by Kastro CVE-2026-73034 · eosphoros-ai DB-GPT
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,893 matching vulnerabilities · Page 102 of 778
eosphoros-ai
microsoft
Unknown
CVE-2026-18391 · Unknown WooCommerce Subscriptions
WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection
CVE-2026-15039 · Unknown giftware
Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
CVE-2026-16051 · Unknown wpmudev-updates
WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action
CVE-2026-18366 · Unknown Events Manager
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
CVE-2026-16538 · Unknown Wallet for WooCommerce
TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up
Canonical
baptisteArno
Budibase
Cal.com
CVE-2026-57858 · Cal.com Cal.com Self-Hosted (Cal.diy)
Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
FreeRDP
siyuan-note
CVE-2026-72789 · siyuan-note siyuan
SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
CVE-2026-72794 · siyuan-note siyuan
siyuan before v3.7.4 Session Cookie Key Disclosure via getConf
CVE-2026-72793 · siyuan-note siyuan
SiYuan before v3.7.4 Information Disclosure via /api/system/getConf
CVE-2026-72795 · siyuan-note siyuan
SiYuan before v3.7.4 Information Disclosure via Embed Block
CVE-2026-72798 · siyuan-note siyuan
SiYuan before v3.7.4 Information Disclosure via renderAttributeView
CVE-2026-72804 · siyuan-note siyuan
SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints
SonicWall
CVE-2026-66147 · SonicWall GMS
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which a…
CVE-2026-66145 · SonicWall GMS
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows re…
Apache Software Foundation
CVE-2026-73240 · Apache Software Foundation Apache Allura
Apache Allura: Git command injection
CVE-2026-71290 · Apache Software Foundation Apache HttpComponents Client
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
Red Hat
CVE-2026-73268 · Red Hat multicluster engine for Kubernetes 2.10
Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
CVE-2026-72526 · Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
CVE-2026-73269 · Red Hat multicluster engine for Kubernetes 2.10
Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
CVE-2026-70398 · Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace
fabrikar.com
CVE-2026-67282 · fabrikar.com Fabrik extension for Joomla
Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8
IBM
CVE-2026-16860 · IBM i
IBM i is Affected By Remote Code Execution Vulnerability []
CVE-2026-16956 · IBM Db2 Mirror for i
IBM Db2 Mirror for i is vulnerable to OS command injection []
CVE-2026-17218 · IBM i
IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []
CVE-2026-17276 · IBM i
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
CVE-2026-18847 · IBM i
IBM i is Affected By Multiple Vulnerabilities in Navigator for i
mitre
CVE-2025-59321 · mitre
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state.
CVE-2025-59326 · mitre
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing fo…
CVE-2025-59324 · mitre
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all Cryp…
Phoenix Contact
CVE-2025-41769 · Phoenix Contact AXC F 1152
Unauthenticated Buffer Overflow in PROFINET Service
Progress Software Corporation
CVE-2026-65941 · Progress Software Corporation WhatsUp Gold
WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
prowler-cloud
Strategy11
CVE-2026-16230 · Strategy11 Formidable Digital Signatures
Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
xerrors
Quanovate Tech Inc. (operating as Mira / Mira Care)
CVE-2026-68067 · Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
Mira Hormone Monitor, Mira Android App Weak Authentication
CVE-2026-67568 · Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials
WebPros
joomshaper.com
CVE-2026-67285 · joomshaper.com SP Page Builder extension for Joomla
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0
Essekia
CVE-2026-66659 · Essekia Tablesome Table
WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability
GitLab
owen2345
CVE-2026-73329 · owen2345 CamaleonCMS