CVE-2026-102992 — piscina is a node.js worker pool implementation

CVE-2026-55494 — Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

CVE-2026-102911 — A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7

CVE-2026-102794 — A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0

CVE-2026-103041 — LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces

CVE-2026-39117 — An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php

CVE-2026-77177 — Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluati…

CVE-2026-102240 — A vulnerability was found in Netcore NAP930 0.1.241010.141410

CVE-2026-101354 — A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4

CVE-2026-101081 — D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

CVE-2026-101077 — Netcore NR289-GE boa_temp process_request missing authentication

CVE-2026-101074 — A weakness has been identified in Netcore NR289-GE 1.4.5102

CVE-2026-85526 — Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD

CVE-2026-101072 — Netcore NR289-GE CGI ap_ip.cgi system os command injection

CVE-2026-101039 — A vulnerability was identified in FAST FAC1900R 20190827_2.0.2

CVE-2026-101038 — FAST FAC1200R MmtAtePrase stack-based overflow

CVE-2026-88772 — Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…

CVE-2026-88771 — Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…

CVE-2026-82901 — The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50

CVE-2026-97163 — Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97161 — Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97160 — Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-94132 — Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, s…

CVE-2026-94130 — Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries.

CVE-2026-18143 — The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function

CVE-2026-97063 — X-SpringBoot through 6.0 Authentication Bypass via Login Code

CVE-2026-39353 — InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments

CVE-2026-89055 — The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0

CVE-2026-61742 — DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite

CVE-2026-61732 — Decepticon is an autonomous hacking agent for red teams

CVE-2026-93425 — Dokploy is a free, self-hostable Platform as a Service (PaaS)

CVE-2026-97360 — HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside …

CVE-2026-96758 — orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals

CVE-2026-96757 — orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code

CVE-2026-95848 — Moquette is a lightweight Java MQTT broker

CVE-2026-96257 — A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4

CVE-2026-91130 — Home Assistant is open source home automation software focused on local control and privacy

CVE-2026-77254 — MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

CVE-2026-86059 — Dokploy is a free, self-hostable Platform as a Service (PaaS)

CVE-2026-95675 — D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web manageme…

CVE-2026-78847 — An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

CVE-2026-88404 — A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

CVE-2026-88402 — A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.

CVE-2026-77521 — MaxKB is an open-source AI assistant for enterprise

CVE-2026-61674 — Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows

CVE-2026-83549 — Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potenti…

CVE-2026-94101 — A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246

CVE-2026-94096 — A vulnerability was found in Netcore NBR200V2 1.3.241127.071246

CVE-2026-89274 — The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1

CVE-2026-92229 — The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2