The archive.

CVE-2026-58508 · Gitea Gitea Open Source Git Server

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

shepherdwind1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2026-73649 · shepherdwind velocity.js

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix)

EPSS 0.7%public exploit CVSS 9.8

IBM12 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2026-17481 · IBM Documentation Offline

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

EPSS 0.9%CVSS 9.8

CVE-2026-17482 · IBM Documentation Offline

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

EPSS 0.8%CVSS 9.8

CVE-2026-17206 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Host Servers

EPSS 0.7%CVSS 9.8

CVE-2026-16867 · IBM i

IBM i is Affected By Multiple Vulnerabilities in NetServer

CVE-2026-17101 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

EPSS 0.6%CVSS 9.6

CVE-2026-17197 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Host Servers

CVE-2026-18193 · IBM i

IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

EPSS 0.5%CVSS 10.0

CVE-2026-14525 · IBM WebSphere Application Server - Liberty

IBM WebSphere Application Server Liberty is affected by an authenication bypass

EPSS 0.5%CVSS 9.4

CVE-2026-16961 · IBM i

IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []

CVE-2026-19297 · IBM Langflow OSS

Insufficient Authentication Brute Force Protection on Login Endpoint

EPSS 0.6%CVSS 9.1

CVE-2026-18249 · IBM i

IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

EPSS 0.4%CVSS 9.9

CVE-2026-16815 · IBM i

IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol

usmannasir1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2026-67614 · usmannasir cyberpanel

CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

EPSS 1.0%CVSS 9.8

vitest-dev1 vulnerability on this pageMax CVSS 9.4Priority 40KEV 0

CVE-2026-73653 · vitest-dev vitest

Vitest: Browser Mode provider commands bypass the file-access permission gate

EPSS 0.8%CVSS 9.4

WPManageNinja2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2026-73532 · WPManageNinja Fluent Forms Pro

Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

EPSS 0.7%CVSS 9.8

CVE-2026-73533 · WPManageNinja Ninja Tables Pro

Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build

AgniHD1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-66465 · AgniHD Cartify

WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Dimitri Grassi1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-66453 · Dimitri Grassi Salon booking system

WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

Cozy Vision Technologies Pvt. Ltd.1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-66424 · Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications

WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

miniOrange1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-61967 · miniOrange miniorange otp verification

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

RsyncProject5 vulnerabilities on this pageMax CVSS 9.2Priority 38KEV 0

scriptsbundle1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-66691 · scriptsbundle Nokri

WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability

triggerdotdev1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-73656 · triggerdotdev trigger.dev

Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state

EPSS 0.5%CVSS 9.9

CPANSec2 vulnerabilities on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2022-4993 · CPANSec

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

EPSS 0.6%CVSS 9.1

CVE-2026-13051 · CPANSec

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template

EPSS 0.6%CVSS 9.1

Elastic1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2026-72676 · Elastic Fleet Server

Improper Control of Generation of Code in Fleet Server Leading to Code Injection

HashiCorp1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2026-8715 · HashiCorp Tooling

Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

EPSS 0.5%CVSS 9.6

OpenIdentityPlatform1 vulnerability on this pageMax CVSS 9.6Priority 36KEV 0

CVE-2026-73644 · OpenIdentityPlatform OpenDJ

OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grant

EPSS 0.4%CVSS 9.6

andy_moyle1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-66478 · andy_moyle Church Admin

WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

denishua1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-61966 · denishua WPJAM Basic

WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

everestthemes1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-66472 · everestthemes Everest Backup

WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

If-So Dynamic Content1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-66446 · If-So Dynamic Content If-So Dynamic Content Personalization

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

JuneAndGreen1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-73567 · JuneAndGreen sm-crypto

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

EPSS 0.4%CVSS 9.1

RealMag7771 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-66436 · RealMag777 Active Products Tables for WooCommerce

WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability

ThimPress1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-66458 · ThimPress RealPress

WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability

Webilia Inc.1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2026-61969 · Webilia Inc. Listdom

WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability