by Kastro CVE-2026-67870 · mitre
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,897 matching vulnerabilities · Page 109 of 778
mitre
Zbtlink
Unknown
CVE-2026-15210 · Unknown OTP Login With Phone Number, OTP Verification
Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force
CVE-2026-15360 · Unknown Ajax Load More
Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args
CVE-2026-16940 · Unknown Custom Fields
Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
Apache Software Foundation
CVE-2026-61484 · Apache Software Foundation Apache Lucy
Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
CVE-2026-61486 · Apache Software Foundation Apache Lucy
Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input
CVE-2026-60053 · Apache Software Foundation Apache Answer
Apache Answer: Residual Administrative API Key Access After Role or Account Revocation
Miantang
Progress Software Corporation
CVE-2026-9192 · Progress Software Corporation MarkLogic Server
Authentication bypass in Progress MarkLogic Server ODBC App Server
CVE-2026-7329 · Progress Software Corporation MarkLogic Server
Privilege escalation in Progress MarkLogic Server REST query interfaces
CVE-2026-8709 · Progress Software Corporation MarkLogic Server
Privilege escalation in Progress MarkLogic Server REST document patch operation
CVE-2026-9190 · Progress Software Corporation MarkLogic Server
HTTP request smuggling in Progress MarkLogic Server
CVE-2026-9193 · Progress Software Corporation MarkLogic Server
Privilege escalation in Progress MarkLogic Server Hadoop integration
CVE-2026-9195 · Progress Software Corporation MarkLogic Server
Cross-site scripting in Progress MarkLogic Server Query Console
CVE-2026-7557 · Progress Software Corporation MarkLogic Server
SAML authentication bypass in Progress MarkLogic Server
Harsh21Patel
CVE-2026-71248 · Harsh21Patel Inventory-Management-System-PHP
Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion
IBM
CVE-2026-10025 · IBM QRadar
IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability
CVE-2026-8400 · IBM WebSphere Application Server
Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU
CVE-2026-17617 · IBM Application Gateway Operator
Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator
iot-ecology
CVE-2026-71278 · iot-ecology rust-iot-platform
rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
CVE-2026-71277 · iot-ecology rust-iot-platform
rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
IoTSharp
mrswapnilsahu
CVE-2026-71207 · mrswapnilsahu Stock-Inventory-Management-System
Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass
NASA-AMMOS
CVE-2026-71289 · NASA-AMMOS anms
NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API
CVE-2026-71214 · NASA-AMMOS plandev (sequencing-server)
NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server
thebradleysanders
CVE-2026-71231 · thebradleysanders IOTSmartHome
IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie
Cisco
CVE-2026-20272 · Cisco Cisco IOS XE Software
Cisco IOS XE Software Security Hardening Release
CVE-2026-20304 · Cisco Cisco Catalyst SD-WAN Controller
Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities
CVE-2026-20267 · Cisco Cisco IOS XE Software
Cisco IOS XE Software Security Hardening Release
debevv
rxi
thiagoralves
Red Hat
CVE-2026-10059 · Red Hat multicluster engine for Kubernetes 2.1
Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token
CVE-2026-10090 · Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11
Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription
CVE-2026-16442 · Red Hat Red Hat build of Keycloak 26.4
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
CVE-2026-16443 · Red Hat Red Hat build of Keycloak 26.4
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
sh1zen
CVE-2026-5581 · sh1zen Multi Uploader for Gravity Forms
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
stellarwp
CVE-2026-9273 · stellarwp Membership Plugin – Kadence Memberships
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
SUSE
themeruby
CVE-2026-4431 · themeruby Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress
Easy Post Submission <= 2.3.0 - Missing Authorization
cwalter-at
DjangoCRM
Flarum
CVE-2026-39923 · Flarum Flarum Framework
Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Linux
typemill
Google Cloud
CVE-2026-15587 · Google Cloud Google SecOps (Chronicle SOAR)