Watch
Security advisories
Vulnerabilities in the libraries, SDKs and tools you depend on — with the version that fixes them.
Follow this register via RSSThe morning bulletin- 709
- advisories logged
- 95
- in the last 7 days
- 166
- actively exploited
- 306
- rated critical
0 entries
Filter
Urgency
Severity
Ecosystem
Class
- npm@azure/msal-nodeOther · >= 5.0.0-beta.0, < 7.1.0→ 7.1.0CVE-2026-109461
- npmundiciDenial of service · >= 6.23.0, < 6.29.1→ 6.29.1CVE-2026-109869
- SoftwareCollabora Online – Built-in CODE ServerActively exploitedRemote code executionNo fix publishedCVE-2026-110447
- npmbody-parserDenial of service · >= 2.0.0, < 2.4.0→ 2.4.0CVE-2026-111181
- PyPIpillowRemote code execution · <= 12.3.0→ 13.0.0CVE-2026-112398
- PyPIfilelockPath traversal · >= 3.20.4, <= 4.2.0→ 4.2.1CVE-2026-112940
PyPIvirtualenv2 advisoriesRemote code execution · < 21.14.9→ 21.14.92 CVE
- CVE-2026-113718Remote code executionHigh
- CVE-2026-113723Remote code executionHigh
- npmmulterDenial of service · >= 2.0.0, < 2.5.0→ 2.5.0CVE-2026-113872
- PyPIvllmDenial of service · >= 0.7.3, < 0.31.0→ 0.31.0CVE-2026-114055
- Composerlaravel/frameworkAuthentication bypass · >= 13.0.0, < 13.29.0→ 13.29.0CVE-2026-114509
- SoftwareArista VeloCloud OrchestratorActively exploitedInjectionNo fix publishedCVE-2026-114625
- PyPIstrands-agentsOther · < 1.43.0→ 1.43.0CVE-2026-115419
- npmelectronOther · >= 45.0.0-alpha.1, < 45.0.0-beta.6→ 45.0.0-beta.6CVE-2026-115570
PyPITwisted2 advisoriesDenial of service · <= 26.4.0→ 26.10.0rc12 CVE
- CVE-2026-115776Denial of service · CVSS 7.5High
- CVE-2026-115778Denial of service · CVSS 7.5High
- RustwasmtimeOther · < 36.0.19→ 36.0.19CVE-2026-115889
- npmhappy-domRemote code execution · >= 17.0.0, <= 21.0.3→ 21.0.4CVE-2026-115895
- Gogithub.com/siyuan-note/siyuan/kernelAuthentication bypass · < 0.0.0-20260731131820-67bc300b6ea6→ 0.0.0-20260731131820-67bc300b6ea6CVE-2026-73054
npmobsidian-tc2 advisoriesAuthentication bypass · Other · < 1.3.1→ 1.3.12 CVE
- CVE-2026-77366Authentication bypass · CVSS 9.9Critical
- CVE-2026-77363Other · CVSS 9.6Critical
- Gogithub.com/labstack/echo/v4Authentication bypass · >= 4.0.0, < 4.16.1→ 4.16.1GHSA-cxf3-9h37-7rr8
- npmpostal-mimeDenial of service · >= 3.0.0, < 4.0.8→ 4.0.8GHSA-f2hq-32vh-53cc
- RustgixOther · >= 0.88.0, <= 0.89.0→ 0.90.0GHSA-q54r-jf2p-rfr2
- npmstorybookRemote code execution · >= 8.0.0, < 8.6.19→ 8.6.19CVE-2026-114126
- PyPIjupyter-serverAuthentication bypass · >= 2.0.0, < 2.6.0→ 2.6.0CVE-2026-114135
PyPIdjangorestframework3 advisoriesDenial of service · Other · >= 3.6.4, < 3.18.2→ 3.18.23 CVE
- CVE-2026-114136Denial of service · CVSS 7.5High
- CVE-2026-114138Denial of service · CVSS 7.5High
- CVE-2026-114137Other · CVSS 7.4High
- npm@sentry/nextjsOther · >= 9.36.0, < 9.47.2→ 9.47.2CVE-2026-114139
npmtoml3 advisoriesDenial of service · <= 5.0.0→ 5.0.13 CVE
- CVE-2026-114144Denial of service · CVSS 7.5High
- CVE-2026-114141Denial of serviceHigh
- CVE-2026-114143Denial of serviceHigh
- npmtomeRemote code execution · <= 5.0.0→ 5.0.1CVE-2026-114142
- PyPIGitpythonRemote code execution · <= 3.2.0→ 3.2.1CVE-2026-114145
- npm@graphql-tools/utilsPath traversal · >= 10.10.1, <= 12.0.1→ 12.0.2CVE-2026-114604
PyPIgraphql-core2 advisoriesDenial of service · >= 3.0.0, < 3.2.12→ 3.2.122 CVE
- CVE-2026-75507Denial of service · CVSS 7.5High
- CVE-2026-75508Denial of service · CVSS 7.5High
- PyPIPillowDenial of service · >= 11.0.0, < 13.0.0→ 13.0.0CVE-2026-96639
- RustlibrsvgOther · < 2.57.5→ 2.57.5CVE-2026-96889
- npmnextRemote code execution · >= 10.0.0, <= 15.5.27→ 15.5.28GHSA-2464-fhr4-w9xw
- npmnextUnsafe deserialisation · >= 16.0.0, <= 16.4.0→ 16.4.1GHSA-673q-mjm6-r5xr
- PyPIpillowOther · >= 11.1.0, < 13.0.0→ 13.0.0GHSA-78g4-xqwv-q3g8
- npmdompurifyCross-site scripting · >= 3.4.4, <= 3.4.16→ 3.4.17GHSA-cg2g-xh64-v4q7
- PyPIpyjwtCryptographic weakness · <= 2.13.0→ 2.14.0GHSA-pxh4-856f-4h89
PyPIPillow6 advisoriesOther · Remote code execution · Denial of service · >= 2.0.0, < 13.0.0→ 13.0.06 CVE
- CVE-2026-112393OtherCritical
- CVE-2026-112900Remote code executionCritical
- CVE-2026-112399OtherHigh
- CVE-2026-112406OtherHigh
- CVE-2026-112894Denial of serviceHigh
- CVE-2026-112902OtherHigh
- PyPIpillowDenial of service · >= 4.1.0, < 13.0.0→ 13.0.0CVE-2026-112892
- npmapostropheDenial of service · < 4.33.0→ 4.33.0CVE-2026-113711
- PyPIvirtualenvRemote code execution · < 21.14.9→ 21.14.9CVE-2026-113722
- PyPIvirtualenvRemote code execution · <= 21.14.6→ 21.14.7CVE-2026-113725
- PyPIvirtualenvRemote code execution · <= 21.14.3→ 21.14.4CVE-2026-113726
- Gogithub.com/openchoreo/openchoreoAuthentication bypass · >= 1.0.0, < 1.0.6→ 1.0.6CVE-2026-113727
- Gogithub.com/moov-io/signedxmlDenial of service · <= 1.4.0→ 1.4.1CVE-2026-113729
PyPIvirtualenv2 advisoriesRemote code execution · <= 21.14.1→ 21.14.22 CVE
- CVE-2026-113732Remote code execution · CVSS 7.8High
- CVE-2026-113776Remote code execution · CVSS 7.8High
- npmstorybookRemote code execution · >= 8.0.0, < 8.6.19→ 8.6.19CVE-2026-114125
- SoftwareEG Secure Solutions SiteGuard Server EditionActively exploitedRemote code executionNo fix publishedCVE-2026-106931
- SoftwareSiemens Software CenterActively exploitedRemote code executionNo fix publishedCVE-2026-110936
- PyPIaiohttpDenial of service · >= 2.0.0, < 3.14.4→ 3.14.4CVE-2026-111066
npmfollow-redirects2 advisoriesInformation disclosure · >= 1.16.0, < 1.16.1→ 1.16.12 CVE
- CVE-2026-111755Information disclosureHigh
- CVE-2026-111756Information disclosureHigh
- npmmarkdown-itDenial of service · >= 14.1.0, < 14.3.3→ 14.3.3CVE-2026-111758
- npmmarkdown-itDenial of service · >= 15.0.0, < 15.0.2→ 15.0.2CVE-2026-111759
- Mavenorg.a2aproject.sdk:a2a-java-sdk-server-commonAuthentication bypass · < 1.3.0.Final→ 1.3.0.FinalCVE-2026-111764
- Mavenorg.a2aproject.sdk:a2a-java-sdk-http-client-androidAuthentication bypass · >= 1.3.0.Final, <= 1.3.1.Final→ 1.3.2.FinalCVE-2026-111765
npm@modelcontextprotocol/sdk2 advisoriesAuthentication bypass · Denial of service · >= 1.24.0, < 1.32.0→ 1.32.02 CVE
- CVE-2026-111767Authentication bypass · CVSS 8.6High
- CVE-2026-111768Denial of service · CVSS 7.5High
- npm@modelcontextprotocol/serverOther · >= 2.0.0, < 2.3.0→ 2.3.0CVE-2026-111770
PyPIPillow6 advisoriesOther · Denial of service · <= 12.3.0→ 13.0.06 CVE
- CVE-2026-112403OtherCritical
- CVE-2026-112397OtherHigh
- CVE-2026-112400Denial of serviceHigh
- CVE-2026-112404OtherHigh
- CVE-2026-112896OtherHigh
- CVE-2026-112897OtherHigh
- PyPIpillowDenial of service · >= 5.1.0, < 13.0.0→ 13.0.0CVE-2026-112895
- npmlaunch-editorRemote code execution · <= 2.14.1→ 2.14.2CVE-2026-112942
- npmapostropheDenial of service · < 4.33.0→ 4.33.0CVE-2026-113658
- npm@apostrophecms/db-connectDenial of service · < 1.1.0→ 1.1.0CVE-2026-113666
- Gogithub.com/klauspost/compressDenial of service · <= 1.18.6→ 1.18.7CVE-2026-63209
- SoftwarePlex Media ServerActively exploitedServer-side request forgeryNo fix publishedCVE-2026-96652
- SoftwarePlex Media ServerActively exploitedOtherNo fix publishedCVE-2026-96654
- SoftwarePlex Media ServerActively exploitedServer-side request forgeryNo fix publishedCVE-2026-96655
- SoftwarePlex Media ServerActively exploitedPath traversalNo fix publishedCVE-2026-96656
- PyPIcertifiOther · >= 2019.03.09, < 2026.10.19→ 2026.10.19GHSA-6q48-6c7w-9gw2
- PyPIuvOther · < 0.13.4→ 0.13.4GHSA-hq85-5cpj-mr62
- PyPIloopxOther · >= 0.0.1, < 0.4.5→ 0.4.5CVE-2026-108372
- PyPImercuryRemote code execution · >= 3.0.0, <= 3.2.3→ 3.2.4CVE-2026-111057
- PyPImercuryAuthentication bypass · <= 3.2.5→ 3.2.6CVE-2026-111058
PyPIaiohttp2 advisoriesDenial of service · <= 3.14.3→ 3.14.42 CVE
- CVE-2026-111064Denial of serviceHigh
- GHSA-2g87-pp6c-29x5Denial of serviceHigh
- NetworkFortinet Multiple ProductsActively exploitedPath traversalNo fix publishedCVE-2025-61624
- Gogithub.com/getkin/kin-openapiOther · <= 0.145.0→ 0.146.0CVE-2026-100349
- SoftwareBeyondTrust Remote SupportActively exploitedAuthentication bypassNo fix publishedCVE-2026-102764
- Mavenorg.bytedeco:javacvDenial of service · < 1.5.14→ 1.5.14CVE-2026-102834
- Gogithub.com/gomarkdown/markdownCross-site scripting · < 0.0.0-20260724235538-61af6e1e6971→ 0.0.0-20260724235538-61af6e1e6971CVE-2026-102941
- PyPIlmcacheAuthentication bypass · >= 0.3.9, < 0.5.6→ 0.5.6CVE-2026-105192
- PyPIclaude-agent-sdkRemote code execution · < 0.2.121→ 0.2.121CVE-2026-96620
- Gogithub.com/getarcaneapp/arcane/backend/v2Privilege escalation · < 2.6.0→ 2.6.0CVE-2026-96627
- RustlopdfDenial of service · < 0.42.0→ 0.42.0GHSA-6fj4-rcr3-r7rr
Gogithub.com/getkin/kin-openapi2 advisoriesOther · >= 0.136.0, < 0.149.0→ 0.149.02 CVE
- CVE-2026-100353Other · CVSS 7.5High
- CVE-2026-100354Other · CVSS 7.5High
- Gogithub.com/dgraph-io/dgraph/v25Authentication bypass · <= 25.3.8→ 25.4.0CVE-2026-102748
- npm@tanstack/start-server-coreCross-site scripting · >= 1.143.12, < 1.169.39→ 1.169.39CVE-2026-102989
- RustmiseRemote code execution · <= 2026.7.13→ 2026.7.14CVE-2026-103929
- Govitess.io/vitessCross-site scripting · < 0.23.5→ 0.23.5CVE-2026-104252
- SoftwareAtlassian Multiple ProductsActively exploitedOtherNo fix publishedCVE-2026-21589
- Gogithub.com/argoproj/argo-cd/v2Authentication bypass · >= 2.10.0, <= 2.14.21No fix publishedCVE-2026-77459
- Gogithub.com/kedacore/kedaServer-side request forgery · <= 1.5.0No fix publishedCVE-2026-77524
- Gogithub.com/dunglas/frankenphpOther · <= 1.12.4→ 1.12.5CVE-2026-82416
- GoNginx-UIAuthentication bypass · < 1.9.10-0.20260703131214-23d1934099b0→ 1.9.10-0.20260703131214-23d1934099b0CVE-2026-84313
Gogithub.com/0xJacky/Nginx-UI6 advisoriesRemote code execution · Authentication bypass · Other · < 1.9.10-0.20260703131214-23d1934099b0→ 1.9.10-0.20260703131214-23d1934099b06 CVE
- CVE-2026-84316Remote code execution · CVSS 8.8High
- CVE-2026-84317Remote code execution · CVSS 8.8High
- CVE-2026-84318Remote code execution · CVSS 8.8High
- CVE-2026-84315Authentication bypass · CVSS 8.3High
- CVE-2026-84319Other · CVSS 8.3High
- CVE-2026-84360Authentication bypass · CVSS 8.1High
- Composerleantime/leantimeAuthentication bypass · < 3.10.0→ 3.10.0CVE-2026-85990
- Gogithub.com/containers/podmanOther · >= 4.4.0, < 5.8.8→ 5.8.8CVE-2026-94603
- Gogithub.com/containerd/containerd/v2Privilege escalation · >= 2.1.0, < 2.2.7→ 2.2.7CVE-2026-95837
- NetworkPalo Alto Networks PAN-OSActively exploitedRemote code executionNo fix publishedCVE-2026-0322
- SoftwareAhsayCBSActively exploitedAuthentication bypassNo fix publishedCVE-2026-105133
- SoftwareAhsayCBSActively exploitedRemote code executionNo fix publishedCVE-2026-105134
- NuGetMicrosoft.OpenApi.YamlReaderDenial of service · >= 3.0.0, < 3.10.0→ 3.10.0CVE-2026-72923
- NetworkCisco Secure Email GatewayActively exploitedPath traversalNo fix publishedCVE-2026-76519
NuGetMicrosoft.AspNetCore.Components.WebAssembly.Server2 advisoriesRemote code execution · Cross-site scripting · >= 10.0.0, <= 10.0.12→ 10.0.132 CVE
- CVE-2026-102870Remote code execution · CVSS 8.8High
- CVE-2026-96230Cross-site scripting · CVSS 8.8High
- NetworkIvanti Connect SecureActively exploitedAuthentication bypassNo fix publishedCVE-2026-104935
- NuGetMicrosoft.Native.Quic.MsQuic.SchannelRemote code execution · = 2.5.11-ci.156755675→ 2.5.11-ci.159417053CVE-2026-105016
- NuGetMicrosoft.NETCore.App.Runtime.linux-armDenial of service · >= 9.0.0, <= 9.0.20→ 9.0.21CVE-2026-69651
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm642 advisoriesRemote code execution · Unsafe deserialisation · >= 9.0.0, <= 9.0.20→ 9.0.212 CVE
- CVE-2026-70007Remote code execution · CVSS 8.8High
- CVE-2026-87697Unsafe deserialisation · CVSS 8.8High
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm642 advisoriesUnsafe deserialisation · Remote code execution · >= 10.0.0, <= 10.0.12→ 10.0.132 CVE
- CVE-2026-70035Unsafe deserialisation · CVSS 8.8High
- CVE-2026-96224Remote code execution · CVSS 8.8High
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm643 advisoriesRemote code execution · >= 8.0.0, <= 8.0.31→ 8.0.323 CVE
- CVE-2026-70174Remote code execution · CVSS 8.8High
- CVE-2026-85363Remote code execution · CVSS 8.8High
- CVE-2026-96235Remote code execution · CVSS 8.8High
- NuGetMicrosoft.AspNetCore.App.Runtime.linux-armPrivilege escalation · >= 9.0.0, <= 9.0.20→ 9.0.21CVE-2026-70175
- NuGetMicrosoft.AspNetCore.Authentication.NegotiateAuthentication bypass · >= 10.0.0, <= 10.0.12→ 10.0.13CVE-2026-70179
NuGetMicrosoft.AspNetCore.App.Runtime.linux-arm3 advisoriesOther · Denial of service · >= 8.0.0, <= 8.0.31→ 8.0.323 CVE
- CVE-2026-88092Other · CVSS 9.4Critical
- CVE-2026-70186Denial of service · CVSS 7.5High
- CVE-2026-96236Denial of service · CVSS 7.5High
- NuGetMicrosoft.AspNetCore.App.Runtime.linux-armOther · >= 11.0.0-preview.1, <= 11.0.0-rc.1→ 11.0.0-rc.2CVE-2026-70188
- NuGetMicrosoft.NETCore.App.Runtime.win-arm64Remote code execution · >= 8.0.0, <= 8.0.31→ 8.0.32CVE-2026-70197
NuGetMicrosoft.WindowsDesktop.App.Runtime.win-arm642 advisoriesUnsafe deserialisation · Information disclosure · >= 11.0.0-preview.1, <= 11.0.0-rc.1→ 11.0.0-rc.22 CVE
- CVE-2026-83520Unsafe deserialisation · CVSS 8.8High
- CVE-2026-96232Information disclosure · CVSS 7.5High
NuGetMicrosoft.NETCore.App.Runtime.linux-arm2 advisoriesPath traversal · >= 8.0.0, <= 8.0.31→ 8.0.322 CVE
- CVE-2026-96225Path traversal · CVSS 7.8High
- CVE-2026-96231Path traversal · CVSS 7.8High
- NuGetMicrosoft.NETCore.App.Runtime.linux-armDenial of service · >= 10.0.0, <= 10.0.12→ 10.0.13CVE-2026-96233
- OSMicrosoft WindowsActively exploitedRemote code executionNo fix publishedCVE-2026-96951
NuGetSystem.Security.Cryptography.Xml2 advisoriesDenial of service · >= 10.0.0, <= 10.0.12→ 10.0.132 CVE
- CVE-2026-96959Denial of service · CVSS 7.5High
- CVE-2026-96960Denial of service · CVSS 7.5High
Gogithub.com/0xJacky/Nginx-UI9 advisoriesRemote code execution · Authentication bypass · Other · Path traversal · Denial of service · Supply chain · >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591→ 1.9.10-0.20260901043436-8c9b9a1aff219 CVE
- CVE-2026-107806Remote code execution · → 1.9.10-0.20260728074146-a467ed652591Critical
- CVE-2026-107807Authentication bypass · CVSS 8.8 · → 1.9.10-0.20260728074433-a3999bd78a3bHigh
- CVE-2026-107809Other · CVSS 8.8 · → 1.9.10-0.20260728074433-a3999bd78a3bHigh
- CVE-2026-107811Authentication bypass · CVSS 8.8 · → 1.9.10-0.20260728091109-0ecbd106c37bHigh
- CVE-2026-107813Authentication bypass · CVSS 8.8 · → 1.9.10-0.20260728074433-a3999bd78a3bHigh
- CVE-2026-107808Authentication bypass · CVSS 8.1 · → 1.9.10-0.20260728074558-95cd21b70814High
- CVE-2026-107810Path traversal · CVSS 8.1 · → 1.9.10-0.20260728074146-a467ed652591High
- CVE-2026-107805Denial of service · CVSS 7.5High
- CVE-2026-107812Supply chain · CVSS 7.5 · → 1.9.10-0.20260728114330-580585516dd8High
- Gogithub.com/luskaner/ageLANServer/serverDenial of service · < 1.8.2-0.20260809203301-1dd40166a593→ 1.8.2-0.20260809203301-1dd40166a593CVE-2026-107839
- Gogithub.com/jhaals/yopassDenial of service · < 0.0.0-20260727191436-61e31ead04a4→ 0.0.0-20260727191436-61e31ead04a4CVE-2026-107840
- Composercontao/comments-bundleCross-site scripting · >= 4.0.0, < 5.3.50→ 5.3.50CVE-2026-107845
- npm@tinacms/cliRemote code execution · <= 2.7.0→ 3.0.0CVE-2026-108259
- npm@tinacms/web-componentsCross-site scripting · <= 0.2.0→ 0.2.1CVE-2026-108260
- npmtinacmsOther · <= 3.13.0→ 3.14.0CVE-2026-108261
- Gogithub.com/argoproj/argo-cd/v2Remote code execution · >= 2.11.0, <= 2.14.21No fix publishedCVE-2026-55797
Gocode.vikunja.io/api4 advisoriesAuthentication bypass · Privilege escalation · Cryptographic weakness · >= 0.24.0, <= 2.3.0→ 2.4.04 CVE
- CVE-2026-68582Authentication bypassCritical
- CVE-2026-57458Privilege escalation · CVSS 8.1High
- CVE-2026-62376Cryptographic weakness · CVSS 8.1High
- CVE-2026-68581Authentication bypass · CVSS 8.1High
- Gocode.vikunja.io/apiAuthentication bypass · <= 2.4.0No fix publishedCVE-2026-76216
PyPIpyload-ng3 advisoriesAuthentication bypass · Other · >= 0.5.0b3.dev1, <= 0.5.0b3.dev101No fix published3 CVE
- GHSA-68w4-83fh-f2w8Authentication bypass · CVSS 8.1High
- GHSA-889w-m37p-88m5Other · CVSS 7.5High
- GHSA-jq7h-wrvp-3rgxOther · CVSS 7.5High
- PyPIpyload-ngAuthentication bypass · < 0.5.0b3.dev101→ 0.5.0b3.dev101GHSA-r44w-v6gf-x3p6
- SoftwareProFTPDActively exploitedAuthentication bypassNo fix publishedCVE-2015-3306
- SoftwareISC BINDActively exploitedDenial of serviceNo fix publishedCVE-2015-5477
- SoftwareApache StrutsActively exploitedRemote code executionNo fix publishedCVE-2016-3081
- SoftwareONLYOFFICE DocsActively exploitedPath traversalNo fix publishedCVE-2021-3199
- SoftwareStrapiActively exploitedRemote code executionNo fix publishedCVE-2023-22894
npmhandlebars2 advisoriesRemote code execution · >= 4.0.0, <= 4.7.9→ 4.7.102 CVE
- CVE-2026-106446Remote code execution · CVSS 9.8Critical
- CVE-2026-106445Remote code executionCritical
- Mavenorg.asynchttpclient:async-http-clientAuthentication bypass · >= 3.0.0, <= 3.0.12→ 3.0.13CVE-2026-107282
- PyPIpydantic-aiOther · >= 2.10.0, < 2.53.0→ 2.53.0CVE-2026-107286
- PyPIpydantic-aiOther · >= 1.34.0, < 1.107.4→ 1.107.4CVE-2026-107295
- npmmsgpack5Other · < 6.1.0→ 6.1.0CVE-2026-107302
npmgenerator-jhipster2 advisoriesInjection · Cross-site scripting · >= 7.0.0, < 9.4.0→ 9.4.02 CVE
- CVE-2026-107375Injection · CVSS 8.8High
- CVE-2026-107303Cross-site scripting · CVSS 7.6High
- PyPIdatamodel-code-generatorPath traversal · >= 0.59.0, <= 0.80.0→ 0.81.0CVE-2026-107377
npmmariadb2 advisoriesInjection · Information disclosure · >= 3.2.0, < 3.2.5→ 3.2.52 CVE
- CVE-2026-107384Injection · CVSS 8.1High
- CVE-2026-107383Information disclosure · CVSS 7.5High
npmfast-jwt2 advisoriesCryptographic weakness · Other · >= 6.2.0, <= 6.2.4→ 6.3.02 CVE
- CVE-2026-107722Cryptographic weakness · CVSS 9.8Critical
- CVE-2026-107723Other · CVSS 8.1High
- Mavencom.hazelcast:hazelcastRemote code execution · = 5.6.0→ 5.7.0CVE-2026-107726
- npmpraisonaiAuthentication bypass · < 1.7.3→ 1.7.3CVE-2026-61426
PyPIpraisonaiagents5 advisoriesRemote code execution · Server-side request forgery · Supply chain · <= 1.6.77→ 1.6.785 CVE
- CVE-2026-61447Remote code execution · CVSS 10Critical
- CVE-2026-61430Server-side request forgery · CVSS 8.5High
- CVE-2026-61446Remote code execution · CVSS 8.4High
- CVE-2026-61443Remote code execution · CVSS 8.1High
- CVE-2026-61437Supply chain · CVSS 7.8High
PyPIpraisonai4 advisoriesRemote code execution · Authentication bypass · <= 4.6.77→ 4.6.784 CVE
- CVE-2026-61445Remote code execution · CVSS 9.9Critical
- CVE-2026-61434Remote code execution · CVSS 8.8High
- CVE-2026-61435Authentication bypass · CVSS 8.2High
- CVE-2026-61433Remote code execution · CVSS 7.8High
- Gogithub.com/corazawaf/coraza/v3Other · >= 3.0.0, < 3.8.1→ 3.8.1CVE-2026-107826
- npmghostRemote code execution · >= 6.56.0, < 6.67.0→ 6.67.0CVE-2026-105642
npmghost2 advisoriesCross-site scripting · Injection · >= 2.5.0, < 6.64.0→ 6.64.02 CVE
- CVE-2026-105650Cross-site scripting · CVSS 8.1High
- CVE-2026-105675Injection · CVSS 7.5High
- PyPIlangflowRemote code execution · >= 1.1.2, < 1.10.3→ 1.10.3CVE-2026-105697
- PyPIdoclingPath traversal · >= 2.94.0, < 2.132.0→ 2.132.0CVE-2026-105744
- npm@payloadcms/plugin-form-builderRemote code execution · < 3.90.0→ 3.90.0CVE-2026-105857
npmpayload5 advisoriesAuthentication bypass · Cross-site scripting · Remote code execution · Path traversal · < 3.90.0→ 3.90.05 CVE
- CVE-2026-105859Authentication bypass · CVSS 9.8Critical
- CVE-2026-105863Authentication bypassCritical
- CVE-2026-105862Cross-site scripting · CVSS 8.7High
- CVE-2026-105858Remote code execution · CVSS 8.1High
- CVE-2026-105865Path traversal · CVSS 8.1High
- PyPIhydra-optuna-sweeperRemote code execution · >= 1.2.0, < 1.3.0→ 1.3.0CVE-2026-106440
PyPIhydra-core2 advisoriesRemote code execution · Unsafe deserialisation · < 1.3.6→ 1.3.62 CVE
- CVE-2026-106441Remote code execution · CVSS 7.8High
- CVE-2026-106442Unsafe deserialisation · CVSS 7.8High
- PyPIWeasyPrintRemote code execution · <= 69.0→ 70.0CVE-2026-106443
- npm@backstage/plugin-techdocs-nodeServer-side request forgery · >= 0.11.12, < 1.14.7→ 1.14.7CVE-2026-106455
- npm@backstage/plugin-scaffolder-backend-module-sentryServer-side request forgery · >= 0.3.0, < 0.3.8→ 0.3.8CVE-2026-106459
- npm@backstage/plugin-scaffolder-backend-module-bitbucket-cloudPath traversal · < 0.3.10→ 0.3.10CVE-2026-106486
- npm@backstage/plugin-auth-backend-module-oidc-providerAuthentication bypass · < 0.4.20→ 0.4.20CVE-2026-106488
- npm@backstage/backend-defaultsAuthentication bypass · < 0.17.8→ 0.17.8CVE-2026-106492
npm@backstage/plugin-techdocs-node2 advisoriesUnsafe deserialisation · Remote code execution · < 1.15.4→ 1.15.42 CVE
- CVE-2026-106558Unsafe deserialisation · CVSS 8.8High
- CVE-2026-106510Remote code execution · CVSS 7.7High
- PyPIpraisonaiagentsServer-side request forgery · <= 1.6.77→ 1.6.78CVE-2026-61429
- PyPIPraisonAIOther · <= 4.6.77→ 4.6.78CVE-2026-61439
- npmvm2Remote code execution · <= 3.12.0→ 3.12.1CVE-2026-93605
- npmshell-quoteRemote code execution · >= 1.8.4, < 1.11.0→ 1.11.0CVE-2026-102422
- npm@modelcontextprotocol/sdkAuthentication bypass · >= 1.12.0, < 1.31.0→ 1.31.0CVE-2026-104850
- PyPIlangflowRemote code execution · < 1.10.1→ 1.10.1CVE-2026-10561
- NuGetMicrosoft.Native.Quic.MsQuic.OpenSSLOther · < 2.4.20→ 2.4.20CVE-2026-105794
- NuGetMicrosoft.OpenApi.KiotaRemote code execution · >= 0.5.0, < 1.35.0→ 1.35.0CVE-2026-105796
- npm@payloadcms/plugin-import-exportRemote code execution · >= 3.0.0, < 3.88.0→ 3.88.0CVE-2026-105844
- npmpayloadInjection · >= 3.0.0, < 3.88.0→ 3.88.0CVE-2026-105845
- npmpayloadAuthentication bypass · > 3.0.0, < 3.90.0→ 3.90.0CVE-2026-105851
- npmknownsRemote code execution · <= 0.29.1→ 0.30.0CVE-2026-86540
npmvm22 advisoriesAuthentication bypass · Other · <= 3.12.1→ 3.12.22 CVE
- CVE-2026-100721Authentication bypass · CVSS 10Critical
- CVE-2026-100722Other · CVSS 8.6High
- npm@socket.io/cluster-engineDenial of service · < 0.1.1→ 0.1.1CVE-2026-102600
npmsimple-git2 advisoriesRemote code execution · <= 3.36.0→ 4.0.02 CVE
- CVE-2026-102826Remote code execution · CVSS 8.1High
- CVE-2026-102827Remote code execution · CVSS 8.1High
- npmsimple-gitRemote code execution · >= 3.15.0, < 4.0.1→ 4.0.1CVE-2026-102828
- npm@simple-git/argv-parserRemote code execution · < 2.0.1→ 2.0.1CVE-2026-102829
- npm@capacitor/androidOther · >= 6.0.0, < 6.2.2→ 6.2.2CVE-2026-103922
- npmserovalUnsafe deserialisation · >= 0.12.0, <= 1.6.0→ 1.6.2CVE-2026-104846
- npmtinypoolRemote code execution · <= 2.1.0→ 2.1.1CVE-2026-104848
- npmtinypoolRemote code execution · < 2.1.2→ 2.1.2CVE-2026-104849
- PyPIfsspecRemote code execution · >= 0.9.0, < 2026.6.0→ 2026.6.0CVE-2026-104851
PyPIlangflow2 advisoriesPath traversal · Remote code execution · <= 1.10.0→ 1.10.12 CVE
- CVE-2026-9205Path traversal · CVSS 9.1Critical
- CVE-2026-51886Remote code execution · CVSS 8.8High
- PyPIlangflowRemote code execution · >= 1.3.0, < 1.10.3→ 1.10.3CVE-2026-7700
- PyPIlangflowAuthentication bypass · >= 1.7.0, <= 1.9.0→ 1.9.1CVE-2026-8505
- npmproxy-addrAuthentication bypass · >= 1.1.0, < 2.0.8→ 2.0.8CVE-2026-90711
npmvm24 advisoriesOther · Remote code execution · >= 3.11.0, <= 3.11.7→ 3.11.84 CVE
- CVE-2026-92953Other · CVSS 10Critical
- CVE-2026-92955Other · CVSS 10Critical
- CVE-2026-92934Remote code execution · CVSS 9Critical
- CVE-2026-92954Other · CVSS 8.6High
npmvm23 advisoriesRemote code execution · Information disclosure · <= 3.11.6→ 3.11.73 CVE
- CVE-2026-92946Remote code execution · CVSS 10Critical
- CVE-2026-92947Information disclosure · CVSS 10Critical
- CVE-2026-92956Remote code execution · CVSS 10Critical
- PyPIpymongoOther · < 4.18.2→ 4.18.2CVE-2026-96749
- NetworkCitrix NetScalerActively exploitedDenial of serviceNo fix publishedCVE-2026-88779
- npm@a2ui/web_coreCross-site scripting · >= 0.9.0, < 0.10.2→ 0.10.2CVE-2026-10032
- SoftwareZammad GmbH ZammadActively exploitedRemote code executionNo fix publishedCVE-2026-102489
- SoftwareZammad GmbH ZammadActively exploitedPrivilege escalationNo fix publishedCVE-2026-102490
- npmprobe-image-sizeDenial of service · <= 7.3.0→ 7.4.0CVE-2026-104861
- Rustaws-smithy-jsonUnsafe deserialisation · <= 0.62.6→ 0.62.7CVE-2026-18140
npm@fastify/busboy2 advisoriesDenial of service · >= 1.0.0, < 3.2.1→ 3.2.12 CVE
- CVE-2026-19481Denial of service · CVSS 7.5High
- CVE-2026-19484Denial of service · CVSS 7.5High
- PyPIheadroom-aiAuthentication bypass · < 0.35.0→ 0.35.0CVE-2026-71416
- Gogitea.com/gitea/runnerPrivilege escalation · < 1.0.9-0.20260731160927-34bfa1915022→ 1.0.9-0.20260731160927-34bfa1915022CVE-2026-73802
Gogithub.com/siyuan-note/siyuan/kernel2 advisoriesServer-side request forgery · Authentication bypass · < 0.0.0-20260813142806-dd2778b70d02→ 0.0.0-20260813142806-dd2778b70d022 CVE
- CVE-2026-82234Server-side request forgery · CVSS 8.2High
- CVE-2026-74904Authentication bypass · CVSS 7.5 · → 0.0.0-20260804015139-bd067a4fe9b2High
- npmfigletDenial of service · < 1.11.3→ 1.11.3CVE-2026-96780
PyPIdulwich3 advisoriesPath traversal · >= 0.23.1, <= 1.2.7→ 1.2.83 CVE
- GHSA-5fqc-mrg8-w798Path traversal · CVSS 8.6High
- GHSA-8w8g-wq8h-fq33Path traversal · CVSS 8.6High
- GHSA-cm62-gvxx-vmxxPath traversal · CVSS 8.6High
PyPIvibe-trading-ai3 advisoriesRemote code execution · Authentication bypass · Path traversal · >= 0.1.0, < 0.1.7→ 0.1.73 CVE
- GHSA-jqmf-mx4f-hfr6Remote code execution · CVSS 10Critical
- GHSA-v2f8-6655-7grjAuthentication bypass · CVSS 10Critical
- GHSA-5rmq-chc7-m22fPath traversal · CVSS 7.5High
- Gogithub.com/xtls/xray-coreOther · >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9→ 1.260327.1-0.20260710210335-64fada32b5b9GHSA-5wf9-h793-w73c
- PyPIdulwichPath traversal · < 1.2.9→ 1.2.9GHSA-8mcx-5rqc-vhmf
npmtrigger.dev2 advisoriesInjection · Cryptographic weakness · <= 4.5.5→ 4.5.62 CVE
- GHSA-9q4r-4842-93vwInjection · CVSS 7.7High
- GHSA-pqxw-g93w-hj9xCryptographic weaknessHigh
- Rustpraxis-proxyDenial of service · < 0.5.2→ 0.5.2GHSA-cjcg-cxmh-9wcr
- npmtrigger.devAuthentication bypass · < 4.5.4→ 4.5.4GHSA-gg6r-gp4c-89hp
npmtrigger.dev3 advisoriesServer-side request forgery · Authentication bypass · < 4.5.2→ 4.5.23 CVE
- CVE-2026-85650Server-side request forgery · CVSS 7.7High
- GHSA-pp95-gc86-jq6qAuthentication bypass · CVSS 7.1High
- CVE-2026-85651Authentication bypass · CVSS 7.1High
- PyPIjupyterlabCross-site scripting · >= 4.6.0, <= 4.6.3→ 4.6.4CVE-2026-102831
- PyPIvirtualenvRemote code execution · <= 21.7.12→ 21.7.13CVE-2026-102925
- npmpiscinaRemote code execution · >= 5.0.0, < 5.3.2→ 5.3.2CVE-2026-102992
- NetworkFortinet FortiMailActively exploitedPath traversalNo fix publishedCVE-2026-104286
Gogithub.com/siyuan-note/siyuan/kernel2 advisoriesInjection · Authentication bypass · < 0.0.0-20260721043339-eef10568384e→ 0.0.0-20260812083335-251596fc0de22 CVE
- CVE-2026-69085Injection · CVSS 10 · → 0.0.0-20260721043339-eef10568384eCritical
- GHSA-9cqf-hhrq-7v45Authentication bypass · CVSS 8.6High
- Mavencom.fasterxml.jackson.core:jackson-coreDenial of service · >= 2.17.0, <= 2.18.10→ 2.18.11CVE-2026-89407
- Mavencom.fasterxml.jackson.core:jackson-coreDenial of service · >= 2.19.0, <= 2.21.6→ 2.21.7CVE-2026-89425
- npmdevalueInformation disclosure · >= 5.1.0, <= 5.9.2→ 5.9.3CVE-2026-92708
npmvm212 advisoriesRemote code execution · Other · Authentication bypass · Cryptographic weakness · Privilege escalation · Supply chain · = 3.11.6→ 3.11.712 CVE
- CVE-2026-92937Remote code execution · CVSS 10Critical
- CVE-2026-92940Other · CVSS 10Critical
- CVE-2026-92941Authentication bypass · CVSS 10Critical
- CVE-2026-92938Other · CVSS 9.9Critical
- CVE-2026-92939Cryptographic weakness · CVSS 9.9Critical
- CVE-2026-92948Remote code execution · CVSS 9.9Critical
- CVE-2026-92951Authentication bypass · CVSS 9.9Critical
- CVE-2026-92957Privilege escalation · CVSS 9.9Critical
- CVE-2026-92944Other · CVSS 9.8Critical
- CVE-2026-92935Remote code execution · CVSS 9Critical
- CVE-2026-92950Supply chain · CVSS 8.6High
- CVE-2026-92958Privilege escalation · CVSS 8.5High
- RustrusshDenial of service · <= 0.63.0→ 0.63.1CVE-2026-102823
npmfastify4 advisoriesOther · Authentication bypass · < 5.12.2→ 5.12.24 CVE
- CVE-2026-84504Other · CVSS 8.1High
- CVE-2026-76169Authentication bypass · CVSS 7.5High
- CVE-2026-84428Other · CVSS 7.5High
- CVE-2026-84469Other · CVSS 7.5High
- NetworkCisco Catalyst SD-WAN ManagerActively exploitedOtherNo fix publishedCVE-2026-76504
- PyPIgitpythonRemote code execution · <= 3.1.59→ 3.1.60CVE-2026-87817
- PyPIGitPythonDenial of service · <= 3.1.59→ 3.1.60CVE-2026-87819
- Mavencom.fasterxml.jackson.core:jackson-databindDenial of service · >= 2.0.0, <= 2.18.10→ 2.18.11CVE-2026-91776
- Mavencom.fasterxml.jackson.core:jackson-databindDenial of service · >= 2.19.0, <= 2.21.6→ 2.21.7CVE-2026-91777
- Composerleague/commonmarkDenial of service · >= 2.0.0, <= 2.10.1→ 2.10.2CVE-2026-105830
- PyPItornadoDenial of service · <= 6.5.8→ 6.5.9CVE-2026-103262
- npmnodemailerDenial of service · >= 9.1.0, <= 10.0.4→ 10.0.5CVE-2026-90776
- npmnextRemote code execution · >= 16.2.0, < 16.3.6→ 16.3.6GHSA-vcvr-r3jv-pc5j
- npm@xhmikosr/decompressPath traversal · >= 11.0.0, <= 11.1.3→ 11.1.4CVE-2026-101894
PyPIPyJWT5 advisoriesCryptographic weakness · Server-side request forgery · <= 2.13.0→ 2.14.05 CVE
- CVE-2026-102268Cryptographic weakness · CVSS 9.1Critical
- CVE-2026-102266Cryptographic weakness · CVSS 7.4High
- CVE-2026-102267Server-side request forgery · CVSS 7.4High
- CVE-2026-102272Cryptographic weakness · CVSS 7.4High
- CVE-2026-102273Cryptographic weakness · CVSS 7.4High
- PyPIpyjwtCryptographic weakness · >= 2.4.0, < 2.14.0→ 2.14.0CVE-2026-102271
- npmbrace-expansionDenial of service · >= 4.0.0, < 5.0.10→ 5.0.10CVE-2026-102276
- npmbrace-expansionDenial of service · >= 4.0.0, < 5.0.11→ 5.0.11CVE-2026-102278
- npm@nestjs/microservicesDenial of service · < 11.2.4→ 11.2.4CVE-2026-102281
- npmengine.ioDenial of service · >= 6.6.0, < 6.6.10→ 6.6.10CVE-2026-102599
- npmelectronOther · < 41.10.4→ 41.10.4CVE-2026-102673
npmelectron2 advisoriesPrivilege escalation · < 41.10.6→ 41.10.62 CVE
- CVE-2026-102676Privilege escalation · CVSS 8.3High
- CVE-2026-102674Privilege escalation · CVSS 8.2High
- npmelectronOther · >= 42.3.3, < 42.10.0→ 42.10.0CVE-2026-102677
- npmundiciDenial of service · >= 6.7.0, < 6.28.1→ 6.28.1CVE-2026-19534
- Composerphpcsstandards/phpcsutilsRemote code execution · >= 1.0.0-alpha1, < 1.2.3→ 1.2.3CVE-2026-65954
- OSApple Multiple ProductsActively exploitedRemote code executionNo fix publishedCVE-2026-86950
- npmjoiDenial of service · >= 17.2.0, < 17.13.7→ 17.13.7CVE-2026-92599
npmadm-zip2 advisoriesDenial of service · <= 0.6.0→ 0.6.12 CVE
- GHSA-8238-w5pm-2374Denial of service · CVSS 7.5High
- CVE-2026-92000Denial of service · CVSS 7.5High
- npmnodemailerDenial of service · <= 10.0.5→ 10.0.6CVE-2026-100700
- npm@angular/platform-serverDenial of service · >= 22.0.0, < 22.1.6→ 22.1.6CVE-2026-101895
- Maventools.jackson.core:jackson-databindDenial of service · >= 3.2.0, < 3.2.2→ 3.2.2CVE-2026-68497
npmfast-uri2 advisoriesOther · Server-side request forgery · < 2.4.6→ 2.4.62 CVE
- CVE-2026-84292Other · CVSS 7.5High
- CVE-2026-84394Server-side request forgery · CVSS 7.5High
- npm@angular/platform-serverCross-site scripting · >= 22.0.0, < 22.1.4→ 22.1.4CVE-2026-88058
- npmcode-ollamaRemote code execution · <= 0.36.0→ 0.36.1GHSA-456v-xq2p-r4cj
- NetworkCitrix NetScalerActively exploitedOtherNo fix publishedCVE-2026-88771
- NetworkCitrix NetScalerActively exploitedRemote code executionNo fix publishedCVE-2026-88772
- NuGetCliInvoke.SpecializationsRemote code execution · >= 2.2.0, <= 2.8.4→ 2.8.5CVE-2026-100368
- NuGetCliInvokeRemote code execution · >= 2.0.0, <= 2.8.4→ 2.8.5CVE-2026-100369
- Composerstarcitizenwiki/embedvideoCross-site scripting · <= 4.0.0→ 4.1.0CVE-2026-57440
- PyPIscbe-aethermooreAuthentication bypass · >= 4.0.2, < 4.2.1→ 4.2.1CVE-2026-57443
Composercode16/sharp2 advisoriesCross-site scripting · < 9.22.5→ 9.22.52 CVE
- CVE-2026-61825Cross-site scripting · CVSS 8.7High
- CVE-2026-61823Cross-site scripting · CVSS 7.3High
- SoftwareMicrosoft SharePointActively exploitedRemote code executionNo fix publishedCVE-2026-65660
- NetworkMikroTik RouterOSActively exploitedOtherNo fix publishedCVE-2026-67279
- npmknownsPath traversal · <= 0.29.1→ 0.30.0CVE-2026-86439
- SoftwareWordPress CoreActively exploitedRemote code executionNo fix publishedCVE-2026-87902
- Composerfof/oauthOther · < 1.7.4→ 1.7.4CVE-2026-92161
- npm@openzeppelin/confidential-contractsOther · < 0.3.2→ 0.3.2GHSA-29h2-jr22-frmh
- PyPIkhojPath traversal · >= 2.0.0-beta.23, < 2.0.0-beta.25→ 2.0.0-beta.25GHSA-62mm-xwmv-crhg
Othermpp2 advisoriesDenial of service · >= 0.2.0, < 0.6.0→ 0.6.02 CVE
- CVE-2026-59252Denial of serviceHigh
- CVE-2026-59695Denial of serviceHigh
- npm@aws/lsp-codewhispererPath traversal · < 0.0.117→ 0.0.117CVE-2026-12958
- SoftwareWSO2 Multiple ProductsActively exploitedCryptographic weaknessNo fix publishedCVE-2026-5430
- Composerthorsten/phpmyfaqCross-site scripting · < 4.2.0-alpha→ 4.2.0-alphaCVE-2026-56736
- Composerthorsten/phpmyfaqAuthentication bypass · >= 3.2.0, < 4.1.6→ 4.1.6CVE-2026-56737
PyPIcompliance-trestle2 advisoriesPath traversal · Remote code execution · < 3.12.4→ 3.12.42 CVE
- CVE-2026-57171Path traversal · CVSS 8.4High
- CVE-2026-57170Remote code execution · CVSS 7.8High
- Gogithub.com/containers/podman/v5Information disclosure · < 5.8.4→ 5.8.4CVE-2026-57231
- npmsuneditorCross-site scripting · <= 2.47.10→ 2.47.11CVE-2026-59167
- npmclineOther · < 3.0.30→ 3.0.30CVE-2026-59723
- Gogithub.com/ixofoundation/ixo-blockchain/v8Authentication bypass · < 8.0.0→ 8.0.0CVE-2026-61604
- PyPIdecepticon-coreOther · <= 1.1.16→ 1.1.17CVE-2026-61732
- Mavenorg.http4s:http4s-scala-xml_2.12Server-side request forgery · <= 0.24.0→ 0.24.1CVE-2026-61741
- npm@bytebase/dbhubAuthentication bypass · <= 0.22.4→ 0.22.5CVE-2026-61742
- npm@rsdoctor/rspack-pluginInformation disclosure · <= 1.5.15→ 1.5.16CVE-2026-61782
- Composerzbateson/mail-mime-parserDenial of service · >= 2.0.0, < 3.0.6→ 3.0.6CVE-2026-61816
Composersnipe/snipe-it2 advisoriesCross-site scripting · < 8.7.0→ 8.7.02 CVE
- CVE-2026-63498Cross-site scripting · CVSS 8.7High
- CVE-2026-62368Cross-site scripting · CVSS 8.1High
- SoftwareAdobe Commerce and MagentoActively exploitedAuthentication bypassNo fix publishedCVE-2026-71362
Gogithub.com/zitadel/zitadel2 advisoriesOther · < 1.80.0-v2.20.0.20260717062331-baf6ed501b68→ 1.80.0-v2.20.0.20260717062356-56f4798ed31f2 CVE
- CVE-2026-85057Other · CVSS 8.7 · → 1.80.0-v2.20.0.20260717062331-baf6ed501b68High
- CVE-2026-85056Other · CVSS 8.2High
- npm9routerAuthentication bypass · <= 0.4.80→ 0.5.2CVE-2026-56675
- PyPIplone.app.portletsRemote code execution · >= 7.0.0, <= 7.0.1→ 7.0.2CVE-2026-57149
Composerverbb/formie3 advisoriesServer-side request forgery · Authentication bypass · >= 3.0.0, < 3.1.31→ 3.1.313 CVE
- CVE-2026-76086Server-side request forgery · CVSS 8.5High
- CVE-2026-76087Authentication bypass · CVSS 8.2High
- CVE-2026-76089Authentication bypass · CVSS 7.7High
- npm@openc3/vue-commonCross-site scripting · >= 5.0.6, <= 7.2.1→ 7.3.0CVE-2026-77394
RubyGemsopenc32 advisoriesRemote code execution · >= 5.1.0, <= 7.2.1→ 7.3.02 CVE
- CVE-2026-77602Remote code execution · CVSS 9.9Critical
- CVE-2026-77601Remote code execution · CVSS 8.8High
- Mavenio.moquette:moquette-brokerRemote code execution · <= 0.18.0→ 0.18.1CVE-2026-85724
- Gogithub.com/klever-io/klever-goAuthentication bypass · <= 1.7.19→ 1.7.20CVE-2026-86064
- Gogithub.com/emiago/sipgoDenial of service · <= 1.4.0→ 1.4.1CVE-2026-58268
- npm@sync-in/serverAuthentication bypass · <= 2.3.0→ 2.4.0CVE-2026-58269
- PyPIpsd-toolsDenial of service · < 1.17.4→ 1.17.4CVE-2026-59991
- Mavennet.sf.mpxj:mpxjOther · >= 5.5.5, < 16.4.1→ 16.4.1CVE-2026-61570
Gogithub.com/kubeedge/kubeedge3 advisoriesRemote code execution · Path traversal · >= 1.21.0, < 1.21.2→ 1.21.23 CVE
- CVE-2026-62182Remote code execution · CVSS 8.8High
- CVE-2026-62371Remote code execution · CVSS 8.8High
- CVE-2026-62369Path traversal · CVSS 8.1High
- npmrequest-filtering-agentDenial of service · < 3.2.1→ 3.2.1CVE-2026-62985
- npm@deepstream/serverAuthentication bypass · = 10.1.0→ 10.1.1CVE-2026-63116
- Gogithub.com/openbao/openbaoOther · < 0.0.0-20260713141742-763625a20721→ 0.0.0-20260713141742-763625a20721CVE-2026-63132
- Gogithub.com/projectdiscovery/nuclei/v3Remote code execution · >= 3.0.0, < 3.10.0→ 3.10.0CVE-2026-76819
PyPImcp-atlassian8 advisoriesAuthentication bypass · Path traversal · < 0.22.0→ 0.22.08 CVE
- CVE-2026-77244Authentication bypass · CVSS 10Critical
- CVE-2026-77243Authentication bypass · CVSS 8.8High
- CVE-2026-77248Path traversal · CVSS 8.6High
- CVE-2026-77255Path traversal · CVSS 8.6High
- CVE-2026-77262Path traversal · CVSS 8.6High
- CVE-2026-77258Path traversal · CVSS 7.7High
- CVE-2026-77259Path traversal · CVSS 7.7High
- CVE-2026-77246Path traversal · CVSS 7.4High
- Gogithub.com/emiago/sipgoDenial of service · <= 1.4.2→ 1.4.3CVE-2026-77322
- Gogithub.com/tinyauthapp/tinyauthAuthentication bypass · < 1.0.1-0.20260720133915-80bc87188ec3→ 1.0.1-0.20260720133915-80bc87188ec3CVE-2026-77560
- NetworkCheck Point Multiple ProductsActively exploitedRemote code executionNo fix publishedCVE-2026-85102
- PyPIlightrag-hkuAuthentication bypass · < 1.5.5→ 1.5.5CVE-2026-85734
- PyPIhomeassistantCross-site scripting · < 2026.7.0→ 2026.7.0CVE-2026-91130
- SoftwareCheck Point Multiple ProductsActively exploitedPath traversalNo fix publishedCVE-2026-93616
- SoftwareArista VeloCloud OrchestratorActively exploitedOtherNo fix publishedCVE-2026-93952
- NetworkF5 BIG-IP APMActively exploitedRemote code executionNo fix publishedCVE-2026-94127
- Gogithub.com/lucasdillmann/nginx-ignitionOther · < 0.0.0-20260621194639-0586b4e55ab→ 0.0.0-20260621194639-0586b4e55abCVE-2026-61628
- Gogithub.com/lucasdillmann/nginx-ignitionDenial of service · >= 0.0.0-20260126024607-cbaf0fc16ed8, < 0.0.0-20260526022344-0c988fc1277c→ 0.0.0-20260526022344-0c988fc1277cCVE-2026-61629
- GohatchetAuthentication bypass · < 0.91.1→ 0.91.1CVE-2026-61687
- NetworkZyxel GS1900 Series SwitchesActively exploitedOtherNo fix publishedCVE-2026-7273
- OSLinux KernelActively exploitedOtherNo fix publishedCVE-2025-39682
- OSLinux KernelActively exploitedOtherNo fix publishedCVE-2025-39964
- Mavenorg.xwiki.rendering:xwiki-rendering-xmlRemote code execution · < 14.10.2→ 14.10.2CVE-2025-53837
- Composermediawiki/semantic-media-wikiCross-site scripting · >= 3.1.0, < 7.0.0→ 7.0.0CVE-2025-61682
- PyPIlmdeployUnsafe deserialisation · >= 0.9.2, < 0.16.0→ 0.16.0CVE-2025-66455
- PyPIlmdeployDenial of service · >= 0.12.1, < 0.12.3→ 0.12.3CVE-2026-33625
- OSLinux KernelActively exploitedOtherNo fix publishedCVE-2026-53266
- Gogithub.com/stacklok/toolhiveAuthentication bypass · < 0.30.1→ 0.30.1CVE-2026-58197
- PyPImnemosyne-memoryCryptographic weakness · <= 3.10.0→ 3.10.1CVE-2026-59163
- Gogithub.com/projectcapsule/capsuleAuthentication bypass · <= 0.13.6→ 0.13.7CVE-2026-61672
- Gogithub.com/kcp-dev/kcpAuthentication bypass · < 0.31.4→ 0.31.4CVE-2026-61682
- Gozotregistry.dev/zot/v2Other · < 2.1.18→ 2.1.18CVE-2026-61833
Gogithub.com/perses/perses2 advisoriesAuthentication bypass · Path traversal · >= 0.43.0, < 0.54.0-rc.0→ 0.54.0-rc.02 CVE
- CVE-2026-63199Authentication bypassHigh
- CVE-2026-63445Path traversalHigh
PyPIanyio2 advisoriesOther · Privilege escalation · < 4.14.2→ 4.14.22 CVE
- CVE-2026-63374OtherCritical
- CVE-2026-63349Privilege escalationHigh
- Gogithub.com/perses/persesAuthentication bypass · < 0.54.0-beta.3→ 0.54.0-beta.3CVE-2026-63458
- npmadm-zipDenial of service · < 0.6.1→ 0.6.1CVE-2026-77301
- Mavenorg.opencastproject:opencast-engage-paella-player-7Cross-site scripting · < 19.7→ 19.7CVE-2026-77615
- Gogithub.com/frain-dev/convoyAuthentication bypass · < 0.9.3-0.20260724092134-1cc67cd16fb1→ 0.9.3-0.20260724092134-1cc67cd16fb1CVE-2026-81505
- Mavenio.moquette:moquette-brokerAuthentication bypass · < 0.18.1→ 0.18.1CVE-2026-85058
- npm@file-viewer/docCross-site scripting · <= 2.3.0→ 2.3.1CVE-2026-91127
- PyPIlmdeployServer-side request forgery · >= 0.12.3, < 0.15.0→ 0.15.0GHSA-39wr-7q6h-cf68
Gogithub.com/obot-platform/obot2 advisoriesAuthentication bypass · Server-side request forgery · < 0.23.0→ 0.23.02 CVE
- CVE-2026-101062Authentication bypass · CVSS 8.8High
- CVE-2026-101064Server-side request forgery · CVSS 7.6High
- Composermediawiki/semantic-media-wikiAuthentication bypass · >= 3.0.0, <= 7.2.1→ 7.3.0GHSA-jr78-w6w5-m8f8
- Composerchamilo/chamilo-lmsRemote code execution · <= 2.0.0→ 2.0.1CVE-2026-45140
- npm@vendure/dashboardCross-site scripting · < 3.6.5→ 3.6.5CVE-2026-63459
- npm@vendure/coreAuthentication bypass · < 3.7.0→ 3.7.0CVE-2026-63472
- npm@tinacms/authAuthentication bypass · <= 1.1.3→ 1.1.4CVE-2026-63506
- Composergetgrav/gravRemote code execution · >= 1.7.0, < 2.0.9→ 2.0.9CVE-2026-65608
- Composergetgrav/gravRemote code execution · >= 2.0.7, <= 2.0.10→ 2.0.11CVE-2026-69088
Composergetgrav/grav2 advisoriesPath traversal · Authentication bypass · <= 2.0.15→ 2.0.162 CVE
- CVE-2026-72695Path traversal · CVSS 8.1High
- CVE-2026-76839Authentication bypass · CVSS 7.7High
- Composergetgrav/gravRemote code execution · < 2.0.13→ 2.0.13CVE-2026-72819
- Mavenio.kestra:coreServer-side request forgery · <= 1.3.31No fix publishedCVE-2026-73247
- NuGetMartenInjection · >= 7.0.0, <= 9.12.0→ 9.13.0CVE-2026-75513
Composergetgrav/grav2 advisoriesRemote code execution · Cross-site scripting · <= 2.0.14→ 2.0.152 CVE
- CVE-2026-75827Remote code execution · CVSS 8.8High
- CVE-2026-75828Cross-site scripting · CVSS 8.7High
- Composergetgrav/gravAuthentication bypass · < 2.0.14→ 2.0.14CVE-2026-75837
- PyPIRestrictedPythonRemote code execution · < 8.4→ 8.4CVE-2026-76825
Gogithub.com/rabbitmq/amqp091-go3 advisoriesCryptographic weakness · Other · Remote code execution · < 1.13.0→ 1.13.03 CVE
- CVE-2026-77405Cryptographic weaknessCritical
- CVE-2026-77408OtherCritical
- CVE-2026-77411Remote code executionCritical
- Composercakephp/databaseInjection · < 4.5.12→ 4.5.12CVE-2026-79752
- Gooras.land/oras-go/v2Path traversal · <= 2.6.1→ 2.6.2CVE-2026-85731
- npm@libp2p/peer-storeAuthentication bypass · >= 8.0.0, < 12.0.24→ 12.0.24CVE-2026-86039
- PyPIlmdeployUnsafe deserialisation · >= 0.9.1, < 0.10.2→ 0.10.2CVE-2025-59953
- SoftwareGoogle PixelActively exploitedAuthentication bypassNo fix publishedCVE-2026-58704
- npm@zereight/mcp-gitlabPath traversal · < 2.1.27→ 2.1.27CVE-2026-61560
PyPIdjust6 advisoriesAuthentication bypass · Privilege escalation · Other · < 1.0.7→ 1.0.76 CVE
- CVE-2026-61594Authentication bypass · CVSS 9.1Critical
- CVE-2026-61591Privilege escalation · CVSS 8.1High
- CVE-2026-61593Other · CVSS 8.1High
- CVE-2026-61595Authentication bypass · CVSS 7.7High
- CVE-2026-61590Authentication bypass · CVSS 7.4High
- CVE-2026-61592Authentication bypass · CVSS 7.4High
Rustrmcp2 advisoriesOther · Denial of service · < 2.0.0→ 2.0.02 CVE
- CVE-2026-63127Other · CVSS 8.2High
- CVE-2026-63128Denial of service · CVSS 7.5High
- npm@nuxtjs/mdcCross-site scripting · < 0.22.1→ 0.22.1CVE-2026-63671
- NetworkCisco Identity Services EngineActively exploitedOtherNo fix publishedCVE-2026-76460
- SoftwareAcronis BackupActively exploitedPrivilege escalationNo fix publishedCVE-2026-87886
- Rustlibp2p-quicDenial of service · < 0.13.1→ 0.13.1CVE-2026-61544
- Gogithub.com/jm33-m0/emp3r0r/coreDenial of service · < 0.0.0-20260531142011-aed3d81641ab→ 0.0.0-20260531142011-aed3d81641abCVE-2026-61554
- npm@zereight/mcp-gitlabServer-side request forgery · >= 0.0.1, < 2.1.27→ 2.1.27CVE-2026-61559
npm@zereight/mcp-gitlab2 advisoriesOther · Authentication bypass · < 2.1.30→ 2.1.302 CVE
- CVE-2026-61568Other · CVSS 9.6Critical
- GHSA-5648-rgj9-v224Authentication bypass · CVSS 8.1High
Mavenorg.http4s:http4s-ember-core_2.125 advisoriesOther · Denial of service · <= 0.23.34→ 0.23.355 CVE
- CVE-2026-69204OtherCritical
- CVE-2026-69202Denial of service · CVSS 7.5High
- CVE-2026-69203Denial of service · CVSS 7.5High
- CVE-2026-69213Denial of service · CVSS 7.5High
- CVE-2026-69218Denial of service · CVSS 7.5High
- Mavenorg.http4s:http4s-ember-core_3Other · <= 0.23.34→ 0.23.35CVE-2026-69205
- Mavenorg.http4s:http4s-ember-server_2.12Denial of service · <= 0.23.34→ 0.23.35CVE-2026-69208
- Mavenorg.http4s:http4s-ember-core_2.13Denial of service · <= 0.23.36→ 0.23.37CVE-2026-88975
- Gogithub.com/zitadel/zitadelAuthentication bypass · < 4.15.3→ 4.15.3CVE-2026-56668
- PyPIesphome-device-builderAuthentication bypass · < 1.0.12→ 1.0.12CVE-2026-59178
- NetworkCisco Secure Email GatewayActively exploitedInjectionNo fix publishedCVE-2026-76461
- Mavencom.linecorp.centraldogma:centraldogma-server-mirror-gitOther · < 0.84.0→ 0.84.0CVE-2026-11745
- Mavencom.linecorp.centraldogma:centraldogma-serverAuthentication bypass · < 0.84.0→ 0.84.0CVE-2026-11746
- SoftwareJFrog ArtifactoryActively exploitedAuthentication bypassNo fix publishedCVE-2026-42016
- SoftwareJFrog ArtifactoryActively exploitedAuthentication bypassNo fix publishedCVE-2026-42018
Composershopper/framework4 advisoriesAuthentication bypass · >= 2.8.0, < 2.9.2→ 2.9.24 CVE
- CVE-2026-56828Authentication bypass · CVSS 8.8High
- CVE-2026-56825Authentication bypass · CVSS 8.1High
- CVE-2026-56827Authentication bypass · CVSS 8.1High
- CVE-2026-56829Authentication bypass · CVSS 8.1High
- npm@mockoon/commons-serverAuthentication bypass · < 9.7.0→ 9.7.0CVE-2026-59148
- PyPIprowler-cloudAuthentication bypass · < 5.30.3→ 5.30.3CVE-2026-59151
- PyPImysql-mcp-serverAuthentication bypass · < 0.4.2→ 0.4.2CVE-2026-59971
- npmmcp-from-openapiServer-side request forgery · >= 2.3.0, < 2.5.0→ 2.5.0CVE-2026-59973
- npmyaysonRemote code execution · <= 4.2.0→ 4.3.0CVE-2026-61534
- SoftwareConnectWise ScreenConnectActively exploitedAuthentication bypassNo fix publishedCVE-2026-84869
- SoftwareGitLab Community Edition and Enterprise EditionActively exploitedPath traversalNo fix publishedCVE-2026-85706
- Composerpimcore/pimcoreInjection · >= 2026.1.0, <= 2026.1.5→ 2026.1.6CVE-2026-55416
- npm@argos-ci/coreRemote code execution · <= 6.2.0→ 6.2.1CVE-2026-59960
- OSMikroTik RouterOSActively exploitedAuthentication bypassNo fix publishedCVE-2026-67277
- NetworkMikroTik RouterOSActively exploitedRemote code executionNo fix publishedCVE-2026-86060
PyPIopen-webui4 advisoriesCross-site scripting · Authentication bypass · Server-side request forgery · Denial of service · >= 0.8.11, <= 0.11.0→ 0.11.14 CVE
- CVE-2026-87995Cross-site scripting · CVSS 8.7High
- CVE-2026-87016Authentication bypass · CVSS 8.1High
- CVE-2026-87996Server-side request forgery · CVSS 7.7High
- CVE-2026-87011Denial of service · CVSS 7.5High
- Gogithub.com/traefik/traefik/v3Authentication bypass · >= 3.0.0, < 3.7.13→ 3.7.13CVE-2026-88007
Gogithub.com/rclone/rclone4 advisoriesAuthentication bypass · Other · < 1.75.1→ 1.75.14 CVE
- CVE-2026-88018Authentication bypass · CVSS 9.8Critical
- CVE-2026-88044Authentication bypass · CVSS 9.1Critical
- CVE-2026-88045Other · CVSS 7.5High
- CVE-2026-88017Other · CVSS 7.3High
- npmomnirouteRemote code execution · <= 3.8.50No fix publishedCVE-2026-88062
Rustmistralrs-server-core2 advisoriesDenial of service · Server-side request forgery · <= 0.8.4→ 0.8.182 CVE
- GHSA-m3wp-48jr-vr4gDenial of service · CVSS 7.5High
- GHSA-wfgq-w7cq-qj7jServer-side request forgery · CVSS 7.2High
- npm@eigenpal/docx-editor-coreCross-site scripting · <= 1.8.2→ 1.8.3GHSA-x7m8-jrm8-hpvx
- NetworkFortinet Multiple ProductsActively exploitedOtherNo fix publishedCVE-2025-25249
- NetworkCitrix NetScalerActively exploitedAuthentication bypassNo fix publishedCVE-2026-19490
- NetworkCisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall ManagementActively exploitedAuthentication bypassNo fix publishedCVE-2026-20079
- npm@yeger/turbo-graphAuthentication bypass · <= 2.8.8→ 2.8.12CVE-2026-59160
- Gogithub.com/candid82/jokerSupply chain · < 1.8.2→ 1.8.2CVE-2026-59172
- npmfunctype-mcp-serverSupply chain · <= 1.4.3→ 1.4.4CVE-2026-59176
- PyPIesphome-device-builderRemote code execution · < 1.0.10→ 1.0.10CVE-2026-59177
- npm@openhop/serverPath traversal · <= 0.3.5→ 0.3.6CVE-2026-59179
- Gogithub.com/identrail/identrailAuthentication bypass · < 1.0.2→ 1.0.2CVE-2026-59185
NuGetMicrosoft.DiaSymReader.Native3 advisoriesPrivilege escalation · Remote code execution · >= 17.10.0-beta1.24272.1, <= 18.9.0-beta1.26405.1→ 18.9.0-beta1.26405.23 CVE
- CVE-2026-69439Privilege escalation · CVSS 8.8High
- CVE-2026-69522Remote code execution · CVSS 8.8High
- CVE-2026-71328Remote code execution · CVSS 8.8High
- BrowserGoogle Chromium V8Actively exploitedRemote code executionNo fix publishedCVE-2026-87491
- Gogithub.com/komari-monitor/komariServer-side request forgery · < 0.0.0-20260609084633-98122fa4d110→ 0.0.0-20260609084633-98122fa4d110GHSA-hxjg-93wc-h8p8
- NuGetMicrosoft.WindowsDesktop.App.Runtime.win-x64Unsafe deserialisation · >= 10.0.0, <= 10.0.9→ 10.0.10CVE-2026-50646
- PyPInltkPath traversal · >= 3.10.0, < 3.10.2→ 3.10.2CVE-2026-62384
PyPInltk3 advisoriesUnsafe deserialisation · Denial of service · Path traversal · <= 3.9.4→ 3.10.03 CVE
- CVE-2026-78683Unsafe deserialisationCritical
- CVE-2026-80205Denial of service · CVSS 7.5High
- CVE-2026-62385Path traversal · CVSS 5.9Moderate
- NuGetMicrosoft.Native.Quic.MsQuic.OpenSSLRemote code execution · >= 2.5.3, < 2.5.10→ 2.5.10CVE-2026-62815
- npmliquidjsDenial of service · <= 10.27.1→ 10.27.2CVE-2026-69222
- PyPInltkPath traversal · <= 3.9.3→ 3.9.4CVE-2026-70626
- Gogithub.com/siyuan-note/siyuan/kernelAuthentication bypass · < 0.0.0-20260726020813-a25c2dd06aae→ 0.0.0-20260726020813-a25c2dd06aaeCVE-2026-72789
- Gogithub.com/semaphoreui/semaphoreRemote code execution · < 0.0.0-20260704181911-7e8a9434bd81→ 0.0.0-20260704181911-7e8a9434bd81CVE-2026-73294
- Mavenio.netty:netty-handlerOther · >= 4.2.0.Final, <= 4.2.16.Final→ 4.2.17.FinalCVE-2026-75595
npmnext2 advisoriesPath traversal · Remote code execution · >= 13.4.0, < 15.5.24→ 15.5.242 CVE
- CVE-2026-75604Path traversal · CVSS 9Critical
- GHSA-2xp9-vwfh-vxw4Remote code executionCritical
- SoftwareAdobe Commerce and MagentoActively exploitedRemote code executionNo fix publishedCVE-2026-75650
npmmulter3 advisoriesDenial of service · = 2.2.0→ 2.3.03 CVE
- CVE-2026-77037Denial of service · CVSS 7.5High
- CVE-2026-77078Denial of service · CVSS 7.5High
- CVE-2026-82333Denial of service · CVSS 7.5High
- Composercakephp/cakephpInjection · >= 5.3.0, < 5.3.7→ 5.3.7CVE-2026-77635
PyPIGitPython3 advisoriesRemote code execution · Path traversal · <= 3.1.58→ 3.1.593 CVE
- CVE-2026-78676Remote code execution · CVSS 9.8Critical
- CVE-2026-78675Path traversal · CVSS 8.4High
- CVE-2026-78677Path traversal · CVSS 7.5High
- PyPInltkUnsafe deserialisation · <= 3.10.2→ 3.10.3CVE-2026-79657
- Composermongodb/mongodbInjection · < 1.21.4→ 1.21.4CVE-2026-81525
- OSMicrosoft WindowsActively exploitedPath traversalNo fix publishedCVE-2026-81963
- Composercomposer/composerRemote code execution · >= 2.3.0, < 2.10.3→ 2.10.3CVE-2026-84361
- npmsvgoCross-site scripting · >= 1.0.0, < 2.8.4→ 2.8.4CVE-2026-84370
- Composerpredis/predisRemote code execution · >= 3.0.0-RC1, < 3.3.0→ 3.3.0CVE-2026-84372
- Composermaatwebsite/excelPath traversal · >= 3.1.8, < 3.1.70→ 3.1.70CVE-2026-84374
- npmjs-yamlDenial of service · >= 4.0.0, < 4.3.2→ 4.3.2CVE-2026-84375
- PyPIhttpcore2Other · < 2.10.0→ 2.10.0CVE-2026-84381
- PyPIhttpx2Denial of service · < 2.12.0→ 2.12.0CVE-2026-84382
- Gogoogle.golang.org/grpcDenial of service · < 1.82.2→ 1.82.2CVE-2026-84445
- PyPIwinml-cliAuthentication bypass · < 0.4.0→ 0.4.0CVE-2026-84452
- npmmaplibre-glCross-site scripting · <= 6.4.0→ 6.4.1CVE-2026-85061
- OSMicrosoft WindowsActively exploitedOtherNo fix publishedCVE-2026-85880
- SoftwareN-able N-centralActively exploitedRemote code executionNo fix publishedCVE-2026-86218
- npmastroRemote code execution · < 7.2.8→ 7.2.8GHSA-26w7-cxv4-gfx2
- npm@typespec/openapi3Path traversal · <= 1.15.0No fix publishedGHSA-2q42-4q24-7rgv
- npmnodemailerDenial of service · < 9.1.0→ 9.1.0CVE-2026-92596
- npm@tiptap/coreDenial of service · >= 3.7.0, < 3.30.5→ 3.30.5GHSA-j95f-988m-3j2f
- npmsharpRemote code execution · < 0.35.4→ 0.35.4GHSA-rgj7-g3m4-5g8c
- BrowserGoogle Chromium V8Actively exploitedRemote code executionNo fix publishedCVE-2026-85046
- npm@typespec/spectorAuthentication bypass · <= 0.1.0-alpha.26→ 0.1.0-alpha.27GHSA-7q9c-hpx7-9cwm
- SoftwareKludex StarletteActively exploitedAuthentication bypassNo fix publishedCVE-2026-48710
- SoftwareKestra OSSActively exploitedRemote code executionNo fix publishedCVE-2026-49869
- SoftwareBerriAI LiteLLMActively exploitedAuthentication bypassNo fix publishedCVE-2026-59822
- SoftwareJFrog ArtifactoryActively exploitedAuthentication bypassNo fix publishedCVE-2026-82329
- NetworkSonicWall SMA1000 AppliancesActively exploitedServer-side request forgeryNo fix publishedCVE-2026-83548
- NetworkSonicWall SMA1000 AppliancesActively exploitedRemote code executionNo fix publishedCVE-2026-83549
- SoftwareSangoma SwitchvoxActively exploitedInjectionNo fix publishedCVE-2026-9586
- SoftwarePaperCut NG/MFActively exploitedAuthentication bypassNo fix publishedCVE-2026-81578
- SoftwarePaperCut NG/MFActively exploitedRemote code executionNo fix publishedCVE-2026-82078
- SoftwareownCloudActively exploitedAuthentication bypassNo fix publishedCVE-2023-49105
- OSLinux KernelActively exploitedPrivilege escalationNo fix publishedCVE-2026-53362
- SoftwareJFrog ArtifactoryActively exploitedPath traversalNo fix publishedCVE-2026-66384
- OSRed Hat LibuserActively exploitedPrivilege escalationNo fix publishedCVE-2015-3246
- OSRed Hat Automatic Bug Reporting ToolActively exploitedPath traversalNo fix publishedCVE-2015-5287
- SoftwareMicrosoft SQL ServerActively exploitedRemote code executionNo fix publishedCVE-2019-1068
- SoftwareAjax.NET ProfessionalActively exploitedUnsafe deserialisationNo fix publishedCVE-2021-23758
- OSLinux KernelActively exploitedDenial of serviceNo fix publishedCVE-2022-0995
- NetworkCitrix NetScaler ADC and NetScaler GatewayActively exploitedDenial of serviceNo fix publishedCVE-2026-8452
- SoftwareGiteaActively exploitedRemote code executionNo fix publishedCVE-2026-60004
- SoftwareOracle HTTP Server and Oracle Weblogic Server Proxy Plug-inActively exploitedAuthentication bypassNo fix publishedCVE-2026-21962
- SoftwareSynacor Zimbra Collaboration Suite (ZCS)Actively exploitedRemote code executionNo fix publishedCVE-2026-73570
- SoftwareTrueConf ServerActively exploitedAuthentication bypassNo fix publishedCVE-2026-72529
- SoftwareTrueConf ServerActively exploitedRemote code executionNo fix publishedCVE-2026-72530
- SoftwareMLflowActively exploitedServer-side request forgeryNo fix publishedCVE-2026-64849
- SoftwareMicrosoft Internet Key Exchange (IKE) Service ExtensionsActively exploitedRemote code executionNo fix publishedCVE-2026-33824
- SoftwareMicrosoft SharePointActively exploitedAuthentication bypassNo fix publishedCVE-2026-55040
- SoftwareBroadcom VMware vCenterActively exploitedPath traversalNo fix publishedCVE-2026-59310
- OSApple macOSActively exploitedAuthentication bypassNo fix publishedCVE-2026-65400
- BrowserRay-Project RayActively exploitedRemote code executionNo fix publishedCVE-2025-62593
- NetworkCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD)Actively exploitedDenial of serviceNo fix publishedCVE-2026-20349
- OSMicrosoft Windows Ancillary Function Driver for WinSockActively exploitedOtherNo fix publishedCVE-2026-68820
- SoftwareMetabaseActively exploitedInjectionNo fix publishedCVE-2026-72898
- SoftwareProgress LoadMasterActively exploitedRemote code executionNo fix publishedCVE-2026-8037
- SoftwareJetBrains TeamCityActively exploitedUnsafe deserialisationNo fix publishedCVE-2026-63077
- SoftwareN-able N-centralActively exploitedAuthentication bypassNo fix publishedCVE-2026-18556
- SoftwareApache TomcatActively exploitedOtherNo fix publishedCVE-2026-34486
- SoftwareIBM LangflowActively exploitedRemote code executionNo fix publishedCVE-2026-9198
- SoftwareN-able N-centralActively exploitedAuthentication bypassNo fix publishedCVE-2026-18577
- NetworkCisco Secure Firewall Management Center (FMC)Actively exploitedOtherNo fix publishedCVE-2026-20316
- NetworkFortinet FortiOSActively exploitedInformation disclosureNo fix publishedCVE-2025-68686
- SoftwareArista VeloCloud OrchestratorActively exploitedRemote code executionNo fix publishedCVE-2026-16812
- SoftwareCheck Point SmartConsoleActively exploitedAuthentication bypassNo fix publishedCVE-2026-16232
- SoftwareMicrosoft SharePointActively exploitedUnsafe deserialisationNo fix publishedCVE-2026-50522
- SoftwareDD-WRTActively exploitedOtherNo fix publishedCVE-2021-27137
- SoftwareLangflowActively exploitedSupply chainNo fix publishedCVE-2026-0770
- SoftwareWordPress CoreActively exploitedInjectionNo fix publishedCVE-2026-60137
- SoftwareWordPress CoreActively exploitedRemote code executionNo fix publishedCVE-2026-63030
- NetworkFortinet FortiSandboxActively exploitedRemote code executionNo fix publishedCVE-2026-25089
- NetworkFortinet FortiSandboxActively exploitedRemote code executionNo fix publishedCVE-2026-39808
- SoftwareMicrosoft SharePointActively exploitedUnsafe deserialisationNo fix publishedCVE-2026-58644
- SoftwareKNX Association KNX Protocol Connection Authorization Option 1Actively exploitedOtherNo fix publishedCVE-2023-4346
- SoftwareOracle E-Business SuiteActively exploitedAuthentication bypassNo fix publishedCVE-2026-46817
- NetworkSonicWall SMA1000 AppliancesActively exploitedServer-side request forgeryNo fix publishedCVE-2026-15409
- NetworkSonicWall SMA1000 AppliancesActively exploitedRemote code executionNo fix publishedCVE-2026-15410
- SoftwareMicrosoft Active Directory Federation ServicesActively exploitedAuthentication bypassNo fix publishedCVE-2026-56155
- SoftwareMicrosoft SharePoint ServerActively exploitedAuthentication bypassNo fix publishedCVE-2026-56164
- OSCisco IOSActively exploitedOtherNo fix publishedCVE-2008-4128
- SoftwareiCagendaActively exploitedOtherNo fix publishedCVE-2026-48939
- SoftwareBalbooa FormsActively exploitedRemote code executionNo fix publishedCVE-2026-56291
- SoftwareAdobe ColdFusionActively exploitedPath traversalNo fix publishedCVE-2026-48282
- SoftwareJoomShaper SP Page BuilderActively exploitedOtherNo fix publishedCVE-2026-48908
- SoftwareLangflowActively exploitedAuthentication bypassNo fix publishedCVE-2026-55255
- SoftwareJoomlack Page BuilderActively exploitedRemote code executionNo fix publishedCVE-2026-56290
- SoftwareMicrosoft SharePoint ServerActively exploitedUnsafe deserialisationNo fix publishedCVE-2026-45659
- SoftwareSimpleHelpActively exploitedCryptographic weaknessNo fix publishedCVE-2026-48558
- SoftwarePTC Windchill and FlexPLMActively exploitedUnsafe deserialisationNo fix publishedCVE-2026-12569
- NetworkCisco Unified Communications ManagerActively exploitedServer-side request forgeryNo fix publishedCVE-2026-20230
- SoftwareLantronix EDS5000Actively exploitedRemote code executionNo fix publishedCVE-2025-67038
- SoftwareUbiquiti UniFi OSActively exploitedAuthentication bypassNo fix publishedCVE-2026-34908
- SoftwareUbiquiti UniFi OSActively exploitedPath traversalNo fix publishedCVE-2026-34909
- SoftwareUbiquiti UniFi OSActively exploitedRemote code executionNo fix publishedCVE-2026-34910
- SoftwareSplunk EnterpriseActively exploitedAuthentication bypassNo fix publishedCVE-2026-20253
- SoftwareWidget Factory Joomla Content EditorActively exploitedAuthentication bypassNo fix publishedCVE-2026-48907
- NetworkCisco Catalyst SD-WAN ManagerActively exploitedPath traversalNo fix publishedCVE-2026-20262
- OSLiteSpeed cPanel PluginActively exploitedPath traversalNo fix publishedCVE-2026-54420
- SoftwareOracle PeopleSoft Enterprise PeopleToolsActively exploitedAuthentication bypassNo fix publishedCVE-2026-35273
- NetworkIvanti SentryActively exploitedRemote code executionNo fix publishedCVE-2026-10520
- BrowserGoogle Chromium V8Actively exploitedRemote code executionNo fix publishedCVE-2026-11645
- NetworkCisco Catalyst SD-WAN ManagerActively exploitedOtherNo fix publishedCVE-2026-20245
- SoftwareArista Extensible Operating SystemActively exploitedOtherNo fix publishedCVE-2026-7473
- SoftwareBerriAI LiteLLMActively exploitedRemote code executionNo fix publishedCVE-2026-42271
- NetworkCheck Point Security GatewayActively exploitedAuthentication bypassNo fix publishedCVE-2026-50751
- SoftwareSolarWinds Serv-UActively exploitedDenial of serviceNo fix publishedCVE-2026-28318
- SoftwareMirasvit Full Page Cache WarmerActively exploitedUnsafe deserialisationNo fix publishedCVE-2026-45247
- OSLinux KernelActively exploitedAuthentication bypassNo fix publishedCVE-2022-0492
- OSAndroid FrameworkActively exploitedPrivilege escalationNo fix publishedCVE-2025-48595
- SoftwareOracle WebLogic ServerActively exploitedOtherNo fix publishedCVE-2024-21182
- NetworkPalo Alto Networks PAN-OSActively exploitedAuthentication bypassNo fix publishedCVE-2026-0257
- SoftwareTanStackActively exploitedOtherNo fix publishedCVE-2026-45321
- SoftwareNx ConsoleActively exploitedSupply chainNo fix publishedCVE-2026-48027
- SoftwareDaemon Tools LiteActively exploitedSupply chainNo fix publishedCVE-2026-8398
- SoftwareLiteSpeed cPanel PluginActively exploitedPrivilege escalationNo fix publishedCVE-2026-48172
- SoftwareDrupal CoreActively exploitedInjectionNo fix publishedCVE-2026-9082
- SoftwareLangflowActively exploitedRemote code executionNo fix publishedCVE-2025-34291
- SoftwareTrend Micro Apex OneActively exploitedPath traversalNo fix publishedCVE-2026-34926
- OSMicrosoft WindowsActively exploitedRemote code executionNo fix publishedCVE-2008-4250
- SoftwareMicrosoft DirectXActively exploitedRemote code executionNo fix publishedCVE-2009-1537
- SoftwareAdobe Acrobat and ReaderActively exploitedRemote code executionNo fix publishedCVE-2009-3459
- SoftwareMicrosoft Internet ExplorerActively exploitedRemote code executionNo fix publishedCVE-2010-0249
- SoftwareMicrosoft Internet ExplorerActively exploitedRemote code executionNo fix publishedCVE-2010-0806
- SoftwareMicrosoft DefenderActively exploitedPath traversalNo fix publishedCVE-2026-41091
- SoftwareMicrosoft DefenderActively exploitedDenial of serviceNo fix publishedCVE-2026-45498
- SoftwareMicrosoftActively exploitedCross-site scriptingNo fix publishedCVE-2026-42897
- NetworkCisco Catalyst SD-WANActively exploitedAuthentication bypassNo fix publishedCVE-2026-20182
No entry matches these filters.
How this register is built
Every morning the register pulls GitHub Security Advisories — reviewed by their security team, rated high or critical, and naming an actual package — along with CISA’s Known Exploited Vulnerabilities catalog.
No entry is written by a model: ecosystem, affected versions, fixed version and score come straight from the cited advisory. Rewriting a version number would only add a chance of error to the one field you are going to copy.
A flaw listed by CISA is marked “actively exploited” and rated critical regardless of its score: a score measures potential, observed exploitation measures a fact.