By severity

High-severity vulnerabilities

CVEs rated High by CVSS, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 35 of 42

• CVE-2026-46320HIGH 7.4

  A memory leak in the Linux kernel's TAP (network) device driver causes pages of system memory to accumulate and never be freed when certain network packets are rejected or fail to process. Specifically, when the driver receives a packet that is too short or encounters an error while building a network packet buffer, it bypasses the cleanup routine that should release allocated memory. In batch-processing scenarios, this leak compounds—each rejected frame discards a page fragment, potentially exhausting system memory over time and leading to a denial of service.

• CVE-2026-46579HIGH 7.4

  OpenShift Router has a header-spoofing vulnerability that breaks mutual TLS authentication when routes are configured to allow unencrypted HTTP traffic. An attacker can send plain HTTP requests with forged client certificate headers, tricking backend services into accepting them as though they came from legitimate authenticated clients. This bypasses the certificate-based trust model that many organizations rely on for service-to-service security.

• CVE-2026-46608HIGH 7.4

  Glances, a popular open-source system monitoring tool, contains a critical flaw in how it manages browser access control when deployed as an XML-RPC server. When an administrator configures the tool to restrict access to specific internal dashboards by listing two or more approved origins, the security control silently breaks and instead allows any website on the internet to pull sensitive system monitoring data. This happens because of a logic error in the CORS (cross-origin resource sharing) fallback mechanism introduced in version 4.5.3. An attacker does not need to compromise credentials or trick a user into clicking anything unusual—merely visiting a malicious webpage while connected to the same network or having the Glances server exposed to the internet is enough to expose real-time CPU, memory, disk, process, and other system metrics.

• CVE-2026-46818HIGH 7.4

  Oracle E-Business Suite's Payments module contains a vulnerability in its File Transmission component that allows an unauthenticated attacker over the network to read and modify sensitive payment data. The attacker does not need valid credentials, but exploitation requires specific technical conditions to be in place. Versions 12.2.3 through 12.2.15 are affected. The vulnerability can lead to unauthorized access to critical financial information or payment records.

• CVE-2026-47960HIGH 7.4

  Adobe ColdFusion versions 2023.19, 2025.8 and earlier contain an XML External Entity (XXE) vulnerability that allows attackers to read arbitrary files from the server's file system. The vulnerability requires a victim to open a malicious file, making it a targeted attack vector. Once exploited, an attacker gains unauthorized access to sensitive data stored on the affected system, but cannot modify files or disrupt service availability.

• CVE-2026-48294HIGH 7.4

  A vulnerability exists in Adobe Acrobat's PDF viewer extension for Chrome that allows attackers to steal session data from victims. The flaw is classified as a cross-site scripting (XSS) issue that can bypass same-origin protections, meaning malicious content on one website could access sensitive information from another site. An attacker would need to trick a user into visiting a malicious webpage or clicking a specially crafted link. The vulnerability affects Acrobat versions 26.5.2.2 and earlier.

• CVE-2026-48501HIGH 7.4

  GitHub CLI (gh) prior to version 2.93.0 has a flaw where it unintentionally sends your authentication token to external services during specific operations. When you run commands like `gh attestation`, `gh release verify`, or `gh release verify-asset`, the tool needs to fetch data from various external servers—including TUF (The Update Framework) repositories and cloud storage. The problem is that the authentication layer doesn't correctly identify which servers should receive your token. Due to flawed host detection logic, requests to services like tuf-repo.github.com are incorrectly treated as requests to GitHub itself, causing your personal GitHub token to be transmitted to an untrusted third party. Similarly, requests to unrelated external hosts (like Sigstore's CDN or Azure Blob Storage) also receive your token. An attacker controlling or monitoring traffic to these external services could intercept your token and impersonate your GitHub account.

• CVE-2026-48505HIGH 7.4

  Filament, a Laravel development toolkit, contains a flaw in its app-based multi-factor authentication (MFA) recovery code system that allows a single recovery code to be used multiple times if an attacker submits it rapidly in parallel. Normally, recovery codes are single-use—meant to be burned after one authentication attempt. An attacker who has stolen both a user's password and recovery codes could exploit this concurrency issue to create multiple authenticated sessions from a single code, significantly extending their unauthorized access window. This only affects app-based MFA with recovery codes enabled; email-based MFA is not vulnerable. Versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 are affected.

• CVE-2026-48526HIGH 7.4

  PyJWT, a widely-used Python library for handling JSON Web Tokens (JWTs), contains an authentication bypass vulnerability in versions before 2.13.0. The flaw allows attackers to forge valid tokens by exploiting insufficient validation of cryptographic key usage. Specifically, when a library instance is configured to accept both asymmetric (public-key) and HMAC (shared-secret) algorithms, an attacker can take the issuer's public key—which is often publicly available—and use it as the HMAC secret to create forged tokens that the vulnerable library will accept as legitimate.

• CVE-2026-48555HIGH 7.4

  Spatie's Laravel Media Library, a popular file management package for Laravel applications, contains a server-side request forgery (SSRF) vulnerability in versions prior to 11.23.0. The flaw exists in the addMediaFromUrl() method, which accepts user-controlled URLs without proper validation. An attacker with authenticated access can exploit this to force the server to make arbitrary outbound HTTP requests on their behalf, potentially reaching internal systems, cloud metadata endpoints, or external targets that the server can access but the attacker cannot directly reach.

• CVE-2026-49082HIGH 7.4

  Chatway Live Chat — an AI-powered customer support and chat plugin — contains a flaw in versions 1.4.8 and earlier that exposes sensitive subscriber data to attackers with valid login credentials. An authenticated user can access information they shouldn't have permission to view, potentially including customer communications, support tickets, or account details. This is particularly concerning because Chatway is commonly deployed on WordPress sites handling customer interactions, making the exposed data valuable to both external attackers and malicious insiders.

• CVE-2026-49287HIGH 7.4

  Statamic, a Laravel-based content management system, contains an incomplete fix for a prior vulnerability that allows attackers to manipulate how content is sorted in memory. If a Statamic site's template is designed to let visitors control sorting parameters, an attacker can craft malicious sort requests that cause content and assets to be deleted or corrupted. The vulnerability requires specific template configuration to be exploitable and is not present in default Statamic installations. Versions 5.73.23 and 6.20.0 and later contain the complete fix.

• CVE-2026-49440HIGH 7.4

  Deno's prime number validation function contains a critical flaw that allows composite numbers to be incorrectly identified as prime. When developers use the default settings, the checkPrime() and checkPrimeSync() functions skip cryptographic validation rounds entirely, relying only on a basic divisibility check against small primes. This means a number that is actually the product of two larger primes can be falsely reported as prime, potentially compromising cryptographic operations that depend on genuine prime generation.

• CVE-2026-49502HIGH 7.4

  Dell PowerFlex Manager versions before 5.1.0.1 contain a flaw that allows an attacker on the same network segment to bypass authentication controls and gain unauthorized access to the system. Without needing valid credentials, an adjacent network attacker could read sensitive data, modify information, or take unauthorized actions within PowerFlex Manager. This is particularly concerning for organizations that assume internal network access is inherently trusted.

• CVE-2026-50136HIGH 7.4

  Budibase, an open-source low-code platform, contains a flaw in versions before 3.39.3 that allows an unauthenticated attacker to generate AWS S3 upload URLs without proper access controls. By knowing a workspace ID and datasource ID, an attacker can craft requests to obtain signed URLs pointing to arbitrary S3 buckets and keys, potentially enabling unauthorized data uploads to cloud storage. The endpoint is protected only by CAPTCHA, bypassing normal authentication and permission checks.

• CVE-2026-50292HIGH 7.4

  CVE-2026-50292 is a privilege escalation vulnerability in libinput, a widely-used input device handling library. The flaw allows an attacker with local access to craft malicious device properties that libinput-device-group fails to properly sanitize, leading to injection of arbitrary udev properties. This injection can result in arbitrary code execution with root privileges. The vulnerability affects libinput versions before 1.30.4 and all 1.31.x versions before 1.31.3.

• CVE-2026-50631HIGH 7.4

  Apache CXF contains a race condition in its OAuth token handling that allows attackers to generate multiple valid access tokens from a single refresh token when the 'recycleRefreshTokens' setting is disabled. If a refresh token is leaked or compromised, an attacker can send concurrent requests to the OAuth provider using that token, potentially obtaining numerous valid access tokens before the provider realizes the refresh token has been misused. This breaks the intended single-use semantics of refresh tokens and significantly expands the window of compromise.

• CVE-2026-50752HIGH 7.4

  CVE-2026-50752 is a flaw in how older VPN key exchange protocols validate certificates. An attacker positioned between two VPN endpoints can forge or bypass certificate checks, allowing them to intercept or alter traffic passing through the tunnel. The vulnerability requires the attacker to be on the network path between sites and affects only VPN connections using the deprecated IKEv1 protocol with certificate-based authentication. This is a high-severity issue because successful exploitation grants access to encrypted traffic that organizations rely on for secure branch-to-branch or cloud communications.

• CVE-2026-52698HIGH 7.4

  PushEngage, a WordPress plugin for web push notifications and eCommerce automation, contains a flaw that exposes sensitive subscriber data to authenticated users with low privileges. Versions 4.2.3 and earlier are affected. An attacker with a user account on the WordPress site could access subscriber information they shouldn't be able to view, such as email addresses, preferences, or other PII collected through the push notification system. This is not a public exploit scenario—it requires an existing login—but it significantly increases risk if your WordPress environment has multiple user accounts or contractor access.

• CVE-2026-5343HIGH 7.4

  A privilege escalation vulnerability exists in miniOrange's SAML SSO Service Provider module for Drupal. The vulnerability stems from improper validation of exceptional conditions during SAML authentication. An unauthenticated attacker can craft specific SAML responses that bypass security checks, allowing them to escalate privileges within the Drupal application. The flaw affects all versions before 3.1.4, making it a significant risk for any Drupal installation relying on this SSO module for authentication.

• CVE-2026-53782HIGH 7.4

  Summarize, a podcast processing tool, contains a server-side request forgery (SSRF) flaw that allows attackers to manipulate podcast RSS feeds and trick the application into fetching content from internal network addresses. By embedding malicious transcript URLs in RSS feeds they control, attackers can force the vulnerable server to reach out to private IP ranges, loopback addresses, and other restricted destinations. The application fails to properly validate redirect targets and resolve hostnames before making requests, leaving internal services exposed. An attacker needs control of a podcast RSS feed and user interaction (someone subscribing to or processing that feed) to exploit this vulnerability.

• CVE-2026-54774HIGH 7.4

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a flaw in how it validates SAML security tokens. When a service uses non-X.509 signing credentials to validate these tokens, the final cryptographic signature check is skipped, allowing an attacker to forge or tamper with assertions. An attacker can trick the system into accepting invalid tokens by referencing a different key identifier that isn't actually an X.509 certificate. This bypasses a critical security control that would normally prevent token manipulation.

• CVE-2026-54781HIGH 7.4

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a flaw in how it validates SAML security tokens. Specifically, the vulnerability allows attackers to bypass authentication checks by either downgrading holder-of-key confirmations to weaker methods or injecting custom confirmation assertions without proving they actually control the token. An attacker could potentially use a stolen or forged SAML token to authenticate as a legitimate user without demonstrating proof of possession. This affects CoreWCF versions before 1.8.1 and 1.9.1.

• CVE-2026-54783HIGH 7.4

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a signature verification flaw in its WS-Security handling. The vulnerability allows an attacker who intercepts a signed SOAP message to reuse that same signature to execute different service operations on behalf of the legitimate user who originally signed it. This breaks the cryptographic guarantee that a signature is bound to a specific operation, creating a replay and privilege escalation risk in any service using vulnerable CoreWCF versions.

• CVE-2026-54784HIGH 7.4

  CoreWCF version 1.9.0 contains a flaw in its SPNEGO-based security token negotiation that leaks the proof key used to establish secure sessions. When a Windows client authenticates using TransportWithMessageCredential mode and negotiates a session, the proof key becomes visible to network observers. This allows an attacker with network access to impersonate the authenticated Windows user and gain the ability to decrypt, read, and forge encrypted WS-SecureConversation messages—effectively hijacking authenticated sessions.

• CVE-2026-54919HIGH 7.4

  cpp-httplib, a popular C++ HTTP/HTTPS library, contains a certificate validation bypass when configured with Mbed TLS or wolfSSL backends. If an application uses cpp-httplib for HTTPS connections to IP-based hosts (rather than domain names) with certificate verification enabled, the library may skip validating the server's certificate chain entirely. This allows an attacker positioned to intercept network traffic—such as on a shared network or compromised router—to impersonate the legitimate server and read or modify sensitive data. The vulnerability affects versions 0.31.0 through 0.46.1 for Mbed TLS and 0.33.0 through 0.46.1 for wolfSSL. It is resolved in version 0.47.0.

• CVE-2026-55075HIGH 7.4

  Coder, a platform for provisioning remote development environments via Terraform, contains two authentication bypass flaws in its OIDC (OpenID Connect) login flow that can chain together to enable account takeover. The vulnerabilities stem from overly permissive email-based user matching and improper handling of email verification claims. An attacker can exploit these weaknesses to gain unauthorized access to existing user accounts without knowing the victim's password. Affected versions are those prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The vendor has released patches that restrict email fallback linking and enforce stricter email verification defaults.

• CVE-2026-55076HIGH 7.4

  Coder, a platform for provisioning remote development environments, contains an authentication bypass vulnerability in versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The flaw stems from improper validation of the `email_verified` claim returned by OpenID Connect (OIDC) identity providers. When an IdP returns this claim in an unexpected format (such as a string instead of a boolean) or omits it entirely, Coder's authentication logic fails in an unsafe way—treating the email as verified regardless. This, combined with a fallback mechanism that links accounts based on email alone, allows an attacker to take over existing user accounts by authenticating through an OIDC provider they control.

• CVE-2026-55436HIGH 7.4

  Coder, a platform for provisioning remote development environments, contains a transport security misconfiguration in its AI Bridge Proxy component. Versions 2.30.0 through 2.34.1 fail to validate TLS certificates when communicating with the main Coder server in default deployments. An attacker positioned on the network path between the proxy and server could intercept and decrypt traffic. Patching to versions 2.32.7, 2.33.8, or 2.34.2 enforces strict certificate validation. Risk is substantially lower for organizations running both components on the same machine or behind mTLS.

• CVE-2026-55759HIGH 7.4

  Rocket.Chat's Apple Sign-In feature has a critical authentication bypass vulnerability. The application correctly verifies that an Apple identity token is cryptographically signed by Apple, but it fails to validate important claims within that token—such as the intended audience, expiration time, or nonce. This means an attacker who obtains a valid Apple identity token (whether from logs, network interception, or another application) can replay it indefinitely to log in as the victim user without any time limit. The vulnerability affects multiple versions of Rocket.Chat across several release branches and is resolved in patched versions released in mid-June 2026.

• CVE-2026-56676HIGH 7.4

  9Router, an AI router designed to optimize token usage for language model queries, contains a DNS rebinding vulnerability affecting versions before 0.5.2. An authenticated attacker with access to the LLM proxy can exploit a timing window between initial validation and actual image fetch to redirect requests from public IPs to internal-only services. By controlling a DNS name that first resolves legitimately then rebinds to a private address, attackers can access internal HTTP services that should be unreachable from the network boundary. The vulnerability requires authentication but allows lateral movement and reconnaissance of internal infrastructure.

• CVE-2026-56776HIGH 7.4

  n8n versions before 1.123.55, 2.25.7, and 2.26.2 have a permission flaw in their test-run feature that lets authenticated users with read-only access to workflows actually execute those workflows. When someone with restricted permissions triggers a test run, the workflow runs for real, potentially making unintended changes to connected systems, pulling or pushing data where it shouldn't, or calling external APIs on behalf of the organization. This bypasses the intended access controls that should prevent read-only users from executing workflows.

• CVE-2026-56815HIGH 7.4

  pwnlift versions before commit d7a9544 contain a symlink-following vulnerability in their file upload handler. When deployed with elevated privileges, an attacker with local access could exploit this flaw to read or modify sensitive files on the system, or potentially execute code with the same privileges as the vulnerable application. This is a local attack that requires no user interaction to trigger.

• CVE-2026-57589HIGH 7.4

  A use-after-free vulnerability exists in OpenBSD's System V semaphore implementation that allows a local attacker with no special privileges to escalate to root access. The flaw occurs when a process calls semget() and enters a sleep state; under specific timing conditions during context switching, freed memory can be accessed, compromising system integrity. This is a local attack requiring code execution on the target system but no prior privileges.

• CVE-2026-57723HIGH 7.4

  A Cross-Site Request Forgery (CSRF) vulnerability has been identified in VikBooking Hotel Booking Engine & PMS versions up to 1.8.12. This flaw allows an attacker to manipulate a hotel staff member or administrator into unknowingly performing actions through a malicious website or email link. While the vulnerability is classified as HIGH severity, it does not enable unauthorized data access or theft; instead, it can cause denial of service or operational disruption. The attack requires user interaction and occurs over the network without requiring special access privileges.

• CVE-2026-57736HIGH 7.4

  HubSpot versions through 11.3.51 contain a vulnerability that allows authenticated users to retrieve sensitive information that should not be transmitted. An attacker with valid login credentials can exploit this flaw to access embedded sensitive data that gets included in outbound communications or API responses. This is a data exposure risk rather than a remote code execution threat, but it carries real confidentiality and integrity implications for organizations using affected HubSpot instances.

• CVE-2026-57991HIGH 7.4

  Microsoft Edge (Chromium-based) contains a flaw in how it resolves symbolic links and shortcuts before accessing files. An attacker can craft a malicious link that, when clicked by a user, causes Edge to follow the link to an unintended location and disclose sensitive information over the network. The vulnerability requires user interaction (clicking the link) but does not require authentication and can affect systems across a network.

• CVE-2026-57993HIGH 7.4

  Microsoft Edge (Chromium-based) contains a server-side request forgery vulnerability that allows an attacker to trick the browser into making unauthorized network requests on behalf of the victim. An attacker can craft a malicious webpage that, when visited by an Edge user, causes Edge to access internal or restricted resources or spoof requests to third-party services. The attack requires user interaction (clicking a link or visiting a page) but can expose sensitive data or facilitate further attacks against internal systems or other users.

• CVE-2026-59806HIGH 7.4

  Gradio versions before 6.20.0 contain a pair of related vulnerabilities in how they handle file fetching. An attacker can craft a malicious link that tricks users into visiting arbitrary websites (open redirect), or more critically, can manipulate the /gradio_api/file= endpoint to make the Gradio server itself fetch files from internal systems—including cloud metadata services that store sensitive credentials like AWS EC2 IAM role tokens. The attack requires user interaction (clicking a link) but can expose highly sensitive infrastructure secrets once triggered.

• CVE-2026-6900HIGH 7.4

  A certificate validation flaw in B&R Industrial Automation's APROL platform allows attackers to bypass security checks that verify the authenticity of remote systems. An attacker positioned on the network could intercept communications and impersonate legitimate systems, potentially gaining unauthorized access or manipulating industrial automation processes without being detected.

• CVE-2026-7830HIGH 7.4

  UltraVNC versions through 1.8.2.2 contain a critical weakness in how it secures remote desktop connections using MS-Logon II authentication. The vulnerability allows an attacker who can monitor network traffic—whether through packet sniffing, session recording, or man-in-the-middle positioning—to recover login credentials in plaintext. The flaw stems from two problems: the encryption uses weak 64-bit parameters that can be broken in under a second, and the session key generation relies on predictable random numbers seeded from the system clock, making it recoverable within a minute. Once an attacker obtains the session key, they can decrypt and steal the username and password being transmitted. This is a serious risk for any organization relying on UltraVNC for remote access, especially over untrusted networks.

• CVE-2026-8646HIGH 7.4

  IBM WebSphere Application Server versions 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.6 contain a flaw that allows attackers to craft malicious HTTP requests that bypass normal request processing. These smuggled requests can circumvent security controls, impersonate legitimate users, gain elevated privileges, and access sensitive data. The vulnerability requires specific conditions to exploit but poses significant risk to organizations relying on these servers.

• CVE-2026-9006HIGH 7.4

  IBM WebSphere Application Server versions 8.5 and 9.0 contain a server-side request forgery (SSRF) flaw when the Ajax Proxy feature is enabled. An attacker can exploit this to make unauthorized requests from the vulnerable server, potentially accessing internal resources, bypassing security controls, or extracting sensitive information. The vulnerability requires specific network conditions but does not require user interaction or authentication.

• CVE-2026-9547HIGH 7.4

  A vulnerability in libcurl's SSH functionality allows applications using SCP or SFTP transfers with custom host key verification callbacks to silently accept servers with mismatched host key types. When a server presents a key type different from what's stored in the known_hosts file, the callback mechanism fails to enforce the mismatch, permitting the connection to proceed without warning. This creates a window for man-in-the-middle attacks where an attacker could intercept traffic or inject malicious data.

• CVE-2026-9697HIGH 7.4

  Undici's ProxyAgent, a popular Node.js HTTP client library, has a configuration flaw affecting SOCKS5 proxies. When you configure the library to use a SOCKS5 proxy and also set custom TLS options (like pinning to your internal certificate authority), those TLS settings are silently ignored. Instead, the library falls back to the default public CA bundle, making it possible for an attacker on the network to intercept and modify HTTPS traffic. This breaks certificate pinning strategies that many organizations rely on for security. The issue affects versions 7.23.0 through 7.27.x in the v7 branch and earlier versions in the v8 branch.

• CVE-2025-69189HIGH 7.3

  EMV JobBank versions up to 1.2.3 contain a missing authorization flaw that allows unauthenticated attackers to exploit improperly configured access controls. An attacker can access sensitive functionality without providing valid credentials, potentially reading, modifying, or disrupting data and services depending on what the unprotected endpoints expose.

• CVE-2026-0131HIGH 7.3

  A vulnerability in Android's RTP packet processing allows a local attacker to access memory outside intended boundaries, potentially escalating their privileges. The flaw stems from an integer overflow in the RtpPacket::decodePacket function. An attacker with basic local access can trigger the vulnerability if a user interacts with a malicious RTP stream—for example, by opening a crafted media file or accepting a call with specially prepared audio/video data.

• CVE-2026-10068HIGH 7.3

  A server-side request forgery (SSRF) vulnerability has been identified in Shibby Tomato version 1.28, specifically within the miniupnpd daemon's SUBSCRIBE call handler. An attacker can exploit this flaw remotely without authentication to make the affected device perform unintended network requests on their behalf. This could lead to unauthorized access to internal services, data exfiltration, or lateral movement within a network. However, the practical impact is limited since Shibby Tomato is no longer maintained, with the project having been superseded by FreshTomato.

• CVE-2026-10110HIGH 7.3

  A SQL injection vulnerability exists in code-projects Student Details Management System version 1.0 affecting the /index.php file. An attacker can manipulate the 'roll' parameter to inject arbitrary SQL commands, potentially accessing, modifying, or deleting sensitive student records. The vulnerability requires no authentication and can be exploited remotely over the network. Public exploit code is already available, increasing the risk of active exploitation.

• CVE-2026-10111HIGH 7.3

  A SQL injection vulnerability exists in the Login Page of sambitraj STUDENT-MANAGEMENT-SYSTEM version 1.0. An attacker can manipulate the email parameter during login to inject malicious SQL commands, potentially compromising the database. The vulnerability requires no authentication or user interaction and can be exploited remotely. Exploit code has already been published publicly, elevating the practical risk.

• CVE-2026-10157HIGH 7.3

  Open5GS, an open-source 5G core network software stack, contains an authentication bypass vulnerability in its NGAP (NG Application Protocol) PathSwitchRequest message handler. An unauthenticated attacker can exploit this remotely to bypass authentication controls, potentially gaining unauthorized access to 5G network functions. The vulnerability affects Open5GS versions up to 2.7.6 and has been publicly disclosed with exploit code available, elevating the practical risk to deployed systems.

• CVE-2026-10167HIGH 7.3

  A flaw in the OUSL-GROUP-BrinaryBrains School Student Management System allows attackers to bypass authentication by manipulating role parameters during login cookie creation. An attacker can remotely exploit this without requiring special privileges or user interaction, potentially gaining unauthorized access to the system. Proof-of-concept code has been publicly released, increasing the risk of real-world exploitation.

• CVE-2026-10178HIGH 7.3

  A SQL injection vulnerability exists in code-projects Online Music Site version 1.0 that allows unauthenticated remote attackers to inject malicious SQL commands through the ID parameter in the admin album editing interface. The flaw permits reading, modifying, or deleting database records without authorization. Public exploit code is available, elevating immediate risk.

• CVE-2026-10184HIGH 7.3

  SourceCodester Hospitals Patient Records Management System version 1.0 contains a SQL injection vulnerability in its user deletion function. An attacker can send a specially crafted request to the /classes/Users.php endpoint that manipulates the ID parameter, allowing unauthorized database queries. Because this flaw requires no authentication and can be exploited over the network, it poses a significant risk to hospital operations and patient data confidentiality.

• CVE-2026-10185HIGH 7.3

  A SQL injection vulnerability exists in SourceCodester Hospitals Patient Records Management System version 1.0. An attacker can send a malicious request to the /classes/Users.php file with a crafted ID parameter that causes the application to execute unintended database commands. No authentication is required, and the vulnerability is accessible over the network. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-10186HIGH 7.3

  CVE-2026-10186 is a SQL injection vulnerability in code-projects Online Hospital Management System version 1.0. An attacker can craft a malicious request to the /patient.php file, manipulating the 'editid' parameter to execute arbitrary SQL commands against the backend database. No authentication is required, and the exploit can be triggered remotely over the network. Public exploit details are available, increasing the practical risk of active exploitation.

• CVE-2026-10208HIGH 7.3

  A SQL injection vulnerability exists in the Online Hospital Management System version 1.php, specifically in the login_user function of login_1.php. An attacker can manipulate the Username parameter during login to inject malicious SQL commands. This allows unauthorized access and data compromise without requiring authentication or user interaction. The vulnerability is remotely exploitable and public exploit code has already been released.

• CVE-2026-10214HIGH 7.3

  A command injection vulnerability exists in the Bash Tool component of chatgpt-on-wechat versions up to 2.0.8. An attacker can remotely exploit a flaw in the _get_safety_warning function to execute arbitrary operating system commands without authentication. This issue is being actively exploited in the wild. Organizations using affected versions should prioritize upgrading to 2.0.9 immediately.

• CVE-2026-10219HIGH 7.3

  nextlevelbuilder GoClaw versions up to 3.11.3 contain a command injection vulnerability in the write_file tool. An unauthenticated attacker can manipulate the WriteFile function to inject arbitrary operating system commands, which are then executed on the affected system. The vulnerability is remotely exploitable and does not require user interaction or special privileges.

• CVE-2026-10220HIGH 7.3

  NousResearch's hermes-agent application contains a vulnerability in how it handles plugin skill requests. An attacker can send specially crafted input to the skill_view function that gets injected into backend operations, potentially compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is network-accessible, requires no authentication, and can be triggered without user interaction. Because exploit details have been publicly disclosed, the attack surface is visible to potential adversaries.

• CVE-2026-10221HIGH 7.3

  A code injection vulnerability exists in NousResearch's hermes-agent software, affecting versions up to 0.12.0. The flaw resides in the context compression function and allows remote attackers to inject malicious code without requiring authentication or user interaction. Public exploit code is available, increasing the practical risk of exploitation.

• CVE-2026-10225HIGH 7.3

  A SQL injection vulnerability exists in raisulislamg4's student management system (PHP-based). An attacker can manipulate the Username parameter in the login_check.php file to inject malicious SQL commands. The vulnerability is network-accessible, requires no authentication, and doesn't require user interaction. Exploit code is publicly available. The project uses a rolling release model, making it difficult to track specific patched versions.

• CVE-2026-10226HIGH 7.3

  A SQL injection vulnerability exists in the raisulislamg4 student management system (a PHP-based open-source project). An attacker can manipulate parameters in the delete.php file—specifically user_id, course_id, teacher_id, student_id, or application_id—to inject malicious SQL commands. This can be exploited remotely without authentication or user interaction, allowing an attacker to read, modify, or delete database records. Proof-of-concept code has been published, increasing the risk of active exploitation.

• CVE-2026-10227HIGH 7.3

  A SQL injection vulnerability exists in the student management system by raisulislamg4 (up to commit 310d950e) that allows unauthenticated attackers to manipulate the role parameter in the user creation process. An attacker can submit malicious input through the add_user_check.php endpoint to execute arbitrary SQL commands, potentially reading, modifying, or deleting database contents. The vulnerability has been publicly disclosed and proof-of-concept information is available, increasing the likelihood of active exploitation.

• CVE-2026-10236HIGH 7.3

  A security flaw exists in SourceCodester Water Billing Management System version 1.0 that allows attackers to bypass authorization controls in the User Management system. An attacker can remotely manipulate user-related operations through the /classes/Users.php?f=save endpoint without needing credentials or user interaction. This means an unauthorized person could potentially create, modify, or access user accounts and associated data. Public disclosure of this vulnerability means attackers are likely already aware of and testing for it.

• CVE-2026-10243HIGH 7.3

  A critical authentication flaw exists in code-projects Smart Parking System version 1.0 that allows unauthenticated remote attackers to bypass security controls on multiple administrative endpoints. An attacker can interact with these endpoints without valid credentials, potentially gaining unauthorized access to sensitive parking system functions. The vulnerability has been publicly disclosed and exploit code is available, elevating the risk of active exploitation.

• CVE-2026-10249HIGH 7.3

  A SQL injection vulnerability exists in itsourcecode Online Blood Bank Management System version 1.0 within the admin request-viewing interface. An unauthenticated attacker can manipulate the ID parameter to inject malicious SQL commands, potentially allowing unauthorized access to sensitive patient data, modification of records, or system disruption. Public exploits are already available, elevating the practical risk.

• CVE-2026-10250HIGH 7.3

  A SQL injection vulnerability exists in itsourcecode Online Blood Bank Management System version 1.0 that allows unauthenticated attackers to manipulate the hospital parameter in the /admin/campsdetails.php file, potentially compromising the confidentiality, integrity, and availability of the system and its data. The vulnerability is remotely exploitable and public exploit code is available, elevating active exploitation risk.

• CVE-2026-10251HIGH 7.3

  A SQL injection vulnerability exists in itsourcecode Online House Rental System version 1.0. An attacker can send a specially crafted request to the login functionality via the Username parameter to execute arbitrary database commands. Because the vulnerability requires no authentication and can be triggered remotely, it poses a significant risk to exposed instances. Public exploit code is available, increasing the likelihood of active exploitation.

• CVE-2026-10252HIGH 7.3

  A SQL injection vulnerability exists in itsourcecode Online House Rental System version 1.0 that allows unauthenticated attackers to inject malicious SQL commands through the ID parameter in the /manage_tenant.php file. This could enable attackers to read, modify, or delete tenant data stored in the application's database without requiring any special credentials or user interaction. The vulnerability is publicly known and exploit code is available.

• CVE-2026-10253HIGH 7.3

  A SQL injection vulnerability exists in itsourcecode Online House Rental System version 1.0. The vulnerability is located in the /manage_payment.php file, specifically in how it processes the ID parameter. An attacker can manipulate this parameter to inject malicious SQL commands, potentially allowing unauthorized access to sensitive payment and rental data. The vulnerability requires no authentication, can be exploited over the network, and exploit code is publicly available.

• CVE-2026-10260HIGH 7.3

  CodeAstro Online Job Portal version 1.0 contains a SQL injection vulnerability in its admin job deletion function. An attacker can manipulate the ID parameter in the /admin/jobs-admins/delete-jobs.php file to inject malicious SQL commands, potentially compromising the database. The vulnerability requires no authentication and can be exploited over the network. Proof-of-concept code has been released publicly, increasing the likelihood of active exploitation.

• CVE-2026-10261HIGH 7.3

  CodeAstro Online Job Portal version 1.0 contains a SQL injection vulnerability in its application status checking functionality. An attacker can manipulate the ID parameter in the /users/application_status.php file to inject malicious SQL commands, potentially gaining unauthorized access to the database. The vulnerability can be exploited remotely without authentication, making it accessible to anyone on the internet.

• CVE-2026-10262HIGH 7.3

  A SQL injection vulnerability exists in Real State Services version 1.0 that allows an attacker to manipulate the Username parameter in the login form (/loginuser.php) to inject malicious SQL commands. Because no authentication is required and the vulnerability can be triggered over the network, an attacker can exploit this remotely to read, modify, or delete sensitive database information without needing valid credentials. The flaw has been publicly disclosed, increasing the risk of active exploitation.

• CVE-2026-10263HIGH 7.3

  A SQL injection vulnerability exists in SourceCodester Computer Repair Shop Management System version 1.0 and earlier. An attacker can manipulate the ID parameter in the product management interface to inject malicious SQL commands, potentially exposing, modifying, or deleting sensitive data. The vulnerability requires no authentication and can be exploited remotely by anyone with network access to the application.

• CVE-2026-10273HIGH 7.3

  php-censor versions up to 2.1.6 contain a remote code execution vulnerability in the webhook processing logic. An attacker can manipulate the commitId parameter sent to the Webhook Endpoint to inject and execute arbitrary operating system commands on the affected server. No authentication is required, and the exploit technique has been publicly disclosed, increasing the likelihood of active exploitation.

• CVE-2026-10280HIGH 7.3

  Horizon921's mcpilot version 0.1.0 contains a server-side request forgery (SSRF) vulnerability in its MCP API Call Endpoint. An attacker can manipulate the serverBaseUrl parameter to trick the application into making requests to arbitrary internal or external systems. Because this requires no authentication and can be exploited over the network, it represents a meaningful attack surface for anyone running this software. The flaw has already been disclosed publicly and exploit code is available.

• CVE-2026-10281HIGH 7.3

  Enderfga's claw-orchestrator contains an authentication bypass in its API endpoint handler. Versions up to 3.5.5 fail to enforce authentication checks in the EmbeddedServer component, allowing unauthenticated remote attackers to access protected functionality. The flaw has been publicly disclosed and exploit code is available. Version 3.5.6 addresses the issue.

• CVE-2026-10287HIGH 7.3

  A server-side request forgery (SSRF) vulnerability exists in SourceCodester SEO Meta Tag Extractor version 1.0. An attacker can manipulate the URL parameter passed to the get_headers function in /index.php to make the vulnerable server perform requests on their behalf—potentially accessing internal services, exfiltrating data, or launching attacks against other systems on the network. No authentication is required, and the flaw can be exploited remotely over the network. Public exploit code is already available.

• CVE-2026-10288HIGH 7.3

  A flaw in the Hotel and Tourism Reservation System version 1.0 allows attackers to bypass admin authentication. The vulnerability exists in the admin login page where the password verification function can be manipulated, enabling unauthorized access to the administrative interface without valid credentials. An attacker can exploit this remotely over the network, and proof-of-concept code has already been published publicly.

• CVE-2026-10290HIGH 7.3

  A SQL injection vulnerability exists in the Hotel and Tourism Reservation System version 1.0, specifically in the tour.php file's GET parameter handler. An attacker can manipulate the 'tour' parameter to inject arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the database. Because the vulnerability is remotely exploitable without authentication, and public exploits are available, organizations running this software face immediate risk.

• CVE-2026-10606HIGH 7.3

  DedeCMS version 5.7.88 contains a SQL injection vulnerability in its feedback handling system. An attacker can manipulate user input passed to the TrimMsg function in the feedback component to inject malicious SQL commands. Since no authentication is required and the attack can be performed over the network, this vulnerability poses a significant risk to any organization running the affected version. The vulnerability has already been disclosed publicly, increasing the likelihood of active exploitation.

• CVE-2026-10607HIGH 7.3

  DedeCMS 5.7.88 contains a SQL injection vulnerability in its friend links management function. An attacker can manipulate the 'msg' parameter in /plus/flink.php to inject malicious SQL commands, allowing unauthorized database access, modification, or deletion. No authentication is required, and the vulnerability can be exploited over the network. Public exploit code exists, elevating the practical risk.

• CVE-2026-10608HIGH 7.3

  DedeCMS version 5.7.88 contains a SQL injection vulnerability in its RemoveXSS function within the /plus/carbuyaction.php file. An attacker can inject malicious SQL commands through the postname or des parameters without authentication, potentially compromising data confidentiality, integrity, and availability. The vulnerability is remotely exploitable and proof-of-concept code has been publicly released.

• CVE-2026-10617HIGH 7.3

  GoClaw, a component by nextlevelbuilder, contains a flaw in its webhook verification handler that allows attackers to bypass authentication checks. An unauthenticated remote attacker can exploit this weakness to gain unauthorized access to protected webhook endpoints. The vulnerability affects GoClaw versions up to and including 3.11.3, and exploit code has already been made public, increasing the practical risk.

• CVE-2026-10619HIGH 7.3

  A remote authentication bypass vulnerability exists in the sayan365 student-management-system affecting commit 7f3c9ce7d410332335c2affac93a385485051800 and earlier versions. An unauthenticated attacker can bypass authentication controls on multiple endpoints without requiring any special privileges or user interaction. The vulnerability allows attackers to gain unauthorized access to the system with confidentiality, integrity, and availability impact. Public exploit code is now available, increasing immediate risk.

• CVE-2026-10620HIGH 7.3

  A SQL injection vulnerability exists in code-projects Student Admission System version 1.0. The flaw resides in the /index.php file and can be exploited by manipulating the eid or did parameters. An attacker can inject malicious SQL commands without authentication, potentially reading or modifying sensitive student and admission data. Public exploit code is available, increasing the likelihood of active exploitation.

• CVE-2026-10694HIGH 7.3

  SourceCodester's Online Food Ordering System version 2.0 contains a file inclusion vulnerability in its index.php page parameter. An unauthenticated attacker can supply a malicious page argument to cause the application to include and execute arbitrary files, potentially from the local filesystem or remote sources. This vulnerability requires no user interaction and can be exploited over the network. Public exploits are available.

• CVE-2026-10704HIGH 7.3

  SourceCodester's Pizzafy E-Commerce System version 1.0 contains a SQL injection vulnerability in the administrative login function. An attacker can manipulate the username field during authentication to inject malicious SQL commands, potentially gaining unauthorized database access without needing credentials or user interaction. The vulnerability is network-accessible and exploits are now publicly available.

• CVE-2026-10771HIGH 7.3

  A server-side request forgery (SSRF) vulnerability exists in CRMEB Java version 1.4. An attacker can manipulate the URL parameter in the RestTemplate.getForEntity function to force the server to make unintended outbound requests. This occurs in the QR code generation endpoint and requires no authentication. Since exploit code has been publicly disclosed, the risk of active exploitation is elevated.

• CVE-2026-10777HIGH 7.3

  A weakness in the administrative backend of ealpha072's Student-Management-System allows attackers to bypass authentication controls and gain unauthorized access to sensitive functions. The vulnerability exists in the admin/config.php file and can be exploited remotely without requiring any special privileges or user interaction. Because exploit code is publicly available, the risk of active abuse is elevated. The project uses a rolling release model, so specific patched versions have not been publicly disclosed.

• CVE-2026-10845HIGH 7.3

  IBM WebSphere Application Server versions 8.5 and 9.0 contain an authentication bypass vulnerability in their JAX-WS (Java API for XML Web Services) implementations. An attacker on the network can exploit this flaw to bypass login controls and gain unauthorized access to affected applications without providing valid credentials. The vulnerability requires no user interaction and can be triggered remotely, making it a practical threat to organizations running these older WebSphere versions.

• CVE-2026-10877HIGH 7.3

  A SQL injection vulnerability exists in the SourceCodester Ship Ferry Ticket Reservation System version 1.0 and earlier. An attacker can exploit the admin login page by manipulating the Username parameter to execute arbitrary SQL commands remotely. No authentication is required to attempt the attack, and the vulnerability has already been publicly disclosed with functional exploits available.

• CVE-2026-11035HIGH 7.3

  Google Chrome on Android contains a flaw in how it handles Custom Tabs—a feature that allows apps to open web content within their own interface. An attacker with local access to a device can exploit this vulnerability by crafting a malicious XML file, potentially gaining elevated privileges on the system. The issue affects Chrome versions prior to 149.0.7827.53. While the base severity from Chromium is listed as Medium, the overall risk score reflects the complete attack chain impact.

• CVE-2026-11115HIGH 7.3

  A use-after-free vulnerability exists in Google Chrome's update mechanism on Windows systems. An attacker with local access can exploit this flaw by crafting a malicious file, potentially escalating their privileges to system or administrator level. The vulnerability affects Chrome versions before 149.0.7827.53 and requires user interaction (such as opening or running a file) to trigger the exploit.

• CVE-2026-11334HIGH 7.3

  A SQL injection vulnerability exists in tittuvarghese CollegeManagementSystem that allows unauthenticated attackers to manipulate the department_code parameter in the dashboard form submission handler, leading to unauthorized database access and potential data theft or modification. The vulnerability is remotely exploitable without authentication, and public exploit information is already available. The affected software uses continuous delivery with rolling releases, making version tracking impractical.

• CVE-2026-11342HIGH 7.3

  A SQL injection vulnerability exists in the Hotel and Tourism Reservation System version 1.0. An attacker can manipulate the 'room' parameter in the /details.php file to inject malicious SQL commands, potentially accessing, modifying, or deleting sensitive data. The vulnerability requires no authentication and can be exploited remotely by anyone with network access to the affected application.

• CVE-2026-11344HIGH 7.3

  A file upload vulnerability exists in code-projects Vehicle Management System version 1.0. An attacker can bypass upload restrictions by manipulating the photo parameter in the New Driver Registration Form, allowing them to upload arbitrary files to the server without authentication. This can lead to remote code execution or other system compromise. Public exploit code is available, making active exploitation likely.

• CVE-2026-11417HIGH 7.3

  AWS CDK (Cloud Development Kit) contains a command injection vulnerability in how it bundles Node.js functions for local development and deployment. An attacker who can control certain bundling settings—such as external modules, code definitions, loaders, injections, or esbuild arguments—can inject shell commands that execute on the developer's machine when the CDK toolchain runs. This requires an attacker to have influence over the CDK application configuration, making it relevant primarily in shared development environments or when developers use untrusted CDK configurations.

• CVE-2026-11435HIGH 7.3

  Jinher OA 1.0 contains a SQL injection vulnerability in its nextselectplan.aspx file. An attacker can manipulate the httpOID parameter to inject malicious SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability requires no authentication and can be exploited over the network. Proof-of-concept code has been publicly disclosed.