By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 32 of 42

• CVE-2026-52957HIGH 7.5

  CVE-2026-52957 is a null pointer dereference vulnerability in the Linux kernel's libceph library that affects how Ceph OSD map messages are decoded. When a Ceph node receives an OSD map containing a CRUSH map with optional choose_args parameters, a specially crafted or corrupted message can reference a bucket index that exists but points to a NULL entry. This causes the kernel to crash when it tries to access that non-existent bucket. The vulnerability requires network access but no authentication, and results in denial of service to the affected system.

• CVE-2026-52960HIGH 7.5

  A memory management bug in the Linux kernel's Ceph filesystem code causes folios (memory pages) to not be properly released when they are unsuitable for writeback operations. When the kernel removes folios from a batch collection, it fails to decrement their reference counters, leaving them pinned in memory. This can exhaust system memory over time and lead to denial-of-service conditions.

• CVE-2026-52974HIGH 7.5

  A memory leak exists in the Linux kernel's TLS (Transport Layer Security) implementation that occurs when the system attempts to offload TLS processing to network hardware and the operation fails. Specifically, when the kernel tries to hand off TLS decryption work to a hardware accelerator and encounters an error, it fails to properly release a temporary data buffer (called an anchor skb) that was allocated during setup. This buffer is never freed, causing memory to leak. The vulnerability only manifests when hardware offload initialization fails; successful offloads and normal connection closures do not trigger the leak.

• CVE-2026-52981HIGH 7.5

  A memory leak has been identified in the Linux kernel's neighbor table networking subsystem. The vulnerability exists in the `neigh_xmit()` function, which is responsible for transmitting network packets through the kernel's neighbor discovery mechanism. Under specific conditions—particularly when a neighbor table is not initialized (such as when IPv6 is disabled but the function is still called)—the function returns an error without properly freeing the associated network buffer (SKB). This means memory is consumed and never released, potentially exhausting system memory over time.

• CVE-2026-52983HIGH 7.5

  A flaw in the Linux kernel's Airoha network driver causes incorrect tracking of in-flight network packets across TX (transmit) queues. The driver counts packets sent through some queues but reports completions for all queues, creating an accounting mismatch that can degrade network performance or trigger scheduler anomalies. This is a kernel-level networking issue that affects systems running vulnerable Linux versions with Airoha hardware.

• CVE-2026-52998HIGH 7.5

  A flaw in the Linux kernel's netfilter subsystem could cause the system to crash when processing certain network packets. The vulnerability stems from code that checks Time-To-Live (TTL) values in network traffic without first confirming that the network device pointer is valid. When the code attempted to access device information without this validation, it could dereference a NULL pointer, leading to a kernel panic. This affects systems running vulnerable versions of the Linux kernel, particularly those using netfilter for network filtering or firewalling.

• CVE-2026-53003HIGH 7.5

  A flaw in the Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) driver allows attackers or misconfigured devices to send specially crafted network frames that can cause system instability. The vulnerability exists because the kernel accepts compressed protocol headers that the PPPoE standard explicitly discourages and that legitimate PPPoE implementations should never use. When such a frame arrives, it causes memory to be misaligned in a way that can crash the system on certain CPU architectures. The fix involves dropping these malformed frames entirely rather than attempting to process them.

• CVE-2026-53026HIGH 7.5

  A logic error in the Linux kernel's NFS server (NFSD) component causes duplicate access counts on file objects when multiple threads concurrently add read access to a delegated write file. This prevents proper cleanup of file resources when the NFS service stops, triggering a kernel crash. The issue is triggered by specific workload patterns—notably the Git project's test suite run over NFS—rather than by direct network attack.

• CVE-2026-53069HIGH 7.5

  A flaw in the Linux kernel's XDP (eXpress Data Path) networking code can crash a system when specific network bonding configurations are exploited. The vulnerability occurs because XDP redirect operations assume bonding devices are fully initialized, but they may not be if the bond was never activated. When an XDP program attempts to redirect traffic through an inactive bond, the kernel tries to access memory structures that were never allocated, causing a null pointer dereference and kernel panic. This affects any Linux system running both bonded network interfaces and XDP-based traffic filtering or forwarding.

• CVE-2026-53070HIGH 7.5

  A Linux kernel vulnerability affects SCTP (Stream Control Transmission Protocol) over UDP networking, where packets are incorrectly dropped due to improper CPU context management. When SCTP traffic is encapsulated over UDP, the kernel's bottleneck handler (BH) is not disabled during transmission, allowing execution context to shift between CPU cores. This breaks an internal counter that tracks packet recursion depth, triggering false positive overflow detection and causing legitimate packets to be silently discarded. The issue manifests as severe throughput degradation—affected systems experience roughly 1% of expected network performance when SCTP over UDP is enabled.

• CVE-2026-53087HIGH 7.5

  A memory leak exists in the Linux kernel's Broadcom GENET network driver. When the driver cleans up the transmit queue during error recovery or shutdown, it discards frames still in flight but fails to return the associated memory buffers back to the free pool. This causes those buffers to become unavailable for reuse, gradually depleting the driver's ability to transmit new data until the system may become unresponsive or crash.

• CVE-2026-53165HIGH 7.5

  A race condition in the Linux kernel's I/O mapping layer can cause a null pointer dereference when the system attempts to report a buffered read error. The vulnerability occurs when multiple read operations complete out of order on the same memory page, and truncate operations simultaneously clear the page's metadata. An attacker with network access could exploit this to crash the system or cause a denial of service, though no active exploitation is currently known.

• CVE-2026-53180HIGH 7.5

  CVE-2026-53180 is a Linux kernel vulnerability in the timer migration subsystem that causes a livelock (infinite loop) condition. When the kernel handles timer expiration across multiple CPUs, it can incorrectly skip processing timers on the local CPU under certain timing conditions. This causes expired timers to remain stuck in the queue, and the system repeatedly checks if they've expired without ever removing them, spinning indefinitely and consuming CPU resources. The vulnerability affects high-availability and real-time systems where timer reliability is critical.

• CVE-2026-53183HIGH 7.5

  A flaw in the Linux kernel's MPTCP (Multipath TCP) implementation allows the receive window to grow larger than intended, potentially causing incoming network traffic to exceed the receiver's buffer capacity. This happens because the kernel incorrectly inflates the TCP-level receive window when data arrives out-of-order or is temporarily held in a backlog, even though the sender is behaving correctly. An attacker on the network could exploit this to send more data than the system can safely handle, leading to a denial of service.

• CVE-2026-53184HIGH 7.5

  A memory safety flaw exists in the Linux kernel's UDP socket handling when used with eBPF socket maps. The kernel accidentally reuses a packet buffer field (skb->dev) to cache memory accounting data, but this cached value persists when the kernel attempts to look up socket information via eBPF programs. When an eBPF socket-lookup helper tries to dereference what it thinks is a network device pointer, it actually reads garbage data, causing a kernel crash. The vulnerability requires a locally-privileged setup of UDP sockets with attached eBPF socket map programs, but once triggered, reliably crashes the kernel.

• CVE-2026-53199HIGH 7.5

  The Linux kernel's Hyper-V network driver (hv_netvsc) has a memory access flaw that causes system crashes during network packet transmission. The vulnerability arises when the driver attempts to copy network packet data into a shared memory buffer used for communication with the Hyper-V hypervisor. On 32-bit x86 systems with high memory support enabled, certain pages (specifically user-space or cached pages) can exist above a memory boundary where the driver's address translation method breaks down. When the driver tries to access these incorrectly translated addresses, it triggers a fatal fault in the networking code path. The fix replaces the flawed address translation with proper page mapping functions that work correctly regardless of where the page resides in memory.

• CVE-2026-53229HIGH 7.5

  A memory leak vulnerability exists in the Linux kernel's mlx5e network driver, specifically in the XSK (AF_XDP zero-copy socket) transmission path. When the driver attempts to transmit an XDP frame but fails because its transmit queue is full, it neglects to release DMA mappings and free the frame buffer. Over time, this causes accumulated DMA memory leaks that are particularly visible when the driver is unloaded. The vulnerability is triggered during normal XDP_TX operations on systems using Mellanox network adapters with AF_XDP sockets.

• CVE-2026-53235HIGH 7.5

  A vulnerability exists in the Linux kernel's Generic Receive Offload (GRO) handling path. The kernel attempts to pull data from a network packet without verifying that the data is actually available in the expected location. When packets arrive through certain network paths with fragmented data, this check is bypassed, causing the kernel to crash. The fix adds a safety check before accessing the data, ensuring the packet structure is valid before manipulation.

• CVE-2026-53244HIGH 7.5

  A flaw in the Linux kernel's file creation code can leave a parent directory locked indefinitely when certain error conditions occur during file creation via NFS exports. The vulnerability exists in how the kernel handles failed file creation attempts on filesystems that support atomic create operations, causing the parent directory lock to never be released. This can lead to system hangs or denial of service when affected NFS clients or servers attempt file operations.

• CVE-2026-53284HIGH 7.5

  CVE-2026-53284 is a Linux kernel vulnerability in the Btrfs filesystem driver that affects how dirty page writes are managed during filesystem transactions. When a write operation fails, the kernel incorrectly clears its internal tracking of pending disk writes without properly handling those unsaved changes. This leads to memory and state management issues that can cause the filesystem to crash or become read-only during shutdown. The vulnerability requires no special privileges or user interaction to trigger—a combination of filesystem stress and an I/O error can initiate it.

• CVE-2026-53432HIGH 7.5

  fzf, a popular command-line fuzzy finder tool, contains an integer overflow vulnerability in its FuzzyMatchV2 matching function. When processing extremely large input—around 2.2 million bytes—combined with a moderately long search pattern of 999 bytes, an arithmetic operation overflows and causes the application to crash immediately. This is a denial-of-service issue: attackers cannot steal data or gain unauthorized access, but they can reliably crash any system running vulnerable fzf versions. The vulnerability affects deployments where fzf processes untrusted or user-supplied input at scale.

• CVE-2026-53433HIGH 7.5

  fzf, a popular command-line fuzzy finder tool, contains a denial of service vulnerability in its --listen mode HTTP server. When a malicious actor sends a specially crafted HTTP POST request with many small segments, the server's request processing becomes extremely slow due to inefficient string concatenation. Because fzf's HTTP server is single-threaded, this attack can freeze the entire service, preventing legitimate users from accessing it. The vulnerability affects fzf versions prior to 0.73.1 and requires only network access to exploit—no authentication or user interaction is needed.

• CVE-2026-53460HIGH 7.5

  ImageMagick, a widely-used open-source image processing library, contains a flaw that allows an attacker to crash applications or services using it by triggering excessive memory allocation. When processing specially crafted image requests, the software fails to validate whether memory requests are reasonable before attempting to fulfill them, leading to out-of-memory conditions. An attacker can exploit this remotely without authentication to deny service to legitimate users.

• CVE-2026-53461HIGH 7.5

  ImageMagick, a widely-used open-source image processing suite, contains a flaw in its ICON file decoder that can trigger an out-of-bounds memory write. When processing a specially crafted ICON file, the decoder's loop logic fails to properly validate boundaries, allowing data to be written beyond allocated heap memory. This results in application crashes and potential memory corruption. The vulnerability affects ImageMagick versions prior to 6.9.13-50 (legacy branch) and 7.1.2-25 (current branch).

• CVE-2026-53482HIGH 7.5

  Dell PowerProtect Data Domain versions from 7.7.1.0 through 8.7, including multiple long-term support (LTS) releases, contain an integer overflow vulnerability that allows unauthenticated remote attackers to crash the system, disrupting backup and recovery operations. The vulnerability requires no authentication and no user interaction—an attacker simply needs network access to trigger a denial-of-service condition.

• CVE-2026-53539HIGH 7.5

  Python-Multipart, a popular library for parsing multipart form data in Python applications, contains a performance flaw that allows attackers to cause denial-of-service by sending specially crafted form submissions. When processing form data that uses semicolons as field separators, the parser inefficiently scans the entire remaining buffer for ampersands before falling back to semicolon detection. An attacker exploiting this flaw can send requests with many semicolon-separated fields that cause the parser to consume excessive CPU time, potentially exhausting server resources and degrading service for legitimate users.

• CVE-2026-5356HIGH 7.5

  The LatePoint calendar booking plugin for WordPress contains a payment processing flaw that allows attackers to manipulate Stripe transactions without authentication. Specifically, the plugin accepts payment confirmation tokens directly from users rather than verifying them server-side, enabling someone to reuse a previously successful payment receipt to conduct unauthorized charges. This is a direct input validation failure that puts any WordPress site using the plugin at risk of financial fraud.

• CVE-2026-53571HIGH 7.5

  Vite, a popular JavaScript frontend build tool, has a vulnerability on Windows systems that allows attackers to read sensitive files—like environment variables and SSL certificates—that should be blocked. The vulnerability exploits Windows-specific file path features (NTFS Alternate Data Streams and 8.3 short filenames) that Vite's security checks don't properly handle. An unauthenticated attacker on the network can request these files directly from the dev server and receive their contents, bypassing the intended protections.

• CVE-2026-53754HIGH 7.5

  Crawl4AI, an open-source web crawler designed to work with large language models, contains a server-side request forgery (SSRF) vulnerability in its Docker API server. The vulnerability stems from incomplete IP address filtering that allows attackers to bypass security controls and access internal services and cloud metadata endpoints. Because the Docker API runs without authentication by default, an attacker can exploit this flaw remotely without credentials to reach sensitive internal systems.

• CVE-2026-53779HIGH 7.5

  WebP Server Go version 0.14.4 and earlier contains a path traversal vulnerability that allows attackers to read files outside the intended image directory on Windows systems. An attacker can craft specially formatted web requests using percent-encoded backslashes to bypass security checks and access arbitrary files that the web server process can reach. This affects Windows deployments specifically, where the vulnerability exploits how Go's path handling differs from Windows' native file system behavior.

• CVE-2026-53834HIGH 7.5

  OpenClaw versions before 2026.4.27 contain an authorization bypass flaw in how it handles QQBot slash commands. Authenticated users can trigger these commands in a way that skips the access control policies meant to restrict who can use them. Depending on how an organization configures OpenClaw, this could allow blocked users to execute commands they shouldn't have access to.

• CVE-2026-53868HIGH 7.5

  Capgo versions before 12.128.2 contain a vulnerability that allows attackers to lock legitimate users out of their accounts for extended periods. An attacker can register a new account using someone else's email address without needing to verify ownership of that email. Once registered, the attacker can initiate a deletion process that leaves the email in a pending deletion state for 30 days, preventing the legitimate owner from using that email to access or recover their account. This is a denial of service attack that exploits gaps in email verification during account creation and deletion workflows.

• CVE-2026-53869HIGH 7.5

  Hermes Agent versions before 0.16.0 have a DNS rebinding vulnerability affecting WebSocket communication endpoints. Attackers can trick the application into accepting requests from attacker-controlled domains by manipulating DNS responses, then use those connections to inject commands or extract sensitive terminal output. The vulnerability exists because security validation middleware is skipped for WebSocket upgrade requests on specific API endpoints.

• CVE-2026-53872HIGH 7.5

  picklescan versions before 0.0.35 contain a critical flaw in how they handle pickled data. An attacker can craft a malicious pickle file that chains together Python's file I/O and URL libraries to read files from the server (like /etc/passwd) and send them to an external attacker-controlled location. No authentication is required, and the attack works over the network. While the vulnerability is sometimes described as RCE-focused, this specific chain achieves data exfiltration—reading and stealing sensitive files rather than executing arbitrary commands.

• CVE-2026-53916HIGH 7.5

  Apache ActiveMQ has a vulnerability that allows an attacker without credentials to crash the message broker by sending specially crafted data over a STOMP connection. The attacker sends header bytes that never end, causing the broker to accumulate them in memory indefinitely until the Java process runs out of heap space and fails. This is a straightforward denial-of-service attack that requires only network access to the STOMP port.

• CVE-2026-53917HIGH 7.5

  Apache ActiveMQ has a denial-of-service vulnerability where authenticated users can crash the broker by sending a specially crafted message with an oversized map size declaration. When the broker tries to allocate memory based on this inflated size value without validation, it exhausts available memory and crashes. This affects multiple ActiveMQ products across two version families: 5.x releases before 5.19.8 and 6.x releases from 6.0.0 through 6.2.6.

• CVE-2026-53923HIGH 7.5

  vLLM, a popular inference engine for large language models, contains a memory leak vulnerability in how it processes quantized model weights. When the system allocates GPU memory for output tensors, a mathematical error causes the processing kernel to only fill part of the allocated space, leaving the remainder untouched. In shared multi-user deployments, this unfilled memory may contain sensitive inference data from other users' requests—potentially exposing prompts, model outputs, or intermediate computations. The flaw affects all versions from 0.5.5 through 0.23.0, and is resolved in version 0.23.1rc0 and later.

• CVE-2026-53950HIGH 7.5

  Ghost's ActivityPub integration (@tryghost/activitypub) is susceptible to JavaScript injection when users interact with posts from a maliciously configured ActivityPub server. An attacker controlling a federated server can craft malicious content that executes arbitrary JavaScript in the context of a Ghost instance, potentially compromising user sessions or data. The vulnerability requires user interaction—specifically viewing or engaging with a malicious post—but poses significant risk to multi-user Ghost deployments and federated content ecosystems. Version 3.1.0 and later eliminate this attack vector.

• CVE-2026-54059HIGH 7.5

  A flaw in Pillow (a widely-used Python image processing library) before version 12.3.0 allows attackers to craft malicious PCF font files that trigger excessive memory allocation on systems that process them. When a vulnerable version of Pillow reads such a file, it fails to validate the font's internal dimensions properly, potentially exhausting available memory and crashing the application or system. The vulnerability requires no user authentication or special privileges—a remote attacker can exploit it by simply hosting or distributing a poisoned font file.

• CVE-2026-54060HIGH 7.5

  Pillow, a widely-used Python library for image manipulation, contains a vulnerability in how it processes font files. When converting fonts to bitmap format, the library can be tricked into allocating excessive memory without proper safety checks, causing the application to consume resources uncontrollably and crash. This affects Pillow versions before 12.3.0. An attacker can exploit this by providing a specially crafted font file to any application using Pillow, requiring no special privileges or user interaction.

• CVE-2026-54063HIGH 7.5

  Excelize, a popular Go library for handling Excel spreadsheets, contains a flaw in how it processes XML row definitions. When opening a malicious XLSX file, the library fails to validate the row count before allocating memory, allowing attackers to either exhaust system memory or crash the application. No login or user interaction is required—simply opening a crafted file triggers the problem. Services that process user-supplied Excel files are at risk.

• CVE-2026-54066HIGH 7.5

  SiYuan, an open-source personal knowledge management system, contains a path traversal vulnerability in its publish mode that allows unauthenticated attackers to read sensitive files from the server. The vulnerability exists because a previous patch for a similar issue only fixed one route (/export/) but left the same weakness in another route (/assets/). By using double-URL-encoding to bypass sanitization, an attacker can download configuration files containing credentials, database files, and logs—all without needing to log in. This affects versions prior to 3.7.0.

• CVE-2026-54091HIGH 7.5

  File Browser is a file management tool that lets users upload, delete, preview, rename, and edit files in designated directories. It also supports sharing directories publicly via special URLs. A flaw in how File Browser handles these public shares allows an attacker who knows a public share URL to bypass access restrictions the owner set up. Specifically, the vulnerability occurs because File Browser checks permissions using paths relative to the shared directory rather than the owner's full filesystem, enabling an attacker to access files the owner explicitly blocked—as long as those files are nested under the shared directory. No authentication is required; the attacker simply needs the public URL.

• CVE-2026-54094HIGH 7.5

  File Browser, a file management interface used for uploading, deleting, previewing, renaming, and editing files, contains a symlink-following vulnerability that allows attackers to escape the intended directory scope. Before version 2.63.14, the HTTP file handlers do not validate symlink targets before serving or accessing files. This means a user with restricted access to a specific directory—or even an unauthenticated user with public-share permissions—can craft a symlink with a path that appears to be within their allowed scope but actually points to files outside that boundary. An attacker can exploit this to read, write, or enumerate sensitive files outside the intended scope.

• CVE-2026-54234HIGH 7.5

  vLLM, a widely-used inference engine for large language models, contains a flaw in its speculative decoding logic that can crash the service. When processing certain multi-request workloads, the rejection sampler can generate an invalid token value that the engine mishandles, eventually triggering a GPU-side assertion failure. Because this crash can be triggered remotely via the public gRPC API, an unauthenticated attacker can repeatedly crash shared inference workers, disrupting service for all other users until manual restart. The issue affects all versions prior to 0.24.0.

• CVE-2026-54268HIGH 7.5

  Angular's date formatting functionality contains a flaw that allows attackers to trigger excessive CPU and memory consumption on applications using the framework. By sending a specially crafted date format string—particularly one with repeating patterns or extreme length—an attacker can cause the application to slow dramatically or become unresponsive. This affects Angular's formatDate function and the widely-used DatePipe component. The vulnerability requires no authentication and can be exploited remotely, making it a practical denial-of-service vector for any internet-facing Angular application that accepts user-influenced date formatting parameters.

• CVE-2026-54273HIGH 7.5

  AIOHTTP, a popular Python framework for handling asynchronous web requests, has a flaw in how it manages incoming HTTP requests. Before version 3.14.1, the system did not limit how many requests could be queued up at once. An attacker can exploit this by sending many requests in rapid succession, causing the application to consume excessive memory until it crashes or becomes unresponsive. This is a denial-of-service vulnerability that affects applications relying on older versions of AIOHTTP.

• CVE-2026-54274HIGH 7.5

  AIOHTTP, a popular Python framework for building asynchronous web applications, has a flaw in how it handles websocket connections. An attacker can send specially crafted incomplete websocket frames that are larger than normal to consume excessive memory on the server, potentially causing the application to become unresponsive or crash. This is a denial-of-service issue affecting versions before 3.14.1.

• CVE-2026-54275HIGH 7.5

  AIOHTTP, a popular Python framework for asynchronous HTTP communication, has a TLS validation weakness in versions before 3.14.1. When applications reuse connections to the same domain while changing the server_hostname parameter between requests, the library may incorrectly allow connections that should be rejected. This means an attacker could potentially intercept traffic if they control the network path and the application is configured to use different hostnames for the same connection pool.

• CVE-2026-54277HIGH 7.5

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in its C-optimized parser that allows attackers to send HTTP requests with oversized lines that bypass size restrictions. This can cause the parser to consume excessive memory, potentially crashing the service or rendering it unresponsive. The vulnerability affects versions before 3.14.1 when using the default pre-built C parser implementation.

• CVE-2026-54278HIGH 7.5

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in how it handles compressed request bodies during cleanup operations. An attacker can craft a specially compressed payload that, when processed by vulnerable versions, decompresses into memory as a single large block—potentially overwhelming system resources and causing denial of service. This is a classic 'zip bomb' scenario applied to HTTP request handling. The issue affects AIOHTTP versions before 3.14.1 and requires no authentication or user interaction to exploit.

• CVE-2026-54279HIGH 7.5

  AIOHTTP, a popular Python framework for building asynchronous HTTP applications, has a cookie handling flaw. When the library saves and restores cookies from disk, it incorrectly forgets which cookies are marked as 'host-only'—a security attribute that restricts cookies to their originating domain. An attacker could exploit this loss of restriction to access or manipulate cookies that should have been tightly scoped, potentially leading to unauthorized actions across domains. The issue affects all versions before 3.14.1.

• CVE-2026-54280HIGH 7.5

  AIOHTTP versions before 3.14.1 fail to properly release file handles and other system resources when a client disconnects during an active write operation. An attacker can exploit this by repeatedly initiating and aborting connections, causing the server to leak file descriptors and other limited resources. Over time, this degrades server performance and availability until the garbage collector intervenes or the process is restarted. The flaw is particularly dangerous in production environments handling high connection volumes.

• CVE-2026-54283HIGH 7.5

  Starlette, a popular lightweight Python web framework, has a vulnerability in how it handles form submissions. When developers configure size limits to protect their applications from being overwhelmed by large requests, those limits fail to work for one common type of form submission (URL-encoded forms). An attacker can exploit this by sending an extremely large or complex form to crash or degrade the application's performance, even when administrators thought they had protective limits in place. The issue affects versions 0.4.1 through 1.3.0 and is fixed in version 1.3.1.

• CVE-2026-54293HIGH 7.5

  NLTK, a popular Python library for natural language processing, contains a path traversal vulnerability in its file-loading mechanism. When using the special `nltk:` URL scheme to load data, an attacker can read arbitrary files from a vulnerable system by encoding path traversal sequences (like forward slashes and dots) as URL hex codes. This bypasses NLTK's documented security checks because the library validates the path before decoding these hex sequences, leaving a window for manipulation. The vulnerability affects all versions before 3.10.0-rc1.

• CVE-2026-54297HIGH 7.5

  Faraday, a popular Ruby HTTP client library, contains a denial-of-service vulnerability in its default query parameter parser. When an application accepts and processes user-supplied query strings through Faraday, an attacker can craft a deeply nested parameter structure that exhausts the Ruby interpreter's call stack, crashing the thread or worker handling that request. This affects Faraday versions 1.0.0 through 1.10.5 and 2.x through 2.14.2. The vulnerability has been patched in versions 1.10.6 and 2.14.3.

• CVE-2026-54299HIGH 7.5

  Astro, a modern web framework, has a vulnerability in its server-side rendering (SSR) feature when prerendered error pages are enabled. When an error occurs at runtime, Astro fetches prerendered 404 or 500 error pages over HTTP. The problem: it constructs the fetch URL using the Host header from the incoming request without validating it against a whitelist of allowed domains. An attacker can craft a malicious Host header to redirect this fetch to a server they control, potentially allowing them to read sensitive response content. This affects Astro versions before 6.4.6.

• CVE-2026-54314HIGH 7.5

  n8n, an open-source workflow automation platform, has a vulnerability in its Compression node that allows an attacker to crash the entire n8n instance by uploading a malicious compressed file. Before version 2.24.0, the decompression feature did not limit how much data it would expand in memory, so a small file can balloon into gigabytes once decompressed, exhausting available RAM and forcing the process to restart. Since this can be triggered through a public webhook without authentication, any organization running a vulnerable n8n instance accessible over the network faces availability risk.

• CVE-2026-54341HIGH 7.5

  DragonflyDB, an in-memory data store, contains a vulnerability in how it processes RESTORE commands that can crash the entire server. An attacker without credentials can send a specially crafted command (roughly 24 bytes) to trigger this crash repeatedly. Because DragonflyDB runs without authentication by default, this is a straightforward remote denial-of-service attack. The issue affects all versions prior to 1.39.0 and is resolved in that release.

• CVE-2026-54399HIGH 7.5

  Apache HttpComponents Core is a widely-used Java library for building HTTP clients and servers. A vulnerability in its HTTP/1.1 message parser allows attackers to crash services or render them unresponsive by flooding them with requests containing unusually large numbers of headers or extremely long header values. The parser consumes memory without adequate limits, leading to exhaustion and denial of service. This affects versions 5.4.2 and earlier, as well as the 5.5-beta1 release.

• CVE-2026-54405HIGH 7.5

  A vulnerability in Ubiquiti's UniFi Network Application allows an attacker already present on your network to crash or disable the application by sending specially crafted requests. The flaw stems from inadequate validation of incoming data. While an attacker must have network access to exploit this, the impact is significant—your UniFi infrastructure could become unavailable, disrupting network management and potentially affecting connected devices.

• CVE-2026-54409HIGH 7.5

  UniFi Protect cameras contain an authentication bypass vulnerability that could allow an attacker with network access to gain unauthorized control over the cameras. The flaw stems from improper initialization during the application startup process. An attacker would need to be on the network and satisfy certain conditions—including user interaction—to successfully exploit this weakness, making it moderately difficult but still a serious risk in environments where the attacker has already gained network-level access.

• CVE-2026-54417HIGH 7.5

  A flaw in the rxi microtar library version 0.1.0 allows an attacker to send a specially crafted tar archive that causes applications processing it to hang indefinitely at high CPU usage. The vulnerability stems from how the library calculates offsets when reading tar records; specific file sizes trigger integer overflow, causing the parser to loop over the same record repeatedly instead of advancing through the archive. Any tool or service that uses this library to extract or list tar files becomes vulnerable to denial of service.

• CVE-2026-54428HIGH 7.5

  Apache HttpComponents Core, a widely-used Java library for HTTP communication, contains a denial-of-service vulnerability in its HTTP/2 header decompression handler. An attacker can send specially crafted oversized compressed headers to exhaust server memory before the library's safety limits kick in, crashing the service. This affects versions 5.4.2 and earlier, including the 5.5-beta1 release.

• CVE-2026-54475HIGH 7.5

  Apache ActiveMQ has a missing authorization vulnerability that breaks the isolation of temporary message destinations. These destinations are supposed to be private to each client connection, but the check exists only on the client side. An attacker with network access can bypass this by connecting directly to the broker and consuming messages from another connection's private temporary destination. This allows unauthorized message interception without requiring credentials or authentication bypass.

• CVE-2026-54499HIGH 7.5

  Stanza, Stanford's popular NLP library for Python, contains a code execution vulnerability in versions before 1.12.2. When loading pre-trained language models (such as tokenization or named entity recognition models), the library attempts a safe loading mode first but falls back to an unsafe mode when it encounters certain errors. An attacker can craft a malicious model file (.pt format) that exploits this fallback behavior to run arbitrary code on a user's machine during the normal process of loading a language model. The vulnerability requires user interaction—someone must attempt to load the malicious model—but no special privileges or network access are required beyond hosting or distributing the bad model file.

• CVE-2026-54592HIGH 7.5

  Oj is a widely-used Ruby gem for parsing and marshalling JSON data. Versions before 3.17.3 contain a stack buffer overflow vulnerability triggered when the Oj::Doc#each_child method is called recursively on deeply nested JSON. The vulnerability stems from a missing bounds check and a missing restoration of an internal pointer (doc->where) during recursive traversal. An attacker can craft a malicious JSON document with excessive nesting depth to overflow a fixed 800-byte stack buffer, causing the Ruby process to crash. This results in a denial-of-service condition affecting any application using vulnerable Oj versions to parse untrusted JSON input.

• CVE-2026-54695HIGH 7.5

  Pipecat is an open-source Python framework for building voice and AI agents. Versions before 1.4.0 expose an unauthenticated WebSocket endpoint used for development and testing that allows attackers to supply a call ID and trigger authenticated call-control commands (hang-up requests) to Twilio, Telnyx, and Plivo telephony providers using the server operator's own credentials. An attacker on the network can abuse this to disrupt active calls or perform unauthorized call terminations.

• CVE-2026-54772HIGH 7.5

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a flaw that allows unauthenticated attackers to exhaust server resources by triggering improper end-of-file handling during the connection handshake. An attacker can force a server thread to consume 100% CPU per malicious connection, effectively starving legitimate traffic. The vulnerability affects three transport bindings used for inter-process and network communication and requires no authentication or special privileges to exploit.

• CVE-2026-54810HIGH 7.5

  Nexi XPay, a payment processing platform, contains a missing authorization vulnerability that allows attackers to bypass access control mechanisms. An unauthenticated attacker on the network can exploit incorrectly configured security levels to gain unauthorized access to functions or data they should not reach, potentially causing service disruption. This is a network-accessible vulnerability requiring no user interaction or authentication to trigger.

• CVE-2026-54816HIGH 7.5

  Monetizemore Advanced Ads contains a code injection vulnerability that allows authenticated attackers to execute arbitrary code remotely through the application. The flaw exists in versions up to 2.0.21 and stems from insufficient validation when the plugin generates or processes code, creating an opening for an attacker with login credentials to inject malicious instructions that the server will then execute.

• CVE-2026-54829HIGH 7.5

  A SQL injection vulnerability exists in WP Photo Album Plus through version 9.1.13.005 that allows attackers to extract sensitive database information through blind SQL injection techniques. Unlike standard SQL injection, blind attacks don't directly display query results; instead, attackers infer data by observing application behavior—making detection harder but exploitation still feasible without special privileges or user interaction.

• CVE-2026-54830HIGH 7.5

  Five Star Restaurant Reservations versions 2.7.19 and earlier contain an unauthenticated access control vulnerability that allows attackers to modify reservation data without logging in or providing credentials. An attacker can directly manipulate reservations—potentially altering bookings, canceling reservations, or disrupting restaurant operations—by sending crafted requests to the application. No authentication is required, and no user interaction is needed to exploit the flaw.

• CVE-2026-54834HIGH 7.5

  A vulnerability in Object Cache 4 everyone plugin versions 2.3.2 and earlier allows attackers to access sensitive cached data without authentication. Because the plugin stores application data in a cache layer accessible over the network, an unauthenticated attacker can retrieve this information directly, potentially exposing user credentials, API keys, session tokens, or other confidential information that the application caches. The vulnerability requires no special tricks to exploit—simply network access to the cache endpoint is sufficient.

• CVE-2026-54835HIGH 7.5

  Five Star Restaurant Menu versions 2.5.2 and earlier contain a critical access control flaw that allows unauthenticated attackers to modify data through the application without providing credentials. An attacker on the network can directly change menu information, pricing, or other sensitive restaurant data without logging in, potentially disrupting operations or altering customer-facing information.

• CVE-2026-54837HIGH 7.5

  A critical access control flaw in Intranet & Private Site – All-In-One Intranet up to version 1.8.1 allows unauthenticated attackers to view sensitive information. The vulnerability stems from missing authorization checks, meaning someone without credentials can potentially access confidential data that should be restricted to authenticated users. The issue affects confidentiality but does not enable attackers to modify data or disrupt service.

• CVE-2026-54839HIGH 7.5

  Trinity Backup, a WordPress backup and migration plugin, contains a critical flaw that allows unauthenticated attackers to access sensitive backup data without any login credentials or interaction from site administrators. The vulnerability affects all versions up to and including 2.0.9. An attacker can directly retrieve backup files and restoration data over the network, potentially exposing database contents, configuration files, and other sensitive site information. This is a straightforward exposure of protected data with no authentication barrier.

• CVE-2026-54846HIGH 7.5

  A security flaw in Syncee Premium Dropshipping & Wholesale plugin (version 1.0.27 and earlier) allows unauthenticated attackers to access sensitive data without requiring login credentials or special permissions. The vulnerability stems from broken access controls that fail to properly verify user identity before exposing confidential information. While attackers cannot modify or delete data through this flaw, the unauthorized disclosure of information poses a significant confidentiality risk to users running affected versions.

• CVE-2026-54904HIGH 7.5

  concurrent-ruby, a popular Ruby concurrency library, contains a critical flaw in its AtomicReference#update method. When an AtomicReference contains the special floating-point value NaN (Not-a-Number), calling update() causes the application to enter an infinite retry loop. This happens because NaN has a unique mathematical property: NaN never equals itself, even when compared to itself. The update method keeps retrying indefinitely, consuming CPU resources and potentially freezing requests or background jobs. This affects applications that store numeric data derived from external sources in AtomicReferences and then attempt to update them.

• CVE-2026-5497HIGH 7.5

  vLLM, an open-source large language model inference engine, contains a denial-of-service vulnerability in how it processes video data. When an attacker sends a specially crafted request containing thousands of JPEG images bundled into a single data URL, the server attempts to decode all of them into memory simultaneously, exhausting available RAM and crashing the service. No authentication is required—the attack works against any exposed vLLM instance running versions 0.8.0 and later. The vulnerability stems from the absence of limits on how many frames the system will process from a single request.

• CVE-2026-55092HIGH 7.5

  Trivy, a popular container security scanner, has a path traversal vulnerability in versions before 0.71.1. When Trivy downloads container images (OCI artifacts), it reads a label called 'org.opencontainers.image.title' from the image metadata and uses it as a filename without checking whether that filename could escape the intended directory. An attacker who controls a container image can craft this label to include path traversal sequences (like '../'), tricking Trivy into writing downloaded content to arbitrary locations on the host system. This could allow an attacker to overwrite critical files or place malicious content where it will be executed.

• CVE-2026-55110HIGH 7.5

  A misconfigured CORS setting in UniFi OS allows an attacker to trick an authenticated user into visiting a malicious webpage, where JavaScript can then perform unauthorized actions on the user's UniFi system using their active session. The attacker cannot initiate the attack directly—they need the user to visit the malicious site first—but once there, they gain the same privileges as the logged-in administrator or user, potentially allowing them to modify network settings, access recordings, or reconfigure security policies.

• CVE-2026-55111HIGH 7.5

  A path traversal vulnerability in Ubiquiti's UniFi Protect Floodlight devices allows someone with network access to read files stored on the device itself. An attacker cannot modify or delete files, only view them. This is a network-based vulnerability requiring no special privileges or user interaction to exploit.

• CVE-2026-55112HIGH 7.5

  A privilege escalation vulnerability exists in UniFi OS running the UniFi Protect application. An attacker who already has network access and low-level user privileges can, under specific conditions, exploit improper access controls to gain elevated privileges on the affected device. This allows a low-privileged insider or compromised account to take full control of the host system.

• CVE-2026-55113HIGH 7.5

  A network-based Server-Side Request Forgery (SSRF) vulnerability in UniFi Talk Application allows unauthenticated attackers to trigger denial-of-service conditions and bypass authentication controls on specific API endpoints. The attacker must have network access to the vulnerable system but does not need valid credentials to initiate the attack. This vulnerability is rated HIGH severity due to its potential to disrupt service availability and circumvent security boundaries.

• CVE-2026-55203HIGH 7.5

  HAProxy versions up to 3.4.0 contain an integer overflow bug in how it parses FastCGI protocol frames from backend servers. When a malicious or compromised FastCGI backend sends specially crafted messages with maximum content length (65535 bytes) plus padding, an internal counter wraps around to zero, causing HAProxy to misinterpret where the next message begins. This can lead to request routing errors, response smuggling attacks, or memory corruption. The flaw requires an attacker to control or compromise a FastCGI backend server connected to the HAProxy instance.

• CVE-2026-55204HIGH 7.5

  HAProxy versions through 3.4.0 contain a vulnerability that allows attackers to crash HAProxy worker processes by exploiting how the software handles HTTP/2 header compression under memory constraints. When HAProxy's internal memory pool becomes full, the software fails to properly check whether a memory cleanup operation succeeded before attempting to use its results, leading to a crash. An attacker can remotely trigger this condition by sending specially crafted HTTP/2 requests, causing denial of service without needing authentication or special privileges.

• CVE-2026-55379HIGH 7.5

  Pillow, a widely-used Python image processing library, contains a vulnerability that allows attackers to consume excessive memory on systems processing untrusted BDF (Bitmap Distribution Format) font files. When Pillow reads a maliciously crafted BDF font, it extracts dimension fields without validating whether they would trigger a decompression bomb—a file designed to expand to enormous size in memory. An attacker can supply a BDF font file with extremely large width and height values, causing Pillow to attempt allocating gigabytes of memory, leading to denial of service. The vulnerability bypasses Pillow's built-in protection mechanism that normally catches such attacks.

• CVE-2026-55380HIGH 7.5

  Pillow, a widely-used Python image processing library, contains a flaw in how it handles GD 2.x image files. When Pillow opens a malicious .gd file, it reads dimension information from the file header without validating whether those dimensions are excessively large. This allows an attacker to craft a file that tricks Pillow into allocating enormous amounts of memory on the host system, potentially causing a denial of service. The vulnerability was fixed in Pillow version 12.3.0.

• CVE-2026-55404HIGH 7.5

  yt-dlp and youtube-dl are popular command-line tools for downloading audio and video from the web. When using shortcut-creation options (--write-link, --write-url-link, or --write-desktop-link), these tools can be tricked into generating malicious shortcut files if a video source contains specially crafted metadata. On Windows, an attacker can inject file:// URIs that execute commands when a user opens the shortcut; on Linux, injected newlines in desktop entry files can similarly lead to command execution. Version 2026.7.4 and later address this by properly validating and escaping metadata before writing shortcut files.

• CVE-2026-55420HIGH 7.5

  Discourse, a popular open-source discussion platform, contains a vulnerability in how it processes PDF file uploads under certain non-default server configurations. An authenticated user could exploit this flaw to execute arbitrary code on the server hosting Discourse. The vulnerability affects multiple version branches and has been patched in recent releases across the supported version lines.

• CVE-2026-55446HIGH 7.5

  Langflow versions prior to 1.0.19 contain a denial-of-service vulnerability in the file upload endpoint. An attacker can submit a specially crafted upload request with an extremely long multipart form boundary—without needing to authenticate—causing the application to become unresponsive and unusable for all legitimate users. The impact persists until the service is restarted or manually recovered.

• CVE-2026-55470HIGH 7.5

  HAPI FHIR, a widely-used Java library for healthcare data exchange, contains a regular expression denial-of-service (ReDoS) vulnerability in its DSTU2 module. An unauthenticated attacker can send specially crafted input to the FHIRPathEngine.matches() function, causing the server to enter catastrophic regex backtracking and consume CPU resources until the service becomes unresponsive. This is a regression—a prior patch for a related vulnerability (CVE-2026-45367) fixed the same issue in one function but missed it in another, leaving the attack surface open.

• CVE-2026-55487HIGH 7.5

  pnpm, a widely-used package manager, contains a vulnerability in how it normalizes package source identifiers. Before versions 10.34.2 and 11.5.3, the system would strip parenthesized text from git URLs, tarballs, file paths, and other package sources when checking if they were approved. An attacker could exploit this by crafting a malicious package source that normalizes to match an already-approved source, potentially allowing installation of unauthorized code. The vulnerability requires user interaction (such as running an install command) to trigger, but successful exploitation could grant an attacker significant control over the dependency supply chain.

• CVE-2026-55574HIGH 7.5

  vLLM, a popular open-source engine for running large language models, has a denial-of-service vulnerability in its structured output feature. When users provide a regular expression pattern through the API, vLLM does not validate the pattern's complexity before passing it to its grammar compiler. An attacker can craft a deliberately complex regex pattern with nested quantifiers that causes the inference worker to hang indefinitely, making the service unavailable. The vulnerability affects vLLM versions before 0.24.0 and has been patched in that release.

• CVE-2026-55603HIGH 7.5

  http-proxy-middleware is a popular Node.js library that relays HTTP requests through a proxy. The library includes a helper function called fixRequestBody() designed to re-send request bodies that were already read by middleware. When handling multipart form data (file uploads and form submissions), the library reconstructs the request body by inserting form field values directly into the wire format without escaping carriage return and line feed characters (\r\n). An attacker can exploit this by crafting a form submission where a field value contains these special characters, allowing them to inject additional form fields that the backend server will interpret as separate parameters. This creates a dangerous mismatch: the proxy's body parser validates the original fields, but the upstream server receives and processes injected fields, enabling request smuggling and parameter injection attacks.

• CVE-2026-55677HIGH 7.5

  Echo, a popular Go web framework, has a critical path-handling flaw where its URL router and static file handler interpret encoded paths differently. An attacker can craft URLs with encoded forward slashes (%2F) to bypass access controls and read files that should be protected. The mismatch means the router approves the request, but the file handler decodes the path and serves content it shouldn't. This affects versions before 4.15.3 and 5.2.0.

• CVE-2026-55687HIGH 7.5

  A flaw in Espressif's IoT Development Framework (ESP-IDF) allows attackers to crash devices by sending specially crafted JPEG image data over the network. The vulnerability exists in the JPEG parser's handling of a specific image marker type (DQT, or Quantization Table). When processing these markers, the code fails to validate that a user-supplied index value stays within safe bounds, causing it to write data to unintended memory locations. This corrupts the device's stack and reliably triggers a denial of service, making the affected device unresponsive. No credentials or user interaction are required—an attacker on the network can trigger the crash remotely.

• CVE-2026-55697HIGH 7.5

  pnpm, a widely-used JavaScript package manager, has a vulnerability that allows attackers to execute arbitrary code on a developer's or CI system during package installation. The vulnerability exists in how pnpm handles special dependencies declared in workspace configuration files. An attacker who controls a repository can declare a malicious package as a configuration dependency, which pnpm will then download and execute without proper safeguards. This affects pnpm versions before 10.34.2 and 11.5.3.

• CVE-2026-55727HIGH 7.5

  Genetec Security Center versions 5.14.0.0 through 5.14.178.17 contain a flaw in how they authenticate requests for live video streams. An attacker on the network can bypass this authentication and view live video feeds without credentials. This is a network-accessible vulnerability that requires no user interaction to exploit.