By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 33 of 42

• CVE-2026-55760HIGH 7.5

  Handlebars.java is a templating library that lets developers create dynamic content using Mustache templates. Before version 4.5.2, if an application allows user input to determine which template file gets loaded—through URL parameters, form fields, or similar mechanisms—an attacker can exploit this to read arbitrary files from the server's filesystem. The vulnerability exists because the library doesn't properly validate template file paths, allowing traversal sequences (like `../`) to escape the intended template directory. An unauthenticated attacker can exploit this over the network without any special privileges.

• CVE-2026-55844HIGH 7.5

  The Home Assistant iOS companion app has a security flaw where it doesn't properly enforce a whitelist of trusted networks (SSIDs) when deciding whether to use your internal home network address. When the app can't find an external URL to connect with, it falls back to using the internal URL regardless of network rules—potentially exposing your authentication token on untrusted WiFi networks. This was fixed in version 2025.5.0.

• CVE-2026-55952HIGH 7.5

  A vulnerability in Erlang/OTP's TLS 1.3 implementation allows an unauthenticated attacker to crash the session ticket handler by sending a specially crafted TLS handshake message. When a TLS 1.3 server has session tickets enabled, the attacker can send a ClientHello with mismatched identity and binder lists, causing the handler process to crash. This disruption persists until the ssl application is restarted, rendering TLS 1.3 session ticket functionality unavailable on the affected listener. TLS 1.2 connections remain unaffected.

• CVE-2026-55958HIGH 7.5

  A memory corruption vulnerability exists in WolfSSL's Renesas TSIP TLS 1.3 implementation that allows a remote attacker to crash a device by sending an oversized TLS handshake message. The underlying flaw occurs because the code checks whether incoming transcript data exceeds a fixed 8 KB buffer but neglects to stop processing after flagging the error—instead, it continues copying data anyway, writing beyond the buffer boundary. This heap corruption can trigger a denial of service on affected embedded systems. The vulnerability only manifests when using the specific Renesas TSIP hardware acceleration on compatible Renesas microcontrollers running WolfSSL with TLS 1.3 client mode enabled.

• CVE-2026-55960HIGH 7.5

  CVE-2026-55960 is a certificate validation bypass vulnerability in wolfSSL that allows an attacker to present a raw public key as a valid certificate even when raw public keys were never negotiated with the peer. Normally, raw public keys have no chain of trust and should only be accepted in TLS connections where both sides explicitly agreed to use them. This vulnerability bypasses that check, potentially allowing an attacker to impersonate a legitimate server or client. The flaw only affects wolfSSL builds compiled with Raw Public Key (RPK) support enabled, which is off by default in standard builds but included when using the --enable-all compilation flag.

• CVE-2026-55961HIGH 7.5

  wolfSSL's PKCS#7 verification function returns success for certificate-only bundles that contain no actual signatures. This means applications relying on PKCS#7_verify() to authenticate content will incorrectly believe unsigned or improperly signed objects are legitimate. An attacker can craft a degenerate PKCS#7 bundle with empty signature data, and if your application processes it, the verification function falsely confirms its authenticity. This is particularly dangerous for code-signing, email verification, or document authentication workflows.

• CVE-2026-55967HIGH 7.5

  A cryptographic flaw in wolfSSL's AES-GCM streaming implementation fails to reject messages larger than 64 GiB, causing the encryption counter to wrap around and reuse the same keystream. This allows attackers to recover plaintext from encrypted data without knowing the encryption key. The vulnerability requires network access and no authentication, making it a serious confidentiality risk for any application using wolfSSL's streaming APIs with large messages.

• CVE-2026-55993HIGH 7.5

  Apache Camel's WebSocket component has a critical flaw that allows unauthenticated attackers to redirect server-side HTTP requests and steal sensitive configuration data. When a WebSocket endpoint receives connections, it accepts query parameters that get converted into internal Camel headers without validation. An attacker can inject specially crafted parameters to override the HTTP destination URI and trigger exposure of environment variables, application properties, and vault secrets through placeholder resolution. This is particularly dangerous in deployments where the WebSocket endpoint feeds directly into downstream HTTP producers and lacks authentication controls.

• CVE-2026-55994HIGH 7.5

  Apache Camel's Iggy component fails to filter incoming message headers before copying them into the application's internal header map. This allows an attacker who can publish messages to a monitored Iggy stream to inject specially crafted headers that override Camel's internal routing directives. When those messages flow through an HTTP request, the injected headers can redirect the request to an attacker-controlled server (SSRF attack) or leak sensitive data like environment variables and secrets. The vulnerability affects Camel versions 4.17.0 through 4.20.x and requires patching to 4.18.3 (for 4.18 branch users) or 4.21.0 (for current releases).

• CVE-2026-56017HIGH 7.5

  JavaScript::Minifier::XS, a Perl module used to compress JavaScript code, contains a critical flaw that causes immediate crashes when processing certain malformed input. Specifically, if the first substantive character in JavaScript code is a forward slash, the minifier's code reading logic attempts to access memory that doesn't exist, crashing the entire application. An attacker can exploit this by sending a single slash character to any service that uses this library to minify untrusted JavaScript, resulting in a denial of service attack. The vulnerability affects all versions before 0.16.

• CVE-2026-56018HIGH 7.5

  JavaScript::Minifier::XS is a Perl module that compresses JavaScript code. Versions before 0.16 have a memory leak bug: every time the minify() function runs, it fails to properly free memory used for processing tokens. In server environments where minification happens repeatedly—like web asset pipelines or API endpoints that minify on demand—this leak causes the process to consume more memory with each request. Eventually the server runs out of memory and crashes, disrupting service. The vulnerability requires no authentication or user interaction; an attacker can trigger it by simply making repeated minification requests.

• CVE-2026-56060HIGH 7.5

  A vulnerability in the 'Print Invoice & Delivery Notes for WooCommerce' plugin (versions up to 7.1.1) allows attackers to access sensitive customer and order information without needing any authentication. The vulnerability exploits insufficient access controls, meaning someone on the internet could potentially retrieve invoices, delivery details, and associated customer data by manipulating requests to the plugin. This is particularly serious for WooCommerce store owners because the exposed data typically includes customer names, addresses, email addresses, phone numbers, and order values.

• CVE-2026-56069HIGH 7.5

  Toolset Forms versions 2.6.24 and earlier contain an Insecure Direct Object References (IDOR) vulnerability that allows unauthenticated attackers to access or manipulate resources by directly referencing objects without proper authorization checks. An attacker can exploit this flaw over the network without needing credentials, potentially disrupting availability of affected forms and their associated data.

• CVE-2026-56082HIGH 7.5

  Capgo, a build management platform, has a serious access control flaw in a database function that should only work for authenticated users but is accidentally exposed to anonymous users. An attacker with just the public API key can forge billing records, overwrite existing build logs for other companies, and artificially inflate billable time—essentially gaining the ability to sabotage another organization's usage data and financial records without needing any credentials or authentication.

• CVE-2026-56122HIGH 7.5

  Winstone Servlet Engine versions through 0.9.10 have a path traversal flaw that allows anyone on the network to read files outside the intended web directory. By crafting HTTP requests with specially formed paths (containing sequences like '../'), an attacker can retrieve sensitive files from the server without needing credentials. The severity depends on what files the servlet engine process can access—if it runs with elevated privileges, system-level configuration files and credentials become exposed.

• CVE-2026-56124HIGH 7.5

  phpUploader versions before 2.0.2 have a serious information disclosure flaw that exposes sensitive data about uploaded files to anyone on the internet. Without needing to log in, an attacker can visit any page of a phpUploader application and retrieve the complete database table of uploads, which includes uploader IP addresses, password hashes, filenames, and file checksums. This data is embedded directly in the page's JavaScript, making it trivial to extract.

• CVE-2026-56214HIGH 7.5

  Capgo versions before 12.128.2 leak sensitive information about organizations and their payment status through two unprotected backend functions. An attacker with only your public API key—which most applications expose by design—can ask the backend whether any given organization exists and whether they're a paying customer. This enumeration attack doesn't require authentication and can be automated to profile your entire user base or identify lucrative targets for downstream attacks.

• CVE-2026-56219HIGH 7.5

  Capgo versions before 12.128.2 suffer from an authentication bypass that leaks sensitive organizational data. An attacker can request organization membership details, role assignments, and member email addresses by exploiting improper NULL value handling in the authorization layer. The vulnerability requires only a public API key and network access—no valid user credentials needed—making it straightforward to discover and exploit at scale.

• CVE-2026-56226HIGH 7.5

  Capgo before version 12.128.2 contains an authorization flaw in a database function that allows anyone to retrieve sensitive organization and user information without authentication. An attacker can use Capgo's public API key to query arbitrary user IDs and extract membership details, roles, subscription status, and email addresses belonging to other users.

• CVE-2026-56242HIGH 7.5

  Capgo versions before 12.128.2 expose an unauthenticated API endpoint that allows attackers to verify whether an API key is valid and determine which user owns it. By testing API keys against this endpoint, an attacker can build a map of valid keys to user accounts. This becomes dangerous when combined with other exposed endpoints in Capgo that reveal organization membership and contact information, enabling attackers to harvest sensitive identity and organizational data without any authentication.

• CVE-2026-56248HIGH 7.5

  Capgo versions before 12.128.12 contain a flaw that allows anyone on the internet to crash the application without authentication. The vulnerability exists in how the backend handles access to audit logs through its API. Attackers can repeatedly query a specific endpoint with a publicly available key, causing the database to work so hard that it times out and becomes unresponsive. When this happens under sustained attack, it cascades into failures across the entire application, making legitimate features unavailable to users.

• CVE-2026-56250HIGH 7.5

  Capgo before version 12.128.2 contains a flaw that allows attackers with upload-scoped API keys to weaponize the application's internal cleanup mechanisms. By modifying a field that controls where application bundles are stored, an attacker can point it to legitimate user data, then trigger automated deletion routines to destroy those objects. This is a targeted denial-of-service attack where the real damage happens through abuse of a legitimate maintenance function, not direct malicious code.

• CVE-2026-56253HIGH 7.5

  Capgo versions before 12.128.2 have a security gap that lets attackers without credentials view the member roster of any organization. An attacker only needs two pieces of information—a public API key (the kind meant to be embedded in client applications) and an organization's unique identifier—to pull a complete list of members along with their email addresses, user IDs, assigned roles, and any pending invitations. This is a straightforward information-disclosure vulnerability that exposes organizational structure and contact details.

• CVE-2026-56270HIGH 7.5

  Flowise, a popular open-source workflow automation platform, contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive OAuth and SSO configuration details without logging in. By making a simple request to a specific API endpoint with an organization ID, an attacker can harvest OAuth client secrets for major identity providers including Google, Microsoft Azure, GitHub, and Auth0. This flaw affects Flowise versions 3.0.13 and earlier; version 3.1.0 and later include fixes. Organizations running Flowise—whether as a cloud service or self-hosted—with this endpoint exposed are at immediate risk of credential compromise.

• CVE-2026-56279HIGH 7.5

  Capgo versions before 12.128.2 expose a critical information leak where anyone on the internet can request details about any user's organization memberships, roles, and billing information without logging in. The vulnerability exists in a backend function that should have been locked down but remains accessible to unauthenticated requests. An attacker only needs to guess or enumerate valid user IDs to harvest sensitive organizational data.

• CVE-2026-56292HIGH 7.5

  AcyMailing, a popular email marketing extension for Joomla, contains a SQL injection vulnerability in versions before 10.11.1. An attacker can exploit this flaw remotely without authentication to query the underlying database, potentially exposing sensitive information stored within the Joomla installation. The vulnerability is publicly disclosed and carries a HIGH severity rating due to the ease of exploitation and confidentiality impact.

• CVE-2026-56300HIGH 7.5

  Capgo before version 12.128.2 has a security defect where two internal database functions—get_user_id and get_org_perm_for_apikey—are accessible over the network without requiring any authentication. An attacker with knowledge of Capgo's API can call these functions to test whether stolen API keys are valid, discover user identifiers and application names, and learn what permissions those keys grant. This turns a single leaked credential into a roadmap for further compromise, making credential theft significantly more damaging.

• CVE-2026-56322HIGH 7.5

  Capgo versions before 12.128.2 contain a privacy flaw that exposes private channel information to anyone on the internet. An attacker can send requests to Capgo's updates endpoint and, without logging in, probe for the names of private channels. By observing subtle differences in how the system responds to valid versus invalid channel names, attackers can enumerate private channels, discover which app versions are assigned to each channel, and extract platform-specific configuration details. This leakage happens because the system resolves channel parameters before checking whether the requester has permission to access that channel.

• CVE-2026-56323HIGH 7.5

  Capgo versions prior to 12.128.2 expose a serious information leak through an unauthenticated API endpoint. An attacker can query the /functions/v1/channel_self endpoint without credentials and discover non-public channel names, determine which applications exist in the system, and reveal subscription and billing information. This reconnaissance capability gives threat actors a detailed map of your infrastructure and customer footprint without any authentication barrier.

• CVE-2026-56341HIGH 7.5

  AVideo is a video platform software used by organizations to host and manage video content. Versions through 26.0 contain a critical flaw: several payment-related features expose sensitive financial data without requiring authentication. An attacker on the internet can request information from these vulnerable endpoints and receive complete payment records—including PayPal tokens, Authorize.Net webhook credentials, Bitcoin transaction details, and user financial information—simply by making direct HTTP requests. No login, no special tools, no complex attack chain required.

• CVE-2026-56669HIGH 7.5

  Elysia, a TypeScript framework for building and validating web services, contains a performance flaw in how it processes file upload forms. When handling multipart/form-data requests (the standard for file uploads), the framework uses an inefficient algorithm that causes CPU usage to spike dramatically as more form fields are submitted. An attacker can exploit this by sending a request with many form fields, forcing the server to consume excessive CPU resources and become unresponsive. This is a denial-of-service vulnerability that requires no authentication and can be triggered remotely.

• CVE-2026-56770HIGH 7.5

  CVE-2026-56770 is a denial-of-service vulnerability in libais, a library used to decode Automatic Identification System (AIS) messages from maritime vessels. The flaw allows attackers to crash services or vessel navigation systems by sending malformed AIS radio messages (AIVDM sentences) with invalid sequential message identifiers. When the library processes these crafted messages, it uses an unchecked index value that causes the application to access memory outside safe bounds, leading to a crash. This affects maritime monitoring systems, vessel bridge equipment, and shore-based AIS receivers that rely on libais for message decoding.

• CVE-2026-56780HIGH 7.5

  Modoboa, an open-source groupware and mail server platform, contains a flaw in its account management API that allows domain administrators to reset passwords for any user—including superadministrators—despite lacking the proper authorization. This insecure direct object reference (IDOR) vulnerability means a domain admin can gain full control of accounts they shouldn't be able to access, including taking over the entire system by compromising a superadmin account. The vulnerability affects Modoboa versions prior to 2.9.0.

• CVE-2026-56811HIGH 7.5

  Phoenix is a popular web framework for Elixir applications. This vulnerability allows an attacker without credentials to crash a Phoenix application by opening a single WebSocket or long-polling connection and repeatedly sending join messages to create thousands of channel processes. The framework had no built-in limit on how many channels one connection could spawn, allowing a single attacker to exhaust the server's process capacity and prevent legitimate users from accessing the application. The fix introduces a configurable cap (default 100 channels per connection) that forces attackers to open multiple connections, where network-layer protections can block them.

• CVE-2026-56812HIGH 7.5

  A vulnerability in Phoenix Framework's JavaScript presence client allows attackers to crash the real-time presence feature for all users viewing a channel. By joining a presence channel with a specially crafted username (such as "__proto__" or "constructor"), an attacker can trigger a JavaScript error that breaks presence synchronization. Unlike many attacks, the attacker doesn't need special permissions—ordinary channel access is sufficient. The disruption persists as long as the attacker remains in the channel, affecting every viewer of that topic until they leave.

• CVE-2026-56842HIGH 7.5

  A flaw in Ubiquiti's UniFi Network Application allows an attacker who already has network access and holds low-level privileges to maintain elevated permissions even after an administrator removes them. The vulnerability stems from improper authorization checks—essentially, the application fails to fully revoke access rights in certain conditions, letting an attacker persist with high-level capabilities they should have lost.

• CVE-2026-57023HIGH 7.5

  A flaw in Juniper Networks' TCP proxy functionality allows an attacker on the network to send a specially crafted TCP packet that crashes the flow processing daemon on vulnerable MX and SRX series routers. The crash causes a complete service outage until the system automatically restarts. No authentication is required—an attacker anywhere on the network can trigger this denial of service.

• CVE-2026-57026HIGH 7.5

  Juniper Networks has disclosed a vulnerability in the SIP (Session Initiation Protocol) plugin used by MX Series and SRX Series routers running Junos OS. When SIP ALG (Application Layer Gateway) is enabled, a malformed SIP packet can crash the flow processing daemon, bringing the device offline until it automatically restarts. An attacker on the network can trigger this crash without authentication, making it a straightforward denial-of-service vector. The vulnerability affects a wide range of Junos OS versions across multiple release trains.

• CVE-2026-57080HIGH 7.5

  Net::BitTorrent, a Perl-based BitTorrent client library, contains a vulnerability that allows any peer in a torrent swarm to crash the downloading application by exhausting its memory. The flaw stems from trusting message-size declarations sent by other peers without validation. An attacker can claim they're sending a massive message (up to 4 GB) and then stream bytes slowly; the vulnerable code keeps buffering data waiting for the promised message to complete, consuming memory until the system runs out. Because BitTorrent swarms are open to any peer, this attack requires no authentication or special access.

• CVE-2026-57081HIGH 7.5

  Net::BitTorrent, a Perl library for BitTorrent protocol handling, contains a memory exhaustion vulnerability affecting versions through 2.1.0. The flaw exists in how the library decodes bencoded data—a binary encoding format used in .torrent files and BitTorrent peer communications. An attacker can craft a specially formatted message with deeply nested structures that forces the decoder into excessive recursion, causing the application to consume gigabytes of memory and crash. A single malicious .torrent file, DHT message, or peer response is sufficient to trigger a denial of service.

• CVE-2026-57111HIGH 7.5

  Apache Helix exposes administrative REST API endpoints to unauthorized cross-origin requests due to overly permissive CORS (Cross-Origin Resource Sharing) configuration. An attacker who tricks a user with legitimate access to visit a malicious web page can make requests to these administrative endpoints from the attacker's domain, potentially reading sensitive responses or performing administrative actions. The vulnerability exists in versions through 2.0.0 and is fixed in 2.0.1.

• CVE-2026-57231HIGH 7.5

  Podman, a widely-used container management tool, has a vulnerability that allows a malicious container image to steal sensitive environment variables from the host system where the container runs. By crafting an image with improperly formatted environment variables—particularly using wildcard characters—an attacker can exfiltrate all environment variables accessible to the Podman session, potentially exposing credentials, API keys, and other secrets. The flaw affects versions 1.8.1 through 5.8.4 and is resolved in version 5.8.4 and later, as well as in version 6.0.0 and beyond.

• CVE-2026-57281HIGH 7.5

  Jenkins Script Security Plugin versions up to 1402.v94c9ce464861 contain a sandbox escape vulnerability. The plugin is designed to safely execute Groovy scripts within a restricted environment, but it fails to properly validate certain Groovy language features called AST transformation annotations. An attacker who can submit sandboxed Groovy scripts to a Jenkins instance can craft malicious code that uses these annotations to break out of the sandbox and execute arbitrary commands with the privileges of the Jenkins process. This requires the attacker to already have legitimate script execution permissions and relies on specific script libraries being available, but the impact—full code execution outside sandbox controls—is severe.

• CVE-2026-5730HIGH 7.5

  A vulnerability in Idvlabs' Ontime application allows attackers to bypass authorization controls by manipulating user-controlled identifiers. The flaw enables unauthorized access to sensitive data without requiring authentication or special privileges. Versions through 04052026 are affected. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) due to its network-accessible nature, low complexity, and potential to expose confidential information.

• CVE-2026-57434HIGH 7.5

  Nokogiri, a widely-used Ruby library for parsing and manipulating XML and HTML documents, contains a flaw in how it initializes certain internal objects. When specific methods are called on these improperly initialized objects, the library crashes due to a null pointer error. This affects Nokogiri versions before 1.19.4. While the crash itself denies availability, it does not allow attackers to steal data or execute arbitrary code.

• CVE-2026-57435HIGH 7.5

  Nokogiri, a widely-used Ruby library for parsing and manipulating XML and HTML documents, contains a memory safety vulnerability in versions prior to 1.19.4. When an application modifies an XML attribute's value after the attribute node has been accessed by Ruby code, Nokogiri's native extension can inadvertently free memory that is still referenced elsewhere. This orphaned pointer can later cause the application to crash or behave unpredictably when the freed memory is accessed. The vulnerability requires no user interaction and can be triggered remotely if the affected code processes untrusted XML input.

• CVE-2026-5757HIGH 7.5

  A remote attacker can read sensitive data directly from an Ollama server's memory without needing to log in. The vulnerability exists in how Ollama processes model quantization requests, allowing an unauthenticated person on the network to extract heap memory contents. This could expose API keys, model weights, user data, or other confidential information stored in the server process, potentially enabling lateral movement or persistent backdoor installation.

• CVE-2026-57585HIGH 7.5

  MessagePack, a popular serialization library for Python, contains a defect in how it handles repeated use of the Unpacker object after an error occurs. When an Unpacker instance encounters a parsing error and is then reused to process more data, it can read from invalid memory locations, causing the process to crash. This denial-of-service condition affects applications that parse untrusted MessagePack data in a loop or that implement retry logic without properly reinitializing the Unpacker. The vulnerability is resolved in version 1.2.1 and later.

• CVE-2026-57647HIGH 7.5

  A local file inclusion vulnerability exists in the Panorama Viewer – 360 Degree Image + Video Viewer plugin affecting versions 1.6.1 and earlier. The vulnerability allows authenticated contributors to include and potentially access arbitrary files on the server, though successful exploitation requires specific conditions. This is a moderate-to-high severity issue that primarily affects sites where contributor access is broadly granted.

• CVE-2026-57872HIGH 7.5

  A remote attacker can read files from affected GeoVision IP cameras without authentication by exploiting a directory traversal flaw in the get_fcont.cgi script. By crafting requests with path manipulation sequences (like '../'), an attacker can bypass intended file access restrictions and retrieve sensitive configuration files, credentials, or other data stored on the device. No authentication or user interaction is required.

• CVE-2026-57873HIGH 7.5

  GeoVision's network camera products GV-LPC2011 and GV-LPC2211 (version 1.12 and earlier) contain a flaw in their web-based certificate upload functionality that allows an unauthenticated attacker to crash the affected service. By sending a specially crafted upload request, an attacker can trigger a NULL pointer dereference in the IEEE8021x_upload.cgi process, causing denial of service. No authentication is required, and the attack can be launched over the network.

• CVE-2026-57874HIGH 7.5

  GeoVision network camera models GV-LPC2011 and GV-LPC2211 running firmware version 1.12 or earlier contain a remotely exploitable buffer overflow flaw in their web upload handler. An attacker without credentials can send a specially crafted file upload request with an excessively long filename to trigger memory corruption, crashing the device and rendering it unavailable. This is a denial-of-service vulnerability—it does not allow data theft or system compromise, but it does disrupt service availability.

• CVE-2026-57875HIGH 7.5

  GeoVision's GV-LPC2011 and GV-LPC2211 network cameras running firmware V1.12 and earlier contain a flaw in how they handle incoming web requests. An attacker on the network can send a malformed HTTP request that causes the camera's web service to crash, temporarily taking the device offline. No authentication is required to trigger this issue, and the attacker doesn't gain access to data—the sole impact is service disruption.

• CVE-2026-57876HIGH 7.5

  GeoVision's GV-LPC2011 and GV-LPC2211 network cameras contain a memory safety flaw in their web interface that allows unauthenticated attackers to crash the device. An attacker can send a specially crafted HTTP request to the onvif.cgi endpoint with oversized input data, causing the application to write beyond allocated memory boundaries. This memory corruption reliably triggers a denial-of-service condition, rendering the camera unavailable until reboot.

• CVE-2026-57912HIGH 7.5

  Johnson & Johnson's Campus Recruiting platform has a data exposure vulnerability that allows unauthorized access to sensitive information submitted by student job candidates. Specifically, attackers can view personal data that students provided during the application process as well as private interviewer notes and assessments about those candidates. This vulnerability affects versions released before October 31, 2025, and requires no authentication or user interaction to exploit—an attacker on the network can simply request the data directly.

• CVE-2026-57913HIGH 7.5

  Johnson & Johnson's Audit Tracking Management System (ATMS) contains a flaw that allows unauthorized users to access sensitive meeting minutes and transcripts without authentication. An attacker on the network can view confidential audit-related documents and discussions that should be restricted to authorized personnel. The vulnerability affects versions released before April 21, 2026, and requires immediate patching to prevent further exposure of privileged information.

• CVE-2026-57975HIGH 7.5

  Microsoft Edge (Chromium-based) contains a type confusion vulnerability that allows attackers to execute arbitrary code on a user's system through network-based attack vectors. An attacker crafts malicious content that tricks Edge into mishandling objects in memory, leading to code execution. The vulnerability requires user interaction—such as visiting a malicious website or opening a crafted file—making it a practical threat to organizations where browsing is common. The HIGH severity reflects the combination of remote attack capability and the ability to fully compromise the system.

• CVE-2026-57984HIGH 7.5

  Microsoft Edge (the Chromium-based version) contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a user's machine when they visit a malicious webpage. The vulnerability requires user interaction—specifically visiting a crafted site—but does not require any special authentication or privileges. While the code execution happens over the network, the attack surface is limited by the need for a specific browser interaction and moderately complex exploit conditions, reflected in its CVSS score of 7.5 (HIGH).

• CVE-2026-57986HIGH 7.5

  Microsoft Edge (Chromium-based) contains a use-after-free memory vulnerability that could allow an attacker to execute code on a user's computer through the network. The vulnerability requires user interaction, such as viewing a malicious webpage, but once triggered grants the attacker full control over the browser and potentially the underlying system. This is a memory corruption issue where the browser attempts to use memory that has already been freed, leading to unpredictable behavior that an attacker can exploit.

• CVE-2026-5799HIGH 7.5

  A security flaw in Idvlabs' Ontime software allows attackers to bypass authorization controls by manipulating user-controlled identifiers. An unauthenticated attacker on the network can exploit this to gain unauthorized access to sensitive information, without needing to interact with a user or overcome any special conditions. The vulnerability affects Ontime versions through April 5, 2026.

• CVE-2026-57992HIGH 7.5

  Microsoft Edge (Chromium-based) contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a user's system through a specially crafted network interaction. The vulnerability requires user interaction (such as visiting a malicious webpage) to trigger, but does not require authentication. Successful exploitation could grant an attacker the same privileges as the logged-in user, potentially enabling data theft, system compromise, or further attacks.

• CVE-2026-58016HIGH 7.5

  GLib, a core utility library used across GNOME, Linux distributions, and many applications, contains a vulnerability in how it parses D-Bus introspection XML files. When specially malformed XML is processed—specifically when a `node` element is incorrectly nested inside method, signal, property, or argument definitions—the parsing code can become confused about its internal state. This confusion leads to an integer overflow in a counter, causing the parser to attempt reading from invalid memory locations. An attacker can exploit this by sending a malicious D-Bus introspection XML document, triggering a crash in any service that relies on GLib's D-Bus parsing. The impact is denial of service; no data theft or system compromise occurs.

• CVE-2026-58036HIGH 7.5

  MediaWiki has a vulnerability that allows unauthorized users to access sensitive information through its user query API endpoints. An attacker on the network can exploit this without needing credentials or user interaction, potentially exposing user data that should remain private. The issue stems from insufficient access controls in the components that handle user enumeration and permission checking.

• CVE-2026-58169HIGH 7.5

  Vibe-Trading versions before 0.1.10 suffer from a DNS rebinding flaw that allows an attacker to trick a user's browser into making authenticated API requests to a local Vibe-Trading server without proper authorization. By hosting a malicious webpage and manipulating DNS responses, an attacker can bypass the application's bearer-token authentication, reach code execution endpoints, and run arbitrary commands on the server. The vulnerability exists because the application trusts the originating IP address for loopback connections while failing to validate the HTTP Host header, combined with overly permissive CORS settings that credential requests. Once authenticated through this bypass, an attacker can also steal credentials by modifying LLM and data-source configuration settings.

• CVE-2026-58210HIGH 7.5

  NATS Server, a widely-used messaging platform for cloud and edge infrastructure, has a vulnerability that allows unauthenticated attackers to trigger a memory exhaustion condition. An attacker can connect to the MQTT interface without credentials and send incomplete connection packets that claim a very large size. The server will hold these packets in memory while waiting for the remainder of the data to arrive, but the attacker never sends it. By opening multiple such connections, an attacker can exhaust the server's available memory, causing the service to become unavailable. This affects NATS Server versions before 2.14.3 and 2.12.12.

• CVE-2026-58250HIGH 7.5

  NATS Server, a widely used cloud and edge messaging platform, has a denial-of-service vulnerability in its leafnode listener when compression is enabled. An attacker without credentials can crash the server by sending specially crafted protocol messages before the authentication process completes. This affects versions prior to 2.12.8 and 2.11.17. The vulnerability requires direct network access to the leafnode port and does not lead to data theft or system compromise—only service interruption.

• CVE-2026-58276HIGH 7.5

  A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an attacker to execute arbitrary code on a user's system by sending a specially crafted network message. The attack requires user interaction—such as visiting a malicious webpage or opening a crafted link—but does not require the attacker to be authenticated or have prior access to the system. Successful exploitation could give an attacker full control over the affected browser process and potentially the underlying machine.

• CVE-2026-58290HIGH 7.5

  A type confusion vulnerability in Microsoft Edge (Chromium-based) allows attackers to execute arbitrary code on a victim's system through network-based exploitation. The flaw arises from improper handling of incompatible data types in memory, which an attacker can abuse to overwrite code regions or manipulate execution flow. Successful exploitation requires user interaction—typically opening a malicious webpage—but once triggered, grants the attacker the same privileges as the logged-in user.

• CVE-2026-58292HIGH 7.5

  Microsoft Edge (Chromium-based) contains a flaw that fails to properly validate user input, allowing attackers to execute code on affected systems over the network. An attacker would typically need to trick a user into visiting a malicious webpage or interacting with crafted content, but once successful, the attacker gains the ability to run arbitrary code with the privileges of the Edge browser process.

• CVE-2026-58294HIGH 7.5

  Microsoft Edge (Chromium-based) contains a use-after-free memory safety defect that allows an attacker to execute arbitrary code on a user's system through the network. The vulnerability requires user interaction (such as visiting a malicious webpage) and relies on moderately complex attack conditions, but successful exploitation grants full system compromise. This is a memory corruption issue where freed memory is accessed improperly, a common source of serious security defects in browser engines.

• CVE-2026-58299HIGH 7.5

  Microsoft Edge for Android contains a race condition vulnerability that could allow an attacker to execute arbitrary code on a user's device through a network-based attack. The flaw exists in a time-of-check time-of-use (TOCTOU) scenario, where the application checks a security condition at one point but the actual use of that resource happens slightly later—giving an attacker a window to manipulate the state between those two moments. Successful exploitation requires user interaction and specific timing, but when achieved, grants the attacker the ability to run code with the privileges of the Edge browser process.

• CVE-2026-58375HIGH 7.5

  JimuReport versions up to 2.5.0 contain a critical authentication bypass in their report export functionality. The `/jmreport/auto/export` endpoint is accessible to anyone on the network without requiring login credentials. An attacker can use this to download any report stored in the system, including sensitive data and database credentials that may be embedded in report configurations. This is particularly dangerous for organizations using JimuReport to expose Snowflake or other database query results.

• CVE-2026-58454HIGH 7.5

  JAIOTlink C492A-W6 Wi-Fi IP cameras contain a flaw that lets authenticated users run arbitrary code on the device. An attacker with valid camera credentials can upload a malicious script to the camera's storage, then trigger execution through a web endpoint. Once running, the code persists even after reboot, giving an attacker persistent control over the camera.

• CVE-2026-58465HIGH 7.5

  Eclipse Wakaama, a lightweight IoT device management framework, has a memory exhaustion vulnerability in how it processes CoAP (Constrained Application Protocol) block transfers. An unauthenticated attacker can send a series of fragmented upload requests to a Wakaama server over the network, causing the server to accumulate data in memory without any safeguard. Eventually, the server runs out of memory and stops responding—a denial-of-service attack that requires no credentials or special access.

• CVE-2026-58467HIGH 7.5

  Cockpit CMS versions up to 2.14.0 contain a flaw that allows attackers to read sensitive files from the server without logging in. By crafting specially formatted URLs with path traversal sequences (like "../"), an attacker can escape the intended directory boundaries and access files outside the application's designated spaces. In certain server configurations, this can escalate to executing arbitrary PHP code, making it a serious confidentiality and integrity risk for affected deployments.

• CVE-2026-58469HIGH 7.5

  GNU Wget versions through 1.25.0 contain a memory safety flaw in how they process Metalink documents—a format used to describe downloadable files and mirrors. When a malicious server sends a Metalink file with a URL containing only whitespace characters, Wget's cleanup function reads memory outside its allocated buffer, potentially crashing the application or causing unpredictable behavior. An attacker controlling a server or intercepting traffic can exploit this by serving a specially crafted Metalink document to any Wget client that fetches from it.

• CVE-2026-58593HIGH 7.5

  NodeBB's federation feature contains an authentication bypass that allows remote attackers to forge posts and direct messages as any local user, including administrators. When processing incoming ActivityPub messages, NodeBB verifies the sender's cryptographic signature but fails to validate that the claimed author (attributedTo field) actually corresponds to the authenticated remote actor. An attacker can exploit this by sending a message with attributedTo set to a local user ID (such as '1' for the admin account), and NodeBB will create the post or message attributed to that local user without proper verification.

• CVE-2026-58652HIGH 7.5

  A privilege-escalation flaw in luci-app-travelmate and the travelmate package allows an attacker with delegated write permissions to the travelmate configuration to execute arbitrary commands as root. The vulnerability exists because the web UI (LuCI) only restricts the auto-login script picker to a safe directory on the frontend, but the backend travelmate service—which runs as root—reads the raw UCI configuration values and executes whatever script path is specified without proper validation. An attacker can bypass the UI restriction by directly setting the script parameter to any executable (e.g., /bin/sh) and the script_args parameter to attacker-controlled commands, leading to complete system compromise.

• CVE-2026-58656HIGH 7.5

  The Grav API plugin before version 1.0.0-rc.16 contains a critical authentication bypass vulnerability that allows attackers to impersonate legitimate users and administrators. The plugin incorrectly accepts JWT authentication tokens passed as URL query parameters and pairs this with overly permissive cross-origin headers, enabling malicious websites to make authenticated API calls on behalf of a victim. If an attacker obtains a leaked JWT token—which can happen through server logs, proxy traces, browser history, or HTTP Referrer headers—they can create rogue super-admin accounts and extract sensitive system and user data without the victim's knowledge.

• CVE-2026-59094HIGH 7.5

  Pathway versions through 0.31.1 contain a denial-of-service vulnerability in the document store's glob pattern matching logic. When users submit search queries with filepath patterns to unauthenticated API endpoints, the system processes these patterns inefficiently, consuming excessive CPU resources. An attacker can craft a specially formatted pattern to freeze the application for tens of seconds per request; sending just a handful of such requests can render the service unavailable to legitimate users.

• CVE-2026-59096HIGH 7.5

  Dapr Sentry, a distributed application runtime component, has a flaw in how it serves OpenID Connect (OIDC) discovery documents. When OIDC is enabled without explicit configuration of allowed hosts or JWT issuer settings (the default), an attacker can manipulate the discovery endpoint by sending a forged Host header (X-Forwarded-Host). The service then serves a document claiming that tokens should be validated against an attacker-controlled server instead of the legitimate one. Because this document is cached publicly for one hour, many clients may fetch and trust the poisoned version, allowing the attacker to create valid-looking tokens that systems will accept. This is a supply-chain style attack on the trust chain itself.

• CVE-2026-59162HIGH 7.5

  Excelize, a Go library for reading and writing Excel files, has a flaw that causes it to crash when processing malicious XLSX files. An attacker can craft a spreadsheet with a specially crafted cell reference that points to an invalid memory location, causing the application using Excelize to panic and stop working. This is a denial-of-service vulnerability that affects any application built with Excelize prior to version 2.11.0.

• CVE-2026-59692HIGH 7.5

  GStreamer's DTLS (Datagram Transport Layer Security) plugin contains a stack buffer overflow flaw that occurs during the SSL/TLS handshake process. When a remote attacker sends a specially crafted certificate with an unusually long subject name, the plugin crashes trying to store that name in a fixed 2048-byte buffer. The result is a denial-of-service condition—any application using GStreamer's DTLS functionality can be knocked offline by an unauthenticated attacker without needing credentials or user interaction.

• CVE-2026-59703HIGH 7.5

  Repomix, a tool for working with Git repositories, contains a vulnerability that allows attackers to read any Git repository stored on a server without needing credentials. The flaw exists in how the application validates Git repository URLs—it fails to properly block requests using the file:// protocol scheme. By crafting a malicious URL with file://, an unauthenticated attacker can bypass validation checks and trick the underlying git clone command into accessing local repositories on the filesystem, exposing all tracked files to unauthorized viewing.

• CVE-2026-59708HIGH 7.5

  Ghostfolio's public portfolio sharing feature contains an authentication bypass vulnerability that allows anyone with a private access ID to retrieve complete portfolio details without logging in. The flaw lies in insufficient validation of user permissions when accessing the /api/v1/public/:accessId/portfolio endpoint. An attacker who obtains a private access ID—whether through social engineering, data leaks, or enumeration—can view sensitive investment information including specific holdings, quantities purchased, entry prices, and performance metrics that the portfolio owner intended to keep private. The vulnerability requires network access but no special privileges or user interaction, making it straightforward to exploit.

• CVE-2026-59720HIGH 7.5

  Hoppscotch, an open source API development platform, has a flaw that causes mock servers created from private collections to be publicly accessible on the internet without requiring authentication. When developers set up a mock server, the system fails to save the 'private' setting, and the database defaults these servers to public. This means sensitive API data and schemas stored in private collections could be exposed to anyone who discovers the mock server URL. The issue affects all versions before 2026.6.0 and is resolved in that release.

• CVE-2026-59724HIGH 7.5

  Socket.IO's Engine.IO component versions 6.5.0 through 6.6.6 contain a denial-of-service vulnerability when WebTransport is enabled. An attacker can send a specially crafted session identifier (like '__proto__') that exploits how the server resolves inherited properties of internal objects, triggering a crash that disrupts service for all users. No authentication is required, and exploitation is straightforward from the network. Version 6.6.7 and later address this flaw.

• CVE-2026-59725HIGH 7.5

  Socket.IO's Engine.IO component, versions 4.1.0 through 6.6.6, contains a flaw in how it processes certain malformed binary requests over HTTP polling. When an attacker sends specially crafted POST requests claiming to contain binary data, the server fails to properly close the connection, leaving it in a hung state. An unauthenticated attacker on the network can repeatedly trigger this condition to accumulate open connections until the server exhausts its available resources and becomes unable to handle legitimate traffic. This is a denial-of-service vulnerability with no authentication requirement.

• CVE-2026-59803HIGH 7.5

  rpcx versions through 1.9.3 contain a denial-of-service vulnerability triggered by specially crafted compressed messages. An attacker can send a small gzip-compressed payload that decompresses to gigabytes of data, exhausting server memory and crashing the service. Because this can happen before authentication, no valid credentials are needed—any network-connected attacker can trigger the vulnerability.

• CVE-2026-59834HIGH 7.5

  SiYuan is an open-source knowledge management application that allows users to organize and search personal documents. A vulnerability in versions before 3.7.1 allows attackers to trick the search function into revealing sensitive information from documents that should be hidden. The flaw exists in how the application processes search requests—specifically, it fails to properly validate user input before using it in internal search operations. An attacker without any login credentials can craft a malicious search query that bypasses access controls and retrieves private document content that other users may not be permitted to view.

• CVE-2026-59869HIGH 7.5

  js-yaml, a widely-used JavaScript library for parsing and dumping YAML, contains a denial-of-service vulnerability affecting versions 3.0.0 through 3.14.x and 4.0.0 through 4.2.x. An attacker can craft a specially formatted YAML document that causes the parser to consume excessive CPU resources—growing quadratically in time while the malicious input size grows only linearly. This means a relatively small payload can trigger disproportionate computational work, potentially exhausting server resources and disrupting service availability.

• CVE-2026-59873HIGH 7.5

  node-tar, a widely-used Node.js library for working with tar archives, contains a resource exhaustion vulnerability that allows an attacker to craft a malicious gzip-compressed tar file that appears small but expands to consume enormous amounts of disk space and CPU when extracted. The library fails to enforce limits on how much data can be decompressed, how many files can be in an archive, or how much the data expands relative to its compressed size. By sending a carefully crafted "gzip bomb," an attacker can cause a system extracting the archive to run out of disk space or become unresponsive—a denial-of-service attack that requires no authentication and can be delivered over the network.

• CVE-2026-59874HIGH 7.5

  A vulnerability in node-tar, a popular Node.js library for handling tar archives, allows an attacker to craft a malicious tar file that causes the library to enter an infinite loop. When processing a specially crafted tar header with a negative file size encoded in base-256 format, the archive scanner fails to advance through the file and instead repeatedly re-parses the same header. This denial-of-service condition can hang or exhaust resources on systems that process untrusted tar archives. The issue affects all versions prior to 7.5.18.

• CVE-2026-59879HIGH 7.5

  Immutable.js, a popular JavaScript library for working with immutable data structures, contains a critical flaw in how it handles large array indices and sizes. When developers use certain list operations with indices between roughly 1 billion and 2 billion, the library either freezes indefinitely, consumes all available memory, or silently produces incorrect results. This affects versions before 4.3.9 and 5.1.8. The vulnerability poses a significant availability risk to any application relying on Immutable.js for core data management, particularly those processing user-controlled list operations at scale.

• CVE-2026-59880HIGH 7.5

  Immutable.js, a popular JavaScript library for managing immutable data structures, contains a denial-of-service vulnerability in versions prior to 4.3.9 and 5.1.8. An attacker can deliberately craft many keys that hash to the same value, forcing the library to perform linear scans through collision buckets during map and set operations. This causes excessive CPU consumption and can slow or crash applications that accept untrusted input for map construction or merging. The vulnerability requires no authentication and can be triggered remotely through normal API calls like Immutable.Map() or state.merge().

• CVE-2026-59887HIGH 7.5

  linkify-it is a widely used JavaScript library that recognizes links in text, including email addresses. Versions before 5.0.2 contain a performance flaw in how they validate mailto: links. An attacker can craft malicious input containing many mailto: patterns that forces the validation logic to consume excessive CPU time, potentially degrading or halting services that process user-supplied text. The vulnerability requires no authentication and affects systems across the network.

• CVE-2026-59892HIGH 7.5

  A vulnerability exists in OpenTelemetry's Jaeger propagator for JavaScript that allows an attacker to crash a Node.js application by sending specially crafted HTTP headers. When the propagator attempts to decode malformed percent-encoded values in trace context headers, it fails to catch the resulting error, causing the entire process to terminate. This is a denial-of-service issue that requires no authentication and can be triggered remotely by any network-connected client.

• CVE-2026-59922HIGH 7.5

  Mistune, a popular Python Markdown parser, contains a performance vulnerability in its formatting plugins that can be exploited to cause denial of service. When processing specially crafted Markdown input containing repeated tilde (~), equals (=), or caret (^) characters, the strikethrough, mark, or insert plugins perform excessive computational work. An attacker can send malicious Markdown to applications using vulnerable versions, exhausting server CPU resources and making the service unavailable to legitimate users. This issue affects all versions prior to 3.3.0 and is fixed in that release.

• CVE-2026-59925HIGH 7.5

  Mistune, a widely-used Python Markdown parser, contains a denial-of-service vulnerability in how it handles emphasis formatting. When processing certain malformed or adversarially crafted Markdown with long sequences of double or triple asterisks (used for bold and italic emphasis), the parser performs redundant scanning that grows quadratically with input length. An attacker can exploit this by sending specially crafted Markdown to any system parsing it with vulnerable Mistune versions, causing the parser to consume excessive CPU and potentially crash or hang the application. Version 3.3.0 eliminates the performance cliff.

• CVE-2026-59928HIGH 7.5

  Mistune, a widely-used Python Markdown parser library, contains a denial-of-service vulnerability in how it handles Markdown reference-link definitions. An attacker can craft a malicious Markdown document with numerous repeated or distinct reference links that forces the parser to perform excessive computational work, ultimately exhausting CPU resources and crashing or hanging applications that parse untrusted Markdown input. The vulnerability has been patched in version 3.3.0.