CVE-2026-110305 acf-extended high Advanced Custom Fields: Extended (WordPress) before 0.9.2.8 - a {get_user} template tag in a public [acfe_form] Term action is resolved and written out as a term name, publishing a… 2026-11-01
CVE-2025-24367 Cacti high Cacti RRDTool argument injection lets an authenticated user write arbitrary PHP to the web root 2026-11-01
CVE-2026-12664 GitLab medium GitLab read_api token scope bypass exposes incoming email and permits work-item creation 2026-11-01
CVE-2026-118527 Ivanti Connect Secure medium Ivanti Connect Secure generates predictable identifiers, so an authenticated attacker writes attacker-controlled content to a known path on disk (CISA KEV) - step 2 of the UTA0576 … 2026-11-01
CVE-2026-76418 Cisco ASA/FTD WebVPN high Cisco ASA/FTD Remote Access SSL VPN unauthenticated reload via secondary authentication on a tunnel group - a crafted connection request takes the VPN down (CVSS 8.6, CISA KEV) 2026-10-30
CVE-2026-119201 Vite dev server high Reported by NewScan's exposure path probe: Vite development server reachable - hot-reload client served to anonymous callers 2026-10-30
CVE-2026-119199 Vite dev server high Reported by NewScan's exposure path probe: Vite development server reachable - hot-reload client served to anonymous callers 2026-10-30
CVE-2026-118772 joi high Joi email multiple-address separator regular expression denial of service (17.x version advisory) 2026-10-30
CVE-2020-17518 Apache Flink critical Apache Flink JobManager REST upload path traversal allows arbitrary file write 2026-10-29
CVE-2023-37941 Apache Superset high Apache Superset metadata database pickle deserialization leads to remote code execution 2026-10-29
CVE-2023-27524 Apache Superset high Apache Superset default SECRET_KEY allows session forgery and admin takeover 2026-10-29
CVE-2020-17519 Apache Flink high Apache Flink JobManager log endpoint path traversal discloses local files 2026-10-29
CVE-2026-111497 Brotli critical Google Brotli 1.0.3 through 1.2.0 - remote unauthenticated buffer overflow in the decoder (CISA KEV, actively exploited) 2026-10-28
CVE-2026-110879 jackson-databind critical jackson-databind polymorphic type validation bypass via nested generic and array element types - gadget deserialization, reachable RCE 2026-10-28
CVE-2026-118376 REST APIs high Reported by NewScan's named-CVE check: test_ssrf 2026-10-28
CVE-2026-116693 dd-trace high Datadog dd-trace query-string obfuscation regular expression denial of service 2026-10-27
CVE-2026-116588 ddtrace high Datadog ddtrace query-string obfuscation regular expression denial of service 2026-10-27
CVE-2026-116193 rclone medium rclone WebDAV OPTIONS authentication bypass discloses path existence and file type 2026-10-27
CVE-2026-57116 praisonai critical PraisonAI AgentOS missing authentication permits remote agent invocation and instruction disclosure 2026-10-24
CVE-2026-115728 @hapi/content high @hapi/content Content.disposition() regular expression denial of service from an incomplete prior fix 2026-10-24
CVE-2026-94267 acf-extended critical Advanced Custom Fields: Extended (WordPress) before 0.9.2.8 - front-end form actions update posts with no capability check, letting an unauthenticated visitor overwrite the site's … 2026-10-23
CVE-2026-112862 participants-database critical Participants Database (WordPress) through 2.7.8.5 deserializes untrusted input - PHP object injection, no patched release exists 2026-10-23
CVE-2026-112860 participants-database critical Participants Database (WordPress) through 2.7.8.5 blind SQL injection, no patched release exists 2026-10-23
CVE-2026-112241 surecart critical SureCart through 4.9.5 accepts a spoofed identity on its authentication path, so an anonymous request can act as another account - a store takeover with no credential 2026-10-22
CVE-2026-111816 Apache Traffic Server critical Apache Traffic Server advisory batch of 2026-10-22: the experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) co… 2026-10-22
CVE-2026-111813 Apache Traffic Server critical Apache Traffic Server advisory batch of 2026-10-22: the experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) co… 2026-10-22
CVE-2026-111811 Apache Traffic Server critical Apache Traffic Server advisory batch of 2026-10-22: the experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) co… 2026-10-22
CVE-2026-111810 Apache Traffic Server critical Covered by the Apache Traffic Server batch fix for CVE-2025-31699 2026-10-22
CVE-2026-105944 apache-pulsar-manager critical Reported by NewScan's unauthenticated interface: Apache Pulsar Manager reachable - anonymous superuser creation, and it holds the cluster credential 2026-10-22
CVE-2025-31699 Apache Traffic Server critical Apache Traffic Server advisory batch of 2026-10-22: the experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) co… 2026-10-22
CVE-2026-113709 Argo CD critical Covered by the Argo CD batch fix for CVE-2026-113708 2026-10-21
CVE-2026-113708 Argo CD critical Argo CD: the repo-server renders untrusted repository content with its own privileges. A .jsonnet file can import any path the repo-server can read, including the files holding clu… 2026-10-21
CVE-2026-113672 Argo CD critical Covered by the Argo CD batch fix for CVE-2026-113708 2026-10-21
CVE-2026-109619 PHP critical Covered by the PHP batch fix for CVE-2026-109618 2026-10-21
CVE-2026-109618 PHP critical PHP core unauthenticated remote code execution pair of 2026-10-21: OOM-interrupted request startup leaves half-initialised request memory for shutdown to use (CVE-2026-109618), and… 2026-10-21
CVE-2026-96655 Plex Media Server high Covered by the Plex Media Server batch fix for CVE-2026-96654 2026-10-21
CVE-2026-96654 Plex Media Server high Plex Media Server before 1.43.3.10861: three CISA KEV bugs fixed by one release - unsanitized URLs in the 'searchOne' parameter let an attacker reach other plugins' functions with … 2026-10-21
CVE-2026-96652 Plex Media Server high Covered by the Plex Media Server batch fix for CVE-2026-96654 2026-10-21
CVE-2026-111956 wholesalex medium WholesaleX leaves the user-import file it wrote in a publicly readable location under a predictable name, so anyone can download the imported customer list 2026-10-21
CVE-2026-108073 surecart medium SureCart lets an anonymous visitor choose which related objects to include when reading an upsell funnel through its REST API, pulling back records the funnel itself was never mean… 2026-10-21
CVE-2026-105999 booking-package medium Booking Package returns calendar-account configuration to an unauthenticated request - no authorization check on the handler that serves it 2026-10-21
CVE-2026-112292 checkcle high Reported by NewScan's unauthenticated interface: CheckCle notification credentials readable anonymously (world-readable PocketBase collections) 2026-10-20
CVE-2026-111750 aiohttp high aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attacker-chosen Request.scheme, two unenforced cookie… 2026-10-20
CVE-2026-111749 aiohttp high Reported by NewScan's component version range: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attack… 2026-10-20
CVE-2026-111748 aiohttp high Reported by NewScan's component version range: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attack… 2026-10-20
CVE-2026-111066 aiohttp high Reported by NewScan's component version range: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attack… 2026-10-20
CVE-2026-111065 aiohttp high Reported by NewScan's component version range: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attack… 2026-10-20
CVE-2026-111064 aiohttp high Reported by NewScan's component version range: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attack… 2026-10-20
CVE-2026-111063 aiohttp high Reported by NewScan's component version range: aiohttp before 3.14.4: seven advisories in one release - request smuggling via ambiguous framing in the pure-Python parser, an attack… 2026-10-20
CVE-2026-78162 Apache Camel critical Apache Camel 4.0.0-4.18.4: the camel-hazelcast component deserializes untrusted data, giving code execution on the integration host (CVSS 10.0) 2026-10-19
CVE-2026-88901 Apache Camel high Apache Camel 4.7.0-4.18.4: XML external entity reference is not restricted, so a routed XML message reads local files or reaches internal hosts 2026-10-19
CVE-2026-86589 Apache Answer high Apache Answer through 2.0.2: the User Center login integration implements its authentication algorithm incorrectly 2026-10-19
CVE-2026-80344 Apache Camel high Apache Camel 4.0.0-4.18.4: server-side request forgery in the AS2 component's message processing 2026-10-19
CVE-2026-80343 Apache Camel high Apache Camel 4.0.0-4.18.4: the Netty HTTP component handles header case inconsistently, which is how a filtered header gets through under a different spelling 2026-10-19
CVE-2026-80312 Apache Camel high Apache Camel 4.11.0-4.18.4: the camel-oauth processor authenticates improperly, so a request reaches the route without a valid token 2026-10-19
CVE-2026-78165 Apache Camel high Apache Camel 2.11.0-4.18.4: the Spring Redis component deserializes untrusted data read back from Redis 2026-10-19
CVE-2026-76994 Apache Answer high Apache Answer through 2.0.2: unauthenticated attackers can obtain user metadata that is not meant to be public 2026-10-19
CVE-2026-67249 Apache Answer high Apache Answer through 2.0.2: an email verification code issued for one workflow is accepted by another sensitive workflow 2026-10-19
CVE-2026-64943 Apache Answer high Apache Answer through 2.0.2 writes full API keys into the application log, so anyone who can read the log holds the keys 2026-10-19
CVE-2026-97859 Gitea medium Gitea before 1.27.3: seven /api/v1/users/{username} routes (followers, following, starred, subscriptions, keys, gpg_keys) were registered without the individual-user authorisation … 2026-10-19
CVE-2026-90910 Apache Answer medium Apache Answer through 2.0.2: the reaction API skips the content-visibility check, so reactions leak private content 2026-10-19
CVE-2026-79624 Apache Answer medium Apache Answer through 2.0.2: sessions are not invalidated on revocation, so a revoked user keeps working 2026-10-19
CVE-2026-79613 Apache Answer medium Apache Answer through 2.0.2: comments on non-public content are reachable anonymously through the public comment URLs 2026-10-19
CVE-2026-71563 Apache Answer medium Apache Answer through 2.0.2: the MCP answer-retrieval tool lets a holder of a general token read answers it should not 2026-10-19
CVE-2026-68482 Apache Answer medium Apache Answer through 2.0.2: the invited-user list is returned to callers with no authorisation for it 2026-10-19
CVE-2026-64945 Apache Answer medium Apache Answer through 2.0.2: the question controller gates hide/show on the wrong permission result 2026-10-19
CVE-2026-64944 Apache Answer medium Apache Answer through 2.0.2: stored cross-site scripting through the content importer 2026-10-19
CVE-2026-110311 Gitea medium Gitea before 28.2.0: creating a draft release through the API returns an assets list built from a release with no ID, which matches every attachment not yet linked to a release and… 2026-10-19
CVE-2026-111911 phpMyFAQ critical phpMyFAQ 4.0.0 before 4.1.9: the WebAuthn registration endpoints attach a new credential to any named account without authentication or challenge validation, so an unauthenticated … 2026-10-18
CVE-2026-111927 Coder high Coder before 2.29.20: GetWorkspaceProxyByHostname matches a workspace-proxy hostname by PREFIX, so an attacker-registered lookalike hostname is accepted as a trusted proxy and is h… 2026-10-18
CVE-2026-111910 phpMyFAQ high phpMyFAQ before 4.1.9: attachment.php serves an attachment without checking the caller may read its parent FAQ, so restricted-category attachments download for anyone 2026-10-18
CVE-2026-111908 phpMyFAQ high phpMyFAQ 4.0.0 before 4.1.9: PUT /api/v3.1/faq/update checks only that the caller may edit SOMETHING, not that it may edit THIS record - broken object-level authorization over the … 2026-10-18
CVE-2026-111907 phpMyFAQ high phpMyFAQ 4.0.0 before 4.1.9: POST /admin/api/update-database runs database migrations with no CSRF token validation, so a logged-in administrator visiting a hostile page triggers t… 2026-10-18
CVE-2026-111906 phpMyFAQ high phpMyFAQ before 4.1.9: the Elasticsearch and OpenSearch administration API endpoints create and drop search indices with no CSRF token validation 2026-10-18
CVE-2026-111905 phpMyFAQ high phpMyFAQ 3.2.0 before 4.1.9: GET /admin/api/user/data/{userId} returns any user's record to any authenticated caller - an IDOR that leaks the target's TOTP secret, which defeats th… 2026-10-18
CVE-2026-111895 phpMyFAQ high phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta: the Microsoft Entra ID login flow links an incoming identity to a local account by the MUTABLE preferred_username claim, so… 2026-10-18
CVE-2026-111884 phpMyFAQ high phpMyFAQ before 4.1.9: UserController::updateData changes the account e-mail without asking for the current password, so any hijacked session can repoint the address and then drive… 2026-10-18
CVE-2026-111882 phpMyFAQ high phpMyFAQ before 4.1.9: a user arriving through the identity provider skips the TOTP second-factor step entirely, so 2FA is not enforced on the IdP login path 2026-10-18
CVE-2026-111934 Coder medium Coder before 2.34.7: the ExtractRealIPAddress middleware trusts the LEFTMOST, client-supplied X-Forwarded-For value instead of the connecting peer, so any client can forge its sour… 2026-10-18
CVE-2026-111933 Coder medium Coder before 2.29.17: userpassword.Compare() substitutes a placeholder hash for an unknown account, so login timing and response differ between real and absent users - unauthentica… 2026-10-18
CVE-2026-111932 Coder medium Coder before 2.29.17: the ApplicationName and LogoURL appearance settings are rendered unescaped, so an operator-set value stores HTML injection into every user's dashboard 2026-10-18
CVE-2026-111931 Coder medium Coder 2.0.0 before 2.34.8: handleAPIKeySmuggling builds a redirect from an unsanitised r.URL.Path, so the workspace app proxy can be made to bounce a user to an external site - ope… 2026-10-18
CVE-2026-111930 Coder medium Coder 2.26.0 before 2.34.8: GET /api/v2/workspaces/{id}/acl checks only workspace READ access and then returns the full group ACL, disclosing group membership and sharing to any us… 2026-10-18
CVE-2026-111929 Coder medium Coder 2.30.0 before 2.34.8: the provisioner daemon DownloadFile gRPC handler omits the organization check, so an authenticated provisioner daemon reads template files belonging to … 2026-10-18
CVE-2026-111928 Coder medium Coder 2.0.0 before 2.34.8: the acl_allow rule of coderd/rbac/policy.rego does not verify organization membership, so a user-level ACL entry grants access across organization bounda… 2026-10-18
CVE-2026-111900 phpMyFAQ medium phpMyFAQ before 4.1.9: attachment.php does not check whether an attachment's parent FAQ is still a DRAFT, so unpublished content is downloadable 2026-10-18
CVE-2026-111894 phpMyFAQ medium phpMyFAQ 3.2.1 before 4.1.9: an authenticated content author stores JavaScript through an iframe `data:` URI that the editor sanitiser permits - stored cross-site scripting 2026-10-18
CVE-2026-111889 phpMyFAQ medium phpMyFAQ 4.1.0 before 4.1.9: the admin dashboard renders for authenticated users holding no admin right - missing authorization 2026-10-18
CVE-2026-111888 phpMyFAQ medium phpMyFAQ 4.0.0 before 4.1.9: PUT /admin/api/news lets a delegated admin without the editnews right modify news items - incorrect authorization 2026-10-18
CVE-2026-111887 phpMyFAQ medium phpMyFAQ before 4.1.9: the unauthenticated guest comment endpoint answers differently for a registered display name or e-mail than for an unknown one - account enumeration 2026-10-18
CVE-2024-58398 Coder medium Coder 2.3.1 before 2.14.4: the login page's redirect query parameter is not validated against the deployment's own origin - open redirect on the authentication entry point 2026-10-18
CVE-2025-71435 Coder low Coder before 2.23.0: when the OIDC provider issues no refresh token the session is never re-validated, so a user keeps access after their identity-provider token has expired - sess… 2026-10-18
CVE-2026-85748 MariaDB critical MariaDB 12.3.1 - 12.3.2: SYS_REFCURSOR cursor-array reallocation leaves stale state behind (CVSS 9.9) 2026-10-17
CVE-2026-85746 MariaDB critical MariaDB 10.6.1 - 10.6.27: ST_AsText writes past its allocated output buffer (CVSS 9.9) 2026-10-17
CVE-2026-110653 latepoint critical LatePoint <= 5.7.4 authentication bypass by racing the OTP lockout - the attempts counter is a non-atomic read-modify-write, so concurrent requests defeat the 10-try cap and brute-… 2026-10-17
CVE-2026-104736 learnpress critical LearnPress <= 4.4.10 unauthenticated PHP object injection - a serialized object in the checkout 'checkout-email' parameter is stored in the session table and unserialized on a late… 2026-10-17
CVE-2026-102764 BeyondTrust Remote Support critical BeyondTrust Remote Support <= 26.2.3: internal components do not validate message origin, allowing file operations on the appliance (CVSS 9.3) 2026-10-17
CVE-2026-97380 MariaDB high MariaDB 10.6.1 - 10.6.27: GRANT PROXY mishandles an IDENTIFIED BY clause, granting more than it should (CVSS 8.8) 2026-10-17
CVE-2026-111413 athemeart-theme-helper high aThemeArt Theme Helper <= 1.0.8 cross-site request forgery (CVSS 8.8) 2026-10-17
CVE-2026-97314 thirstyaffiliates medium ThirstyAffiliates < 3.12.1: the link redirect tracking handler checks neither the status nor the type of the requested object, so an unauthenticated caller reads the destination UR… 2026-10-17
CVE-2026-111602 latepoint medium LatePoint <= 5.7.4 customer database disclosure - the unauthenticated steps__load_step AJAX endpoint leaks name, email, phone and notes for any customer whose uuid prefix is enumer… 2026-10-17
CVE-2024-27198 JetBrains TeamCity critical TeamCity authentication bypass - an unauthenticated request reaches every authenticated endpoint and can create an administrator 2026-10-16
CVE-2023-42793 JetBrains TeamCity critical TeamCity authentication bypass - an unauthenticated request mints an administrator token and runs code on the build server 2026-10-16
CVE-2026-111096 JetBrains TeamCity high Covered by the JetBrains TeamCity batch fix for CVE-2026-111094 2026-10-16
CVE-2026-111095 JetBrains TeamCity high Covered by the JetBrains TeamCity batch fix for CVE-2026-111094 2026-10-16
CVE-2026-111094 JetBrains TeamCity high TeamCity remote code execution through a whitelist bypass in the build messages protocol 2026-10-16
CVE-2022-24706 CouchDB critical Apache CouchDB 3.2.1 and earlier: the installer leaves the Erlang distribution cookie at the default 'monster', so anyone who can reach the cluster ports (4369 epmd, 9100) executes… 2026-10-15
CVE-2019-17558 Apache Solr critical Apache Solr 5.0.0 through 8.3.1: the VelocityResponseWriter renders a template passed as a request parameter once params.resource.loader.enabled is set, and the config API can set … 2026-10-15
CVE-2017-12635 CouchDB critical Apache CouchDB before 1.7.0: the Erlang and JavaScript JSON parsers disagree about duplicate keys, so an anonymous _users document can smuggle itself the _admin role - privilege es… 2026-10-15
CVE-2017-12629 Apache Solr critical Apache Solr before 7.1.0: a RunExecutableListener can be added through the config API and then fired by any document update, giving remote command execution; the same id also cover… 2026-10-15
CVE-2015-1427 Elasticsearch critical Elasticsearch before 1.3.8: the Groovy scripting sandbox can be escaped, so a dynamic script submitted to _search runs arbitrary code 2026-10-15
CVE-2014-3120 Elasticsearch critical Elasticsearch before 1.2: dynamic scripting is enabled by default, so the source parameter of _search executes attacker-supplied MVEL - unauthenticated remote code execution 2026-10-15
CVE-2017-12636 CouchDB high Apache CouchDB before 1.7.0: a server configuration option can be pointed at an arbitrary binary which CouchDB then launches, so an administrator account becomes command execution … 2026-10-15
CVE-2015-5531 Elasticsearch high Elasticsearch before 1.6.1: the snapshot/restore repository location is not confined to path.repo, so a crafted repository name reads arbitrary files 2026-10-15
CVE-2015-3337 Elasticsearch high Elasticsearch before 1.4.5: a site plugin's static file handler accepts ../ in the path, giving arbitrary file read as the Elasticsearch user 2026-10-15
CVE-2026-85733 PHP phpinfo() critical Reported by NewScan's exposure path probe: Exposed phpinfo() at the application root 2026-10-14
CVE-2026-104935 Ivanti Connect Secure critical Ivanti Connect Secure authentication bypass by spoofing -> unauthenticated command execution 2026-10-14
CVE-2026-110130 HTTP routing high Reported by NewScan's named-CVE check: test_path_acl_bypass 2026-10-14
CVE-2026-107406 Citrix NetScaler ADC/Gateway critical NetScaler ADC/Gateway memory overflow leading to remote code execution or denial of service; reachable only where the appliance is configured as a SAML Identity Provider (IdP) or S… 2026-10-09
CVE-2026-107204 LMCache critical LMCache through 0.5.5: unauthenticated remote code execution - POST /run_script exec()s an uploaded Python file on the inference host (CVSS 9.3) 2026-10-09
CVE-2026-102255 SonicWall SMA/SSL-VPN critical SonicWall SMA1000 WorkPlace portal pre-authentication server-side request forgery via an unintended alternate access path - reachable with no credentials (CVSS 10.0) 2026-10-09
CVE-2026-107206 LMCache high LMCache through 0.5.5: missing authentication on the multiprocess-mode HTTP server's management API - anonymous cache inspection, clear and reconfigure (CVSS 8.8) 2026-10-09
CVE-2026-107205 LMCache high LMCache through 0.5.5: missing authentication on the multiprocess coordinator's HTTP fleet control API (CVSS 8.8) 2026-10-09
CVE-2026-107207 LMCache medium LMCache through 0.5.5: server-side request forgery in the frontend monitoring service - the proxy allowlist is bypassed through the node catalog (CVSS 6.9) 2026-10-09
CVE-2026-21589 Atlassian Confluence critical Confluence pre-authentication arbitrary file read through the plugin-resource download servlet 2026-10-07
CVE-2026-103378 geliver-akilli-kargo-pazaryeri high Geliver Akilli Kargo Pazaryeri writes its carrier-integration key to a world-readable log file inside its own plugin directory 2026-10-07
CVE-2026-86816 wp-cafe medium WPCafe REST API routes registered without a permission callback - unauthenticated read of WooCommerce product data 2026-10-07
CVE-2026-77226 Camunda Platform 7 critical Camunda Platform 7.24.0 before 7.24.15: the Admin web application's first-run setup endpoint stays reachable after setup has already been completed, so an unauthenticated caller ca… 2026-10-06
CVE-2026-105740 Langflow critical Covered by the Langflow batch fix for CVE-2026-8182 2026-10-06
CVE-2026-105697 Langflow critical Covered by the Langflow batch fix for CVE-2026-8182 2026-10-06
CVE-2026-61500 Rejetto HFS critical Rejetto HFS admin session forgery via a Math.random() session-signing key -> full admin access and remote code execution (exploited in the wild) 2026-10-05
CVE-2026-88779 Citrix NetScaler ADC/Gateway high NetScaler ADC/Gateway denial of service when configured as a SAML Service Provider or Identity Provider (CVSS 8.7, CISA KEV, exploited as a zero-day) 2026-10-05
CVE-2026-103355 unlimited-elements-for-elementor critical Unlimited Elements for Elementor (WordPress) through 2.0.20: SQL injection, plus two cross-site scripting defects fixed in the same release 2026-10-04
CVE-2026-103344 unlimited-elements-for-elementor critical Covered by the unlimited-elements-for-elementor batch fix for CVE-2026-103355 2026-10-04
CVE-2026-103342 unlimited-elements-for-elementor critical Covered by the unlimited-elements-for-elementor batch fix for CVE-2026-103355 2026-10-04
CVE-2026-97276 wp-statistics high WP Statistics (WordPress) through 14.16.14: reflected cross-site scripting 2026-10-04
CVE-2026-96451 ultimate-member high Ultimate Member (WordPress) through 2.13.1: authorization bypass through a user-controlled key -> privilege escalation 2026-10-04
CVE-2026-105122 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-105121 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-105120 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-105118 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-105117 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-105116 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-105115 OpenAM high OpenAM before 16.1.3: unauthenticated arbitrary class instantiation via the legacy JAX-RPC SOAP interface, plus cross-realm session disclosure/destruction, OAuth2 client SSRF, refl… 2026-10-04
CVE-2026-105114 OpenAM high Covered by the OpenAM batch fix for CVE-2026-105115 2026-10-04
CVE-2026-103354 kadence-blocks high Gutenberg Blocks by Kadence Blocks (WordPress) through 3.7.11.1: cross-site scripting 2026-10-04
CVE-2026-103062 translatepress-multilingual high TranslatePress (WordPress) through 3.3.6: stored cross-site scripting 2026-10-04
CVE-2026-104849 tinypool critical Tinypool runs a worker file named by the caller's own options object - a request-controlled options bag becomes arbitrary code execution 2026-10-03
CVE-2026-104848 tinypool critical Tinypool prototype pollution - execArgv and env read off a plain options object reach the worker thread's process configuration 2026-10-03
CVE-2026-104846 seroval critical Seroval fromJSON deserialization of a fulfilled Promise reaches unintended code paths 2026-10-03
CVE-2026-85515 Bouncy Castle high Covered by the Bouncy Castle batch fix for CVE-2026-71885 2026-10-03
CVE-2026-71890 Bouncy Castle high Covered by the Bouncy Castle batch fix for CVE-2026-71885 2026-10-03
CVE-2026-71887 Bouncy Castle high Covered by the Bouncy Castle batch fix for CVE-2026-71885 2026-10-03
CVE-2026-71886 Bouncy Castle high Covered by the Bouncy Castle batch fix for CVE-2026-71885 2026-10-03
CVE-2026-71885 Bouncy Castle high Bouncy Castle for Java MLS and OpenPGP signature-binding failures (MLS LeafNode credential not bound to its signature key, OpenPGP subkey and certification binding accepted without… 2026-10-03
CVE-2026-71883 Bouncy Castle LTS high Bouncy Castle for Java LTS one-shot native packet ciphers released the caller's key, IV and additional authenticated data 2026-10-03
CVE-2026-104861 probe-image-size high probe-image-size SVG parser regular-expression denial of service 2026-10-03
CVE-2026-104851 fsspec high fsspec ReferenceFileSystem evaluates attacker-supplied references 2026-10-03
CVE-2026-104845 seroval high Seroval typed-array deserialization denial of service - deserializeTypedArray trusts an attacker-stated length 2026-10-03
CVE-2026-104476 Backdrop CMS high Reported by NewScan's exposure path probe: Site configuration export archive downloadable without authentication 2026-10-03
CVE-2026-104286 FortiMail critical FortiMail path traversal plus NULL-byte neutralisation failure - a crafted unauthenticated HTTP(S) request writes arbitrary files on the mail gateway (CVSS 9.8, CISA KEV, exploited… 2026-10-02
CVE-2026-103475 Yii critical Reported by NewScan's exposure path probe: Yii Gii code generator reachable without authentication - unauthenticated remote code execution 2026-10-02
CVE-2026-102147 Kiteworks critical Kiteworks Core stored XSS reachable without credentials - an unauthenticated attacker stores content that later runs JavaScript in an authenticated user's session (CVSS 9.3) 2026-10-02
CVE-2026-102115 Kiteworks critical Kiteworks Core password-reset parameter validation failure - an unauthenticated attacker who knows a user's email address takes over that account (CVSS 9.8) 2026-10-02
CVE-2026-102106 Kiteworks critical Kiteworks Email Protection Gateway administrative service does not consistently enforce authentication - an administrative surface answers a caller it never authenticated (CVSS 9.1… 2026-10-02
CVE-2026-102121 Kiteworks high Kiteworks Advanced Forms renders published forms to anonymous visitors but returns more data than the form displays (CVSS 8.6) 2026-10-02
CVE-2026-76504 Cisco Catalyst SD-WAN Manager critical Cisco Catalyst SD-WAN Manager authentication bypass granting unauthenticated admin-level API access (CISA KEV) 2026-10-01
CVE-2026-55494 tugtainer-agent critical Reported by NewScan's unauthenticated interface: Unauthenticated Tugtainer Agent Docker control API 2026-10-01
CVE-2018-1207 Dell iDRAC high Reported by NewScan's named-CVE check: idrac_version 2026-10-01
CVE-2026-28292 simple-git critical simple-git blockUnsafeOperationsPlugin bypass via a case-insensitive protocol.allow config key -> RCE 2026-09-30
CVE-2026-102828 simple-git critical simple-git command execution via unclassified trailer.<token>.cmd config - git interpret-trailers runs an attacker-selected shell command 2026-09-30
CVE-2026-102811 marmite critical Reported by NewScan's unauthenticated interface: Marmite development server exposed with its authoring API unauthenticated 2026-09-30
CVE-2026-102810 marmite critical Reported by NewScan's unauthenticated interface: Marmite development server exposed with its authoring API unauthenticated 2026-09-30
CVE-2022-25860 simple-git critical simple-git remote code execution via an incompletely sanitised remote URL 2026-09-30
CVE-2018-20060 urllib3 critical urllib3 does not strip the Authorization header on cross-origin redirects 2026-09-30
CVE-2026-97689 urllib3 high urllib3 unbounded memory allocation - read_chunked/stream buffer an unterminated chunk-size line without a length bound, so a malicious server can exhaust the client process 2026-09-30
CVE-2026-97687 urllib3 high urllib3 HTTPS-proxy TLS confusion - target-server TLS settings are applied to the proxy connection and cert_reqs=CERT_NONE mutates proxy_ssl_context in place, so later connections … 2026-09-30
CVE-2026-6951 simple-git high simple-git remote code execution 2026-09-30
CVE-2026-44432 urllib3 high urllib3 decompression-bomb safeguards bypassed in parts of the streaming API 2026-09-30
CVE-2026-44431 urllib3 high urllib3 forwards sensitive headers across origins in proxied low-level redirects 2026-09-30
CVE-2026-28291 simple-git high simple-git command execution via an option-parsing bypass 2026-09-30
CVE-2026-21441 urllib3 high urllib3 decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) 2026-09-30
CVE-2026-102827 simple-git high simple-git option-abbreviation bypass in detectVulnerableFlags - abbreviated --receive-pack/--exec forms reach git push and invoke an attacker-selected command 2026-09-30
CVE-2026-102826 simple-git high simple-git config-include bypass in blockUnsafeOperationsPlugin - include.path/includeIf.<condition>.path load an attacker-controlled git config that can set core.sshCommand 2026-09-30
CVE-2025-66471 urllib3 high urllib3 streaming API improperly handles highly compressed data 2026-09-30
CVE-2025-66418 urllib3 high urllib3 allows an unbounded number of links in the decompression chain 2026-09-30
CVE-2023-43804 urllib3 high urllib3 does not strip the Cookie header on cross-origin redirects (1.26.x line) 2026-09-30
CVE-2022-25912 simple-git high simple-git remote code execution when the ext transport protocol is enabled 2026-09-30
CVE-2022-24433 simple-git high simple-git command injection via git argument handling 2026-09-30
CVE-2022-24066 simple-git high simple-git command injection 2026-09-30
CVE-2021-33503 urllib3 high urllib3 catastrophic backtracking in the URL authority parser on a URL containing many @ characters 2026-09-30
CVE-2020-7212 urllib3 high urllib3 uncontrolled resource consumption in the URL authority parser 2026-09-30
CVE-2019-11324 urllib3 high urllib3 improper certificate validation when a custom CA bundle is supplied 2026-09-30
CVE-2026-97688 urllib3 medium urllib3 infinite loop in HTTPResponse.stream/read_chunked - a chunked Deflate response with trailing bytes decodes without progress and no socket read occurs, so read timeouts do n… 2026-09-30
CVE-2025-50182 urllib3 medium urllib3 does not control redirects in browsers and Node.js 2026-09-30
CVE-2025-50181 urllib3 medium urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation 2026-09-30
CVE-2024-37891 urllib3 medium urllib3 does not strip the Proxy-Authorization header on cross-origin redirects (1.26.x line) 2026-09-30
CVE-2023-45803 urllib3 medium urllib3 does not strip the request body after a 303 redirect changes the method to GET (1.26.x line) 2026-09-30
CVE-2021-28363 urllib3 medium urllib3 does not verify the proxy certificate hostname when the default SSLContext is used for an HTTPS proxy 2026-09-30
CVE-2020-26137 urllib3 medium urllib3 CRLF injection via an attacker-controlled request method 2026-09-30
CVE-2019-11236 urllib3 medium urllib3 CRLF injection via a crafted request URI 2026-09-30
CVE-2018-25091 urllib3 medium urllib3 forwards the Authorization header on cross-host redirects 2026-09-30
CVE-2016-9015 urllib3 medium urllib3 incorrect certificate validation - TLS hostname verification is not enforced 2026-09-30
CVE-2026-102275 PyJWT high Covered by the PyJWT batch fix for CVE-2026-102268 2026-09-29
CVE-2026-102274 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102273 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102272 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102271 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102270 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102269 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102268 PyJWT high PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.prepare_key as an ordinary secret - anyone holding… 2026-09-29
CVE-2026-102267 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102266 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-102265 PyJWT high Covered by the PyJWT batch fix for CVE-2026-102268 2026-09-29
CVE-2026-101918 PyJWT high Covered by the PyJWT batch fix for CVE-2026-102268 2026-09-29
CVE-2026-101917 PyJWT high Reported by NewScan's component version range: PyJWT before 2.14.0: is_pem_format does not recognise every PEM representation, so an asymmetric public key reaches HMACAlgorithm.pre… 2026-09-29
CVE-2026-101909 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101908 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101907 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101906 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101905 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101904 axios high axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution), two quadratic regular expressions, unhandled H… 2026-09-29
CVE-2026-101903 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101901 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101900 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101898 axios high Reported by NewScan's component version range: axios 1.x before 1.20.0: ten advisories fixed by one release - inherited-prototype config reaching the request (prototype pollution),… 2026-09-29
CVE-2026-101902 axios medium axios 0.x before 0.34.0: a default-instance request that omits an explicit method reads an inherited method from a polluted prototype, and toFormData processes inherited serializat… 2026-09-29
CVE-2026-101092 SiYuan medium Covered by the SiYuan batch fix for CVE-2026-101091 2026-09-29
CVE-2026-101091 SiYuan medium SiYuan before 3.8.4: a block query embed block in an imported .sy document runs unvalidated SQL against siyuan.db, and getCurrentAttrViewImages skips the publish-access check 2026-09-29
CVE-2026-88773 Citrix NetScaler ADC/Gateway critical NetScaler ADC/Gateway HTTP request smuggling through inconsistent request interpretation (CVSS 9.3) 2026-09-28
CVE-2026-88772 Citrix NetScaler ADC/Gateway critical NetScaler ADC/Gateway memory overflow leading to remote code execution or denial of service when DTLS is enabled (CVSS 9.5, CISA KEV, exploited as a zero-day) 2026-09-28
CVE-2026-88771 Citrix NetScaler ADC/Gateway critical NetScaler ADC/Gateway pre-authentication command injection via the AAA logon endpoint (CVSS 9.5, CISA KEV, exploited as a zero-day) 2026-09-28
CVE-2026-101065 obot critical Reported by NewScan's unauthenticated interface: Unauthenticated Obot AI agent platform (owner-level API reachable anonymously) 2026-09-28
CVE-2026-88774 Citrix NetScaler ADC/Gateway high NetScaler ADC/Gateway vulnerability dependent on specific configurations (CVSS 7.0) 2026-09-28
CVE-2026-85984 miniorange-otp-verification critical miniOrange OTP Login, Verification and SMS Notifications (WordPress) authentication bypass - mo_wp_login_intent=otp logs an unauthenticated caller in as any administrator 2026-09-27
CVE-2026-82901 ultimate-addons-for-contact-form-7 critical Ultra Addons for Contact Form 7 (WordPress) unauthenticated arbitrary file upload in uacf7_wpcf7_mail_components -> possible RCE 2026-09-27
CVE-2026-100857 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100856 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100855 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100853 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100852 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100851 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100849 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100848 AzuraCast high Covered by the AzuraCast batch fix for CVE-2026-100847 2026-09-27
CVE-2026-100847 AzuraCast high AzuraCast pre-0.23.8 batch: DQL injection via the sortOrder API parameter, plus SSRF, command/code injection and unauthenticated media download 2026-09-27
CVE-2026-87902 WordPress critical WordPress core unauthenticated local file inclusion - get_page_template() resolves a page template outside the active theme and includes a chosen readable local .php file 2026-09-26
CVE-2026-65660 Microsoft SharePoint Server critical SharePoint Server code injection - an authenticated caller executes code on the server over the network (CVSS 8.8), actively exploited September 2026 2026-09-26
CVE-2026-100418 Flame medium Reported by NewScan's exposure path probe: Flame start-page configuration, weather API key included, answers an unauthenticated GET - CVE-2026-100418 2026-09-26
CVE-2026-89055 customer-reviews-woocommerce high Customer Reviews for WooCommerce authorization bypass - a plugin endpoint does not check the caller's capability before acting 2026-09-25
CVE-2026-63645 OpenObserve high Reported by NewScan's exposure path probe: OpenObserve runtime configuration answers an unauthenticated GET - CVE-2026-63645 2026-09-25
CVE-2026-97056 SigNoz critical Covered by the SigNoz batch fix for CVE-2026-97055 2026-09-24
CVE-2026-97055 SigNoz critical SigNoz ships an EMPTY default JWT signing secret, so anyone can forge an admin session (CVSS 9.2) 2026-09-24
CVE-2026-82077 PaperCut MF/NG high PaperCut MF/NG Scan-to-Fax path traversal reaching command execution on the host (CVSS 7.3) 2026-09-24
CVE-2026-14780 PaperCut MF/NG high Covered by the PaperCut MF/NG batch fix for CVE-2026-82077 2026-09-24
CVE-2026-87739 PaperCut MF/NG medium PaperCut MF/NG generates reports for an unauthenticated caller - user permissions are never evaluated (CVSS 6.9) 2026-09-24
CVE-2026-94127 F5 BIG-IP critical F5 BIG-IP APM heap overflow in OAuth request handling -> unauthenticated RCE (zero-day, exploited in the wild) 2026-09-23
CVE-2026-93616 Check Point Security Gateway critical Check Point Management Server directory traversal + file upload -> unauthenticated arbitrary script execution 2026-09-23
CVE-2026-85102 Check Point Security Gateway critical Check Point Quantum Security Gateway improper certificate trust validation during VPN negotiation -> unauthenticated RCE 2026-09-23
CVE-2026-73546 envoy critical Reported by NewScan's unauthenticated interface: Unauthenticated Envoy admin interface 2026-09-22
CVE-2026-84990 ntopng high ntopng before 6.7.260718: the system-configuration backup REST endpoints list and hand out configuration backups to a caller that should not be able to read them, exposing the moni… 2026-09-22
CVE-2026-82412 ntopng high ntopng before 6.7.260717: the vulnerability-scan REST endpoints pass a caller-supplied host into the scanner shell, so a request to the monitoring UI runs commands on the appliance… 2026-09-22
CVE-2026-73553 Envoy high Reported by NewScan's component version range: Envoy before 1.36.10 / 1.37.6 / 1.38.4 / 1.39.1: one advisory batch of six routing and access-control bypasses - a non-WebSocket upgr… 2026-09-22
CVE-2026-73552 Envoy high Reported by NewScan's component version range: Envoy before 1.36.10 / 1.37.6 / 1.38.4 / 1.39.1: one advisory batch of six routing and access-control bypasses - a non-WebSocket upgr… 2026-09-22
CVE-2026-73551 Envoy high Reported by NewScan's component version range: Envoy before 1.36.10 / 1.37.6 / 1.38.4 / 1.39.1: one advisory batch of six routing and access-control bypasses - a non-WebSocket upgr… 2026-09-22
CVE-2026-73548 Envoy high Envoy before 1.36.10 / 1.37.6 / 1.38.4 / 1.39.1: one advisory batch of six routing and access-control bypasses - a non-WebSocket upgrade is forwarded as a tunnel (request smuggling… 2026-09-22
CVE-2026-73511 Envoy high Reported by NewScan's component version range: Envoy before 1.36.10 / 1.37.6 / 1.38.4 / 1.39.1: one advisory batch of six routing and access-control bypasses - a non-WebSocket upgr… 2026-09-22
CVE-2026-82187 web-to-print-online-designer critical WooCommerce Online Product Designer unauthenticated arbitrary file upload -> RCE (no type/extension validation, upload token handed to any visitor) 2026-09-21
CVE-2026-86802 todo-lists-for-membership-sites high To Do List Member unauthenticated import - no authorisation or nonce check, and the fetched location is unvalidated (content injection + SSRF) 2026-09-21
CVE-2025-12999 HTTP high Reported by NewScan's named-CVE check: test_base_url_poisoning 2026-09-21
CVE-2026-85113 give medium GiveWP stored shortcode injection - donor-supplied values are rendered on public pages with shortcode delimiters intact 2026-09-21
CVE-2026-85010 restropress medium RestroPress client-side add-on price trusted by the server - unauthenticated order-total manipulation 2026-09-21
CVE-2026-87067 forminator high Forminator Forms (WordPress) PHP object injection: the XML-RPC path deserialises a request value with no allow-list of instantiable classes 2026-09-20
CVE-2026-81654 nextgen-gallery high Covered by the nextgen-gallery batch fix for CVE-2026-81652 2026-09-20
CVE-2026-81652 nextgen-gallery high NextGEN Gallery (WordPress) before 4.5.0: any logged-in user reads any image record, and any logged-in user writes the gallery's image-sizing settings 2026-09-20
CVE-2026-93964 Nginx Proxy Manager medium nginx-proxy-manager through 2.15.1: internalCertificate.validate mishandles an uploaded certificate bundle 2026-09-20
CVE-2026-93598 arcadedb high Reported by NewScan's unauthenticated interface: ArcadeDB Studio console reachable anonymously 2026-09-19
CVE-2026-93595 arcadedb high Reported by NewScan's unauthenticated interface: ArcadeDB Studio console reachable anonymously 2026-09-19
CVE-2026-93594 arcadedb high Reported by NewScan's unauthenticated interface: ArcadeDB Studio console reachable anonymously 2026-09-19
CVE-2026-93593 arcadedb high Reported by NewScan's unauthenticated interface: ArcadeDB Studio console reachable anonymously 2026-09-19
CVE-2026-61833 zot high zot before 2.1.18: the bearer authentication handler accepts a token it should reject, so an OCI registry configured for bearer auth can be read and written without a valid credent… 2026-09-19
CVE-2026-92947 vm2 critical vm2 shared Buffer pool host-memory exposure (version advisory) 2026-09-18
CVE-2026-92599 joi high Joi isoDate validation denial of service (17.x version advisory) 2026-09-18
CVE-2026-91992 tornado medium Tornado CurlAsyncHTTPClient credential reuse (version advisory) 2026-09-18
CVE-2026-89013 Dolibarr high Dolibarr authorization bypass - hashp=shared skips token validation in document.php and viewimage.php, giving an unauthenticated caller arbitrary file read 2026-09-14
CVE-2026-42018 JFrog Artifactory high JFrog Artifactory returns an internal anonymous-user token to an unauthenticated caller even when anonymous access is DISABLED (CISA KEV, exploited in the wild) 2026-09-14
CVE-2026-42016 JFrog Artifactory high JFrog Artifactory (self-hosted) privilege escalation - access tokens are validated on signature and issuer but never on SCOPE (CISA KEV, exploited in the wild) 2026-09-14
CVE-2026-90549 AVideo medium Reported by NewScan's exposure path probe: AVideo mobile video feed returns the video owner's email and last-login to an anonymous caller - CVE-2026-90549 2026-09-14
CVE-2026-90541 AVideo medium Reported by NewScan's exposure path probe: AVideo TopMenu administration menu list answers an unauthenticated GET - CVE-2026-90541 2026-09-14
CVE-2026-89012 Dolibarr medium Dolibarr case-sensitive denylist bypass in the sqlfilters API parameter - uppercase field names reach protected columns as a boolean oracle 2026-09-14
CVE-2026-84869 ConnectWise ScreenConnect critical ScreenConnect build distributes a client that can be made to transfer and execute files over an active remote session without Host authorization 2026-09-12
CVE-2026-72710 SPIP critical SPIP remote code execution via the editer_objet action - attacker rows injected into the spip_jobs queue are unserialized and executed by cron 2026-09-12
CVE-2026-72709 SPIP critical SPIP missing authorization on the ecrire/action/ endpoints - unauthenticated password reset of any account, including the administrator 2026-09-12
CVE-2026-72708 SPIP high SPIP unauthenticated blind SQL injection in the public sitemap - leaks the alea_ephemere nonce-signing secret 2026-09-12
CVE-2026-88877 Traefik critical Traefik Kubernetes Ingress NGINX provider authentication bypass - an Ingress carrying both an auth annotation and from-to-www-redirect generates a sibling host-only router that rea… 2026-09-11
CVE-2026-88007 Traefik critical Traefik HTTP/3 backend connection reuse across users - the HTTP/3 entrypoint's ConnContext never calls service.AddTransportOnContext, so a backend connection already authenticated … 2026-09-11
CVE-2026-89054 Apache HTTP Server high Reported by NewScan's named-CVE check: test_http_method_authz 2026-09-11
CVE-2026-88009 Traefik high Traefik rootless HTTP/1 request-target is routed as "/" but forwarded to the backend verbatim - Go parks a rootless target in URL.Opaque, so path-scoped routing rules, path-scoped … 2026-09-11
CVE-2026-88008 Traefik high Traefik request smuggling and incorrect authorization from inconsistent HTTP request interpretation between Traefik and the backend (CVSS 7.0) 2026-09-11
CVE-2026-88004 Traefik high Traefik entrypoint header-name sanitization bypassed via request trailers - a header Traefik strips or rewrites on the request can be reintroduced in the HTTP trailer section, whic… 2026-09-11
CVE-2026-89248 AVideo medium Reported by NewScan's exposure path probe: AVideo WebRTC plugin status endpoint answers anonymously - CVE-2026-89248 2026-09-11
CVE-2026-88879 Traefik medium Traefik canonicalizes header names on dashes only, so X-Auth-User, X_Auth_User and X.Auth.User are three headers to Traefik and ONE variable to a CGI/WSGI/PHP/NGINX backend - a cli… 2026-09-11
CVE-2026-88878 Traefik medium Traefik respondingTimeouts (readTimeout, on by default at 60s) are not applied to the HTTP/3 request path - readTimeout is a TCP connection deadline that cannot bind a QUIC stream,… 2026-09-11
CVE-2026-88012 Traefik medium Traefik respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded (CVSS 5.3) 2026-09-11
CVE-2026-88011 Traefik medium Traefik ForwardAuth identity spoofing via a dot-form header alias - the client supplies X.Authenticated.User alongside the canonical X-Authenticated-User that ForwardAuth writes, a… 2026-09-11
CVE-2026-20079 Cisco Secure Firewall Management Center critical Cisco Secure Firewall Management Center authentication bypass - a hardcoded internal session id is accepted from the network, giving an unauthenticated attacker the authenticated c… 2026-09-10
CVE-2026-19490 Citrix NetScaler ADC/Gateway critical NetScaler ADC/Gateway authentication bypass leading to account takeover (CVSS 9.3, CISA KEV) 2026-09-10
CVE-2023-6553 backup-backup critical Backup Migration unauthenticated remote code execution through attacker-controlled includes in backup-heart.php 2026-09-10
CVE-2025-25249 FortiOS SSL-VPN high FortiOS heap-based buffer overflow (CVSS 8.1, CISA KEV) - exploited in the wild by the PivotC2 FortiGate RAT 2026-09-10
CVE-2026-86218 N-able N-central critical N-able N-central pre-authentication remote code execution (CVSS 10.0, actively exploited) 2026-09-09
CVE-2026-87819 GitPython high GitPython Actor author/committer parsing regular-expression denial of service 2026-09-09
CVE-2026-86081 n8n high n8n Git node clone destination-path regular-expression denial of service 2026-09-09
CVE-2026-86543 knowns critical Reported by NewScan's unauthenticated interface: Unauthenticated knowns management API (no password set) 2026-09-08
CVE-2026-13190 Telerik UI for ASP.NET AJAX critical Telerik UI for ASP.NET AJAX unsafe type instantiation from persisted state in the persistence utilities -> remote code execution 2026-09-07
CVE-2026-13186 Telerik UI for ASP.NET AJAX critical Telerik UI for ASP.NET AJAX path traversal in the file-based persistence storage provider -> attacker-controlled deserialization and remote code execution 2026-09-07
CVE-2026-13185 Telerik UI for ASP.NET AJAX critical Telerik UI for ASP.NET AJAX deserialization of attacker-controlled cookie state in RadPersistenceManager / RadDockLayout -> unauthenticated remote code execution 2026-09-07
CVE-2026-13181 Telerik UI for ASP.NET AJAX critical Telerik UI for ASP.NET AJAX unsafe type resolution in RadAsyncUpload AsyncUploadTypeName -> remote code execution 2026-09-07
CVE-2026-13184 Telerik UI for ASP.NET AJAX high Telerik UI for ASP.NET AJAX predictable default upload-metadata integrity key when Telerik.Upload.ConfigurationHashKey and machineKey are both unset 2026-09-07
CVE-2026-13183 Telerik UI for ASP.NET AJAX high Telerik UI for ASP.NET AJAX timing oracle in RadAsyncUpload metadata processing -> recovery of protected metadata when detailed errors are suppressed 2026-09-07
CVE-2026-13182 Telerik UI for ASP.NET AJAX high Telerik UI for ASP.NET AJAX padding oracle in RadAsyncUpload client-state handling -> disclosure and forgery of protected upload metadata 2026-09-07
CVE-2026-2390 powerkit medium Powerkit (WordPress) stored cross-site scripting via the Lazy Load module's regex-based image-attribute parser 2026-09-07
CVE-2026-85595 Traefik critical Traefik digestAuth authentication bypass - an unknown username is answered with an empty secret instead of a rejection, so any username with no password authenticates (CVSS 9.3) 2026-09-04
CVE-2026-85597 Traefik high Traefik mTLS bypass - conflicting TLS options on routers sharing a hostname fall back to the default TLS config, dropping client-certificate authentication for every host in the ru… 2026-09-04
CVE-2026-85596 Traefik high Traefik Kubernetes Ingress NGINX provider mTLS bypass - Ingresses sharing a host and client CA generate distinct TLS option names, are read as a conflict, and fall back to a defaul… 2026-09-04
CVE-2026-85391 JSON Web Token high Reported by NewScan's named-CVE check: crack_jwt_secret 2026-09-04
CVE-2026-85180 Ollama high Ollama 0.30.0-0.33.2: SSRF when pulling tensor-layer models - blob downloads follow a cross-host redirect unvalidated, so a model reference the operator pulls can steer the server … 2026-09-04
CVE-2026-49869 Kestra critical Kestra authentication bypass -> unauthenticated RCE as root (CVSS 10.0, CISA KEV) 2026-09-03
CVE-2026-59822 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-09-03
CVE-2025-22871 RoadRunner critical RoadRunner request smuggling via bare-LF chunk-size line (bundled Go net/http) 2026-09-02
CVE-2026-84304 google.golang.org/grpc high gRPC-Go heap exhaustion through fragmented HTTP/2 DATA frames 2026-09-02
CVE-2026-83619 @xmldom/xmldom high xmldom quadratic end-tag parsing denial of service 2026-09-02
CVE-2026-81578 PaperCut MF/NG critical PaperCut MF/NG unauthenticated management-interface access control bypass chained to code execution (CISA KEV) 2026-09-01
CVE-2026-81891 elFinder high Covered by the elFinder batch fix for CVE-2026-81889 2026-09-01
CVE-2026-81890 elFinder high Covered by the elFinder batch fix for CVE-2026-81889 2026-09-01
CVE-2026-81889 elFinder high elFinder URL-upload SSRF filter bypass, archive-extraction MIME bypass and netmount left out of the CSRF-protected command list 2026-09-01
CVE-2026-77348 Wallos high Wallos SSRF through HTTP proxy environment variables - the incomplete fix for CVE-2026-33407 2026-09-01
CVE-2026-61641 Wallos high Covered by the Wallos batch fix for CVE-2026-61639 2026-09-01
CVE-2026-61640 Wallos high Covered by the Wallos batch fix for CVE-2026-61639 2026-09-01
CVE-2026-61639 Wallos high Wallos zip-slip on database restore, SSRF through the admin-set OIDC and SMTP endpoints, and OIDC identity linking by email 2026-09-01
CVE-2026-61638 Wallos high Covered by the Wallos batch fix for CVE-2026-61639 2026-09-01
CVE-2026-54600 Wallos high Wallos unauthenticated database import and schema migration over HTTP, plus an unchecked OIDC state nonce 2026-09-01
CVE-2026-54599 Wallos high Covered by the Wallos batch fix for CVE-2026-54600 2026-09-01
CVE-2026-54598 Wallos high Covered by the Wallos batch fix for CVE-2026-54600 2026-09-01
CVE-2026-33407 Wallos high Covered by the Wallos batch fix for CVE-2026-77348 2026-09-01
CVE-2026-82880 YaCy high YaCy Search Server XML external entity injection - the SVG, FreeMind and OpenSearch parsers resolve external entities 2026-08-31
CVE-2026-82654 SiYuan high Covered by the SiYuan batch fix for CVE-2026-82653 2026-08-31
CVE-2026-82653 SiYuan high SiYuan stored cross-site scripting - package and notebook names in confirmDialog(), and block name/alias/memo in hint, backlink and breadcrumb rendering, are interpolated into inne… 2026-08-31
CVE-2026-82456 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-30
CVE-2026-75807 miniorange-saml-20-single-sign-on high SAML Single Sign On - SSO Login (miniOrange) authentication bypass - mo_saml_login_validate() trusts an unverified assertion, so any account can be logged into 2026-08-30
CVE-2026-82476 Memos medium Memos server-side request forgery - the link-metadata fetcher omits the 100.64.0.0/10 CGNAT range from its SSRF guard 2026-08-30
CVE-2026-81766 really-simple-ssl medium Really Simple Security missing capability check on plugin installation - a subsite admin installs arbitrary plugins from a supplied URL 2026-08-30
CVE-2026-81660 groundhogg medium Groundhogg stored cross-site scripting - optional web-form fields are stored and rendered unescaped 2026-08-30
CVE-2026-76585 customer-reviews-woocommerce medium Customer Reviews for WooCommerce stored cross-site scripting - review content from one of its endpoints is neither sanitised nor escaped 2026-08-30
CVE-2026-78364 mw-wp-form low MW WP Form stored cross-site scripting - form settings are echoed unescaped in an admin dashboard page 2026-08-30
CVE-2026-82266 redpanda critical Reported by NewScan's unauthenticated interface: Unauthenticated Redpanda Admin API 2026-08-29
CVE-2026-19295 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-19294 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-19286 Langflow critical Langflow 1.0.0 - 1.11.1: remote code execution via the A2A public endpoint, plus 7 further IBM Langflow OSS advisories fixed in the same range 2026-08-29
CVE-2026-18904 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-18899 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-18891 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-18729 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-18545 Langflow critical Covered by the Langflow batch fix for CVE-2026-19286 2026-08-29
CVE-2026-82288 Stable Diffusion WebUI high Reported by NewScan's exposure path probe: Stable Diffusion WebUI leaks its own UI password - CVE-2026-82288 2026-08-29
CVE-2026-82246 Budibase critical Covered by the Budibase batch fix for CVE-2026-82244 2026-08-28
CVE-2026-82245 Budibase critical Covered by the Budibase batch fix for CVE-2026-82244 2026-08-28
CVE-2026-82244 Budibase critical Budibase before 3.41.3: remote code execution via plugin upload (CVE-2026-82244), plus datasource-query authorization bypass, builder-role escalation, cross-app resource injection,… 2026-08-28
CVE-2026-82243 Budibase critical Covered by the Budibase batch fix for CVE-2026-82244 2026-08-28
CVE-2026-82242 Budibase critical Covered by the Budibase batch fix for CVE-2026-82244 2026-08-28
CVE-2026-82240 Budibase critical Covered by the Budibase batch fix for CVE-2026-82244 2026-08-28
CVE-2026-82239 Budibase critical Covered by the Budibase batch fix for CVE-2026-82244 2026-08-28
CVE-2023-49105 ownCloud critical ownCloud before 10.13.1: WebDAV API authentication bypass reads, writes and deletes any user's files (CISA KEV) 2026-08-28
CVE-2023-49103 ownCloud critical Covered by the ownCloud batch fix for CVE-2023-49105 2026-08-28
CVE-2026-82241 Budibase high Budibase 3.33.4 before 3.41.3: the default SSRF blacklist omits the shared address space 100.64.0.0/10 2026-08-28
CVE-2026-82237 FileBrowser high Covered by the FileBrowser batch fix for CVE-2026-82235 2026-08-28
CVE-2026-82235 FileBrowser high FileBrowser through 2.63.23: a named pipe in a shared directory blocks the archive and public-download handlers, and renaming a shared file leaves its share link live - NO FIX WILL… 2026-08-28
CVE-2026-82238 FileBrowser low FileBrowser 2.24.0 through 2.63.23: concurrent TUS PATCH uploads race past the declared Upload-Length - NO FIX WILL SHIP 2026-08-28
CVE-2026-60004 Gitea critical Gitea diffpatch API remote code execution via Git hook installation (CVSS 9.8, CISA KEV) 2026-08-27
CVE-2026-8452 Citrix NetScaler ADC/Gateway high NetScaler ADC/Gateway memory-overflow denial of service when configured as a Gateway (CVSS 8.8) 2026-08-27
CVE-2021-23758 AjaxPro high Reported by NewScan's exposure path probe: AjaxPro handler exposed - .NET deserialization RCE (CVE-2021-23758) 2026-08-27
CVE-2026-79782 rclone critical rclone S3 backend leaks the X-Amz-Security-Token over plaintext HTTP on an HTTPS->HTTP redirect 2026-08-26
CVE-2026-79781 rclone medium rclone serve s3 path traversal via dot-dot object keys - read and overwrite root-level files 2026-08-26
CVE-2026-79780 rclone medium rclone before 1.75.0: credential exposure on redirect, WebDAV TUS DoS panic, and RC API stack-trace disclosure 2026-08-26
CVE-2026-79779 rclone medium Covered by the rclone batch fix for CVE-2026-79780 2026-08-26
CVE-2026-79778 rclone medium Covered by the rclone batch fix for CVE-2026-79780 2026-08-26
CVE-2026-79777 rclone medium Covered by the rclone batch fix for CVE-2026-79780 2026-08-26
CVE-2026-79776 rclone medium Covered by the rclone batch fix for CVE-2026-79780 2026-08-26
CVE-2026-78678 GitPython critical Covered by the GitPython batch fix for CVE-2026-78676 2026-08-25
CVE-2026-78677 GitPython critical Covered by the GitPython batch fix for CVE-2026-78676 2026-08-25
CVE-2026-78676 GitPython critical GitPython git-config injection reaching core.hooksPath -> code execution, plus clone and blame option-denylist gaps (the 3.1.59 fix train) 2026-08-25
CVE-2026-56706 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-56705 Adminer critical Adminer unauthenticated PDO/ODBC DSN injection from the login form -> code execution (heads a 7-CVE batch all fixed in 5.4.3) 2026-08-25
CVE-2026-56704 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-56703 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-56702 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-40877 iTop critical Covered by the iTop batch fix for CVE-2026-34741 2026-08-25
CVE-2026-39975 iTop critical Covered by the iTop batch fix for CVE-2026-34741 2026-08-25
CVE-2026-34968 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-34967 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-30864 iTop critical Covered by the iTop batch fix for CVE-2026-34741 2026-08-25
CVE-2026-21962 Oracle WebLogic Server critical WebLogic Server Proxy Plug-in for Apache HTTP Server: unauthenticated remote access to critical data (CVSS 10.0, exploited in the wild) 2026-08-25
CVE-2026-16434 Adminer critical Covered by the Adminer batch fix for CVE-2026-56705 2026-08-25
CVE-2026-34964 Adminer medium Adminer SSRF and open redirect via the login-form server field and X-Forwarded-Prefix (the 5.5.0 fix train) 2026-08-25
CVE-2026-34959 Adminer medium Covered by the Adminer batch fix for CVE-2026-34964 2026-08-25
CVE-2026-78207 exceljs-hardened critical exceljs-hardened prototype pollution and unbounded XLSX decompression 2026-08-24
CVE-2026-78206 exceljs-hardened critical Covered by the exceljs-hardened batch fix for CVE-2026-78207 2026-08-24
CVE-2026-8445 justhtml critical justhtml Markdown text-node escaping cross-site scripting 2026-08-23
CVE-2026-7808 justhtml critical justhtml HTML sanitization bypass permits dangerous active content 2026-08-23
CVE-2026-76217 GitPython critical Covered by the GitPython batch fix for CVE-2026-78676 2026-08-23
CVE-2026-73080 SeaweedFS critical SeaweedFS unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle 2026-08-23
CVE-2026-5388 justhtml critical justhtml URL sanitization and HTML serialization bypasses 2026-08-23
CVE-2026-73624 GitPython high Covered by the GitPython batch fix for CVE-2026-73620 2026-08-23
CVE-2026-73620 GitPython high GitPython argument injection via unguarded git option forwarding (IndexFile.checkout / TagReference.create) 2026-08-23
CVE-2026-73619 GitPython high Covered by the GitPython batch fix for CVE-2026-73620 2026-08-23
CVE-2026-73246 kestra high Reported by NewScan's unauthenticated interface: Unauthenticated Kestra /worker endpoint exposes live task state and configuration 2026-08-23
CVE-2026-71324 Traefik high Traefik cross-user response poisoning via proxied CONNECT (HTTP/2/3 CONNECT smuggled into the backend keep-alive pool) 2026-08-23
CVE-2026-4671 justhtml high justhtml CSS selector and linkification denial of service 2026-08-23
CVE-2026-19351 sql-query high node-sql-query SelectQuery SQL injection (Select.js from/build parameter manipulation) 2026-08-23
CVE-2026-17601 Nexus Repository high Nexus Repository 3 wildcard-privilege self-escalation to administrator 2026-08-23
CVE-2026-73245 kestra medium Reported by NewScan's unauthenticated interface: Unauthenticated Kestra management endpoint (Micronaut actuator) 2026-08-23
CVE-2026-77806 SPIP critical SPIP unauthenticated remote code execution via an X-Spip-Filtre request header (exploited in the wild) 2026-08-22
CVE-2026-73570 Zimbra Collaboration critical Zimbra Collaboration SNMP notification command injection -> remote code execution (CVSS 8.9, CISA KEV) 2026-08-22
CVE-2026-34949 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-34948 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-34836 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-34741 iTop critical Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE batch all fixed in 3.2.3) 2026-08-22
CVE-2026-33240 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-33047 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-31936 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-31880 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-31803 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-30890 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-30866 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-30865 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-30826 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-30819 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-27490 iTop critical Reported by NewScan's component version range: Combodo iTop authentication bypass lets an unauthenticated attacker execute arbitrary PHP files from env-production (heads a 19-CVE b… 2026-08-22
CVE-2026-27463 iTop critical Covered by the iTop batch fix for CVE-2026-34741 2026-08-22
CVE-2026-48050 Go pprof high Reported by NewScan's exposure path probe: Exposed Go pprof debug endpoints 2026-08-22
CVE-2026-77647 SPIP critical SPIP unauthenticated remote code execution via incorrect identification of PHP open tags (exploited in the wild) 2026-08-21
CVE-2026-72530 TrueConf Server critical Pre-auth server-side template injection over TrueConf's client port 4307/TCP -> code execution on the conferencing server (CVSS 9.5) 2026-08-21
CVE-2026-72529 TrueConf Server critical Pre-auth account takeover over TrueConf's client port 4307/TCP -> arbitrary command execution as a server account (CVSS 9.3) 2026-08-21
CVE-2026-67448 Mailpit high Mailpit origin middleware checks the raw RequestURI for the /api/ prefix, so a re-spelled path reaches the whole mailbox API without the browser-origin gate 2026-08-21
CVE-2026-67447 Mailpit high Covered by the Mailpit batch fix for CVE-2026-67448 2026-08-21
CVE-2026-67446 Mailpit high Covered by the Mailpit batch fix for CVE-2026-67448 2026-08-21
CVE-2026-67445 Mailpit high Covered by the Mailpit batch fix for CVE-2026-67448 2026-08-21
CVE-2026-77082 n8n critical Covered by the n8n batch fix for CVE-2026-77068 2026-08-20
CVE-2026-77080 n8n critical Covered by the n8n batch fix for CVE-2026-77068 2026-08-20
CVE-2026-77075 n8n critical Covered by the n8n batch fix for CVE-2026-77068 2026-08-20
CVE-2026-77072 n8n critical Covered by the n8n batch fix for CVE-2026-77068 2026-08-20
CVE-2026-77068 n8n critical n8n 1.x August 2026 batch: node-schema loader path traversal -> RCE, Snowflake node arbitrary file read/write, resource-locator expression injection, Form-node stored XSS and Filte… 2026-08-20
CVE-2026-55089 Etherpad critical Etherpad OAuth authorization_code path authorizes /api/2/* requests without a valid API key 2026-08-20
CVE-2026-32475 elementor-pro critical Elementor Pro unauthenticated arbitrary file upload -> RCE via the Forms widget file-upload field 2026-08-20
CVE-2026-55085 Etherpad high Etherpad stored XSS via a numbered-list start attribute interpolated into unquoted HTML 2026-08-20
CVE-2026-59310 VMware vCenter Server critical vCenter Syslog server directory traversal -> arbitrary code execution (CVSS 9.8) 2026-08-19
CVE-2026-55040 Microsoft SharePoint Server critical SharePoint Server JWT authentication bypass - an unsigned (alg:none) Bearer token authenticates an anonymous caller on /_api/* (CVSS 9.1) 2026-08-19
CVE-2025-55315 Kestrel critical Kestrel HTTP request smuggling security-feature bypass 2026-08-19
CVE-2024-35264 Kestrel critical Kestrel HTTP/3 data corruption remote code execution 2026-08-19
CVE-2023-44487 Kestrel high Kestrel HTTP/2 Rapid Reset denial of service 2026-08-19
CVE-2023-38180 Kestrel high Kestrel fails to disconnect some malicious clients, enabling denial of service 2026-08-19
CVE-2026-64849 MLflow critical MLflow webhook-test SSRF via redirect re-validation bypass 2026-08-18
CVE-2025-62593 Ray critical Ray Jobs API driven from a victim browser (User-Agent-gated dashboard, KEV) 2026-08-18
CVE-2026-68520 Glances high Reported by NewScan's exposure path probe: Glances config API leaking export credentials 2026-08-18
CVE-2026-74842 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-17
CVE-2026-74799 Go pprof high Reported by NewScan's exposure path probe: Exposed Go pprof debug endpoints 2026-08-17
CVE-2026-19984 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-17
CVE-2026-19964 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-17
CVE-2026-19958 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-17
CVE-2026-19957 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-17
CVE-2026-19956 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-17
CVE-2026-14832 shopsmart-loyalty-for-woocommerce high ShopSmart Loyalty for WooCommerce unauthenticated customer-record disclosure - shopsmart_check_phone returns a loyalty profile to anyone who supplies a phone number, with no owners… 2026-08-17
CVE-2026-13700 wooms high WooMS unauthenticated SSRF in the data-sync feature - the plugin attaches its stored third-party integration credentials to a request aimed at an attacker-supplied URL, so the cred… 2026-08-17
CVE-2026-19474 @fastify/multipart high @fastify/multipart 3.0.0-10.1.0: aborted multipart uploads leak temporary files (and, from 5.3.0, hang the request handler), letting an unauthenticated client exhaust disk 2026-08-16
CVE-2026-18549 @fastify/multipart high Covered by the @fastify/multipart batch fix for CVE-2026-19474 2026-08-16
CVE-2026-18500 @fastify/jwt high @fastify/jwt before 10.2.2: a per-request verification key is silently overridden by the global secret, so a token signed with the global secret passes a check that demanded a diff… 2026-08-16
CVE-2026-19898 vmauth medium vmauth authentication-endpoint brute force (requestHandler) 2026-08-16
CVE-2026-18165 @fastify/oauth2 medium @fastify/oauth2 7.2.0-8.2.0: OAuth state and PKCE verifier live in unprefixed cookies, so anyone who can write a cookie on a related host can log a victim into the ATTACKER's accou… 2026-08-16
CVE-2026-50027 mcp-memory-service critical Reported by NewScan's unauthenticated interface: Unauthenticated mcp-memory-service document/memory API 2026-08-15
CVE-2026-49989 CrateDB high CrateDB blob HTTP handler authorization bypass - any authenticated user reads, deletes or plants blobs by SHA-1 digest 2026-08-15
CVE-2026-73302 Budibase critical Budibase before 3.39.30: OIDC login accepts an unverified email, allowing account takeover by email collision 2026-08-14
CVE-2026-72857 Budibase critical Covered by the Budibase batch fix for CVE-2026-72851 2026-08-14
CVE-2026-72856 Budibase critical Covered by the Budibase batch fix for CVE-2026-72851 2026-08-14
CVE-2026-72855 Budibase critical Covered by the Budibase batch fix for CVE-2026-72851 2026-08-14
CVE-2026-72853 Budibase critical Covered by the Budibase batch fix for CVE-2026-72851 2026-08-14
CVE-2026-72851 Budibase critical Budibase before 3.40.0: unauthenticated SQL injection via webhook automations (CVE-2026-72851), plus arbitrary file write, tenant-owner auth bypass, Oracle-connector SQLi, SSRF, cr… 2026-08-14
CVE-2026-72850 Budibase critical Covered by the Budibase batch fix for CVE-2026-72851 2026-08-14
CVE-2026-72849 Budibase critical Covered by the Budibase batch fix for CVE-2026-72851 2026-08-14
CVE-2026-72836 FileBrowser critical FileBrowser before 2.63.19: self-registration home-directory takeover on case-insensitive filesystems 2026-08-14
CVE-2026-73500 etcd high etcd 3.5.x before 3.5.33: remote denial of service on the TLS listener (CVE-2026-73500), plus CVE-2026-73499 2026-08-14
CVE-2026-73499 etcd high Covered by the etcd batch fix for CVE-2026-73500 2026-08-14
CVE-2026-73408 Budibase high Budibase before 3.39.18: MySQL connector enables multipleStatements and interpolates an unescaped table name into DESCRIBE 2026-08-14
CVE-2026-73305 Budibase high Budibase before 3.39.24: POST /api/public/v1/roles/assign skips the app-scope check, allowing cross-app privilege escalation 2026-08-14
CVE-2026-72859 Budibase high Budibase 3.39.4 before 3.40.0: authorization regression hands BASIC users S3 PutObject presigned URLs 2026-08-14
CVE-2026-73604 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73603 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73602 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73601 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73488 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73487 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73486 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73485 Flowise critical Covered by the Flowise batch fix for CVE-2026-73483 2026-08-13
CVE-2026-73483 Flowise critical Flowise before 3.1.4: sandbox escapes and agent-node code injection - remote code execution on the Flowise host, unauthenticated in two of them 2026-08-13
CVE-2026-72794 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-13
CVE-2026-72793 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-13
CVE-2026-47717 FUXA high Reported by NewScan's unauthenticated interface: Unauthenticated FUXA SCADA/HMI project 2026-08-13
CVE-2026-73211 PeerTube critical PeerTube unauthenticated SQL injection from a federated peer, plus cross-origin video takeover 2026-08-12
CVE-2026-73090 PeerTube critical PeerTube cross-origin video takeover via a federated Update activity 2026-08-12
CVE-2026-20349 Cisco ASA/FTD WebVPN high Cisco ASA/FTD Remote Access SSL VPN unauthenticated reload - a single crafted HTTP request takes the VPN down (CVSS 8.6, KEV 2026-08-12) 2026-08-12
CVE-2026-72899 Metabase critical Covered by the Metabase batch fix for CVE-2026-72898 2026-08-11
CVE-2026-72898 Metabase critical Metabase unauthenticated SQL injection to administrator (/api/session/reset_password, and public-link field filters) 2026-08-11
CVE-2023-38646 Metabase critical Metabase pre-authentication remote code execution via a public setup token 2026-08-11
CVE-2026-69086 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-10
CVE-2026-69083 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-10
CVE-2026-68586 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-10
CVE-2026-68585 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-10
CVE-2026-68584 SiYuan critical Reported by NewScan's unauthenticated interface: Unauthenticated SiYuan kernel API 2026-08-10
CVE-2026-21858 n8n critical n8n Form Webhook Content-Type confusion allows unauthenticated arbitrary file read ("Ni8mare") 2026-08-10
CVE-2025-68613 n8n critical n8n expression sandbox escape allows authenticated remote code execution 2026-08-10
CVE-2019-9193 PostgreSQL high Covered by the PostgreSQL batch fix for CVE-2018-1058 2026-08-10
CVE-2018-1058 PostgreSQL high PostgreSQL search_path privilege escalation: an unprivileged user can create objects that a superuser then executes 2026-08-10
CVE-2026-12971 learnpress medium LearnPress SSRF: the instructor-role AI image-import feature fetches an arbitrary attacker-supplied URL server-side 2026-08-10
CVE-2026-67620 REST APIs high Reported by NewScan's named-CVE check: test_ssrf 2026-08-09
CVE-2026-10595 Web apps high Reported by NewScan's named-CVE check: test_url_path_traversal 2026-08-09
CVE-2026-8037 Progress Kemp LoadMaster critical Pre-auth OS command injection in the LoadMaster API (/accessv2) -> arbitrary command execution on the appliance (CVSS 9.6) 2026-08-08
CVE-2026-61808 lightrag critical Reported by NewScan's unauthenticated interface: Unauthenticated LightRAG API server (authentication disabled) 2026-08-08
CVE-2026-64638 WordPress high XSS2Shell: WordPress core pre-auth reflected XSS on wp-login.php via a strip_tags()/KSES parser differential 2026-08-08
CVE-2026-14812 Premium-SEO critical Premium-SEO is a malicious WordPress plugin, not a compromised one: every build ships an unauthenticated backdoor that creates a hidden administrator account (login prefix resource… 2026-08-07
CVE-2026-11976 google-analytics-premium critical MonsterInsights Pro 10.2.0 shipped from a compromised update bucket: backdoored class-system-check.php hijacks the MonsterInsights/ExactMetrics update channel to an attacker server… 2026-08-07
CVE-2026-9205 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-9196 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-9130 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-9081 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-8478 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-8470 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-8446 Langflow critical Covered by the Langflow batch fix for CVE-2026-8182 2026-08-06
CVE-2026-8183 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-8182 Langflow critical Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixed in the same range 2026-08-06
CVE-2026-7869 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-7658 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-7657 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-7646 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-68746 livebook critical Reported by NewScan's unauthenticated interface: Unauthenticated Livebook notebook server 2026-08-06
CVE-2026-56164 Microsoft SharePoint Server critical SharePoint Server on-premises remote code execution - actively exploited July 2026, chained for IIS machine-key theft 2026-08-06
CVE-2026-45659 Microsoft SharePoint Server critical SharePoint Server on-premises remote code execution - actively exploited July 2026 2026-08-06
CVE-2026-41940 cPanel / WHM critical cPanel / WHM authentication bypass - unauthenticated administrative control of the hosting server, all supported versions 2026-08-06
CVE-2026-35616 FortiClient EMS critical FortiClient EMS improper access control - unauthenticated code/command execution via crafted requests 2026-08-06
CVE-2026-32201 Microsoft SharePoint Server critical SharePoint Server spoofing via improper input validation - a manipulated Referer plus a malformed query string bypasses the front-end authorization check 2026-08-06
CVE-2026-21643 FortiClient EMS critical FortiClient EMS 7.4.4 pre-authentication SQL injection in the management server 2026-08-06
CVE-2026-18577 N-able N-central critical N-able N-central authentication bypass - unauthenticated administrative control of the RMM server, and therefore of every endpoint it manages 2026-08-06
CVE-2026-17633 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-17632 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-17630 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-17625 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-17624 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-17623 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-16232 Check Point Security Gateway critical Check Point SmartConsole/management authentication bypass - exploited in the wild 2026-08-06
CVE-2026-10547 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2026-10128 Langflow critical Reported by NewScan's component version range: Langflow 1.0.0 - 1.10.3: unauthenticated remote code execution in two HTTP requests, plus 20 further IBM Langflow OSS advisories fixe… 2026-08-06
CVE-2025-64446 FortiWeb critical FortiWeb path traversal + authentication bypass - crafted HTTP(S) runs administrative commands and creates admin accounts on the WAF itself 2026-08-06
CVE-2025-61882 Oracle E-Business Suite critical Oracle E-Business Suite pre-auth RCE in the internet-facing web tier - the Cl0p mass-extortion campaign (CVSS 9.8) 2026-08-06
CVE-2025-59287 Microsoft WSUS critical Windows Server Update Services unauthenticated deserialization -> RCE as SYSTEM (CVSS 9.8) 2026-08-06
CVE-2025-5777 Citrix NetScaler ADC/Gateway critical CitrixBleed 2: out-of-bounds memory disclosure on the login endpoint leaks session tokens, replayed to hijack sessions and bypass MFA (CVSS 9.3) 2026-08-06
CVE-2025-49844 Redis critical RediShell: Lua use-after-free reachable from a crafted EVAL script -> remote code execution (CVSS 10.0) 2026-08-06
CVE-2025-20333 Cisco ASA/FTD WebVPN critical Cisco ASA/FTD VPN web server buffer overflow - unauthenticated root RCE (ArcaneDoor-class; CISA ED 25-03) 2026-08-06
CVE-2025-10035 GoAnywhere MFT critical GoAnywhere MFT License Servlet deserialization -> command injection, unauthenticated with a forged license-response signature (CVSS 10.0) 2026-08-06
CVE-2026-49331 HTTP high Reported by NewScan's named-CVE check: test_header_trust 2026-08-06
CVE-2026-42586 Redis high Reported by NewScan's named-CVE check: test_redis_injection 2026-08-06
CVE-2026-25589 RedisBloom high Invalid memory access in RESTORE when used with the RedisBloom module -> potential remote code execution 2026-08-06
CVE-2026-25588 RedisTimeSeries high Invalid memory access in RESTORE when used with the RedisTimeSeries module -> potential remote code execution 2026-08-06
CVE-2026-25243 Redis high Invalid memory access in the RESTORE command from a crafted serialized payload -> remote code execution 2026-08-06
CVE-2026-23479 Redis high Use-after-free in the unblock-client flow -> remote code execution 2026-08-06
CVE-2026-0257 PaloAlto GlobalProtect high PAN-OS GlobalProtect authentication bypass - an attacker establishes VPN connections without valid credentials 2026-08-06
CVE-2025-32023 Redis high Hyperloglog out-of-bounds write from a crafted hyperloglog value -> remote code execution 2026-08-06
CVE-2025-20362 Cisco ASA/FTD WebVPN high Cisco ASA/FTD WebVPN unauthorized access to restricted URL endpoints - chained with CVE-2025-20333 for pre-auth RCE 2026-08-06
CVE-2024-55656 RedisBloom high RedisBloom integer overflow via CMS.INITBYDIM with large WIDTH/DEPTH -> heap overflow, potential remote code execution 2026-08-06
CVE-2024-51737 RediSearch high RediSearch integer overflow via crafted FT.SEARCH/FT.AGGREGATE LIMIT or KNN arguments -> heap overflow, potential remote code execution 2026-08-06
CVE-2024-51480 RedisTimeSeries high RedisTimeSeries integer overflow via crafted TS.QUERYINDEX/TS.MGET/TS.MRANGE/TS.MREVRANGE arguments -> heap overflow, potential remote code execution 2026-08-06
CVE-2024-46981 Redis high Lua use-after-free (garbage-collector manipulation) -> remote code execution 2026-08-06
CVE-2024-31449 Redis high Lua library stack overflow via a crafted EVAL script -> remote code execution as the Redis process 2026-08-06
CVE-2026-23631 Redis medium Lua use-after-free via master-replica synchronization -> remote code execution 2026-08-06
CVE-2026-70494 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70493 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70492 Open WebUI high Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in the web loader and vega renderer, cross-tenant re… 2026-08-05
CVE-2026-70491 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70490 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70489 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70488 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70487 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70486 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70485 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70484 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70483 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70482 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70481 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70480 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-70479 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-54020 Open WebUI high Reported by NewScan's component version range: Open WebUI before 0.11.0: 17-CVE batch - stored XSS in the Katex/markdown renderer, OAuth token-exchange account takeover, SSRF in th… 2026-08-05
CVE-2026-67200 Rocket.Chat critical Reported by NewScan's exposure path probe: Unauthenticated path traversal - arbitrary file read 2026-08-04
CVE-2026-56845 Rocket.Chat critical Reported by NewScan's exposure path probe: Unauthenticated path traversal - arbitrary file read 2026-08-04
CVE-2021-43798 Rocket.Chat critical Reported by NewScan's exposure path probe: Unauthenticated path traversal - arbitrary file read 2026-08-04
CVE-2026-69243 aiohttp medium aiohttp HTTP parser request smuggling (WebSocket upgrade handling) 2026-08-04
CVE-2026-8763 Bouncy Castle critical Bouncy Castle for Java certificate/signature verification bypasses (X.509 name-constraint bypass, CMS zero-signer accept, RSA PKCS#1 hash truncation) plus unbounded-KDF DoS 2026-08-03
CVE-2026-59648 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-59647 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-59640 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-59639 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-58063 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-15055 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-13586 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-12860 Bouncy Castle critical Covered by the Bouncy Castle batch fix for CVE-2026-8763 2026-08-03
CVE-2026-59652 Bouncy Castle LTS high Covered by the Bouncy Castle LTS batch fix for CVE-2026-71883 2026-08-03
CVE-2026-59643 Bouncy Castle LTS high Covered by the Bouncy Castle LTS batch fix for CVE-2026-71883 2026-08-03
CVE-2024-45519 Zimbra Collaboration critical Zimbra postjournal service command injection - unauthenticated RCE via crafted SMTP message 2026-08-02
CVE-2024-40766 SonicWall SMA/SSL-VPN critical SonicOS management access-control flaw - unauthorized resource access / firewall crash 2026-08-02
CVE-2024-4040 CrushFTP critical CrushFTP VFS sandbox escape via server-side template injection - unauthenticated file read / RCE 2026-08-02
CVE-2024-38475 Apache httpd critical Apache mod_rewrite improper substitution escaping - source disclosure and code execution via crafted URLs 2026-08-02
CVE-2024-36401 GeoServer critical GeoServer unauthenticated RCE - OGC request property names evaluated as XPath expressions 2026-08-02
CVE-2024-23897 Jenkins critical Jenkins CLI arbitrary file read via expandAtFiles - reads secrets, then full takeover 2026-08-02
CVE-2024-1709 ConnectWise ScreenConnect critical ScreenConnect SetupWizard authentication bypass - create an administrator, then RCE 2026-08-02
CVE-2023-50164 Apache Struts critical Struts file-upload path traversal -> upload a webshell (RCE) 2026-08-02
CVE-2023-35078 Ivanti EPMM / MobileIron Core critical Ivanti EPMM unauthenticated API access - read/modify enrolled-device and user data 2026-08-02
CVE-2023-29300 Adobe ColdFusion critical ColdFusion WDDX deserialization - unauthenticated remote code execution 2026-08-02
CVE-2023-26360 Adobe ColdFusion critical ColdFusion improper access control / deserialization - unauthenticated arbitrary file read and RCE 2026-08-02
CVE-2023-25690 Apache httpd critical Apache mod_proxy HTTP request smuggling via a RewriteRule/ProxyPassMatch substitution 2026-08-02
CVE-2023-22518 Atlassian Confluence critical Confluence improper authorization - unauthenticated restore/takeover of the instance 2026-08-02
CVE-2023-22515 Atlassian Confluence critical Confluence broken access control - unauthenticated administrator account creation 2026-08-02
CVE-2023-20198 Cisco IOS XE Web UI critical IOS XE web UI privilege escalation - unauthenticated admin account creation (mass implant campaign) 2026-08-02
CVE-2022-37042 Zimbra Collaboration critical Covered by the Zimbra Collaboration batch fix for CVE-2022-27925 2026-08-02
CVE-2022-28346 Django critical Django SQL injection via crafted dictionary expansion in QuerySet.annotate()/aggregate() 2026-08-02
CVE-2022-27925 Zimbra Collaboration critical Zimbra mboximport archive extraction path traversal -> RCE (chained with CVE-2022-37042 auth bypass) 2026-08-02
CVE-2022-26134 Atlassian Confluence critical Confluence OGNL injection - unauthenticated remote code execution 2026-08-02
CVE-2022-1040 Sophos Firewall critical Sophos Firewall User Portal/Webadmin authentication bypass -> RCE 2026-08-02
CVE-2021-45046 Log4j critical Log4j Thread Context lookup bypass of the 2.15.0 fix - RCE in some configurations 2026-08-02
CVE-2021-41773 Apache httpd critical Apache path traversal outside the document root (cgi-bin -> RCE) 2026-08-02
CVE-2021-40539 ManageEngine ADSelfService Plus critical ADSelfService Plus REST API authentication bypass -> remote code execution 2026-08-02
CVE-2021-22005 VMware vCenter Server critical vCenter Analytics service arbitrary file upload -> RCE 2026-08-02
CVE-2021-21972 VMware vCenter Server critical vCenter vRealize Operations plugin unauthenticated file upload -> RCE 2026-08-02
CVE-2021-20016 SonicWall SMA/SSL-VPN critical SonicWall SMA100 SQL injection - unauthenticated credential/session access 2026-08-02
CVE-2020-14882 Oracle WebLogic Server critical WebLogic administration console path-traversal authentication bypass -> RCE 2026-08-02
CVE-2020-12271 Sophos Firewall critical Sophos XG SQL injection -> remote code execution (Asnarok) 2026-08-02
CVE-2019-7609 Kibana critical Kibana Timelion prototype pollution -> arbitrary code execution as the Kibana process 2026-08-02
CVE-2019-6340 Drupal critical Drupal RESTful Web Services unsafe deserialization -> remote code execution 2026-08-02
CVE-2018-7600 Drupal critical Drupalgeddon2 - unauthenticated remote code execution via Form API render arrays 2026-08-02
CVE-2018-12613 phpMyAdmin critical phpMyAdmin file inclusion via the index.php target parameter -> code execution 2026-08-02
CVE-2017-5638 Apache Struts critical Struts Jakarta multipart parser OGNL injection - unauthenticated RCE via the Content-Type header (Equifax) 2026-08-02
CVE-2017-10271 Oracle WebLogic Server critical WebLogic WLS-WSAT XML deserialization - unauthenticated RCE 2026-08-02
CVE-2014-0160 OpenSSL critical Heartbleed - TLS heartbeat over-read leaks up to 64KB of process memory (keys, sessions, credentials) 2026-08-02
CVE-2026-68578 Model Context Protocol high Reported by NewScan's named-CVE check: scan_mcp 2026-08-02
CVE-2024-38816 Spring Framework high Spring path traversal - functional web resource handlers serve files outside the configured location 2026-08-02
CVE-2024-29041 Express high Express open redirect - res.location()/res.redirect() accept a malformed URL that browsers follow off-site 2026-08-02
CVE-2024-24919 Check Point Security Gateway high Check Point Remote Access VPN arbitrary file read (password hashes, certificates) 2026-08-02
CVE-2024-1708 ConnectWise ScreenConnect high ScreenConnect path traversal - write outside the extension sandbox 2026-08-02
CVE-2024-1135 Gunicorn high Gunicorn HTTP request smuggling - improper Transfer-Encoding validation desyncs it from the front-end proxy 2026-08-02
CVE-2023-38408 OpenSSH high OpenSSH ssh-agent PKCS#11 provider remote code execution (agent forwarding to a hostile host) 2026-08-02
CVE-2023-35081 Ivanti EPMM / MobileIron Core high Ivanti EPMM administrator path traversal - arbitrary file write (chained with CVE-2023-35078) 2026-08-02
CVE-2023-30861 Flask high Flask session cookie can be cached by a proxy and served to another client (session disclosure) 2026-08-02
CVE-2023-23752 Joomla high Joomla improper access check on the web-service endpoints - unauthenticated config/credential disclosure 2026-08-02
CVE-2023-20273 Cisco IOS XE Web UI high IOS XE web UI command injection - root after the CVE-2023-20198 account creation 2026-08-02
CVE-2022-3602 OpenSSL high OpenSSL X.509 email-address punycode buffer overflow (4-byte stack overwrite) 2026-08-02
CVE-2022-24999 Express high qs prototype pollution via bracketed query keys -> denial of service 2026-08-02
CVE-2021-35042 Django high Django SQL injection through QuerySet.order_by() with an unvalidated column name 2026-08-02
CVE-2024-37032 ollama medium Reported by NewScan's unauthenticated interface: Unauthenticated Ollama model API 2026-08-02
CVE-2021-44832 Log4j medium Log4j JDBC Appender remote code execution when an attacker controls the logging configuration 2026-08-02
CVE-2016-2107 OpenSSL medium OpenSSL AES-NI CBC MAC-check padding oracle (Lucky-13 variant) - plaintext recovery 2026-08-02
CVE-2026-68771 comfyui critical Reported by NewScan's unauthenticated interface: Unauthenticated ComfyUI interface 2026-08-01
CVE-2026-3141 formgent critical FormGent unauthenticated arbitrary file deletion via REST API (wp-config.php -> site takeover) 2026-08-01
CVE-2026-14919 shopmonitor critical ShopMonitor.io authentication bypass via email redirection -> unauthenticated administrator account takeover 2026-08-01
CVE-2026-6540 HTTP routing high Reported by NewScan's named-CVE check: test_path_acl_bypass 2026-08-01
CVE-2026-53501 Thumbor high Reported by NewScan's named-CVE check: test_media_proxy_ssrf 2026-08-01
CVE-2026-53500 Thumbor high Reported by NewScan's named-CVE check: test_media_proxy_ssrf 2026-08-01
CVE-2026-17566 pgadmin high Reported by NewScan's unauthenticated interface: Unauthenticated pgAdmin interface reachable 2026-08-01
CVE-2026-17349 pgadmin high Reported by NewScan's unauthenticated interface: Unauthenticated pgAdmin interface reachable 2026-08-01
CVE-2026-17347 pgadmin high Reported by NewScan's unauthenticated interface: Unauthenticated pgAdmin interface reachable 2026-08-01
CVE-2026-16144 kali-forms high Kali Forms remote code execution via improper code-generation control 2026-08-01
CVE-2026-15988 ai-engine high AI Engine cross-site request forgery -> actions as an authenticated user 2026-08-01
CVE-2026-15450 nex-forms high NEX-Forms authenticated path traversal -> arbitrary file deletion 2026-08-01
CVE-2026-15414 subscriptions-for-woocommerce high Subscriptions for WooCommerce authenticated privilege escalation 2026-08-01
CVE-2026-15258 webappick-product-feed-for-woocommerce high Product Feed Manager for WooCommerce authenticated SQL injection 2026-08-01
CVE-2026-13609 acf-frontend-form-element high Frontend Admin unauthenticated stored cross-site scripting 2026-08-01
CVE-2026-12721 kirki high Kirki Customizer Framework SQL injection 2026-08-01
CVE-2026-12695 miniorange-2-factor-authentication high miniOrange 2FA authentication bypass (unauthenticated MFA circumvention) 2026-08-01
CVE-2026-12251 ultimate-member high Ultimate Member improper privilege management -> unauthorized access / permission elevation 2026-08-01
CVE-2021-3129 Laravel Ignition critical Reported by NewScan's exposure path probe: Exposed Laravel Ignition debug handler 2026-07-31
CVE-2026-44578 Next.js high Next.js May 2026 coordinated security release (13 advisories): SSRF via the middleware/proxy request path, plus middleware and proxy bypass CVE-2026-44573, cache poisoning on middl… 2026-07-30
CVE-2026-44577 Next.js high Covered by the Next.js batch fix for CVE-2026-44578 2026-07-30
CVE-2026-44573 Next.js high Covered by the Next.js batch fix for CVE-2026-44578 2026-07-30
CVE-2026-44572 Next.js high Covered by the Next.js batch fix for CVE-2026-44578 2026-07-30
CVE-2022-31129 moment high moment regular-expression denial of service parsing a long attacker-supplied date string 2026-07-30
CVE-2021-23337 lodash high lodash command injection via _.template's variable option 2026-07-30
CVE-2020-8203 lodash high lodash prototype pollution in zipObjectDeep/set/setWith 2026-07-30
CVE-2024-21490 Angular medium AngularJS regular-expression denial of service via ng-srcset with untrusted input 2026-07-30
CVE-2023-45857 axios medium axios leaks the XSRF-TOKEN cookie value to a third-party host in the Authorization-style header 2026-07-30
CVE-2019-11358 jQuery medium jQuery prototype pollution via $.extend(true, {}, attackerJSON) 2026-07-30
CVE-2018-14042 Bootstrap medium Bootstrap XSS in data-container of the tooltip/popover plugin 2026-07-30
CVE-2026-18072 advanced-responsive-video-embedder critical ARVE hardcoded-backdoor authentication bypass -> admin takeover (malicious release) 2026-07-29
CVE-2026-14512 IBM WebSphere Application Server critical WebSphere pre-authentication unsafe deserialization -> auth bypass / RCE 2026-07-29
CVE-2026-14446 IBM WebSphere Application Server critical WebSphere admin-console broken access control -> privilege escalation 2026-07-29
CVE-2026-13423 streamit critical Streamit theme unauthenticated AJAX arbitrary-function call -> privilege escalation / RCE 2026-07-29
CVE-2026-16498 Model Context Protocol high Reported by NewScan's named-CVE check: test_mcp_session_isolation 2026-07-29
CVE-2026-16723 Fastjson high Reported by NewScan's named-CVE check: test_fastjson_rce 2026-07-27
CVE-2025-3248 Langflow critical Langflow before 1.3.0: unauthenticated remote code execution via POST /api/v1/validate/code 2026-07-23
CVE-2026-0770 Langflow high Reported by NewScan's named-CVE check: test_langflow_rce 2026-07-23
CVE-2026-42533 nginx critical nginx script-engine capture/map heap overflow (DoS; RCE where ASLR bypassable) 2026-07-21
CVE-2025-55752 Apache Tomcat critical Tomcat rewrite dir-traversal -> RCE 2026-07-21
CVE-2025-29927 Next.js critical Next.js middleware authorization bypass - the internal x-middleware-subrequest header skips middleware entirely 2026-07-21
CVE-2024-34351 Next.js high Next.js Server Actions SSRF - a crafted Host header makes the server fetch an attacker-chosen origin 2026-07-21
CVE-2026-63030 WordPress critical WP2Shell: REST API batch-route confusion -> SQLi (CVE-2026-60137) -> unauthenticated RCE 2026-07-19
CVE-2026-60137 WordPress critical Covered by the WordPress batch fix for CVE-2026-63030 2026-07-19
CVE-2021-44228 Log4j critical Log4Shell - JNDI lookup in a logged string gives unauthenticated remote code execution 2026-07-17
CVE-2022-42889 Apache Commons Text high Reported by NewScan's named-CVE check: test_text4shell 2026-07-17
CVE-2024-3400 PaloAlto GlobalProtect critical PAN-OS GlobalProtect command injection -> pre-auth RCE 2026-07-13
CVE-2024-21887 Ivanti Connect Secure critical Ivanti Connect Secure command injection (chained -> pre-auth RCE) 2026-07-13
CVE-2024-21762 FortiOS SSL-VPN critical FortiOS SSL-VPN out-of-bounds write -> pre-auth RCE 2026-07-13
CVE-2023-4966 Citrix NetScaler ADC/Gateway critical Citrix Bleed: sensitive session-token disclosure 2026-07-13
CVE-2023-46747 F5 BIG-IP critical F5 BIG-IP Traffic Management UI auth bypass -> RCE 2026-07-13
CVE-2023-35708 MOVEit Transfer critical MOVEit Transfer SQL injection -> privilege escalation 2026-07-13
CVE-2023-35036 MOVEit Transfer critical MOVEit Transfer SQL injection (follow-up) 2026-07-13
CVE-2023-34362 MOVEit Transfer critical MOVEit Transfer SQL injection -> RCE (Cl0p mass-exploitation) 2026-07-13
CVE-2023-0669 GoAnywhere MFT critical GoAnywhere MFT deserialization -> RCE (Cl0p) 2026-07-13
CVE-2022-1388 F5 BIG-IP critical F5 BIG-IP iControl REST authentication bypass -> RCE 2026-07-13
CVE-2021-34473 Microsoft Exchange OWA critical ProxyShell: pre-auth RCE 2026-07-13
CVE-2021-26855 Microsoft Exchange OWA critical ProxyLogon: pre-auth SSRF 2026-07-13
CVE-2023-46805 Ivanti Connect Secure high Ivanti Connect Secure authentication bypass 2026-07-13
CVE-2025-14847 MongoDB high MongoBleed: unauthenticated zlib-decompression heap memory disclosure 2026-07-11
CVE-2020-25213 wp-file-manager critical WP File Manager unauthenticated arbitrary file upload -> RCE 2026-07-07
CVE-2017-1001000 WordPress critical WordPress REST API unauthenticated content injection / privilege escalation 2026-07-07
CVE-2017-9066 WordPress high WordPress SSRF via HTTP request handling (unpatched pre-4.7.5 branch) 2026-07-07
CVE-2025-24813 Apache Tomcat critical Tomcat partial-PUT deserialization RCE 2026-06-29
CVE-2024-6387 OpenSSH critical regreSSHion: unauthenticated RCE in sshd 2026-06-29
CVE-2024-4577 PHP critical PHP-CGI argument injection → RCE (Windows) 2026-06-29
CVE-2022-22965 Spring Framework critical Spring4Shell RCE via data binding 2026-06-29
CVE-2021-42013 Apache httpd critical Apache path traversal → RCE 2026-06-29
CVE-2021-23017 nginx critical nginx resolver off-by-one heap overwrite (RCE) 2026-06-29
CVE-2024-49767 Werkzeug high Werkzeug multipart resource exhaustion 2026-06-29
CVE-2023-25577 Werkzeug high Werkzeug multipart DoS (resource exhaustion) 2026-06-29
CVE-2021-40438 Apache httpd high mod_proxy SSRF 2026-06-29
CVE-2020-11022 jQuery medium jQuery htmlPrefilter XSS 2026-06-29
CVE-2019-8331 Bootstrap medium Bootstrap XSS in tooltip/popover data-template 2026-06-29
CVE-2018-2783 Angular medium AngularJS (1.x) is end-of-life; multiple sandbox-escape XSS 2026-06-29

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.