CVE-2026-104848 — Tinypool is a minimal Node.js worker thread pool implementation

CVE-2026-104610 — A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon

CVE-2026-19660 — The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0

CVE-2026-14378 — The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled …

CVE-2026-56660 — GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS

CVE-2026-104286 — An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may al…

CVE-2026-69085 — SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

CVE-2026-103244 — ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode

CVE-2026-92966 — The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0

CVE-2026-102992 — piscina is a node.js worker pool implementation

CVE-2026-55494 — Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

CVE-2026-102911 — A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7

CVE-2026-102794 — A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0

CVE-2026-103041 — LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces

CVE-2026-39117 — An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php

CVE-2026-77177 — Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluati…

CVE-2026-102240 — A vulnerability was found in Netcore NAP930 0.1.241010.141410

CVE-2026-101354 — A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4

CVE-2026-101081 — D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

CVE-2026-101077 — Netcore NR289-GE boa_temp process_request missing authentication

CVE-2026-101074 — A weakness has been identified in Netcore NR289-GE 1.4.5102

CVE-2026-85526 — Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD

CVE-2026-101072 — Netcore NR289-GE CGI ap_ip.cgi system os command injection

CVE-2026-101039 — A vulnerability was identified in FAST FAC1900R 20190827_2.0.2

CVE-2026-101038 — FAST FAC1200R MmtAtePrase stack-based overflow

CVE-2026-88772 — Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-…

CVE-2026-88771 — Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 1…

CVE-2026-82901 — The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50

CVE-2026-97163 — Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97161 — Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97160 — Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-94132 — Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, s…

CVE-2026-94130 — Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries.

CVE-2026-18143 — The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function

CVE-2026-97063 — X-SpringBoot through 6.0 Authentication Bypass via Login Code

CVE-2026-39353 — InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments

CVE-2026-89055 — The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0

CVE-2026-61742 — DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite

CVE-2026-61732 — Decepticon is an autonomous hacking agent for red teams

CVE-2026-93425 — Dokploy is a free, self-hostable Platform as a Service (PaaS)

CVE-2026-97360 — HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside …

CVE-2026-96758 — orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals

CVE-2026-96757 — orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code

CVE-2026-95848 — Moquette is a lightweight Java MQTT broker

CVE-2026-96257 — A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4

CVE-2026-91130 — Home Assistant is open source home automation software focused on local control and privacy

CVE-2026-77254 — MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials

CVE-2026-86059 — Dokploy is a free, self-hostable Platform as a Service (PaaS)

CVE-2026-95675 — D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web manageme…

CVE-2026-78847 — An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.