by Kastro CVE-2026-75411 · mitre
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,711 matching vulnerabilities · Page 77 of 775
mitre
CVE-2026-75414 · mitre
In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command…
CVE-2026-75325 · mitre
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
CVE-2026-75334 · mitre
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution.
CVE-2026-26448 · mitre
Stomper 5e2741e is vulnerable to Use-After-Free.
CVE-2026-75329 · mitre
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism.
CVE-2026-75338 · mitre
disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control.
CVE-2023-42179 · mitre
Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation p…
CVE-2026-68000 · mitre
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.
CVE-2026-75327 · mitre
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file uploa…
CVE-2026-75330 · mitre
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection.
CVE-2026-75336 · mitre
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.
CVE-2025-61165 · mitre
An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to exeute ar…
CVE-2025-61163 · mitre
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.
CVE-2026-51106 · mitre
An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
CVE-2026-75332 · mitre
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
CVE-2026-75340 · mitre
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Se…
CVE-2026-52103 · mitre
A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows atta…
CVE-2025-70293 · mitre
An issue was discovered in Denx U-Boot before 2026.04.
CVE-2025-70290 · mitre
An issue was discovered in Denx U-Boot before 2026.04.
CVE-2025-51679 · mitre
An issue was discovered in openRISC OR1200 commit 83ac6b.
TOTOLINK
cozmoslabs
CVE-2026-19632 · cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
baptisteArno
kimai
Ubiquiti Inc
CVE-2026-77537 · Ubiquiti Inc UniFi Protect Application
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application…
CVE-2026-77533 · Ubiquiti Inc UniFi Protect Application
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi P…
CVE-2026-77535 · Ubiquiti Inc UniFi Network Application
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi…
CVE-2026-77539 · Ubiquiti Inc UniFi OS Server
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi…
CVE-2026-77534 · Ubiquiti Inc UniFi OS Server
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain d…
CVE-2026-77536 · Ubiquiti Inc UniFi OS Server
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain d…
eosphoros-ai
MacWarrior
themefusion
CVE-2026-18431 · themefusion Avada (Fusion) Builder
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Thinking Software Technology
CVE-2026-80235 · Thinking Software Technology EFence
Thinking Software Technology｜EFence - Arbitrary File Upload
Apache Software Foundation
CVE-2026-65637 · Apache Software Foundation Apache Tomcat
Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
CVE-2026-65905 · Apache Software Foundation Apache Tomcat
Apache Tomcat: Limited replay attack possible with DIGEST authentication
CVE-2026-65182 · Apache Software Foundation Apache Tomcat
Apache Tomcat: Bypass longest prefix security constraint
CVE-2026-68525 · Apache Software Foundation Apache Tomcat
Apache Tomcat: Redirect after FORM auth may bypass method specific constraints
Drupal
CVE-2026-16639 · Drupal Internationalization Single Sign-On
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
CVE-2026-16641 · Drupal Commerce Elavon
Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084
CVE-2026-16644 · Drupal Webform REST
Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087
CVE-2026-16645 · Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088
CalcProgrammer1
CPANSec
CVE-2026-78619 · CPANSec
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically
CVE-2026-78655 · CPANSec