The archive.

CVE-2026-55486 · intranda goobi-viewer-core

Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

codexonics1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-115806 · codexonics Prime Mover – Backup and Migration

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

Linux3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-98959 · Linux Linux

btrfs: fix xattr replace when multiple xattrs are packed in the same item

EPSS 0.6%CVSS 9.8

CVE-2026-99078 · Linux Linux

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

CVE-2026-99079 · Linux Linux

net/mlx5e: Prevent stale XSK buffer release on refill retry

AWS1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-115812 · AWS multi-model-server

Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server

Fosowl1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2026-115727 · Fosowl AgenticSeek

AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server

EPSS 0.7%CVSS 9.2

GitroomHQ3 vulnerabilities on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-115931 · GitroomHQ postiz-app

Arbitrary file read and backend crash through unrestricted provider method calls

EPSS 0.5%CVSS 9.9

CVE-2026-115932 · GitroomHQ postiz-app

Path traversal in post media lets any registered user read server files

EPSS 0.4%CVSS 9.6

CVE-2026-115933 · GitroomHQ postiz-app

Forged signed tokens let any registered user take over other users and organizations

EPSS 0.2%CVSS 9.9

paytiumsupport1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-114196 · paytiumsupport Paytium

WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

Python Software Foundation1 vulnerability on this pageMax CVSS 9.4Priority 37KEV 0

CVE-2026-115557 · Python Software Foundation CPython

Distrust compromised intermediate certificates in ssl module

EPSS 0.5%CVSS 9.4

Tribulant Software2 vulnerabilities on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-94075 · Tribulant Software Newsletters

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

CVE-2026-111402 · Tribulant Software Newsletters

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

axiomthemes5 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-112853 · axiomthemes Hallelujah

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

CVE-2026-112857 · axiomthemes Reprizo

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

CVE-2026-112854 · axiomthemes Holistic Center

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

CVE-2026-112855 · axiomthemes Redy

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

CVE-2026-112858 · axiomthemes Rhodos

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

xnau webdesign2 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-112862 · xnau webdesign Participants Database

WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

CVE-2026-112860 · xnau webdesign Participants Database

WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability

CGM4 vulnerabilities on this pageMax CVSS 9.4Priority 35KEV 0

CVE-2025-30047 · CGM CGM CLININET

Remote Code Execution via Java Deserialization in CGM CLININET

EPSS 0.4%CVSS 9.4

CVE-2025-30046 · CGM CGM CLININET

Remote Code Execution in CGM CLININET

EPSS 0.3%CVSS 9.0

CVE-2025-30050 · CGM CGM CLININET

Remote Code Execution in CGM CLININET

EPSS 0.2%CVSS 9.4

CVE-2025-30054 · CGM CGM CLININET

Local Privilege Escalation in CGM CLININET

EPSS 0.1%CVSS 9.3

conda1 vulnerability on this pageMax CVSS 9.9Priority 35KEV 0

CVE-2026-53942 · conda infrastructure

Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN

EPSS 0.3%CVSS 9.9

Hallo Welt! GmbH1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-25784 · Hallo Welt! GmbH BlueSpice

bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

open625411 vulnerability on this pageMax CVSS 9.2Priority 35KEV 0

CVE-2026-116014 · open62541 open62541

open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType

EPSS 0.4%CVSS 9.2

Unknown2 vulnerabilities on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-110956 · Unknown asVereinbase

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

CVE-2026-115214 · Unknown Datawiza Proxy Auth Plugin

Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers

AivahThemes1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-112848 · AivahThemes Hostme v2

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

ThemeREX1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-112847 · ThemeREX ZenSoul

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

ThemeREX Group4 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2026-112846 · ThemeREX Group Save Life

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

CVE-2026-112851 · ThemeREX Group HotLock

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

CVE-2026-112856 · ThemeREX Group Vagabonds

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

CVE-2026-112859 · ThemeREX Group Little Birdies

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

WPFactory1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-112866 · WPFactory Product Filter by WBW

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

EPSS 0.4%CVSS 9.3

DJI1 vulnerability on this pageMax CVSS 9.3Priority 33KEV 0

CVE-2026-114357 · DJI CrystalSky ZS600C

DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

grokability1 vulnerability on this pageMax CVSS 9.2Priority 33KEV 0

CVE-2026-116199 · grokability snipe-it

Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

EPSS 0.3%CVSS 9.2

YesWiki1 vulnerability on this pageMax CVSS 9.1Priority 32KEV 0

CVE-2026-116207 · YesWiki yeswiki

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

agentjido1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2026-107685 · agentjido req_llm

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

Oracle Corporation1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2026-114820 · Oracle Corporation Oracle Java SE

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

parse-community1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2026-116163 · parse-community parse-server

Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses