by Kastro CVE-2026-8985 · Autel MaxiCharger Single
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,897 matching vulnerabilities · Page 126 of 778
Autel
CVE-2026-8984 · Autel MaxiCharger Single
Unauthenticated RCE
CVE-2026-8983 · Autel MaxiCharger Single
Backdoor Authentication Token
CVE-2026-8982 · Autel MaxiCharger Single
Hard-coded / Backdoor Accounts
MervinPraison
CVE-2026-47391 · MervinPraison PraisonAI
PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
CVE-2026-47392 · MervinPraison PraisonAI
PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `execute_code` (subprocess mode)
CVE-2026-47393 · MervinPraison PraisonAI
PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default
CVE-2026-47396 · MervinPraison PraisonAI
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
CVE-2026-47410 · MervinPraison praisonai-platform
praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
CVE-2026-47407 · MervinPraison praisonai-platform
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
CVE-2026-47413 · MervinPraison praisonai-platform
praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
CVE-2026-47416 · MervinPraison praisonai-platform
praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}
home-assistant
CVE-2026-64824 · home-assistant Home Assistant Core
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
CVE-2026-64825 · home-assistant Home Assistant Core
Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
Tenable, Inc.
CVE-2026-64879 · Tenable, Inc. Security Center
Command Injection
CVE-2026-64878 · Tenable, Inc. Security Center
Command Injection
CVE-2026-64877 · Tenable, Inc. Security Center
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the applian…
SepineTam
SolarWinds
CVE-2026-28316 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
CVE-2026-28302 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
CVE-2026-28304 · SolarWinds Serv-U
SolarWinds Serv-U Remote Code Execution Vulnerability
CVE-2026-28305 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
CVE-2026-28308 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
CVE-2026-28312 · SolarWinds Serv-U
SolarWinds Serv-U Privilege Escalation Vulnerability
CVE-2026-28314 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
CVE-2026-28321 · SolarWinds Serv-U
SolarWinds Serv-U Broken Access Control Vulnerability
CVE-2026-28306 · SolarWinds Serv-U
SolarWinds Serv-U Privilege Escalation Vulnerability
CVE-2026-28307 · SolarWinds Serv-U
SolarWinds Serv-U Privilege Escalation Vulnerability
CVE-2026-28309 · SolarWinds Serv-U
SolarWinds Serv-U Broken Access Control Vulnerability
CVE-2026-28310 · SolarWinds Serv-U
SolarWinds Serv-U Privilege Escalation Vulnerability
CVE-2026-28313 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
CVE-2026-28317 · SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
keephq
Mozilla
CVE-2026-16412 · Mozilla Firefox
Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
CVE-2026-16408 · Mozilla Firefox
Integer overflow in the Audio/Video: Playback component
CVE-2026-16410 · Mozilla Firefox
JIT miscompilation in the JavaScript Engine: JIT component
CVE-2026-16360 · Mozilla Firefox
Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
CVE-2026-16411 · Mozilla Firefox
Memory safety bugs fixed in Thunderbird 153
CVE-2026-16361 · Mozilla Firefox
Memory safety bugs fixed in Thunderbird ESR 140.13
EGOR
CVE-2026-59144 · EGOR Data::RingBuffer::Shared
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq
CVE-2026-59147 · EGOR Data::DisjointSet::Shared
Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find
CVE-2026-59139 · EGOR Data::ReqRep::Shared
Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked
CVE-2026-59140 · EGOR Data::SortedSet::Shared
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths
CVE-2026-59141 · EGOR Data::RadixTree::Shared
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked
CVE-2026-59142 · EGOR Data::HashMap::Shared
Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shm_str_copy
CVE-2026-59145 · EGOR Data::Intern::Shared
Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find
Eclipse Foundation
CVE-2026-16441 · Eclipse Foundation OpenJ9
Eclipse OpenJ9 : Method resolution default method precedence failure
CVE-2026-16439 · Eclipse Foundation OpenJ9
Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
Saturday Drive
CVE-2026-65048 · Saturday Drive Ninja Forms
Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
CVE-2026-65049 · Saturday Drive Ninja Forms