https://bugrater.com/releases/cve-2026-119070-the-optimole-optimize-images-convert-webp-avif-cdn-lazy-load-image-optimization-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-vi2026-11-07 https://bugrater.com/releases/cve-2026-119098-the-lifterlms-wp-lms-for-elearning-online-courses-quizzes-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-answer-parameter-i2026-11-07 https://bugrater.com/releases/cve-2026-119152-the-appointment-booking-plugin-latepoint-calendar-scheduling-for-wordpress-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-cust2026-11-07 https://bugrater.com/releases/cve-2026-119165-the-wpbakery-page-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-display-name-nickname-parameter-in-all-versions-up-to-a2026-11-07 https://bugrater.com/releases/cve-2026-119175-the-flying-images-optimize-and-lazy-load-images-for-faster-page-speed-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-comment-param2026-11-07 https://bugrater.com/releases/cve-2026-119213-the-fluent-support-helpdesk-customer-support-ticket-system-plugin-for-wordpress-is-vulnerable-to-unauthenticated-modification-of-a-linked-customer-s-stored2026-11-07 https://bugrater.com/releases/cve-2026-119218-the-greenshift-animation-and-page-builder-blocks-plugin-for-wordpress-is-vulnerable-to-stored-dom-based-cross-site-scripting-via-the-url-comment-author-url2026-11-07 https://bugrater.com/releases/cve-2026-119219-the-jupiter-x-core-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-fields-custom-meta-field-id-parameter-in-all-versions-up-to-a2026-11-07 https://bugrater.com/releases/cve-2026-119616-the-noptin-newsletter-new-post-notifications-email-automation-plugin-for-wordpress-is-vulnerable-to-local-file-inclusion-in-all-versions-up-to-and-includi2026-11-07 https://bugrater.com/releases/cve-2026-120082-the-geodirectory-wp-business-directory-plugin-and-classified-listings-directory-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-pos2026-11-07 https://bugrater.com/releases/cve-2026-120512-the-form-maker-by-10web-mobile-friendly-drag-drop-contact-form-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-wdform-n2026-11-07 https://bugrater.com/releases/cve-2026-120520-the-greenshift-animation-and-page-builder-blocks-plugin-for-wordpress-is-vulnerable-to-sensitive-information-exposure-in-all-versions-up-to-and-including-132026-11-07 https://bugrater.com/releases/cve-2026-120540-the-iubenda-all-in-one-compliance-for-gdpr-ccpa-cookie-consent-more-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-in-versions-up-to-a2026-11-07 https://bugrater.com/releases/cve-2026-120555-the-jupiter-x-core-plugin-for-wordpress-is-vulnerable-to-directory-traversal-in-all-versions-up-to-and-including-4-62-0-via-the-file-parameter-parameter-th2026-11-07 https://bugrater.com/releases/cve-2026-120737-the-jupiter-x-core-plugin-for-wordpress-is-vulnerable-to-authorization-bypass-in-all-versions-up-to-and-including-4-62-0-this-is-due-to-the-plugin-not-properl2026-11-07 https://bugrater.com/releases/cve-2026-120741-the-motopress-appointment-booking-lite-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-in-versions-up-to-and-including-2-4-8-via-the-public2026-11-07 https://bugrater.com/releases/cve-2026-121515-the-fv-flowplayer-video-player-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-comment-parameter-in-all-versions-up-to-and-includin2026-11-07 https://bugrater.com/releases/cve-2026-121519-the-social-slider-feed-social-media-feed-gallery-widgets-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-slidespeed-parameter-in2026-11-07 https://bugrater.com/releases/cve-2026-93754-the-payever-woocommerce-gateway-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-upload-leading-to-remote-code-execution-in-various-versions-up-to-and-in2026-11-07 https://bugrater.com/releases/cve-2026-119158-the-pie-register-user-registration-profiles-content-restriction-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-first-name-para2026-11-07 https://bugrater.com/releases/cve-2026-120560-the-active-woot-products-tables-for-woocommerce-100-free-plugin-for-wordpress-is-vulnerable-to-media-library-file-deletion-in-all-versions-up-to-and-includin2026-11-07 https://bugrater.com/releases/cve-2026-120677-the-optimole-optimize-images-convert-webp-avif-cdn-lazy-load-image-optimization-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-vi2026-11-07 https://bugrater.com/releases/cve-2026-120739-the-optimole-optimize-images-convert-webp-avif-cdn-lazy-load-image-optimization-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-vi2026-11-07 https://bugrater.com/releases/cve-2026-121516-the-qode-wishlist-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-qode-wishlist-for-woocommerce-guests-items-paramet2026-11-07 https://bugrater.com/releases/msrc-cve-2026-1094692026-11-07 https://bugrater.com/releases/cve-2026-19803-the-printcart-store-web-to-print-product-designer-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-upload-in-all-versions-up-to-and-inclu2026-11-07 https://bugrater.com/releases/cve-2026-110534-the-redux-framework-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-content-parameter-in-all-versions-up-to-and-including-4-5-16-d2026-11-07 https://bugrater.com/releases/cve-2026-110705-the-redux-framework-plugin-for-wordpress-is-vulnerable-to-authorization-bypass-in-all-versions-up-to-and-including-4-5-16-this-is-due-to-the-plugin-not-prope2026-11-07 https://bugrater.com/releases/cve-2026-119167-the-translatepress-translate-multilingual-sites-with-ai-translation-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-comment-parame2026-11-07 https://bugrater.com/releases/cve-2026-120043-the-affiliate-program-suite-slicewp-affiliates-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-email-parameter-in-all-versions-up-to-an2026-11-07 https://bugrater.com/releases/cve-2026-120477-the-stop-spammers-classic-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-author-post-parameter-in-versions-up-to-and-including-202026-11-07 https://bugrater.com/releases/cve-2026-93779-the-tutor-lms-elearning-and-online-course-solution-plugin-for-wordpress-is-vulnerable-to-insecure-direct-object-reference-in-all-versions-up-to-and-including2026-11-07 https://bugrater.com/releases/cve-2026-93902-the-soledad-theme-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-social-profile-fields-in-all-versions-up-to-and-including-8-7-7-due-to-insuff2026-11-07 https://bugrater.com/releases/cve-2026-9601-the-stackable-page-builder-gutenberg-blocks-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-update-block-style-endpoint-in-all-ver2026-11-07 https://bugrater.com/releases/cve-2025-15708-the-live-composer-wordpress-plugin-before-2-1-23-does-not-sanitise-and-escape-some-of-its-custom-post-type-slug-settings-before-using-them-in-front-end-links2026-11-07 https://bugrater.com/releases/cve-2026-117525-the-fv-flowplayer-video-player-wordpress-plugin-before-7-5-57-7212-does-not-escape-shortcode-attribute-values-embedded-in-comments-before-rendering-them-into-th2026-11-07 https://bugrater.com/releases/cve-2026-117588-the-wp-google-review-slider-wordpress-plugin-before-18-11-does-not-perform-nonce-validation-when-updating-its-active-google-places-configuration-allowing-attac2026-11-07 https://bugrater.com/releases/cve-2026-118528-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-does-not-validate-that-the-requesting-user-owns-the-refer2026-11-07 https://bugrater.com/releases/cve-2026-118529-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-does-not-verify-that-a-user-owns-a-listing-before-process2026-11-07 https://bugrater.com/releases/cve-2026-118530-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-does-not-check-that-the-acting-user-may-edit-each-targete2026-11-07 https://bugrater.com/releases/cve-2026-118532-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-does-not-verify-ownership-of-attachment-ids-supplied-when2026-11-07 https://bugrater.com/releases/cve-2026-118533-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-does-not-verify-that-the-user-requesting-an-order-s-payme2026-11-07 https://bugrater.com/releases/cve-2026-118534-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-does-not-verify-that-the-order-targeted-by-its-checkout-p2026-11-07 https://bugrater.com/releases/cve-2026-119073-the-live-composer-wordpress-plugin-before-2-1-23-does-not-escape-a-pagination-setting-supplied-through-its-post-listing-module-shortcodes-before-outputting-it2026-11-07 https://bugrater.com/releases/cve-2026-121379-the-tournamatch-wordpress-plugin-before-4-7-1-does-not-validate-or-restrict-the-path-of-a-previously-stored-profile-or-team-image-before-deleting-it-when-a-new2026-11-07 https://bugrater.com/releases/cve-2026-121491-the-fiber-admin-wordpress-plugin-before-4-0-1-does-not-validate-or-escape-a-request-header-before-writing-it-into-a-php-file-it-regenerates-on-an-unprotected-ad2026-11-07 https://bugrater.com/releases/cve-2026-121492-the-fiber-admin-wordpress-plugin-before-4-0-1-does-not-have-authorisation-checks-in-some-of-its-ajax-actions-allowing-unauthenticated-users-to-change-the-order2026-11-07 https://bugrater.com/releases/cve-2026-121796-the-add-from-server-lite-wordpress-plugin-before-6-0-0-does-not-restrict-svg-uploads-to-users-allowed-to-post-unfiltered-html-allowing-users-with-the-author-ro2026-11-07 https://bugrater.com/releases/cve-2026-121848-the-magic-link-wordpress-plugin-before-2-2-6-does-not-check-that-the-user-requesting-a-login-link-is-authorised-to-generate-one-for-the-chosen-account-allowin2026-11-07 https://bugrater.com/releases/cve-2026-121857-the-event-tickets-with-ticket-scanner-wordpress-plugin-before-3-1-14-does-not-check-that-a-user-may-manage-woocommerce-orders-before-returning-or-removing-ticke2026-11-07 https://bugrater.com/releases/cve-2026-121858-the-event-tickets-with-ticket-scanner-wordpress-plugin-before-3-2-9-does-not-properly-escape-a-search-value-before-using-it-in-sql-queries-in-several-of-its-adm2026-11-07 https://bugrater.com/releases/cve-2026-121866-the-ileads-sms-gateway-by-exsile-wordpress-plugin-before-2-0-0-does-not-check-capabilities-or-nonces-in-several-ajax-actions-that-update-a-site-option-chosen-by2026-11-07 https://bugrater.com/releases/cve-2026-122001-the-komfortkasse-for-woocommerce-wordpress-plugin-before-1-4-9-does-not-properly-validate-the-authenticity-of-rest-api-requests-overriding-wordpress-s-own-nonc2026-11-07 https://bugrater.com/releases/cve-2026-97189-the-advanced-custom-fields-acf-wordpress-plugin-before-6-8-11-does-not-perform-a-read-permission-check-when-it-renders-and-formats-the-values-of-its-relation2026-11-07 https://bugrater.com/releases/cve-2026-97190-the-advanced-custom-fields-acf-wordpress-plugin-before-6-8-11-does-not-verify-that-a-user-is-allowed-to-edit-the-target-object-before-writing-to-it-during-bi2026-11-07 https://bugrater.com/releases/cve-2026-97191-the-advanced-custom-fields-acf-wordpress-plugin-before-6-8-11-does-not-re-apply-its-field-group-location-rules-when-persisting-values-submitted-through-the-p2026-11-07 https://bugrater.com/releases/cve-2026-103917-the-the-quiz-and-survey-master-qsm-quiz-maker-survey-maker-plugin-for-wordpress-is-vulnerable-to-arbitrary-shortcode-execution-in-all-versions-up-to-and2026-11-07 https://bugrater.com/releases/cve-2026-115811-the-strong-testimonials-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-star-rating-parameter-in-all-versions-up-to-and-including2026-11-07 https://bugrater.com/releases/cve-2026-116558-the-unlimited-elements-for-elementor-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-title-description-inside-the-attacker-contro2026-11-07 https://bugrater.com/releases/cve-2026-116621-the-ultimate-member-user-profile-registration-login-member-directory-content-restriction-membership-plugin-plugin-for-wordpress-is-vulnerable-to-stored2026-11-07 https://bugrater.com/releases/cve-2026-118048-the-wp-data-access-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-simple-form-autocomplete-lookup-label-in-versions-up-to-and-includ2026-11-07 https://bugrater.com/releases/cve-2026-118204-the-wp-data-access-app-builder-for-tables-forms-dashboards-charts-maps-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-imageur2026-11-07 https://bugrater.com/releases/cve-2026-118800-the-ablocks-gutenberg-blocks-user-dashboard-builder-popup-builder-form-builder-animation-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site2026-11-07 https://bugrater.com/releases/cve-2026-118801-the-ablocks-gutenberg-blocks-user-dashboard-builder-popup-builder-form-builder-animation-builder-plugin-for-wordpress-is-vulnerable-to-sensitive-informat2026-11-07 https://bugrater.com/releases/cve-2026-120479-the-wp-data-access-app-builder-for-tables-forms-dashboards-charts-maps-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-data-pro2026-11-07 https://bugrater.com/releases/cve-2026-120515-the-seopress-ai-seo-plugin-on-site-seo-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-seopress-google-analytics-affiliate-tracki2026-11-07 https://bugrater.com/releases/cve-2026-120530-the-webtoffee-wp-backup-and-migration-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-description-parameter-in-all-versions-up-to-and-inc2026-11-07 https://bugrater.com/releases/cve-2026-120537-the-translatepress-translate-multilingual-sites-with-ai-translation-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-comment-storag2026-11-07 https://bugrater.com/releases/cve-2026-121536-the-wp-data-access-app-builder-for-tables-forms-dashboards-charts-maps-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-engine-param2026-11-07 https://bugrater.com/releases/cve-2026-121792-the-gamipress-gamification-plugin-to-reward-points-badges-ranks-in-wordpress-now-with-ai-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-t2026-11-07 https://bugrater.com/releases/cve-2026-122037-the-agenwebsite-shipping-plugin-ongkos-kirim-generate-resi-otomatis-semua-kurir-indonesia-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting2026-11-07 https://bugrater.com/releases/cve-2026-122265-the-vanquish-upload-files-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-directory-traversal-in-all-versions-up-to-and-including-2-7-13-via-the-vanupf2026-11-07 https://bugrater.com/releases/cve-2026-87112-the-qa-assistants-driven-by-data-plugin-for-wordpress-is-vulnerable-to-php-object-injection-in-all-versions-up-to-and-including-5-3-0-via-the-dlevent-ver2026-11-07 https://bugrater.com/releases/cve-2026-93370-the-paystack-woocommerce-payment-gateway-plugin-for-wordpress-is-vulnerable-to-sensitive-information-exposure-in-all-versions-up-to-and-including-5-8-5-via-th2026-11-07 https://bugrater.com/releases/cve-2026-123881-a-vulnerability-was-found-in-openbmb-internet-of-agents-up-to-9d78e88e47160eb42ee1ee8538c05e1c2c47877a-this-issue-affects-the-function-fetch-chat-record-of-the2026-11-07 https://bugrater.com/releases/cve-2026-104738-the-advanced-form-integration-connect-forms-to-300-apps-plugin-for-wordpress-is-vulnerable-to-php-object-injection-in-all-versions-up-to-and-including-2-102026-11-07 https://bugrater.com/releases/cve-2026-119467-missing-authorization-vulnerability-in-wpvibes-anywhere-elementor-anywhere-elementor-allows-exploiting-incorrectly-configured-access-control-security-levels-thi2026-11-07 https://bugrater.com/releases/cve-2026-119489-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bootstrapped-ventures-wp-recipe-maker-wp-recipe-maker-allo2026-11-07 https://bugrater.com/releases/cve-2026-119510-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-saeed-mc-woocommerce-wishlist-smart-wishlist-for-more-conv2026-11-07 https://bugrater.com/releases/cve-2026-120848-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wc-lovers-wcfm-marketplace-wc-multivendor-marketplace-allo2026-11-07 https://bugrater.com/releases/cve-2026-120849-missing-authorization-vulnerability-in-wc-lovers-wcfm-marketplace-wc-multivendor-marketplace-allows-exploiting-incorrectly-configured-access-control-security-le2026-11-07 https://bugrater.com/releases/cve-2026-121761-missing-authorization-vulnerability-in-infomaniak-network-vod-infomaniak-vod-infomaniak-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-07 https://bugrater.com/releases/cve-2026-121767-missing-authorization-vulnerability-in-wedevs-wedocs-wedocs-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-wedocs-f2026-11-07 https://bugrater.com/releases/cve-2026-121768-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-markus-wiesenhofer-contact-form-7-8211-post-fields-cf72026-11-07 https://bugrater.com/releases/cve-2026-121778-missing-authorization-vulnerability-in-wp-lab-wp-lister-lite-for-amazon-wp-lister-for-amazon-allows-exploiting-incorrectly-configured-access-control-security-le2026-11-07 https://bugrater.com/releases/cve-2026-121779-exposure-of-sensitive-system-information-to-an-unauthorized-control-sphere-vulnerability-in-yith-yith-woocommerce-subscription-yith-woocommerce-subscription-all2026-11-07 https://bugrater.com/releases/cve-2026-121781-missing-authorization-vulnerability-in-wp-manageninja-llc-fluent-booking-fluent-booking-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-07 https://bugrater.com/releases/cve-2026-122675-cross-site-request-forgery-csrf-vulnerability-in-wpmet-wp-social-wp-social-allows-cross-site-request-forgery-this-issue-affects-wp-social-from-n-a-through-32026-11-07 https://bugrater.com/releases/cve-2026-123957-a-vulnerability-was-determined-in-totolink-ca300-poe-6-2c-884-impacted-is-the-function-setipqosrules-of-the-file-cgi-bin-cstecgi-cgi-this-manipulation-of-the2026-11-07 https://bugrater.com/releases/cve-2026-123958-a-vulnerability-was-identified-in-totolink-ca300-poe-6-2c-884-the-affected-element-is-the-function-setlanconfig-of-the-file-cgi-bin-cstecgi-cgi-such-manipula2026-11-07 https://bugrater.com/releases/cve-2026-124274-missing-authorization-vulnerability-in-mycred-mycred-mycred-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-mycred-f2026-11-07 https://bugrater.com/releases/cve-2026-39733-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-properfraction-profilepress-wp-user-avatar-allows-code-injection2026-11-07 https://bugrater.com/releases/cve-2026-52713-missing-authorization-vulnerability-in-thimpress-learnpress-learnpress-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affect2026-11-07 https://bugrater.com/releases/cve-2026-66669-cross-site-request-forgery-csrf-vulnerability-in-suplugins-superb-addons-blocks-patterns-amp-theme-designer-superb-blocks-allows-cross-site-request-forger2026-11-07 https://bugrater.com/releases/cve-2026-103900-the-wpjam-basic-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-versions-up-to-and-including-7-1-this-is-due-to-the-wpjam-user-signup-signup2026-11-07 https://bugrater.com/releases/cve-2026-104992-the-booking-for-appointments-and-events-calendar-amelia-plugin-for-wordpress-is-vulnerable-to-authorization-bypass-in-all-versions-up-to-and-including-9-9-12026-11-07 https://bugrater.com/releases/cve-2026-107616-the-amelia-plugin-for-wordpress-is-vulnerable-to-unauthorized-access-of-attendee-data-due-to-a-missing-authorization-check-on-the-geteventattendeescommandhandle2026-11-07 https://bugrater.com/releases/cve-2026-110004-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-deletion-due-to-insufficient-file-path-validation-in-the-theme-delete-function-in-all-vers2026-11-07 https://bugrater.com/releases/cve-2026-118784-the-wpspeed-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-in-versions-up-to-and-including-2-6-10-this-is-due-to-a-combination-of-two-issue2026-11-07 https://bugrater.com/releases/cve-2026-119155-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-time-based-sql-injection-via-the-href-locale-parameter-in-all-versions-up-to-and-including-3-2-2-due2026-11-07 https://bugrater.com/releases/cve-2026-119164-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-all-versions-up-to-and-including-3-2-2-via-the-data-secondary-groupids-param2026-11-07 https://bugrater.com/releases/cve-2026-119465-insertion-of-sensitive-information-into-sent-data-vulnerability-in-wpvibes-elementor-addon-elements-addon-elements-for-elementor-page-builder-allows-retrieve-em2026-11-07 https://bugrater.com/releases/cve-2026-119473-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-properfraction-profilepress-wp-user-avatar-allows-code-injection2026-11-07 https://bugrater.com/releases/cve-2026-119484-cross-site-request-forgery-csrf-vulnerability-in-supsystic-photo-gallery-by-supsystic-gallery-by-supsystic-allows-cross-site-request-forgery-this-issue-affect2026-11-07 https://bugrater.com/releases/cve-2026-119486-missing-authorization-vulnerability-in-wp-manageninja-llc-fluentboards-fluent-boards-allows-exploiting-incorrectly-configured-access-control-security-levels-thi2026-11-07 https://bugrater.com/releases/cve-2026-119491-missing-authorization-vulnerability-in-david-lingren-media-library-assistant-media-library-assistant-allows-exploiting-incorrectly-configured-access-control-sec2026-11-07 https://bugrater.com/releases/cve-2026-119493-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-metaphor-creations-llc-ditty-ditty-news-ticker-allows-sto2026-11-07 https://bugrater.com/releases/cve-2026-119494-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-gemini-labs-site-reviews-site-reviews-allows-code-injection-this2026-11-07 https://bugrater.com/releases/cve-2026-119500-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bplugins-flash-html5-video-html5-video-player-allows-sto2026-11-07 https://bugrater.com/releases/cve-2026-119502-missing-authorization-vulnerability-in-bdthemes-ultimate-store-kit-elementor-addons-ultimate-store-kit-allows-exploiting-incorrectly-configured-access-control-s2026-11-07 https://bugrater.com/releases/cve-2026-119507-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-wpdeveloper-notificationx-notificationx-allows-code-injection-thi2026-11-07 https://bugrater.com/releases/cve-2026-119511-missing-authorization-vulnerability-in-saeed-mc-woocommerce-wishlist-smart-wishlist-for-more-convert-allows-exploiting-incorrectly-configured-access-control-sec2026-11-07 https://bugrater.com/releases/cve-2026-119520-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-brainstorm-force-spectra-ultimate-addons-for-gutenberg-all2026-11-07 https://bugrater.com/releases/cve-2026-120514-the-zephyr-project-manager-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-zpm-profile-picture-parameter-in-all-versions-up-to-and2026-11-07 https://bugrater.com/releases/cve-2026-120532-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-post-body-parameter-in-all-versions-up-to-and-including-3-2-2-du2026-11-07 https://bugrater.com/releases/cve-2026-120548-the-yml-for-yandex-market-plugin-for-wordpress-is-vulnerable-to-sensitive-information-exposure-in-all-versions-up-to-and-including-5-10-0-via-the-y4ym-check2026-11-07 https://bugrater.com/releases/cve-2026-120840-missing-authorization-vulnerability-in-themegrill-user-registration-user-registration-allows-exploiting-incorrectly-configured-access-control-security-levels-th2026-11-07 https://bugrater.com/releases/cve-2026-120842-missing-authorization-vulnerability-in-brainstorm-force-sureforms-sureforms-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-a2026-11-07 https://bugrater.com/releases/cve-2026-120847-missing-authorization-vulnerability-in-wpmet-metform-metform-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-metform2026-11-07 https://bugrater.com/releases/cve-2026-120850-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-elementor-elementor-website-builder-elementor-allows-store2026-11-07 https://bugrater.com/releases/cve-2026-120852-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-brainstorm-force-cartflows-cartflows-allows-code-injection-this-i2026-11-07 https://bugrater.com/releases/cve-2026-120853-missing-authorization-vulnerability-in-brainstorm-force-cartflows-cartflows-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-a2026-11-07 https://bugrater.com/releases/cve-2026-121762-cross-site-request-forgery-csrf-vulnerability-in-blubrry-podcasting-powerpress-podcasting-powerpress-allows-cross-site-request-forgery-this-issue-affects-powe2026-11-07 https://bugrater.com/releases/cve-2026-121766-missing-authorization-vulnerability-in-blubrry-podcasting-powerpress-podcasting-powerpress-allows-exploiting-incorrectly-configured-access-control-security-leve2026-11-07 https://bugrater.com/releases/cve-2026-122668-missing-authorization-vulnerability-in-mycred-mycred-mycred-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-mycred-f2026-11-07 https://bugrater.com/releases/cve-2026-123464-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-liquid-web-stellarwp-the-events-calendar-the-events-cale2026-11-07 https://bugrater.com/releases/cve-2026-123466-missing-authorization-vulnerability-in-leapworx-premium-blocks-gutenberg-blocks-for-wordpress-premium-blocks-for-gutenberg-allows-exploiting-incorrectly-confi2026-11-07 https://bugrater.com/releases/cve-2026-123469-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-liquid-web-stellarwp-the-events-calendar-the-events-calendar-al2026-11-07 https://bugrater.com/releases/cve-2026-123959-a-security-flaw-has-been-discovered-in-totolink-ca300-poe-6-2c-884-the-impacted-element-is-the-function-setlanguagecfg-of-the-file-cgi-bin-cstecgi-cgi-perfor2026-11-07 https://bugrater.com/releases/cve-2026-123960-a-weakness-has-been-identified-in-totolink-ca300-poe-6-2c-884-this-affects-the-function-setwanconfig-of-the-file-cgi-bin-cstecgi-cgi-executing-a-manipulation2026-11-07 https://bugrater.com/releases/cve-2026-61990-missing-authorization-vulnerability-in-wc-lovers-wcfm-membership-wc-multivendor-membership-allows-exploiting-incorrectly-configured-access-control-security-leve2026-11-07 https://bugrater.com/releases/cve-2026-95870-the-wpforo-forum-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-data-parameter-in-all-versions-up-to-and-including-3-2-1-due-to-insuffi2026-11-07 https://bugrater.com/releases/cve-2026-119478-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-stylemixthemes-masterstudy-lms-masterstudy-lms-learning-managemen2026-11-07 https://bugrater.com/releases/cve-2026-119490-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-made-with-fuel-ltd-better-notifications-for-wp-bnfw-allows-code2026-11-07 https://bugrater.com/releases/cve-2026-119492-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-metaphor-creations-llc-ditty-ditty-news-ticker-allows-code-injec2026-11-07 https://bugrater.com/releases/cve-2026-119496-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-david-lingren-media-library-assistant-media-library-assistant-all2026-11-07 https://bugrater.com/releases/cve-2026-119501-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bdthemes-element-pack-elementor-addons-bdthemes-element-pa2026-11-07 https://bugrater.com/releases/cve-2026-119508-missing-authorization-vulnerability-in-mamunur-rashid-radius-booking-booking-calendar-for-appointments-amp-services-radius-booking-allows-exploiting-incorre2026-11-07 https://bugrater.com/releases/cve-2026-119513-missing-authorization-vulnerability-in-ahmad-js-help-desk-js-support-ticket-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-a2026-11-07 https://bugrater.com/releases/cve-2026-119523-missing-authorization-vulnerability-in-cozmoslabs-paid-member-subscriptions-paid-member-subscriptions-allows-exploiting-incorrectly-configured-access-control-se2026-11-07 https://bugrater.com/releases/cve-2026-119525-missing-authorization-vulnerability-in-wp-desk-dropshipping-xml-for-woocommerce-dropshipping-xml-for-woocommerce-allows-exploiting-incorrectly-configured-access2026-11-07 https://bugrater.com/releases/cve-2026-120364-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-untapwp-vidplex-vidplex-allows-stored-xss-this-issue-affec2026-11-07 https://bugrater.com/releases/cve-2026-120365-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-aguila-technologies-wp-customer-area-customer-area-allows2026-11-07 https://bugrater.com/releases/cve-2026-120837-missing-authorization-vulnerability-in-everest-forms-everest-forms-everest-forms-allows-exploiting-incorrectly-configured-access-control-security-levels-this-is2026-11-07 https://bugrater.com/releases/cve-2026-120857-missing-authorization-vulnerability-in-videowhisper-com-2way-videocalls-and-random-chat-webcam-2way-videochat-allows-exploiting-incorrectly-configured-access-co2026-11-07 https://bugrater.com/releases/cve-2026-121571-missing-authorization-vulnerability-in-wp-desk-autopay-dla-woocommerce-pay-wp-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue2026-11-07 https://bugrater.com/releases/cve-2026-121724-missing-authorization-vulnerability-in-webberzone-contextual-related-posts-contextual-related-posts-allows-exploiting-incorrectly-configured-access-control-secu2026-11-07 https://bugrater.com/releases/cve-2026-121783-cross-site-request-forgery-csrf-vulnerability-in-passionate-programmer-peter-wp-data-access-wp-data-access-allows-cross-site-request-forgery-this-issue-affect2026-11-07 https://bugrater.com/releases/cve-2026-123148-missing-authorization-vulnerability-in-tms-ivyforms-ivyforms-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-ivyforms2026-11-07 https://bugrater.com/releases/cve-2026-123468-missing-authorization-vulnerability-in-stylemixthemes-motors-motors-car-dealership-classified-listings-allows-exploiting-incorrectly-configured-access-control-s2026-11-07 https://bugrater.com/releases/cve-2026-123470-missing-authorization-vulnerability-in-hivepress-hivepress-hivepress-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects2026-11-07 https://bugrater.com/releases/cve-2026-123961-a-security-vulnerability-has-been-detected-in-totolink-ca300-poe-6-2c-884-this-impacts-the-function-setwifibasicconfig-of-the-file-cgi-bin-cstecgi-cgi-the-ma2026-11-07 https://bugrater.com/releases/cve-2026-102564-the-the-dynific-addons-for-elementor-formerly-anywhere-elementor-plugin-for-wordpress-is-vulnerable-to-arbitrary-shortcode-execution-in-all-versions-up-to-an2026-11-07 https://bugrater.com/releases/cve-2026-103914-the-dynific-addons-for-elementor-plugin-for-wordpress-is-vulnerable-to-sql-injection-via-the-q-parameter-in-versions-up-to-and-including-1-3-this-is-due-to2026-11-07 https://bugrater.com/releases/cve-2026-104014-the-naimur-email-otp-verification-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-authentication-bypass-in-versions-up-to-and-including-2-1-0-this-is-d2026-11-07 https://bugrater.com/releases/cve-2026-104746-the-motors-car-dealership-classified-listings-plugin-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-deletion-due-to-insufficient-file-path-validation2026-11-07 https://bugrater.com/releases/cve-2026-104760-the-wedocs-ai-powered-knowledge-base-docs-documentation-wiki-ai-chatbot-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-modalplaceh2026-11-07 https://bugrater.com/releases/cve-2026-104768-the-automatorwp-no-code-workflow-automation-integration-webhooks-plugin-now-with-ai-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-all-vers2026-11-07 https://bugrater.com/releases/cve-2026-109214-the-user-frontend-membership-user-registration-user-profile-user-directory-content-restriction-with-frontend-post-submission-plugin-for-wordpress-is-vuln2026-11-07 https://bugrater.com/releases/cve-2026-109230-the-wp-visitor-statistics-real-time-traffic-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-browser-parameter-in-all-versions-up-t2026-11-07 https://bugrater.com/releases/cve-2026-109991-the-funnelkit-payment-gateway-for-stripe-woocommerce-plugin-for-wordpress-is-vulnerable-to-insecure-direct-object-reference-in-all-versions-up-to-and-including2026-11-07 https://bugrater.com/releases/cve-2026-111317-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-any-form-field-name-e-g-payload2026-11-07 https://bugrater.com/releases/cve-2026-111370-the-wp-visitor-statistics-real-time-traffic-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-os-also-browser-res-parameter-in-al2026-11-07 https://bugrater.com/releases/cve-2026-115548-the-quttera-threatsign-web-malware-scanner-for-wordpress-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-http-user-agent-parameter2026-11-07 https://bugrater.com/releases/cve-2026-116537-the-link-library-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-link-description-parameter-in-all-versions-up-to-and-including-72026-11-07 https://bugrater.com/releases/cve-2026-116751-the-booking-for-appointments-and-events-calendar-amelia-pro-plugin-for-wordpress-is-vulnerable-to-time-based-sql-injection-via-the-tag-array-keys-parame2026-11-07 https://bugrater.com/releases/cve-2026-118047-the-falang-multilanguage-for-wordpress-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-falang-term-taxonomy-locale-field-vi2026-11-07 https://bugrater.com/releases/cve-2026-118050-the-football-pool-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-shouttext-parameter-in-all-versions-up-to-and-including-2-13-5-d2026-11-07 https://bugrater.com/releases/cve-2026-118056-the-image-hover-effects-ultimate-image-gallery-effects-lightbox-comparison-magnifier-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting2026-11-07 https://bugrater.com/releases/cve-2026-118066-the-appointment-booking-plugin-latepoint-calendar-scheduling-for-wordpress-plugin-for-wordpress-is-vulnerable-to-authentication-bypass-via-account-takeove2026-11-07 https://bugrater.com/releases/cve-2026-118267-the-wp-data-access-app-builder-for-tables-forms-dashboards-charts-maps-plugin-for-wordpress-is-vulnerable-to-incorrect-authorization-leading-to-privilege2026-11-07 https://bugrater.com/releases/cve-2026-119075-the-registration-form-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-due-to-a-missing-allow-list-check-in-the-formhandler-validate2026-11-07 https://bugrater.com/releases/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-form-field-mapped-to-a-post-meta-ke2026-11-07 https://bugrater.com/releases/cve-2026-119498-authentication-bypass-using-an-alternate-path-or-channel-vulnerability-in-relywp-simple-cloudflare-turnstile-simple-cloudflare-turnstile-allows-authentication-a2026-11-07 https://bugrater.com/releases/cve-2026-120509-the-real-testimonials-testimonial-slider-collect-customer-reviews-and-video-testimonials-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-vi2026-11-07 https://bugrater.com/releases/cve-2026-120683-the-real-testimonials-testimonial-slider-collect-customer-reviews-and-video-testimonials-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-vi2026-11-07 https://bugrater.com/releases/cve-2026-120685-the-real-testimonials-testimonial-slider-collect-customer-reviews-and-video-testimonials-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-vi2026-11-07 https://bugrater.com/releases/cve-2026-121765-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-cozmoslabs-translatepress-translatepress-multilingual-allo2026-11-07 https://bugrater.com/releases/cve-2026-121976-the-modula-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-items-parameter-in-versions-up-to-and-including-3-0-17-this-is-due-to-i2026-11-07 https://bugrater.com/releases/cve-2026-121977-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-note-form-field-whose-value-is-writ2026-11-07 https://bugrater.com/releases/cve-2026-122059-the-wp-imageviewer-plugin-for-wordpress-is-vulnerable-to-stored-dom-based-cross-site-scripting-via-the-img-alt-parameter-in-all-versions-up-to-and-including2026-11-07 https://bugrater.com/releases/cve-2026-122231-the-ws-form-lite-drag-drop-contact-form-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-field-id-0-0-parameter-in-al2026-11-07 https://bugrater.com/releases/cve-2026-123418-the-church-admin-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-lat-parameter-in-all-versions-up-to-and-including-5-1-7-due-to-in2026-11-07 https://bugrater.com/releases/cve-2026-93429-the-vikbooking-hotel-booking-engine-pms-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-guests-documents-parameter-in-all-version2026-11-07 https://bugrater.com/releases/cve-2026-93755-the-happyforms-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-spoofable-client-ip-headers-in-versions-up-to-and-including-1-38-9-this2026-11-07 https://bugrater.com/releases/cve-2026-93766-the-happyforms-pro-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-happyforms-client-referer-parameter-in-all-versions-up-to-and-in2026-11-07 https://bugrater.com/releases/cve-2026-96565-the-wp-members-membership-plugin-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-woocommerce-checkout-multicheckbox-multiselect-field-sca2026-11-07 https://bugrater.com/releases/cve-2026-109973-the-image-hover-effects-ultimate-visual-composer-flipbox-awesomes-flip-boxes-image-overlay-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting2026-11-07 https://bugrater.com/releases/cve-2026-119156-the-download-manager-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-wpdm-reg-first-name-wpdm-reg-last-name-wpdm-reg-user-login2026-11-07 https://bugrater.com/releases/cve-2026-120579-the-active-woot-products-tables-for-woocommerce-100-free-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-help-title-parameter-in-a2026-11-07 https://bugrater.com/releases/cve-2026-120839-improper-control-of-filename-for-include-require-statement-in-php-program-php-remote-file-inclusion-vulnerability-in-magepeople-inc-wptravelly-tour-booking2026-11-07 https://bugrater.com/releases/cve-2026-120841-improper-control-of-filename-for-include-require-statement-in-php-program-php-remote-file-inclusion-vulnerability-in-magepeople-inc-wptravelly-tour-booking2026-11-07 https://bugrater.com/releases/cve-2026-121575-missing-authorization-vulnerability-in-wp-user-manager-wp-user-manager-wp-user-manager-allows-exploiting-incorrectly-configured-access-control-security-levels-t2026-11-07 https://bugrater.com/releases/cve-2026-121579-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-unlimited-elements-unlimited-elements-for-elementor-free2026-11-07 https://bugrater.com/releases/cve-2026-121775-missing-authorization-vulnerability-in-villatheme-curcy-woo-multi-currency-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-af2026-11-07 https://bugrater.com/releases/cve-2026-121777-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-cool-plugins-cool-formkit-lite-extensions-for-elementor-form-allo2026-11-07 https://bugrater.com/releases/cve-2026-121784-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-magepeople-inc-wpbookingly-service-booking-manager-allows2026-11-07 https://bugrater.com/releases/cve-2026-122041-the-checkout-field-editor-for-woocommerce-pro-plugin-for-wordpress-is-vulnerable-to-unauthorized-deletion-of-arbitrary-attachments-due-to-a-missing-capability2026-11-07 https://bugrater.com/releases/cve-2026-122659-missing-authorization-vulnerability-in-wp-manageninja-llc-fluent-booking-fluent-booking-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-07 https://bugrater.com/releases/cve-2026-122660-missing-authorization-vulnerability-in-bakkbone-australia-floristpress-bakkbone-florist-companion-allows-exploiting-incorrectly-configured-access-control-securi2026-11-07 https://bugrater.com/releases/cve-2026-122663-missing-authorization-vulnerability-in-villatheme-curcy-woo-multi-currency-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-af2026-11-07 https://bugrater.com/releases/cve-2026-122669-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-everest-forms-everest-forms-everest-forms-allows-stored-xs2026-11-07 https://bugrater.com/releases/cve-2026-123183-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-pluginus-net-active-products-tables-for-woocommerce-profit-produc2026-11-07 https://bugrater.com/releases/cve-2026-123462-missing-authorization-vulnerability-in-mycred-mycred-mycred-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-mycred-f2026-11-07 https://bugrater.com/releases/cve-2026-123467-missing-authorization-vulnerability-in-stylemixthemes-motors-motors-car-dealership-classified-listings-allows-exploiting-incorrectly-configured-access-control-s2026-11-07 https://bugrater.com/releases/cve-2026-123474-missing-authorization-vulnerability-in-leapworx-premium-blocks-gutenberg-blocks-for-wordpress-premium-blocks-for-gutenberg-allows-exploiting-incorrectly-confi2026-11-07 https://bugrater.com/releases/cve-2026-123477-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-crocoblock-jetengine-jet-engine-allows-stored-xss-this-iss2026-11-07 https://bugrater.com/releases/cve-2026-123483-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-crocoblock-jetformbuilder-jetformbuilder-allows-code-injection-th2026-11-07 https://bugrater.com/releases/cve-2026-123860-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-crocoblock-jetformbuilder-jetformbuilder-allows-code-injection-th2026-11-07 https://bugrater.com/releases/cve-2026-123861-authorization-bypass-through-user-controlled-key-vulnerability-in-crocoblock-jetformbuilder-hierarchical-select-jet-form-builder-hierarchical-select-allows-ex2026-11-07 https://bugrater.com/releases/cve-2026-123963-a-security-vulnerability-has-been-detected-in-openbmb-internet-of-agents-up-to-9d78e88e47160eb42ee1ee8538c05e1c2c47877a-the-impacted-element-is-the-function-re2026-11-07 https://bugrater.com/releases/cve-2026-123964-a-vulnerability-was-detected-in-openbmb-internet-of-agents-up-to-9d78e88e47160eb42ee1ee8538c05e1c2c47877a-this-affects-the-function-launch-goal-of-the-file-im2026-11-07 https://bugrater.com/releases/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management-component-when-a-client-is-created-or-imported-with-authorization-services-enabled-the-system-fail2026-11-07 https://bugrater.com/releases/cve-2026-123966-a-vulnerability-was-determined-in-tenda-ac19-16-03-10-07-affected-by-this-issue-is-the-function-saveparentcontrolinfo-of-the-file-goform-saveparentcontrolinfo2026-11-07 https://bugrater.com/releases/cve-2026-123988-a-vulnerability-has-been-found-in-sililawijesinghe-food-ordering-system-up-to-ba314e897e3365600461e5ea59432e39ceaa0fa5-this-issue-affects-some-unknown-processi2026-11-07 https://bugrater.com/releases/cve-2026-123989-a-vulnerability-was-found-in-esengine-deepseek-reasonix-up-to-1-33-0-impacted-is-the-function-loadgitstatus-of-the-file-build-rs-of-the-component-build-script2026-11-07 https://bugrater.com/releases/cve-2026-124307-fraunhofer-hhi-vvdec-before-3-2-1-contains-a-heap-use-after-free-vulnerability-that-allows-attackers-to-corrupt-memory-by-redefining-an-alf-adaptation-parameter2026-11-07 https://bugrater.com/releases/cve-2026-124308-fraunhofer-hhi-vvdec-before-3-2-1-contains-a-heap-use-after-free-vulnerability-in-declibrecon-createsubpicrefbufs-because-decompresspicture-clears-m-subpicextt2026-11-07 https://bugrater.com/releases/cve-2026-124309-fraunhofer-hhi-vvdec-before-3-2-1-contains-a-heap-out-of-bounds-read-vulnerability-in-seireader-xparseseiscalablenesting-that-allows-attackers-to-read-past-hea2026-11-07 https://bugrater.com/releases/cve-2026-124310-fraunhofer-hhi-vvdec-before-3-2-1-contains-an-out-of-bounds-read-vulnerability-that-allows-attackers-to-crash-the-decoder-by-supplying-bitstreams-with-overlappi2026-11-07 https://bugrater.com/releases/cve-2026-124311-fraunhofer-hhi-vvdec-through-3-2-1-contains-a-null-pointer-dereference-vulnerability-in-interprediction-xpredinterblk-that-allows-attackers-to-crash-the-decode2026-11-07 https://bugrater.com/releases/cve-2026-124312-fraunhofer-hhi-vvdec-through-3-2-1-contains-a-heap-out-of-bounds-read-vulnerability-that-allows-attackers-to-crash-the-decoder-by-supplying-a-collocated-picture2026-11-07 https://bugrater.com/releases/cve-2026-124313-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains-a-missing-authorization-vulnerability-in-the-whitelisted-get-linked-payments-for-doc-method-any2026-11-07 https://bugrater.com/releases/cve-2026-124314-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains-a-missing-authorization-vulnerability-in-erpnext-crm-utils-get-open-activities-that-exposes-todo2026-11-07 https://bugrater.com/releases/cve-2026-124315-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains-a-missing-authorization-vulnerability-in-the-whitelisted-get-bom-items-and-get-bom-diff-methods2026-11-07 https://bugrater.com/releases/cve-2026-124316-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains-a-missing-authorization-vulnerability-in-the-whitelisted-erpnext-buying-utils-get-linked-materia2026-11-07 https://bugrater.com/releases/cve-2026-124317-libexpat-through-2-10-0-contains-an-out-of-bounds-read-vulnerability-in-unknown-toutf8-and-unknown-toutf16-in-xmltok-c-when-handling-application-registered2026-11-07 https://bugrater.com/releases/cve-2026-124318-treeio-through-2-0-contains-an-insecure-deserialization-vulnerability-in-updaterecord-get-format-strings-and-modulesetting-loads-that-allows-staff-users-to-exec2026-11-07 https://bugrater.com/releases/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2-10-27-3-1-0-affected-is-the-function-extwhere2str-extwhere2sqlojb-of-the-file-engine-trans-extwh2026-11-07 https://bugrater.com/releases/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected-by-this-vulnerability-is-the-function-whitelistutils-endswithany-of-the-file-whitelistutils-jav2026-11-07 https://bugrater.com/releases/cve-2026-119522-missing-authorization-vulnerability-in-themegrill-user-registration-user-registration-allows-exploiting-incorrectly-configured-access-control-security-levels-th2026-11-07 https://bugrater.com/releases/cve-2026-120836-missing-authorization-vulnerability-in-elightup-meta-box-wordpress-custom-fields-framework-meta-box-allows-exploiting-incorrectly-configured-access-control-se2026-11-07 https://bugrater.com/releases/cve-2026-123461-missing-authorization-vulnerability-in-pluginus-net-fox-woocommerce-currency-switcher-allows-exploiting-incorrectly-configured-access-control-security-levels-th2026-11-07 https://bugrater.com/releases/cve-2026-123472-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-elightup-meta-box-wordpress-custom-fields-framework-meta2026-11-07 https://bugrater.com/releases/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this-issue-is-the-function-staticresourceserver-validatesvgcontent-of-the-file-core-core-backend-sr2026-11-07 https://bugrater.com/releases/cve-2026-124057-a-security-flaw-has-been-discovered-in-totolink-ca300-poe-6-2c-884-this-impacts-the-function-setwifimultipleconfig-of-the-file-cgi-bin-cstecgi-cgi-performing2026-11-07 https://bugrater.com/releases/cve-2026-124258-missing-authorization-vulnerability-in-themegrill-user-registration-user-registration-allows-exploiting-incorrectly-configured-access-control-security-levels-th2026-11-07 https://bugrater.com/releases/cve-2026-124058-a-weakness-has-been-identified-in-totolink-ca300-poe-6-2c-884-affected-is-the-function-setwifirepeaterconfig-of-the-file-cgi-bin-cstecgi-cgi-executing-a-mani2026-11-07 https://bugrater.com/releases/cve-2026-124059-a-security-vulnerability-has-been-detected-in-totolink-ca300-poe-6-2c-884-affected-by-this-vulnerability-is-the-function-setwifiwdsaddconfig-of-the-file-cgi-b2026-11-07 https://bugrater.com/releases/cve-2026-124060-a-vulnerability-was-detected-in-totolink-ca300-poe-6-2c-884-affected-by-this-issue-is-the-function-uploadcustommodule-of-the-file-cgi-bin-cstecgi-cgi-the-man2026-11-07 https://bugrater.com/releases/cve-2026-120531-the-subscribe2-form-email-subscribers-newsletters-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-data-ip-parameter-in-all-ver2026-11-07 https://bugrater.com/releases/cve-2026-123493-vikunja-from-2-4-0-before-2-7-1-contains-an-authentication-bypass-vulnerability-that-allows-disabled-or-locked-users-to-retain-access-through-api-tokens-owned-b2026-11-08 https://bugrater.com/releases/cve-2026-123519-vikunja-before-2-7-1-contains-a-denial-of-service-vulnerability-that-allows-authenticated-users-to-exhaust-api-process-memory-by-uploading-wekan-or-vikunja-file2026-11-08 https://bugrater.com/releases/cve-2026-123520-vikunja-from-0-18-0-before-2-7-1-contains-a-privilege-escalation-vulnerability-that-allows-team-owners-to-gain-admin-or-ownership-of-read-only-shared-projects-b2026-11-08 https://bugrater.com/releases/cve-2026-123521-vikunja-before-2-7-1-contains-an-improper-restriction-of-excessive-authentication-attempts-vulnerability-that-allows-session-holders-to-brute-force-account-pass2026-11-08 https://bugrater.com/releases/cve-2026-123522-vikunja-before-2-7-1-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-read-any-task-by-injecting-a-crafted-task-object-into-a-n2026-11-08 https://bugrater.com/releases/cve-2026-123523-vikunja-before-2-7-1-contains-an-uncontrolled-resource-consumption-vulnerability-that-allows-authenticated-users-to-exhaust-server-memory-by-requesting-avatars2026-11-08 https://bugrater.com/releases/cve-2026-123524-vikunja-from-0-23-0-before-2-7-1-contains-an-information-disclosure-vulnerability-that-allows-project-collaborators-with-write-access-to-read-tasks-from-inacces2026-11-08 https://bugrater.com/releases/cve-2026-123525-vikunja-before-2-7-1-allocates-memory-without-limits-in-its-trello-todoist-and-microsoft-to-do-migration-importers-which-buffer-remote-attachment-downloads-an2026-11-08 https://bugrater.com/releases/cve-2026-123526-vikunja-before-2-7-1-contains-a-mass-assignment-vulnerability-that-allows-any-authenticated-user-to-set-the-read-only-external-id-field-through-the-team-create2026-11-08 https://bugrater.com/releases/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass-vulnerability-that-allows-token-holders-to-perform-unintended-operations-due-to-colliding-v1-an2026-11-08 https://bugrater.com/releases/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration-vulnerability-that-allows-holders-of-revoked-access-tokens-to-keep-authenticating-because-setup2026-11-08 https://bugrater.com/releases/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection-vulnerability-that-allows-authenticated-users-with-project-write-access-to-inject-arbitrary-css-via-unsanit2026-11-08 https://bugrater.com/releases/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication-vulnerability-that-allows-attackers-holding-a-stolen-session-to-enroll-and-enable-totp-without-the-accoun2026-11-08 https://bugrater.com/releases/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled-resource-consumption-vulnerability-that-allows-authenticated-users-to-bypass-service-maxitemsperpage-by2026-11-08 https://bugrater.com/releases/cve-2026-123532-gix-fs-in-gitoxide-before-0-24-1-contains-a-credential-disclosure-vulnerability-that-allows-remote-attackers-to-capture-ntlm-credentials-by-supplying-unc-symlin2026-11-08 https://bugrater.com/releases/cve-2026-123533-gix-commitgraph-before-0-42-0-as-used-in-gitoxide-before-0-61-0-contains-a-denial-of-service-vulnerability-because-its-commit-graph-parser-does-not-validate-p2026-11-08 https://bugrater.com/releases/cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in-requesthandler-static-url-and-get-version-that-allows-attackers-to-hash-files-outside-static-p2026-11-08 https://bugrater.com/releases/cve-2026-123535-tornado-before-6-6-does-not-validate-the-max-age-argument-of-requesthandler-set-cookie-also-called-by-set-signed-cookie-set-secure-cookie-and-clear-cookie2026-11-08 https://bugrater.com/releases/cve-2026-123536-openam-before-16-1-4-contains-a-server-side-request-forgery-vulnerability-that-allows-administrators-including-delegated-realm-administrators-to-make-the-serv2026-11-08 https://bugrater.com/releases/cve-2026-123537-openam-before-16-1-4-contains-a-server-side-request-forgery-vulnerability-that-allows-parties-registering-uma-resource-sets-to-trigger-internal-requests-through2026-11-08 https://bugrater.com/releases/cve-2026-123538-openam-before-16-1-4-does-not-verify-that-a-signed-saml-1-x-assertion-or-response-was-signed-by-the-partner-named-as-its-issuer-accepting-a-signature-from-any2026-11-08 https://bugrater.com/releases/cve-2026-123539-openam-before-16-1-4-contains-a-stored-cross-site-scripting-vulnerability-that-allows-privileged-attackers-to-inject-script-by-placing-markup-in-a-user-s-displa2026-11-08 https://bugrater.com/releases/cve-2026-123540-openam-before-16-1-4-contains-an-incomplete-output-encoding-vulnerability-that-allows-a-saml-1-x-identity-provider-to-alter-attribute-values-by-injecting-unenco2026-11-08 https://bugrater.com/releases/cve-2026-123541-openam-before-16-1-4-contains-an-open-redirect-vulnerability-that-allows-remote-attackers-to-redirect-users-after-saml-1-x-single-sign-on-by-exploiting-loose-tr2026-11-08 https://bugrater.com/releases/cve-2026-123542-openam-before-16-1-4-fails-to-enforce-pkce-in-the-oauth-2-0-device-authorization-flow-never-validating-the-code-verifier-when-device-codes-are-exchanged-for-to2026-11-08 https://bugrater.com/releases/cve-2026-123543-openam-before-16-1-4-contains-a-denial-of-service-vulnerability-that-allows-unauthenticated-attackers-to-exhaust-server-resources-by-sending-serialized-java-dat2026-11-08 https://bugrater.com/releases/cve-2026-123544-openam-before-16-1-4-and-its-client-sdk-fail-to-sufficiently-validate-responses-on-the-internal-server-to-server-soap-channel-allowing-network-positioned-attac2026-11-08 https://bugrater.com/releases/cve-2026-123545-openam-from-14-5-1-before-16-1-4-contains-a-cross-site-request-forgery-vulnerability-in-the-oauth-2-0-device-authorization-flow-that-allows-attackers-to-approve2026-11-08 https://bugrater.com/releases/cve-2026-123546-openam-before-16-1-4-contains-an-open-redirect-and-cross-site-scripting-vulnerability-that-allows-remote-attackers-to-control-post-login-and-logout-destinations2026-11-08 https://bugrater.com/releases/cve-2026-123547-openam-before-16-1-4-contains-an-open-redirect-vulnerability-that-allows-attackers-to-redirect-users-to-external-sites-because-relaystate-is-unchecked-when-no-r2026-11-08 https://bugrater.com/releases/cve-2026-123548-openidentityplatform-openam-before-16-1-4-contains-an-open-redirect-because-ws-federation-logout-saml-v2-0-logout-and-name-identifier-management-saml-v2-0-ide2026-11-08 https://bugrater.com/releases/cve-2026-123549-openam-before-16-1-4-fails-to-enforce-the-valid-creation-attributes-list-during-self-registration-allowing-anonymous-attackers-to-set-restricted-attributes-inc2026-11-08 https://bugrater.com/releases/cve-2026-123550-openam-before-16-1-4-contains-an-authentication-bypass-vulnerability-in-its-saml-v2-0-service-provider-that-accepts-unsigned-assertions-on-the-ecp-paos-and-ht2026-11-08 https://bugrater.com/releases/cve-2026-123551-openam-from-14-0-0-before-16-1-4-contains-an-information-disclosure-vulnerability-that-allows-unauthenticated-attackers-to-read-live-session-tokens-from-the-not2026-11-08 https://bugrater.com/releases/cve-2026-123553-openam-before-16-1-4-ships-built-in-identities-in-the-top-level-realm-demo-anonymous-wsc-wsp-securitytokenservice-and-agentauth-with-passwords-that-are-id2026-11-08 https://bugrater.com/releases/cve-2026-123554-zebra-zebrad-6-4-0-before-7-0-0-performs-quadratic-work-in-the-mempool-coinbase-maturity-check-because-transaction-coinbase-spend-restriction-rebuilds-the-tr2026-11-08 https://bugrater.com/releases/cve-2026-123555-zebra-from-2-3-0-before-7-0-0-contains-a-denial-of-service-vulnerability-that-allows-unauthenticated-peers-to-evade-misbehavior-scoring-by-sending-transactions2026-11-08 https://bugrater.com/releases/cve-2026-123556-zcashfoundation-zebra-from-4-5-0-before-7-0-0-contains-a-protection-mechanism-failure-that-bans-honest-peers-by-scoring-mempool-lock-time-rejections-at-the-ban2026-11-08 https://bugrater.com/releases/cve-2026-123557-zcashfoundation-zebra-zebrad-before-7-0-0-contains-a-reachable-assertion-race-condition-that-allows-unauthenticated-remote-peers-to-abort-the-node-by-triggering2026-11-08 https://bugrater.com/releases/cve-2026-123558-zebra-zebrad-before-7-0-0-contains-a-denial-of-service-vulnerability-that-allows-a-malicious-peer-to-stall-checkpoint-sync-by-cancelling-the-verifier-rewind-aft2026-11-08 https://bugrater.com/releases/cve-2026-123559-zebra-before-7-0-0-contains-an-inefficient-algorithmic-complexity-vulnerability-that-allows-unauthenticated-peers-to-exhaust-verification-threads-by-submitting2026-11-08 https://bugrater.com/releases/cve-2026-123560-zebra-before-7-0-0-contains-an-incomplete-cleanup-vulnerability-that-allows-unauthenticated-peers-to-stall-initial-sync-by-serving-a-forged-checkpoint-block-bod2026-11-08 https://bugrater.com/releases/cve-2026-123567-sveltejs-devalue-before-5-6-4-contains-a-prototype-injection-vulnerability-that-allows-attackers-to-inject-proto-own-properties-into-objects-returned-by-dev2026-11-08 https://bugrater.com/releases/cve-2026-123570-the-dns-wire-format-message-parser-in-hickory-proto-hickory-dns-0-18-before-0-26-2-preallocates-record-vectors-sized-by-the-untrusted-ancount-nscount-and-ar2026-11-08 https://bugrater.com/releases/cve-2026-123571-hickory-dns-from-0-26-0-before-0-26-2-contains-an-integer-underflow-vulnerability-in-tsig-rdata-decoding-that-allows-remote-attackers-to-trigger-a-panic-via-mal2026-11-08 https://bugrater.com/releases/cve-2026-123572-hickory-dns-from-0-20-1-before-0-26-2-contains-a-denial-of-service-vulnerability-in-the-hickory-proto-svcb-and-https-record-presentation-format-parser-which-pa2026-11-08 https://bugrater.com/releases/cve-2026-123573-hickory-dns-from-0-20-1-before-0-26-2-contains-a-denial-of-service-vulnerability-in-the-hickory-proto-svcb-and-https-record-presentation-format-parser-attacker2026-11-08 https://bugrater.com/releases/cve-2026-123574-the-zone-file-parser-in-the-hickory-proto-crate-of-hickory-dns-0-24-0-before-0-26-2-panics-when-a-single-token-in-a-zone-file-is-4096-bytes-or-longer-attackers2026-11-08 https://bugrater.com/releases/cve-2026-123576-hickory-dns-0-24-0-through-0-26-1-contains-a-memory-exhaustion-vulnerability-that-allows-remote-attackers-to-consume-server-resources-by-sending-incomplete-dns2026-11-08 https://bugrater.com/releases/cve-2026-123577-hickory-dns-from-0-24-0-before-0-26-2-contains-a-resource-exhaustion-vulnerability-that-allows-remote-attackers-to-consume-server-memory-via-unbounded-doh-reque2026-11-08 https://bugrater.com/releases/cve-2026-123578-hickory-dns-hickory-net-0-26-0-before-0-26-2-and-hickory-proto-0-25-0-through-0-25-2-skip-the-check-that-a-udp-response-s-question-section-matches-the-query-whe2026-11-08 https://bugrater.com/releases/cve-2026-123579-dnssec-validation-in-hickory-dns-hickory-net-0-26-0-beta-1-before-0-26-2-and-hickory-proto-through-0-26-0-alpha-1-does-not-distinguish-nodata-responses-from-wil2026-11-08 https://bugrater.com/releases/cve-2026-123580-hickory-dns-hickory-net-0-26-0-beta-1-before-0-26-2-and-hickory-proto-through-0-26-0-alpha-1-perform-insufficient-checks-on-nsec3-record-names-during-dnssec-ver2026-11-08 https://bugrater.com/releases/cve-2026-123581-hickory-dns-hickory-proto-through-0-26-0-alpha-1-and-hickory-net-0-26-0-beta-1-before-0-26-2-contain-a-dnssec-validation-flaw-that-accepts-a-response-as-a-posit2026-11-08 https://bugrater.com/releases/cve-2026-123582-the-validating-recursive-resolver-and-validating-forwarder-in-hickory-dns-hickory-server-0-25-0-before-0-26-2-do-not-check-whether-the-soa-record-passed-dnsse2026-11-08 https://bugrater.com/releases/cve-2026-123583-the-recursive-resolver-in-hickory-dns-hickory-recursor-0-25-0-through-0-25-2-and-hickory-resolver-0-26-0-before-0-26-2-does-not-apply-out-of-bailiwick-filtering2026-11-08 https://bugrater.com/releases/cve-2026-123584-the-hickory-net-crate-in-hickory-dns-0-26-0-before-0-26-2-stops-listening-and-returns-an-error-when-a-client-udp-connection-receives-a-datagram-that-cannot-be-p2026-11-08 https://bugrater.com/releases/cve-2026-123585-the-hickory-resolver-component-of-hickory-dns-0-25-0-before-0-26-2-follows-irrelevant-cname-records-when-resolving-recursive-queries-sending-queries-that-are-u2026-11-08 https://bugrater.com/releases/cve-2026-123586-hickory-dns-0-25-0-alpha-3-through-0-25-2-contains-a-query-amplification-vulnerability-in-its-recursive-resolver-which-mishandles-cyclic-sibling-name-server-re2026-11-08 https://bugrater.com/releases/cve-2026-123587-the-dnssec-validation-in-the-hickory-dns-hickory-net-crate-0-26-0-before-0-26-2-identifies-wraparound-nsec-records-by-comparing-the-next-domain-name-to-an-soa-r2026-11-08 https://bugrater.com/releases/cve-2026-123588-the-recursive-resolver-in-hickory-dns-all-versions-of-the-hickory-recursor-crate-and-hickory-resolver-0-26-0-before-0-26-2-caches-an-empty-connection-pool-wh2026-11-08 https://bugrater.com/releases/cve-2026-123589-the-dns-over-quic-doq-server-in-hickory-server-hickory-dns-before-0-26-2-does-not-apply-any-timeout-when-reading-a-request-message-from-a-quic-stream-bypas2026-11-08 https://bugrater.com/releases/cve-2026-123590-hickory-dns-hickory-net-0-26-0-beta-1-before-0-26-2-and-hickory-proto-through-0-26-0-alpha-1-accept-nsec-and-nsec3-records-for-dnssec-nonexistence-proofs-when-a2026-11-08 https://bugrater.com/releases/cve-2026-123591-hickory-dns-hickory-net-0-26-0-beta-1-before-0-26-2-and-hickory-proto-through-0-26-0-alpha-1-fail-to-verify-per-rfc-6840-4-4-that-an-nsec-or-nsec3-record-den2026-11-08 https://bugrater.com/releases/cve-2026-123592-the-hickory-net-crate-in-hickory-dns-0-26-0-beta-1-before-0-26-2-allows-dnssec-validation-bypass-because-name-s-hash-ignores-label-lengths-and-validationcacheke2026-11-08 https://bugrater.com/releases/cve-2026-123593-hickory-dns-hickory-net-0-26-0-beta-1-before-0-26-2-and-hickory-proto-0-24-0-through-0-26-0-alpha-1-compare-dnskey-public-keys-against-dnssec-trust-anchors-with2026-11-08 https://bugrater.com/releases/cve-2026-123594-hickory-dns-hickory-proto-through-0-26-0-alpha-1-and-hickory-net-0-26-0-beta-1-before-0-26-2-contain-an-nsec-validation-flaw-that-returns-a-secure-proof-for-nxd2026-11-08 https://bugrater.com/releases/cve-2026-123595-hickory-dns-hickory-proto-0-25-through-0-26-0-alpha-1-and-hickory-net-0-26-0-beta-1-before-0-26-2-contain-a-dnssec-validation-flaw-in-the-validating-recursor-s2026-11-08 https://bugrater.com/releases/cve-2026-123596-hickory-dns-hickory-proto-through-0-26-0-alpha-1-and-hickory-net-0-26-0-beta-1-before-0-26-2-contain-a-dnssec-validation-flaw-in-the-validating-recursor-s-nsec2026-11-08 https://bugrater.com/releases/cve-2026-123597-hickory-dns-hickory-proto-0-25-0-alpha-1-through-0-26-0-alpha-1-and-hickory-net-before-0-26-2-contain-a-logic-bug-in-dnssecdnshandle-s-ds-fetch-path-that-caches2026-11-08 https://bugrater.com/releases/cve-2026-123598-the-validating-recursor-in-hickory-dns-hickory-recursor-0-25-0-through-0-26-0-alpha-1-hickory-resolver-0-26-0-alpha-1-before-0-26-2-and-hickory-net-0-26-0-bet2026-11-08 https://bugrater.com/releases/cve-2026-123599-hickory-dns-hickory-proto-before-0-26-0-beta-1-and-hickory-net-before-0-26-2-contain-a-dnssec-validation-bypass-because-verify-rrsets-ignores-dns-class-when-p2026-11-08 https://bugrater.com/releases/cve-2026-123600-hickory-dns-hickory-proto-0-25-0-alpha-3-through-0-25-2-and-hickory-net-0-26-0-alpha-1-before-0-26-2-contain-a-dnssec-validation-flaw-in-dnssecdnshandle-that-ac2026-11-08 https://bugrater.com/releases/cve-2026-123601-hickory-dns-hickory-proto-0-25-0-through-0-26-0-alpha-1-and-hickory-net-0-26-0-beta-1-before-0-26-2-invert-the-relational-operators-in-the-wrap-around-branch-of2026-11-08 https://bugrater.com/releases/cve-2026-123602-the-hickory-dns-recursor-in-all-versions-of-hickory-recursor-and-in-hickory-resolver-0-26-0-beta-1-before-0-26-2-recursor-feature-is-vulnerable-to-ghost-domai2026-11-08 https://bugrater.com/releases/cve-2026-123603-hickory-proto-and-hickory-resolver-0-26-0-before-0-26-2-hickory-server-0-25-0-alpha-1-before-0-26-2-and-hickory-recursor-0-25-0-alpha-3-through-0-26-0-alpha-12026-11-08 https://bugrater.com/releases/cve-2026-123604-hickory-dns-hickory-resolver-0-26-0-beta-1-before-0-26-2-contains-an-unbounded-retry-loop-in-nameserverpool-try-send-which-re-queues-truncated-tc-responses2026-11-08 https://bugrater.com/releases/cve-2026-123605-hickory-dns-hickory-proto-0-1-through-0-25-0-alpha-3-and-hickory-net-before-0-26-2-contain-a-dnssec-validation-bypass-because-the-validator-verifies-an-rrsig-ag2026-11-08 https://bugrater.com/releases/cve-2026-123606-the-hickory-dns-recursor-in-hickory-recursor-0-25-0-alpha-3-through-0-25-2-and-hickory-resolver-0-26-0-alpha-1-before-0-26-2-iterates-every-out-of-bailiwick-ns2026-11-08 https://bugrater.com/releases/cve-2026-123608-hickory-dns-hickory-proto-from-0-3-1-before-0-26-1-contains-a-denial-of-service-vulnerability-in-binencoder-that-allows-remote-attackers-to-exhaust-cpu-through2026-11-08 https://bugrater.com/releases/cve-2026-123611-rustls-before-0-23-46-contains-a-key-exchange-downgrade-vulnerability-that-allows-network-attackers-to-poison-the-per-server-name-key-exchange-group-record-via2026-11-08 https://bugrater.com/releases/cve-2026-123613-rustls-from-0-23-13-before-0-23-45-accepts-tls-1-3-handshake-messages-at-the-wrong-encryption-level-when-they-follow-a-key-changing-message-in-the-same-record2026-11-08 https://bugrater.com/releases/cve-2026-123614-imgproxy-from-4-0-0-before-4-0-16-contains-an-integer-overflow-in-the-ico-loader-that-allows-remote-attackers-to-trigger-a-heap-buffer-overflow-via-a-crafted-da2026-11-08 https://bugrater.com/releases/cve-2026-123615-imgproxy-3-3-0-before-4-0-17-contains-an-out-of-bounds-heap-read-and-write-in-the-ico-loader-s-bmp-header-reconstruction-vips-foreign-load-ico-header-in-vips-i2026-11-08 https://bugrater.com/releases/cve-2026-123616-imgproxy-from-3-3-0-before-4-0-16-contains-an-unbounded-memory-allocation-vulnerability-in-the-ico-loader-that-fails-to-validate-the-data-size-field-attackers2026-11-08 https://bugrater.com/releases/cve-2026-124422-suneditor-from-3-0-0-before-3-4-0-contains-a-stored-cross-site-scripting-vulnerability-in-html-clean-that-rebuilds-iframes-from-data-se-iframe-holder-attrs-js2026-11-08 https://bugrater.com/releases/cve-2026-103303-the-turisbook-booking-system-wordpress-plugin-through-1-3-8-does-not-have-authorisation-and-csrf-checks-when-saving-its-settings-and-does-not-sanitise-and-esca2026-11-08 https://bugrater.com/releases/cve-2026-103375-the-antom-payments-wordpress-plugin-through-2-0-11-does-not-perform-any-ownership-or-authorisation-check-before-returning-an-order-s-confirmation-link-which-co2026-11-08 https://bugrater.com/releases/cve-2026-104307-the-backupwordpress-plugin-before-3-15-does-not-perform-a-capability-or-nonce-check-on-an-ajax-action-that-cleans-up-its-backup-directory-allowing-any-authenti2026-11-08 https://bugrater.com/releases/cve-2026-104337-the-razorpay-for-woocommerce-wordpress-plugin-before-4-8-9-does-not-verify-ownership-of-an-order-before-returning-a-coupon-discount-computed-against-that-order2026-11-08 https://bugrater.com/releases/cve-2026-104338-the-razorpay-for-woocommerce-wordpress-plugin-before-4-8-9-does-not-perform-an-authorization-check-on-one-of-its-rest-routes-and-derives-the-acting-user-s-ident2026-11-08 https://bugrater.com/releases/cve-2026-104639-the-razorpay-for-woocommerce-wordpress-plugin-before-4-8-9-does-not-sanitize-and-escape-a-value-derived-from-an-incoming-webhook-request-before-using-it-in-a-sq2026-11-08 https://bugrater.com/releases/cve-2026-105970-the-thanh-to-n-qu-t-m-qr-code-t-ng-wordpress-plugin-through-2-0-1-does-not-properly-verify-the-authenticity-of-incoming-bank-transfer-payment-notifications2026-11-08 https://bugrater.com/releases/cve-2026-106015-the-ecommerce-affiliate-wordpress-plugin-through-1-0-0-does-not-restrict-one-time-password-issuance-and-verification-to-the-legitimate-account-owner-nor-limit2026-11-08 https://bugrater.com/releases/cve-2026-110132-the-sync-post-with-other-site-wordpress-plugin-before-1-9-4-does-not-properly-authorize-a-content-management-action-for-post-types-other-than-pages-allowing-us2026-11-08 https://bugrater.com/releases/cve-2026-110963-the-userplace-wordpress-plugin-through-1-2-0-does-not-perform-authorization-checks-on-an-ajax-action-available-to-unauthenticated-users-and-publicly-exposes-th2026-11-08 https://bugrater.com/releases/cve-2026-114432-the-contact-form-7-wordpress-plugin-before-6-2-4-does-not-validate-the-type-or-extension-of-files-uploaded-through-a-form-file-field-and-a-flaw-in-its-temporar2026-11-08 https://bugrater.com/releases/cve-2026-122060-the-wp-recipe-maker-wordpress-plugin-before-10-9-2-does-not-check-whether-the-post-a-recipe-is-embedded-in-is-password-protected-before-returning-the-recipe-thr2026-11-08 https://bugrater.com/releases/cve-2026-122085-the-event-tickets-manager-for-woocommerce-wordpress-plugin-before-1-6-0-does-not-perform-authorisation-or-a-valid-nonce-check-on-its-ticket-transfer-feature-wh2026-11-08 https://bugrater.com/releases/cve-2026-85344-the-fv-flowplayer-video-player-wordpress-plugin-before-7-5-57-7212-does-not-perform-any-authorization-check-on-an-ajax-action-that-carries-out-a-site-wide-conte2026-11-08 https://bugrater.com/releases/cve-2026-96961-the-pie-register-wordpress-plugin-through-3-8-4-15-does-not-perform-any-capability-nonce-or-authentication-check-on-one-of-its-request-handlers-allowing-unau2026-11-08 https://bugrater.com/releases/cve-2026-96963-the-pie-register-wordpress-plugin-through-3-8-4-15-does-not-perform-an-authorisation-check-in-one-of-its-ajax-actions-allowing-users-with-a-role-as-low-as-con2026-11-08 https://bugrater.com/releases/cve-2026-97192-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not-re-apply-its-field-group-location-rules-when-persisting-values-submitted-through-the-post-editor2026-11-08 https://bugrater.com/releases/cve-2026-97193-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not-verify-that-a-user-is-allowed-to-edit-the-target-object-before-writing-to-it-during-bidirectiona2026-11-08 https://bugrater.com/releases/cve-2026-97194-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not-perform-a-read-permission-check-when-it-renders-and-formats-the-values-of-its-relational-fields2026-11-08 https://bugrater.com/releases/cve-2026-97195-the-secure-custom-fields-wordpress-plugin-before-6-9-8-does-not-sanitize-a-persisted-field-definition-before-emitting-part-of-it-as-an-html-attribute-name-allo2026-11-08 https://bugrater.com/releases/cve-2026-124326-a-flaw-has-been-found-in-datalinkdc-dinky-up-to-1-2-5-impacted-is-the-function-file-getoriginalfilename-of-the-file-cataloguecontroller-java-of-the-component-c2026-11-08 https://bugrater.com/releases/cve-2026-124328-a-vulnerability-has-been-found-in-flowci-flow-core-x-up-to-1-23-49-the-affected-element-is-the-function-conditionmanagerimpl-run-of-the-file-core-src-main-java2026-11-08 https://bugrater.com/releases/cve-2026-124329-a-vulnerability-was-found-in-flowci-flow-core-x-up-to-1-23-49-the-impacted-element-is-the-function-filehelper-unzip-of-the-file-common-src-main-java-com-flowci2026-11-08 https://bugrater.com/releases/cve-2026-124330-a-vulnerability-was-determined-in-flowci-flow-core-x-up-to-1-23-49-this-affects-the-function-exist-save-read-remove-of-the-file-store-src-main-java-com-flowci2026-11-08 https://bugrater.com/releases/cve-2026-124331-a-vulnerability-was-identified-in-jinher-oa-c6-this-impacts-an-unknown-function-of-the-file-c6-jhsoft-web-project-officereadonly-projectaffichemanage-aspx-su2026-11-08 https://bugrater.com/releases/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file-read-vulnerability-that-allows-authenticated-control-panel-users-to-read-svg-files-by-posting-arbi2026-11-08 https://bugrater.com/releases/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege-escalation-vulnerability-that-allows-unauthenticated-public-registrants-to-reclaim-deactivated-non-admin2026-11-08 https://bugrater.com/releases/cve-2026-124430-craft-cms-from-5-10-0-before-5-11-2-contains-a-remote-code-execution-vulnerability-that-allows-non-administrator-control-panel-users-to-obtain-hmac-signed-twig2026-11-08 https://bugrater.com/releases/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-low-privileged-users-to-browse-volumes-they-lack-pe2026-11-08 https://bugrater.com/releases/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0-beta-3-contain-an-account-enumeration-vulnerability-in-the-unauthenticated-post-api-webauthn-p2026-11-08 https://bugrater.com/releases/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization-vulnerability-that-allows-delegated-administrators-holding-only-group-delete-permission-to-delete2026-11-08 https://bugrater.com/releases/cve-2026-124434-grav-lightbox-gallery-plugin-1-1-0-before-1-3-2-on-grav-2-x-calls-any-medium-method-named-in-image-thumb-or-thumb-options-shortcode-values-without-core-s-allow2026-11-08 https://bugrater.com/releases/cve-2026-124435-openremote-before-1-32-2-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-with-write-admin-permissions-to-upload-html-or-svg2026-11-08 https://bugrater.com/releases/cve-2026-124436-openremote-before-1-32-2-contains-an-improper-authorization-vulnerability-that-allows-realm-administrators-to-access-and-modify-global-resources-by-calling-admi2026-11-08 https://bugrater.com/releases/cve-2026-124440-kyverno-from-1-19-1-before-1-19-2-contains-an-authorization-bypass-vulnerability-in-the-apicall-namespace-clamp-that-allows-namespace-tenants-to-issue-cross-nam2026-11-08 https://bugrater.com/releases/cve-2026-124441-kyverno-before-1-19-2-contains-an-authorization-bypass-vulnerability-that-allows-namespaced-tenants-to-generate-any-resource-kind-in-any-namespace-by-templating2026-11-08 https://bugrater.com/releases/cve-2026-124442-azuracast-before-0-24-0-contains-a-server-side-request-forgery-vulnerability-that-allows-users-with-station-webhooks-permission-to-bypass-the-userurlfilter-ssrf2026-11-08 https://bugrater.com/releases/cve-2026-124443-frappe-framework-before-15-121-1-and-16-x-before-16-35-0-contains-a-broken-access-control-vulnerability-in-file-list-and-report-queries-that-fails-to-restrict-p2026-11-08 https://bugrater.com/releases/cve-2026-124444-openemr-before-8-4-0-contains-a-mass-assignment-vulnerability-in-the-patient-portal-onsitedocument-query-api-that-lets-request-parameters-set-bitwise-criteria-f2026-11-08 https://bugrater.com/releases/cve-2026-124445-openemr-from-7-0-1-before-8-4-0-contains-a-flaw-in-src-common-auth-onetimeauth-php-that-ignores-the-enforce-onetime-use-and-max-access-count-flags-never-revoke2026-11-08 https://bugrater.com/releases/cve-2026-124446-openemr-before-8-3-0-contains-a-path-traversal-vulnerability-in-the-faxsms-module-s-rcfaxclient-and-signalwireclient-disposedocument-functions-that-allows-authe2026-11-08 https://bugrater.com/releases/cve-2026-124447-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-onsiteportalactivitycontroller-update-that-checks-the-request-s-patientid2026-11-08 https://bugrater.com/releases/cve-2026-124448-openemr-before-8-3-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-ccda-ccd-preview-stylesheets-where-cda-xsl-copies-event-handler-attributes-who2026-11-08 https://bugrater.com/releases/cve-2026-124449-openemr-before-8-4-0-contains-a-missing-authorization-vulnerability-in-fhir-media-uuid-and-questionnaireresponse-read-routes-that-skip-acl-checks-non-patient2026-11-08 https://bugrater.com/releases/cve-2026-124450-openemr-before-8-3-0-contains-a-broken-access-control-and-path-traversal-vulnerability-in-the-fax-sms-module-disposedocument-action-via-an-unvalidated-file-path2026-11-08 https://bugrater.com/releases/cve-2026-124451-openemr-before-8-4-0-contains-an-authorization-bypass-vulnerability-in-its-smart-on-fhir-implementation-because-checkuserhasaccesstopatient-in-bearertokenauth2026-11-08 https://bugrater.com/releases/cve-2026-124452-openemr-before-8-3-0-contains-a-stored-cross-site-scripting-vulnerability-in-interface-forms-eye-mag-report-php-that-allows-authenticated-users-to-inject-script2026-11-08 https://bugrater.com/releases/cve-2026-124453-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-portal-lib-persist-php-that-allows-authenticated-portal-patients-to-write-set2026-11-08 https://bugrater.com/releases/cve-2026-124455-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-onsitedocumentcontroller-query-that-allows-authenticated-portal-patients-t2026-11-08 https://bugrater.com/releases/cve-2026-124456-openemr-before-8-3-0-contains-missing-authorization-and-insecure-direct-object-reference-vulnerabilities-in-the-oe-module-prior-authorizations-module-that-allow2026-11-08 https://bugrater.com/releases/cve-2026-124457-openemr-before-8-3-0-contains-a-path-traversal-vulnerability-in-interface-billing-sl-eob-process-php-that-allows-authenticated-users-to-write-and-read-files-by2026-11-08 https://bugrater.com/releases/cve-2026-124458-openemr-before-8-4-0-contains-an-authorization-bypass-vulnerability-in-the-fhir-get-fhir-person-uuid-route-that-allows-patient-portal-users-to-read-any-staff2026-11-08 https://bugrater.com/releases/cve-2026-124459-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-many-encounter-form-view-and-save-endpoints-that-lack-patient-encounter-owner2026-11-08 https://bugrater.com/releases/cve-2026-124460-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-portalpatientcontroller-read-that-allows-authenticated-patients-to-read-ot2026-11-08 https://bugrater.com/releases/cve-2026-124461-openemr-before-8-3-0-contains-a-missing-authorization-vulnerability-in-library-ajax-upload-php-that-allows-any-authenticated-user-to-read-and-overwrite-document2026-11-08 https://bugrater.com/releases/cve-2026-124462-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-onsitedocumentcontroller-query-that-allows-authenticated-portal-patients-t2026-11-08 https://bugrater.com/releases/cve-2026-124463-openemr-before-8-3-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-with-camos-access-to-inject-html-by-saving-malicious-c2026-11-08 https://bugrater.com/releases/cve-2026-124464-openemr-before-8-4-0-contains-an-authorization-bypass-vulnerability-that-allows-patient-scoped-smart-tokens-to-read-other-patients-questionnaire-responses-beca2026-11-08 https://bugrater.com/releases/cve-2026-124465-trendyol-kafka-konsumer-from-2-3-3-before-2-6-18-contains-a-denial-of-service-vulnerability-in-batch-consumer-go-that-panics-when-a-single-record-exceeds-messag2026-11-08 https://bugrater.com/releases/cve-2026-124466-openemr-before-8-4-0-contains-a-server-side-request-forgery-vulnerability-that-allows-unauthenticated-attackers-to-make-the-server-send-http-requests-by-registe2026-11-08 https://bugrater.com/releases/cve-2026-124467-openemr-before-8-4-0-contains-a-local-file-inclusion-in-the-esign-router-library-esign-router-php-which-passes-the-unsanitized-module-parameter-into-a-requir2026-11-08 https://bugrater.com/releases/cve-2026-124468-openemr-before-8-3-0-contains-an-sql-injection-vulnerability-in-the-standard-rest-api-patient-insurance-and-employer-search-which-concatenates-query-string-par2026-11-08 https://bugrater.com/releases/cve-2026-124469-openemr-before-8-3-0-contains-an-sql-injection-vulnerability-in-the-fee-sheet-drug-inventory-lookup-drugsalesservice-selldrug-that-interpolates-the-prod-n-w2026-11-08 https://bugrater.com/releases/cve-2026-124470-openemr-before-8-3-0-contains-a-broken-object-level-authorization-vulnerability-in-portal-report-portal-custom-report-php-that-allows-authenticated-portal-patie2026-11-08 https://bugrater.com/releases/cve-2026-124471-openemr-before-8-3-0-contains-a-missing-authorization-vulnerability-in-interface-billing-sl-eob-invoice-php-that-allows-any-authenticated-user-to-read-and-modif2026-11-08 https://bugrater.com/releases/cve-2026-124472-openemr-before-8-3-0-contains-a-missing-authorization-vulnerability-in-interface-billing-sl-eob-patient-note-php-that-allows-any-authenticated-user-to-read-and2026-11-08 https://bugrater.com/releases/cve-2026-124473-openemr-before-8-3-0-contains-a-broken-object-level-authorization-vulnerability-in-the-soap-note-update-api-which-does-not-verify-that-the-supplied-soap-note-i2026-11-08 https://bugrater.com/releases/cve-2026-124474-mrbs-meeting-room-booking-system-before-1-12-3-contains-a-reflected-cross-site-scripting-vulnerability-that-allows-unauthenticated-attackers-to-inject-script2026-11-08 https://bugrater.com/releases/cve-2026-124475-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-vulnerability-in-portal-lib-persist-php-that-allows-authenticated-portal-patients-to-modify-ot2026-11-08 https://bugrater.com/releases/cve-2026-124476-openemr-before-8-3-0-contains-an-insecure-direct-object-reference-in-portal-lib-paylib-php-which-writes-the-request-supplied-form-pid-or-the-patient-id-cc-val2026-11-08 https://bugrater.com/releases/cve-2026-124477-openemr-before-8-3-0-contains-a-missing-authorization-vulnerability-that-allows-low-privileged-authenticated-users-to-delete-arbitrary-patient-recall-records-vi2026-11-08 https://bugrater.com/releases/cve-2026-124478-openemr-before-8-3-0-contains-a-missing-authorization-vulnerability-in-the-addrecall-action-of-interface-main-messages-save-php-that-allows-low-privileged-auth2026-11-08 https://bugrater.com/releases/cve-2026-124481-openemr-before-8-4-0-contains-an-improper-authorization-vulnerability-in-rainforest-patient-portal-payments-that-trusts-browser-supplied-patientid-encounter-a2026-11-08 https://bugrater.com/releases/cve-2026-124483-openemr-before-8-4-0-contains-an-incorrect-authorization-vulnerability-because-the-prescription-rest-api-routes-check-the-patients-med-acl-instead-of-patients-r2026-11-08 https://bugrater.com/releases/cve-2026-124484-openemr-before-8-4-0-contains-a-missing-authorization-vulnerability-in-portal-onsite-document-apis-that-allows-any-authenticated-core-user-to-access-cross-patie2026-11-08 https://bugrater.com/releases/cve-2026-124485-openemr-before-8-3-0-contains-an-authorization-bypass-vulnerability-in-the-patient-portal-onsitedocuments-api-that-allows-authenticated-patients-to-read-other-p2026-11-08 https://bugrater.com/releases/cve-2026-124486-openemr-before-8-3-0-contains-a-missing-authorization-vulnerability-in-the-classic-document-controller-that-allows-low-privilege-authenticated-users-to-recatego2026-11-08 https://bugrater.com/releases/cve-2026-124487-openemr-before-8-4-0-contains-an-improper-authorization-vulnerability-in-the-non-patient-post-fhir-documentreference-docref-route-that-allows-low-privileged-u2026-11-08 https://bugrater.com/releases/cve-2026-124488-openemr-before-8-3-0-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-clinicians-lacking-high-sensitivity-permission-to-read-and-modify2026-11-08 https://bugrater.com/releases/cve-2026-124489-openemr-before-8-3-0-contains-a-broken-access-control-vulnerability-in-portal-portal-payment-php-that-allows-low-privilege-authenticated-users-to-bypass-billing2026-11-08 https://bugrater.com/releases/cve-2026-124490-openemr-before-8-3-0-contains-a-path-traversal-vulnerability-in-the-ringcentral-rcfaxclient-disposedocument-method-of-oe-module-faxsms-that-allows-authenticat2026-11-08 https://bugrater.com/releases/cve-2026-124491-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-fileupload-plugin-create-method-that-assigns-server-returned-file-names-to2026-11-08 https://bugrater.com/releases/cve-2026-124492-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting-vulnerability-in-modalanchoreditor-s-createbookmarklist-which-inserts-entity-decoded-h1-h6-heade2026-11-08 https://bugrater.com/releases/cve-2026-124493-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-documenttype-constructor-that-injects-header-textcontent-into-innerhtml-witho2026-11-08 https://bugrater.com/releases/cve-2026-124494-suneditor-before-3-4-0-contains-a-stored-cross-site-scripting-vulnerability-because-the-html-clean-sanitizer-s-normalizeurl-function-decodes-named-entities2026-11-08 https://bugrater.com/releases/cve-2026-124551-classroomio-through-1-0-0-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-of-any-organization-to-clone-other-tenants-courses-via2026-11-08 https://bugrater.com/releases/cve-2026-124552-webmin-through-2-670-contains-a-stored-cross-site-scripting-vulnerability-in-the-shorewall-and-shorewall6-modules-list-cgi-which-renders-table-fields-and-comm2026-11-08 https://bugrater.com/releases/cve-2026-124553-babeldoc-from-0-3-61-before-0-7-0-contains-a-resource-exhaustion-vulnerability-that-allows-remote-attackers-to-exhaust-cpu-and-memory-by-supplying-unbounded-bfr2026-11-08 https://bugrater.com/releases/cve-2026-109899-missing-authorization-vulnerability-in-melapress-melapress-role-editor-melapress-role-editor-allows-exploiting-incorrectly-configured-access-control-security-le2026-11-08 https://bugrater.com/releases/cve-2026-109900-incorrect-privilege-assignment-vulnerability-in-melapress-melapress-role-editor-melapress-role-editor-allows-privilege-escalation-this-issue-affects-melapress-r2026-11-08 https://bugrater.com/releases/cve-2026-114186-missing-authorization-vulnerability-in-wpvibes-anywhere-elementor-anywhere-elementor-allows-exploiting-incorrectly-configured-access-control-security-levels-thi2026-11-08 https://bugrater.com/releases/cve-2026-114188-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wpvibes-anywhere-elementor-anywhere-elementor-allows-store2026-11-08 https://bugrater.com/releases/cve-2026-114189-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-wpvibes-anywhere-elementor-anywhere-elementor-allows-blind2026-11-08 https://bugrater.com/releases/cve-2026-120858-missing-authorization-vulnerability-in-wp-manageninja-llc-fluentform-fluentform-allows-exploiting-incorrectly-configured-access-control-security-levels-this-iss2026-11-08 https://bugrater.com/releases/cve-2026-61987-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wc-lovers-wcfm-frontend-manager-for-woocommerce-wc-front2026-11-08 https://bugrater.com/releases/cve-2026-116499-ibm-qiskit-sdk-1-4-2-through-2-6-2-could-allow-a-local-attacker-to-execute-arbitrary-code-due-to-deserialization-of-untrusted-data2026-11-08 https://bugrater.com/releases/cve-2026-116500-ibm-qiskit-sdk-2-4-0-through-2-6-1-could-allow-a-local-attacker-to-cause-a-denial-of-service-due-to-unbound-recursion-during-deserialization-of-untrusted-qpy-pa2026-11-08 https://bugrater.com/releases/cve-2026-116501-ibm-qiskit-sdk-2-4-0-through-2-6-1-could-allow-a-local-attacker-to-execute-arbitrary-code-due-to-an-out-of-bounds-write-caused-by-improper-input-validation-when2026-11-08 https://bugrater.com/releases/cve-2026-119670-ibm-storage-copy-data-management-2-2-could-allow-an-authenticated-user-to-execute-arbitrary-commands-with-normal-user-privileges-on-the-system-due-to-improper-v2026-11-08 https://bugrater.com/releases/cve-2026-14434-ibm-turbonomic-kubeturbo-agent-8-16-0-through-8-21-2-does-not-validate-or-improperly-validates-tls-certificate-validation-which-could-allow-an-attacker-to-obta2026-11-08 https://bugrater.com/releases/cve-2026-3684-ibm-cloud-pak-for-data-system-11-3-1-2-interim-fix-001-through-11-3-1-2-interim-fix-002-could-allow-a-user-with-administrative-privileges-to-read-and-write-ar2026-11-08 https://bugrater.com/releases/cve-2026-124498-a-vulnerability-was-determined-in-convene-azeus-convene-board-management-portal-7-0-2-7-3-p72-the-impacted-element-is-an-unknown-function-of-the-file-jsp-ge-d2026-11-08 https://bugrater.com/releases/cve-2026-124499-a-vulnerability-was-identified-in-fengoffice-feng-office-up-to-3-11-13-11-4-2-1-2-this-affects-the-function-write-translations-of-the-file-application-controll2026-11-09 https://bugrater.com/releases/cve-2026-124500-a-security-flaw-has-been-discovered-in-fengoffice-feng-office-up-to-3-11-13-11-4-2-1-2-this-impacts-the-function-upload-document-image-of-the-file-application2026-11-09 https://bugrater.com/releases/cve-2026-124501-a-weakness-has-been-identified-in-tidelift-moto-up-to-5-2-4-affected-is-an-unknown-function-of-the-file-moto-batch-models-py-of-the-component-aws-batch-emulati2026-11-09 https://bugrater.com/releases/cve-2026-124502-a-security-vulnerability-has-been-detected-in-yungifez-skuul-school-management-system-up-to-2-6-3-affected-by-this-vulnerability-is-the-function-graduationcont2026-11-09 https://bugrater.com/releases/cve-2026-119506-incorrect-privilege-assignment-vulnerability-in-dynamiapps-frontend-admin-by-dynamiapps-acf-frontend-form-element-allows-privilege-escalation-this-issue-affects2026-11-09 https://bugrater.com/releases/cve-2026-124504-a-vulnerability-was-detected-in-erupts-erupt-up-to-2-3-0-affected-by-this-issue-is-the-function-reportservice-querybidata-of-the-file-reportservice-java-perfo2026-11-09 https://bugrater.com/releases/cve-2026-124505-a-flaw-has-been-found-in-dianping-cat-3-0-0-3-1-0-4-0-rc1-this-affects-the-function-handler-redirect-of-the-file-handler-java-of-the-component-login-logout-ex2026-11-09 https://bugrater.com/releases/cve-2026-124506-a-vulnerability-has-been-found-in-dianping-cat-3-0-0-3-1-0-4-0-rc1-this-vulnerability-affects-the-function-model-getdomain-of-the-file-web-inf-tags-hourlyrepor2026-11-09 https://bugrater.com/releases/cve-2026-124507-a-vulnerability-was-found-in-conductor-oss-conductor-up-to-3-32-4-3-33-0-3-34-0-rc3-4-0-0-alpha-1-this-issue-affects-the-function-workflowsystemtask-start-of-t2026-11-09 https://bugrater.com/releases/cve-2026-124508-a-vulnerability-was-determined-in-floci-io-floci-up-to-2-4-0-impacted-is-the-function-buildspecparser-parseartifacts-of-the-file-src-main-java-io-github-hector2026-11-09 https://bugrater.com/releases/cve-2026-124509-a-vulnerability-was-identified-in-floci-io-floci-up-to-2-1-0-the-affected-element-is-the-function-s3destination-bucketname-of-the-file-services-firehose-model2026-11-09 https://bugrater.com/releases/cve-2026-124554-a-security-flaw-has-been-discovered-in-jeecgboot-3-9-5-this-affects-an-unknown-part-of-the-file-jeecg-boot-drag-onldragdatasethead-getallchartdata-of-the-comp2026-11-09 https://bugrater.com/releases/cve-2026-124555-a-weakness-has-been-identified-in-jeecgboot-3-9-5-this-vulnerability-affects-the-function-jimuformapiservice-gettabledictlist-of-the-file-jeecg-boot-jmreport2026-11-09 https://bugrater.com/releases/cve-2026-121825-openam-openam-consortium-edition-14-0-5-and-earlier-contains-an-open-redirect-vulnerability-cwe-601-in-the-liberty-id-ff-service-provider-single-sign-on-flo2026-11-09 https://bugrater.com/releases/cve-2026-124556-a-security-vulnerability-has-been-detected-in-kekingcn-kkfileview-up-to-5-0-3-this-issue-affects-the-function-baseurlfilter-getbaseurl-of-the-file-server-src-m2026-11-09 https://bugrater.com/releases/cve-2026-124557-a-vulnerability-was-detected-in-ottermind-chat2db-up-to-5-3-8-impacted-is-the-function-dbmybatisgenerateserviceimpl-generateclass-of-the-file-dbmybatisgenerate2026-11-09 https://bugrater.com/releases/cve-2026-124558-a-vulnerability-has-been-found-in-datalinkdc-dinky-up-to-1-2-5-the-impacted-element-is-the-function-sqlgateway-onopen-of-the-file-sqlgateway-java-of-the-compon2026-11-09 https://bugrater.com/releases/cve-2026-124560-a-vulnerability-was-found-in-d-link-dir-878-1-20b05-this-affects-the-function-getcaptchasetting-of-the-file-bin-prog-cgi-of-the-component-hnap-handler-perform2026-11-09 https://bugrater.com/releases/cve-2026-113362-improper-access-control-in-the-program-installation-folder-in-nec-corporation-websam-winshare-ver-7-5-0-and-earlier-excluding-ver-7-3-3-ver-7-6-0-and-ver-7-72026-11-09 https://bugrater.com/releases/cve-2026-124561-a-vulnerability-was-determined-in-d-link-dir-878-1-20b05-this-impacts-the-function-setvlansettings-of-the-file-prog-cgi-of-the-component-hnap-handler-executin2026-11-09 https://bugrater.com/releases/cve-2026-124562-a-vulnerability-was-identified-in-d-link-dir-878-1-20b05-affected-is-the-function-setwansettings-of-the-component-hnap-handler-the-manipulation-of-the-argumen2026-11-09 https://bugrater.com/releases/cve-2026-124563-a-security-flaw-has-been-discovered-in-d-link-dir-878-1-20b05-affected-by-this-vulnerability-is-the-function-setwansettings-of-the-component-hnap-handler-the2026-11-09 https://bugrater.com/releases/cve-2026-124564-a-weakness-has-been-identified-in-d-link-dir-878-1-20b05-affected-by-this-issue-is-the-function-getlistdirectory-of-the-file-bin-prog-cgi-of-the-component-hnap2026-11-09 https://bugrater.com/releases/cve-2026-113363-improper-input-validation-in-the-network-communication-processing-in-nec-corporation-websam-winshare-ver-7-2-0-through-7-5-0-ver-7-6-0-and-ver-7-7-0-through-72026-11-09 https://bugrater.com/releases/cve-2026-113364-buffer-overflow-in-the-data-receiving-process-in-nec-corporation-websam-winshare-ver-7-5-0-and-earlier-ver-7-6-0-and-ver-7-7-0-through-7-7-2-on-windows-allows2026-11-09 https://bugrater.com/releases/cve-2026-124565-a-security-vulnerability-has-been-detected-in-fushengqian-fuint-up-to-36cc31b08d77facc94e8959afa02224891b4fe5f-this-affects-the-function-confirm-of-the-file-me2026-11-09 https://bugrater.com/releases/cve-2026-124566-a-vulnerability-was-detected-in-fushengqian-fuint-up-to-36cc31b08d77facc94e8959afa02224891b4fe5f-this-vulnerability-affects-the-function-alipaycallback-of-the2026-11-09 https://bugrater.com/releases/cve-2026-124567-a-flaw-has-been-found-in-fushengqian-fuint-up-to-36cc31b08d77facc94e8959afa02224891b4fe5f-this-issue-affects-the-function-receipt-of-the-file-clientordercontro2026-11-09 https://bugrater.com/releases/cve-2026-124568-a-vulnerability-has-been-found-in-fushengqian-fuintcatering-up-to-6d054f5788ac8645eb491f79242bb8a625efc133-impacted-is-the-function-refundserviceimpl-agreerefu2026-11-09 https://bugrater.com/releases/cve-2026-124569-a-vulnerability-was-found-in-fushengqian-fuintcatering-up-to-6d054f5788ac8645eb491f79242bb8a625efc133-the-affected-element-is-the-function-updatecommissioncash2026-11-09 https://bugrater.com/releases/cve-2026-124570-a-vulnerability-was-detected-in-sourcecodester-online-leave-management-system-1-0-affected-is-an-unknown-function-of-the-file-app-classes-master-php-of-the-com2026-11-09 https://bugrater.com/releases/cve-2026-124571-a-flaw-has-been-found-in-sourcecodester-simple-crud-using-php-and-fpdf-1-0-affected-by-this-vulnerability-is-an-unknown-functionality-of-the-file-app-register2026-11-09 https://bugrater.com/releases/cve-2026-115212-the-mview-wordpress-plugin-through-1-0-3-does-not-validate-the-type-name-or-source-of-a-remotely-fetched-file-nor-perform-any-capability-or-authorizatio2026-11-09 https://bugrater.com/releases/cve-2026-115213-the-easy-js-wpapi-client-handle-for-the-wordpress-rest-api-wordpress-plugin-through-2-0-does-not-prevent-the-administrator-credentials-it-stores-from-being-disc2026-11-09 https://bugrater.com/releases/cve-2026-115256-the-mail-debug-for-woocommerce-wordpress-plugin-through-1-3-0-does-not-perform-any-capability-authentication-or-nonce-check-on-one-of-its-email-logging-action2026-11-09 https://bugrater.com/releases/cve-2026-118201-the-limit-login-attempts-security-wordpress-plugin-before-3-4-1-does-not-enforce-its-two-factor-authentication-on-every-password-authentication-route-so-an-at2026-11-09 https://bugrater.com/releases/cve-2026-118202-the-limit-login-attempts-security-wordpress-plugin-before-3-4-1-does-not-confirm-that-its-two-factor-authentication-step-succeeded-before-completing-a-login-an2026-11-09 https://bugrater.com/releases/cve-2026-120409-the-all-in-one-video-gallery-wordpress-plugin-before-5-1-1-does-not-check-whether-a-video-is-password-protected-before-serving-it-through-its-standalone-player2026-11-09 https://bugrater.com/releases/cve-2026-121759-the-fusion-page-builder-wordpress-plugin-before-1-7-1-does-not-check-that-the-user-owns-the-content-it-moves-to-the-trash-which-could-allow-users-with-a-role-a2026-11-09 https://bugrater.com/releases/cve-2026-121874-the-post-duplicator-wordpress-plugin-before-3-0-18-does-not-restrict-settings-saves-to-its-own-options-allowing-a-site-administrator-on-a-multisite-network-who2026-11-09 https://bugrater.com/releases/cve-2026-121875-the-post-duplicator-wordpress-plugin-before-3-0-18-does-not-validate-the-capabilities-assigned-to-roles-through-its-permissions-settings-allowing-a-site-admini2026-11-09 https://bugrater.com/releases/cve-2026-123064-the-wp-base-booking-of-appointments-services-and-events-wordpress-plugin-before-6-5-1-does-not-properly-restrict-access-to-one-of-its-user-creation-actions-al2026-11-09 https://bugrater.com/releases/cve-2026-123088-the-unipay-payment-gateway-for-woocommerce-wordpress-plugin-before-2-4-does-not-perform-any-authorization-check-before-returning-an-order-s-order-received-url-f2026-11-09 https://bugrater.com/releases/cve-2026-123091-the-vigilant-wordpress-plugin-before-2-11-0-does-not-enforce-its-two-factor-authentication-on-login-forms-other-than-the-default-wordpress-one-allowing-an-att2026-11-09 https://bugrater.com/releases/cve-2026-123128-the-gembooking-wordpress-plugin-before-1-7-1-does-not-serialise-concurrent-booking-requests-per-team-member-allowing-unauthenticated-users-to-create-overlappi2026-11-09 https://bugrater.com/releases/cve-2026-123129-the-event-tickets-manager-for-woocommerce-wordpress-plugin-before-1-6-0-does-not-validate-the-ticket-type-price-sent-to-one-of-its-unauthenticated-ajax-actions2026-11-09 https://bugrater.com/releases/cve-2026-123131-the-gembooking-wordpress-plugin-before-1-7-1-does-not-properly-verify-that-a-rest-request-is-addressed-to-its-own-routes-before-temporarily-granting-staff-user2026-11-09 https://bugrater.com/releases/cve-2026-123145-the-woocommerce-stripe-payment-gateway-wordpress-plugin-before-11-1-0-does-not-exclude-the-account-password-from-the-checkout-fields-it-saves-to-order-metadata2026-11-09 https://bugrater.com/releases/cve-2026-123751-the-wp-duplicate-wordpress-plugin-through-1-1-11-does-not-properly-verify-a-request-authentication-value-and-does-not-validate-the-path-or-type-of-uploaded-fil2026-11-09 https://bugrater.com/releases/cve-2026-124572-a-vulnerability-has-been-found-in-datalinkdc-dinky-up-to-1-2-5-affected-by-this-issue-is-the-function-cataloguecontroller-upload-of-the-file-dinky-admin-src-ma2026-11-09 https://bugrater.com/releases/cve-2026-124573-a-vulnerability-was-found-in-logseq-2-0-1-2-0-2-this-affects-the-function-validate-auth-token-of-the-file-src-electron-electron-server-cljs-of-the-component-lo2026-11-09 https://bugrater.com/releases/cve-2026-124574-a-vulnerability-was-determined-in-chenyme-grok2api-up-to-3-1-6-this-vulnerability-affects-the-function-beginselectionsession-of-the-file-backend-internal-appli2026-11-09 https://bugrater.com/releases/cve-2026-124575-a-vulnerability-was-identified-in-siteserver-sscms-up-to-7-1-3-7-2-1-7-4-0-this-issue-affects-the-function-logincontroller-submit-of-the-file-src-sscms-web-con2026-11-09 https://bugrater.com/releases/cve-2026-124576-a-security-flaw-has-been-discovered-in-beikeshop-up-to-2-0-0-31-impacted-is-the-function-orderrepo-getorderbynumber-of-the-file-beike-repositories-orderrepo-p2026-11-09 https://bugrater.com/releases/cve-2026-81422-the-advanced-appointment-booking-scheduling-wordpress-plugin-before-2-7-does-not-verify-the-site-s-user-registration-setting-before-creating-accounts-through2026-11-09 https://bugrater.com/releases/cve-2026-124577-a-weakness-has-been-identified-in-intelbras-sg-2404-poe-l2-1-00-70-1-00-72-the-affected-element-is-an-unknown-function-of-the-file-excu-shell-of-the-componen2026-11-09 https://bugrater.com/releases/cve-2026-124578-a-security-vulnerability-has-been-detected-in-pantum-bp5100dw-3-a-4-7-the-impacted-element-is-an-unknown-function-of-the-file-shtml-omdb-shtml-of-the-componen2026-11-09 https://bugrater.com/releases/cve-2026-124579-a-vulnerability-was-determined-in-aapanel-billionmail-up-to-4-9-affected-by-this-issue-is-some-unknown-functionality-of-the-file-core-api-relay-v1-relay-go-of2026-11-09 https://bugrater.com/releases/cve-2026-124580-a-vulnerability-was-found-in-chengdu-feiyuxing-technology-vw2100-and-vec10gp-1-0-b-mb3w202-210825-r11775-this-impacts-the-function-handle-wechat-cn-wifi-of-the2026-11-09 https://bugrater.com/releases/cve-2026-123870-the-otterdog-webapp-evaluates-a-format-string-built-from-the-incoming-github-webhook-json-body-using-python-s-eval-when-the-github-webhook-secret-configurati2026-11-09 https://bugrater.com/releases/cve-2026-124581-a-vulnerability-was-determined-in-itsourcecode-airline-reservation-system-1-0-affected-is-an-unknown-function-of-the-file-admin-manage-flight-php-this-manipu2026-11-09 https://bugrater.com/releases/cve-2026-124582-a-vulnerability-was-identified-in-webtorrent-up-to-2-8-5-3-0-21-affected-by-this-vulnerability-is-the-function-getfilemodtimes-of-the-file-torrent-js-of-the-co2026-11-09 https://bugrater.com/releases/cve-2026-124584-a-vulnerability-has-been-found-in-wummel-patool-4-1-0-this-vulnerability-affects-the-function-extract-gzip-of-the-file-patoolib-fileutil-py-of-the-component-gz2026-11-09 https://bugrater.com/releases/cve-2026-124585-a-vulnerability-was-found-in-chengdu-feiyuxing-technology-vw2100-and-vec10gp-1-0-b-mb3w202-210825-r11775-this-issue-affects-the-function-add-expmac-of-the-file2026-11-09 https://bugrater.com/releases/cve-2026-92606-time-of-check-time-of-use-toctou-race-condition-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-institute-pardus-mycomputer-allows-leveraging-t2026-11-09 https://bugrater.com/releases/cve-2026-94249-missing-authorization-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-institute-liderahenk-allows-privilege-abuse-this-issue-affects-liderahenk2026-11-09 https://bugrater.com/releases/cve-2026-101031-the-example-dag-decorator-example-dag-shipped-with-apache-airflow-validated-an-ip-address-fetched-over-http-with-python-s-ipaddress-module-and-then-placed-i2026-11-09 https://bugrater.com/releases/cve-2026-107474-the-apache-airflow-connections-api-did-not-mask-the-apprise-provider-s-config-connection-extra-which-can-embed-notification-service-credentials-a-user-with2026-11-09 https://bugrater.com/releases/cve-2026-111395-apache-airflow-did-not-reject-reserved-serialization-keys-inside-a-dag-run-s-conf-a-user-allowed-to-trigger-a-dag-that-uses-a-deadline-alert-with-an-asynchro2026-11-09 https://bugrater.com/releases/cve-2026-111403-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wp-inventory-wp-inventory-manager-wp-inventory-manager-all2026-11-09 https://bugrater.com/releases/cve-2026-111421-apache-airflow-s-task-execution-api-stored-xcom-values-written-by-a-task-without-the-reserved-key-check-applied-elsewhere-so-a-dag-author-s-task-could-write-an2026-11-09 https://bugrater.com/releases/cve-2026-111452-apache-airflow-s-secrets-masker-matched-sensitive-key-names-only-in-their-snake-case-form-so-values-stored-under-camelcase-keys-such-as-privatekey-connecti2026-11-09 https://bugrater.com/releases/cve-2026-111453-apache-airflow-s-api-endpoint-for-deleting-an-asset-s-queued-events-checked-dag-edit-permission-against-the-dag-id-query-parameter-but-deleted-the-queued-eve2026-11-09 https://bugrater.com/releases/cve-2026-111454-apache-airflow-s-asset-api-endpoints-returned-the-ids-of-dags-that-are-scheduled-on-produce-or-consume-an-asset-without-checking-whether-the-caller-may-read-t2026-11-09 https://bugrater.com/releases/cve-2026-111455-apache-airflow-s-asynchronous-connection-test-checked-permissions-when-the-test-was-queued-only-create-permission-when-the-connection-id-did-not-exist-yet-b2026-11-09 https://bugrater.com/releases/cve-2026-113504-apache-airflow-s-secrets-masker-stopped-descending-into-nested-structures-after-five-levels-so-a-secret-registered-with-the-masker-for-example-a-connection-p2026-11-09 https://bugrater.com/releases/cve-2026-119483-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-10web-form-maker-by-10web-form-maker-allows-stored-xss-thi2026-11-09 https://bugrater.com/releases/cve-2026-119497-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wpwax-directorist-directorist-allows-stored-xss-this-issue2026-11-09 https://bugrater.com/releases/cve-2026-119503-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-welcart-welcart-e-commerce-usc-e-shop-allows-code-injection-this2026-11-09 https://bugrater.com/releases/cve-2026-119504-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-dynamiapps-frontend-admin-by-dynamiapps-acf-frontend-form2026-11-09 https://bugrater.com/releases/cve-2026-119505-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-welcart-welcart-e-commerce-usc-e-shop-allows-stored-xss-th2026-11-09 https://bugrater.com/releases/cve-2026-119514-incorrect-privilege-assignment-vulnerability-in-webful-creations-repairbuddy-computer-repair-shop-allows-privilege-escalation-this-issue-affects-repairbuddy-fr2026-11-09 https://bugrater.com/releases/cve-2026-121760-missing-authorization-vulnerability-in-wedevs-wedocs-wedocs-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-wedocs-f2026-11-09 https://bugrater.com/releases/cve-2026-121763-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wpmu-dev-hummingbird-hummingbird-performance-allows-stored2026-11-09 https://bugrater.com/releases/cve-2026-121764-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-foliovision-fv-flowplayer-video-player-fv-wordpress-flowpl2026-11-09 https://bugrater.com/releases/cve-2026-121780-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-gijo-varghese-flying-images-nazy-load-allows-stored-xss-th2026-11-09 https://bugrater.com/releases/cve-2026-123463-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wp-wham-checkout-files-upload-for-woocommerce-checkout-fil2026-11-09 https://bugrater.com/releases/cve-2026-123465-exposure-of-sensitive-system-information-to-an-unauthorized-control-sphere-vulnerability-in-mycred-mycred-mycred-allows-retrieve-embedded-sensitive-data-this-is2026-11-09 https://bugrater.com/releases/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-crocoblock-jetformbuilder-jetformbuilder-allows-dom-based2026-11-09 https://bugrater.com/releases/cve-2026-124586-a-vulnerability-was-determined-in-tencent-rapidjson-1-1-0-impacted-is-the-function-getcachedpowerbyindex-in-the-library-include-rapidjson-internal-diyfp-h-thi2026-11-09 https://bugrater.com/releases/cve-2026-124587-a-vulnerability-was-identified-in-elizaos-eliza-2-0-3-beta-7-the-affected-element-is-an-unknown-function-of-the-file-packages-app-platforms-electrobun-src-life2026-11-09 https://bugrater.com/releases/cve-2026-124588-a-security-flaw-has-been-discovered-in-huggingface-finetrainers-0-1-0-0-2-0-the-impacted-element-is-the-function-resolve-component-cls-of-the-file-finetrainers2026-11-09 https://bugrater.com/releases/cve-2026-124589-a-weakness-has-been-identified-in-lxtgh-omg-seg-up-to-f3b26b609bae919760cd3ccf09c36179bb8624a0-this-affects-the-function-load-state-dict-into-model-of-the-file2026-11-09 https://bugrater.com/releases/cve-2026-124637-a-stored-cross-site-scripting-xss-vulnerability-was-identified-in-the-profile-editing-form-in-the-parameters-clinom-and-clicognoms-in-a-request-to-https2026-11-09 https://bugrater.com/releases/cve-2026-40913-apache-airflow-s-public-import-errors-api-returns-the-raw-parse-failure-stack-trace-to-any-user-with-the-importerror-can-read-permission-when-the-failing-file2026-11-09 https://bugrater.com/releases/cve-2026-50204-apache-airflow-s-audit-log-stored-connection-and-variable-secret-values-in-cleartext-in-the-log-extra-column-because-the-secrets-masker-matched-only-on-config2026-11-09 https://bugrater.com/releases/cve-2026-54863-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-mamunur-rashid-review-schema-review-schema-allows-reflecte2026-11-09 https://bugrater.com/releases/cve-2026-66675-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-stylemixthemes-motors-motors-car-dealership-classified-lis2026-11-09 https://bugrater.com/releases/cve-2026-68982-apache-airflow-s-celeryexecutor-ran-callback-workloads-executecallback-used-for-deadline-alert-callbacks-without-validating-the-workload-s-authentication-t2026-11-09 https://bugrater.com/releases/cve-2026-76185-apache-airflow-s-task-sdk-secret-cache-built-its-keys-from-the-team-name-and-secret-id-with-unescaped-delimiters-so-different-team-secret-id-pairs-could2026-11-09 https://bugrater.com/releases/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore-stateful-bolt-checkpoints-configured-kryo-with-class-registration-disabled-and-an-instantiat2026-11-09 https://bugrater.com/releases/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s-topology-scheduler-strategy-when-scheduling-it-the-allowlist-intended-to-constrain-that-choi2026-11-09 https://bugrater.com/releases/cve-2026-86468-apache-airflow-s-cli-records-its-arguments-in-the-audit-log-but-masks-secrets-by-argument-position-so-some-supported-command-shapes-leave-secrets-in-cleartext2026-11-09 https://bugrater.com/releases/cve-2026-96285-apache-airflow-3-3-1-shipped-a-fix-for-cve-2026-67260-that-checks-the-scheduler-s-decoded-next-kwargs-value-is-a-dictionary-but-performs-that-check-only-afte2026-11-09 https://bugrater.com/releases/cve-2026-106008-the-fraudlabs-pro-sms-verification-wordpress-plugin-from-1-11-2-to-1-12-1-does-not-perform-authorisation-or-validity-checks-before-marking-a-woocommerce-order-s2026-11-09 https://bugrater.com/releases/cve-2026-106466-the-jwt-auth-wordpress-plugin-through-3-0-2-does-not-invalidate-previously-issued-refresh-tokens-when-a-user-changes-or-resets-their-password-or-removes-a-conne2026-11-09 https://bugrater.com/releases/cve-2026-115252-the-confection-wordpress-cable-wordpress-plugin-from-0-4-0-to-0-4-7-does-not-perform-any-capability-or-nonce-checks-before-saving-its-settings-and-writing-one-o2026-11-09 https://bugrater.com/releases/cve-2026-118196-oauth-1-rebinding-vulnerability-in-apache-allura-this-issue-affects-apache-allura-through-1-22-0-users-are-recommended-to-upgrade-to-version-1-22-1-wh2026-11-09 https://bugrater.com/releases/cve-2026-119515-missing-authorization-vulnerability-in-mamunur-rashid-radius-booking-booking-calendar-for-appointments-amp-services-radius-booking-allows-exploiting-incorre2026-11-09 https://bugrater.com/releases/cve-2026-119524-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-aguila-technologies-wp-customer-area-customer-area-allows2026-11-09 https://bugrater.com/releases/cve-2026-120367-allocation-of-resources-without-limits-or-throttling-vulnerability-in-apache-axis2-java-the-json-message-builders-including-the-gson-moshi-and-http-2-variant2026-11-09 https://bugrater.com/releases/cve-2026-120761-improper-restriction-of-xml-external-entity-reference-vulnerability-in-apache-axis2-java-when-a-client-built-an-axisservice-from-a-wsdl-url-through-servicecli2026-11-09 https://bugrater.com/releases/cve-2026-120832-server-side-request-forgery-ssrf-vulnerability-in-apache-axis2-java-when-axis2-built-a-service-description-from-a-wsdl-through-serviceclient-axisservice-cr2026-11-09 https://bugrater.com/releases/cve-2026-120838-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-plugins360-labs-all-in-one-video-gallery-all-in-one-video2026-11-09 https://bugrater.com/releases/cve-2026-120855-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-templateinvaders-ti-woocommerce-wishlist-ti-woocommerce-wi2026-11-09 https://bugrater.com/releases/cve-2026-121570-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wp-chill-rsvp-and-event-management-rsvp-allows-stored-xss2026-11-09 https://bugrater.com/releases/cve-2026-121722-missing-authorization-vulnerability-in-wp-e-signature-formidable-forms-signature-online-contract-automation-forms-signature-formidable-online-contract-automatio2026-11-09 https://bugrater.com/releases/cve-2026-121782-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-if-so-dynamic-content-if-so-dynamic-content-personalizatio2026-11-09 https://bugrater.com/releases/cve-2026-122661-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wpwax-directorist-directorist-allows-stored-xss-this-issue2026-11-09 https://bugrater.com/releases/cve-2026-122665-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-kitae-park-mang-board-wp-mangboard-allows-stored-xss-this2026-11-09 https://bugrater.com/releases/cve-2026-122666-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-kitae-park-mang-board-wp-mangboard-allows-reflected-xss-th2026-11-09 https://bugrater.com/releases/cve-2026-123460-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-nickboss-wordpress-file-upload-wp-file-upload-allows-store2026-11-09 https://bugrater.com/releases/cve-2026-123475-missing-authorization-vulnerability-in-pt-norther-lights-production-mapsvg-mapsvg-lite-interactive-vector-maps-allows-exploiting-incorrectly-configured-access-c2026-11-09 https://bugrater.com/releases/cve-2026-123476-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-fifu-app-featured-image-from-url-featured-image-from-url-a2026-11-09 https://bugrater.com/releases/cve-2026-123753-server-side-request-forgery-ssrf-vulnerability-in-apache-axis2-java-an-unauthenticated-caller-could-supply-a-non-anonymous-ws-addressing-wsa-replyto-or-wsa-f2026-11-09 https://bugrater.com/releases/cve-2026-123766-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-the-openapi-module-of-apache-axis2-java-the-swagger-ui-page2026-11-09 https://bugrater.com/releases/cve-2026-123770-allocation-of-resources-without-limits-or-throttling-vulnerability-in-apache-axis2-java-the-multipart-form-data-and-application-x-www-form-urlencoded-message-b2026-11-09 https://bugrater.com/releases/cve-2026-123779-direct-request-forced-browsing-vulnerability-in-apache-axis2-java-the-exposeservicemetadata-service-parameter-was-enforced-only-on-the-wsdl-wsdl2-and-x2026-11-09 https://bugrater.com/releases/cve-2026-124590-a-security-vulnerability-has-been-detected-in-zhangbw409-library-manager-system-f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b-56514767a5207caf5e04c2cea379dfaa8cb5f002026-11-09 https://bugrater.com/releases/cve-2026-124591-a-vulnerability-was-detected-in-bahleel-0-1-0-0-1-1-affected-is-the-function-fputcsv-of-the-file-app-exporters-csvexporter-php-the-manipulation-results-in-csv2026-11-09 https://bugrater.com/releases/cve-2026-124621-a-vulnerability-was-determined-in-kongxin-github-java-library-management-system-up-to-70a6eb6b96fe64575d8051f1a59055bfc5dc5885-this-affects-the-function-update2026-11-09 https://bugrater.com/releases/cve-2026-112172-cgm-xdent-and-xmedical-expose-php-synchronization-endpoints-that-allow-unauthenticated-attackers-to-manipulate-session-variables-and-execute-arbitrary-sql-queri2026-11-09 https://bugrater.com/releases/cve-2026-118450-venere-is-installed-outside-program-files-and-loads-registers-unsigned-components-from-locations-where-an-unprivileged-user-may-create-files2026-11-09 https://bugrater.com/releases/cve-2026-118458-the-shared-ais-login-routing-selects-a-production-shipped-test-dao-and-plaintext-comparison-for-the-h-and-v-application-codes-accepting-fixed-administrator-acc2026-11-09 https://bugrater.com/releases/cve-2026-118459-a-time-derived-emergency-password-can-be-derived-from-publicly-available-application-code-enabling-authentication-without-legitimate-credentials2026-11-09 https://bugrater.com/releases/cve-2026-118460-embedded-private-keys-protected-by-a-shared-password-can-be-used-to-sign-practitioner-assertions-for-arbitrary-practitioner-identifiers-enabling-unauthorized-p2026-11-09 https://bugrater.com/releases/cve-2026-118461-the-shared-client-accepts-caller-controlled-doctor-identifiers-for-read-and-write-operations-without-requiring-authentication-or-authorization-credentials2026-11-09 https://bugrater.com/releases/cve-2026-118462-update-components-download-and-execute-code-without-proper-authenticity-verification-relying-on-ignored-hashes-or-forgeable-checksums-some-update-paths-also-p2026-11-09 https://bugrater.com/releases/cve-2026-118464-shared-cryptographic-services-use-fixed-vendor-wide-secrets-deterministic-ivs-null-salts-and-reversible-transformations-to-protect-credentials-ipc-data-con2026-11-09 https://bugrater.com/releases/cve-2026-118465-shared-components-expose-hard-coded-access-workgroup-ccbasic-dbisam-and-related-database-credentials-that-are-identical-across-installations2026-11-09 https://bugrater.com/releases/cve-2026-118467-shared-telemetry-and-logging-components-store-or-transmit-patient-and-doctor-identifiers-clinical-information-and-low-entropy-identifiers-without-adequate-pse2026-11-09 https://bugrater.com/releases/cve-2026-118468-xml-parsers-process-attacker-influenced-update-manifests-or-network-responses-with-external-entity-resolution-enabled-potentially-allowing-xml-external-entity2026-11-09 https://bugrater.com/releases/cve-2026-110468-widzialnicms-is-vulnerable-to-unrestricted-file-upload-in-the-panel-controllers-save-photo-php-endpoint-due-to-a-client-controlled-permission-check-parameter2026-11-09 https://bugrater.com/releases/cve-2026-110469-widzialnicms-is-vulnerable-to-unrestricted-file-upload-in-the-panel-upload-php-endpoint-due-to-a-client-controlled-permission-check-parameter-and-insufficient2026-11-09 https://bugrater.com/releases/cve-2026-112168-the-magistra-software-uses-weak-custom-encryption-relies-on-an-outdated-compression-algorithm-to-protect-the-database-and-contains-embedded-secrets2026-11-09 https://bugrater.com/releases/cve-2026-112169-magistra-software-contains-undocumented-backdoor-functionality-that-allows-authentication-bypass-and-the-creation-of-a-privileged-user-account-without-credentia2026-11-09 https://bugrater.com/releases/cve-2026-112170-the-software-downloads-upgrade-files-without-performing-integrity-checks-allowing-the-installation-of-tampered-updates2026-11-09 https://bugrater.com/releases/cve-2026-112171-an-attacker-can-inject-malicious-sql-statements-through-user-controlled-input-allowing-unauthorized-access-to-modification-of-or-disclosure-of-database-data2026-11-09 https://bugrater.com/releases/cve-2026-112204-widzialnicms-is-vulnerable-to-reflected-xss-in-the-index-php-endpoint-an-attacker-can-prepare-an-url-that-when-opened-results-in-arbitrary-javascript-execut2026-11-09 https://bugrater.com/releases/cve-2026-112205-widzialnicms-is-vulnerable-to-bruteforce-protection-bypass-in-the-login-functionality-the-cookie-based-lockout-can-be-bypassed-by-omitting-the-login-count-and2026-11-09 https://bugrater.com/releases/cve-2026-118790-multiple-hardcoded-credentials-are-embedded-within-product-components-and-administrative-functionalities-these-credentials-may-enable-unauthorized-access-to-pr2026-11-09 https://bugrater.com/releases/cve-2026-118791-the-application-implements-software-update-functionality-without-adequate-authenticity-and-integrity-validation-allowing-update-packages-to-be-accepted-without2026-11-09 https://bugrater.com/releases/cve-2026-118792-default-credentials-permit-access-through-acuxdbc2026-11-09 https://bugrater.com/releases/cve-2026-118795-administrative-roles-and-module-permissions-are-stored-in-mutable-local-database-fields-allowing-privilege-escalation-for-attackers-with-database-write-access2026-11-09 https://bugrater.com/releases/cve-2026-118798-multiple-sensitive-authentication-data-including-credentials-oauth-related-secrets-session-information-and-authentication-artifacts-are-exposed-through-app2026-11-09 https://bugrater.com/releases/cve-2026-119610-a-flaw-was-found-in-gstreamer-s-gst-plugins-good-specifically-in-the-h-264-rtp-depayloader-element-when-processing-mtap16-or-mtap24-multi-time-aggregation-rtp2026-11-09 https://bugrater.com/releases/cve-2026-119613-generation-of-error-message-containing-sensitive-information-vulnerability-in-ash-project-ash-ai-allows-a-caller-of-an-ashai-tool-to-read-internal-error-details2026-11-09 https://bugrater.com/releases/cve-2026-120854-allocation-of-resources-without-limits-or-throttling-vulnerability-in-iubenda-iubenda-iubenda-cookie-law-solution-allows-http-dos-this-issue-affects-iubenda-fr2026-11-09 https://bugrater.com/releases/cve-2026-120856-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-rymera-web-co-invoice-gateway-for-woocommerce-invoice-pa2026-11-09 https://bugrater.com/releases/cve-2026-122673-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wpmet-shopengine-shopengine-allows-stored-xss-this-issue-a2026-11-09 https://bugrater.com/releases/cve-2026-124079-rconfig-core-8-0-0-before-8-2-19-and-rconfig-pro-before-8-4-1-contain-a-deserialization-of-untrusted-data-vulnerability-that-allows-unauthenticated-network-atta2026-11-09 https://bugrater.com/releases/cve-2026-124622-a-vulnerability-was-identified-in-olivier-ls-php-fts-up-to-1-1-3-this-impacts-the-function-trigramindex-open-of-the-file-storage-php-such-manipulation-leads2026-11-09 https://bugrater.com/releases/cve-2026-124623-a-security-flaw-has-been-discovered-in-piprapay-3-0-0-affected-is-the-function-system-settings-import-of-the-file-sumo166-cve-apply-blob-main-piprapay-piprapa2026-11-09 https://bugrater.com/releases/cve-2026-94434-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-instit2026-11-09 https://bugrater.com/releases/cve-2026-95648-improperly-controlled-modification-of-dynamically-determined-object-attributes-vulnerability-in-c-prot-inc-c-prot-appdefense-allows-privilege-escalation-this2026-11-09 https://bugrater.com/releases/cve-2026-119274-stored-xss-attacks-occur-when-an-attacker-injects-a-malicious-script-in-global-smart-folders-feature-in-nios2026-11-09 https://bugrater.com/releases/cve-2026-119743-pdfmake-before-0-3-14-contains-a-shared-resource-caching-vulnerability-that-allows-attackers-to-access-cross-document-cached-resources-by-exploiting-a-process-w2026-11-09 https://bugrater.com/releases/cve-2026-124624-a-weakness-has-been-identified-in-piprapay-3-0-0-affected-by-this-vulnerability-is-the-function-hash-hmac-of-the-file-pp-content-pp-include-pp-adapter-php-of-t2026-11-09 https://bugrater.com/releases/cve-2026-124625-a-security-vulnerability-has-been-detected-in-piprapay-3-0-0-affected-by-this-issue-is-the-function-deletedata-of-the-file-pp-content-pp-include-pp-functions-p2026-11-09 https://bugrater.com/releases/cve-2026-124635-a-vulnerability-was-identified-in-kevquirk-pureblog-up-to-3-7-2-impacted-is-an-unknown-function-of-the-file-admin-upload-image-php-of-the-component-admin-image2026-11-09 https://bugrater.com/releases/cve-2026-16283-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-osbil-technology-ltd-osbil-technology-ltd-opanel-al2026-11-09 https://bugrater.com/releases/cve-2026-95778-a-remote-code-execution-vulnerability-exists-in-hpe-morpheus-software2026-11-09 https://bugrater.com/releases/cve-2026-104620-a-path-traversal-attack-in-simulation-of-actions-in-the-zypp-backend-of-packagekit-before-1-4-1-could-be-used-by-local-attackers-to-gain-root-privileges2026-11-09 https://bugrater.com/releases/cve-2026-119474-incorrect-permission-assignment-for-critical-resource-vulnerability-in-havelsan-inc-liman-render-engine-allows-privilege-escalation-this-issue-affects-liman2026-11-09 https://bugrater.com/releases/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response-carried-an-already-expired-set-cookie-header-for-it-using-the-domain-and-path-attributes-from2026-11-09 https://bugrater.com/releases/cve-2026-124636-a-security-flaw-has-been-discovered-in-kevquirk-pureblog-up-to-3-7-2-the-affected-element-is-the-function-save-page-of-the-file-includes-lib-content-php-of-the2026-11-09 https://bugrater.com/releases/cve-2026-124850-a-sql-injection-vulnerability-exists-in-a-database-migration-script-in-flowintel-the-migration-process-reads-stored-connector-identifier-values-from-the-datab2026-11-09 https://bugrater.com/releases/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server-certificate-function-the-identity-of-the-certificate-is-not-checked2026-11-09 https://bugrater.com/releases/cve-2026-118492-in-eclipse-langium-versions-3-0-0-and-later-the-langium-sprotty-package-does-not-html-escape-diagnostic-messages-before-rendering-them-in-the-default-hover-pop2026-11-09 https://bugrater.com/releases/cve-2026-103906-use-of-hard-coded-mqtt-credentials-in-the-am-club-mobile-application-allows-an-authenticated-attacker-to-connect-to-the-mqtt-broker-and-access-data-or-perform-a2026-11-09 https://bugrater.com/releases/cve-2026-112164-the-lasergest-mobile-application-encrypts-stored-assistance-portal-credentials-with-a-hardcoded-aes-key-and-iv-allowing-an-attacker-with-access-to-the-applicat2026-11-09 https://bugrater.com/releases/cve-2026-112165-the-lasergest-mobile-application-disables-tls-certificate-and-hostname-verification-via-setservertrustmode-nocheck-allowing-a-man-in-the-middle-attacker-to2026-11-09 https://bugrater.com/releases/cve-2026-114594-a-time-of-check-to-time-of-use-toctou-race-condition-in-the-sandisk-dashboard-installer-allows-a-local-authenticated-standard-user-to-replace-an-installer-st2026-11-09 https://bugrater.com/releases/cve-2026-115337-improper-access-control-in-progress-ws-ftp-server-versions-prior-to-2025-0-5-could-allow-an-authenticated-user-with-certain-folder-management-permissions-to-byp2026-11-09 https://bugrater.com/releases/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server-releases-prior-to-2025-0-5-on-windows-could-allow-an-unauthenticated-remote-attacker-to-cause-de2026-11-09 https://bugrater.com/releases/cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on-windows-may-write-sensitive-user-credential-and-session-data-to-a-temporary-file-during-file-trans2026-11-09 https://bugrater.com/releases/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer-component-of-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on-windows-could-allow-an-a2026-11-09 https://bugrater.com/releases/cve-2026-121576-incorrect-privilege-assignment-vulnerability-in-atlasaidev-mcp-server-for-wordpress-ai-workflow-automation-ai-agent-hub-allows-privilege-escalation-this-issue-a2026-11-09 https://bugrater.com/releases/cve-2026-121612-weak-authentication-vulnerability-in-wpzoom-wpbruiser-no-captcha-anti-spam-goodbye-captcha-allows-authentication-abuse-this-issue-affects-wpbruiser-no-capt2026-11-09 https://bugrater.com/releases/cve-2026-122664-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-videowhisper-com-broadcast-live-video-videowhisper-live-st2026-11-09 https://bugrater.com/releases/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-crocoblock-jetformbuilder-jetformbuilder-allows-stored-xss2026-11-09 https://bugrater.com/releases/cve-2026-124683-eclipse-langium-versions-3-2-0-through-4-4-0-contain-an-inefficient-algorithmic-complexity-issue-cwe-407-in-the-opt-in-indentationawaretokenbuilder-and-indent2026-11-09 https://bugrater.com/releases/cve-2026-119755-tasmota-through-16-0-0-fixed-in-commit-1cb7ebc-contains-a-cross-site-request-forgery-vulnerability-that-allows-unauthenticated-attackers-to-bypass-referer-bas2026-11-09 https://bugrater.com/releases/cve-2026-119756-tasmota-through-16-0-0-fixed-in-commit-e97e1e4-contains-a-heap-out-of-bounds-write-vulnerability-in-sendreceivedevicegroupmessage-that-allows-unauthenticate2026-11-09 https://bugrater.com/releases/cve-2026-19706-during-abi-bootstrap-the-bootstrap-node-s-approve-csr-service-approves-and-signs-every-csr-without-identity-validation-an-attacker-on-the-install-network-can2026-11-09 https://bugrater.com/releases/cve-2026-60117-the-android-implementation-of-the-flutter-dart-receive-sharing-intent-package-versions-1-4-1-through-1-9-0-contains-a-path-traversal-vulnerability-in-filedire2026-11-09 https://bugrater.com/releases/cve-2026-112314-clnttcp-call-in-lib-rpc-clnt-tcp-c-in-mit-kerberos-5-aka-krb5-does-not-free-the-rpc-reply-verifier-between-retries-which-allows-remote-attackers-to-cause-a2026-11-09 https://bugrater.com/releases/cve-2026-112315-the-rpcsec-gss-authentication-routines-in-lib-rpc-authgss-prot-c-in-mit-kerberos-5-aka-krb5-1-4-and-later-do-not-free-partially-decoded-buffers-on-failure-wh2026-11-09 https://bugrater.com/releases/cve-2026-112316-xdr-krb5-tl-data-in-lib-kadm5-kadm-rpc-xdr-c-in-mit-kerberos-5-aka-krb5-does-not-free-partially-decoded-data-on-failure-which-allows-remote-authenticated-u2026-11-09 https://bugrater.com/releases/cve-2026-112317-krb5-ktkdb-get-entry-in-lib-kdb-keytab-c-in-mit-kerberos-5-aka-krb5-1-2-8-and-later-does-not-free-decrypted-key-material-when-a-post-decryption-check-fails2026-11-09 https://bugrater.com/releases/cve-2026-112318-the-policy-rpc-stubs-in-kadmin-server-server-stubs-c-in-mit-kerberos-5-aka-krb5-1-5-3-and-later-do-not-reject-a-null-policy-name-decoded-by-xdr-nullstring2026-11-09 https://bugrater.com/releases/cve-2026-112319-the-gss-rpc-layer-in-mit-kerberos-5-aka-krb5-does-not-enforce-size-limits-on-xdr-decoded-data-which-allows-remote-authenticated-users-to-cause-a-denial-of-se2026-11-09 https://bugrater.com/releases/cve-2026-112320-the-gss-rpc-transport-layer-in-mit-kerberos-5-aka-krb5-1-4-and-later-does-not-release-the-previous-authentication-context-when-a-client-switches-from-an-rpcse2026-11-09 https://bugrater.com/releases/cve-2026-112321-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka-krb5-does-not-free-decoded-arguments-on-certain-error-paths-which-allows-remote-at2026-11-09 https://bugrater.com/releases/cve-2026-112322-clean-client-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka-krb5-restarts-its-scan-from-the-head-of-the-client-list-after-each-removal-resulting-in-qua2026-11-09 https://bugrater.com/releases/cve-2026-112323-the-auth-gssapi-handler-in-lib-rpc-svc-auth-gssapi-c-in-mit-kerberos-5-aka-krb5-1-5-2-and-later-allows-remote-attackers-to-cause-a-denial-of-service-memory-e2026-11-09 https://bugrater.com/releases/cve-2026-119079-decode-sequence-of-in-lib-krb5-asn-1-asn1-encode-c-in-mit-kerberos-5-aka-krb5-1-11-and-later-grows-the-decoded-element-array-one-entry-at-a-time-which-allo2026-11-09 https://bugrater.com/releases/cve-2026-120834-incorrect-privilege-assignment-vulnerability-in-tobias-wp2leads-wp2leads-allows-privilege-escalation-this-issue-affects-wp2leads-from-n-a-through-3-5-172026-11-09 https://bugrater.com/releases/cve-2026-121573-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-melapress-wp-activity-log-wp-security-audit-log-allows-sto2026-11-09 https://bugrater.com/releases/cve-2026-121769-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-axew3-com-wp-w3all-phpbb-wp-w3all-phpbb-integration-allows2026-11-09 https://bugrater.com/releases/cve-2026-123999-nasa-jpl-ion-dtn-3-6-2-through-4-2-0-contains-a-heap-based-buffer-overflow-in-the-network-management-daemon-nm-mgr-string-formatting-logic-that-allows-a-malic2026-11-09 https://bugrater.com/releases/cve-2026-124000-nasa-jpl-ion-dtn-2-1-0-through-4-2-0-contains-a-heap-buffer-under-allocation-vulnerability-in-the-asynchronous-message-service-daemon-amsd-that-allows-a-rogue2026-11-09 https://bugrater.com/releases/cve-2026-124001-nasa-jpl-ion-dtn-2-2-1b-through-4-2-0-contains-an-integer-overflow-vulnerability-in-the-datagram-retransmission-dgr-convergence-layer-that-allows-attackers-to2026-11-09 https://bugrater.com/releases/cve-2026-125064-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-g726-decode-frame-in-libavcodec-g726-c-because-it-ignores-init-get-bits-failure-on2026-11-09 https://bugrater.com/releases/cve-2026-125065-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-tgv-decode-inter-in-libavcodec-eatgv-c-that-ignores-init-get-bits-failure-on-overs2026-11-09 https://bugrater.com/releases/cve-2026-125066-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-the-cirrus-logic-accupak-cljr-decoder-in-libavcodec-cljrdec-c-because-decode-frame2026-11-09 https://bugrater.com/releases/cve-2026-125067-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-vble-decode-frame-in-libavcodec-vble-c-because-it-ignores-init-get-bits-failure-on2026-11-09 https://bugrater.com/releases/cve-2026-125068-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-the-bink-video-decoder-because-decode-frame-in-libavcodec-bink-c-ignores-init-get-bi2026-11-09 https://bugrater.com/releases/cve-2026-125069-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-the-motion-pixels-decoder-because-mp-decode-frame-ignores-init-get-bits-failure-a2026-11-09 https://bugrater.com/releases/cve-2026-125070-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-tqi-decode-frame-in-libavcodec-eatqi-c-which-ignores-init-get-bits-failure-after2026-11-09 https://bugrater.com/releases/cve-2026-125071-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-libavcodec-jvdec-c-that-allows-attackers-to-crash-applications-by-supplying-oversized2026-11-09 https://bugrater.com/releases/cve-2026-125072-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-mp-decode-frame-in-libavcodec-mpegaudiodec-template-c-because-init-get-bits-failur2026-11-09 https://bugrater.com/releases/cve-2026-125073-ffmpeg-through-9-0-2-contains-an-infinite-loop-vulnerability-in-bit-allocation-in-libavcodec-imc-c-that-allows-attackers-to-hang-decoding-by-supplying-audio-b2026-11-09 https://bugrater.com/releases/cve-2026-125095-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-use-vulnerability-in-the-c93-video-decoder-in-libavcodec-c93-c-where-decode-frame-never-checks-how-many2026-11-09 https://bugrater.com/releases/cve-2026-125096-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-libavcodec-tiertexseqv-c-that-allows-attackers-to-leak-stack-contents-by-trigg2026-11-09 https://bugrater.com/releases/cve-2026-125097-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-raw-decode-in-libavcodec-rawdec-c-that-fails-to-verify-packet-stride-covers2026-11-09 https://bugrater.com/releases/cve-2026-125098-ffmpeg-through-9-0-2-contains-an-information-disclosure-vulnerability-in-vp8-lossy-decode-alpha-in-libavcodec-webp-c-that-leaves-alpha-plane-memory-uninitiali2026-11-09 https://bugrater.com/releases/cve-2026-125099-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-the-gem-raster-image-decoder-in-libavcodec-gemdec-c-that-exposes-uninitialized2026-11-09 https://bugrater.com/releases/cve-2026-125100-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-the-openexr-decoder-s-decode-frame-in-libavcodec-exr-c-that-miscalculates-the-tiled-block-c2026-11-09 https://bugrater.com/releases/cve-2026-125101-ffmpeg-through-9-0-2-contains-an-information-disclosure-vulnerability-in-the-vmnc-decoder-in-libavcodec-vmnc-c-that-restores-an-unwritten-cursor-save-area-into2026-11-09 https://bugrater.com/releases/cve-2026-125102-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-tak-decode-frame-in-libavcodec-takdec-c-that-fails-to-verify-multichannel-de2026-11-09 https://bugrater.com/releases/cve-2026-125103-ffmpeg-through-9-0-2-contains-an-information-disclosure-vulnerability-in-ff-mlz-decompression-in-libavcodec-mlz-c-which-accepts-string-codes-beyond-the-dicti2026-11-09 https://bugrater.com/releases/cve-2026-125104-ffmpeg-through-9-0-2-contains-a-memory-exhaustion-vulnerability-in-ape-decode-frame-in-libavcodec-apedec-c-that-fails-to-enforce-the-73728-sample-limit-for-le2026-11-09 https://bugrater.com/releases/cve-2026-125170-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-targa-decode-rle-in-libavcodec-targa-c-caused-by-missing-packet-length-check2026-11-09 https://bugrater.com/releases/cve-2026-125171-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-the-musepack-sv7-decoder-because-mpc7-decode-init-does-not-validate-lastframelen-against2026-11-09 https://bugrater.com/releases/cve-2026-125172-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-libxevd-receive-frame-in-libavcodec-libxevd-c-that-fails-to-validate-nal-unit-length-pref2026-11-09 https://bugrater.com/releases/cve-2026-125173-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-libxevd-receive-frame-in-libavcodec-libxevd-c-that-fails-to-free-pkt-au-when-an-access-unit-produ2026-11-09 https://bugrater.com/releases/cve-2026-125174-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-ff-hap-set-chunk-count-in-libavcodec-hap-c-where-a-shadowed-ret2026-11-09 https://bugrater.com/releases/cve-2026-125175-ffmpeg-through-9-0-2-contains-an-information-disclosure-vulnerability-in-flashsv-decode-block-in-libavcodec-flashsv-c-that-copies-uninitialized-heap-memory-in2026-11-09 https://bugrater.com/releases/cve-2026-125176-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-read-vulnerability-in-decode-hybrid-in-libavcodec-flashsv-c-that-reads-past-decompressed-data-when-decod2026-11-09 https://bugrater.com/releases/cve-2026-125177-ffmpeg-through-9-0-2-contains-an-information-disclosure-vulnerability-in-the-mscc-srgc-decoder-in-libavcodec-mscc-c-that-outputs-uninitialized-heap-bytes-when-r2026-11-09 https://bugrater.com/releases/cve-2026-125178-ffmpeg-through-9-0-2-contains-an-out-of-bounds-heap-read-vulnerability-in-tdsc-load-cursor-in-libavcodec-tdsc-c-which-stores-cursor-dimensions-before-validat2026-11-09 https://bugrater.com/releases/cve-2026-125179-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-vulnerability-in-the-vqa-video-decoder-in-libavcodec-vqavideo-c-that-allows-attackers-to-disclose-heap-mem2026-11-09 https://bugrater.com/releases/cve-2026-125180-ffmpeg-8-1-through-9-0-2-contains-a-memory-exhaustion-vulnerability-in-the-libavcodec-exif-c-parser-that-allows-attackers-to-amplify-allocations-by-pointing-man2026-11-09 https://bugrater.com/releases/cve-2026-125181-ffmpeg-through-9-0-2-contains-an-out-of-bounds-write-vulnerability-in-flic-decode-frame-15-16bpp-in-libavcodec-flicvideo-c-that-allows-attackers-to-corrupt-he2026-11-09 https://bugrater.com/releases/cve-2026-125182-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-the-cook-decoder-joint-decode-function-because-cook-decode-init-does-not-check-js-subba2026-11-09 https://bugrater.com/releases/cve-2026-125183-ffmpeg-through-9-0-2-contains-a-denial-of-service-vulnerability-in-pps-3d-extension-in-libavcodec-hevc-ps-c-that-allows-attackers-to-exhaust-cpu-through-unbou2026-11-09 https://bugrater.com/releases/cve-2026-125184-ffmpeg-6-1-through-9-0-2-contains-an-information-disclosure-vulnerability-in-the-camstudio-decoder-libavcodec-cscd-c-that-copies-uninitialized-heap-memory-int2026-11-09 https://bugrater.com/releases/cve-2026-125185-ffmpeg-through-9-0-2-contains-a-division-by-zero-vulnerability-in-ff-aom-parse-film-grain-sets-that-fails-to-reject-afgs1-scaling-points-with-repeated-x-value2026-11-09 https://bugrater.com/releases/cve-2026-125186-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource-consumption-vulnerability-in-the-dts2pts-bitstream-filter-that-allows-attackers-to-exhaust-cpu-through-un2026-11-09 https://bugrater.com/releases/cve-2026-125187-ffmpeg-through-9-0-2-contains-a-reachable-assertion-vulnerability-in-the-tta-encoder-s-tta-encode-frame-in-libavcodec-ttaenc-c-which-never-reserves-output-pa2026-11-09 https://bugrater.com/releases/cve-2026-125188-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read-vulnerability-in-libavcodec-proresenc-anatoliy-c-that-occurs-when-the-prores-aw-encoder-processes-interl2026-11-09 https://bugrater.com/releases/cve-2026-125189-ffmpeg-8-1-through-9-0-2-contains-a-denial-of-service-vulnerability-in-the-lcevc-metadata-bitstream-filter-caused-by-a-process-block-position-mismatch-in-lcevc2026-11-09 https://bugrater.com/releases/cve-2026-125190-ffmpeg-through-9-0-2-contains-an-information-disclosure-vulnerability-in-decode-mvc2-in-libavcodec-mvcdec-c-that-leaks-uninitialized-stack-memory-through-unch2026-11-09 https://bugrater.com/releases/cve-2026-125191-ffmpeg-through-9-0-2-contains-a-reference-count-leak-in-libavcodec-v4l2-buffers-c-that-allows-attackers-to-deadlock-the-v4l2-mem2mem-decoder-on-multi-plane-capt2026-11-09 https://bugrater.com/releases/cve-2026-125192-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-vulnerability-in-the-dxa-decoder-in-libavcodec-dxa-c-that-allows-attackers-to-disclose-heap-memory-via-cra2026-11-09 https://bugrater.com/releases/cve-2026-125193-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-bitpacked-decode-uyvy422-in-libavcodec-bitpacked-dec-c-because-it-never-verifies-packets2026-11-09 https://bugrater.com/releases/cve-2026-125194-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-pcm-dvd-encode-frame-in-libavcodec-pcm-dvdenc-c-when-a-24-bit-final-frame-holds-fewer-sam2026-11-09 https://bugrater.com/releases/cve-2026-125195-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-adpcm-encode-frame-in-libavcodec-adpcmenc-c-that-leaks-heap-bytes-when-encod2026-11-09 https://bugrater.com/releases/cve-2026-125196-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-liboapve-encode-in-libavcodec-liboapvenc-c-that-allows-attackers-to-corrupt-heap-memory2026-11-09 https://bugrater.com/releases/cve-2026-125197-ffmpeg-through-9-0-2-contains-an-integer-underflow-in-decode-frame-in-libavcodec-lcldec-c-that-allows-attackers-to-trigger-a-heap-out-of-bounds-read-via-short2026-11-09 https://bugrater.com/releases/cve-2026-125198-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-mediaformat-jni-setbuffer-in-libavcodec-mediacodec-wrapper-c-that-never-frees-buffers-wrapped-wit2026-11-09 https://bugrater.com/releases/cve-2026-125199-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-vc1-decode-frame-in-libavcodec-vc1dec-c-that-leaks-slice-buffers-when-init-get-bits8-fails-att2026-11-09 https://bugrater.com/releases/cve-2026-125200-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-libavcodec-libx265-c-because-libx265-encode-frame-never-frees-the-rpu-payload-allocated-by-ff-dov2026-11-09 https://bugrater.com/releases/cve-2026-125201-ffmpeg-7-0-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of-bounds-write-vulnerability-in-vk-av1-decode-slice-in-libavcodec-vulkan-av1-c-because-the-t2026-11-09 https://bugrater.com/releases/cve-2026-125202-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-vaapi-hevc-start-frame-in-libavcodec-vaapi-hevc-c-that-copies-unbounded-pps-tile-counts2026-11-09 https://bugrater.com/releases/cve-2026-125203-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-the-cook-multichannel-decoder-in-libavcodec-cook-c-that-fails-to-verif2026-11-09 https://bugrater.com/releases/cve-2026-125204-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-in-ff-libwebp-get-frame-in-libwebpenc-common-c-that-lets-attackers-corrupt-memory-when-cr-threshold-is-se2026-11-09 https://bugrater.com/releases/cve-2026-125205-ffmpeg-through-9-0-2-contains-an-unbounded-memory-allocation-vulnerability-in-the-av1-frame-merge-bitstream-filter-that-allows-attackers-to-exhaust-memory-by-ne2026-11-09 https://bugrater.com/releases/cve-2026-125206-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-the-prores-ks-encoder-s-get-alpha-data-that-reads-before-the-blocks-buffer-for-interlaced2026-11-09 https://bugrater.com/releases/cve-2026-125207-ffmpeg-through-9-0-2-contains-an-uncontrolled-memory-allocation-vulnerability-in-the-interplay-acm-decoder-that-allows-attackers-to-exhaust-memory-via-an-attack2026-11-09 https://bugrater.com/releases/cve-2026-125208-ffmpeg-through-9-0-2-contains-an-out-of-bounds-write-vulnerability-in-v4l2-buffer-swframe-to-buf-in-libavcodec-v4l2-buffers-c-because-cumulative-plane-offsets2026-11-09 https://bugrater.com/releases/cve-2026-125209-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-the-dvd-subtitle-encoder-that-underestimates-rle-output-size-for-odd-w2026-11-09 https://bugrater.com/releases/cve-2026-125210-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-aribcaption-trans-text-subtitle-in-libavcodec-libaribcaption-c-when-decoding-with-sub-ty2026-11-09 https://bugrater.com/releases/cve-2026-125211-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-and-invalid-free-vulnerability-in-aribcaption-trans-ass-subtitle-in-libavcodec-libaribcaption-c-that-frees2026-11-09 https://bugrater.com/releases/cve-2026-125212-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-libavcodec-videotoolboxenc-c-that-copies-frames-larger-than-encoder-dimensions-into-unders2026-11-09 https://bugrater.com/releases/cve-2026-125213-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-the-psd-decoder-in-libavcodec-psd-c-that-allows-attackers-to-corrupt-heap-memory-on-32-bit2026-11-09 https://bugrater.com/releases/cve-2026-125214-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-pcm-bluray-decode-frame-in-libavcodec-pcm-bluray-c-on-big-endian-hosts-attackers-can-su2026-11-09 https://bugrater.com/releases/cve-2026-125215-ffmpeg-7-1-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-ff-dovi-rpu-generate-in-libavcodec-dovi-rpuenc-c-that-allows-attackers-to-crash2026-11-09 https://bugrater.com/releases/cve-2026-125216-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-libavcodec-dpxenc-c-that-allows-attackers-to-crash-the-process-via-unvalidated-bits-pe2026-11-09 https://bugrater.com/releases/cve-2026-125217-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-use-vulnerability-in-roq-dpcm-encode-frame-in-libavcodec-roqaudioenc-c-that-encodes-stale-heap-contents2026-11-09 https://bugrater.com/releases/cve-2026-125218-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-the-apng-encoder-s-encode-apng-function-in-libavcodec-pngenc-c-when-frame-size-changes-m2026-11-09 https://bugrater.com/releases/cve-2026-125219-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-vdpau-hevc-start-frame-in-libavcodec-vdpau-hevc-c-that-copies-unbounded-pps-tile-counts2026-11-09 https://bugrater.com/releases/cve-2026-125220-ffmpeg-through-9-0-2-contains-a-deadlock-vulnerability-in-mimic-decode-frame-in-libavcodec-mimic-c-that-fails-to-report-frame-progress-when-init-get-bits8-f2026-11-09 https://bugrater.com/releases/cve-2026-125221-ffmpeg-through-9-0-2-contains-an-uncontrolled-recursion-vulnerability-in-score-header-in-libavcodec-flac-parser-c-that-allows-attackers-to-exhaust-the-thread2026-11-09 https://bugrater.com/releases/cve-2026-125222-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-hap-parse-frame-header-in-libavcodec-hapdec-c-that-allows-attackers-to-trigger-a-heap-buffe2026-11-09 https://bugrater.com/releases/cve-2026-125223-ffmpeg-8-0-through-9-0-2-contains-a-memory-leak-vulnerability-in-the-vp9-decoder-that-allows-attackers-to-exhaust-memory-because-vp9-decode-frame-skips-resett2026-11-09 https://bugrater.com/releases/cve-2026-125224-ffmpeg-through-9-0-2-contains-a-denial-of-service-vulnerability-in-libavcodec-vorbis-parser-c-that-re-parses-invalid-extradata-for-every-packet-when-valid-extra2026-11-09 https://bugrater.com/releases/cve-2026-125225-ffmpeg-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-aac-adtstoasc-filter-that-allows-attackers-to-crash-applications-via-oversized-adts2026-11-09 https://bugrater.com/releases/cve-2026-125226-ffmpeg-through-9-0-2-contains-an-uncontrolled-memory-allocation-vulnerability-in-sbg-read-header-in-libavformat-sbgdec-c-that-derives-an-unbounded-default-fra2026-11-09 https://bugrater.com/releases/cve-2026-125227-ffmpeg-through-9-0-2-contains-an-integer-overflow-in-cbs-jpeg-write-scan-in-libavcodec-cbs-jpeg-c-that-causes-a-heap-buffer-overflow-on-32-bit-builds-attacke2026-11-09 https://bugrater.com/releases/cve-2026-125228-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-put-vector-in-libavcodec-vorbisenc-c-when-nan-samples-leave-the-codeb2026-11-09 https://bugrater.com/releases/cve-2026-125229-ffmpeg-through-9-0-2-contains-an-out-of-bounds-memory-access-vulnerability-in-the-encode-frame-function-of-libavcodec-huffyuvenc-c-because-encode-init-neve2026-11-09 https://bugrater.com/releases/cve-2026-125230-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-the-pcm-rechunk-bitstream-filter-that-allows-attackers-to-trigger-division-by-zero-via-a-craf2026-11-09 https://bugrater.com/releases/cve-2026-125231-ffmpeg-4-4-through-9-0-2-contains-a-null-pointer-dereference-vulnerability-in-libavcodec-adxdec-c-because-adx-decode-header-updates-the-channel-layout-before2026-11-09 https://bugrater.com/releases/cve-2026-125232-ffmpeg-through-9-0-2-contains-a-division-by-zero-vulnerability-in-estimate-motion-b-in-libavcodec-motion-est-c-caused-by-frame-timestamp-distances-truncated2026-11-09 https://bugrater.com/releases/cve-2026-125233-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-dvbsub-encode-in-libavcodec-dvbsubenc-c-that-undercounts-each-clut-segment-header-by-two2026-11-09 https://bugrater.com/releases/cve-2026-125234-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-wavpack-encode-init-in-libavcodec-wavpackenc-c-that-causes-an-infinite-loop-when-computing2026-11-09 https://bugrater.com/releases/cve-2026-125235-ffmpeg-through-9-0-2-contains-a-heap-overflow-vulnerability-in-libavcodec-qsvenc-c-that-allows-attackers-to-corrupt-memory-by-reusing-an-undersized-pooled-qsvfr2026-11-09 https://bugrater.com/releases/cve-2026-125236-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-alloc-frame-in-libavcodec-vvc-refs-c-that-leaks-sps-and-pps-references-when-frame-buffer-allocati2026-11-09 https://bugrater.com/releases/cve-2026-125237-ffmpeg-8-1-through-9-0-2-contains-a-denial-of-service-vulnerability-in-libavcodec-dpx-c-that-leaves-dpx-hwaccel-picture-private-allocated-when-vulkan-hwaccel-c2026-11-09 https://bugrater.com/releases/cve-2026-125238-ffmpeg-through-9-0-2-contains-a-reachable-assertion-vulnerability-in-libxevd-receive-frame-in-libavcodec-libxevd-c-that-returns-success-when-an-access-unit-pr2026-11-09 https://bugrater.com/releases/cve-2026-125239-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-ff-dxva2-hevc-fill-picture-parameters-that-allows-attackers-to-corrupt-memory-via-unboun2026-11-09 https://bugrater.com/releases/cve-2026-125240-ffmpeg-through-9-0-2-contains-a-resource-leak-vulnerability-in-svt-jpegxs-dec-decode-in-libsvtjpegxsdec-c-that-leaks-decoder-instances-when-ff-set-dimensions2026-11-09 https://bugrater.com/releases/cve-2026-125241-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-libavcodec-flicvideo-c-that-allows-attackers-to-write-out-of-bounds-because-check-pixel-pt2026-11-09 https://bugrater.com/releases/cve-2026-125242-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-libavcodec-vdpau-c-that-allows-attackers-to-exhaust-heap-memory-by-aborting-pictures-before-end-fra2026-11-09 https://bugrater.com/releases/cve-2026-125243-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-ff-jpegls-decode-picture-in-libavcodec-jpeglsdec-c-which-decodes-16-bit-lin2026-11-09 https://bugrater.com/releases/cve-2026-125244-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-an-out-of-bounds-write-vulnerability-in-the-vvc-decoder-s-sh-entry-points-function-in-libavcodec-vvc-ps-c-a2026-11-09 https://bugrater.com/releases/cve-2026-125245-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-ff-mjpeg-decode-sof-in-libavcodec-mjpegdec-c-which-overwrites-the-hwaccel-picture-private-pointe2026-11-09 https://bugrater.com/releases/cve-2026-125246-ffmpeg-through-9-0-2-contains-a-denial-of-service-vulnerability-in-cbs-jpeg-assemble-fragment-that-miscounts-0xff-stuffing-bytes-in-jpeg-scan-headers-attacke2026-11-09 https://bugrater.com/releases/cve-2026-125247-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-dng-decode-tiles-that-allows-attackers-to-leak-uninitialized-memory-via-crafted-dng-tile-di2026-11-09 https://bugrater.com/releases/cve-2026-125248-ffmpeg-9-0-through-9-0-2-contains-an-integer-overflow-vulnerability-in-libavcodec-ffv1enc-vulkan-c-that-undersizes-the-float-remap-gpu-buffer-for-large-frames2026-11-09 https://bugrater.com/releases/cve-2026-125249-ffmpeg-7-1-through-9-0-2-contains-an-integer-overflow-in-ff-vk-decode-add-slice-in-libavcodec-vulkan-decode-c-that-miscalculates-the-vulkan-hwaccel-bitstream2026-11-09 https://bugrater.com/releases/cve-2026-125250-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-in-the-gif-encoder-s-gif-image-write-image-in-libavcodec-gif-c-because-shrunk-buf-is-sized-from-the-first2026-11-09 https://bugrater.com/releases/cve-2026-125251-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-the-vvc-decoder-alloc-frame-function-in-libavcodec-vvc-refs-c-that-undersizes-the-reference2026-11-09 https://bugrater.com/releases/cve-2026-12977-a-flaw-was-found-in-the-deployment-operation-family-of-wildfly-core-certain-handlers-such-as-upload-deployment-url-lack-proper-sensitivity-classification-al2026-11-09 https://bugrater.com/releases/cve-2026-70555-rconfig-core-8-2-3-before-8-2-13-contains-an-information-disclosure-vulnerability-that-allows-authenticated-users-to-retrieve-cleartext-ssh-telnet-and-enable2026-11-09 https://bugrater.com/releases/cve-2026-124834-a-security-vulnerability-has-been-detected-in-iomad-up-to-4-5-15-5-0-11-5-1-8-5-2-4-affected-by-this-issue-is-the-function-store-temporary-password-of-the-file2026-11-09 https://bugrater.com/releases/cve-2026-124987-a-vulnerability-has-been-found-in-mikefarah-yq-up-to-4-53-3-this-affects-the-function-encode-of-the-file-pkg-yqlib-encoder-properties-go-such-manipulation-lea2026-11-09 https://bugrater.com/releases/cve-2026-125252-ffmpeg-through-9-0-2-contains-a-memory-leak-vulnerability-in-libavcodec-vaapi-decode-c-that-allows-attackers-to-exhaust-memory-by-supplying-streams-with-slice-p2026-11-09 https://bugrater.com/releases/cve-2026-125253-ffmpeg-through-9-0-2-contains-an-integer-overflow-in-cbs-vp9-split-fragment-in-libavcodec-cbs-vp9-c-that-wraps-the-superframe-size-check-on-32-bit-builds-att2026-11-09 https://bugrater.com/releases/cve-2026-125254-ffmpeg-through-9-0-2-contains-a-division-by-zero-vulnerability-in-the-vvc-decoder-because-ff-vvc-slice-rpl-fails-to-validate-num-ref-idx-active-against-built2026-11-09 https://bugrater.com/releases/cve-2026-125255-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in-libavcodec-mjpegdec-c-that-allows-attackers-to-trigger-freed-buffer-reads-by-sending-a-sof-marke2026-11-09 https://bugrater.com/releases/cve-2026-125256-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-ff-llvidenc-diff-bytes-rvv-that-allows-attackers-to-corrupt-heap-memory-by-triggering-ne2026-11-09 https://bugrater.com/releases/cve-2026-125257-ffmpeg-through-9-0-2-contains-an-off-by-one-heap-overflow-vulnerability-in-get-exponent-dynamic-in-libavcodec-nellymoserenc-c-that-allows-writing-one-element2026-11-09 https://bugrater.com/releases/cve-2026-125258-ffmpeg-through-9-0-2-contains-a-division-by-zero-vulnerability-in-dovi-configure-ext-in-libavcodec-dovi-rpuenc-c-that-allows-attackers-to-crash-the-process-vi2026-11-09 https://bugrater.com/releases/cve-2026-125259-ffmpeg-through-9-0-2-contains-an-integer-overflow-vulnerability-in-ff-prores-kostya-encode-init-that-miscalculates-frame-size-upper-bound-using-32-bit-arithme2026-11-09 https://bugrater.com/releases/cve-2026-125260-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-libavcodec-exrenc-c-that-allows-attackers-to-corrupt-heap-memory-when-encode-scanline-rle2026-11-09 https://bugrater.com/releases/cve-2026-125261-ffmpeg-through-9-0-2-contains-an-out-of-bounds-read-vulnerability-in-the-sgi-encoder-s-encode-frame-in-libavcodec-sgienc-c-where-unsigned-size-variables-mis2026-11-09 https://bugrater.com/releases/cve-2026-125262-ffmpeg-through-9-0-2-contains-a-heap-buffer-overflow-vulnerability-in-libavcodec-lcevcdec-c-because-lcevc-output-picture-dimensions-are-not-validated-against-th2026-11-09 https://bugrater.com/releases/cve-2026-125263-ffmpeg-9-0-through-9-0-2-built-with-liblcevc-dec-fails-to-validate-lcevc-enhanced-output-dimensions-against-max-pixels-in-libavcodec-decode-c-before-frame-alloc2026-11-09 https://bugrater.com/releases/cve-2026-125264-ffmpeg-through-9-0-2-contains-an-uncontrolled-resource-consumption-vulnerability-in-parse-frame-header-in-libavcodec-jpegxl-parser-c-that-fails-to-validate-to2026-11-09 https://bugrater.com/releases/cve-2026-125265-ffmpeg-through-9-0-2-contains-a-use-after-free-vulnerability-in-libavcodec-nvdec-c-because-ff-nvdec-start-frame-fails-to-reset-ctx-bitstream-after-slice-erro2026-11-09 https://bugrater.com/releases/cve-2026-125266-ffmpeg-through-9-0-2-contains-an-uninitialized-stack-memory-disclosure-vulnerability-in-old-codec23-of-libavcodec-sanm-c-that-leaks-stack-bytes-into-decoded-f2026-11-09 https://bugrater.com/releases/cve-2026-125267-ffmpeg-before-8-1-3-and-9-x-before-9-0-2-contains-a-heap-out-of-bounds-write-vulnerability-in-the-apac-decoder-in-libavcodec-apac-c-caused-by-an-unreset-bitstre2026-11-09 https://bugrater.com/releases/cve-2026-125268-ffmpeg-through-9-0-2-contains-an-uninitialized-memory-disclosure-vulnerability-in-the-cineform-hd-decoder-that-allows-attackers-to-leak-heap-memory-via-unzeroed2026-11-09 https://bugrater.com/releases/cve-2026-125269-ffmpeg-through-9-0-2-contains-a-double-free-vulnerability-in-libavcodec-cbs-sei-c-where-cbs-sei-delete-message-leaves-a-stale-extension-data-reference-that-ff2026-11-09 https://bugrater.com/releases/cve-2026-125270-ffmpeg-through-9-0-2-contains-a-heap-out-of-bounds-read-vulnerability-in-v4l2-buffer-swframe-to-buf-in-libavcodec-v4l2-buffers-c-that-mishandles-frames-with-n2026-11-09 https://bugrater.com/releases/cve-2026-87857-temporal-server-does-not-bind-a-workflow-history-pagination-token-to-the-namespace-and-workflow-named-in-the-request-that-presents-it-getworkflowexecutionhisto2026-11-09 https://bugrater.com/releases/ios-27-2-1-and-ipados-27-2-12026-11-10 https://bugrater.com/releases/ios-26-7-3-and-ipados-26-7-32026-11-10 https://bugrater.com/releases/stable-channel-update-for-desktop-157-0-8103-50-512026-11-10 https://bugrater.com/releases/ios-18-7-12-and-ipados-18-7-122026-11-10 https://bugrater.com/releases/security-vulnerabilities-fixed-in-firefox-for-ios-160-02026-11-10 https://bugrater.com/releases/security-vulnerabilities-fixed-in-thunderbird-140-152026-11-10 https://bugrater.com/releases/security-vulnerabilities-fixed-in-thunderbird-1552026-11-10 https://bugrater.com/releases/cve-2026-125076-a-vulnerability-was-found-in-sourcecodester-smart-attendance-system-with-qr-code-scanner-1-0-affected-is-an-unknown-function-of-the-file-api-attendance-handler2026-11-10 https://bugrater.com/releases/cve-2026-125077-a-vulnerability-was-determined-in-sourcecodester-smart-attendance-system-with-qr-code-scanner-1-0-affected-by-this-vulnerability-is-an-unknown-functionality-e2026-11-10 https://bugrater.com/releases/cve-2026-125078-a-security-flaw-has-been-discovered-in-sourcecodester-smart-attendance-system-with-qr-code-scanner-1-0-this-affects-an-unknown-part-of-the-file-login-php-the2026-11-10 https://bugrater.com/releases/cve-2026-125357-munin-munin-httpd-2-99-1-through-2-999-18-contains-a-path-traversal-vulnerability-in-the-static-file-handler-of-munin-master-html-handle-request-that-allows2026-11-10 https://bugrater.com/releases/cve-2026-125358-universal-modder-before-commit-e88f6876745427321eb755ebc98276063a962d8a-contains-a-missing-websocket-origin-validation-vulnerability-in-the-hostlink-class-of-it2026-11-10 https://bugrater.com/releases/cve-2026-125359-mediary-scout-before-2026-11-05-contains-a-server-side-request-forgery-vulnerability-that-allows-any-authenticated-user-including-non-owner-accounts-to-set-an2026-11-10 https://bugrater.com/releases/cve-2026-125360-storyden-through-1-26-16-contains-a-privilege-escalation-vulnerability-that-allows-users-holding-manage-roles-to-grant-the-administrator-permission-without-bein2026-11-10 https://bugrater.com/releases/cve-2026-125361-tencent-browserskill-through-0-4-2-contains-a-missing-authentication-vulnerability-that-allows-local-attackers-to-impersonate-the-bsk-daemon-because-remotesocke2026-11-10 https://bugrater.com/releases/cve-2026-125362-seahub-through-14-0-10-contains-a-weak-randomness-vulnerability-in-multisharelinksbatch-post-that-generates-batch-share-link-passwords-using-python-s-non-cryp2026-11-10 https://bugrater.com/releases/cve-2026-125363-mikrodash-before-0-8-79-contains-a-server-side-request-forgery-vulnerability-that-allows-any-signed-in-user-including-the-viewer-role-to-target-internal-addre2026-11-10 https://bugrater.com/releases/cve-2026-125364-frab-through-0-9-1-contains-a-privilege-escalation-vulnerability-that-allows-authenticated-crew-users-to-grant-themselves-orga-roles-by-submitting-unchecked-nes2026-11-10 https://bugrater.com/releases/cve-2026-125365-dollardollar-through-4-4-contains-a-missing-authorization-vulnerability-in-add-expense-that-allows-authenticated-users-to-modify-other-users-account-balances2026-11-10 https://bugrater.com/releases/cve-2026-125366-omnom-through-0-9-0-contains-a-server-side-request-forgery-vulnerability-that-allows-authenticated-users-to-make-server-requests-to-arbitrary-hosts-by-submittin2026-11-10 https://bugrater.com/releases/cve-2026-125367-pico-through-4-1-2-contains-a-server-side-request-forgery-vulnerability-in-the-feeds-service-that-allows-signed-up-users-to-make-the-server-fetch-arbitrary-urls2026-11-10 https://bugrater.com/releases/cve-2026-125368-omniagent-through-commit-12b98c5-contains-an-approval-bypass-vulnerability-in-reflexionagent-is-safe-bash-command-that-treats-any-command-starting-with-find-as2026-11-10 https://bugrater.com/releases/cve-2026-125369-bitpoll-through-0-11-0-contains-an-insecure-direct-object-reference-vulnerability-that-allows-unauthenticated-attackers-to-read-votes-and-comments-from-other-po2026-11-10 https://bugrater.com/releases/cve-2026-125370-kubero-3-0-0-through-3-1-1-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-remote-attackers-to-forge-administrative-jwts-by-using-a2026-11-10 https://bugrater.com/releases/cve-2026-125371-tinyproxy-through-1-11-3-contains-an-access-control-bypass-vulnerability-in-acl-string-processing-in-src-acl-c-that-compares-only-trailing-hostname-characters2026-11-10 https://bugrater.com/releases/cve-2026-125372-rebuild-before-4-5-3-contains-an-authorization-bypass-vulnerability-in-feedslistcontroller-fetchdetails-and-fetchcomments-that-skips-privilege-filtering-and-fee2026-11-10 https://bugrater.com/releases/cve-2026-125373-ietf-datatracker-before-12-83-0-contains-an-authorization-bypass-vulnerability-that-allows-nomcom-role-holders-to-access-other-committees-records-by-supplying2026-11-10 https://bugrater.com/releases/cve-2026-125374-krayin-crm-before-2-2-8-contains-a-broken-object-level-authorization-vulnerability-in-lead-tagcontroller-attach-and-detach-actions-that-skip-the-data-scope-chec2026-11-10 https://bugrater.com/releases/cve-2026-125375-mrdoc-through-1-1-1-contains-a-missing-authorization-vulnerability-in-the-project-doc-sort-and-manage-project-doc-sort-handlers-that-allows-registered-users-to2026-11-10 https://bugrater.com/releases/cve-2026-125376-vanblog-through-0-54-0-contains-an-information-disclosure-vulnerability-that-allows-unauthenticated-attackers-to-read-private-and-hidden-articles-via-the-post2026-11-10 https://bugrater.com/releases/cve-2026-125377-pig-before-4-1-2-contains-a-missing-authorization-vulnerability-in-sysclientcontroller-that-allows-authenticated-users-without-client-management-permission-to-r2026-11-10 https://bugrater.com/releases/cve-2026-125378-powerdns-admin-before-2026-11-0-contains-a-missing-authorization-vulnerability-in-the-apply-records-handler-for-admin-template-template-apply-that-lets-any-a2026-11-10 https://bugrater.com/releases/cve-2026-125379-movim-through-0-35-5-contains-an-authorization-bypass-vulnerability-in-post-ajaxgetpost-that-allows-authenticated-users-to-read-restricted-posts-by-supplying-s2026-11-10 https://bugrater.com/releases/cve-2026-125380-dataroom-through-3-0-0-contains-an-incorrect-authorization-vulnerability-in-datasetcontroller-runtest-that-allows-visitor-role-users-to-execute-dataset-definiti2026-11-10 https://bugrater.com/releases/cve-2026-125381-dataroom-through-3-0-0-contains-an-sql-injection-vulnerability-in-mybatisservice-generatesql-that-allows-sharer-role-users-to-inject-sql-by-supplying-crafted-da2026-11-10 https://bugrater.com/releases/cve-2026-125382-map-os-5-0-0-to-before-5-2-2-contains-a-privilege-escalation-vulnerability-in-the-rest-users-api-that-allows-non-administrator-operators-holding-the-cusuario-pe2026-11-10 https://bugrater.com/releases/cve-2026-125383-indotalent-whms-asp-net-core-inventory-order-management-system-before-10-20261109-contains-an-authentication-bypass-vulnerability-caused-by-a-hard-coded-jwt-s2026-11-10 https://bugrater.com/releases/cve-2026-125384-indotalent-whms-before-10-20261109-contains-a-default-credentials-vulnerability-that-allows-unauthenticated-attackers-to-gain-administrator-access-because-usera2026-11-10 https://bugrater.com/releases/cve-2026-125385-indotalent-whms-before-10-20261109-contains-a-path-traversal-vulnerability-that-allows-authenticated-users-to-read-arbitrary-files-via-the-documentname-and-imag2026-11-10 https://bugrater.com/releases/cve-2026-125386-langchain4j-aideepin-through-3-32-0-contains-an-insecure-direct-object-reference-vulnerability-in-charactermessagecontroller-that-allows-authenticated-users-to2026-11-10 https://bugrater.com/releases/cve-2026-125387-faveo-helpdesk-through-2-0-3-contains-an-authorization-bypass-vulnerability-in-ticketcontroller-that-allows-authenticated-agents-to-modify-tickets-outside-their2026-11-10 https://bugrater.com/releases/cve-2026-125388-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-a-missing-authorization-vulnerability-that-allows-authenticated-users-to-download-form-rep2026-11-10 https://bugrater.com/releases/cve-2026-125389-intermesh-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-a-stored-cross-site-scripting-vulnerability-in-the-email-viewer-due-to-a-flawed-regex-in-s2026-11-10 https://bugrater.com/releases/cve-2026-125390-group-office-before-6-8-181-25-0-116-and-26-0-58-contains-an-arbitrary-local-file-read-vulnerability-in-foldercontroller-actionprocessuploadqueue-that-allows2026-11-10 https://bugrater.com/releases/cve-2026-125391-webmin-through-2-670-contains-an-os-command-injection-vulnerability-in-samba-save-euser-cgi-that-allows-authenticated-samba-user-maintainers-to-inject-commands2026-11-10 https://bugrater.com/releases/cve-2026-125392-webmin-through-2-670-contains-a-stored-cross-site-scripting-vulnerability-in-bind8-edit-recs-cgi-that-outputs-raw-dns-record-values-without-html-escaping-in-all2026-11-10 https://bugrater.com/releases/cve-2026-125393-mailenable-enterprise-premium-before-10-62-contains-a-heap-overflow-vulnerability-in-the-imap-x-fb-fetch-command-that-allows-authenticated-users-to-overflow-a-f2026-11-10 https://bugrater.com/releases/cve-2026-125394-freerdp-before-3-33-0-contains-a-heap-use-after-free-vulnerability-in-update-gdi-patblt-update-gdi-polygon-cb-and-update-gdi-mem3blt-that-retain-stale-br2026-11-10 https://bugrater.com/releases/cve-2026-125395-ampache-before-8-4-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-users-with-upload-rights-to-inject-script-through-unescaped-song-lyrics-in2026-11-10 https://bugrater.com/releases/cve-2026-125396-ghostscript-before-10-08-0-contains-a-dsafer-bypass-vulnerability-in-the-putgstringcopy-procedure-in-gs-fonts-ps-which-calls-the-privileged-forceput-operato2026-11-10 https://bugrater.com/releases/cve-2026-125397-nocobase-plugin-ai-2-1-0-through-2-2-41-contains-an-authorization-bypass-vulnerability-in-getaccessibleaiemployee-that-lets-authenticated-users-access-unassig2026-11-10 https://bugrater.com/releases/cve-2026-125398-instatic-before-0-0-21-contains-an-authorization-bypass-vulnerability-in-handlerowauthor-that-allows-authenticated-users-to-skip-table-level-access-checks-by-lo2026-11-10 https://bugrater.com/releases/cve-2026-125399-fluxion-before-6-39-contains-an-os-command-injection-vulnerability-in-the-fluxion-sh-target-scanner-which-decodes-access-point-essids-with-eval-after-escaping2026-11-10 https://bugrater.com/releases/cve-2026-125400-ettercap-through-0-8-4-1-contains-a-use-after-free-vulnerability-in-func-pcre-in-src-ec-filter-c-that-reads-the-pcre2-ovector-after-freeing-match-data-networ2026-11-10 https://bugrater.com/releases/cve-2026-125401-ettercap-through-0-8-4-1-contains-a-heap-buffer-overflow-vulnerability-in-gg-get-version-in-src-dissectors-ec-gg-c-that-writes-up-to-44-bytes-into-a-30-byte-a2026-11-10 https://bugrater.com/releases/cve-2026-125402-ettercap-through-0-8-4-1-contains-a-heap-out-of-bounds-read-vulnerability-in-sslw-get-clienthello-sni-in-src-ec-sslwrap-c-that-trusts-the-unchecked-16-bit-sni2026-11-10 https://bugrater.com/releases/cve-2026-125403-ettercap-through-0-8-4-1-contains-an-out-of-bounds-read-and-size-t-underflow-vulnerability-in-sslw-remove-sts-in-src-ec-sslwrap-c-caused-by-a-stale-length-an2026-11-10 https://bugrater.com/releases/cve-2026-125404-ettercap-through-0-8-4-1-contains-an-integer-underflow-in-ccmp-decrypt-in-src-ec-encryption-ccmp-c-that-subtracts-the-8-byte-ccmp-trailer-without-checking-min2026-11-10 https://bugrater.com/releases/cve-2026-125405-ettercap-through-0-8-4-1-contains-an-out-of-bounds-read-vulnerability-in-parse-ntlm-auth-in-src-dissectors-ec-http-c-due-to-unvalidated-ntlm-message-offsets2026-11-10 https://bugrater.com/releases/cve-2026-125406-ettercap-through-0-8-4-1-contains-a-stack-buffer-underwrite-vulnerability-in-the-telnet-dissector-in-src-dissectors-ec-telnet-c-that-decrements-the-output-point2026-11-10 https://bugrater.com/releases/cve-2026-107240-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used-for-url-based-zero-touch-provisioning-ztp-of-the-vos-appliance-and-is-not-required-after-pro2026-11-10 https://bugrater.com/releases/cve-2026-107241-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used-for-url-based-zero-touch-provisioning-ztp-of-the-vos-appliance-and-is-not-required-after-pro2026-11-10 https://bugrater.com/releases/cve-2026-107242-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used-for-url-based-zero-touch-provisioning-ztp-of-the-vos-appliance-and-is-not-required-after-pro2026-11-10 https://bugrater.com/releases/cve-2026-107243-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used-for-url-based-zero-touch-provisioning-ztp-of-the-vos-appliance-and-is-not-required-after-pro2026-11-10 https://bugrater.com/releases/cve-2026-107244-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used-for-url-based-zero-touch-provisioning-ztp-of-the-vos-appliance-and-is-not-required-after-pro2026-11-10 https://bugrater.com/releases/cve-2026-107246-the-plesk-extension-site-import-before-1-13-2-does-not-properly-validate-domain-and-session-identifiers-allowing-path-traversal-this-lets-a-non-owner-subscr2026-11-10 https://bugrater.com/releases/cve-2026-124598-an-api-key-is-hardcoded-and-retrievable-from-the-gv-face-package-since-android-applications-can-be-reverse-engineered-embedding-sensitive-api-credentials-dire2026-11-10 https://bugrater.com/releases/cve-2026-124599-the-rsa-cryptographic-key-material-including-a-private-key-and-public-key-is-embedded-within-the-application-package-because-android-applications-can-be-extr2026-11-10 https://bugrater.com/releases/cve-2026-124600-gv-face-transmits-sensitive-user-credentials-and-related-authentication-data-over-unencrypted-http-connections-the-http-traffic-is-not-encrypted-an-attacker-w2026-11-10 https://bugrater.com/releases/cve-2026-124601-an-api-key-is-hardcoded-and-retrievable-from-the-gv-access-package-since-android-applications-can-be-reverse-engineered-embedding-sensitive-api-credentials-di2026-11-10 https://bugrater.com/releases/cve-2026-124602-the-rsa-cryptographic-key-material-including-a-private-key-and-public-key-is-embedded-within-the-gv-access-application-package-because-android-applications-c2026-11-10 https://bugrater.com/releases/cve-2026-124603-an-api-key-is-hardcoded-and-retrievable-from-the-gv-cloud-application-package-since-android-applications-can-be-reverse-engineered-embedding-sensitive-api-cre2026-11-10 https://bugrater.com/releases/cve-2026-124604-the-rsa-cryptographic-key-material-including-a-private-key-and-public-key-is-embedded-within-the-gv-cloud-application-package-because-android-applications-ca2026-11-10 https://bugrater.com/releases/cve-2026-125079-a-vulnerability-was-determined-in-d-link-dcs-6501lh-3-03-02-this-impacts-the-function-pf-get-onvif-user-pwd-mydlink-default-sys-info-of-the-file-mnt-conf-syst2026-11-10 https://bugrater.com/releases/cve-2026-125082-a-security-flaw-has-been-discovered-in-sunkaifei-flycms-up-to-e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a-affected-by-this-vulnerability-is-the-function-modeldata2026-11-10 https://bugrater.com/releases/cve-2026-125086-a-vulnerability-has-been-found-in-d-link-m60-1-12-b01-impacted-is-the-function-system-of-the-file-etc-emdaemon-mosquitto-conf-of-the-component-emdaemon-mqtt-b2026-11-10 https://bugrater.com/releases/cve-2026-125087-a-vulnerability-was-found-in-michael-a-kuykendall-shimmy-up-to-2-6-4-the-affected-element-is-an-unknown-function-of-the-file-src-server-rs-of-the-component-inf2026-11-10 https://bugrater.com/releases/cve-2026-115640-limesurvey-community-edition-7-7-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-central-participants-database-blocklist-control-an-authenticated2026-11-10 https://bugrater.com/releases/cve-2026-96769-the-extend-b2b-companies-and-users-management-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-sensitive-information-exposure-in-all-versions-up-to-and2026-11-10 https://bugrater.com/releases/cve-2026-104676-the-zion-builder-wordpress-plugin-through-3-6-17-does-not-sanitize-uploaded-svg-files-or-validate-their-contents-before-storing-them-in-a-publicly-accessible-l2026-11-10 https://bugrater.com/releases/cve-2026-110516-the-all-in-one-addons-for-wpbakery-page-builder-formerly-visual-composer-wordpress-plugin-through-1-2-does-not-validate-a-shortcode-attribute-before-using-it2026-11-10 https://bugrater.com/releases/cve-2026-119273-the-bulletproof-security-wordpress-plugin-through-7-2-does-not-sufficiently-protect-its-security-log-files-or-prevent-sensitive-authentication-material-from-bei2026-11-10 https://bugrater.com/releases/cve-2026-12389-a-vulnerability-that-could-lead-to-a-high-privileged-authenticated-user-performing-a-remote-code-execution-attack2026-11-10 https://bugrater.com/releases/cve-2026-12963-a-vulnerability-that-could-allow-a-viewer-account-to-gain-unauthorized-access-to-network-attached-storage-devices-on-the-server2026-11-10 https://bugrater.com/releases/cve-2026-12964-a-vulnerability-allowing-for-privileged-escalation-of-the-viewer-account-to-gain-administrator-privileges2026-11-10 https://bugrater.com/releases/cve-2026-13312-a-vulnerability-that-could-allow-an-attacker-to-compromise-a-system2026-11-10 https://bugrater.com/releases/cve-2026-13387-a-vulnerability-related-to-url-redirection-handling-during-the-sign-out-flow-that-could-allow-a-user-to-be-redirected-to-unintended-external-content-under-speci2026-11-10 https://bugrater.com/releases/cve-2026-13409-the-vapix-api-dynamicoverlay-cgi-which-results-in-a-denial-of-service-of-the-overlay-functionality-this-flaw-can-only-be-exploited-after-authenticating-with-an2026-11-10 https://bugrater.com/releases/cve-2026-14542-the-vapix-sip-configuration-api-lacked-sufficient-input-validation-which-could-potentially-lead-to-privilege-escalation-this-flaw-can-only-be-exploited-after2026-11-10 https://bugrater.com/releases/cve-2026-14543-the-vapix-edge-storage-api-enabling-the-escalation-of-user-privileges-by-circumventing-filesystem-isolation-granting-unauthorized-access-to-protected-system-r2026-11-10 https://bugrater.com/releases/cve-2026-14918-the-signed-video-framework-contained-a-out-of-bounds-read-issue-in-the-signed-video-framework-which-could-lead-the-application-using-this-framework-to-crash-th2026-11-10 https://bugrater.com/releases/cve-2026-4762-a-vulnerability-to-perform-a-privilege-escalation-attack-on-the-server-as-a-non-admin-user2026-11-10 https://bugrater.com/releases/cve-2026-63282-improper-shell-quote-escaping-when-processing-user-controlled-input-potentially-allowing-command-injection-which-could-lead-to-privilege-escalation2026-11-10 https://bugrater.com/releases/cve-2026-63287-it-was-possible-for-an-authenticated-non-admin-user-to-modify-certain-data-objects-without-having-the-appropriate-permissions-which-could-be-used-to-tamper-wit2026-11-10 https://bugrater.com/releases/cve-2026-63288-a-websocket-request-sent-to-a-specific-api-endpoint-allows-unauthorized-access-to-a-separate-api-endpoint-this-bypasses-the-intended-authentication-layer2026-11-10 https://bugrater.com/releases/cve-2026-8372-a-vulnerability-that-could-allow-an-attacker-to-gain-unauthorized-access2026-11-10 https://bugrater.com/releases/cve-2026-9063-a-locally-authenticated-user-can-achieve-privilege-escalation-via-an-insecure-configuration-that-leads-to-unauthorized-code-execution-this-flaw-can-only-be-exp2026-11-10 https://bugrater.com/releases/cve-2026-100386-the-ultra-addons-for-contact-form-7-plugin-for-wordpress-is-vulnerable-to-directory-traversal-in-all-versions-up-to-and-including-3-5-54-via-the-uacf7-wpcf7-m2026-11-10 https://bugrater.com/releases/cve-2026-120513-the-everest-forms-contact-form-payment-form-quiz-survey-custom-form-builder-with-ai-plugin-for-wordpress-is-vulnerable-to-file-deletion-due-to-insufficie2026-11-10 https://bugrater.com/releases/cve-2026-76877-the-wpml-multilingual-cms-plugin-for-wordpress-is-vulnerable-to-authentication-bypass-via-race-condition-in-versions-up-to-and-including-4-9-7-this-is-due-to2026-11-10 https://bugrater.com/releases/cve-2026-84938-the-avada-fusion-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-form-notification-dynamic-data-action-hook-media-upload-chain2026-11-10 https://bugrater.com/releases/cve-2026-93427-the-armember-premium-membership-plugin-content-restriction-member-levels-user-profile-user-signup-plugin-for-wordpress-is-vulnerable-to-stored-cross-site2026-11-10 https://bugrater.com/releases/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak-which-provides-the-core-authentication-and-authorization-logic-for-the-identity-provider-the-i2026-11-10 https://bugrater.com/releases/cve-2026-106007-the-fraudlabs-pro-sms-verification-wordpress-plugin-through-1-12-1-does-not-enforce-its-sms-retry-limit-on-the-server-side-allowing-unauthenticated-users-to-se2026-11-10 https://bugrater.com/releases/cve-2026-60035-a-high-privileged-remote-attacker-can-perform-a-code-injection-in-the-backends-network-auth-function-leading-to-code-execution-this-can-result-in-a-total-loss2026-11-10 https://bugrater.com/releases/cve-2026-60036-a-high-privileged-remote-attacker-can-perform-a-code-injection-in-the-backends-patch-activate-function-leading-to-code-execution-this-can-result-in-a-total-los2026-11-10 https://bugrater.com/releases/cve-2026-60037-a-high-privileged-remote-attacker-can-perform-an-openssl-code-injection-in-the-frontends-device-importer-function-leading-to-code-execution-this-can-result-in2026-11-10 https://bugrater.com/releases/cve-2026-60038-a-high-privileged-remote-attacker-can-perform-an-openssl-code-injection-in-the-backends-importpkcs12-function-leading-to-code-execution-this-can-result-in-a-to2026-11-10 https://bugrater.com/releases/cve-2026-60039-a-high-privileged-remote-attacker-can-perform-a-code-injection-in-the-backends-backup-restore-function-leading-to-code-execution-this-can-result-in-a-total-los2026-11-10 https://bugrater.com/releases/cve-2026-60040-an-unauthenticated-remote-attacker-can-perform-a-dos-in-the-backends-backup-creation-function-this-can-result-in-a-total-loss-of-availability2026-11-10 https://bugrater.com/releases/cve-2026-60041-an-unauthenticated-remote-attacker-can-perform-a-csrf-attack-on-a-logged-in-backend-user-allowing-for-execution-of-multiple-critical-system-actions-this-could2026-11-10 https://bugrater.com/releases/cve-2026-60042-an-unauthenticated-remote-attacker-can-perform-an-authentication-bypass-on-the-com-check-function-potentially-triggering-traffic-on-other-systems-and-email-ale2026-11-10 https://bugrater.com/releases/cve-2026-60043-an-unauthenticated-remote-attacker-can-perform-a-xss-attack-on-a-logged-in-backend-user-allowing-for-execution-of-multiple-critical-system-actions-this-could-a2026-11-10 https://bugrater.com/releases/cve-2026-60044-the-backups-created-by-the-application-use-a-weak-static-password-allowing-an-unauthenticated-remote-attacker-to-access-their-content-this-can-result-in-a-tota2026-11-10 https://bugrater.com/releases/cve-2026-60045-a-high-privileged-remote-attacker-can-upload-arbitrary-files-to-a-guessable-location-this-can-result-in-a-loss-of-availability-and-might-be-chained-with-other2026-11-10 https://bugrater.com/releases/cve-2026-60046-an-unauthenticated-remote-attacker-can-perform-password-resets-for-any-user-with-known-username-and-email-without-rate-limiting-this-can-result-in-a-total-loss2026-11-10 https://bugrater.com/releases/cve-2026-104619-untrusted-users-could-roll-back-security-updates-when-using-the-packagekit-zypp-backend-before-1-4-1-allowing-privilege-escalation2026-11-10 https://bugrater.com/releases/cve-2026-124503-a-vulnerability-was-identified-in-sooperset-mcp-atlassian-up-to-0-24-0-this-issue-affects-the-function-validate-safe-path-of-the-file-src-mcp-atlassian-utils-i2026-11-10 https://bugrater.com/releases/cve-2026-119446-session-fixation-vulnerability-in-the-cli-login-flow-in-nerves-hub-nerves-hub-web-allows-an-unauthenticated-attacker-to-obtain-an-api-token-for-another-user-s-a2026-11-10 https://bugrater.com/releases/cve-2026-120286-missing-authorization-vulnerability-in-the-device-and-deployment-group-pages-in-nerves-hub-nerves-hub-web-allows-an-authenticated-organization-member-with-the-v2026-11-10 https://bugrater.com/releases/cve-2026-120295-incorrect-authorization-vulnerability-in-the-devices-page-bulk-move-in-nerves-hub-nerves-hub-web-allows-an-authenticated-user-with-the-manage-role-in-one-organi2026-11-10 https://bugrater.com/releases/cve-2026-120730-improperly-controlled-modification-of-dynamically-determined-object-attributes-vulnerability-in-the-device-api-device-forms-signing-key-and-product-forms-and2026-11-10 https://bugrater.com/releases/cve-2026-120997-improper-session-invalidation-vulnerability-in-the-dashboard-pages-device-console-and-local-shell-channels-in-nerves-hub-nerves-hub-web-allows-an-organization2026-11-10 https://bugrater.com/releases/cve-2026-125672-a-flaw-was-found-in-cockpit-storaged-a-tang-keyserver-address-read-from-a-clevis-token-in-a-luks-header-is-concatenated-into-curl-s-argument-vector-without-a2026-11-10 https://bugrater.com/releases/cve-2026-101275-our-payment-integration-with-adyen-did-not-properly-validate-payment-status-responses-an-attacker-could-use-a-successful-payment-status-response-from-one-payme2026-11-10 https://bugrater.com/releases/cve-2026-121191-missing-authorization-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-institute-eta-remote-allows-accessing-functionality-not-properly-constraine2026-11-10 https://bugrater.com/releases/cve-2026-123717-os-command-injection-in-the-pass-and-bitwarden-credential-providers-in-eclipse-foundation-eclipse-otterdog-through-1-7-1-allows-a-user-able-to-modify-an-organiz2026-11-10 https://bugrater.com/releases/cve-2026-125715-samsung-mtower-lacks-access-control-for-ta-sessions-allowing-a-normal-world-application-to-open-ta-sessions-and-invoke-their-commands-or-use-a-close-existing2026-11-10 https://bugrater.com/releases/cve-2026-125742-7-zip-before-26-06-contains-a-heap-out-of-bounds-write-vulnerability-in-the-lzx-decoder-that-lets-attackers-corrupt-memory-when-a-continuation-cab-volume-declar2026-11-10 https://bugrater.com/releases/cve-2026-121267-incorrect-default-permissions-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-institute-eta-remote-allows-accessing-functionality-not-properly-co2026-11-10 https://bugrater.com/releases/cve-2026-124747-a-flaw-was-found-in-busybox-when-resuming-a-download-over-file-transfer-protocol-ftp-the-wget-utility-fails-to-verify-that-the-resume-offset-does-not-exceed2026-11-10 https://bugrater.com/releases/cve-2026-125744-our-api-endpoint-for-changing-ticket-layouts-did-not-properly-check-permissions-of-the-requesting-user-or-api-token-an-attacker-with-read-only-access-to-an-eve2026-11-10 https://bugrater.com/releases/cve-2026-125745-custom-post-types-and-custom-fields-creator-wck-before-2-4-1-contains-a-missing-authorization-vulnerability-that-allows-authenticated-attackers-with-access-to2026-11-10 https://bugrater.com/releases/cve-2026-16478-permissive-list-of-allowed-inputs-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-institute-pardus-nvidia-installer-allows-privilege-escalation2026-11-10 https://bugrater.com/releases/cve-2026-120399-a-flaw-was-found-in-flightctl-a-tls-handshake-is-performed-synchronously-in-the-http-server-s-connection-context-callback-without-a-deadline-a-network-reachab2026-11-10 https://bugrater.com/releases/cve-2026-82509-v-programming-language-standard-library-net-http-through-version-0-5-2-prior-to-commit-4077484-contains-a-tls-certificate-validation-bypass-vulnerability-that-a2026-11-10 https://bugrater.com/releases/cve-2026-111262-the-jakarta-security-ldap-identity-store-does-not-neutralize-special-characters-in-the-caller-name-before-using-it-in-directory-queries-a-remote-unauthenticate2026-11-10 https://bugrater.com/releases/cve-2026-111263-authentication-configured-for-an-ejb-jax-ws-endpoint-in-the-tomee-deployment-descriptor-is-not-enforced-when-the-endpoint-is-published-within-an-existing-web-ap2026-11-10 https://bugrater.com/releases/cve-2026-111264-the-security-constraint-generated-for-ejb-jax-ws-endpoints-with-configured-authentication-protects-only-some-http-methods-a-remote-unauthenticated-attacker-can2026-11-10 https://bugrater.com/releases/cve-2026-121885-a-flaw-was-found-in-podman-an-attacker-can-trigger-a-denial-of-service-dos-by-supplying-a-container-image-containing-crafted-metadata-labels-podman-s-auto-u2026-11-10 https://bugrater.com/releases/cve-2026-123082-docker-desktop-before-version-4-94-0-could-write-the-signed-in-user-s-docker-hub-access-token-a-jwt-in-cleartext-to-application-logs-and-diagnostics-bundles2026-11-10 https://bugrater.com/releases/cve-2026-86532-the-bundled-jaas-login-modules-leak-whether-a-username-exists-and-compare-credentials-in-a-non-constant-time-manner-a-remote-unauthenticated-attacker-can-enume2026-11-10 https://bugrater.com/releases/cve-2026-86811-the-stateful-session-bean-passivation-mechanism-derives-the-on-disk-file-name-from-a-client-supplied-identifier-without-validating-it-a-remote-attacker-with-ac2026-11-10 https://bugrater.com/releases/cve-2026-87755-stateful-session-bean-identifiers-are-not-generated-from-a-cryptographically-secure-random-source-a-remote-attacker-with-access-to-the-ejb-remote-endpoint-who2026-11-10 https://bugrater.com/releases/cve-2026-87756-the-internal-system-ejbs-used-for-remote-deployment-and-configuration-did-not-enforce-their-administrative-role-check-when-the-server-ran-with-the-default-profi2026-11-10 https://bugrater.com/releases/cve-2026-111239-the-optional-ssh-administration-service-grants-full-access-to-the-administration-shell-to-every-user-that-authenticates-against-its-configured-login-domain-wit2026-11-10 https://bugrater.com/releases/cve-2026-111240-the-jdbc-based-jaas-login-module-accepts-a-login-without-a-password-for-accounts-whose-stored-password-is-null-a-remote-attacker-who-knows-the-user-name-of-suc2026-11-10 https://bugrater.com/releases/cve-2026-111241-when-a-non-default-stateful-session-bean-passivation-strategy-is-configured-passivated-bean-state-is-written-to-predictably-named-files-in-the-shared-system-te2026-11-10 https://bugrater.com/releases/cve-2026-111242-when-microprofile-jwt-authentication-is-used-for-servlets-that-declare-a-run-as-identity-the-security-state-established-for-a-request-is-not-always-cleared-fro2026-11-10 https://bugrater.com/releases/cve-2026-111243-a-negative-microprofile-jwt-clock-skew-setting-is-not-rejected-and-disables-validation-of-the-token-expiration-and-other-time-based-claims-in-such-configuratio2026-11-10 https://bugrater.com/releases/cve-2026-111244-when-microprofile-jwt-role-based-access-control-is-used-the-access-constraints-of-jax-rs-resources-are-not-always-enforced-as-declared-resources-that-declare2026-11-10 https://bugrater.com/releases/cve-2026-111245-after-a-successful-ws-security-usernametoken-authentication-the-caller-identity-stays-associated-with-the-worker-thread-once-the-request-completes-when-web-ser2026-11-10 https://bugrater.com/releases/cve-2026-111246-the-embedded-openejb-http-server-does-not-isolate-http-sessions-between-web-applications-a-remote-attacker-can-use-a-session-established-in-one-web-application2026-11-10 https://bugrater.com/releases/cve-2026-111247-when-resolving-security-roles-of-a-realm-authenticated-caller-the-caller-s-user-name-is-also-treated-as-a-role-name-in-addition-to-the-roles-assigned-by-the-re2026-11-10 https://bugrater.com/releases/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user-database-compares-the-supplied-password-with-the-stored-value-as-plain-text-and-ignores-the-config2026-11-10 https://bugrater.com/releases/cve-2026-111249-the-development-time-livereload-support-listens-on-all-network-interfaces-without-authentication-and-accepts-websocket-connections-from-any-origin-a-network-at2026-11-10 https://bugrater.com/releases/cve-2026-111250-the-embedded-openejb-http-server-reports-every-request-as-authenticated-when-an-application-requests-authentication-programmatically-a-remote-unauthenticated-a2026-11-10 https://bugrater.com/releases/cve-2026-111251-the-admin-service-of-the-standalone-openejb-server-accepts-stop-requests-without-any-authentication-any-local-user-or-process-able-to-connect-to-the-admin-port2026-11-10 https://bugrater.com/releases/cve-2026-111256-when-jax-ws-or-jax-rs-endpoints-are-published-by-the-embedded-openejb-http-server-rather-than-tomcat-some-configured-authentication-methods-are-silently-ignore2026-11-10 https://bugrater.com/releases/cve-2026-111257-with-the-default-configuration-and-no-users-defined-in-the-default-user-database-tomee-silently-adds-an-administrative-user-with-a-well-known-password-at-start2026-11-10 https://bugrater.com/releases/cve-2026-111258-the-optional-request-routing-feature-forwards-requests-to-their-configured-destination-without-applying-the-security-constraints-of-that-destination-or-the-prot2026-11-10 https://bugrater.com/releases/cve-2026-111259-the-embedded-server-generates-http-session-identifiers-with-a-non-cryptographic-random-number-generator-by-default-a-remote-attacker-who-observes-a-session-ide2026-11-10 https://bugrater.com/releases/cve-2026-111260-the-jakarta-security-openid-connect-authentication-mechanism-generates-the-state-and-nonce-values-with-a-non-cryptographic-random-number-generator-and-insuffici2026-11-10 https://bugrater.com/releases/cve-2026-111261-the-jakarta-security-ldap-identity-store-accepts-an-empty-password-as-valid-if-the-directory-server-allows-unauthenticated-binds-which-some-directory-servers-d2026-11-10 https://bugrater.com/releases/cve-2026-11315-a-out-of-bounds-read-vulnerability-exists-in-the-dr-mp3-drmp3-init-internal-functionality-of-dr-libs-version-s-0-7-3-a-specially-crafted-mp3-file-can-lead2026-11-10 https://bugrater.com/releases/cve-2026-11316-a-out-of-bounds-write-vulnerability-exists-in-the-dr-wav-drwav-read-cue-to-metadata-obj-functionality-of-dr-libs-version-s-0-14-5-a-specially-crafted-wav2026-11-10 https://bugrater.com/releases/cve-2026-124038-an-uncontrolled-xml-entity-expansion-vulnerability-in-the-flock-installer-app-for-android-before-version-2-35-0-allows-an-attacker-who-has-a-valid-technician-ac2026-11-10 https://bugrater.com/releases/cve-2026-125747-zentao-pms-through-22-7-contains-a-missing-object-level-authorization-vulnerability-in-module-build-control-php-that-allows-authenticated-users-to-modify-builds2026-11-10 https://bugrater.com/releases/cve-2026-125748-parabol-before-15-21-2-contains-a-missing-authorization-vulnerability-in-the-addreactjitoreactable-graphql-mutation-that-allows-authenticated-users-to-tamper-wi2026-11-10 https://bugrater.com/releases/cve-2026-125749-taxhacker-through-0-8-5-contains-an-insecure-direct-object-reference-vulnerability-in-app-app-settings-actions-ts-that-allows-authenticated-users-to-modify-ot2026-11-10 https://bugrater.com/releases/cve-2026-125750-firekylin-through-2-18-1-contains-an-improper-authorization-vulnerability-that-allows-editor-role-users-to-read-administrator-only-secrets-because-the-admin-api2026-11-10 https://bugrater.com/releases/cve-2026-125751-meteroid-before-2-2-0-contains-an-authorization-bypass-vulnerability-in-the-apitokensservice-getapitokenbyid-grpc-handler-that-fails-to-apply-the-caller-s-tenan2026-11-10 https://bugrater.com/releases/cve-2026-125752-meteroid-before-2-2-0-contains-a-cross-tenant-authorization-bypass-vulnerability-in-the-couponsservice-updatecouponstatus-grpc-handler-whose-update-query-filte2026-11-10 https://bugrater.com/releases/cve-2026-125753-abp-framework-2-9-0-before-10-6-2-and-10-7-0-pre-releases-before-10-7-0-contain-a-path-traversal-vulnerability-in-defaultblobfilepathcalculator-that-allows-unau2026-11-10 https://bugrater.com/releases/cve-2026-125754-dolibarr-20-0-0-through-23-0-4-and-24-x-before-24-0-2-contains-an-insecure-direct-object-reference-vulnerability-in-api-expensereports-class-php-payment-endpoin2026-11-10 https://bugrater.com/releases/cve-2026-125755-nodemailer-3-0-0-before-10-4-1-contains-an-address-parsing-flaw-in-addressparser-that-truncates-domains-at-folding-whitespace-or-comments-before-a-dot-allowing2026-11-10 https://bugrater.com/releases/cve-2026-125756-postal-mime-before-4-2-1-contains-a-parser-differential-vulnerability-in-its-address-parser-that-truncates-the-domain-at-folding-whitespace-or-comments-precedin2026-11-10 https://bugrater.com/releases/cve-2026-125757-mailcow-dockerized-before-2026-11-contains-a-server-side-template-injection-vulnerability-that-allows-domain-administrators-to-execute-commands-in-the-shared-r2026-11-10 https://bugrater.com/releases/cve-2026-125758-aptabase-before-commit-61d4c01-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-forge-sign-in-links-by-using-the-publicl2026-11-10 https://bugrater.com/releases/cve-2026-125759-nango-before-0-71-3-contains-an-sql-injection-vulnerability-that-allows-unauthenticated-attackers-to-execute-arbitrary-sql-by-supplying-a-crafted-task-group-key2026-11-10 https://bugrater.com/releases/cve-2026-86336-apache-tomee-running-on-jdk-21-or-later-skips-ejb-method-authorization-checks-allowing-callers-to-invoke-ejb-methods-without-the-configured-access-restrictions2026-11-10 https://bugrater.com/releases/cve-2026-86531-the-embedded-openejb-http-server-does-not-limit-the-size-of-incoming-request-bodies-or-of-multipart-requests-and-does-not-remove-the-temporary-files-it-creates2026-11-10 https://bugrater.com/releases/cve-2026-87758-the-remote-ejb-client-does-not-verify-that-the-hostname-of-the-server-it-connects-to-matches-the-server-s-tls-certificate-an-attacker-able-to-intercept-network2026-11-10 https://bugrater.com/releases/cve-2026-97402-in-eclipse-kura-versions-3-1-0-to-5-6-2-the-ibeacon-and-eddystone-advertisement-decoders-wrongly-parse-the-ad-structure-length-field-of-an-over-the-air-ble-adv2026-11-10 https://bugrater.com/releases/cve-2026-97849-the-embedded-derby-network-service-ignores-its-configured-bind-address-and-listens-on-all-network-interfaces-when-the-service-is-enabled-a-remote-attacker-wit2026-11-10 https://bugrater.com/releases/cve-2026-97867-the-ejbd-remote-protocol-returns-datasource-connection-details-including-database-credentials-to-remote-clients-that-look-up-a-datasource-a-remote-client-abl2026-11-10 https://bugrater.com/releases/cve-2026-97870-when-hessian-remoting-endpoints-are-served-by-the-embedded-http-server-configured-authentication-and-transport-security-requirements-are-silently-ignored-a-re2026-11-10 https://bugrater.com/releases/cve-2026-97872-when-an-ejb-is-exposed-over-the-optional-hessian-protocol-inside-an-existing-web-application-some-configured-authentication-and-transport-security-settings-are2026-11-10 https://bugrater.com/releases/cve-2026-97874-when-hessian-remoting-is-configured-with-basic-authentication-the-authentication-check-is-not-applied-to-hessian-endpoints-of-applications-deployed-under-a-non2026-11-10 https://bugrater.com/releases/cve-2026-97880-the-embedded-openejb-http-server-dispatches-some-requests-to-rest-endpoints-configured-for-http-basic-authentication-without-verifying-credentials-a-remote-una2026-11-10 https://bugrater.com/releases/cve-2026-97881-the-embedded-openejb-http-server-does-not-restrict-static-resource-paths-to-the-configured-resource-directories-a-remote-unauthenticated-attacker-can-read-arbi2026-11-10 https://bugrater.com/releases/cve-2026-97888-the-embedded-http-server-does-not-clear-the-security-identity-established-during-a-request-before-its-worker-thread-handles-the-next-request-a-remote-unauthent2026-11-10 https://bugrater.com/releases/cve-2026-97890-the-embedded-http-server-does-not-invalidate-the-previous-session-identifier-when-an-application-changes-the-session-id-e-g-after-login-an-attacker-who-can-p2026-11-10 https://bugrater.com/releases/cve-2026-111729-in-kura-versions-5-6-2-the-command-file-upload-handler-at-post-admin-denali-file-command-extracts-a-client-supplied-zip-archive-into-the-configured-co2026-11-10 https://bugrater.com/releases/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to-decompress-an-archive-a-python-script-shadowing-the-stdlib-can-be-created-then-if-an-error-o2026-11-10 https://bugrater.com/releases/cve-2026-123178-an-insufficient-input-validation-vulnerability-in-the-listed-netgear-orbi-models-router-allows-an-authenticated-administrator-connected-to-the-local-network-to2026-11-10 https://bugrater.com/releases/cve-2026-123180-a-missing-authentication-vulnerability-in-the-listed-netgear-rax-models-allows-an-network-adjacent-attacker-who-has-authenticated-to-wifi-network-to-obtain-sens2026-11-10 https://bugrater.com/releases/cve-2026-124251-cross-site-request-forgery-csrf-vulnerability-in-xplodedthemes-wpide-file-manager-code-editor-wpide-allows-cross-site-request-forgery-this-issue-affects-w2026-11-10 https://bugrater.com/releases/cve-2026-126042-vnote-3-11-0-before-4-12-0-contains-an-os-command-injection-vulnerability-in-its-tasks-feature-magic-variables-such-as-buffername-and-selectedtext-are-su2026-11-10 https://bugrater.com/releases/cve-2026-126048-gwenhywfar-4-99-8beta-before-5-14-2-contains-a-stack-based-buffer-overflow-in-gwen-tlv-buffer-to-db-in-src-parser-tlv-c-when-decoding-ber-tlv-tags-into-a-fixe2026-11-10 https://bugrater.com/releases/cve-2026-126049-gwenhywfar-5-14-2-contains-a-heap-use-after-free-vulnerability-in-gwen-tlv-buffer-to-db-in-src-parser-tlv-c-which-frees-a-nested-record-s-gwen-db-node-when-p2026-11-10 https://bugrater.com/releases/cve-2026-126050-apitrace-2-0-through-14-0-contains-a-heap-based-buffer-overflow-in-snappyfile-flushreadcache-that-allows-attackers-to-write-past-m-compressedcache-via-an-ove2026-11-10 https://bugrater.com/releases/cve-2026-57907-a-privilege-escalation-vulnerability-in-watchguard-endpoint-protection-s-inter-process-communication-between-the-console-and-the-protection-service-allows-a-loc2026-11-10 https://bugrater.com/releases/cve-2026-66332-ami-aptiov-contains-a-vulnerability-in-bios-where-a-privileged-user-may-cause-the-out-of-bound-read-by-local-access-successful-exploitation-of-this-vulnerabi2026-11-10 https://bugrater.com/releases/cve-2026-66333-ami-aptiov-contains-vulnerabilities-in-bios-where-privileged-users-may-cause-the-out-of-bounds-read-by-local-access-successful-exploitation-of-this-vulnerabi2026-11-10 https://bugrater.com/releases/cve-2026-66334-ami-aptiov-contains-vulnerabilities-in-bios-where-privileged-users-may-cause-the-out-of-bounds-write-by-local-access-successful-exploitation-of-this-vulnerab2026-11-10 https://bugrater.com/releases/cve-2026-82518-akamai-cli-before-2-0-6-contains-a-path-traversal-vulnerability-that-allows-malicious-packages-to-write-files-outside-the-install-directory-via-unvalidated-comm2026-11-10 https://bugrater.com/releases/cve-2026-97401-in-kura-versions-5-6-2-commandcloudapp-execute-extracts-a-caller-supplied-zip-archive-into-a-caller-supplied-directory-inside-the-kura-jvm-process-befor2026-11-10 https://bugrater.com/releases/cve-2026-121691-improper-handling-of-highly-compressed-data-cwe-409-in-the-zip-loader-of-whatstk-from-0-7-0-before-0-9-0-allows-a-party-that-supplies-a-chat-export-to-exhaust2026-11-10 https://bugrater.com/releases/cve-2026-107496-issue-summary-encrypting-a-cms-message-to-an-ec-certificate-whose-group-order-is-1-may-cause-cms-encrypt-or-cms-encrypt-ex-to-loop-indefinitely-impact-su2026-11-10 https://bugrater.com/releases/cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf-imaplib-s-own-read-ahead-buffer-untouched-any-plaintext-bytes-that-arrived-in-the-same-recv2026-11-10 https://bugrater.com/releases/cve-2026-14968-edk2-contains-vulnerabilities-in-bios-where-skilled-and-privileged-users-or-attackers-may-cause-out-of-bounds-write-by-local-access-successful-exploitation-o2026-11-10 https://bugrater.com/releases/cve-2026-18448-edk2-contains-a-vulnerability-in-bios-where-a-privileged-attacker-may-cause-exposure-of-sensitive-information-during-transient-execution-by-local-access-succ2026-11-10 https://bugrater.com/releases/cve-2026-88822-issue-summary-quic-when-performing-automated-peer-detection-may-allow-uninitialized-stack-data-to-leak-into-the-received-address-which-is-then-used-as-the-de2026-11-10 https://bugrater.com/releases/cve-2026-88823-issue-summary-the-aes-gcm-siv-implementation-treats-a-zero-length-additional-authenticated-data-aad-update-as-a-reset-of-all-the-aad-supplied-so-far-instead2026-11-10 https://bugrater.com/releases/cve-2026-95691-issue-summary-a-retransmitted-quic-crypto-frame-can-release-packet-storage-while-the-tls-record-layer-retains-a-direct-pointer-into-that-storage-causing-use-af2026-11-10 https://bugrater.com/releases/cve-2026-95692-issue-summary-setting-an-aes-gcm-siv-iv-shorter-than-the-expected-nonce-length-via-evp-cipherinit-ex-may-trigger-a-heap-out-of-bounds-read-supplying-a-longe2026-11-10 https://bugrater.com/releases/cve-2026-104060-worklenz-before-3-3-0-contains-an-sql-injection-vulnerability-in-the-reporting-members-endpoints-that-allows-authenticated-attackers-to-read-arbitrary-database2026-11-10 https://bugrater.com/releases/cve-2026-115483-the-everest-forms-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-read-in-all-versions-up-to-and-including-3-6-3-via-the-attach-entry-files-function-t2026-11-10 https://bugrater.com/releases/cve-2026-115539-swarmkit-s-cluster-api-proxy-can-overwrite-a-forwarded-client-s-tls-identity-with-an-intermediary-manager-s-identity-withmetadataforwardtlsinfo-replaces-outgoi2026-11-10 https://bugrater.com/releases/cve-2026-121288-an-unauthenticated-attacker-on-an-adjacent-network-segment-can-bypass-md5-authentication-and-have-unauthorized-rip-route-updates-accepted-by-the-device-success2026-11-10 https://bugrater.com/releases/cve-2026-121289-on-affected-platforms-running-arista-eos-with-bgp-configured-a-specially-crafted-packet-can-cause-the-bgp-agent-to-crash-successful-exploitation-causes-the-b2026-11-10 https://bugrater.com/releases/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional-forwarding-detection-bfd-configured-to-use-keyed-md5-or-keyed-sha1-authentication-an-unauthentica2026-11-10 https://bugrater.com/releases/cve-2026-124016-postal-mime-before-4-2-1-contains-an-algorithmic-complexity-denial-of-service-vulnerability-that-allows-unauthenticated-remote-attackers-to-cause-excessive-cpu2026-11-10 https://bugrater.com/releases/cve-2026-26248-a-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-fortinet-fortisandbox-5-0-0-through-5-0-5-fortisandbox2026-11-10 https://bugrater.com/releases/macos-golden-gate-27-2-12026-11-11 https://bugrater.com/releases/macos-tahoe-26-7-32026-11-11 https://bugrater.com/releases/macos-sequoia-15-8-32026-11-11 https://bugrater.com/releases/gitlab-critical-patch-release-19-5-4-19-4-6-19-3-82026-11-11 https://bugrater.com/releases/zsb-26024-zoom-workplace-for-windows-origin-validation-error2026-11-11 https://bugrater.com/releases/zsb-26023-zoom-workplace-for-windows-improper-input-validation2026-11-11 https://bugrater.com/releases/security-vulnerabilities-fixed-in-thunderbird-153-72026-11-11 https://bugrater.com/releases/security-vulnerabilities-fixed-in-thunderbird-1602026-11-11 https://bugrater.com/releases/security-vulnerabilities-fixed-in-firefox-esr-153-72026-11-11 https://bugrater.com/releases/cve-2026-95780-a-vulnerability-exists-in-the-authentication-and-session-management-mechanisms-that-may-result-in-access-not-being-fully-terminated-following-certain-account-or2026-11-11 https://bugrater.com/releases/cve-2026-95781-a-security-vulnerability-exists-in-athonetos-that-may-allow-an-unauthorized-party-to-affect-service-operation-or-gain-access-to-certain-protected-system-functio2026-11-11 https://bugrater.com/releases/cve-2026-95782-a-vulnerability-exists-in-a-monitoring-component-that-may-under-certain-conditions-allow-security-controls-to-be-circumvented-successful-exploitation-could-r2026-11-11 https://bugrater.com/releases/cve-2026-95783-a-vulnerability-exists-in-a-network-facing-component-that-may-under-certain-conditions-result-in-service-disruption-successful-exploitation-could-cause-tempo2026-11-11 https://bugrater.com/releases/cve-2026-95784-a-vulnerability-exists-in-a-system-component-that-may-under-certain-conditions-disrupt-the-availability-of-affected-services-successful-exploitation-could-re2026-11-11 https://bugrater.com/releases/cve-2026-95785-a-vulnerability-exists-in-a-system-component-that-may-under-certain-conditions-allow-an-authorized-user-to-make-unauthorized-changes-to-system-managed-content2026-11-11 https://bugrater.com/releases/cve-2026-95786-a-vulnerability-exists-in-a-system-interface-that-may-under-certain-conditions-fail-to-properly-enforce-authorization-boundaries-successful-exploitation-coul2026-11-11 https://bugrater.com/releases/cve-2026-105986-incorrect-authorization-in-the-admin-api-rbac-of-kong-gateway-enterprise-allows-a-delegated-administrator-to-elevate-privileges-via-a-percent-encoded-role-name2026-11-11 https://bugrater.com/releases/cve-2026-92544-sql-injection-in-the-llm-usage-counters-of-kong-gateway-enterprise-and-kong-ai-gateway-may-allow-a-client-to-execute-arbitrary-sql-against-the-kong-database-via2026-11-11 https://bugrater.com/releases/cve-2026-105150-the-product-filter-for-woocommerce-by-wbw-plugin-for-wordpress-is-vulnerable-to-reflected-cross-site-scripting-via-the-text-no-products-parameter-in-all-versi2026-11-11 https://bugrater.com/releases/cve-2026-107356-u-s-geological-survey-area-species-management-research-program-armi-accepts-any-uploaded-file-and-stores-the-file-under-uploads-upload-file-a-remote-a2026-11-11 https://bugrater.com/releases/cve-2026-125297-asiainfo-business-support-system-bss-9-2-0-through-9-2-40-accepts-unauthenticated-requests-via-the-management-api-bss-sysmgnt-api-a-remote-unauthenticat2026-11-11 https://bugrater.com/releases/cve-2026-125298-asiainfo-business-support-system-bss-9-2-0-through-9-2-40-does-not-correctly-verify-cryptographic-signatures-for-json-web-tokens-jwt-a-remote-unauthentica2026-11-11 https://bugrater.com/releases/cve-2026-125882-relative-path-traversal-vulnerability-in-n-able-n-central-allows-path-traversal-this-issue-affects-n-central-before-26-4-12026-11-11 https://bugrater.com/releases/cve-2026-125958-download-of-code-without-integrity-check-vulnerability-in-n-able-n-central-allows-remote-code-inclusion-this-issue-affects-n-central-through-24-6-12026-11-11 https://bugrater.com/releases/cve-2026-126123-bees-software-solutions-erp-before-04-september-2026-allows-any-low-privileged-user-to-navigate-directly-to-the-administrative-dashboard-endpoint-and-gain-acces2026-11-11 https://bugrater.com/releases/cve-2026-28247-improper-access-control-applied-to-mirrored-or-aliased-memory-regions-in-amd-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-t2026-11-11 https://bugrater.com/releases/cve-2026-28248-improper-enforcement-of-behavioral-workflow-in-amd-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-to-potentially-launch-a-gue2026-11-11 https://bugrater.com/releases/cve-2026-28249-improper-preservation-of-consistency-between-independent-representations-of-shared-state-in-amd-secure-encrypted-virtualization-sev-firmware-could-allow-a-mal2026-11-11 https://bugrater.com/releases/cve-2026-40668-authentication-bypass-by-spoofing-in-amd-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-to-request-attestation-reports-for-vm2026-11-11 https://bugrater.com/releases/cve-2026-40669-an-off-by-one-error-in-amd-secure-encrypted-virtualization-sev-firmware-could-allow-an-attacker-with-hypervisor-access-to-corrupt-the-reverse-map-table-rmp2026-11-11 https://bugrater.com/releases/cve-2026-40670-improper-check-for-unusual-or-exceptional-conditions-in-amd-secure-encrypted-virtualization-secure-nested-paging-sev-snp-could-allow-a-privileged-attacker-t2026-11-11 https://bugrater.com/releases/cve-2026-67175-chargemap-contains-a-stored-cross-site-scripting-vulnerability-that-allows-a-remote-authenticated-attacker-to-craft-a-malicious-payload-in-the-user-profile-pag2026-11-11 https://bugrater.com/releases/cve-2026-67176-chargemap-contains-an-open-redirect-vulnerability-in-the-authentication-login-endpoint-a-remote-unauthenticated-attacker-could-send-a-crafted-url-to-a-victim2026-11-11 https://bugrater.com/releases/cve-2026-67177-chargemap-contains-a-stored-cross-site-scripting-vulnerability-a-remote-unauthenticated-attacker-could-craft-a-payload-in-the-username-field-of-the-account-re2026-11-11 https://bugrater.com/releases/cve-2026-89324-the-basel-post-types-plugin-for-wordpress-is-vulnerable-to-authentication-bypass-in-all-versions-up-to-and-including-1-18-the-vulnerability-exists-because-a2026-11-11 https://bugrater.com/releases/cve-2026-92439-the-saml-plugin-in-kong-gateway-enterprise-does-not-enforce-audiencerestriction-allowing-a-valid-assertion-issued-for-another-service-provider-to-be-replayed-t2026-11-11 https://bugrater.com/releases/cve-2026-92441-kong-gateway-enterprise-and-kong-ai-gateway-include-decoded-cr-lf-characters-from-the-request-path-in-the-x-forwarded-prefix-header-on-regex-routes-allowing-ht2026-11-11 https://bugrater.com/releases/cve-2026-92442-the-graphql-proxy-cache-advanced-plugin-in-kong-gateway-enterprise-omits-the-caller-s-identity-from-the-cache-key-allowing-a-response-cached-for-one-caller-to2026-11-11 https://bugrater.com/releases/cve-2026-92443-the-caching-plugins-in-kong-gateway-enterprise-and-kong-ai-gateway-may-serve-a-response-cached-for-a-request-carrying-an-authorization-or-proxy-authorization-to2026-11-11 https://bugrater.com/releases/cve-2026-92545-the-proxy-cache-and-proxy-cache-advanced-plugins-in-kong-gateway-enterprise-and-kong-ai-gateway-omit-the-request-hostname-from-the-cache-key-which-may-allow-a-r2026-11-11 https://bugrater.com/releases/cve-2026-92558-the-proxy-cache-and-proxy-cache-advanced-plugins-in-kong-gateway-enterprise-and-kong-ai-gateway-do-not-escape-separator-characters-when-building-the-cache-key2026-11-11 https://bugrater.com/releases/cve-2026-96437-the-ai-azure-content-safety-plugin-in-kong-gateway-enterprise-skips-inspection-of-request-bodies-larger-than-the-in-memory-body-buffer-allowing-prompts-to-bypa2026-11-11 https://bugrater.com/releases/cve-2024-36309-missing-lock-bit-protection-in-the-northbridge-io-nbio-could-allow-a-privileged-attacker-to-use-an-intentionally-disabled-device-as-part-of-a-remapping-attack2026-11-11 https://bugrater.com/releases/cve-2025-0008-insufficient-verification-of-data-authenticity-may-allow-a-local-attacker-to-bypass-secure-debug-unlock-sdu-potentially-resulting-in-unauthorized-debug-acces2026-11-11 https://bugrater.com/releases/cve-2025-29941-incorrect-usage-of-seeds-in-pseudo-random-number-generator-in-the-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-or-migration2026-11-11 https://bugrater.com/releases/cve-2025-48504-operation-on-a-resource-after-expiration-or-release-in-the-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-to-manipulate-metad2026-11-11 https://bugrater.com/releases/cve-2026-0003-use-of-a-per-part-static-key-in-the-asp-bootloader-could-allow-an-attacker-to-downgrade-the-secure-encrypted-virtualization-sev-firmware-and-exploit-known-vul2026-11-11 https://bugrater.com/releases/cve-2026-0435-operation-on-a-resource-after-expiration-or-release-in-the-amd-secure-encrypted-virtualization-sev-firmware-could-allow-an-attacker-with-administrative-privil2026-11-11 https://bugrater.com/releases/cve-2026-0454-an-out-of-bounds-write-in-the-amd-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-to-corrupt-global-firmware-variables-potent2026-11-11 https://bugrater.com/releases/cve-2026-0480-missing-authentication-for-critical-function-in-amd-secure-encrypted-virtualization-sev-firmware-could-allow-a-malicious-hypervisor-to-forge-sev-tio-guest-req2026-11-11 https://bugrater.com/releases/cve-2026-123084-an-expression-language-injection-has-been-found-in-the-headercontentguard-permit-function-in-publication-py-of-the-content-guard-in-the-pulpcore-package2026-11-11 https://bugrater.com/releases/cve-2026-126261-a-improper-authorization-vulnerability-in-fortinet-fortimanager-8-0-0-fortimanager-7-6-0-through-7-6-7-fortimanager-7-4-0-through-7-4-5-fortimanager-7-2-0-th2026-11-11 https://bugrater.com/releases/cve-2026-126495-mqttx-desktop-through-1-13-3-contains-a-stored-cross-site-scripting-vulnerability-that-allows-attackers-to-inject-script-by-publishing-malicious-mqtt-topic-name2026-11-11 https://bugrater.com/releases/cve-2026-126496-1panel-dev-cordyscrm-before-1-9-6-contains-an-authorization-bypass-vulnerability-in-customercontactcontroller-get-that-allows-authenticated-users-to-read-other2026-11-11 https://bugrater.com/releases/cve-2026-126497-librecad-through-2-2-1-6-contains-a-heap-based-out-of-bounds-write-vulnerability-in-the-bundled-libdxfrw-dwgreader18-parsedatapage-function-due-to-unchecked2026-11-11 https://bugrater.com/releases/cve-2026-126498-writefreely-before-0-17-3-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-authors-to-inject-html-by-supplying-a-malicious-post-sl2026-11-11 https://bugrater.com/releases/cve-2026-126539-directus-before-12-1-0-contains-an-authorization-bypass-vulnerability-that-allows-unauthenticated-attackers-to-skip-permission-checks-by-sending-a-failed-auth-m2026-11-11 https://bugrater.com/releases/cve-2026-126541-wwbn-avideo-through-29-7-1-contains-a-missing-authorization-vulnerability-in-live-plugin-restream-endpoints-that-allows-authenticated-streamers-to-obtain-other2026-11-11 https://bugrater.com/releases/cve-2026-126542-wwbn-avideo-6-5-through-29-7-1-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-log-in-as-any-user-via-hybridauth-social2026-11-11 https://bugrater.com/releases/cve-2026-126543-wwbn-avideo-through-29-7-1-contains-an-improper-payment-verification-vulnerability-in-plugin-paypalypt-ipnv2-php-that-credits-wallets-from-paypal-ipns-not-bound2026-11-11 https://bugrater.com/releases/cve-2026-126544-wwbn-avideo-6-5-through-29-7-1-contains-an-email-verification-bypass-vulnerability-in-user-verifycode-in-objects-user-php-caused-by-php-loose-comparison-of-t2026-11-11 https://bugrater.com/releases/cve-2026-126545-wwbn-avideo-through-29-7-1-contains-a-missing-authorization-vulnerability-in-api-get-api-tags-in-plugin-api-api-php-that-allows-registered-users-to-access-re2026-11-11 https://bugrater.com/releases/cve-2026-126546-viber-for-ios-through-29-4-0-24-fails-to-validate-the-logical-screen-width-and-height-in-received-gif-headers-allowing-attackers-to-crash-the-app-attackers-ca2026-11-11 https://bugrater.com/releases/cve-2026-116645-limesurvey-community-edition-7-8-0-contains-an-sql-injection-vulnerability-in-the-survey-archive-participant-import-and-spss-response-export-workflow-an-authen2026-11-11 https://bugrater.com/releases/cve-2026-126559-semantic-mediawiki-4-2-0-before-7-4-1-contains-a-stored-cross-site-scripting-vulnerability-in-optionsbuilder-profiles-that-allows-users-with-the-smw-schemaed2026-11-11 https://bugrater.com/releases/cve-2026-126560-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-stored-cross-site-scripting-vulnerability-in-the-datatables-integration-that-initialises-author-written-smw-dat2026-11-11 https://bugrater.com/releases/cve-2026-126561-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-missing-authorization-vulnerability-that-allows-editors-without-the-edit-protection-right-to-lock-pages-by-addi2026-11-11 https://bugrater.com/releases/cve-2026-126562-semantic-mediawiki-3-0-0-before-7-4-1-contains-an-uncontrolled-recursion-vulnerability-in-the-elasticstore-conceptdescriptioninterpreter-that-only-detects-direc2026-11-11 https://bugrater.com/releases/cve-2026-126563-semantic-mediawiki-2-4-0-before-7-4-1-contains-a-reflected-cross-site-scripting-vulnerability-in-timevalueformatter-getcaptionfromfreeformat-which-emits-fre2026-11-11 https://bugrater.com/releases/cve-2026-126564-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-stored-cross-site-scripting-vulnerability-in-valueformatter-getformattedsubject-that-renders-property-label2026-11-11 https://bugrater.com/releases/cve-2026-126565-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-denial-of-service-vulnerability-in-the-elasticstore-and-sparqlstore-conceptdescriptioninterpreter-classes-whic2026-11-11 https://bugrater.com/releases/cve-2026-126566-semantic-mediawiki-7-3-1-before-7-4-1-contains-an-incorrect-authorization-vulnerability-in-editprotectionupdater-usermaychangeprotection-that-checks-protecti2026-11-11 https://bugrater.com/releases/cve-2026-126567-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-stored-cross-site-scripting-vulnerability-in-special-ask-with-the-elasticstore-backend-allowing-users-with-edi2026-11-11 https://bugrater.com/releases/cve-2026-126569-mbin-1-2-1-before-1-11-1-contains-a-stored-cross-site-scripting-vulnerability-in-embedelement-builddestructed-that-renders-nested-markdown-image-alt-text-and2026-11-11 https://bugrater.com/releases/cve-2026-126570-padloc-4-0-0-before-4-3-1-contains-a-prototype-pollution-vulnerability-that-allows-scim-token-holders-to-modify-object-prototype-by-sending-crafted-scim-patch-p2026-11-11 https://bugrater.com/releases/cve-2026-126571-padloc-4-0-0-before-4-3-1-contains-an-authentication-bypass-vulnerability-in-the-legacy-retrievemfatoken-handler-that-never-counts-wrong-email-verification-code2026-11-11 https://bugrater.com/releases/msrc-cve-2026-697442026-11-11 https://bugrater.com/releases/msrc-cve-2026-700792026-11-11 https://bugrater.com/releases/msrc-cve-2026-701662026-11-11 https://bugrater.com/releases/msrc-cve-2026-1028682026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055832026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055822026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055842026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055862026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055872026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055882026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055892026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055902026-11-11 https://bugrater.com/releases/msrc-cve-2026-1002042026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084092026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084172026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084242026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084032026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084112026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084152026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094632026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084162026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094672026-11-11 https://bugrater.com/releases/msrc-cve-2026-668012026-11-11 https://bugrater.com/releases/msrc-cve-2026-1055442026-11-11 https://bugrater.com/releases/msrc-cve-2026-1141642026-11-11 https://bugrater.com/releases/msrc-cve-2026-1141652026-11-11 https://bugrater.com/releases/msrc-cve-2026-1141662026-11-11 https://bugrater.com/releases/msrc-cve-2026-1141672026-11-11 https://bugrater.com/releases/msrc-cve-2026-1141692026-11-11 https://bugrater.com/releases/msrc-cve-2026-1141702026-11-11 https://bugrater.com/releases/msrc-cve-2026-838942026-11-11 https://bugrater.com/releases/msrc-cve-2026-1022362026-11-11 https://bugrater.com/releases/msrc-cve-2026-1022242026-11-11 https://bugrater.com/releases/msrc-cve-2026-1057342026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084022026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084182026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084192026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094752026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094762026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094782026-11-11 https://bugrater.com/releases/msrc-cve-2026-945112026-11-11 https://bugrater.com/releases/msrc-cve-2026-858012026-11-11 https://bugrater.com/releases/msrc-cve-2026-836842026-11-11 https://bugrater.com/releases/msrc-cve-2026-1022002026-11-11 https://bugrater.com/releases/msrc-cve-2026-1002232026-11-11 https://bugrater.com/releases/msrc-cve-2026-629032026-11-11 https://bugrater.com/releases/msrc-cve-2026-858382026-11-11 https://bugrater.com/releases/msrc-cve-2026-858392026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084142026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094542026-11-11 https://bugrater.com/releases/msrc-cve-2026-945132026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094552026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094572026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094602026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094642026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094662026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094722026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094812026-11-11 https://bugrater.com/releases/msrc-cve-2026-1084252026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094922026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094852026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094912026-11-11 https://bugrater.com/releases/msrc-cve-2026-1094872026-11-11 https://bugrater.com/releases/msrc-cve-2026-693272026-11-11 https://bugrater.com/releases/msrc-cve-2026-673912026-11-11 https://bugrater.com/releases/msrc-cve-2026-813842026-11-11 https://bugrater.com/releases/msrc-cve-2026-858622026-11-11 https://bugrater.com/releases/msrc-cve-2026-882162026-11-11 https://bugrater.com/releases/msrc-cve-2026-701202026-11-11 https://bugrater.com/releases/msrc-cve-2026-702312026-11-11 https://bugrater.com/releases/msrc-cve-2026-882182026-11-11 https://bugrater.com/releases/msrc-cve-2026-882272026-11-11 https://bugrater.com/releases/msrc-cve-2026-882282026-11-11 https://bugrater.com/releases/msrc-cve-2026-882212026-11-11 https://bugrater.com/releases/msrc-cve-2026-882302026-11-11 https://bugrater.com/releases/msrc-cve-2026-882322026-11-11 https://bugrater.com/releases/msrc-cve-2026-882312026-11-11 https://bugrater.com/releases/msrc-cve-2026-882332026-11-11 https://bugrater.com/releases/msrc-cve-2026-882352026-11-11 https://bugrater.com/releases/cve-2026-118368-akaunting-3-3-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-xlsx-item-import-workflow-an-authenticated-manager-can-import-an-item-whose-name-co2026-11-11 https://bugrater.com/releases/cve-2026-97036-on-darwin-building-a-malicious-package-that-uses-cgo-could-cause-arbitrary-code-execution-when-using-the-apple-linker-due-to-passing-l-to-library-path-in2026-11-11 https://bugrater.com/releases/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass-cgo-flag-validation-and-inject-arbitrary-linker-flags-when-linking-when-loading-syso-entri2026-11-11 https://bugrater.com/releases/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler-directives-could-inject-arbitrary-flags-into-the-external-linker-invocation-on-elf-platforms-the2026-11-11 https://bugrater.com/releases/cve-2026-97054-for-http-1-servers-when-maxbytesreader-s-limit-is-exceeded-connection-close-header-is-automatically-set-without-synchronization-which-might-race-with-anot2026-11-11 https://bugrater.com/releases/cve-2025-15711-the-live-composer-wordpress-plugin-before-2-1-24-does-not-sanitise-and-escape-some-of-its-module-settings-before-outputting-them-in-an-href-attribute-which-co2026-11-11 https://bugrater.com/releases/cve-2025-15712-the-live-composer-wordpress-plugin-before-2-1-24-does-not-sanitise-and-escape-some-of-its-staff-member-settings-before-outputting-them-in-pages-which-could-al2026-11-11 https://bugrater.com/releases/cve-2025-15713-the-live-composer-wordpress-plugin-before-2-1-24-does-not-sanitise-and-escape-some-of-its-page-builder-module-settings-before-outputting-them-allowing-users-w2026-11-11 https://bugrater.com/releases/cve-2025-15714-the-live-composer-wordpress-plugin-before-2-1-24-does-not-sanitise-and-escape-some-of-its-button-module-settings-before-outputting-them-on-the-front-end-which2026-11-11 https://bugrater.com/releases/cve-2026-104718-the-elementor-website-builder-wordpress-plugin-before-4-3-6-does-not-validate-or-escape-an-element-identifier-before-rendering-it-into-a-client-side-framework2026-11-11 https://bugrater.com/releases/cve-2026-106468-the-code-snippets-wordpress-plugin-before-4-1-0-does-not-verify-network-level-capabilities-before-honouring-a-network-scope-parameter-on-its-snippet-import-rout2026-11-11 https://bugrater.com/releases/cve-2026-109870-the-user-registration-membership-wordpress-plugin-before-5-3-2-does-not-verify-that-a-discount-coupon-applied-to-a-paid-membership-plan-is-actually-valid-for2026-11-11 https://bugrater.com/releases/cve-2026-109871-the-user-registration-membership-wordpress-plugin-before-5-3-2-does-not-verify-that-a-payment-has-actually-been-completed-before-extending-a-paid-membership2026-11-11 https://bugrater.com/releases/cve-2026-109873-the-user-registration-membership-wordpress-plugin-before-5-3-2-does-not-enforce-its-payment-before-login-restriction-when-a-registration-is-submitted-without2026-11-11 https://bugrater.com/releases/cve-2026-110016-the-data-tables-generator-by-supsystic-wordpress-plugin-before-1-15-8-does-not-perform-any-authorization-or-ownership-check-before-returning-the-stored-content2026-11-11 https://bugrater.com/releases/cve-2026-110948-the-download-manager-wordpress-plugin-before-3-3-73-download-manager-wordpress-plugin-before-7-6-2-does-not-verify-that-a-visitor-is-allowed-to-access-a-packag2026-11-11 https://bugrater.com/releases/cve-2026-110949-the-download-manager-wordpress-plugin-before-3-3-73-download-manager-wordpress-plugin-before-7-6-2-does-not-verify-a-package-s-configured-role-restriction-when2026-11-11 https://bugrater.com/releases/cve-2026-111579-the-forminator-forms-wordpress-plugin-before-1-58-4-does-not-enforce-payment-on-the-server-side-when-a-form-s-configured-payment-gateway-is-unavailable-allowi2026-11-11 https://bugrater.com/releases/cve-2026-111597-the-forminator-forms-wordpress-plugin-before-1-58-4-does-not-verify-that-a-stripe-checkout-payment-has-completed-before-returning-a-pending-submission-s-after2026-11-11 https://bugrater.com/releases/cve-2026-115733-the-printaura-woocommerce-wordpress-plugin-through-4-0-2-does-not-properly-restrict-access-to-the-woocommerce-rest-api-causing-every-woocommerce-rest-route-to2026-11-11 https://bugrater.com/releases/cve-2026-115734-the-pay-with-a-tweet-wordpress-plugin-through-1-0-5-does-not-validate-a-file-path-before-deleting-it-nor-does-it-restrict-access-to-the-relevant-administration2026-11-11 https://bugrater.com/releases/cve-2026-116081-sleipnir-mobile-for-iphone-ipad-and-sleipnir-mobile-for-iphone-ipad-black-edition-provided-by-fenrir-inc-are-vulnerable-to-improper-certificate-verificatio2026-11-11 https://bugrater.com/releases/cve-2026-117521-the-dynific-addons-for-elementor-formerly-anywhere-elementor-wordpress-plugin-before-1-3-1-does-not-escape-a-user-controlled-profile-value-before-outputting-i2026-11-11 https://bugrater.com/releases/cve-2026-117522-the-dynific-addons-for-elementor-formerly-anywhere-elementor-wordpress-plugin-before-1-3-1-does-not-escape-the-post-title-before-outputting-it-in-a-quoted-htm2026-11-11 https://bugrater.com/releases/cve-2026-117523-the-dynific-addons-for-elementor-formerly-anywhere-elementor-wordpress-plugin-before-1-3-1-does-not-perform-a-capability-or-nonce-check-on-an-ajax-action-that2026-11-11 https://bugrater.com/releases/cve-2026-117524-the-dynific-addons-for-elementor-formerly-anywhere-elementor-wordpress-plugin-before-1-3-1-does-not-perform-a-status-or-capability-check-when-resolving-post-i2026-11-11 https://bugrater.com/releases/cve-2026-118041-the-contest-gallery-wordpress-plugin-before-34-0-3-does-not-sanitise-the-name-of-files-uploaded-through-its-e-commerce-sale-file-replacement-feature-allowing2026-11-11 https://bugrater.com/releases/cve-2026-118241-the-smush-wordpress-plugin-before-4-3-6-does-not-verify-that-a-user-is-authorised-to-act-on-the-targeted-media-attachment-only-checking-a-broad-upload-files-c2026-11-11 https://bugrater.com/releases/cve-2026-118418-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not-restrict-which-database-models-and-columns-its-public-directory-search-action-may-return-nor-verify2026-11-11 https://bugrater.com/releases/cve-2026-118420-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not-sanitise-and-escape-a-parameter-before-using-it-in-a-sql-statement-making-it-possible-for-users-hol2026-11-11 https://bugrater.com/releases/cve-2026-118439-the-limit-login-attempts-security-wordpress-plugin-before-3-4-2-does-not-validate-the-destination-of-a-server-side-request-built-from-a-user-supplied-setup-val2026-11-11 https://bugrater.com/releases/cve-2026-119032-the-schema-structured-data-for-wp-amp-wordpress-plugin-before-1-70-does-not-check-that-the-importing-user-may-edit-the-posts-named-in-a-settings-backup-nor2026-11-11 https://bugrater.com/releases/cve-2026-119033-the-schema-structured-data-for-wp-amp-wordpress-plugin-before-1-70-does-not-verify-that-a-user-may-edit-a-post-before-letting-them-change-that-post-s-struct2026-11-11 https://bugrater.com/releases/cve-2026-119034-the-schema-structured-data-for-wp-amp-wordpress-plugin-before-1-70-does-not-verify-that-a-post-is-publicly-viewable-before-returning-its-approved-comments-t2026-11-11 https://bugrater.com/releases/cve-2026-119035-the-schema-structured-data-for-wp-amp-wordpress-plugin-before-1-70-does-not-safely-encode-its-structured-data-output-when-the-pretty-print-option-is-enabled2026-11-11 https://bugrater.com/releases/cve-2026-119303-the-notificationx-wordpress-plugin-before-3-3-7-does-not-perform-any-capability-or-nonce-check-on-one-of-its-rest-routes-allowing-unauthenticated-users-to-upd2026-11-11 https://bugrater.com/releases/cve-2026-119529-the-gravity-forms-wordpress-plugin-before-3-2-2-does-not-properly-restrict-the-file-types-that-unauthenticated-users-can-upload-through-its-chunked-file-upload2026-11-11 https://bugrater.com/releases/cve-2026-119531-the-live-composer-wordpress-plugin-before-2-1-24-does-not-escape-several-attributes-of-one-of-its-page-builder-shortcodes-before-outputting-them-inside-html-ta2026-11-11 https://bugrater.com/releases/cve-2026-121472-the-automatorwp-wordpress-plugin-before-6-0-8-does-not-bind-the-requests-that-complete-its-zoom-and-aweber-integration-connections-to-the-administrator-who-sta2026-11-11 https://bugrater.com/releases/cve-2026-121497-the-askany-wordpress-plugin-before-2-2-0-does-not-validate-the-extension-or-content-of-files-attached-to-chat-messages-trusting-the-browser-supplied-file-type2026-11-11 https://bugrater.com/releases/cve-2026-121862-the-knowledge-building-wordpress-plugin-before-0-7-3-does-not-sanitise-and-escape-comments-submitted-through-its-reply-feature-and-publishes-them-without-moder2026-11-11 https://bugrater.com/releases/cve-2026-121870-the-simpler-checkout-wordpress-plugin-before-1-5-4-does-not-properly-restrict-who-can-create-orders-and-checks-its-automatic-login-link-with-a-key-that-stays-em2026-11-11 https://bugrater.com/releases/cve-2026-121873-the-redirection-for-contact-form-7-wordpress-plugin-before-3-2-16-does-not-verify-ownership-of-the-email-address-supplied-through-its-data-request-form-action-a2026-11-11 https://bugrater.com/releases/cve-2026-121998-the-ichart-wordpress-plugin-before-2-2-4-does-not-perform-capability-or-ownership-checks-in-several-of-its-ajax-actions-relying-only-on-a-nonce-that-any-logge2026-11-11 https://bugrater.com/releases/cve-2026-122061-the-event-tickets-and-registration-wordpress-plugin-before-5-30-3-1-does-not-correctly-check-whether-an-event-displays-a-public-attendee-list-before-returning-o2026-11-11 https://bugrater.com/releases/cve-2026-122087-the-event-tickets-and-registration-wordpress-plugin-before-5-30-3-1-does-not-restrict-attendee-data-to-events-the-requester-is-allowed-to-view-allowing-unauthe2026-11-11 https://bugrater.com/releases/cve-2026-123134-the-smoove-abandoned-cart-trigger-for-woocommerce-wordpress-plugin-before-4-3-6-does-not-sanitise-and-escape-abandoned-cart-data-submitted-by-visitors-before-ou2026-11-11 https://bugrater.com/releases/cve-2026-123656-the-profilepress-wordpress-plugin-before-4-17-6-does-not-correctly-evaluate-some-of-its-content-protection-rule-conditions-when-content-is-rendered-outside-the2026-11-11 https://bugrater.com/releases/cve-2026-123657-the-profilepress-wordpress-plugin-before-4-17-6-does-not-reject-negative-membership-plan-identifiers-before-checking-whether-a-plan-is-active-allowing-unauthe2026-11-11 https://bugrater.com/releases/cve-2026-123661-the-profilepress-wordpress-plugin-before-4-17-4-does-not-check-that-a-membership-plan-is-still-active-when-checkout-is-used-to-change-an-existing-subscription2026-11-11 https://bugrater.com/releases/cve-2026-123666-the-photo-engine-media-organizer-lightroom-wordpress-plugin-before-6-6-2-does-not-check-that-a-user-may-delete-the-media-in-a-collection-before-deleting-it2026-11-11 https://bugrater.com/releases/cve-2026-123667-the-photo-engine-media-organizer-lightroom-wordpress-plugin-before-6-6-2-does-not-sanitise-and-escape-keyword-names-before-storing-them-and-outputting-them2026-11-11 https://bugrater.com/releases/cve-2026-123695-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-restrict-access-to-several-of-its-rest-api-routes-allowing-unauthenticated-users-to-gener2026-11-11 https://bugrater.com/releases/cve-2026-123696-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-check-that-the-requester-is-authorised-before-resetting-two-factor-authentication-enrolmen2026-11-11 https://bugrater.com/releases/cve-2026-123697-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-restrict-who-can-request-a-user-s-current-two-factor-code-or-two-factor-secret-allowing-u2026-11-11 https://bugrater.com/releases/cve-2026-123698-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-restrict-access-to-one-of-its-rest-api-routes-allowing-unauthenticated-users-to-retrieve2026-11-11 https://bugrater.com/releases/cve-2026-123699-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-check-that-the-requester-is-authorised-before-running-bulk-security-for-woocommerce-wordpr2026-11-11 https://bugrater.com/releases/cve-2026-123700-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-check-that-the-requester-is-authorised-before-running-several-of-its-comment-cleanup-actio2026-11-11 https://bugrater.com/releases/cve-2026-123701-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-have-proper-authorization-checks-when-resetting-its-settings-allowing-unauthenticated-use2026-11-11 https://bugrater.com/releases/cve-2026-123702-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-check-that-the-requester-is-authorised-before-regenerating-the-secret-keys-and-salts-in-th2026-11-11 https://bugrater.com/releases/cve-2026-123703-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-check-that-the-requester-is-authorised-before-ending-a-user-s-login-sessions-allowing-una2026-11-11 https://bugrater.com/releases/cve-2026-123704-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-restrict-access-to-one-of-its-rest-api-routes-allowing-unauthenticated-users-to-retrieve2026-11-11 https://bugrater.com/releases/cve-2026-123705-the-security-for-woocommerce-wordpress-plugin-through-1-0-16-does-not-restrict-access-to-one-of-its-rest-api-routes-allowing-unauthenticated-users-to-retrieve2026-11-11 https://bugrater.com/releases/cve-2026-88813-the-yith-woocommerce-gift-cards-wordpress-plugin-through-4-39-0-does-not-reconcile-the-value-of-a-gift-card-it-issues-against-the-amount-actually-paid-for-it-i2026-11-11 https://bugrater.com/releases/cve-2026-96414-in-affected-versions-of-octopus-server-insufficient-integrity-protection-of-authentication-cookies-combined-with-incorrect-validation-of-permissions-assigned2026-11-11 https://bugrater.com/releases/cve-2026-105948-in-affected-versions-of-octopus-server-incorrect-validation-of-permissions-assigned-to-a-user-that-would-allow-them-to-edit-their-own-login-identities-could-re2026-11-11 https://bugrater.com/releases/cve-2026-111190-the-arforms-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-upload-in-all-versions-up-to-and-including-7-2-4-via-its-form-file-upload-handler-the-name-o2026-11-11 https://bugrater.com/releases/cve-2026-116468-a-flaw-was-found-in-the-group-move-and-organization-group-reparenting-endpoints-of-the-keycloak-services-component-this-component-is-responsible-for-core-authe2026-11-11 https://bugrater.com/releases/cve-2026-119171-the-advanced-product-fields-product-addons-for-woocommerce-wordpress-plugin-from-1-6-22-to-1-7-3-does-not-validate-that-a-submitted-value-for-a-required-paid2026-11-11 https://bugrater.com/releases/cve-2026-119302-the-notificationx-wordpress-plugin-before-3-3-7-does-not-perform-any-capability-authentication-or-nonce-check-on-its-notification-preview-path-allowing-unauth2026-11-11 https://bugrater.com/releases/cve-2026-123659-the-profilepress-wordpress-plugin-before-4-17-6-does-not-restrict-the-role-and-user-meta-filters-its-member-directories-accept-to-those-configured-by-the-admini2026-11-11 https://bugrater.com/releases/cve-2026-123668-the-getpaid-wordpress-plugin-from-2-8-63-to-2-8-64-does-not-ensure-item-quantities-on-its-payment-forms-are-whole-numbers-allowing-unauthenticated-users-to-hav2026-11-11 https://bugrater.com/releases/cve-2026-12062-zoho-corporation-manageengine-adaudit-plus-versions-below-8703-are-vulnerable-to-an-authenticated-sql-injection-vulnerability-in-adaudit-plus-reports-api2026-11-11 https://bugrater.com/releases/cve-2026-12424-the-arforms-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-referer-header-in-all-versions-up-to-and-including-7-2-4-due-to-insufficient2026-11-11 https://bugrater.com/releases/cve-2026-12427-the-arforms-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-description-parameter-in-all-versions-up-to-and-including-7-2-4-due-to2026-11-11 https://bugrater.com/releases/cve-2026-15785-the-joinchat-enhanced-click-to-chat-plugin-for-wordpress-is-vulnerable-to-reflected-cross-site-scripting-via-href-dynamic-variable-via-query-parameter-n2026-11-11 https://bugrater.com/releases/cve-2026-92408-the-wps-bookings-for-woocommerce-wordpress-plugin-before-3-13-1-does-not-validate-a-price-value-taken-from-user-input-before-using-it-to-set-the-product-price2026-11-11 https://bugrater.com/releases/cve-2026-93487-in-affected-versions-of-octopus-server-incorrect-validation-of-the-permissions-assigned-to-a-user-that-would-allow-them-to-create-project-triggers-could-result2026-11-11 https://bugrater.com/releases/cve-2026-18767-a-local-low-privileged-attacker-or-process-can-access-i-o-ports-via-tcrouter-sys-because-of-exposed-ioctl-function-calls-resulting-in-a-full-compromise-of-the-a2026-11-11 https://bugrater.com/releases/cve-2026-18768-a-local-low-privileged-attacker-can-access-arbitrary-physical-memory-or-define-its-mapping-via-tcrouter-sys-because-of-exposed-ioctl-function-calls-resulting-in2026-11-11 https://bugrater.com/releases/cve-2026-18769-a-local-low-privileged-attacker-can-move-arbitrary-physical-memory-content-via-tcrouter-sys-because-of-exposed-ioctl-function-calls-resulting-in-a-full-compromi2026-11-11 https://bugrater.com/releases/cve-2026-112174-local-privilege-escalation-vulnerability-in-iperius-backup-8-8-3-due-to-insufficient-separation-between-the-graphical-user-interface-running-with-elevated-priv2026-11-11 https://bugrater.com/releases/cve-2026-124250-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-ayecode-ltd-geodirectory-geodirectory-allows-reflected-xss2026-11-11 https://bugrater.com/releases/cve-2026-124256-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-coderockz-delivery-amp-pickup-date-time-for-woocommerce2026-11-11 https://bugrater.com/releases/cve-2026-124257-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wordplus-bp-better-messages-bp-better-messages-allows-stor2026-11-11 https://bugrater.com/releases/cve-2026-124737-a-flaw-was-found-in-busybox-when-the-tftp-trivial-file-transfer-protocol-client-requests-a-custom-small-block-size-and-receives-a-standard-response-it-falls2026-11-11 https://bugrater.com/releases/cve-2026-111792-uncontrolled-recursion-vulnerability-in-apache-xml-graphics-batik-this-issue-affects-apache-xml-graphics-batik-through-1-19-users-are-recommended-to-up2026-11-11 https://bugrater.com/releases/cve-2026-123478-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-meow-apps-ai-engine-ai-engine-allows-stored-xss-this-issue2026-11-11 https://bugrater.com/releases/cve-2026-124253-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-codepeople-calculated-fields-form-calculated-fields-form-a2026-11-11 https://bugrater.com/releases/cve-2026-124739-a-flaw-was-found-in-busybox-when-the-httpd-web-server-processes-subdirectory-configuration-files-an-overly-long-index-page-name-can-trigger-a-stack-based-buff2026-11-11 https://bugrater.com/releases/cve-2026-124741-a-flaw-was-found-in-busybox-the-udhcpc6-dhcpv6-client-does-not-properly-validate-the-size-of-network-options-sent-by-a-server-before-copying-them-into-memory2026-11-11 https://bugrater.com/releases/cve-2026-78287-improper-control-of-generation-of-code-code-injection-vulnerability-in-staggs-staggs-staggs-allows-remote-code-inclusion-this-issue-affects-staggs-from-n-a2026-11-11 https://bugrater.com/releases/cve-2026-103883-the-6storage-rentals-plugin-for-wordpress-is-vulnerable-to-authentication-bypass-leading-to-administrator-account-takeover-in-all-versions-up-to-and-including2026-11-11 https://bugrater.com/releases/cve-2026-115600-missing-authorization-vulnerability-in-dev-institute-restrict-user-access-membership-plugin-with-force-restrict-user-access-allows-exploiting-incorrectly-conf2026-11-11 https://bugrater.com/releases/cve-2026-119097-the-author-image-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-display-name-parameter-in-all-versions-up-to-and-including-4-9-32026-11-11 https://bugrater.com/releases/cve-2026-119615-the-reset-database-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-versions-up-to-and-including-1-1-3-this-is-due-to-the-process-reset-functi2026-11-11 https://bugrater.com/releases/cve-2026-121014-missing-authorization-vulnerability-in-ahmad-wp-job-portal-wp-job-portal-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affe2026-11-11 https://bugrater.com/releases/cve-2026-121028-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-wp-chill-strong-testimonials-strong-testimonials-allows-code-inje2026-11-11 https://bugrater.com/releases/cve-2026-121574-missing-authorization-vulnerability-in-wp-chill-passster-content-protector-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-af2026-11-11 https://bugrater.com/releases/cve-2026-121770-cross-site-request-forgery-csrf-vulnerability-in-villatheme-viseek-viseek-easy-custom-search-allows-cross-site-request-forgery-this-issue-affects-viseek-from2026-11-11 https://bugrater.com/releases/cve-2026-121773-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-generatepress-generateblocks-generateblocks-allows-stored2026-11-11 https://bugrater.com/releases/cve-2026-122671-missing-authorization-vulnerability-in-e2pdf-com-e2pdf-e2pdf-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-e2pdf-f2026-11-11 https://bugrater.com/releases/cve-2026-123473-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wedevs-happy-addons-for-elementor-happy-elementor-addons-a2026-11-11 https://bugrater.com/releases/cve-2026-124255-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-franky-events-made-easy-events-made-easy-allows-code-injection-th2026-11-11 https://bugrater.com/releases/cve-2026-124271-missing-authorization-vulnerability-in-dev-institute-restrict-user-access-membership-plugin-with-force-restrict-user-access-allows-exploiting-incorrectly-conf2026-11-11 https://bugrater.com/releases/cve-2026-124408-missing-authorization-vulnerability-in-arraytics-wpcafe-wp-cafe-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-wpcaf2026-11-11 https://bugrater.com/releases/cve-2026-124413-missing-authorization-vulnerability-in-wp-user-manager-wp-user-manager-wp-user-manager-allows-exploiting-incorrectly-configured-access-control-security-levels-t2026-11-11 https://bugrater.com/releases/cve-2026-124421-missing-authorization-vulnerability-in-bdthemes-zoloblocks-zoloblocks-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects2026-11-11 https://bugrater.com/releases/cve-2026-124738-a-flaw-was-found-in-busybox-when-the-http-daemon-httpd-has-pre-compressed-file-support-enabled-authentication-checks-are-evaluated-only-against-the-requeste2026-11-11 https://bugrater.com/releases/cve-2026-124740-a-flaw-was-found-in-busybox-s-udhcpc6-dhcpv6-client-a-malicious-server-on-the-local-network-can-trigger-a-use-after-free-condition-by-responding-with-a-crafted2026-11-11 https://bugrater.com/releases/cve-2026-124742-a-flaw-was-found-in-busybox-the-volume-identification-component-fails-to-properly-validate-cluster-parameters-when-analyzing-specially-formatted-fat-filesystem2026-11-11 https://bugrater.com/releases/cve-2026-124743-a-flaw-was-found-in-busybox-when-processing-filesystem-metadata-the-volume-identification-component-does-not-properly-validate-header-values-in-hfs-filesyste2026-11-11 https://bugrater.com/releases/cve-2026-124752-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bdthemes-element-pack-elementor-addons-bdthemes-element-pa2026-11-11 https://bugrater.com/releases/cve-2026-124753-missing-authorization-vulnerability-in-ahmad-wp-job-portal-wp-job-portal-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affe2026-11-11 https://bugrater.com/releases/cve-2026-125434-missing-authorization-vulnerability-in-webful-creations-repairbuddy-computer-repair-shop-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-11 https://bugrater.com/releases/cve-2026-125437-missing-authorization-vulnerability-in-nsquared-simply-schedule-appointments-simply-schedule-appointments-allows-exploiting-incorrectly-configured-access-contro2026-11-11 https://bugrater.com/releases/cve-2026-125438-missing-authorization-vulnerability-in-webful-creations-repairbuddy-computer-repair-shop-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-11 https://bugrater.com/releases/cve-2026-125439-missing-authorization-vulnerability-in-kit-kit-formerly-convertkit-convertkit-allows-exploiting-incorrectly-configured-access-control-security-levels-this-iss2026-11-11 https://bugrater.com/releases/cve-2026-125444-missing-authorization-vulnerability-in-king-addons-king-addons-for-elementor-king-addons-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-11 https://bugrater.com/releases/cve-2026-125451-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bplugins-b-blocks-b-blocks-allows-stored-xss-this-issue-af2026-11-11 https://bugrater.com/releases/cve-2026-125455-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bold-themes-bold-page-builder-bold-page-builder-allows-sto2026-11-11 https://bugrater.com/releases/cve-2026-125680-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bold-themes-bold-page-builder-bold-page-builder-allows-sto2026-11-11 https://bugrater.com/releases/cve-2026-125761-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-yith-yith-woocommerce-ajax-search-yith-woocommerce-ajax-se2026-11-11 https://bugrater.com/releases/cve-2026-125777-insertion-of-sensitive-information-into-sent-data-vulnerability-in-cozmoslabs-profile-builder-profile-builder-allows-retrieve-embedded-sensitive-data-this-issue2026-11-11 https://bugrater.com/releases/cve-2026-125781-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-nous-ouvert-utile-et-simple-event-post-event-post-allows-s2026-11-11 https://bugrater.com/releases/cve-2026-125784-cross-site-request-forgery-csrf-vulnerability-in-magnigenie-restropress-restropress-allows-cross-site-request-forgery-this-issue-affects-restropress-from-n-a2026-11-11 https://bugrater.com/releases/cve-2026-126627-creation-of-temporary-file-with-insecure-permissions-vulnerability-in-apache-xml-graphics-fop-this-issue-affects-apache-xml-graphics-fop-through-2-11-u2026-11-11 https://bugrater.com/releases/cve-2026-105152-exposure-of-sensitive-information-to-an-unauthorized-actor-in-apache-roller-4-0-through-6-1-6-allows-a-weblog-administrator-to-read-another-user-s-stored-passwo2026-11-11 https://bugrater.com/releases/cve-2026-105153-improper-restriction-of-xml-external-entity-reference-in-apache-roller-4-0-through-6-1-6-allows-an-authenticated-user-with-no-weblog-permissions-to-read-files-r2026-11-11 https://bugrater.com/releases/cve-2026-105154-cross-site-request-forgery-csrf-in-the-planet-feed-aggregator-administration-of-apache-roller-4-0-through-6-1-6-allows-an-unauthenticated-attacker-to-make-the2026-11-11 https://bugrater.com/releases/cve-2026-108338-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-apache-roller-5-0-1-through-6-1-6-allows-an-authenticated-user-with-the2026-11-11 https://bugrater.com/releases/cve-2026-111824-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-apache-roller-6-1-6-allows-an-authenticated-user-with-the-author-role-on2026-11-11 https://bugrater.com/releases/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of-keycloak-the-identity-and-access-management-solution-this-issue-specifically-affects-deployments-us2026-11-11 https://bugrater.com/releases/cve-2026-118405-exposure-of-sensitive-information-to-an-unauthorized-actor-in-apache-roller-4-0-through-6-1-6-allows-any-logged-in-user-to-learn-other-users-email-addresses-t2026-11-11 https://bugrater.com/releases/cve-2026-118408-missing-authorization-in-apache-roller-4-0-through-6-1-6-allows-any-logged-in-user-to-read-unpublished-entries-of-a-weblog-they-have-no-role-in-the-entry-previ2026-11-11 https://bugrater.com/releases/cve-2026-118409-exposure-of-sensitive-information-to-an-unauthorized-actor-in-apache-roller-4-0-through-6-1-6-allows-an-unauthenticated-visitor-to-recover-the-email-addresses-o2026-11-11 https://bugrater.com/releases/cve-2026-118410-exposure-of-resource-to-wrong-sphere-in-apache-roller-4-0-through-6-1-6-allows-an-unauthenticated-visitor-to-read-an-entry-after-its-author-has-withdrawn-it-to2026-11-11 https://bugrater.com/releases/cve-2026-118411-cross-site-request-forgery-csrf-in-apache-roller-5-0-1-through-6-1-6-allows-an-unauthenticated-attacker-to-create-an-administrator-account-if-a-logged-in-roll2026-11-11 https://bugrater.com/releases/cve-2026-118412-improper-authentication-in-apache-roller-5-1-0-through-6-1-6-allows-a-user-whose-account-an-administrator-has-disabled-to-sign-in-again-through-openid-and-read2026-11-11 https://bugrater.com/releases/cve-2026-118413-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-apache-roller-4-0-through-6-1-6-allows-a-weblog-administrator-to-store-s2026-11-11 https://bugrater.com/releases/cve-2026-118414-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-apache-roller-6-1-2-through-6-1-6-allows-a-weblog-administrator-to-store2026-11-11 https://bugrater.com/releases/cve-2026-122096-uncontrolled-resource-consumption-vulnerability-in-the-sketch-deserialization-of-apache-datasketches-java-several-deserializers-trusted-sizes-and-counts-dec2026-11-11 https://bugrater.com/releases/cve-2026-122300-missing-authorization-vulnerability-in-apache-roller-4-0-through-6-1-6-allows-a-weblog-member-with-the-limited-role-to-remove-or-change-entries-that-member-may2026-11-11 https://bugrater.com/releases/cve-2026-123374-deserialization-of-untrusted-data-vulnerability-in-apache-roller-when-roller-sends-a-weblog-update-ping-its-xml-rpc-client-deserializes-java-object-data-conta2026-11-11 https://bugrater.com/releases/cve-2026-123480-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-fullworks-plugins-display-eventbrite-events-widget-for-eve2026-11-11 https://bugrater.com/releases/cve-2026-123481-missing-authorization-vulnerability-in-wp-extended-the-ultimate-wordpress-toolkit-wp-extended-wpextended-allows-exploiting-incorrectly-configured-access-contr2026-11-11 https://bugrater.com/releases/cve-2026-124261-missing-authorization-vulnerability-in-magepeople-inc-taxi-booking-manager-for-woocommerce-ecab-taxi-booking-manager-allows-exploiting-incorrectly-configured-a2026-11-11 https://bugrater.com/releases/cve-2026-124262-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-igor-funa-ad-inserter-ad-inserter-allows-code-injection-this-issu2026-11-11 https://bugrater.com/releases/cve-2026-124263-cross-site-request-forgery-csrf-vulnerability-in-plainware-locatoraid-store-locator-locatoraid-allows-cross-site-request-forgery-this-issue-affects-locatoraid2026-11-11 https://bugrater.com/releases/cve-2026-124269-missing-authorization-vulnerability-in-wedevs-happy-addons-for-elementor-happy-elementor-addons-allows-exploiting-incorrectly-configured-access-control-security2026-11-11 https://bugrater.com/releases/cve-2026-124411-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-brainstorm-force-surecart-surecart-allows-stored-xss-this2026-11-11 https://bugrater.com/releases/cve-2026-124416-missing-authorization-vulnerability-in-ahmad-wp-job-portal-wp-job-portal-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affe2026-11-11 https://bugrater.com/releases/cve-2026-124417-missing-authorization-vulnerability-in-ahmad-wp-job-portal-wp-job-portal-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affe2026-11-11 https://bugrater.com/releases/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves-files-that-a-worker-has-placed-in-its-own-log-directory-as-links-to-other-files-a-user-who-is-allo2026-11-11 https://bugrater.com/releases/cve-2026-124496-the-drpc-http-endpoint-lets-an-authenticated-client-act-as-another-user-without-applying-the-configured-impersonation-authorizer-an-authenticated-user-can-exec2026-11-11 https://bugrater.com/releases/cve-2026-124744-a-flaw-was-found-in-busybox-when-extracting-files-using-the-cpio-utility-with-path-traversal-protection-enabled-hardlink-target-paths-are-not-properly-sanitiz2026-11-11 https://bugrater.com/releases/cve-2026-124745-a-flaw-was-found-in-busybox-when-extracting-an-archive-the-tar-utility-improperly-resolves-deferred-hardlink-targets-across-symbolic-links-pointing-outside-th2026-11-11 https://bugrater.com/releases/cve-2026-125045-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-john-michael-l-allier-create-mediavine-create-allows-store2026-11-11 https://bugrater.com/releases/cve-2026-125046-missing-authorization-vulnerability-in-john-michael-l-allier-create-mediavine-create-allows-exploiting-incorrectly-configured-access-control-security-levels-thi2026-11-11 https://bugrater.com/releases/cve-2026-125431-missing-authorization-vulnerability-in-mamunur-rashid-food-menu-restaurant-menu-online-ordering-for-woocommerce-tlp-food-menu-allows-exploiting-incorrectly2026-11-11 https://bugrater.com/releases/cve-2026-125433-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-futuriowp-futurio-extra-futurio-extra-allows-stored-xss-th2026-11-11 https://bugrater.com/releases/cve-2026-125435-insertion-of-sensitive-information-into-sent-data-vulnerability-in-ideabox-creations-powerpack-addons-for-elementor-powerpack-lite-for-elementor-allows-retrieve2026-11-11 https://bugrater.com/releases/cve-2026-125436-missing-authorization-vulnerability-in-mamunur-rashid-the-post-grid-the-post-grid-allows-exploiting-incorrectly-configured-access-control-security-levels-this-i2026-11-11 https://bugrater.com/releases/cve-2026-125445-cross-site-request-forgery-csrf-vulnerability-in-infomaniak-network-vod-infomaniak-vod-infomaniak-allows-cross-site-request-forgery-this-issue-affects-vod-inf2026-11-11 https://bugrater.com/releases/cve-2026-125446-cross-site-request-forgery-csrf-vulnerability-in-wisdmlabs-edwiser-bridge-edwiser-bridge-allows-cross-site-request-forgery-this-issue-affects-edwiser-bridge2026-11-11 https://bugrater.com/releases/cve-2026-125448-missing-authorization-vulnerability-in-kaliforms-kali-forms-kali-forms-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affect2026-11-11 https://bugrater.com/releases/cve-2026-125450-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-brainstorm-force-surerank-surerank-allows-stored-xss-this2026-11-11 https://bugrater.com/releases/cve-2026-125454-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wp-chill-passster-content-protector-allows-stored-xss-this2026-11-11 https://bugrater.com/releases/cve-2026-125708-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-bdthemes-element-pack-elementor-addons-bdthemes-element-pa2026-11-11 https://bugrater.com/releases/cve-2026-125743-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wpvibes-elementor-addon-elements-addon-elements-for-elemen2026-11-11 https://bugrater.com/releases/cve-2026-125746-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-propluginslab-back-in-stock-notifier-for-woocommerce-back-in-stoc2026-11-11 https://bugrater.com/releases/cve-2026-125762-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-leapworx-premium-addons-for-elementor-premium-addons-for-e2026-11-11 https://bugrater.com/releases/cve-2026-125763-missing-authorization-vulnerability-in-brainstorm-force-sureforms-sureforms-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-a2026-11-11 https://bugrater.com/releases/cve-2026-125766-insertion-of-sensitive-information-into-sent-data-vulnerability-in-wpzoom-wpzoom-social-feed-widget-block-instagram-widget-by-wpzoom-allows-retrieve-embedded2026-11-11 https://bugrater.com/releases/cve-2026-125767-insertion-of-sensitive-information-into-sent-data-vulnerability-in-nerdpress-hubbub-lite-social-pug-allows-retrieve-embedded-sensitive-data-this-issue-affects-h2026-11-11 https://bugrater.com/releases/cve-2026-125776-missing-authorization-vulnerability-in-cozmoslabs-profile-builder-profile-builder-allows-exploiting-incorrectly-configured-access-control-security-levels-this-i2026-11-11 https://bugrater.com/releases/cve-2026-125778-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-mycred-mycred-mycred-allows-code-injection-this-issue-affects-myc2026-11-11 https://bugrater.com/releases/cve-2026-125782-missing-authorization-vulnerability-in-blubrry-podcasting-powerpress-podcasting-powerpress-allows-exploiting-incorrectly-configured-access-control-security-leve2026-11-11 https://bugrater.com/releases/cve-2026-126537-the-ninja-forms-file-uploads-add-on-for-wordpress-is-vulnerable-to-arbitrary-file-deletion-and-arbitrary-file-read-via-s3-dropbox-google-drive-exfiltration2026-11-11 https://bugrater.com/releases/cve-2026-126658-bytestash-1-5-10-before-1-6-2-contains-an-insufficient-session-expiration-vulnerability-that-allows-holders-of-api-keys-to-keep-access-after-account-deactivatio2026-11-11 https://bugrater.com/releases/cve-2026-126659-blueprintue-self-hosted-edition-1-0-0-before-4-3-5-contains-a-resource-exhaustion-vulnerability-that-allows-unauthenticated-attackers-to-fill-server-storage-by2026-11-11 https://bugrater.com/releases/cve-2026-126662-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before-6-0-6-contains-an-access-control-bypass-vulnerability-that-allows-filemount-restricted-backend2026-11-11 https://bugrater.com/releases/cve-2026-126663-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before-6-0-6-contains-a-path-traversal-vulnerability-that-allows-content-editors-to-read-image-files2026-11-11 https://bugrater.com/releases/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on-a-supervisor-including-the-host-port-owner-and-resource-assignment-of-topologies-the-caller2026-11-11 https://bugrater.com/releases/cve-2026-123040-an-attacker-who-gains-the-ability-to-execute-arbitrary-code-on-a-system-with-trueconf-server-linux-versions-from-4-7-2-up-to-but-not-including-5-5-6-install2026-11-11 https://bugrater.com/releases/cve-2026-125838-cross-site-request-forgery-csrf-vulnerability-in-webriti-quality-quality-allows-cross-site-request-forgery-this-issue-affects-quality-from-n-a-through-3-32026-11-11 https://bugrater.com/releases/cve-2026-125839-cross-site-request-forgery-csrf-vulnerability-in-webriti-elitepress-elitepress-allows-cross-site-request-forgery-this-issue-affects-elitepress-from-n-a-throu2026-11-11 https://bugrater.com/releases/cve-2026-125840-cross-site-request-forgery-csrf-vulnerability-in-webriti-rambo-rambo-allows-cross-site-request-forgery-this-issue-affects-rambo-from-n-a-through-3-02026-11-11 https://bugrater.com/releases/cve-2026-125841-cross-site-request-forgery-csrf-vulnerability-in-webriti-heroic-heroic-allows-cross-site-request-forgery-this-issue-affects-heroic-from-n-a-through-1-4-22026-11-11 https://bugrater.com/releases/cve-2026-125842-cross-site-request-forgery-csrf-vulnerability-in-webriti-wallstreet-agency-wallstreet-agency-allows-cross-site-request-forgery-this-issue-affects-wallstreet-a2026-11-11 https://bugrater.com/releases/cve-2026-125843-cross-site-request-forgery-csrf-vulnerability-in-webriti-spasalon-spasalon-allows-cross-site-request-forgery-this-issue-affects-spasalon-from-n-a-through-3-02026-11-11 https://bugrater.com/releases/cve-2026-125844-cross-site-request-forgery-csrf-vulnerability-in-webriti-vice-vice-allows-cross-site-request-forgery-this-issue-affects-vice-from-n-a-through-1-42026-11-11 https://bugrater.com/releases/cve-2026-125845-cross-site-request-forgery-csrf-vulnerability-in-webriti-vdequator-vdequator-allows-cross-site-request-forgery-this-issue-affects-vdequator-from-n-a-through2026-11-11 https://bugrater.com/releases/cve-2026-125846-cross-site-request-forgery-csrf-vulnerability-in-webriti-mazino-mazino-allows-cross-site-request-forgery-this-issue-affects-mazino-from-n-a-through-1-12026-11-11 https://bugrater.com/releases/cve-2026-125847-cross-site-request-forgery-csrf-vulnerability-in-webriti-vdperanto-vdperanto-allows-cross-site-request-forgery-this-issue-affects-vdperanto-from-n-a-through2026-11-11 https://bugrater.com/releases/cve-2026-125848-cross-site-request-forgery-csrf-vulnerability-in-webriti-leo-leo-allows-cross-site-request-forgery-this-issue-affects-leo-from-n-a-through-1-7-42026-11-11 https://bugrater.com/releases/cve-2026-125849-cross-site-request-forgery-csrf-vulnerability-in-webriti-shk-corporate-shk-corporate-allows-cross-site-request-forgery-this-issue-affects-shk-corporate-from2026-11-11 https://bugrater.com/releases/cve-2026-125850-cross-site-request-forgery-csrf-vulnerability-in-webriti-appointment-dark-appointment-dark-allows-cross-site-request-forgery-this-issue-affects-appointment-da2026-11-11 https://bugrater.com/releases/cve-2026-106023-null-pointer-dereference-vulnerability-in-apache-http-server-s-mod-md-during-http-request-processing-this-issue-affects-apache-http-server-from-2-4-30-thro2026-11-11 https://bugrater.com/releases/cve-2026-107509-a-user-with-the-viewer-role-can-make-grafana-allocate-an-unbounded-amount-of-memory-and-crash-it-with-a-single-sql-expression-query-that-casts-a-value-to-a-ve2026-11-11 https://bugrater.com/releases/cve-2026-109163-stack-based-buffer-overflow-vulnerability-in-apache-http-server-s-mod-vhost-alias-after-cve-2026-63292-this-issue-affects-apache-http-server-2-4-692026-11-11 https://bugrater.com/releases/cve-2026-110992-a-user-who-can-create-git-sync-provisioning-jobs-the-editor-role-by-default-could-delete-or-move-files-outside-the-configured-repository-path-with-a-job-that2026-11-11 https://bugrater.com/releases/cve-2026-111000-a-user-with-the-editor-role-who-can-edit-a-folder-can-move-it-through-the-folders-resource-api-under-a-folder-they-administer-and-so-gain-admin-on-the-moved2026-11-11 https://bugrater.com/releases/cve-2026-111024-a-user-with-the-viewer-or-editor-role-could-bypass-folder-permissions-on-git-sync-managed-resources-through-the-repository-files-api-a-viewer-could-read-files2026-11-11 https://bugrater.com/releases/cve-2026-119618-concurrent-execution-using-shared-resource-with-improper-synchronization-vulnerability-in-apache-http-server-s-mod-http2-in-assign-headers-can-lead-to-rce-t2026-11-11 https://bugrater.com/releases/cve-2026-123710-a-flaw-was-found-in-red-hat-quay-an-unauthenticated-client-can-obtain-an-anonymous-registry-token-with-an-audience-it-controls-present-that-token-to-the-servi2026-11-11 https://bugrater.com/releases/cve-2026-124746-a-flaw-was-found-in-busybox-an-integer-overflow-occurs-in-the-volume-id-component-when-calculating-buffer-boundaries-while-probing-filesystem-metadata-an-atta2026-11-11 https://bugrater.com/releases/cve-2026-13721-a-user-with-edit-access-to-one-folder-could-modify-move-or-delete-git-sync-provisioned-resources-in-folders-where-they-only-had-view-access-through-the-provis2026-11-11 https://bugrater.com/releases/cve-2026-14242-a-user-with-the-editor-role-could-delete-move-push-or-pull-git-sync-managed-resources-in-folders-where-they-only-had-view-access-by-creating-a-provisioning-j2026-11-11 https://bugrater.com/releases/cve-2026-82014-any-authenticated-user-including-a-viewer-could-change-the-preferences-of-any-team-such-as-its-home-dashboard-theme-and-timezone-through-an-undocumented-en2026-11-11 https://bugrater.com/releases/cve-2026-85632-missing-authentication-for-critical-function-and-improper-validation-of-integrity-check-value-vulnerability-in-sipay-electronic-money-and-payment-services-inc2026-11-11 https://bugrater.com/releases/cve-2026-100290-the-regcomp-and-regexec-functions-in-the-gnu-c-library-version-2-3-to-version-2-44-may-read-freed-memory-and-free-the-same-heap-block-twice-when-a-memory-alloca2026-11-11 https://bugrater.com/releases/cve-2026-105440-missing-authorization-in-the-json-rpc-web-services-interface-of-extreme-networks-switch-engine-exos-allows-an-authenticated-low-privileged-read-only-user-t2026-11-11 https://bugrater.com/releases/cve-2026-115819-calling-the-wide-scanf-family-of-functions-swscanf-fwscanf-wscanf-vswscanf-vfwscanf-and-vwscanf-with-a-s-or-conversion-without-the-l-length-modifier2026-11-11 https://bugrater.com/releases/cve-2026-124686-in-progress-kendo-ui-for-jquery-versions-prior-to-2026-4-1111-kendo-init-compiles-data-attribute-values-with-new-function-when-an-invalid-json-object-is2026-11-11 https://bugrater.com/releases/cve-2026-110697-a-flaw-was-found-in-quay-where-the-robot-account-listing-function-constructs-a-sql-like-pattern-from-user-controlled-namespace-names-without-escaping-wildcard-m2026-11-11 https://bugrater.com/releases/cve-2026-116633-a-potential-vulnerability-was-reported-in-some-lenovo-tablets-that-could-allow-a-third-party-application-to-perform-an-arbitrary-file-write-with-elevated-privil2026-11-11 https://bugrater.com/releases/cve-2026-122043-repmgr-4-0-0-through-5-5-0-is-affected-by-an-os-command-injection-vulnerability-cwe-78-in-event-notifications-when-event-notification-command-is-configured2026-11-11 https://bugrater.com/releases/cve-2026-124687-in-progress-kendo-ui-for-jquery-versions-from-2022-2-621-prior-to-2026-4-1111-the-dropdownbutton-and-splitbutton-allow-markup-injection-through-the-id-and2026-11-11 https://bugrater.com/releases/cve-2026-124688-in-progress-kendo-ui-for-jquery-prior-to-2026-4-1111-the-tabstrip-panelbar-and-menu-widgets-support-mapping-a-datasource-field-to-spritecssclass-if-an-at2026-11-11 https://bugrater.com/releases/cve-2026-124689-in-progress-kendo-ui-for-jquery-versions-2026-3-1014-up-to-but-not-including-2026-4-1110-actionsheet-does-not-encode-title-subtitle-and-header-button-label2026-11-11 https://bugrater.com/releases/cve-2026-124690-in-progress-kendo-ui-for-jquery-sanitizesvgcontent-parses-custom-icon-markup-into-a-live-dom-before-filtering-it-an-attacker-who-can-influence-custom-icon-c2026-11-11 https://bugrater.com/releases/cve-2026-124692-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but-not-including-2026-4-1110-the-grid-and-treelist-column-reorder-drag-clue-reparses-header-text2026-11-11 https://bugrater.com/releases/cve-2026-124693-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but-not-including-2026-4-1110-pivotgrid-and-pivotconfigurator-axis-field-names-are-passed-to-a-chi2026-11-11 https://bugrater.com/releases/cve-2026-124694-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but-not-including-2026-4-1110-propertygrid-does-not-encode-bound-property-values-and-items-descr2026-11-11 https://bugrater.com/releases/cve-2026-77873-an-improper-permissions-vulnerability-was-reported-in-lenovo-system-update-that-could-allow-a-local-authenticated-user-to-execute-code-with-elevated-privileges2026-11-11 https://bugrater.com/releases/cve-2026-77882-a-deserialization-of-untrusted-data-vulnerability-was-discovered-in-lenovo-system-update-that-could-allow-a-local-authenticated-user-to-execute-code-with-elevat2026-11-11 https://bugrater.com/releases/cve-2026-89061-during-an-internal-security-assessment-a-potential-vulnerability-was-discovered-in-lenovo-pc-manager-distributed-exclusively-in-the-chinese-market-that-could2026-11-11 https://bugrater.com/releases/cve-2026-106133-in-progress-telerik-report-server-prior-to-version-12-3-26-1110-an-incorrect-authorization-vulnerability-in-the-web-report-designer-allows-an-authenticated-a2026-11-11 https://bugrater.com/releases/cve-2026-107247-an-authorization-bypass-in-revive-adserver-6-0-0-through-6-0-8-allows-an-authenticated-manager-restricted-to-one-agency-to-access-or-modify-resources-belonging2026-11-11 https://bugrater.com/releases/cve-2026-107662-blind-sql-injection-in-revive-adserver-6-0-8-and-earlier-allows-an-authenticated-manager-restricted-to-one-agency-to-extract-arbitrary-database-values-through-t2026-11-11 https://bugrater.com/releases/cve-2026-108558-a-reflected-cross-site-scripting-vulnerability-in-the-conversion-statistics-pages-of-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacker-to-exe2026-11-11 https://bugrater.com/releases/cve-2026-108559-a-reflected-cross-site-scripting-vulnerability-in-the-iframe-invocation-options-of-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacker-to-execu2026-11-11 https://bugrater.com/releases/cve-2026-108560-a-reflected-cross-site-scripting-vulnerability-in-updates-history-php-in-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacker-to-execute-javascr2026-11-11 https://bugrater.com/releases/cve-2026-108561-a-stored-cross-site-scripting-vulnerability-in-the-report-date-selection-controls-of-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacker-to-exe2026-11-11 https://bugrater.com/releases/cve-2026-108562-a-stored-cross-site-scripting-vulnerability-in-maintenance-appendcode-check-php-in-revive-adserver-6-0-8-and-earlier-allows-an-authenticated-manager-to-execute2026-11-11 https://bugrater.com/releases/cve-2026-108563-spreadsheet-formula-injection-in-conversion-tracking-report-exports-in-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacker-to-submit-conversion2026-11-11 https://bugrater.com/releases/cve-2026-108564-a-reflected-cross-site-scripting-vulnerability-in-the-invocation-tag-generation-interface-of-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacke2026-11-11 https://bugrater.com/releases/cve-2026-108565-a-reflected-cross-site-scripting-vulnerability-in-the-popup-invocation-options-of-revive-adserver-6-0-8-and-earlier-allows-an-unauthenticated-attacker-to-execut2026-11-11 https://bugrater.com/releases/cve-2026-68485-an-authorization-bypass-in-website-index-php-in-revive-adserver-6-0-8-and-earlier-allows-an-authenticated-manager-restricted-to-one-agency-to-view-another-agenc2026-11-11 https://bugrater.com/releases/cve-2026-68486-an-authorization-bypass-in-campaign-zone-linking-in-revive-adserver-6-0-8-and-earlier-allows-an-authenticated-manager-or-a-trafficker-with-zone-linking-permiss2026-11-11 https://bugrater.com/releases/cve-2026-68862-dell-terraform-provider-for-dell-powerflex-contain-s-an-os-command-injection-vulnerability-in-the-sdc-host-provisioning-component-a-high-privileged-remote-att2026-11-11 https://bugrater.com/releases/cve-2026-77168-a-cross-site-request-forgery-vulnerability-in-tracker-invocation-php-in-revive-adserver-6-0-8-and-earlier-allows-an-attacker-to-modify-a-tracker-s-name-descrip2026-11-11 https://bugrater.com/releases/cve-2026-82978-an-authorization-bypass-in-channel-edit-php-in-revive-adserver-6-0-8-and-earlier-allows-an-authenticated-manager-to-create-a-delivery-rule-set-belonging-to-anot2026-11-11 https://bugrater.com/releases/cve-2026-108472-a-flaw-was-found-in-the-xfs-admin-utility-in-xfsprogs-the-tool-does-not-properly-validate-user-supplied-parameters-allowing-operating-system-command-injection2026-11-11 https://bugrater.com/releases/cve-2026-123828-a-one-byte-heap-buffer-overflow-in-node-js-http-2-alt-svc-handling-lets-a-remote-unauthenticated-attacker-corrupt-process-memory-when-an-application-passes-an2026-11-11 https://bugrater.com/releases/cve-2026-123829-a-permission-model-bypass-in-node-js-recursive-file-watching-discloses-the-names-of-files-and-directories-the-process-is-not-permitted-to-read-on-macos-and-win2026-11-11 https://bugrater.com/releases/cve-2026-123862-an-uncatchable-exception-in-the-node-js-zlib-streaming-api-lets-a-peer-crash-a-process-by-disconnecting-while-data-is-being-compressed-zlib-params-queues-a-f2026-11-11 https://bugrater.com/releases/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets-any-unauthenticated-client-abort-the-server-over-both-tls-and-cleartext-a-client-can-arrange-for2026-11-11 https://bugrater.com/releases/cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated-client-read-memory-belonging-to-other-connections-including-tls-private-keys-and-other-users-reque2026-11-11 https://bugrater.com/releases/cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js-server-memory-and-file-descriptors-if-a-peer-triggers-a-protocol-error-for-example-an-oversized2026-11-11 https://bugrater.com/releases/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak-response-memory-including-the-contents-of-other-connections-response-buffers-to-a-peer-when-a-st2026-11-11 https://bugrater.com/releases/cve-2026-123867-a-per-host-mutual-tls-authorization-bypass-in-node-js-lets-a-client-authorized-for-the-default-hostname-reach-a-protected-hostname-it-is-not-authorized-for-whe2026-11-11 https://bugrater.com/releases/cve-2026-123868-an-unauthenticated-http-2-client-can-exhaust-node-js-server-memory-because-inbound-data-queued-on-an-undrained-stream-is-charged-to-no-session-budget-each-inbo2026-11-11 https://bugrater.com/releases/cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config-error-messages-cve-2026-48615-established-that-a-proxy-credential-must-not-appear-in-a-node-js2026-11-11 https://bugrater.com/releases/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a-client-change-the-servername-during-tls-1-2-renegotiation-to-reach-endpoints-it-was-not-authori2026-11-11 https://bugrater.com/releases/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated-client-corrupt-server-memory-over-both-tls-and-cleartext-when-the-server-serves-files-with-respondw2026-11-11 https://bugrater.com/releases/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an-unauthenticated-client-crash-the-server-over-both-tls-and-cleartext-by-cancelling-file-downloads-when-th2026-11-11 https://bugrater.com/releases/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a-cached-tls-session-authenticated-under-one-ca-policy-be-reused-by-a-later-request-with-a-stricter2026-11-11 https://bugrater.com/releases/cve-2026-126766-opstree-rems-through-1-0-0-contains-an-improper-authorization-vulnerability-that-allows-authenticated-users-to-set-an-incident-s-reporter-to-another-user-by-sup2026-11-11 https://bugrater.com/releases/cve-2026-126767-opstree-rems-through-1-0-0-contains-a-prompt-injection-vulnerability-that-allows-authenticated-users-to-disclose-the-hidden-system-prompt-by-submitting-crafted2026-11-11 https://bugrater.com/releases/cve-2026-126768-opstree-rems-through-1-0-0-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-obtain-valid-jwts-by-setting-the-client-cont2026-11-11 https://bugrater.com/releases/cve-2026-126769-opstree-rems-through-1-0-0-contains-a-missing-authentication-vulnerability-that-allows-unauthenticated-remote-attackers-to-access-governance-api-endpoints-incl2026-11-11 https://bugrater.com/releases/cve-2026-126770-opstree-rems-through-1-0-0-contains-a-server-side-request-forgery-vulnerability-that-allows-authenticated-users-to-make-the-backend-connect-to-arbitrary-destina2026-11-11 https://bugrater.com/releases/cve-2026-126771-opstree-rems-through-1-0-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-attackers-to-inject-scripts-by-uploading-attachments-w2026-11-11 https://bugrater.com/releases/cve-2026-126772-opstree-rems-through-1-0-0-contains-an-improper-attribution-vulnerability-that-allows-authenticated-users-to-post-comments-as-the-incident-creator-via-post-api2026-11-11 https://bugrater.com/releases/cve-2026-126774-tinacms-mdx-before-2-4-2-contains-a-code-injection-vulnerability-in-its-mdx-serializer-which-writes-rich-text-values-into-mdx-expressions-without-escaping-the2026-11-11 https://bugrater.com/releases/cve-2026-126775-social-auth-core-4-7-0-before-7-0-0-contains-a-login-cross-site-request-forgery-vulnerability-in-the-saml-backend-that-restores-sessions-named-in-the-unsigned-r2026-11-11 https://bugrater.com/releases/cve-2026-126776-siyuan-3-7-0-before-3-8-10-on-windows-contains-a-path-traversal-vulnerability-in-kernel-util-webfetch-go-that-allows-attackers-to-write-files-outside-the-import2026-11-11 https://bugrater.com/releases/cve-2026-126777-traccar-3-15-before-6-17-0-contains-an-authentication-bypass-vulnerability-in-ldapprovider-login-that-fails-to-reject-empty-passwords-causing-ldap-binds-to-b2026-11-11 https://bugrater.com/releases/cve-2026-126778-wallos-4-4-0-before-5-10-3-contains-a-stored-cross-site-scripting-vulnerability-in-endpoints-cronjobs-sendnotifications-php-that-allows-registered-users-to-inje2026-11-11 https://bugrater.com/releases/cve-2026-126779-spatie-browsershot-2-2-0-before-5-5-0-contains-a-local-file-read-vulnerability-that-allows-attackers-to-read-server-files-by-supplying-root-relative-references2026-11-11 https://bugrater.com/releases/cve-2026-126780-webmin-through-2-670-contains-a-privilege-escalation-vulnerability-in-acl-save-group-cgi-that-allows-delegated-administrators-to-grant-unauthorized-modules-by-s2026-11-11 https://bugrater.com/releases/cve-2026-126781-webmin-through-2-670-contains-a-users-file-injection-vulnerability-in-acl-cert-issue-cgi-that-allows-authenticated-webmin-users-to-inject-lines-by-supplying-unv2026-11-11 https://bugrater.com/releases/cve-2026-91150-a-flaw-was-found-in-cockpit-this-vulnerability-allows-a-remote-attacker-without-prior-authentication-to-send-specially-crafted-fragmented-websocket-messages2026-11-11 https://bugrater.com/releases/cve-2026-0323-a-server-side-request-forgery-vulnerability-in-palo-alto-networks-checkov-by-prisma-cloud-enables-a-local-unauthenticated-user-to-make-unauthorized-network-req2026-11-11 https://bugrater.com/releases/cve-2026-0324-an-incorrect-privilege-management-vulnerability-in-the-opswat-metadefender-endpoint-security-sdk-used-by-the-palo-alto-networks-globalprotect-app-on-windows-de2026-11-11 https://bugrater.com/releases/cve-2026-0325-an-authorization-bypass-vulnerability-in-the-globalprotect-gateway-of-palo-alto-networks-pan-os-software-enables-an-authenticated-attacker-with-valid-globalpro2026-11-11 https://bugrater.com/releases/cve-2026-0326-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os-software-enables-an-unauthenticated-attacker-to-disrupt-service-processing-by-causing-a-service-pro2026-11-11 https://bugrater.com/releases/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway-of-palo-alto-networks-pan-os-software-enables-an-authenticated-lower-privileged-user-to-obta2026-11-11 https://bugrater.com/releases/cve-2026-0328-authentication-bypass-vulnerabilities-in-the-globalprotect-portal-and-gateway-of-palo-alto-networks-pan-os-software-enables-an-unauthenticated-user-to-bypass2026-11-11 https://bugrater.com/releases/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os-software-enables-an-unauthenticated-attacker-with-network-access-to-cause-a-denial-of-service-dos2026-11-11 https://bugrater.com/releases/cve-2026-0330-a-remote-code-execution-rce-vulnerability-in-palo-alto-networks-pan-os-software-on-panorama-enables-an-authenticated-administrator-with-network-access-to-exe2026-11-11 https://bugrater.com/releases/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan-os-software-enables-an-unauthenticated-remote-attacker-with-network-access-to-obtain-sensiti2026-11-11 https://bugrater.com/releases/cve-2026-126784-missing-rate-limiting-per-account-submission-quota-and-geographic-validation-in-the-publicar-aviso-rpc-function-in-lagarto-chivato-0-4-1-and-earlier-on-web-all2026-11-11 https://bugrater.com/releases/cve-2026-126815-pre-account-hijacking-in-the-authentication-flow-in-lagarto-chivato-0-4-1-and-earlier-on-web-allows-remote-unauthenticated-attackers-to-take-over-arbitrary-acco2026-11-11 https://bugrater.com/releases/cve-2026-91151-a-flaw-was-found-in-cockpit-a-local-authenticated-user-with-control-over-a-target-account-s-home-directory-can-exploit-a-privileged-symlink-dereference-vulnera2026-11-11 https://bugrater.com/releases/cve-2026-126797-nextscan-1-1-0-through-1-2-0-contains-an-authentication-bypass-vulnerability-in-ns-admin-that-allows-unauthenticated-attackers-to-forge-administrator-tokens-usi2026-11-11 https://bugrater.com/releases/cve-2026-126798-nextscan-1-1-0-through-1-2-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-ns-admin-url-asset-detail-dialog-that-renders-crawled-form-request-bodi2026-11-11 https://bugrater.com/releases/cve-2026-126799-gotenberg-8-31-0-before-8-38-0-contains-a-server-side-request-forgery-vulnerability-in-ispublicip-that-allows-unauthenticated-attackers-to-bypass-private-ip-d2026-11-11 https://bugrater.com/releases/cve-2026-126800-hydro-hydrooj-ui-default-before-4-59-1-contains-a-stored-cross-site-scripting-vulnerability-that-allows-registered-users-to-inject-script-by-placing-double-quo2026-11-11 https://bugrater.com/releases/cve-2026-126801-rote-1-2-0-through-2-6-0-contains-an-authorization-bypass-in-the-oauth-bind-merge-endpoint-that-allows-authenticated-users-to-merge-any-oauth-bound-account-into2026-11-11 https://bugrater.com/releases/cve-2026-126802-nextscan-1-1-0-through-1-2-0-contains-hardcoded-http-basic-auth-credentials-in-ns-admin-s-authagent-and-authexternal-routers-that-allow-unauthenticated-attacker2026-11-11 https://bugrater.com/releases/cve-2026-126803-rote-through-2-6-0-contains-a-privilege-escalation-vulnerability-that-allows-authenticated-admins-to-obtain-super-admin-rights-by-reading-or-overwriting-jwt-sig2026-11-11 https://bugrater.com/releases/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal-vulnerability-in-the-ads-plugin-deleteimage-json-php-that-allows-authenticated-users-with-custom-ads-t2026-11-11 https://bugrater.com/releases/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization-vulnerability-that-allows-delegated-videos-admin-users-to-obtain-video-id-hash-values-bound-to-an2026-11-11 https://bugrater.com/releases/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site-scripting-vulnerability-that-allows-uploaders-to-inject-scripts-via-the-videodownloadedlink-value-s2026-11-11 https://bugrater.com/releases/cve-2026-126807-wuzapi-through-1-1-0-contains-a-cross-tenant-information-disclosure-vulnerability-in-the-gethistory-handler-that-allows-authenticated-users-to-view-other-tenant2026-11-11 https://bugrater.com/releases/cve-2026-126808-wedevs-erp-wp-erp-through-1-17-11-contains-an-incorrect-authorization-vulnerability-that-allows-authenticated-employees-to-edit-their-own-hr-records-because-h2026-11-11 https://bugrater.com/releases/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization-vulnerability-in-objects-import-json-php-that-allows-uploaders-to-import-other-users-mp4-files-by-r2026-11-11 https://bugrater.com/releases/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site-scripting-vulnerability-that-allows-registered-users-to-inject-markup-through-the-channel-about-f2026-11-11 https://bugrater.com/releases/cve-2026-126811-bookstack-before-26-09-3-contains-an-incorrect-authorization-vulnerability-that-allows-authenticated-users-to-access-other-users-unpublished-draft-page-images2026-11-11 https://bugrater.com/releases/cve-2026-126812-blueprintue-self-hosted-edition-before-4-3-7-contains-an-insecure-default-configuration-in-its-docker-compose-examples-that-sets-mysql-allow-empty-password-yes2026-11-11 https://bugrater.com/releases/cve-2026-126813-roundcube-webmail-before-1-6-21-and-1-7-x-before-1-7-6-contains-an-imap-command-injection-vulnerability-that-allows-attackers-to-inject-commands-via-crlf-in-the2026-11-11 https://bugrater.com/releases/cve-2026-126814-blueprintue-self-hosted-edition-before-4-3-6-contains-an-iframe-injection-vulnerability-that-allows-authenticated-users-to-embed-arbitrary-third-party-content-b2026-11-11 https://bugrater.com/releases/cve-2026-111521-dell-display-and-peripheral-manager-ddpm-windows-versions-prior-to-2-4-0-17-contain-a-time-of-check-time-of-use-toctou-condition-vulnerability-a-low-priv2026-11-11 https://bugrater.com/releases/cve-2026-121528-a-improper-certificate-validation-vulnerability-in-fortinet-fortios-7-6-0-through-7-6-4-fortios-7-4-0-through-7-4-9-fortios-7-2-0-through-7-2-13-may-allow-a-r2026-11-11 https://bugrater.com/releases/cve-2026-126144-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail2026-11-11 https://bugrater.com/releases/cve-2026-126145-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail2026-11-11 https://bugrater.com/releases/cve-2026-126146-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail2026-11-11 https://bugrater.com/releases/cve-2026-126147-a-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-throug2026-11-11 https://bugrater.com/releases/cve-2026-126148-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail2026-11-11 https://bugrater.com/releases/cve-2026-126149-a-integer-overflow-or-wraparound-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-7-4-8-fortimai2026-11-11 https://bugrater.com/releases/cve-2026-126150-a-weak-password-recovery-mechanism-for-forgotten-password-vulnerability-in-fortinet-fortimail-8-0-0-fortimail-7-6-0-through-7-6-5-fortimail-7-4-0-through-7-42026-11-11 https://bugrater.com/releases/cve-2026-126151-a-incorrect-implementation-of-authentication-algorithm-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-t2026-11-11 https://bugrater.com/releases/cve-2026-126152-a-authorization-bypass-through-user-controlled-key-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-throu2026-11-11 https://bugrater.com/releases/cve-2026-126153-a-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-throug2026-11-11 https://bugrater.com/releases/cve-2026-126154-a-out-of-bounds-write-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-7-4-8-fortimail-7-2-all-v2026-11-11 https://bugrater.com/releases/cve-2026-126155-a-incorrect-authorization-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-7-4-8-fortimail-7-2-a2026-11-11 https://bugrater.com/releases/cve-2026-126156-a-authorization-bypass-through-user-controlled-key-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-throu2026-11-11 https://bugrater.com/releases/cve-2026-126157-a-improper-authentication-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-7-4-8-fortimail-7-2-a2026-11-11 https://bugrater.com/releases/cve-2026-126158-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-may-allow-a2026-11-11 https://bugrater.com/releases/cve-2026-126159-a-authorization-bypass-through-user-controlled-key-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-throu2026-11-11 https://bugrater.com/releases/cve-2026-126160-a-improper-authentication-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-7-4-8-fortimail-7-2-a2026-11-11 https://bugrater.com/releases/cve-2026-126161-a-uncontrolled-resource-consumption-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-7-4-6-may-al2026-11-11 https://bugrater.com/releases/cve-2026-126162-a-xml-injection-aka-blind-xpath-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-may-allow-a-remote-unauthenti2026-11-11 https://bugrater.com/releases/cve-2026-126163-a-use-of-externally-controlled-format-string-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-may-allow-a-remote-unauthenticated-attacker-to-execute-unau2026-11-11 https://bugrater.com/releases/cve-2026-126164-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-02026-11-11 https://bugrater.com/releases/cve-2026-126165-a-memory-allocation-with-excessive-size-value-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-0-through-7-6-6-fortimail-7-4-0-through-72026-11-11 https://bugrater.com/releases/cve-2026-126166-a-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-2-fortimail-7-6-0-th2026-11-11 https://bugrater.com/releases/cve-2026-126167-a-improper-neutralization-of-special-elements-used-in-a-command-command-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-2-fortimail-7-6-0-t2026-11-11 https://bugrater.com/releases/cve-2026-126168-a-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-2-fortimail-7-6-0-th2026-11-11 https://bugrater.com/releases/cve-2026-126169-a-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-2-fortimail-7-6-0-th2026-11-11 https://bugrater.com/releases/cve-2026-126170-a-improper-encoding-or-escaping-of-output-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-2-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-cloud-82026-11-11 https://bugrater.com/releases/cve-2026-126171-a-use-of-externally-controlled-format-string-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-02026-11-11 https://bugrater.com/releases/cve-2026-126175-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortianalyzer-7-6-0-through-7-6-7-fortianalyze2026-11-11 https://bugrater.com/releases/cve-2026-126176-a-xml-injection-aka-blind-xpath-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-112026-11-11 https://bugrater.com/releases/cve-2026-126177-a-xml-injection-aka-blind-xpath-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-112026-11-11 https://bugrater.com/releases/cve-2026-126178-a-heap-based-buffer-overflow-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-112026-11-11 https://bugrater.com/releases/cve-2026-126179-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-02026-11-11 https://bugrater.com/releases/cve-2026-126180-a-improper-neutralization-of-special-elements-used-in-a-template-engine-vulnerability-in-fortinet-fortimanager-8-0-0-through-8-0-1-fortimanager-7-6-0-through-72026-11-11 https://bugrater.com/releases/cve-2026-126181-a-use-of-hard-coded-credentials-vulnerability-in-fortinet-fortimanager-8-0-0-through-8-0-1-fortimanager-7-6-0-through-7-6-7-fortimanager-7-4-0-through-7-4-112026-11-11 https://bugrater.com/releases/cve-2026-126182-a-improper-control-of-generation-of-code-code-injection-vulnerability-in-fortinet-fortimanager-8-0-0-through-8-0-1-fortimanager-7-6-0-through-7-6-7-fortim2026-11-11 https://bugrater.com/releases/cve-2026-126183-a-authorization-bypass-through-user-controlled-key-vulnerability-in-fortinet-fortimanager-8-0-0-through-8-0-1-fortimanager-7-6-0-through-7-6-7-fortimanager-72026-11-11 https://bugrater.com/releases/cve-2026-126184-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through2026-11-11 https://bugrater.com/releases/cve-2026-126185-a-improper-control-of-generation-of-code-code-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fort2026-11-11 https://bugrater.com/releases/cve-2026-126211-a-improper-privilege-management-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-1-through-7-6-7-fortianalyzer-cloud-8-0-0-throug2026-11-11 https://bugrater.com/releases/cve-2026-126212-a-heap-based-buffer-overflow-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-112026-11-11 https://bugrater.com/releases/cve-2026-126213-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyze2026-11-11 https://bugrater.com/releases/cve-2026-126214-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through2026-11-11 https://bugrater.com/releases/cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-11-fo2026-11-11 https://bugrater.com/releases/cve-2026-126216-a-improper-privilege-management-vulnerability-in-fortinet-fortimanager-8-0-0-fortimanager-7-6-0-through-7-6-7-fortimanager-7-4-0-through-7-4-11-fortimanager2026-11-11 https://bugrater.com/releases/cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-11-fo2026-11-11 https://bugrater.com/releases/cve-2026-126218-a-authorization-bypass-through-user-controlled-key-vulnerability-in-fortinet-fortimanager-8-0-0-through-8-0-1-fortimanager-7-6-0-through-7-6-7-fortimanager-72026-11-11 https://bugrater.com/releases/cve-2026-126219-a-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-0-through-7-62026-11-11 https://bugrater.com/releases/cve-2026-126220-a-improper-neutralization-of-special-elements-in-output-used-by-a-downstream-component-injection-vulnerability-in-fortinet-fortimanager-8-0-0-fortimanager2026-11-11 https://bugrater.com/releases/cve-2026-126221-a-improper-neutralization-of-special-elements-in-output-used-by-a-downstream-component-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyze2026-11-11 https://bugrater.com/releases/cve-2026-126222-a-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-62026-11-11 https://bugrater.com/releases/cve-2026-126223-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-112026-11-11 https://bugrater.com/releases/cve-2026-126224-a-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-0-through2026-11-11 https://bugrater.com/releases/cve-2026-126225-a-missing-authorization-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-7-fortianalyzer-cloud-8-0-0-through-8-0-1-fortianalyzer2026-11-11 https://bugrater.com/releases/cve-2026-126226-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-02026-11-11 https://bugrater.com/releases/cve-2026-126227-a-unintended-proxy-or-intermediary-confused-deputy-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianal2026-11-11 https://bugrater.com/releases/cve-2026-126228-a-out-of-bounds-write-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-7-4-11-fortia2026-11-11 https://bugrater.com/releases/cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer2026-11-11 https://bugrater.com/releases/cve-2026-126230-a-use-of-externally-controlled-format-string-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-02026-11-11 https://bugrater.com/releases/cve-2026-126231-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-7-6-02026-11-11 https://bugrater.com/releases/cve-2026-126232-a-improper-certificate-validation-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer-7-4-0-through-72026-11-11 https://bugrater.com/releases/cve-2026-126233-a-unrestricted-upload-of-file-with-dangerous-type-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-6-0-through-7-6-7-fortianalyzer2026-11-11 https://bugrater.com/releases/cve-2026-126234-a-improper-neutralization-of-special-elements-used-in-a-template-engine-vulnerability-in-fortinet-fortianalyzer-8-0-0-fortianalyzer-cloud-8-0-0-fortimanager-82026-11-11 https://bugrater.com/releases/cve-2026-126235-a-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyzer-7-62026-11-11 https://bugrater.com/releases/cve-2026-126236-a-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortia2026-11-11 https://bugrater.com/releases/cve-2026-126237-a-loop-with-unreachable-exit-condition-infinite-loop-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-62026-11-11 https://bugrater.com/releases/cve-2026-126238-a-incorrect-authorization-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-unauthenticated2026-11-11 https://bugrater.com/releases/cve-2026-126239-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-unauthentic2026-11-11 https://bugrater.com/releases/cve-2026-126240-a-improper-neutralization-of-special-elements-used-in-an-ldap-query-ldap-injection-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiau2026-11-11 https://bugrater.com/releases/cve-2026-126241-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiau2026-11-11 https://bugrater.com/releases/cve-2026-126242-a-incorrect-authorization-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-attacker-to-byp2026-11-11 https://bugrater.com/releases/cve-2026-126243-a-incorrect-authorization-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-attacker-to-byp2026-11-11 https://bugrater.com/releases/cve-2026-126244-a-allocation-of-resources-without-limits-or-throttling-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-102026-11-11 https://bugrater.com/releases/cve-2026-126245-a-out-of-bounds-write-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-unauthenticated-att2026-11-11 https://bugrater.com/releases/cve-2026-126246-a-null-pointer-dereference-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-unauthenticate2026-11-11 https://bugrater.com/releases/cve-2026-126247-a-use-of-externally-controlled-format-string-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow2026-11-11 https://bugrater.com/releases/cve-2026-126248-a-insufficiently-protected-credentials-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-un2026-11-11 https://bugrater.com/releases/cve-2026-126249-a-improper-privilege-management-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-authentic2026-11-11 https://bugrater.com/releases/cve-2026-126250-a-incorrect-authorization-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-unauthenticated2026-11-11 https://bugrater.com/releases/cve-2026-126251-a-incorrect-authorization-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-attacker-to-byp2026-11-11 https://bugrater.com/releases/cve-2026-126252-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiau2026-11-11 https://bugrater.com/releases/cve-2026-126253-a-authentication-bypass-by-primary-weakness-vulnerability-in-fortinet-fortios-8-0-0-through-8-0-1-fortios-7-6-0-through-7-6-7-fortios-7-4-0-through-7-4-12-fo2026-11-11 https://bugrater.com/releases/cve-2026-126254-a-numeric-truncation-error-vulnerability-in-fortinet-fortios-8-0-0-through-8-0-1-fortios-7-6-0-through-7-6-7-fortios-7-4-0-through-7-4-12-fortios-7-2-0-throu2026-11-11 https://bugrater.com/releases/cve-2026-126255-a-path-traversal-filedir-vulnerability-in-fortinet-fortios-8-0-0-through-8-0-1-fortios-7-6-0-through-7-6-7-fortios-7-4-0-through-7-4-12-fortios-7-2-0-t2026-11-11 https://bugrater.com/releases/cve-2026-126256-a-out-of-bounds-read-vulnerability-in-fortinet-fortios-8-0-0-through-8-0-1-fortios-7-6-0-through-7-6-7-fortios-7-4-all-versions-fortios-7-2-all-versions-for2026-11-11 https://bugrater.com/releases/cve-2026-126257-a-use-of-hard-coded-password-vulnerability-in-fortinet-fortiauthenticator-8-0-0-through-8-0-3-fortiauthenticator-6-6-0-through-6-6-10-may-allow-an-unauthentica2026-11-11 https://bugrater.com/releases/cve-2026-126258-a-stack-based-buffer-overflow-vulnerability-in-fortinet-fortios-8-0-0-fortios-7-6-7-may-allow-an-unauthenticated-attacker-with-wad-port-access-to-crash-proxy-o2026-11-11 https://bugrater.com/releases/cve-2026-126259-a-missing-authentication-for-critical-function-vulnerability-in-fortinet-fortios-8-0-0-fortios-7-6-0-through-7-6-7-fortios-7-4-0-through-7-4-12-fortios-7-2-02026-11-11 https://bugrater.com/releases/cve-2026-126262-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortianalyzer-8-0-0-through-8-0-1-fortianalyze2026-11-11 https://bugrater.com/releases/cve-2026-126263-a-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-fortinet-fortimail-8-0-0-through-8-0-1-fortimail-7-6-02026-11-11 https://bugrater.com/releases/cve-2026-126757-a-security-vulnerability-has-been-detected-in-moonshot-ai-kimi-code-up-to-2-5-2-this-affects-the-function-isoriginallowed-of-the-file-apps-kimi-code-dist-web-a2026-11-11 https://bugrater.com/releases/cve-2026-126758-a-vulnerability-was-detected-in-moonshot-ai-kimi-code-up-to-2-0-2-this-vulnerability-affects-unknown-code-of-the-file-kimi-code-local-toml-of-the-component-wo2026-11-11 https://bugrater.com/releases/cve-2026-126932-zipline-4-6-2-before-4-8-0-contains-a-policy-bypass-vulnerability-that-allows-authenticated-users-to-evade-administrator-disabled-mime-types-by-editing-file-met2026-11-11 https://bugrater.com/releases/cve-2026-126933-zipline-4-0-0-before-4-8-0-contains-an-upload-filter-bypass-vulnerability-that-allows-users-with-upload-access-to-store-blocked-file-types-due-to-extension-form2026-11-11 https://bugrater.com/releases/cve-2026-126934-zipline-4-3-2-before-4-8-0-contains-a-rate-limit-bypass-vulnerability-that-allows-unauthenticated-attackers-to-evade-throttling-by-spoofing-x-forwarded-for-head2026-11-11 https://bugrater.com/releases/cve-2026-126935-zipline-before-4-8-0-contains-a-race-condition-vulnerability-in-src-server-routes-raw-id-ts-that-allows-remote-attackers-to-bypass-file-maxviews-limits-throug2026-11-11 https://bugrater.com/releases/stable-channel-update-for-desktop-157-0-8103-78-792026-11-12 https://bugrater.com/releases/data-field-moderately-critical-cross-site-scripting-sa-contrib-2026-3392026-11-12 https://bugrater.com/releases/file-resumable-upload-moderately-critical-improper-authorization-sa-contrib-2026-3382026-11-12 https://bugrater.com/releases/s3-file-system-cors-upload-moderately-critical-improper-authorization-sa-contrib-2026-3372026-11-12 https://bugrater.com/releases/real-name-moderately-critical-twig-injection-sa-contrib-2026-3362026-11-12 https://bugrater.com/releases/layout-builder-iframe-modal-moderately-critical-cross-site-scripting-sa-contrib-2026-3352026-11-12 https://bugrater.com/releases/cookies-consent-management-moderately-critical-cross-site-scripting-sa-contrib-2026-3342026-11-12 https://bugrater.com/releases/commerce-sermepa-moderately-critical-improper-authorization-sa-contrib-2026-3332026-11-12 https://bugrater.com/releases/smart-trim-moderately-critical-cross-site-scripting-sa-contrib-2026-3322026-11-12 https://bugrater.com/releases/cve-2026-126759-a-flaw-has-been-found-in-h3c-icg2000-unified-communication-gateway-2023-this-issue-affects-some-unknown-processing-of-the-file-wnm-check-j-of-the-component-we2026-11-12 https://bugrater.com/releases/cve-2026-125785-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-crocoblock-jetengine-jet-engine-allows-stored-xss-this-iss2026-11-12 https://bugrater.com/releases/cve-2026-125786-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-expresstech-quiz-and-survey-master-quiz-master-next-allows-code-i2026-11-12 https://bugrater.com/releases/cve-2026-125787-missing-authorization-vulnerability-in-expresstech-quiz-and-survey-master-quiz-master-next-allows-exploiting-incorrectly-configured-access-control-security-leve2026-11-12 https://bugrater.com/releases/cve-2026-126785-a-vulnerability-has-been-found-in-rmalright-tr-vision-home-2-0-5-impacted-is-the-function-sub-11504-in-the-library-wfanmanager-sys-of-the-component-ioctl-handl2026-11-12 https://bugrater.com/releases/cve-2026-126795-a-vulnerability-was-determined-in-tooljet-up-to-3-20-256-lts-3-21-93-beta-the-impacted-element-is-the-function-activateuserwithpassword-of-the-file-server-src2026-11-12 https://bugrater.com/releases/cve-2026-111433-unix-symbolic-link-symlink-following-vulnerability-in-openeuler-isulad-on-linux-this-vulnerability-is-associated-with-program-file-src-daemon-modules-spec-s2026-11-12 https://bugrater.com/releases/cve-2026-111434-use-of-externally-controlled-format-string-vulnerability-in-openeuler-isulad-on-linux-this-vulnerability-is-associated-with-program-file-src-daemon-modules-im2026-11-12 https://bugrater.com/releases/cve-2026-111435-relative-path-traversal-vulnerability-in-openeuler-isulad-on-linux-this-vulnerability-is-associated-with-program-file-src-daemon-modules-image-oci-oci-load-c2026-11-12 https://bugrater.com/releases/cve-2026-111436-missing-release-of-memory-after-effective-lifetime-vulnerability-in-openeuler-isulad-on-linux-this-vulnerability-is-associated-with-program-file-src-daemon-mo2026-11-12 https://bugrater.com/releases/cve-2026-124993-an-incorrect-authorization-vulnerability-in-the-security-advisor-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-atta2026-11-12 https://bugrater.com/releases/cve-2026-13656-an-improper-neutralization-of-input-during-web-page-generation-vulnerability-in-the-audio-player-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and2026-11-12 https://bugrater.com/releases/cve-2026-15198-a-missing-authentication-for-critical-functionality-vulnerability-in-the-webdav-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-12026-11-12 https://bugrater.com/releases/cve-2026-15201-an-improper-certificate-validation-vulnerability-in-the-support-form-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-man-in2026-11-12 https://bugrater.com/releases/cve-2026-16550-an-external-control-of-file-name-or-path-vulnerability-in-the-media-parser-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-r2026-11-12 https://bugrater.com/releases/cve-2026-18633-an-access-of-uninitialized-pointer-vulnerability-in-the-nfsd-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-attacker2026-11-12 https://bugrater.com/releases/cve-2026-18792-an-improper-limitation-of-a-pathname-to-a-restricted-directory-vulnerability-in-the-sharing-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-72026-11-12 https://bugrater.com/releases/cve-2026-19048-an-improper-link-resolution-before-file-access-vulnerability-in-the-thumb-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-re2026-11-12 https://bugrater.com/releases/cve-2026-19414-a-missing-authorization-vulnerability-in-the-promotion-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-authentica2026-11-12 https://bugrater.com/releases/cve-2026-19833-a-missing-authorization-vulnerability-in-the-acl-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-authenticated-us2026-11-12 https://bugrater.com/releases/cve-2026-74850-an-improper-limitation-of-a-pathname-to-a-restricted-directory-vulnerability-in-the-contentextract-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-an2026-11-12 https://bugrater.com/releases/cve-2026-74857-a-missing-critical-step-in-authentication-vulnerability-in-the-auth-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remo2026-11-12 https://bugrater.com/releases/cve-2026-75785-an-improper-neutralization-of-special-elements-used-in-an-os-command-vulnerability-in-the-vpn-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and2026-11-12 https://bugrater.com/releases/cve-2026-76954-an-improper-neutralization-of-special-elements-used-in-an-sql-command-vulnerability-in-the-auth-api-in-synology-diskstation-manager-dsm-before-7-2-1-69057-132026-11-12 https://bugrater.com/releases/cve-2026-77738-a-server-side-request-forgery-vulnerability-in-the-credential-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-aut2026-11-12 https://bugrater.com/releases/cve-2026-81557-an-improper-neutralization-of-input-during-web-page-generation-vulnerability-in-the-dsmnotify-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-42026-11-12 https://bugrater.com/releases/cve-2026-81558-a-missing-authorization-vulnerability-in-the-socketio-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-authenticat2026-11-12 https://bugrater.com/releases/cve-2026-81559-a-missing-authorization-vulnerability-in-the-taskscheduler-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-authen2026-11-12 https://bugrater.com/releases/cve-2026-81584-an-improper-neutralization-of-special-elements-used-in-an-sql-command-vulnerability-in-the-user-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-a2026-11-12 https://bugrater.com/releases/cve-2026-85098-a-reachable-assertion-vulnerability-in-the-synoscgi-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-remote-attackers-to-cond2026-11-12 https://bugrater.com/releases/cve-2026-85101-an-authentication-bypass-using-an-alternate-path-or-channel-vulnerability-in-the-rsync-in-synology-diskstation-manager-dsm-before-7-2-1-69057-13-7-2-2-728062026-11-12 https://bugrater.com/releases/cve-2026-86343-an-improper-neutralization-of-crlf-sequences-vulnerability-in-the-snmp-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-90080-1-allows-r2026-11-12 https://bugrater.com/releases/cve-2026-87801-an-insertion-of-sensitive-information-into-sent-data-vulnerability-in-the-api-framework-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-9002026-11-12 https://bugrater.com/releases/cve-2026-88266-an-external-control-of-system-or-configuration-setting-vulnerability-in-the-synomount-in-synology-diskstation-manager-dsm-before-7-3-2-86009-5-and-7-4-1-900802026-11-12 https://bugrater.com/releases/cve-2026-92379-an-improper-neutralization-of-input-during-web-page-generation-vulnerability-in-the-notification-api-in-synology-diskstation-manager-dsm-before-7-3-2-86009-52026-11-12 https://bugrater.com/releases/cve-2026-106027-the-oxygen-mydata-for-woocommerce-wordpress-plugin-before-3-0-9-does-not-have-proper-authorisation-nor-validate-the-authenticity-of-the-request-on-one-of-its2026-11-12 https://bugrater.com/releases/cve-2026-110041-the-crop-thumbnails-wordpress-plugin-before-1-10-0-does-not-perform-object-level-authorization-when-reading-and-re-cropping-media-attachments-allowing-any-auth2026-11-12 https://bugrater.com/releases/cve-2026-110072-the-photo-gallery-by-10web-wordpress-plugin-before-1-8-49-does-not-escape-a-shortcode-attribute-that-sets-a-gallery-watermark-image-before-rendering-it-into-an2026-11-12 https://bugrater.com/releases/cve-2026-110959-the-descope-wordpress-plugin-before-1-2-0-does-not-validate-the-authentication-token-it-receives-before-creating-a-wordpress-session-accepting-any-non-empty-to2026-11-12 https://bugrater.com/releases/cve-2026-118421-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not-properly-sanitise-and-escape-a-parameter-used-to-order-results-on-one-of-its-admin-screens-before-us2026-11-12 https://bugrater.com/releases/cve-2026-118531-the-directorist-ai-powered-business-directory-listings-classified-ads-wordpress-plugin-before-8-11-1-does-not-prevent-a-listing-s-own-author-from-changing-i2026-11-12 https://bugrater.com/releases/cve-2026-118597-akaunting-3-3-0-contains-a-stored-cross-site-scripting-vulnerability-in-custom-invoice-payment-terms-an-authenticated-manager-can-save-a-crafted-custom-payment2026-11-12 https://bugrater.com/releases/cve-2026-119039-the-defender-security-wordpress-plugin-before-6-4-1-does-not-verify-that-the-client-ip-address-it-derives-for-its-firewall-and-lockout-decisions-actually-origi2026-11-12 https://bugrater.com/releases/cve-2026-119040-the-defender-security-wordpress-plugin-before-6-4-1-does-not-limit-the-number-of-failed-two-factor-authentication-attempts-in-its-default-configuration-allowi2026-11-12 https://bugrater.com/releases/cve-2026-121498-the-askany-wordpress-plugin-before-2-2-1-does-not-verify-that-a-chat-session-belongs-to-the-requester-before-returning-or-changing-it-allowing-unauthenticated2026-11-12 https://bugrater.com/releases/cve-2026-122003-the-abilities-bridge-wordpress-plugin-before-1-4-2-does-not-require-a-valid-nonce-before-re-authenticating-a-rest-api-request-from-the-logged-in-session-cookie2026-11-12 https://bugrater.com/releases/cve-2026-123044-the-contentpen-wordpress-plugin-before-1-1-1-discloses-its-rest-api-key-to-unauthenticated-users-who-can-then-use-it-to-create-posts-containing-unfiltered-java2026-11-12 https://bugrater.com/releases/cve-2026-123092-the-wp-remote-users-sync-wordpress-plugin-before-2-3-0-does-not-restrict-which-user-metadata-keys-may-be-written-through-its-incoming-user-synchronisation-reque2026-11-12 https://bugrater.com/releases/cve-2026-124647-the-ti-woocommerce-wishlist-wordpress-plugin-before-2-0-7-does-not-sanitise-and-escape-user-input-before-using-it-in-a-sql-statement-in-a-front-end-endpoint-al2026-11-12 https://bugrater.com/releases/cve-2026-124648-the-ti-woocommerce-wishlist-wordpress-plugin-before-2-13-0-does-not-verify-that-a-visitor-who-is-not-logged-in-owns-a-registered-user-s-wishlist-before-letting2026-11-12 https://bugrater.com/releases/cve-2026-124652-the-mine-cloudvod-wordpress-plugin-before-2-6-6-does-not-verify-that-an-order-belongs-to-the-requesting-user-before-returning-its-payment-status-allowing-any-a2026-11-12 https://bugrater.com/releases/cve-2026-124653-the-mine-cloudvod-wordpress-plugin-before-2-6-6-does-not-restrict-who-can-request-cloud-storage-upload-credentials-from-several-of-its-rest-api-routes-allowing2026-11-12 https://bugrater.com/releases/cve-2026-124665-the-order-tracking-wordpress-plugin-before-3-6-2-does-not-verify-that-a-visitor-owns-the-customer-or-sales-representative-account-whose-orders-they-request-an2026-11-12 https://bugrater.com/releases/cve-2026-124814-the-ultimate-addons-for-elementor-forms-wordpress-plugin-before-1-0-8-does-not-properly-validate-the-extension-of-uploaded-files-in-its-bundled-file-upload-fiel2026-11-12 https://bugrater.com/releases/cve-2026-124815-the-clockinator-lite-wordpress-plugin-before-1-1-0-does-not-restrict-access-to-several-of-its-record-deletion-actions-and-uses-a-user-supplied-table-name-in-a2026-11-12 https://bugrater.com/releases/cve-2026-124817-the-clockinator-lite-wordpress-plugin-before-1-1-0-does-not-check-authorisation-or-ownership-when-updating-leave-requests-allowing-unauthenticated-users-to-mod2026-11-12 https://bugrater.com/releases/cve-2026-76792-the-user-verification-by-pickplugins-wordpress-plugin-before-2-0-49-does-not-rate-limit-the-verification-step-of-its-one-time-password-login-and-does-not-expir2026-11-12 https://bugrater.com/releases/cve-2026-12507-zohocorp-manageengine-assetexplorer-versions-below-7860-servicedesk-plus-versions-below-15290-servicedesk-plus-msp-versions-below-15150-and-supportcenter-plu2026-11-12 https://bugrater.com/releases/cve-2026-12591-zohocorp-manageengine-m365-manager-plus-versions-below-4818-is-affected-by-an-authenticated-technician-may-exploit-insufficient-permission-validation-in-the-del2026-11-12 https://bugrater.com/releases/cve-2026-87772-incorrect-authorization-vulnerability-in-t-b-tak-b-lgem-software-technologies-research-institute-pardus-about-allows-privilege-escalation-this-issue-affects-p2026-11-12 https://bugrater.com/releases/cve-2026-8331-an-unrestricted-upload-of-files-with-dangerous-type-vulnerability-in-the-microchip-timepictra-platform-allows-functionality-not-properly-constrained-by-access-c2026-11-12 https://bugrater.com/releases/cve-2026-8332-a-hard-coded-root-password-in-microchip-timepictra-platform-installation-files-could-allow-an-attacker-with-access-to-those-files-to-obtain-privileged-credentia2026-11-12 https://bugrater.com/releases/cve-2026-8333-a-stored-cross-site-scripting-vulnerability-in-microchip-the-timepictra-platform-could-allow-an-authenticated-low-privileged-attacker-to-store-malicious-script2026-11-12 https://bugrater.com/releases/cve-2026-118855-akaunting-3-3-0-contains-a-stored-cross-site-scripting-vulnerability-through-invoice-import-an-authenticated-user-with-invoice-creation-permission-can-import-h2026-11-12 https://bugrater.com/releases/cve-2026-125836-cross-site-request-forgery-csrf-vulnerability-in-nicu-micle-simple-jwt-login-simple-jwt-login-allows-cross-site-request-forgery-this-issue-affects-simple-jwt2026-11-12 https://bugrater.com/releases/cve-2026-126991-the-wikidata-lookup-expansion-module-wiki-py-in-misp-misp-modules-contained-a-sparql-injection-vulnerability-the-handler-function-constructed-a-sparql-query2026-11-12 https://bugrater.com/releases/cve-2026-82292-a-null-pointer-dereference-vulnerability-in-the-qt-framework-qdomdocument-setcontent-xml-parsing-path-of-the-qt-xml-module-qtbase2026-11-12 https://bugrater.com/releases/cve-2026-118975-in-progress-telerik-reporting-prior-to-version-20-3-26-1110-improper-restriction-of-xml-external-entity-references-in-the-svg-processing-engine-allows-an-aut2026-11-12 https://bugrater.com/releases/cve-2026-123765-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-apache-sling-xss-xssapi-getstyletoken-accepts-markup-in2026-11-12 https://bugrater.com/releases/cve-2026-76173-blind-sql-injection-vulnerability-in-the-public-endpoint-public-webhook-receiver-php-of-the-whatsapp-module-for-dolibarr-1-9-the-phone-number-value-derived-f2026-11-12 https://bugrater.com/releases/cve-2026-124023-out-of-bounds-read-vulnerability-in-the-guththila-xml-parser-wrapper-of-apache-axis2-c-on-some-malformed-xml-input-the-guththila-parser-returned-a-raw-input-by2026-11-12 https://bugrater.com/releases/cve-2026-126641-a-host-key-verification-flaw-was-found-in-ansible-pylibssh-and-in-the-ansible-netcommon-libssh-connection-plugin-when-trust-on-first-use-is-enabled-host-key-a2026-11-12 https://bugrater.com/releases/cve-2026-126643-a-cleartext-storage-flaw-was-found-in-the-aap-gateway-operator-when-reconciling-an-automationcontroller-the-operator-reads-the-protected-resource-server-secre2026-11-12 https://bugrater.com/releases/cve-2026-13764-the-masterstudy-education-wordpress-theme-theme-for-wordpress-is-vulnerable-to-privilege-escalation-in-all-versions-up-to-and-including-4-8-151-this-is-due2026-11-12 https://bugrater.com/releases/cve-2026-15309-the-coursecure-courses-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-versions-up-to-and-including-1-5-1-this-is-due-to-a-missing-capability-c2026-11-12 https://bugrater.com/releases/cve-2026-16135-the-vibebp-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-all-versions-up-to-and-including-1-9-9-8-1-this-is-due-to-the-plugin-allowing-arbitr2026-11-12 https://bugrater.com/releases/cve-2026-19421-zohocorp-manageengine-ddi-central-versions-below-6301-is-affected-by-a-powershell-injection-vulnerability-due-to-insufficient-validation-of-user-supplied-txt-re2026-11-12 https://bugrater.com/releases/cve-2026-2982-the-wp-table-builder-drag-drop-table-builder-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-url-parameter-in-versions-up-to-an2026-11-12 https://bugrater.com/releases/cve-2026-110951-weak-password-recovery-mechanism-for-forgotten-password-vulnerability-in-hyper-teknoloji-ltd-ti-hyper-e-commerce-infrastructure-hyper-teknoloji-ltd-ti-hy2026-11-12 https://bugrater.com/releases/cve-2026-111552-use-of-single-factor-authentication-vulnerability-in-hyper-teknoloji-ltd-ti-hyper-e-commerce-infrastructure-hyper-teknoloji-ltd-ti-hyper-e-commerce-infra2026-11-12 https://bugrater.com/releases/cve-2026-123139-improper-verification-of-the-source-of-a-communication-channel-vulnerability-in-opera-neon-on-macos-and-windows-allows-a-malicious-browser-extension-to-take-con2026-11-12 https://bugrater.com/releases/cve-2026-125870-bookstack-before-26-09-3-contains-a-missing-authorization-vulnerability-in-imagecontroller-checkimagepermission-that-allows-authenticated-non-admin-users-to2026-11-12 https://bugrater.com/releases/cve-2026-126993-a-security-flaw-has-been-discovered-in-siteserver-sscms-up-to-7-2-2-impacted-is-an-unknown-function-of-the-file-api-v1-captcha-performing-a-manipulation-of-t2026-11-12 https://bugrater.com/releases/cve-2026-126994-a-vulnerability-has-been-found-in-braindecode-up-to-1-8-1-affected-is-the-function-resolve-type-kwargs-of-the-file-braindecode-models-util-py-of-the-component2026-11-12 https://bugrater.com/releases/cve-2026-127050-backup-migration-before-2-1-8-for-wordpress-contains-a-path-traversal-vulnerability-in-its-pclzip-restore-fallback-that-allows-an-attacker-to-achieve-arbitrary2026-11-12 https://bugrater.com/releases/cve-2026-127056-papaparse-before-5-7-1-contains-an-inefficient-algorithmic-complexity-vulnerability-that-allows-remote-unauthenticated-attackers-to-cause-denial-of-service-by-s2026-11-12 https://bugrater.com/releases/cve-2026-19422-zohocorp-manageengine-ddi-central-versions-below-6301-is-affected-by-an-authentication-bypass-vulnerability-in-windows-dns-and-dhcp-agent-synchronization-apis2026-11-12 https://bugrater.com/releases/cve-2026-75864-zohocorp-manageengine-ddi-central-versions-below-6301-is-affected-by-an-improper-authorization-vulnerability-that-allowed-authenticated-non-administrative-users2026-11-12 https://bugrater.com/releases/cve-2026-75867-zohocorp-manageengine-ddi-central-versions-below-6301-is-affected-by-an-authorization-bypass-vulnerability-that-allowed-authenticated-non-administrative-users-t2026-11-12 https://bugrater.com/releases/cve-2026-75868-zohocorp-manageengine-ddi-central-versions-below-6301-is-affected-by-an-authorization-bypass-vulnerability-that-allowed-authenticated-non-administrative-users-t2026-11-12 https://bugrater.com/releases/cve-2026-75869-zohocorp-manageengine-ddi-central-versions-below-6301-is-affected-by-an-authorization-bypass-and-powershell-command-injection-vulnerability-that-allowed-authent2026-11-12 https://bugrater.com/releases/cve-2026-116835-in-affected-versions-of-octopus-server-insufficient-validation-of-custom-claims-on-oidc-accounts-allowed-a-user-with-permission-to-edit-accounts-to-cause-octop2026-11-12 https://bugrater.com/releases/cve-2026-124018-gutenverse-form-plugin-for-wordpress-before-3-2-2-contains-a-csv-formula-injection-vulnerability-that-allows-unauthenticated-attackers-to-inject-spreadsheet-for2026-11-12 https://bugrater.com/releases/cve-2026-124627-in-affected-versions-of-octopus-server-incorrect-validation-of-the-external-identity-linked-to-a-newly-registered-user-could-result-in-that-user-receiving-the2026-11-12 https://bugrater.com/releases/cve-2026-124628-in-affected-versions-of-octopus-server-incorrect-validation-of-changes-a-user-made-to-their-own-ldap-identity-allowed-them-to-edit-that-identity-even-when-an-a2026-11-12 https://bugrater.com/releases/cve-2026-126995-a-vulnerability-was-found-in-tjake-jlama-up-to-0-8-4-0-9-0-beta-affected-by-this-vulnerability-is-the-function-safetensorindex-loadweights-of-the-file-jlama-co2026-11-12 https://bugrater.com/releases/cve-2026-127058-wondercms-before-3-7-0-contains-an-unverified-password-change-vulnerability-in-the-saveaction-functionality-that-allows-an-authenticated-attacker-to-change-the2026-11-12 https://bugrater.com/releases/cve-2026-92083-missing-authorization-vulnerability-in-t-b-tak-b-lgem-yaz-l-m-teknolojileri-ara-t-rma-enstit-s-pardus-image-writer-allows-privilege-escalation-this-issue-aff2026-11-12 https://bugrater.com/releases/cve-2026-116303-missing-authorization-in-postgresql-type-conversion-allows-a-database-user-to-invoke-a-cast-function-despite-lacking-execute-privilege-on-that-function-via-for2026-11-12 https://bugrater.com/releases/cve-2026-116304-use-after-free-in-postgresql-coordination-of-anonymous-record-type-identifiers-among-parallel-workers-allows-a-database-user-to-execute-arbitrary-code-as-the-op2026-11-12 https://bugrater.com/releases/cve-2026-116306-type-confusion-in-postgresql-composite-value-field-assignment-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-databa2026-11-12 https://bugrater.com/releases/cve-2026-116307-use-after-free-in-postgresql-plperl-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-re-entering-plperl2026-11-12 https://bugrater.com/releases/cve-2026-116308-buffer-over-read-in-postgresql-dict-int-allows-a-database-user-to-disclose-portions-of-server-memory-via-a-zero-length-token-versions-before-postgresql-18-72026-11-12 https://bugrater.com/releases/cve-2026-116309-type-confusion-in-postgresql-plperl-may-allow-an-object-creator-to-execute-arbitrary-code-via-blessing-a-non-hash-reference-into-postgresql-inserver-array2026-11-12 https://bugrater.com/releases/cve-2026-116310-use-after-free-in-postgresql-copy-from-error-reporting-allows-a-database-user-to-disclose-portions-of-server-memory-via-a-longer-input-row-following-an-ignored2026-11-12 https://bugrater.com/releases/cve-2026-116311-missing-authorization-in-postgresql-drop-owned-allows-a-role-to-remove-itself-from-restrictive-row-level-security-policies-thereby-reading-or-modifying-rows-th2026-11-12 https://bugrater.com/releases/cve-2026-116312-inconsistent-transition-capture-state-in-postgresql-merge-allows-a-table-data-modifier-to-make-an-after-trigger-process-the-wrong-new-row-via-a-partitioned-tab2026-11-12 https://bugrater.com/releases/cve-2026-116313-untrusted-search-path-in-postgresql-vacuumdb-allows-a-database-owner-to-execute-arbitrary-sql-as-the-database-user-running-vacuumdb-via-shadowing-operators-use2026-11-12 https://bugrater.com/releases/cve-2026-116314-improper-input-validation-in-postgresql-pg-restore-allows-a-non-plain-archive-provider-to-execute-arbitrary-code-as-the-operating-system-user-running-pg-restore2026-11-12 https://bugrater.com/releases/cve-2026-116315-heap-based-buffer-overflow-in-postgresql-tsvector-delete-allows-a-database-user-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-v2026-11-12 https://bugrater.com/releases/cve-2026-116316-improper-protection-of-alternate-path-in-postgresql-security-restricted-operations-allows-an-object-creator-to-execute-arbitrary-sql-as-the-operation-s-caller2026-11-12 https://bugrater.com/releases/cve-2026-116317-heap-based-buffer-overflow-in-postgresql-ts-rank-cd-may-allow-a-database-user-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via2026-11-12 https://bugrater.com/releases/cve-2026-116318-sql-injection-in-postgresql-pg-dump-allows-an-object-creator-to-execute-arbitrary-sql-as-the-user-restoring-the-dump-via-an-inherited-column-having-a-child-loc2026-11-12 https://bugrater.com/releases/cve-2026-116319-use-after-free-in-postgresql-plperl-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-reentrant-return-n2026-11-12 https://bugrater.com/releases/cve-2026-116320-use-after-free-in-postgresql-plperl-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-dropping-the-final2026-11-12 https://bugrater.com/releases/cve-2026-116321-improper-null-termination-in-postgresql-array-element-assignment-allows-a-database-user-to-disclose-server-memory-via-changing-the-final-byte-of-a-fixed-length2026-11-12 https://bugrater.com/releases/cve-2026-116322-improper-locking-in-postgresql-startup-processing-allows-an-unauthenticated-network-client-to-trigger-a-server-restart-via-arranging-for-authentication-timeout2026-11-12 https://bugrater.com/releases/cve-2026-116323-use-after-free-in-postgresql-pltcl-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-a-domain-check-that2026-11-12 https://bugrater.com/releases/cve-2026-116325-sql-injection-in-postgresql-reindexdb-allows-an-object-creator-to-execute-arbitrary-sql-as-the-database-user-running-reindexdb-via-a-crafted-index-name-embedde2026-11-12 https://bugrater.com/releases/cve-2026-116326-uncaught-exceptions-in-postgresql-plperl-allow-an-object-creator-to-cause-use-of-a-stale-sigjmp-buf-via-a-tied-perl-object-or-a-perl-object-whose-overloaded-c2026-11-12 https://bugrater.com/releases/cve-2026-116327-exposure-of-sensitive-information-in-postgresql-security-barrier-processing-allows-a-database-user-to-infer-values-hidden-by-a-security-barrier-view-via-applyi2026-11-12 https://bugrater.com/releases/cve-2026-116328-integer-wraparound-in-postgresql-generation-memory-contexts-allows-a-database-user-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database2026-11-12 https://bugrater.com/releases/cve-2026-116329-type-confusion-in-postgresql-statistics-import-allows-a-table-maintainer-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-nested2026-11-12 https://bugrater.com/releases/cve-2026-116330-untrusted-data-inclusion-in-postgresql-pg-dump-tar-format-restore-sql-allows-a-compromised-origin-server-to-execute-arbitrary-code-as-the-client-operating-syste2026-11-12 https://bugrater.com/releases/cve-2026-116331-type-confusion-in-postgresql-min-max-aggregate-optimization-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database2026-11-12 https://bugrater.com/releases/cve-2026-116332-use-after-free-in-postgresql-portal-setup-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-running-user2026-11-12 https://bugrater.com/releases/cve-2026-116333-buffer-over-read-in-postgresql-parallel-b-tree-scans-allows-an-object-creator-to-read-attacker-chosen-server-memory-addresses-via-a-function-incorrectly-marked2026-11-12 https://bugrater.com/releases/cve-2026-116335-type-confusion-in-postgresql-operator-commutator-and-negator-links-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-d2026-11-12 https://bugrater.com/releases/cve-2026-116336-operation-on-a-dropped-index-in-postgresql-reindex-concurrently-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-data2026-11-12 https://bugrater.com/releases/cve-2026-120139-integer-wraparound-in-postgresql-in-memory-tuple-size-calculations-allows-a-database-user-to-execute-arbitrary-code-as-the-operating-system-user-running-the-dat2026-11-12 https://bugrater.com/releases/cve-2026-120141-type-confusion-in-postgresql-materialized-set-returning-functions-allows-a-database-user-to-execute-arbitrary-code-as-the-operating-system-user-running-the-data2026-11-12 https://bugrater.com/releases/cve-2026-120142-type-confusion-in-postgresql-anonymous-record-types-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-ro2026-11-12 https://bugrater.com/releases/cve-2026-120143-use-after-free-in-postgresql-trigger-functions-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-a-curso2026-11-12 https://bugrater.com/releases/cve-2026-120144-type-confusion-from-incomplete-postgresql-type-cache-invalidation-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-da2026-11-12 https://bugrater.com/releases/cve-2026-120145-missing-authorization-in-postgresql-logical-replication-allows-a-compromised-publisher-to-execute-arbitrary-code-as-the-operating-system-user-running-the-superu2026-11-12 https://bugrater.com/releases/cve-2026-120146-missing-authorization-in-postgresql-reassign-owned-allows-a-role-granted-inherit-but-not-set-to-transfer-objects-to-the-granted-role-it-also-allows-reassignme2026-11-12 https://bugrater.com/releases/cve-2026-120147-use-after-free-in-the-postgresql-dblink-extension-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-type2026-11-12 https://bugrater.com/releases/cve-2026-120148-type-confusion-in-postgresql-extended-statistics-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-a-sta2026-11-12 https://bugrater.com/releases/cve-2026-120149-heap-based-buffer-overflow-in-postgresql-foreign-batch-inserts-allows-a-foreign-server-to-execute-arbitrary-code-via-reporting-that-it-inserted-more-rows-than2026-11-12 https://bugrater.com/releases/cve-2026-120150-use-after-free-in-postgresql-expanded-record-domain-checks-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database2026-11-12 https://bugrater.com/releases/cve-2026-120151-type-confusion-in-postgresql-plpgsql-record-field-assignment-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-databas2026-11-12 https://bugrater.com/releases/cve-2026-120152-use-after-free-in-postgresql-pg-show-all-settings-allows-a-database-user-to-retrieve-memory-contents-via-loading-a-module-while-the-function-is-scanning-cust2026-11-12 https://bugrater.com/releases/cve-2026-120153-sql-injection-in-postgresql-extension-script-substitutions-allows-an-attacker-with-database-level-create-privilege-to-execute-arbitrary-code-as-the-bootstrap-su2026-11-12 https://bugrater.com/releases/cve-2026-120154-improper-protection-in-postgresql-insert-on-conflict-allows-an-attacker-having-insert-update-and-applicable-select-privileges-on-the-table-to-read-every-r2026-11-12 https://bugrater.com/releases/cve-2026-126996-a-vulnerability-was-determined-in-sakanaai-text-to-lora-0-0-1-affected-by-this-issue-is-the-function-get-tokenizer-of-the-file-src-hyper-llm-modulator-utils-mo2026-11-12 https://bugrater.com/releases/cve-2026-126997-a-vulnerability-was-identified-in-jeecgboot-up-to-3-9-6-this-affects-the-function-resttemplate-exchange-of-the-file-org-jeecg-modules-airag-flow-c-a-class-of-t2026-11-12 https://bugrater.com/releases/cve-2026-126998-a-security-flaw-has-been-discovered-in-jeecgboot-up-to-3-9-5-this-vulnerability-affects-the-function-openapicontroller-call-of-the-file-openapi-call-of-the-co2026-11-12 https://bugrater.com/releases/cve-2026-14661-external-control-of-file-name-in-postgresql-dblink-and-create-alter-subscription-allows-a-user-to-achieve-persistent-denial-of-service-via-appending-invalid-da2026-11-12 https://bugrater.com/releases/cve-2026-16237-improper-protection-in-postgresql-insert-on-conflict-on-auto-updatable-views-allows-an-attacker-having-insert-and-update-privileges-on-the-view-to-read-and2026-11-12 https://bugrater.com/releases/cve-2026-16240-use-of-externally-controlled-format-string-in-postgresql-pg-basebackup-allows-an-attacker-having-already-compromised-a-server-to-achieve-disclosure-from-pg-base2026-11-12 https://bugrater.com/releases/cve-2026-18447-type-confusion-in-postgresql-sql-language-functions-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-an2026-11-12 https://bugrater.com/releases/cve-2026-6460-type-confusion-in-postgresql-allows-an-object-creator-to-execute-arbitrary-code-as-the-operating-system-user-running-the-database-via-alter-set-data-type-p2026-11-12 https://bugrater.com/releases/cve-2026-6467-uncontrolled-search-path-element-in-postgresql-create-extension-allows-an-attacker-with-database-level-create-privilege-to-execute-arbitrary-code-as-the-bootstr2026-11-12 https://bugrater.com/releases/cve-2026-126329-docker-sandboxes-reuses-existing-state-and-configuration-directories-without-verifying-their-ownership-if-sbx-or-sandboxd-is-run-as-root-with-home-or-on-linux2026-11-12 https://bugrater.com/releases/cve-2026-126330-docker-sandboxes-can-silently-republish-a-sandbox-service-after-an-operator-removes-its-automatically-assigned-host-port-mapping-the-daemon-removes-the-active2026-11-12 https://bugrater.com/releases/cve-2026-127111-sogo-before-5-12-13-contains-an-improper-restriction-of-excessive-authentication-attempts-vulnerability-that-allows-unauthenticated-attackers-to-reset-account-p2026-11-12 https://bugrater.com/releases/cve-2026-127121-sogo-before-5-12-13-contains-an-improper-cryptographic-signature-verification-vulnerability-that-allows-remote-attackers-to-replace-a-victim-s-contact-s-mime-ce2026-11-12 https://bugrater.com/releases/cve-2026-127131-sogo-before-5-12-13-contains-a-missing-rate-limiting-vulnerability-in-its-web-login-totp-verification-that-allows-attackers-who-already-possess-a-victim-s-passw2026-11-12 https://bugrater.com/releases/cve-2026-127135-sogo-before-5-12-13-contains-a-sieve-script-injection-vulnerability-that-allows-authenticated-users-to-inject-arbitrary-sieve-directives-by-inserting-unescaped2026-11-12 https://bugrater.com/releases/cve-2026-127141-sogo-before-5-12-13-contains-a-denial-of-service-vulnerability-that-allows-authenticated-attackers-to-exhaust-all-worker-processes-by-configuring-an-auxiliary-i2026-11-12 https://bugrater.com/releases/cve-2026-127145-sogo-before-5-12-13-contains-a-server-side-request-forgery-vulnerability-that-allows-authenticated-users-to-make-the-server-connect-to-arbitrary-internal-host-p2026-11-12 https://bugrater.com/releases/cve-2026-70642-tooljet-before-3-21-94-fixed-in-commit-e5f387a-contains-an-authorization-bypass-vulnerability-in-the-app-environments-init-endpoint-that-allows-authenticated2026-11-12 https://bugrater.com/releases/cve-2026-121876-a-flaw-was-found-in-the-interaction-between-systemd-gpt-auto-generator-and-confidential-computing-guest-vm-images-in-openshift-sandboxed-containers-confident2026-11-12 https://bugrater.com/releases/cve-2026-124691-in-progress-kendo-ui-for-jquery-gantt-the-task-editor-s-parent-dropdown-renders-task-titles-as-html-an-attacker-who-can-influence-a-task-title-shown-in-the-dr2026-11-12 https://bugrater.com/releases/cve-2026-124695-in-progress-kendo-ui-for-jquery-form-the-items-hint-option-is-documented-as-a-string-but-is-rendered-as-html-an-attacker-who-can-influence-a-form-item-s-hin2026-11-12 https://bugrater.com/releases/cve-2026-124696-in-progress-kendo-ui-for-jquery-spreadsheet-sheet-names-are-inserted-into-the-sheetsbar-menu-button-s-data-sheet-name-attribute-without-encoding-an-attacker-w2026-11-12 https://bugrater.com/releases/cve-2026-124697-in-progress-kendo-ui-for-jquery-chart-shared-tooltip-rendering-treats-bound-category-and-series-name-values-as-raw-html-an-attacker-who-can-influence-values-c2026-11-12 https://bugrater.com/releases/cve-2026-124698-in-progress-kendo-ui-for-jquery-the-chart-default-tooltip-renders-point-values-as-raw-html-an-attacker-who-can-influence-a-string-point-value-can-inject-marku2026-11-12 https://bugrater.com/releases/cve-2026-127029-a-flaw-was-found-in-freeradius-s-extensible-authentication-protocol-method-for-subscriber-identity-module-eap-sim-module-when-handling-authentication-request2026-11-12 https://bugrater.com/releases/cve-2026-127030-a-flaw-was-found-in-freeradius-an-improper-length-validation-in-the-eap-fast-module-allows-a-stack-based-buffer-overflow-during-session-ticket-processing-a-re2026-11-12 https://bugrater.com/releases/cve-2026-127202-mlflow-before-3-18-0-using-the-filestore-backend-contains-a-path-traversal-vulnerability-that-allows-unauthenticated-remote-attackers-to-write-files-outside-the2026-11-12 https://bugrater.com/releases/cve-2026-127203-appflowy-cloud-through-0-9-64-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-workspace-members-to-upload-blobs-with-unvalidated2026-11-12 https://bugrater.com/releases/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in-attribute-values-and-includes-them-verbatim-in-all-output-formats-an-attacker-who-can-control-thes2026-11-12 https://bugrater.com/releases/cve-2026-82977-the-plesk-goaccess-statistics-integration-in-plesk-obsidian-for-linux-versions-18-0-77-to-18-0-81-7-18-0-82-to-18-0-82-2-allows-cross-subscription-informatio2026-11-12 https://bugrater.com/releases/cve-2026-117543-joomla-extension-jdownloads-com-ssrf-via-external-download-url-field-jdownloads-4-1-8-http-redirects-when-retrieving-external-download-urls-could-bypas2026-11-12 https://bugrater.com/releases/cve-2026-117550-joomla-extension-jdownloads-com-publishing-of-files-without-approval-in-jdownloads-4-1-8-manipulated-frontend-submission-parameters-could-bypass-the-in2026-11-12 https://bugrater.com/releases/cve-2026-117551-joomla-extension-jdownloads-com-rce-through-file-upload-in-jdownloads-4-1-8-insufficient-validation-of-frontend-thumbnail-uploads-allowed-users-with-up2026-11-12 https://bugrater.com/releases/cve-2026-118495-joomla-wordpress-extension-acymailing-com-exposure-of-sensitive-information-to-an-unauthorized-actor-in-acymailing-6-0-0-11-1-1-exposure-of-sensitive2026-11-12 https://bugrater.com/releases/cve-2026-119275-akaunting-3-3-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-xlsx-invoice-import-workflow-an-authenticated-manager-can-import-a-child-invoice-wh2026-11-12 https://bugrater.com/releases/cve-2026-120466-joomla-wordpress-extension-acymailing-com-missing-authorization-on-subscription-changes-in-acymailing-1-0-0-11-1-1-an-unauthenticated-attacker-who-kno2026-11-12 https://bugrater.com/releases/cve-2026-120468-joomla-extension-acymailing-com-unauthenticated-disclosure-of-mailing-list-metadata-in-acymailing-1-0-0-11-1-1-an-unauthenticated-attacker-can-retrieve2026-11-12 https://bugrater.com/releases/cve-2026-120469-joomla-wordpress-extension-acymailing-com-open-redirect-on-the-subscription-and-unsubscription-endpoints-in-acymailing-1-0-0-11-1-1-on-a-default-confi2026-11-12 https://bugrater.com/releases/cve-2026-120470-joomla-wordpress-extension-acymailing-com-online-version-of-an-email-readable-without-the-visibility-check-in-acymailing-1-0-0-11-1-1-an-unauthenticat2026-11-12 https://bugrater.com/releases/cve-2026-120471-joomla-extension-acymailing-com-site-modules-rendered-outside-their-access-level-in-acymailing-1-0-0-11-1-1-an-unauthenticated-visitor-can-cause-a-site2026-11-12 https://bugrater.com/releases/cve-2026-127099-a-flaw-was-found-in-sssd-s-conversion-of-x-509-certificate-rsa-public-keys-to-ssh-keys-missing-size-checks-before-copying-rsa-components-into-fixed-size-stack2026-11-12 https://bugrater.com/releases/cve-2026-127100-a-flaw-was-found-in-sssd-s-pam-responder-on-builds-with-the-json-pam-extension-enabled-a-local-attacker-can-submit-a-crafted-authentication-request-containing2026-11-12 https://bugrater.com/releases/cve-2026-127101-a-flaw-was-found-in-sssd-s-pam-responder-a-local-attacker-can-send-an-authentication-request-without-first-negotiating-the-client-protocol-version-the-respond2026-11-12 https://bugrater.com/releases/cve-2026-127204-woocommerce-paypal-pro-payment-gateway-plugin-before-4-1-1-contains-an-unauthenticated-payment-bypass-vulnerability-that-allows-remote-attackers-to-mark-unpaid2026-11-12 https://bugrater.com/releases/cve-2026-81843-grafana-is-an-open-source-platform-for-monitoring-and-observability-when-an-elasticsearch-data-source-is-configured-with-a-time-based-index-pattern-grafana-g2026-11-12 https://bugrater.com/releases/cve-2026-0004-a-transient-execution-vulnerability-in-some-amd-processors-may-allow-an-attacker-with-the-ability-to-execute-code-on-the-system-to-infer-data-in-the-l1d-cache2026-11-12 https://bugrater.com/releases/cve-2026-117542-joomla-extension-jdownloads-com-authenticated-path-traversal-in-jdownloads-4-1-8-a-manipulated-update-file-form-parameter-could-bypass-the-intended-se2026-11-12 https://bugrater.com/releases/cve-2026-117544-joomla-extension-jdownloads-com-idor-allowing-restricted-file-downloads-in-jdownloads-4-1-8-the-other-file-id-parameter-could-reference-another-downlo2026-11-12 https://bugrater.com/releases/cve-2026-120033-in-frrouting-10-1-and-later-bgpd-does-not-correctly-close-a-bgp-session-when-the-send-hold-timer-rfc-9687-expires-i-e-when-a-neighbor-has-stopped-accepting2026-11-12 https://bugrater.com/releases/cve-2026-120467-joomla-wordpress-extension-acymailing-com-subscriber-identity-not-bound-to-the-record-acted-upon-in-acymailing-1-0-0-11-1-1-an-authenticated-user-of-a2026-11-12 https://bugrater.com/releases/cve-2026-121619-the-symfony-frameworkbundle-framework-trusted-proxies-option-and-the-httpfoundation-request-settrustedproxies-method-trust-remote-clients-as-reverse-proxies2026-11-12 https://bugrater.com/releases/cve-2026-127119-unverified-ownership-of-the-default-cluster-log-location-in-the-emr-module-in-aws-sdk-for-pandas-awswrangler-from-1-1-0-before-3-18-0-might-allow-remote-actor2026-11-12 https://bugrater.com/releases/cve-2026-127235-a-reflected-cross-site-scripting-vulnerability-exists-in-the-web-user-interface-of-multiple-versions-of-opennms-meridian-and-horizon-several-web-ui-pages-copy2026-11-12 https://bugrater.com/releases/cve-2026-127236-an-argument-injection-vulnerability-exists-in-the-ad-hoc-rrd-graph-feature-of-multiple-versions-of-opennms-meridian-and-horizon-the-ad-hoc-graph-endpoint-get2026-11-12 https://bugrater.com/releases/cve-2024-21963-an-out-of-bounds-read-vulnerability-in-the-iommu-could-allow-a-malicious-guest-to-corrupt-hypervisor-hv-pages-and-potentially-cause-a-host-crash-leading-to-lo2026-11-12 https://bugrater.com/releases/cve-2024-36344-insufficient-parameter-sanitization-in-amd-secure-processor-asp-tee-drvsys-could-allow-an-attacker-with-local-access-to-the-trusted-execution-environment-tee2026-11-12 https://bugrater.com/releases/cve-2026-107152-an-improper-authentication-vulnerability-has-been-found-in-the-task-console-in-the-smart-proxy-dynflow-package-the-console-accepts-any-client-certificate-signe2026-11-12 https://bugrater.com/releases/cve-2026-107360-a-flaw-was-found-in-rubygem-safemode-compound-assignment-expressions-in-sandboxed-code-are-evaluated-without-mediating-method-calls-through-the-jail-allow-list2026-11-12 https://bugrater.com/releases/cve-2026-107443-a-flaw-was-found-in-foreman-an-authenticated-user-with-view-hosts-privileges-can-retrieve-rendered-provisioning-template-content-for-a-host-via-the-hosts-templ2026-11-12 https://bugrater.com/releases/cve-2026-111456-a-missing-authorization-check-has-been-found-in-consumerresource-setupowner-function-of-consumer-registration-module-in-the-candlepin-package-the-registratio2026-11-12 https://bugrater.com/releases/cve-2026-124002-xweb-evo-versions-5-2-3-through-before-5-7-0-contains-a-pre-authentication-os-command-injection-vulnerability-that-allows-unauthenticated-remote-attackers-to-ex2026-11-12 https://bugrater.com/releases/cve-2026-124003-xweb-evo-before-5-6-2-contains-a-command-injection-vulnerability-where-the-setuid-root-lua-cgi-interpreter-wlua-executes-system-usr-bin-lua-argv-on-unsanit2026-11-12 https://bugrater.com/releases/cve-2026-124004-xweb-evo-before-5-6-2-contains-a-hardcoded-backdoor-password-vulnerability-that-allows-unauthenticated-remote-attackers-to-gain-full-administrative-access-to-th2026-11-12 https://bugrater.com/releases/cve-2026-124005-xweb-evo-4-3-0-through-5-8-8-contains-a-weak-password-generation-vulnerability-that-allows-remote-attackers-to-derive-the-administrator-code-of-the-day-password2026-11-12 https://bugrater.com/releases/cve-2026-124006-xweb-evo-through-5-8-8-contains-a-predictable-credential-generation-vulnerability-that-allows-attackers-to-derive-the-linux-root-password-by-computing-a-fixed-p2026-11-12 https://bugrater.com/releases/cve-2026-124007-xweb-evo-before-5-6-2-contains-a-pre-authentication-os-command-injection-vulnerability-that-allows-unauthenticated-remote-attackers-to-execute-arbitrary-command2026-11-12 https://bugrater.com/releases/cve-2026-124008-xweb-evo-5-2-3-through-5-8-8-contains-an-authenticated-os-command-injection-vulnerability-in-the-devices-lua-template-handling-which-allows-authenticated-attac2026-11-12 https://bugrater.com/releases/cve-2026-124009-xweb-evo-5-2-3-through-5-8-8-contains-an-authenticated-os-command-injection-vulnerability-that-allows-authenticated-attackers-to-execute-arbitrary-commands-as-r2026-11-12 https://bugrater.com/releases/cve-2026-124010-xweb-evo-before-5-6-2-contains-a-command-injection-vulnerability-that-allows-unauthenticated-remote-attackers-to-execute-arbitrary-commands-as-root-by-exploitin2026-11-12 https://bugrater.com/releases/cve-2026-124011-xweb-evo-5-6-2-through-5-8-8-contains-an-information-disclosure-vulnerability-that-allows-unauthenticated-attackers-to-obtain-the-device-s-eth0-mac-address-and2026-11-12 https://bugrater.com/releases/cve-2026-124012-xweb-evo-5-6-2-through-5-8-8-contains-a-hardcoded-credential-vulnerability-where-the-administrator-web-account-is-configured-to-use-password-mode-daily-password2026-11-12 https://bugrater.com/releases/cve-2026-124013-xweb-evo-5-6-2-through-5-8-8-contains-an-authenticated-os-command-injection-vulnerability-in-the-api-lua-import-preconfiguration-and-restore-actions-where-serv2026-11-12 https://bugrater.com/releases/cve-2026-124014-xweb-evo-4-3-0-through-5-8-8-contains-an-unauthenticated-arbitrary-file-write-vulnerability-that-allows-remote-attackers-to-modify-the-system-configuration-file2026-11-12 https://bugrater.com/releases/cve-2026-124015-xweb-evo-5-6-2-through-5-8-8-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-set-the-password-of-any-account-flagged-mu2026-11-12 https://bugrater.com/releases/cve-2026-127120-a-vulnerability-was-found-in-governikus-ausweisapp-mobile-up-to-2-5-5-this-impacts-an-unknown-function-of-the-component-startpaosresponse-handler-performing-a2026-11-12 https://bugrater.com/releases/cve-2026-106018-authentication-bypass-using-an-alternate-path-or-channel-vulnerability-in-johnson-controls-easyio-fw-allows-authentication-bypass-this-issue-affects-easyio-fw2026-11-12 https://bugrater.com/releases/cve-2026-127206-image-captcha-for-contact-form-7-and-wpforms-through-3-3-29-contains-a-captcha-bypass-vulnerability-that-allows-unauthenticated-attackers-to-defeat-the-anti-aut2026-11-12 https://bugrater.com/releases/cve-2026-127207-sendcloud-for-woocommerce-through-1-0-41-contains-a-missing-authorization-vulnerability-that-allows-authenticated-low-privileged-users-including-subscribers-t2026-11-12 https://bugrater.com/releases/cve-2026-127208-datamodel-code-generator-before-0-84-0-contains-a-code-injection-vulnerability-that-allows-attackers-to-achieve-arbitrary-code-execution-by-supplying-a-maliciou2026-11-12 https://bugrater.com/releases/cve-2026-86322-a-flaw-was-found-in-foreman-s-api-v2-personalaccesstokenscontroller-where-foreman-controller-useraware-find-user-resolves-the-target-account-using-user-fin2026-11-12 https://bugrater.com/releases/cve-2026-86323-a-flaw-was-found-in-foreman-s-api-v2-mailnotificationscontroller-where-authorization-checks-on-user-specific-mail-notification-resources-are-insufficient-th2026-11-12 https://bugrater.com/releases/cve-2026-86324-a-flaw-was-found-in-foreman-s-api-v2-sshkeyscontroller-where-the-target-user-is-resolved-through-foreman-controller-useraware-find-user-using-user-find-par2026-11-12 https://bugrater.com/releases/cve-2026-127209-xiaomi-mi-browser-android-application-com-mi-globalbrowser-before-14-66-0-gn-contains-a-path-traversal-vulnerability-in-the-exported-thirddocvieweractivity-co2026-11-12 https://bugrater.com/releases/cve-2026-127211-multivendorx-plugin-for-wordpress-before-5-0-22-contains-a-broken-access-control-vulnerability-in-the-wp-json-multivendorx-v1-stores-rest-route-that-allows-aut2026-11-12 https://bugrater.com/releases/cve-2026-91141-a-vulnerability-in-the-default-configuration-of-vsomeip-allows-a-remote-unauthenticated-attacker-to-trigger-massive-memory-allocations-by-sending-a-small-tcp-p2026-11-12 https://bugrater.com/releases/homeview-software-version-27-22026-11-13 https://bugrater.com/releases/watchos-27-2-12026-11-13 https://bugrater.com/releases/watchos-26-6-12026-11-13 https://bugrater.com/releases/download-count-moderately-critical-access-bypass-sa-contrib-2026-3312026-11-13 https://bugrater.com/releases/page-manager-moderately-critical-cross-site-request-forgery-sa-contrib-2026-3302026-11-13 https://bugrater.com/releases/mollie-for-drupal-moderately-critical-information-disclosure-sa-contrib-2026-3292026-11-13 https://bugrater.com/releases/mollie-for-drupal-moderately-critical-incorrect-authorization-sa-contrib-2026-3282026-11-13 https://bugrater.com/releases/entity-print-moderately-critical-insertion-of-sensitive-information-into-sent-data-sa-contrib-2026-3272026-11-13 https://bugrater.com/releases/campaign-monitor-moderately-critical-cross-site-request-forgery-sa-contrib-2026-3262026-11-13 https://bugrater.com/releases/paragraphs-entity-embed-moderately-critical-cross-site-scripting-sa-contrib-2026-3252026-11-13 https://bugrater.com/releases/commerce-license-less-critical-access-bypass-sa-contrib-2026-3242026-11-13 https://bugrater.com/releases/cve-2026-127212-dokploy-before-0-31-1-contains-a-missing-ownership-check-vulnerability-in-the-readappmonitoring-trpc-procedure-that-allows-authenticated-attackers-to-access-con2026-11-13 https://bugrater.com/releases/cve-2026-127273-a-vulnerability-has-been-found-in-linksys-ea8100-1-0-3-216940-this-affects-the-function-getwanstatus-getwanstatus3-isadminpassworddefault-of-the-component-jnap2026-11-13 https://bugrater.com/releases/cve-2026-127274-a-vulnerability-was-found-in-linksys-ea8100-1-0-3-216940-this-vulnerability-affects-unknown-code-of-the-file-jnap-core-checkadminpassword-the-manipulation-re2026-11-13 https://bugrater.com/releases/cve-2026-127275-a-vulnerability-was-determined-in-linksys-ea8100-1-0-3-216940-this-issue-affects-the-function-setremotesetting-setunsecuredwifiwarning-of-the-file-ui-server-lu2026-11-13 https://bugrater.com/releases/cve-2026-92735-hashicorp-vault-and-vault-enterprise-are-vulnerable-to-an-issue-in-the-integrated-storage-join-process-that-may-allow-an-unauthenticated-attacker-with-network-a2026-11-13 https://bugrater.com/releases/cve-2026-93333-vault-s-audit-devices-did-not-validate-the-contents-of-a-configured-audit-log-prefix-and-did-not-consistently-enforce-the-server-level-setting-that-restricts-au2026-11-13 https://bugrater.com/releases/cve-2026-93335-vault-community-edition-and-vault-enterprise-did-not-consistently-apply-explicit-acl-policy-deny-rules-to-request-paths-that-differ-only-by-a-trailing-slash-th2026-11-13 https://bugrater.com/releases/cve-2026-127276-a-vulnerability-was-identified-in-linksys-ea8100-1-0-3-216940-impacted-is-an-unknown-function-of-the-component-web-ui-such-manipulation-leads-to-cookie-withou2026-11-13 https://bugrater.com/releases/cve-2026-127277-a-security-flaw-has-been-discovered-in-linksys-ea8100-1-0-3-216940-the-affected-element-is-an-unknown-function-of-the-file-etc-init-d-service-smbd-sh-of-the-co2026-11-13 https://bugrater.com/releases/cve-2026-127278-a-weakness-has-been-identified-in-aip-pub-acps-community-up-to-2-2-0-the-impacted-element-is-the-function-send-verification-code-of-the-file-registry-server-ap2026-11-13 https://bugrater.com/releases/cve-2026-127279-a-vulnerability-was-detected-in-aip-pub-acps-community-up-to-2-2-0-this-impacts-an-unknown-function-of-the-file-discovery-server-app-main-py-of-the-component-d2026-11-13 https://bugrater.com/releases/cve-2026-127281-a-vulnerability-was-found-in-lanyulei-ferry-1-0-0-beta-1-1-0-0-affected-is-an-unknown-function-of-the-file-middleware-auth-go-of-the-component-jwt-validation2026-11-13 https://bugrater.com/releases/cve-2026-127282-a-vulnerability-was-determined-in-sourcecodester-smart-attendance-system-with-qr-code-scanner-1-0-affected-by-this-vulnerability-is-an-unknown-functionality-of2026-11-13 https://bugrater.com/releases/cve-2026-127283-a-vulnerability-was-identified-in-sourcecodester-food-ordering-system-1-0-affected-by-this-issue-is-some-unknown-functionality-of-the-file-admin-update-food-ph2026-11-13 https://bugrater.com/releases/cve-2026-127284-a-security-flaw-has-been-discovered-in-sourcecodester-food-ordering-system-1-0-this-affects-an-unknown-part-of-the-file-admin-add-category-php-of-the-component2026-11-13 https://bugrater.com/releases/cve-2026-127285-a-flaw-has-been-found-in-cairo-dock-glx-dock-3-4-0-the-affected-element-is-an-unknown-function-of-the-file-bg-forum-php-of-the-component-href-attribute-handler2026-11-13 https://bugrater.com/releases/cve-2026-127286-a-vulnerability-was-identified-in-zackriya-solutions-meetily-up-to-0-4-1-affected-is-an-unknown-function-of-the-file-backend-app-main-py-the-manipulation-lead2026-11-13 https://bugrater.com/releases/cve-2026-116059-the-letsrecover-wordpress-plugin-through-1-2-0-does-not-sanitize-a-user-supplied-value-that-is-used-as-a-database-column-name-in-one-of-its-unauthenticated-aja2026-11-13 https://bugrater.com/releases/cve-2026-118064-the-advance-guest-post-wordpress-plugin-through-1-9-does-not-properly-restrict-or-validate-file-uploads-authorizing-an-upload-action-with-a-nonce-exposed-to-ev2026-11-13 https://bugrater.com/releases/cve-2026-118065-the-advance-guest-post-wordpress-plugin-through-1-9-does-not-perform-any-authorization-or-ownership-check-when-deleting-media-attachments-relying-only-on-a-non2026-11-13 https://bugrater.com/releases/cve-2026-120407-the-contact-form-7-wordpress-plugin-before-6-2-5-does-not-restrict-which-user-properties-a-form-field-s-default-value-can-be-populated-from-allowing-users-with2026-11-13 https://bugrater.com/releases/cve-2026-121853-the-apppresser-wordpress-plugin-before-5-0-0-does-not-restrict-access-to-two-of-its-rest-api-endpoints-allowing-unauthenticated-visitors-to-retrieve-the-insta2026-11-13 https://bugrater.com/releases/cve-2026-123093-the-wp-remote-users-sync-wordpress-plugin-before-2-2-1-does-not-have-authorisation-and-csrf-checks-in-one-of-its-ajax-actions-allowing-any-authenticated-user2026-11-13 https://bugrater.com/releases/cve-2026-123097-the-wp-remote-users-sync-wordpress-plugin-before-2-2-1-does-not-restrict-which-account-fields-a-synchronised-site-may-set-when-it-creates-or-updates-users-allo2026-11-13 https://bugrater.com/releases/cve-2026-123124-the-woocommerce-vindi-pagamento-wordpress-plugin-through-0-8-3-does-not-perform-any-authorisation-check-when-updating-an-order-s-shipment-tracking-code-and-doe2026-11-13 https://bugrater.com/releases/cve-2026-123670-the-essential-real-estate-wordpress-plugin-before-5-3-6-does-not-verify-that-the-recipients-it-allows-for-its-contact-email-action-are-legitimate-allowing-user2026-11-13 https://bugrater.com/releases/cve-2026-123711-the-wpcom-member-wordpress-plugin-before-1-8-3-does-not-limit-or-bind-attempts-to-verify-wechat-login-codes-allowing-unauthenticated-attackers-to-brute-force-a2026-11-13 https://bugrater.com/releases/cve-2026-124763-the-woocommerce-wishlist-wordpress-plugin-through-1-1-0-does-not-have-authorisation-and-csrf-checks-in-one-of-its-unauthenticated-ajax-actions-allowing-unauthe2026-11-13 https://bugrater.com/releases/cve-2026-124822-the-easy-dragdrop-file-uploader-wordpress-plugin-before-1-1-10-does-not-validate-a-user-supplied-path-before-deleting-it-allowing-unauthenticated-users-to-dele2026-11-13 https://bugrater.com/releases/cve-2026-124833-the-ahime-image-printer-wordpress-plugin-through-1-0-0-does-not-validate-the-name-extension-or-type-of-uploaded-files-before-writing-them-to-disk-allowing-una2026-11-13 https://bugrater.com/releases/cve-2026-125912-the-wp-ultimate-csv-importer-wordpress-plugin-before-9-2-does-not-restrict-the-destination-filename-and-extension-nor-validate-the-fetched-content-type-when2026-11-13 https://bugrater.com/releases/cve-2026-126119-the-streamit-wordpress-plugin-before-1-3-10-does-not-perform-any-authorization-or-nonce-verification-on-one-of-its-unauthenticated-ajax-routes-which-invokes-an2026-11-13 https://bugrater.com/releases/cve-2026-128424-a-flaw-was-found-in-kroxylicious-the-acl-authorizer-s-rules-file-parser-unquotes-matching-regular-expression-literals-using-the-string-unquoting-rules-w2026-11-13 https://bugrater.com/releases/cve-2026-59074-edito-cms-is-vulnerable-to-improper-cryptographic-signature-verification-in-the-jwt-refresh-logic-an-authenticated-low-privilege-user-can-submit-self-crafted2026-11-13 https://bugrater.com/releases/cve-2026-59075-edito-cms-is-vulnerable-to-dynamic-linq-injection-due-to-improper-input-validation-an-authenticated-attacker-can-inject-conditional-expressions-into-the-sort2026-11-13 https://bugrater.com/releases/cve-2026-59076-edito-cms-is-vulnerable-to-stored-cross-site-scripting-xss-due-to-improper-input-validation-an-authenticated-attacker-can-inject-malicious-scripts-into-give2026-11-13 https://bugrater.com/releases/cve-2026-59077-edito-cms-is-vulnerable-to-stored-xss-via-content-parameter-in-tiny-editor-functionality-authenticated-attacker-can-inject-arbitrary-html-and-js-into-website2026-11-13 https://bugrater.com/releases/cve-2026-59078-edito-cms-is-vulnerable-to-stored-xss-in-avatar-upload-functionality-authenticated-attacker-can-inject-arbitrary-html-and-js-into-website-which-will-be-render2026-11-13 https://bugrater.com/releases/cve-2026-59079-edito-cms-restricts-the-ability-to-upload-files-via-the-ui-to-specific-file-types-however-an-avatar-upload-functionality-allows-an-attacker-to-upload-files-of2026-11-13 https://bugrater.com/releases/cve-2026-59080-edito-cms-sends-jwt-token-via-get-requests-this-allows-a-local-attacker-with-access-to-browser-history-to-obtain-valid-jwt-token-and-perform-action-on-behalf-o2026-11-13 https://bugrater.com/releases/cve-2026-59081-edito-cms-deserializes-json-data-without-further-validation-a-user-even-an-administrator-cannot-exploit-this-vulnerability-through-the-application-s-normal-f2026-11-13 https://bugrater.com/releases/cve-2026-128824-a-flaw-was-found-in-red-hat-quay-the-v1-registry-api-error-handler-reflects-the-attacker-supplied-image-id-path-segment-in-a-response-served-as-text-html-allo2026-11-13 https://bugrater.com/releases/cve-2023-54423-openmage-magento-lts-before-20-2-0-contains-a-stored-cross-site-scripting-vulnerability-because-the-tinymce-wysiwyg-editor-fails-to-filter-scripts-in-specially2026-11-13 https://bugrater.com/releases/cve-2024-58404-zipline-versions-from-3-4-5-before-3-7-10-contain-a-path-traversal-vulnerability-in-the-user-data-export-endpoint-via-the-name-query-parameter-authenticated-at2026-11-13 https://bugrater.com/releases/cve-2024-58405-zipline-through-3-7-9-contains-an-improper-authorization-vulnerability-in-the-api-auth-register-endpoint-which-enforces-invite-codes-only-when-user-registrati2026-11-13 https://bugrater.com/releases/cve-2025-71459-zipline-through-4-3-2-contains-a-path-traversal-vulnerability-that-allows-authenticated-uploaders-to-write-files-outside-the-upload-directory-by-supplying-trave2026-11-13 https://bugrater.com/releases/cve-2025-71460-zipline-before-4-2-1-contains-a-missing-authorization-vulnerability-in-the-api-user-files-transaction-endpoint-that-allows-authenticated-users-to-modify-other2026-11-13 https://bugrater.com/releases/cve-2025-71461-zipline-before-4-0-2-contains-a-predictable-filename-vulnerability-that-allows-attackers-to-infer-other-users-upload-filenames-by-recovering-the-math-random-ge2026-11-13 https://bugrater.com/releases/cve-2025-71463-scapy-before-2-7-0-contains-an-insecure-deserialization-vulnerability-in-the-load-session-function-that-allows-attackers-to-execute-code-by-supplying-a-maliciou2026-11-13 https://bugrater.com/releases/cve-2026-112181-vulnerability-due-to-inadequate-restriction-of-references-to-external-xml-entities-in-openkm-community-edition-the-xml-processing-in-formutils-localentityres2026-11-13 https://bugrater.com/releases/cve-2026-115871-the-wp-staging-backups-restore-migration-clone-plugin-cloud-backups-scheduled-backups-plugin-for-wordpress-is-vulnerable-to-arbitrary-directory-deleti2026-11-13 https://bugrater.com/releases/cve-2026-116509-the-quiz-and-survey-master-qsm-quiz-maker-survey-maker-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-qpages-parameter-in-all-versi2026-11-13 https://bugrater.com/releases/cve-2026-116614-the-wpmr-google-feed-manager-for-woocommerce-sell-on-google-merchant-center-shopping-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-so2026-11-13 https://bugrater.com/releases/cve-2026-116615-the-widget-options-advanced-conditional-visibility-for-gutenberg-blocks-classic-widgets-plugin-for-wordpress-is-vulnerable-to-code-injection-in-all-versions2026-11-13 https://bugrater.com/releases/cve-2026-118191-the-photo-gallery-sliders-proofing-and-themes-nextgen-gallery-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-deletion-due-to-insufficient-file-path-va2026-11-13 https://bugrater.com/releases/cve-2026-118587-the-powerpress-podcasting-plugin-by-blubrry-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-width-parameter-in-all-versions-up-to-a2026-11-13 https://bugrater.com/releases/cve-2026-119077-the-elex-wordpress-helpdesk-customer-ticketing-system-plugin-for-wordpress-is-vulnerable-to-php-object-injection-in-all-versions-up-to-and-including-3-3-9-v2026-11-13 https://bugrater.com/releases/cve-2026-120547-the-cf7-apps-honeypot-database-redirection-webhook-and-addons-for-contact-form-7-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the2026-11-13 https://bugrater.com/releases/cve-2026-120573-the-wpematico-rss-feed-fetcher-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-post-category-parameter-in-all-versions-up-to-and-in2026-11-13 https://bugrater.com/releases/cve-2026-120658-the-download-manager-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-file-additional-previews-parameter-in-all-versions-up-to-an2026-11-13 https://bugrater.com/releases/cve-2026-120688-the-ez-sql-reports-shortcode-widget-and-db-backup-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-http-user-agent-demonstrated-mor2026-11-13 https://bugrater.com/releases/cve-2026-121518-the-customer-reviews-for-woocommerce-plugin-for-wordpress-is-vulnerable-to-sensitive-information-exposure-in-versions-up-to-and-including-5-127-0-via-the-sea2026-11-13 https://bugrater.com/releases/cve-2026-122063-the-newsletters-plugin-for-wordpress-is-vulnerable-to-blind-sql-injection-via-the-user-email-parameter-in-all-versions-up-to-and-including-4-18-2-due-to-ins2026-11-13 https://bugrater.com/releases/cve-2026-122227-the-easy-property-listings-plugin-for-wordpress-is-vulnerable-to-generic-sql-injection-via-the-post-type-parameter-in-all-versions-up-to-and-including-3-5-22026-11-13 https://bugrater.com/releases/cve-2026-123769-the-suredash-community-courses-member-dashboard-plugin-for-wordpress-is-vulnerable-to-privilege-escalation-in-all-versions-up-to-and-including-1-13-0-thi2026-11-13 https://bugrater.com/releases/cve-2026-124218-the-drag-and-drop-file-upload-for-elementor-forms-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-deletion-due-to-insufficient-file-path-validation-in-the2026-11-13 https://bugrater.com/releases/cve-2026-125055-the-chatterbug-forms-fast-flexible-wordpress-form-builder-plugin-for-wordpress-is-vulnerable-to-arbitrary-file-upload-in-all-versions-up-to-and-including-12026-11-13 https://bugrater.com/releases/cve-2026-125409-the-passster-password-protect-pages-and-content-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-metavalue-metakeyinput-passster-id2026-11-13 https://bugrater.com/releases/cve-2026-125948-the-recipe-card-blocks-lite-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-steps-text-parameter-in-all-versions-up-to-and-includ2026-11-13 https://bugrater.com/releases/cve-2026-126029-the-wpzoom-addons-for-elementor-starter-templates-widgets-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-actions-save-builder-d2026-11-13 https://bugrater.com/releases/cve-2026-126264-siyuan-before-3-8-9-contains-an-information-disclosure-vulnerability-that-allows-authenticated-reader-users-to-retrieve-credential-named-widget-files-by-bypassi2026-11-13 https://bugrater.com/releases/cve-2026-126265-siyuan-2-1-0-before-3-8-9-contains-a-flaw-where-the-loginauth-captcha-challenge-lives-in-a-signed-client-side-cookie-allowing-reuse-of-a-solved-challenge-atta2026-11-13 https://bugrater.com/releases/cve-2026-126266-siyuan-from-3-6-0-before-3-8-9-contains-an-information-disclosure-vulnerability-that-allows-unauthenticated-publish-visitors-to-bypass-per-document-passwords-vi2026-11-13 https://bugrater.com/releases/cve-2026-126267-nocodb-from-0-300-0-before-2026-04-4-contains-a-denial-of-service-vulnerability-that-allows-authenticated-users-to-crash-the-server-by-triggering-an-unhandled-p2026-11-13 https://bugrater.com/releases/cve-2026-126268-nocodb-before-2026-08-0-contains-an-ip-address-spoofing-vulnerability-that-allows-unauthenticated-attackers-to-forge-their-recorded-source-ip-by-supplying-x-for2026-11-13 https://bugrater.com/releases/cve-2026-126269-nocodb-before-2026-09-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-editor-users-to-execute-scripts-by-storing-crafted-attach2026-11-13 https://bugrater.com/releases/cve-2026-126270-nocodb-before-2026-09-1-contains-a-missing-authentication-vulnerability-in-the-aggregated-meta-info-route-of-utils-controller-ts-that-exposes-instance-wide-meta2026-11-13 https://bugrater.com/releases/cve-2026-126272-nocodb-before-2026-09-0-contains-an-uncontrolled-resource-consumption-vulnerability-that-allows-authenticated-users-to-bypass-bulk-row-count-limits-by-using-ses2026-11-13 https://bugrater.com/releases/cve-2026-126274-nocodb-before-2026-08-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-creator-users-to-inject-script-by-embedding-markup-in-col2026-11-13 https://bugrater.com/releases/cve-2026-126275-nocodb-before-2026-09-0-contains-an-insecure-direct-object-reference-vulnerability-that-allows-authenticated-users-to-read-cross-base-row-comments-by-supplying2026-11-13 https://bugrater.com/releases/cve-2026-126276-nocodb-before-2026-08-1-contains-an-authentication-bypass-vulnerability-in-oauth-token-service-ts-that-treats-pkce-as-a-substitute-for-confidential-client-authe2026-11-13 https://bugrater.com/releases/cve-2026-126277-nocodb-before-2026-08-1-contains-an-uncontrolled-resource-consumption-vulnerability-that-allows-unauthenticated-attackers-to-exhaust-server-resources-by-sending2026-11-13 https://bugrater.com/releases/cve-2026-126278-nocodb-before-2026-08-1-contains-a-race-condition-vulnerability-in-users-service-ts-that-allows-holders-of-a-valid-reset-token-to-perform-multiple-password-chan2026-11-13 https://bugrater.com/releases/cve-2026-126279-nocodb-before-2026-06-2-contains-a-stored-cross-site-scripting-vulnerability-in-promptwithfields-vue-that-renders-unescaped-field-references-from-ai-field-promp2026-11-13 https://bugrater.com/releases/cve-2026-126280-nocodb-before-2026-08-0-contains-a-race-condition-in-refresh-token-rotation-that-allows-attackers-to-reuse-tokens-because-userrefreshtoken-ts-never-checks-the-a2026-11-13 https://bugrater.com/releases/cve-2026-126281-nocodb-before-2026-08-0-contains-a-missing-authorization-vulnerability-in-the-copy-from-branch-of-integration-creation-in-integrations-service-ts-that-decrypts2026-11-13 https://bugrater.com/releases/cve-2026-126282-nocodb-from-2026-04-0-before-2026-08-0-contains-an-improper-privilege-management-vulnerability-in-org-users-service-ts-where-updating-a-user-s-legacy-organizati2026-11-13 https://bugrater.com/releases/cve-2026-126283-nocodb-before-2026-08-0-contains-an-incorrect-authorization-vulnerability-that-lets-base-scoped-api-tokens-act-as-account-wide-credentials-because-the-token-s-b2026-11-13 https://bugrater.com/releases/cve-2026-126285-nocodb-before-2026-08-0-contains-an-sql-injection-vulnerability-that-allows-authenticated-users-with-read-access-to-run-arbitrary-read-queries-via-the-legacy-wh2026-11-13 https://bugrater.com/releases/cve-2026-126286-nocodb-before-2026-08-0-contains-a-reflected-cross-site-scripting-vulnerability-in-pageleavingwarning-vue-that-allows-unauthenticated-attackers-to-execute-scrip2026-11-13 https://bugrater.com/releases/cve-2026-126287-nocodb-before-2026-06-2-contains-a-race-condition-vulnerability-in-oauth-token-service-ts-that-allows-attackers-to-reuse-a-refresh-token-by-presenting-it-concur2026-11-13 https://bugrater.com/releases/cve-2026-126288-nocodb-before-2026-06-2-contains-an-information-disclosure-vulnerability-that-allows-unauthenticated-attackers-to-retrieve-full-oauth-client-records-by-querying2026-11-13 https://bugrater.com/releases/cve-2026-126289-nocodb-before-2026-06-1-contains-a-csv-formula-injection-vulnerability-in-export-service-ts-that-writes-record-values-and-column-titles-beginning-with-formula-c2026-11-13 https://bugrater.com/releases/cve-2026-126290-nocodb-before-2026-07-0-contains-an-information-disclosure-vulnerability-in-base-integrations-service-ts-that-allows-authenticated-base-members-to-read-private2026-11-13 https://bugrater.com/releases/cve-2026-126291-nocodb-before-2026-06-2-contains-an-sql-injection-vulnerability-in-base-user-cte-utils-ts-which-concatenates-base-members-email-addresses-into-the-sql-text-of2026-11-13 https://bugrater.com/releases/cve-2026-126292-nocodb-before-2026-06-1-contains-an-information-disclosure-vulnerability-in-the-profile-update-handler-in-users-service-ts-which-returns-the-stored-user-record2026-11-13 https://bugrater.com/releases/cve-2026-126293-nocodb-before-2026-06-2-contains-an-attachment-size-limit-bypass-that-allows-authenticated-editor-users-to-store-oversized-files-because-data-attachment-v3-serv2026-11-13 https://bugrater.com/releases/cve-2026-126295-nltk-from-3-10-0-before-3-10-4-contains-an-arbitrary-file-read-vulnerability-in-bllipparser-that-allows-attackers-to-open-files-outside-nltk-data-roots-by-suppl2026-11-13 https://bugrater.com/releases/cve-2026-126296-nltk-before-3-10-4-contains-a-path-traversal-vulnerability-in-save-maxent-params-and-load-maxent-params-that-bypasses-the-pathsec-filesystem-restriction-mec2026-11-13 https://bugrater.com/releases/cve-2026-126297-nltk-before-3-10-4-contains-a-quadratic-time-denial-of-service-vulnerability-in-conllcorpusreader-get-srl-instances-that-allows-remote-attackers-to-exhaust-cpu2026-11-13 https://bugrater.com/releases/cve-2026-126298-nltk-before-3-10-4-contains-a-denial-of-service-vulnerability-in-tree-chomsky-normal-form-that-allows-remote-attackers-to-exhaust-cpu-through-quadratic-time-rig2026-11-13 https://bugrater.com/releases/cve-2026-126299-nltk-before-3-10-4-contains-a-denial-of-service-vulnerability-in-the-ccg-lexicon-parser-fromstring-that-allows-remote-attackers-to-exhaust-cpu-by-supplying-wide2026-11-13 https://bugrater.com/releases/cve-2026-126300-nltk-from-3-2-5-before-3-10-4-contains-an-algorithmic-complexity-vulnerability-in-treebankwordtokenizer-span-tokenize-that-allows-remote-attackers-to-cause-quad2026-11-13 https://bugrater.com/releases/cve-2026-126301-nltk-from-3-6-before-3-10-4-contains-an-algorithmic-complexity-vulnerability-in-legalitysyllabletokenizer-tokenize-that-allows-remote-attackers-to-exhaust-cpu-b2026-11-13 https://bugrater.com/releases/cve-2026-126302-nltk-from-3-9-4-before-3-10-4-contains-a-symlink-following-vulnerability-in-nltk-sem-chat80-sql-query-that-bypasses-the-pathsec-data-root-sandbox-containment2026-11-13 https://bugrater.com/releases/cve-2026-126303-nltk-before-3-10-4-contains-an-uncontrolled-resource-consumption-vulnerability-in-steppingrecursivedescentparser-parse-that-lacks-any-max-time-deadline-or-ste2026-11-13 https://bugrater.com/releases/cve-2026-126304-nltk-from-3-10-0-before-3-10-4-contains-a-symlink-escape-vulnerability-in-ycoecorpusreader-that-allows-attackers-to-read-files-outside-the-corpus-root-by-planti2026-11-13 https://bugrater.com/releases/cve-2026-126305-espocrm-before-9-3-11-and-10-x-before-10-0-9-contains-a-stored-cross-site-scripting-vulnerability-in-knowledge-base-articles-that-lets-users-with-knowledge-base2026-11-13 https://bugrater.com/releases/cve-2026-126306-espocrm-before-9-3-11-and-10-x-before-10-0-8-contains-a-stored-cross-site-scripting-vulnerability-that-allows-low-privileged-users-to-upload-crafted-svg-images2026-11-13 https://bugrater.com/releases/cve-2026-126307-nezha-dashboard-before-2-6-0-contains-multiple-authorization-tenant-isolation-and-resource-exhaustion-vulnerabilities-that-allow-members-or-unauthenticated-at2026-11-13 https://bugrater.com/releases/cve-2026-126308-the-web-dashboard-in-coder-2-24-0-before-2-29-23-2-30-0-before-2-34-14-2-35-0-before-2-36-9-2-37-0-before-2-37-6-and-2-38-0-before-2-38-2-replaces-the-sess2026-11-13 https://bugrater.com/releases/cve-2026-126309-openbao-before-2-6-5-and-2-7-2-contains-a-path-traversal-vulnerability-in-transit-key-import-that-allows-authenticated-attackers-to-bypass-name-restrictions-in2026-11-13 https://bugrater.com/releases/cve-2026-126310-openbao-before-2-6-5-and-2-7-2-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-callers-to-obtain-oidc-id-tokens-by-abusing-public-cl2026-11-13 https://bugrater.com/releases/cve-2026-126311-openbao-before-2-6-5-and-2-7-x-before-2-7-2-does-not-neutralize-wildcard-characters-in-ssh-certificate-principals-rendered-from-unvalidated-external-token-metad2026-11-13 https://bugrater.com/releases/cve-2026-126312-openbao-before-2-6-5-and-2-7-x-before-2-7-2-and-the-openbao-plugins-ldap-and-radius-auth-plugins-before-0-2-0-contain-an-acl-bypass-in-the-approle-cert-ldap2026-11-13 https://bugrater.com/releases/cve-2026-126313-frappe-hrms-16-0-0-before-16-20-1-contains-an-authorization-bypass-because-an-ownership-check-is-missing-on-a-record-type-that-employees-can-create-authenticat2026-11-13 https://bugrater.com/releases/cve-2026-126314-frappe-hrms-15-0-0-before-15-64-6-and-16-0-0-before-16-20-1-does-not-check-access-to-each-employee-on-endpoints-that-create-records-in-bulk-for-a-list-of-employ2026-11-13 https://bugrater.com/releases/cve-2026-126315-frappe-hrms-16-14-0-before-16-20-1-sends-product-usage-events-on-certain-hr-transactions-without-checking-the-site-s-telemetry-setting-and-some-events-include2026-11-13 https://bugrater.com/releases/cve-2026-126316-frappe-hrms-from-16-0-0-before-16-20-1-contains-an-information-exposure-vulnerability-that-places-the-subscription-key-in-the-query-string-of-outbound-subscript2026-11-13 https://bugrater.com/releases/cve-2026-126317-frappe-hrms-from-16-0-0-before-16-20-1-contains-a-missing-authorization-vulnerability-that-allows-authenticated-users-to-read-company-details-outside-their-perm2026-11-13 https://bugrater.com/releases/cve-2026-126318-redaxo-before-5-21-6-contains-an-authorization-bypass-vulnerability-that-allows-editors-without-the-version-live-version-permission-to-modify-live-article-vers2026-11-13 https://bugrater.com/releases/cve-2026-126319-dockhand-before-1-0-55-contains-an-arbitrary-file-read-vulnerability-that-allows-authenticated-users-with-stacks-create-permission-to-read-sensitive-files-by-su2026-11-13 https://bugrater.com/releases/cve-2026-126320-dockhand-before-1-0-55-contains-an-improper-authorization-vulnerability-that-lets-users-holding-only-containers-view-download-arbitrary-container-files-instead2026-11-13 https://bugrater.com/releases/cve-2026-126321-dockhand-before-1-0-55-contains-a-path-traversal-vulnerability-that-allows-authenticated-users-with-stacks-edit-to-bypass-the-file-browser-path-guard-by-combini2026-11-13 https://bugrater.com/releases/cve-2026-126322-openemr-before-8-3-0-contains-an-unsanitized-deserialization-vulnerability-that-allows-authenticated-attackers-to-control-patient-matching-criteria-by-supplying2026-11-13 https://bugrater.com/releases/cve-2026-126323-vvveb-through-1-0-8-6-contains-a-cross-site-request-forgery-vulnerability-that-allows-attackers-to-perform-admin-state-changing-actions-because-checkcsrf-in-a2026-11-13 https://bugrater.com/releases/cve-2026-126369-vvveb-through-1-0-8-6-contains-a-stored-cross-site-scripting-vulnerability-that-allows-low-privilege-author-or-vendor-users-to-inject-script-by-bypassing-the-re2026-11-13 https://bugrater.com/releases/cve-2026-126370-vvveb-through-1-0-8-6-contains-a-remote-code-execution-vulnerability-allowing-restricted-site-admin-roles-to-inject-php-by-saving-sql-files-through-the-admin-c2026-11-13 https://bugrater.com/releases/cve-2026-126371-vvveb-through-1-0-8-6-contains-an-sql-injection-vulnerability-in-admin-auth-tokensql-update-which-interpolates-admin-auth-token-array-keys-into-an-insert-co2026-11-13 https://bugrater.com/releases/cve-2026-126373-vvveb-1-0-8-4-through-1-0-8-6-contains-an-authorization-bypass-vulnerability-in-the-content-revisions-revision-action-that-lets-low-privileged-authors-read-othe2026-11-13 https://bugrater.com/releases/cve-2026-126377-vvveb-before-1-0-9-0-contains-an-authentication-bypass-vulnerability-in-generatecookie-in-system-user-user-php-that-uses-loose-comparison-to-validate-md5-cook2026-11-13 https://bugrater.com/releases/cve-2026-126378-vvveb-through-1-0-8-6-contains-a-file-upload-vulnerability-in-the-theme-installer-validfile-function-that-uses-strpos-instead-of-strict-path-matching-attac2026-11-13 https://bugrater.com/releases/cve-2026-126379-vvveb-1-0-8-6-contains-an-incomplete-server-side-request-forgery-fix-that-allows-authenticated-admin-users-to-bypass-dns-pinning-by-requesting-non-443-urls-att2026-11-13 https://bugrater.com/releases/cve-2026-126380-vvveb-before-1-0-9-0-contains-a-denylist-bypass-in-system-traits-media-php-where-phar-is-misconfigured-with-a-leading-dot-allowing-authenticated-administrat2026-11-13 https://bugrater.com/releases/cve-2026-126381-n8n-before-2-43-5-2-44-x-before-2-44-1-and-3-x-before-3-0-1-contains-an-sql-injection-vulnerability-in-the-vector-store-oracledb-node-which-does-not-valida2026-11-13 https://bugrater.com/releases/cve-2026-126382-n8n-before-2-38-0-and-3-x-before-3-0-1-contains-a-missing-authentication-vulnerability-in-the-asana-trigger-that-accepts-a-new-webhook-verification-secret-from2026-11-13 https://bugrater.com/releases/cve-2026-126383-n8n-before-1-123-89-2-x-before-2-45-5-2-46-x-before-2-46-1-and-3-x-before-3-0-1-contains-a-nosql-injection-vulnerability-in-the-mongodb-node-s-update-and-fin2026-11-13 https://bugrater.com/releases/cve-2026-126384-n8n-before-1-123-89-2-x-before-2-45-5-2-46-x-before-2-46-1-and-3-x-before-3-0-1-bundles-a-graphicsmagick-version-with-known-vulnerabilities-in-its-official-d2026-11-13 https://bugrater.com/releases/cve-2026-126385-n8n-before-2-45-5-2-46-x-before-2-46-1-and-3-x-before-3-0-1-contains-a-flaw-in-the-oauth2-credential-callback-of-the-dynamic-credential-connect-flow-which-do2026-11-13 https://bugrater.com/releases/cve-2026-126386-n8n-before-1-123-89-2-x-before-2-45-5-2-46-x-before-2-46-1-and-3-x-before-3-0-1-contains-an-open-redirect-vulnerability-in-the-unauthenticated-mcp-oauth-dyna2026-11-13 https://bugrater.com/releases/cve-2026-126387-n8n-before-2-46-1-contains-an-arbitrary-file-read-vulnerability-that-allows-authenticated-members-to-read-server-files-by-supplying-absolute-paths-to-the-browse2026-11-13 https://bugrater.com/releases/cve-2026-126388-n8n-before-2-46-1-contains-a-credential-exposure-vulnerability-that-forwards-authorization-headers-and-basic-auth-credentials-on-cross-origin-redirects-because2026-11-13 https://bugrater.com/releases/cve-2026-126389-n8n-before-1-123-89-contains-an-authentication-bypass-vulnerability-in-the-chat-trigger-that-allows-unauthenticated-attackers-to-skip-n8n-user-auth-through-the2026-11-13 https://bugrater.com/releases/cve-2026-126390-n8n-before-1-123-89-contains-a-credential-leakage-vulnerability-in-the-nocodb-node-that-sends-the-configured-nocodb-api-token-to-attacker-chosen-hosts-when-down2026-11-13 https://bugrater.com/releases/cve-2026-126391-n8n-before-1-123-89-contains-an-insufficient-isolation-vulnerability-in-workflow-expression-evaluation-that-allows-authenticated-users-to-escape-the-sandbox-at2026-11-13 https://bugrater.com/releases/cve-2026-126393-siyuan-before-3-8-10-contains-a-server-side-request-forgery-vulnerability-in-the-skill-install-download-path-because-fetchbytes-performs-only-a-parse-time-hostn2026-11-13 https://bugrater.com/releases/cve-2026-126394-vllm-0-30-0-before-0-31-0-contains-a-resource-exhaustion-vulnerability-in-opencvdynamicopenpanguvideobackend-which-uses-request-controlled-num-frames-without-a2026-11-13 https://bugrater.com/releases/cve-2026-126395-vllm-from-0-14-0rc1-before-0-31-0-contains-an-information-disclosure-vulnerability-in-sanitize-message-whose-lowercase-only-regex-fails-to-scrub-uppercase-pil2026-11-13 https://bugrater.com/releases/cve-2026-126396-vllm-from-0-24-0-before-0-31-0-contains-a-resource-exhaustion-vulnerability-in-the-minimax-m3-vl-video-processor-which-accepts-request-level-min-pixels-without2026-11-13 https://bugrater.com/releases/cve-2026-126397-vllm-from-0-10-1-before-0-31-0-forwards-a-request-controlled-mm-processor-kwargs-max-patches-value-to-the-hugging-face-processor-for-cohere2-vision-models-witho2026-11-13 https://bugrater.com/releases/cve-2026-126398-vllm-from-0-28-0-before-0-30-0-contains-a-reachable-assertion-vulnerability-in-gpumodelrunner-init-xdrope-positions-that-allows-remote-attackers-to-crash-the-e2026-11-13 https://bugrater.com/releases/cve-2026-126399-vllm-from-0-19-0-before-0-31-0-contains-a-resource-exhaustion-vulnerability-that-allows-inference-clients-to-bypass-the-server-frame-limit-by-setting-media-io-k2026-11-13 https://bugrater.com/releases/cve-2026-126400-password-pusher-from-1-49-0-before-2-17-0-contains-an-ip-spoofing-vulnerability-that-allows-remote-clients-to-forge-the-recorded-request-ip-via-unanchored-trust2026-11-13 https://bugrater.com/releases/cve-2026-126401-fleet-before-4-86-2-contains-a-denial-of-service-vulnerability-that-allows-unauthenticated-attackers-to-exhaust-server-memory-through-quadratic-xml-canonicaliza2026-11-13 https://bugrater.com/releases/cve-2026-126403-coder-2-26-0-before-2-29-24-2-30-0-before-2-34-16-2-35-0-before-2-36-11-2-37-0-before-2-37-8-and-2-38-0-before-2-38-4-contains-an-improper-authorization-fla2026-11-13 https://bugrater.com/releases/cve-2026-126404-coder-2-28-0-before-2-29-24-2-30-0-before-2-34-16-2-35-0-before-2-36-11-2-37-0-before-2-37-8-and-2-38-0-before-2-38-4-does-not-restrict-new-api-keys-to-the2026-11-13 https://bugrater.com/releases/cve-2026-126410-wasmtime-s-wasmtime-wasi-crate-48-0-0-before-48-0-8-49-0-0-before-49-0-5-and-50-0-0-before-50-0-1-contains-a-time-of-check-time-of-use-race-in-the-wasip3-wasi2026-11-13 https://bugrater.com/releases/cve-2026-126411-frappe-hrms-16-0-0-before-16-50-0-lacks-authorization-checks-on-certain-hr-workflow-endpoints-letting-authenticated-users-access-records-they-are-not-permitted2026-11-13 https://bugrater.com/releases/cve-2026-126412-frappe-hrms-15-0-0-before-15-64-1-and-16-0-0-before-16-19-0-lacks-a-write-permission-check-on-a-bulk-record-processing-action-allowing-users-with-only-read-acc2026-11-13 https://bugrater.com/releases/cve-2026-126413-frappe-hrms-15-x-before-15-64-1-and-16-x-before-16-19-0-contains-a-missing-authorization-vulnerability-in-an-endpoint-that-returns-file-information-allowing-au2026-11-13 https://bugrater.com/releases/cve-2026-126414-frappe-hrms-15-0-0-before-15-64-2-and-16-0-0-before-16-20-0-contains-a-missing-authorization-vulnerability-in-certain-record-update-endpoints-that-lack-an-owner2026-11-13 https://bugrater.com/releases/cve-2026-126415-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-the-patient-validation-module-that-allows-any-authenticated-user-to-retrieve-patient-demo2026-11-13 https://bugrater.com/releases/cve-2026-126416-openemr-before-8-5-0-contains-an-improper-authorization-vulnerability-in-patient-tracker-status-php-that-allows-low-privilege-authenticated-users-to-modify-othe2026-11-13 https://bugrater.com/releases/cve-2026-126417-openemr-before-8-5-0-contains-an-access-control-flaw-in-get-claim-file-php-with-location-tmp-it-serves-any-file-in-the-shared-temporary-directory-without-veri2026-11-13 https://bugrater.com/releases/cve-2026-126418-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-in-interface-billing-sl-eob-invoice-php-which-escapes-billing-codes-for-html-attribut2026-11-13 https://bugrater.com/releases/cve-2026-126419-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-the-esign-form-submit-handler-of-library-esign-form-controller-php-that-verifies-only-the2026-11-13 https://bugrater.com/releases/cve-2026-126420-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-the-faxsms-module-s-utility-php-that-allows-read-only-demographics-users-to-create-patien2026-11-13 https://bugrater.com/releases/cve-2026-126421-openemr-before-8-5-0-contains-an-uncontrolled-resource-consumption-vulnerability-that-allows-authenticated-users-with-patients-med-access-to-exhaust-php-workers2026-11-13 https://bugrater.com/releases/cve-2026-126422-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-library-ajax-lists-touch-php-that-allows-restricted-authenticated-users-to-mark-another-p2026-11-13 https://bugrater.com/releases/cve-2026-126423-openemr-before-8-5-0-contains-a-denial-of-service-vulnerability-in-four-zip-upload-paths-that-read-uncompressed-entries-into-memory-without-size-or-ratio-checks2026-11-13 https://bugrater.com/releases/cve-2026-126424-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-users-with-admin-superbill-write-permission-to-inject-html-into-snomed-cod2026-11-13 https://bugrater.com/releases/cve-2026-126425-openemr-before-8-5-0-contains-a-stored-sql-injection-vulnerability-in-which-history-layout-field-identifiers-saved-through-edit-layout-php-including-his-fields2026-11-13 https://bugrater.com/releases/cve-2026-126426-openemr-5-0-2-before-8-5-0-contains-a-missing-authentication-vulnerability-in-mfa-registrations-php-and-mfa-u2f-php-that-allows-session-hijackers-to-delete-mfa2026-11-13 https://bugrater.com/releases/cve-2026-126427-openemr-before-8-5-0-contains-a-session-expiration-vulnerability-that-prevents-automatic-logoff-because-the-eye-exam-form-s-read-only-poll-omits-skip-timeout-re2026-11-13 https://bugrater.com/releases/cve-2026-126428-openemr-before-8-5-0-contains-a-remote-code-execution-vulnerability-that-allows-authenticated-billing-users-to-store-attacker-controlled-php-by-uploading-a-malf2026-11-13 https://bugrater.com/releases/cve-2026-126429-openemr-before-8-5-0-passes-authenticated-user-controlled-html-from-the-doc-lib-php-content-parameter-to-mpdf-which-resolves-local-files-and-nested-svg-resourc2026-11-13 https://bugrater.com/releases/cve-2026-126430-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-that-allows-any-authenticated-core-user-to-inject-sql-by-supplying-crafted-patient-data-field-names2026-11-13 https://bugrater.com/releases/cve-2026-126431-openemr-before-8-5-0-contains-a-second-order-sql-injection-vulnerability-that-allows-authenticated-carecoordination-users-to-store-malicious-c-cda-field-identif2026-11-13 https://bugrater.com/releases/cve-2026-126432-openemr-before-8-5-0-contains-an-improper-authorization-vulnerability-in-interface-orders-list-reports-php-that-allows-read-only-users-to-transmit-lab-orders-be2026-11-13 https://bugrater.com/releases/cve-2026-126433-openemr-before-8-5-0-contains-an-improper-authorization-vulnerability-in-interface-drugs-dispense-drug-php-which-checks-only-for-admin-drugs-view-permission-in2026-11-13 https://bugrater.com/releases/cve-2026-126434-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-interface-forms-procedure-order-common-php-that-allows-authenticated-accounts-lacking-pat2026-11-13 https://bugrater.com/releases/cve-2026-126435-openemr-before-8-5-0-contains-an-improper-authorization-vulnerability-in-interface-orders-order-manifest-php-which-checks-patients-med-without-requiring-write2026-11-13 https://bugrater.com/releases/cve-2026-126436-openemr-before-8-5-0-contains-an-authorization-bypass-vulnerability-that-allows-oauth2-clients-to-use-unregistered-grant-types-because-oauth-clients-grant-types2026-11-13 https://bugrater.com/releases/cve-2026-126437-openemr-before-8-5-0-contains-an-authorization-bypass-vulnerability-in-portal-lib-download-template-php-that-allows-any-authenticated-core-user-to-render-docume2026-11-13 https://bugrater.com/releases/cve-2026-126438-openemr-before-8-5-0-contains-an-improper-authorization-vulnerability-in-interface-patient-file-rules-patient-data-php-that-allows-read-only-patients-med-users2026-11-13 https://bugrater.com/releases/cve-2026-126439-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-ccdaservice-ccda-gateway-php-that-fails-to-enforce-the-patients-pat-rep-permission-accep2026-11-13 https://bugrater.com/releases/cve-2026-126440-openemr-before-8-5-0-contains-a-missing-authorization-flaw-in-the-care-coordination-ccda-and-ccr-import-controllers-which-move-a-document-named-by-the-document2026-11-13 https://bugrater.com/releases/cve-2026-126441-openemr-before-8-5-0-contains-an-insecure-direct-object-reference-vulnerability-in-the-camos-rx-print-php-printer-that-allows-authenticated-users-to-read-other2026-11-13 https://bugrater.com/releases/cve-2026-126442-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-create-portallogin-php-that-allows-low-privilege-authenticated-users-to-replace-patient-p2026-11-13 https://bugrater.com/releases/cve-2026-126443-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-dynamic-finder-ajax-php-that-allows-authenticated-users-without-patients-demo-permission2026-11-13 https://bugrater.com/releases/cve-2026-126444-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-the-ensora-erx-integration-that-allows-authenticated-staff-without-patients-rx-permission2026-11-13 https://bugrater.com/releases/cve-2026-126445-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-that-allows-any-authenticated-core-user-to-modify-arbitrary-patient-flow-board-trackers-with2026-11-13 https://bugrater.com/releases/cve-2026-126446-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-that-allows-any-authenticated-core-user-to-retrieve-destroyed-drug-records-because-destroyed2026-11-13 https://bugrater.com/releases/cve-2026-126447-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-trusted-messages-ajax-php-that-allows-any-authenticated-core-user-to-send-direct-messages2026-11-13 https://bugrater.com/releases/cve-2026-126448-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-that-allows-authenticated-users-lacking-nationnotes-nn-configure-to-modify-shared-nation-not2026-11-13 https://bugrater.com/releases/cve-2026-126449-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-immunizations-php-diagnosis-full-php-and-billing-process-php-that-lets-low-privileged-u2026-11-13 https://bugrater.com/releases/cve-2026-126450-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-to-inject-scripts-by-placing-payloads-in-the-patient-e2026-11-13 https://bugrater.com/releases/cve-2026-126451-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-portal-patients-to-run-javascript-in-staff-sessions-by-injecting-javascrip2026-11-13 https://bugrater.com/releases/cve-2026-126452-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-diagnosis-full-php-that-allows-authenticated-users-to-delete-or-clear-any-billing-record2026-11-13 https://bugrater.com/releases/cve-2026-126453-openemr-before-8-5-0-contains-an-inverted-comparison-in-document-has-expired-that-causes-the-fhir-binary-download-endpoint-to-treat-time-limited-phi-document2026-11-13 https://bugrater.com/releases/cve-2026-126454-openemr-before-8-5-0-lacks-rate-limiting-or-lockout-on-totp-submission-allowing-attackers-with-a-valid-password-to-brute-force-the-6-digit-mfa-code-attackers2026-11-13 https://bugrater.com/releases/cve-2026-126455-openemr-before-8-5-0-contains-multiple-missing-authorization-and-sql-injection-defects-across-report-portal-transaction-and-immunization-components-low-priv2026-11-13 https://bugrater.com/releases/cve-2026-126456-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-fee-sheet-notecodes-field-which-is-escaped-with-the-wrong-context-attackers-w2026-11-13 https://bugrater.com/releases/cve-2026-126457-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-installercontroller-that-allows-any-authenticated-user-to-modify-module-administration-se2026-11-13 https://bugrater.com/releases/cve-2026-126458-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-authorizations-full-php-that-allows-any-authenticated-staff-user-to-authorize-arbitrary-p2026-11-13 https://bugrater.com/releases/cve-2026-126460-openemr-before-8-5-0-contains-a-persistent-sql-injection-vulnerability-in-sleob-slinvoicenumber-where-the-clp01-claim-control-number-from-uploaded-x12-835-e2026-11-13 https://bugrater.com/releases/cve-2026-126461-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-library-ajax-user-settings-php-that-lets-any-authenticated-user-persist-arbitrary-global2026-11-13 https://bugrater.com/releases/cve-2026-126462-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-with-eye-exam-edit-permission-to-inject-scripts-via-th2026-11-13 https://bugrater.com/releases/cve-2026-126463-openemr-before-8-5-0-contains-multiple-sql-injection-vulnerabilities-that-allow-authenticated-users-to-inject-payloads-through-era-clp01-form-facility-form-ic2026-11-13 https://bugrater.com/releases/cve-2026-126464-openemr-before-8-5-0-contains-a-server-side-request-forgery-vulnerability-in-patientportalpdfdocumentcreator-createpdfobject-that-allows-authenticated-patien2026-11-13 https://bugrater.com/releases/cve-2026-126465-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-in-the-patient-portal-api-onsiteactivityviews-endpoint-that-allows-any-authenticated-staff-user-to2026-11-13 https://bugrater.com/releases/cve-2026-126466-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-that-allows-any-authenticated-user-to-create-patient-records-and-enumerate-patients-by-omitt2026-11-13 https://bugrater.com/releases/cve-2026-126467-openemr-before-8-5-0-contains-a-mass-assignment-vulnerability-in-observationcontroller-processenhancedformsave-that-allows-authenticated-low-privilege-users2026-11-13 https://bugrater.com/releases/cve-2026-126468-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-that-allows-any-authenticated-low-privilege-user-to-access-reports-dated-reminders-and-bat2026-11-13 https://bugrater.com/releases/cve-2026-126469-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-several-custom-scripts-that-rely-only-on-session-authentication-and-never-call-aclmain2026-11-13 https://bugrater.com/releases/cve-2026-126470-openemr-before-8-5-0-contains-an-insecure-direct-object-reference-vulnerability-in-the-carecoordination-module-that-allows-authenticated-users-with-send-to-hie2026-11-13 https://bugrater.com/releases/cve-2026-126471-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-print-referral-php-and-trend-form-php-that-allows-low-privileged-front-office-users-to-ac2026-11-13 https://bugrater.com/releases/cve-2026-126472-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-ccdaservice-ccda-gateway-php-that-allows-any-authenticated-low-privilege-staff-user-to-re2026-11-13 https://bugrater.com/releases/cve-2026-126473-openemr-before-8-4-0-contains-oauth-scope-canonicalization-and-containment-flaws-that-allow-unauthenticated-attackers-to-obtain-unapproved-system-level-fhir-acc2026-11-13 https://bugrater.com/releases/cve-2026-126474-openemr-before-8-5-0-contains-a-reflected-cross-site-scripting-vulnerability-in-the-acl-module-that-allows-attackers-to-execute-javascript-in-authenticated-sess2026-11-13 https://bugrater.com/releases/cve-2026-126475-openemr-before-8-5-0-contains-a-reflected-cross-site-scripting-vulnerability-that-allows-authenticated-attackers-to-execute-javascript-by-injecting-payloads-int2026-11-13 https://bugrater.com/releases/cve-2026-126476-openemr-before-8-5-0-contains-a-reflected-cross-site-scripting-vulnerability-in-the-application-module-s-auto-suggest-endpoint-which-echoes-the-searchmode-post2026-11-13 https://bugrater.com/releases/cve-2026-126477-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-eye-exam-eye-mag-module-that-allows-administrators-to-inject-javascript-throu2026-11-13 https://bugrater.com/releases/cve-2026-126478-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-in-the-syndromic-surveillance-report-because-the-form-icd-codes-post-array-is-concatenated-into-a2026-11-13 https://bugrater.com/releases/cve-2026-126479-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-five-module-manager-installercontroller-actions-that-lack-the-admin-manage-modules-acl-ch2026-11-13 https://bugrater.com/releases/cve-2026-126480-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-in-ccrtable-insertapproveddata-that-allows-authenticated-users-to-inject-sql-through-request-par2026-11-13 https://bugrater.com/releases/cve-2026-126481-openemr-before-8-5-0-contains-a-path-traversal-vulnerability-in-era-payments-php-and-sl-eob-search-php-that-allows-authenticated-billing-users-to-write-files-ou2026-11-13 https://bugrater.com/releases/cve-2026-126482-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-in-sleob-slinvoicenumber-in-src-billing-sleob-php-which-concatenates-the-clp01-claim-identifier2026-11-13 https://bugrater.com/releases/cve-2026-126483-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-that-allows-authenticated-report-users-to-manipulate-queries-by-supplying-a-crafted-form-facility-v2026-11-13 https://bugrater.com/releases/cve-2026-126484-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-in-printed-fee-sheet-php-that-allows-authenticated-portal-patients-to-inject-script-by2026-11-13 https://bugrater.com/releases/cve-2026-126485-openemr-before-8-5-0-contains-a-cross-site-request-forgery-vulnerability-in-observationcontroller-deleteaction-that-allows-attackers-to-delete-observation-form2026-11-13 https://bugrater.com/releases/cve-2026-126486-openemr-before-8-5-0-contains-a-missing-authorization-vulnerability-in-portal-import-template-php-where-several-portal-document-template-modes-lack-admin-forms2026-11-13 https://bugrater.com/releases/cve-2026-126487-openemr-before-8-5-0-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-override-system-wide-global-configuration-values-by-stori2026-11-13 https://bugrater.com/releases/cve-2026-126488-openemr-before-8-5-0-contains-an-sql-injection-vulnerability-in-the-patient-portal-onsitedocument-query-endpoint-where-mass-assigned-bitwiseand-criteria-param2026-11-13 https://bugrater.com/releases/cve-2026-126489-openemr-before-8-5-0-contains-a-second-order-sql-injection-vulnerability-in-the-ippf-contraceptive-issue-feature-because-issue-ippf-con-save-concatenates-layout2026-11-13 https://bugrater.com/releases/cve-2026-126490-openemr-before-8-5-0-contains-active-debug-code-in-interface-fax-fax-view-php-that-executes-passthru-groups-and-discloses-the-web-server-s-unix-group-members2026-11-13 https://bugrater.com/releases/cve-2026-126491-openemr-before-8-5-0-contains-a-stored-sql-injection-vulnerability-in-getbypatientdemographics-where-layout-options-field-id-values-are-concatenated-into-the2026-11-13 https://bugrater.com/releases/cve-2026-126492-openemr-before-8-5-0-contains-a-second-order-sql-injection-vulnerability-that-allows-low-privileged-authenticated-users-to-store-malicious-sql-via-library-ajax2026-11-13 https://bugrater.com/releases/cve-2026-126493-openemr-before-8-5-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-low-privileged-patient-portal-users-to-inject-javascript-via-the-tableargs2026-11-13 https://bugrater.com/releases/cve-2026-126494-openemr-before-8-4-0-contains-an-improper-authorization-vulnerability-in-scoperepository-finalizescopes-that-allows-read-only-smart-oauth-clients-to-obtain-w2026-11-13 https://bugrater.com/releases/cve-2026-126936-zipline-before-4-7-0-contains-a-race-condition-vulnerability-that-allows-users-to-bypass-invitation-usage-limits-upload-storage-quotas-and-shortened-url-quota2026-11-13 https://bugrater.com/releases/cve-2026-126937-zipline-before-4-6-5-contains-a-toctou-race-condition-in-the-post-api-setup-endpoint-that-allows-unauthenticated-attackers-to-create-multiple-superadmin-accoun2026-11-13 https://bugrater.com/releases/cve-2026-126938-zipline-before-4-6-4-contains-a-resource-allocation-vulnerability-that-allows-authenticated-users-to-bypass-chunked-upload-size-and-quota-checks-by-forging-cont2026-11-13 https://bugrater.com/releases/cve-2026-126939-zipline-before-4-6-4-contains-an-information-disclosure-vulnerability-in-get-api-server-folder-id-that-allows-unauthenticated-attackers-to-list-files-in-non-p2026-11-13 https://bugrater.com/releases/cve-2026-126940-zipline-before-4-6-4-contains-a-rate-limit-bypass-vulnerability-that-allows-remote-attackers-to-evade-request-limits-by-varying-query-strings-or-supplying-the-x2026-11-13 https://bugrater.com/releases/cve-2026-126941-zipline-through-4-6-2-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-administrators-to-read-superadmin-secrets-because-get-api-users2026-11-13 https://bugrater.com/releases/cve-2026-126942-zipline-before-4-6-2-contains-a-missing-authorization-vulnerability-in-post-api-user-folders-that-allows-authenticated-users-to-reparent-other-users-files-by2026-11-13 https://bugrater.com/releases/cve-2026-126943-zipline-from-4-2-0-before-4-6-2-contains-an-information-disclosure-vulnerability-that-logs-sensitive-environment-variable-values-such-as-oauth-oidc-client-secr2026-11-13 https://bugrater.com/releases/cve-2026-126944-zipline-before-4-6-1-contains-a-path-traversal-vulnerability-in-localdatasource-that-allows-superadmin-users-to-read-or-delete-files-outside-the-upload-director2026-11-13 https://bugrater.com/releases/cve-2026-126945-zipline-before-4-5-1-contains-a-stored-cross-site-scripting-vulnerability-in-the-highlightcode-component-that-renders-unescaped-file-content-before-highlight-js2026-11-13 https://bugrater.com/releases/cve-2026-126946-zipline-from-4-3-0-before-4-5-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-low-privilege-users-to-inject-html-through-unesca2026-11-13 https://bugrater.com/releases/cve-2026-126947-zipline-before-4-5-0-contains-a-stored-open-redirect-vulnerability-that-allows-authenticated-users-to-set-arbitrary-short-url-destinations-by-abusing-missing-sc2026-11-13 https://bugrater.com/releases/cve-2026-126949-zipline-through-4-4-0-contains-a-path-traversal-vulnerability-in-the-patch-api-user-files-id-rename-endpoint-that-allows-authenticated-users-to-overwrite-exis2026-11-13 https://bugrater.com/releases/cve-2026-126950-zipline-through-4-4-0-contains-a-path-traversal-vulnerability-that-allows-authenticated-attackers-to-delete-arbitrary-server-files-by-injecting-traversal-sequen2026-11-13 https://bugrater.com/releases/cve-2026-126951-zipline-through-4-4-0-contains-a-path-traversal-vulnerability-that-allows-authenticated-users-to-read-arbitrary-server-files-by-abusing-a-fallback-treating-the2026-11-13 https://bugrater.com/releases/cve-2026-126952-zipline-through-4-4-0-contains-an-authentication-bypass-vulnerability-in-the-webauthn-login-endpoint-that-creates-sessions-for-a-supplied-registered-credential2026-11-13 https://bugrater.com/releases/cve-2026-126954-glance-from-0-7-9-before-0-8-8-contains-a-stored-cross-site-scripting-vulnerability-that-allows-malicious-extension-endpoints-to-inject-javascript-urls-via-the2026-11-13 https://bugrater.com/releases/cve-2026-126955-glance-from-0-8-0-before-0-8-8-contains-an-observable-response-discrepancy-in-handlepagerequest-and-handlepagecontentrequest-that-allows-unauthenticated-attacke2026-11-13 https://bugrater.com/releases/cve-2026-127073-opstree-buildpiper-before-2-7-0-contains-a-privilege-escalation-vulnerability-that-allows-project-users-to-gain-kubernetes-cluster-admin-rights-by-submitting-un2026-11-13 https://bugrater.com/releases/cve-2026-127074-opstree-buildpiper-before-2-7-0-contains-a-path-traversal-vulnerability-that-allows-authenticated-users-with-build-configuration-permission-to-read-files-on-the2026-11-13 https://bugrater.com/releases/cve-2026-127075-opstree-buildpiper-before-2-7-0-contains-a-path-traversal-vulnerability-that-allows-authenticated-users-to-read-arbitrary-files-by-supplying-traversal-sequences2026-11-13 https://bugrater.com/releases/cve-2026-127076-opstree-buildpiper-before-2-7-0-contains-a-broken-access-control-vulnerability-that-allows-authenticated-users-to-list-and-build-from-git-repositories-restricte2026-11-13 https://bugrater.com/releases/cve-2026-127077-opstree-buildpiper-before-2-7-0-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-create-environments-on-unassigned-kubernetes-c2026-11-13 https://bugrater.com/releases/cve-2026-127078-opstree-buildpiper-before-2-7-0-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-attach-another-application-s-environment-to-th2026-11-13 https://bugrater.com/releases/cve-2026-127079-opstree-buildpiper-before-2-7-0-lacks-rate-limiting-on-password-reset-otp-verification-allowing-unauthenticated-attackers-to-brute-force-6-digit-otps-attacker2026-11-13 https://bugrater.com/releases/cve-2026-127080-opstree-buildpiper-before-2-7-0-contains-an-improper-authorization-vulnerability-that-allows-authenticated-deploy-users-to-define-arbitrary-kubernetes-hostpath2026-11-13 https://bugrater.com/releases/cve-2026-127081-opstree-buildpiper-before-2-7-0-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-link-pipeline-stages-to-environments-of-other2026-11-13 https://bugrater.com/releases/cve-2026-127082-huginn-before-2026-11-09-contains-an-information-exposure-vulnerability-in-jqagent-that-allows-authenticated-users-to-read-the-server-process-environment-becaus2026-11-13 https://bugrater.com/releases/cve-2026-127083-huginn-from-2026-09-09-before-2026-11-09-contains-a-server-side-request-forgery-vulnerability-because-outboundproxy-configure-applies-the-egress-proxy-only-to2026-11-13 https://bugrater.com/releases/cve-2026-127084-teable-before-2026-10-12t12-45-53z-3331-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-to-upload-svg-or-html-attachments-w2026-11-13 https://bugrater.com/releases/cve-2026-127085-ryot-before-10-5-6-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-remove-entries-from-other-users-collections-by-supplying-a2026-11-13 https://bugrater.com/releases/cve-2026-127086-ryot-before-10-5-6-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-take-over-other-users-collections-by-supplying-an-updateid2026-11-13 https://bugrater.com/releases/cve-2026-127087-ryot-before-10-5-6-contains-an-authorization-bypass-vulnerability-that-allows-authenticated-users-to-revoke-other-users-access-links-by-supplying-an-arbitrary2026-11-13 https://bugrater.com/releases/cve-2026-127088-2fauth-before-9-0-1-contains-a-weak-password-recovery-vulnerability-that-allows-unauthenticated-attackers-to-poison-reset-links-by-forging-the-http-host-header2026-11-13 https://bugrater.com/releases/cve-2026-127090-jadaptive-maverick-synergy-server-before-3-0-33-and-3-1-x-before-3-1-7-and-maverick-legacy-server-before-1-8-1-contain-an-authentication-bypass-vulnerability2026-11-13 https://bugrater.com/releases/cve-2026-127091-jadaptive-maverick-synergy-server-before-3-0-33-and-3-1-x-before-3-1-7-and-maverick-legacy-server-before-1-8-1-contain-an-improper-path-equivalence-flaw-in-vi2026-11-13 https://bugrater.com/releases/cve-2026-127092-buildadmin-1-0-1-through-2-3-9-contains-a-stored-cross-site-scripting-vulnerability-that-allows-unauthenticated-attackers-to-store-javascript-urls-in-the-admin2026-11-13 https://bugrater.com/releases/cve-2026-127093-rustrak-before-0-26-0-contains-a-server-side-request-forgery-vulnerability-that-allows-users-with-integrations-update-permission-to-send-requests-to-arbitrary-d2026-11-13 https://bugrater.com/releases/cve-2026-127094-pagelayer-2-1-7-before-2-2-1-contains-a-missing-authorization-vulnerability-in-abilities-api-abilities-registered-in-main-abilitiesregister-php-that-only-requir2026-11-13 https://bugrater.com/releases/cve-2026-128014-frankenphp-standalone-static-binaries-1-8-0-before-1-13-2-bundle-the-php-brotli-extension-statically-linked-with-brotli-1-2-0-whose-decoder-contains-an-out-of2026-11-13 https://bugrater.com/releases/cve-2026-128015-frankenphp-before-1-13-4-contains-a-use-after-free-vulnerability-that-leaves-a-dangling-pointer-to-a-freed-environment-table-when-putenv-is-called-during-requ2026-11-13 https://bugrater.com/releases/cve-2026-128016-frankenphp-before-1-13-4-contains-a-use-after-free-vulnerability-in-worker-mode-that-frees-internal-streams-of-spltempfileobject-or-splfileobject-on-php-temp2026-11-13 https://bugrater.com/releases/cve-2026-128017-frankenphp-before-1-13-4-contains-a-double-free-vulnerability-in-worker-mode-that-frees-sg-request-info-content-type-dup-twice-when-a-worker-script-ends-its-lo2026-11-13 https://bugrater.com/releases/cve-2026-128018-frankenphp-before-1-13-4-contains-a-denial-of-service-vulnerability-in-worker-mode-where-frankenphp-handle-request-returns-false-without-finishing-the-dequeue2026-11-13 https://bugrater.com/releases/cve-2026-128019-frankenphp-before-1-13-4-contains-an-information-disclosure-vulnerability-in-worker-mode-that-leaks-per-request-environment-variables-into-later-requests-on-the2026-11-13 https://bugrater.com/releases/cve-2026-128020-frankenphp-before-1-13-2-contains-an-uncontrolled-recursion-vulnerability-in-its-php-to-go-array-converter-that-fails-to-detect-circular-references-in-php-array2026-11-13 https://bugrater.com/releases/cve-2026-128021-frankenphp-before-1-13-2-contains-an-information-disclosure-vulnerability-that-allows-later-clients-to-read-earlier-clients-libxml-errors-because-worker-mode-n2026-11-13 https://bugrater.com/releases/cve-2026-128022-frankenphp-before-1-13-2-contains-a-resource-exhaustion-vulnerability-that-allows-unauthenticated-clients-to-tie-up-php-threads-because-queued-requests-are-not2026-11-13 https://bugrater.com/releases/cve-2026-128023-frankenphp-before-1-13-0-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-spoof-trusted-headers-by-sending-dot-form-head2026-11-13 https://bugrater.com/releases/cve-2026-128024-frankenphp-before-1-13-0-contains-a-denial-of-service-vulnerability-in-goarray-that-allows-remote-attackers-to-abort-the-server-process-via-arrays-with-null-i2026-11-13 https://bugrater.com/releases/cve-2026-128025-frankenphp-before-1-13-0-contains-a-path-split-interpretation-conflict-in-splitpos-in-cgi-go-that-allows-unauthenticated-attackers-to-execute-protected-php-scri2026-11-13 https://bugrater.com/releases/cve-2026-128026-frankenphp-from-1-5-0-before-1-13-0-contains-an-incomplete-environment-sandbox-vulnerability-in-which-putenv-writes-to-the-process-wide-os-environment-via-os-se2026-11-13 https://bugrater.com/releases/cve-2026-128027-frankenphp-docker-images-before-1-1-11-were-rebuilt-only-when-new-base-image-tags-were-created-so-security-fixes-that-alpine-php-and-go-applied-under-existin2026-11-13 https://bugrater.com/releases/cve-2026-128032-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-accepts-the-free-no-payment-information-required-payment-method-on-orders-with-a-non2026-11-13 https://bugrater.com/releases/cve-2026-128040-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-contains-a-stored-cross-site-scripting-vulnerability-because-admin-pages-render-dataflo2026-11-13 https://bugrater.com/releases/cve-2026-128042-openmage-magento-lts-before-20-19-0-and-21-0-0-beta1-before-21-0-0-beta3-contains-a-race-condition-in-shopping-cart-price-rule-usage-limits-because-mage-salesr2026-11-13 https://bugrater.com/releases/cve-2026-128043-openmage-magento-lts-before-20-19-0-and-21-0-0-beta1-before-21-0-0-beta3-contains-a-cross-site-request-forgery-vulnerability-in-paypal-cancel-and-decline-return2026-11-13 https://bugrater.com/releases/cve-2026-128044-openmage-magento-lts-before-20-18-2-and-21-x-before-21-0-0-beta3-validates-oauth-1-0a-oauth-callback-urls-with-a-string-prefix-check-and-falls-back-to-accepting2026-11-13 https://bugrater.com/releases/cve-2026-128045-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-contains-an-authorization-bypass-in-the-rss-order-status-feed-because-its-url-key-is-u2026-11-13 https://bugrater.com/releases/cve-2026-128046-openmage-magento-lts-20-17-0-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-contains-an-unrestricted-file-upload-vulnerability-because-the-general-file-pro2026-11-13 https://bugrater.com/releases/cve-2026-128047-openmage-magento-lts-before-20-18-2-and-21-0-0-beta-pre-releases-before-21-0-0-beta3-generate-customer-email-confirmation-keys-with-md5-uniqid-and-customer-a2026-11-13 https://bugrater.com/releases/cve-2026-128048-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-lets-restricted-administrators-read-decrypted-configuration-secrets-because-the-store-g2026-11-13 https://bugrater.com/releases/cve-2026-128049-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-contains-a-cross-site-request-forgery-vulnerability-in-the-admin-and-storefront-oauth-c2026-11-13 https://bugrater.com/releases/cve-2026-128051-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-contains-a-stored-cross-site-scripting-vulnerability-because-storefront-msrp-map-popup2026-11-13 https://bugrater.com/releases/cve-2026-128052-openmage-magento-lts-before-20-19-0-and-21-0-0-beta1-before-21-0-0-beta3-contains-an-incorrect-authorization-vulnerability-in-the-template-filter-s-layout-d2026-11-13 https://bugrater.com/releases/cve-2026-128053-openmage-magento-lts-before-20-18-2-and-21-0-0-beta1-before-21-0-0-beta3-contains-a-reflected-cross-site-scripting-vulnerability-in-its-error-pages-which-print2026-11-13 https://bugrater.com/releases/cve-2026-128237-scapy-before-2-8-0-contains-a-denial-of-service-vulnerability-in-ber-num-dec-and-bercodec-oid-do-dec-that-allows-remote-attackers-to-exhaust-cpu-by-supplyin2026-11-13 https://bugrater.com/releases/cve-2026-128238-scapy-before-2-8-0-contains-an-uncontrolled-recursion-vulnerability-in-the-ber-asn-1-decoder-in-scapy-asn1-ber-py-that-allows-unauthenticated-remote-attackers-t2026-11-13 https://bugrater.com/releases/cve-2026-128239-gpac-through-26-07-0-contains-a-null-pointer-dereference-vulnerability-in-the-mpeg-4-form-spatial-constraint-handlers-in-src-compositor-mpeg4-form-c-that-lets-a2026-11-13 https://bugrater.com/releases/cve-2026-128240-gpac-through-26-07-0-contains-a-use-after-free-vulnerability-in-gf-sg-proto-del-in-src-scenegraph-vrml-proto-c-because-gf-sg-reset-frees-unregistered-protot2026-11-13 https://bugrater.com/releases/cve-2026-128241-the-xmlwf-tool-in-libexpat-through-2-10-0-contains-a-symlink-following-vulnerability-because-d-output-mode-opens-files-with-fopen-wb-which-follows-symbolic2026-11-13 https://bugrater.com/releases/cve-2026-128242-actix-http-before-3-20-1-and-actix-web-before-4-18-2-contain-an-unbounded-decompression-vulnerability-in-encoding-decoder-that-lets-remote-attackers-exhaust-me2026-11-13 https://bugrater.com/releases/cve-2026-128328-dokploy-0-28-0-before-0-31-1-contains-a-path-traversal-vulnerability-that-allows-authenticated-organization-members-to-list-tracked-files-of-any-git-repository2026-11-13 https://bugrater.com/releases/cve-2026-128329-dokploy-0-28-0-before-0-31-1-contains-a-path-traversal-vulnerability-that-allows-authenticated-organization-members-to-read-arbitrary-files-by-supplying-seq2026-11-13 https://bugrater.com/releases/cve-2026-128330-miniflux-before-2-3-5-contains-an-insufficient-session-expiration-vulnerability-that-allows-attackers-to-retain-account-access-because-password-changes-do-not-r2026-11-13 https://bugrater.com/releases/cve-2026-128331-miniflux-before-2-3-5-contains-an-unverified-password-change-vulnerability-that-allows-holders-of-a-signed-in-session-to-change-the-account-password-without-sup2026-11-13 https://bugrater.com/releases/cve-2026-128332-listmonk-6-0-0-before-7-0-0-beta-2-contains-a-2fa-bypass-vulnerability-that-allows-attackers-with-a-valid-password-to-brute-force-totp-codes-because-the-attempt2026-11-13 https://bugrater.com/releases/cve-2026-128333-listmonk-6-0-0-before-7-0-0-beta-2-contains-an-authentication-bypass-vulnerability-in-doresetpassword-that-skips-totp-verification-after-a-password-reset-attac2026-11-13 https://bugrater.com/releases/cve-2026-128334-listmonk-6-2-0-before-7-0-0-beta-2-contains-a-missing-authentication-vulnerability-that-allows-unauthenticated-attackers-to-submit-azure-event-grid-bounce-webho2026-11-13 https://bugrater.com/releases/cve-2026-128335-contao-4-6-0-before-5-3-54-5-4-0-rc1-before-5-7-17-and-6-0-0-rc1-before-6-0-6-fails-to-invalidate-existing-user-sessions-when-two-factor-authentication-is-ena2026-11-13 https://bugrater.com/releases/cve-2026-128336-exceljs-through-4-4-0-contains-a-prototype-pollution-vulnerability-that-allows-attackers-to-add-numeric-keys-to-object-prototype-through-a-crafted-defined-name2026-11-13 https://bugrater.com/releases/cve-2026-128337-exceljs-through-4-4-0-contains-a-prototype-pollution-vulnerability-in-mergeconditionalformattings-that-allows-attackers-to-modify-object-prototype-by-supplying2026-11-13 https://bugrater.com/releases/cve-2026-128338-exceljs-through-4-4-0-contains-a-memory-exhaustion-vulnerability-that-allows-attackers-to-crash-applications-by-supplying-a-worksheet-col-element-with-an-unboun2026-11-13 https://bugrater.com/releases/cve-2026-128339-exceljs-through-4-4-0-contains-a-memory-exhaustion-vulnerability-in-worksheet-parsemergecells-that-allows-attackers-to-crash-applications-by-supplying-unbounde2026-11-13 https://bugrater.com/releases/cve-2026-128340-exceljs-through-4-4-0-contains-a-memory-exhaustion-vulnerability-that-allows-attackers-to-crash-applications-by-supplying-a-workbook-with-an-oversized-defined-n2026-11-13 https://bugrater.com/releases/cve-2026-128341-exceljs-through-4-4-0-contains-a-resource-exhaustion-vulnerability-in-data-validations-xform-js-that-allows-attackers-to-exhaust-cpu-and-memory-by-supplying-unb2026-11-13 https://bugrater.com/releases/cve-2026-128342-exceljs-through-4-4-0-contains-a-denial-of-service-vulnerability-that-allows-attackers-to-block-the-event-loop-by-supplying-an-unbounded-sheetid-in-xl-workbook2026-11-13 https://bugrater.com/releases/cve-2026-128343-exceljs-through-4-4-0-contains-a-denial-of-service-vulnerability-that-allows-attackers-to-block-the-event-loop-by-supplying-unbounded-row-r-attributes-parsed-in2026-11-13 https://bugrater.com/releases/cve-2026-128344-exceljs-through-4-4-0-contains-a-memory-exhaustion-vulnerability-that-allows-attackers-to-crash-applications-by-supplying-a-workbook-with-an-unbounded-image-anc2026-11-13 https://bugrater.com/releases/cve-2026-128345-exceljs-through-4-4-0-contains-a-regular-expression-denial-of-service-vulnerability-in-slideformula-in-lib-utils-shared-formula-js-when-translating-shared-formu2026-11-13 https://bugrater.com/releases/cve-2026-128346-exceljs-through-4-4-0-contains-a-resource-leak-vulnerability-in-the-streaming-workbookreader-parse-that-leaves-temporary-files-and-open-descriptors-when-sheet-p2026-11-13 https://bugrater.com/releases/cve-2026-128347-exceljs-through-4-4-0-contains-an-arbitrary-file-read-vulnerability-in-the-streaming-workbookwriter-that-allows-attackers-to-read-local-files-by-supplying-craft2026-11-13 https://bugrater.com/releases/cve-2026-128348-exceljs-through-4-4-0-contains-a-formula-injection-vulnerability-in-the-totals-row-formula-getter-in-lib-doc-table-js-that-fails-to-escape-and-charact2026-11-13 https://bugrater.com/releases/cve-2026-61417-dell-smartfabric-os10-software-versions-prior-to-10-6-0-10-contains-an-improper-access-control-vulnerability-a-low-privileged-attacker-with-remote-access-cou2026-11-13 https://bugrater.com/releases/cve-2026-61418-dell-smartfabric-os10-software-versions-prior-to-10-6-0-10-contains-an-incorrect-authorization-vulnerability-a-low-privileged-attacker-with-remote-access-cou2026-11-13 https://bugrater.com/releases/cve-2026-75494-cudy-tr3000-before-2-5-42-contains-an-argument-injection-vulnerability-that-allows-a-malicious-or-compromised-acs-to-inject-curl-options-through-unfiltered-user2026-11-13 https://bugrater.com/releases/cve-2026-75578-cudy-tr3000-before-2-5-42-contains-a-command-injection-vulnerability-in-luci-model-cbi-vpn-openvpn-client-lua-which-embeds-the-shellquote-quoted-remote-host2026-11-13 https://bugrater.com/releases/cve-2026-109903-a-buffer-overread-caused-by-casting-a-negative-integer-to-card32-in-xvqueryimageattributes-in-x-org-x-server-before-21-1-26-and-xwayland-before-24-1-15-could-be2026-11-13 https://bugrater.com/releases/cve-2026-109904-a-buffer-overread-caused-by-an-integer-overflow-in-proc-sprocxresqueryclientids-in-x-org-xwayland-before-24-1-15-and-x-server-before-21-1-26-could-be-used-by-at2026-11-13 https://bugrater.com/releases/cve-2026-112182-unauthorization-vulnerability-in-the-management-of-workflow-definitions-in-openkm-community-edition-the-rest-endpoints-registerprocessdefinition-and-runproc2026-11-13 https://bugrater.com/releases/cve-2026-123274-out-of-bounds-write-vulnerability-in-apache-datasketches-c-an-application-that-deserializes-a-kll-sketch-from-an-untrusted-source-can-have-heap-memory-co2026-11-13 https://bugrater.com/releases/cve-2026-125659-this-vulnerability-exists-in-the-emudhra-embridge-due-to-missing-authorization-checks-in-the-filebrowser-api-endpoints-these-endpoints-perform-file-system-enum2026-11-13 https://bugrater.com/releases/cve-2026-120221-in-frrouting-8-4-and-later-bgpd-frees-the-same-memory-twice-when-dynamic-bgp-neighbors-disconnect-if-the-peer-group-used-by-a-bgp-listen-range-also-has-a-si2026-11-13 https://bugrater.com/releases/cve-2025-41725-affected-devices-running-firmware-versions-prior-to-4-1-0-may-crash-and-become-unavailable-when-receiving-specific-malformed-bluetooth-messages-from-an-unauthen2026-11-13 https://bugrater.com/releases/cve-2026-105880-authorization-bypass-through-user-controlled-key-vulnerability-in-tobias-webinarignition-webinar-ignition-allows-exploiting-incorrectly-configured-access-contro2026-11-13 https://bugrater.com/releases/cve-2026-112830-missing-authorization-vulnerability-in-brizy-brizy-brizy-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-brizy-from2026-11-13 https://bugrater.com/releases/cve-2026-119518-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wproyal-royal-elementor-addons-royal-elementor-addons-allo2026-11-13 https://bugrater.com/releases/cve-2026-121721-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-publishpress-gutenberg-blocks-advanced-gutenberg-allows-st2026-11-13 https://bugrater.com/releases/cve-2026-121771-insertion-of-sensitive-information-into-sent-data-vulnerability-in-publishpress-gutenberg-blocks-advanced-gutenberg-allows-retrieve-embedded-sensitive-data-this2026-11-13 https://bugrater.com/releases/cve-2026-125801-concurrent-execution-using-shared-resource-with-improper-synchronization-race-condition-vulnerability-in-automattic-woocommerce-woocommerce-allows-leveragin2026-11-13 https://bugrater.com/releases/cve-2026-125814-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-rymera-web-co-product-feed-pro-for-woocommerce-woo-product-feed-p2026-11-13 https://bugrater.com/releases/cve-2026-125815-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-noah-hearle-we-re-open-opening-hours-allows-code-injection-this2026-11-13 https://bugrater.com/releases/cve-2026-125816-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-pt-norther-lights-production-mapsvg-mapsvg-lite-interactiv2026-11-13 https://bugrater.com/releases/cve-2026-125833-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-yith-yith-woocommerce-ajax-product-filter-yith-woocommerce2026-11-13 https://bugrater.com/releases/cve-2026-128834-missing-authorization-vulnerability-in-brainstorm-force-spectra-ultimate-addons-for-gutenberg-allows-exploiting-incorrectly-configured-access-control-security-l2026-11-13 https://bugrater.com/releases/cve-2026-95518-time-of-check-time-of-use-toctou-race-condition-vulnerability-in-t-b-tak-b-lgem-yaz-l-m-teknolojileri-ara-t-rma-enstit-s-pardus-package-installer-allows-leve2026-11-13 https://bugrater.com/releases/cve-2026-109095-a-integer-overflow-in-glamor-xv-image-size-handling-in-x-org-xwayland-before-24-1-15-and-x-server-before-21-1-26-could-be-used-by-authenticated-clients-to-crash2026-11-13 https://bugrater.com/releases/cve-2026-109096-incorrect-handling-of-negative-returns-from-ddqueryimageattributes-when-processing-xvputimage-requests-in-x-org-xwayland-before-24-1-15-and-x-server-before-22026-11-13 https://bugrater.com/releases/cve-2026-124758-p-net-before-1-0-4-does-not-check-the-record-data-length-of-an-iodwrite-request-to-a-non-user-record-index-against-the-size-of-the-record-block-header-the-32-b2026-11-13 https://bugrater.com/releases/cve-2026-124759-p-net-before-1-0-4-routes-a-received-rta-alarm-frame-to-an-application-relationship-using-only-the-destination-alarm-reference-in-the-frame-without-checking-th2026-11-13 https://bugrater.com/releases/cve-2026-124760-p-net-before-1-0-4-sets-the-alarm-receiver-state-to-waiting-for-confirmation-before-the-data-of-a-received-alarm-notification-is-parsed-if-the-parsing-fails-th2026-11-13 https://bugrater.com/releases/cve-2026-124761-p-net-before-1-0-4-copies-the-ip-suite-of-a-dcp-set-request-to-the-current-and-the-non-volatile-configuration-and-starts-saving-it-before-the-state-of-the-dev2026-11-13 https://bugrater.com/releases/cve-2026-124762-p-net-before-1-0-4-finds-the-rpc-session-of-a-received-pdu-by-its-activity-uuid-only-and-a-reject-fault-or-cancel-pdu-for-the-session-aborts-the-application-r2026-11-13 https://bugrater.com/releases/cve-2026-125800-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-brainstorm-force-spectra-ultimate-addons-for-gutenberg-all2026-11-13 https://bugrater.com/releases/cve-2026-128790-in-eclipse-basyx-go-components-versions-up-to-and-including-1-1-2-abac-enabled-deployments-of-the-submodel-repository-and-the-aas-environment-do-not-apply-an-a2026-11-13 https://bugrater.com/releases/cve-2026-77706-improper-handling-of-highly-compressed-data-data-amplification-vulnerability-in-fileorbis-bili-im-hizmetleri-ticaret-anonim-irketi-fileorbis-nextgen-fileserv2026-11-13 https://bugrater.com/releases/cve-2026-91094-a-directory-traversal-bug-was-discovered-when-unpacking-3-0-quilt-source-packages-where-the-packaging-tarball-could-contain-the-quilt-database-directory-pc2026-11-13 https://bugrater.com/releases/cve-2026-103769-deserialization-of-untrusted-data-vulnerability-in-acowebs-pdf-invoices-and-packing-slips-for-woocommerce-pdf-invoices-and-packing-slips-for-woocommerce-allows2026-11-13 https://bugrater.com/releases/cve-2026-109092-incorrectly-handled-negative-sizes-when-processing-procxvshmputimage-requests-in-the-x-org-xwayland-before-24-1-15-and-x-server-before-21-1-26-could-be-used-by2026-11-13 https://bugrater.com/releases/cve-2026-109093-a-stack-buffer-overflow-in-procxtestfakeinput-devicevaluator-handling-in-x-org-xwayland-before-24-1-15-and-x-server-before-21-1-26-could-be-used-by-authenticat2026-11-13 https://bugrater.com/releases/cve-2026-109445-planet-gs-5220-8p2t2s-hardware-version-3-0-firmware-versions-before-3-2412b261008-contains-a-stack-based-buffer-overflow-vulnerability-that-allows-unauthentic2026-11-13 https://bugrater.com/releases/cve-2026-119102-in-telerik-ui-for-blazor-versions-v12-0-0-through-15-2-0-an-improper-input-validation-vulnerability-exists-where-the-grid-treelist-and-gantt-s-ai-command-fi2026-11-13 https://bugrater.com/releases/cve-2026-119512-deserialization-of-untrusted-data-vulnerability-in-tribulant-software-newsletters-newsletters-lite-allows-object-injection-this-issue-affects-newsletters-from2026-11-13 https://bugrater.com/releases/cve-2026-119517-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-villatheme-catna-woo-name-your-price-and-offers-catna-wo2026-11-13 https://bugrater.com/releases/cve-2026-120835-deserialization-of-untrusted-data-vulnerability-in-villatheme-affi-affiliate-marketing-for-woocommerce-affi-affiliate-marketing-for-woo-allows-object-injectio2026-11-13 https://bugrater.com/releases/cve-2026-121776-missing-authorization-vulnerability-in-wp-chill-passster-content-protector-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-af2026-11-13 https://bugrater.com/releases/cve-2026-123975-grid-community-toolkit-before-6-2-20261111-globus-gss-assist-before-12-9-contains-a-heap-out-of-bounds-write-in-globus-gss-assist-token-get-fd-triggered-by2026-11-13 https://bugrater.com/releases/cve-2026-124260-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-jacob-n-breetvelt-wp-photo-album-plus-wp-photo-album-plus2026-11-13 https://bugrater.com/releases/cve-2026-124265-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-tribulant-software-newsletters-newsletters-lite-allows-bli2026-11-13 https://bugrater.com/releases/cve-2026-124267-missing-authorization-vulnerability-in-noor-alam-gmail-smtp-gmail-smtp-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affect2026-11-13 https://bugrater.com/releases/cve-2026-124272-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-dimitri-grassi-salon-booking-system-salon-booking-system-a2026-11-13 https://bugrater.com/releases/cve-2026-124409-missing-authorization-vulnerability-in-villatheme-curcy-woo-multi-currency-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-af2026-11-13 https://bugrater.com/releases/cve-2026-124410-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wplingua-translation-service-translate-and-boost-seo-8212026-11-13 https://bugrater.com/releases/cve-2026-124412-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-elightup-slim-seo-slim-seo-allows-code-injection-this-issue-affec2026-11-13 https://bugrater.com/releases/cve-2026-124414-weak-authentication-vulnerability-in-videowhisper-com-broadcast-live-video-videowhisper-live-streaming-integration-allows-authentication-abuse-this-issue-affect2026-11-13 https://bugrater.com/releases/cve-2026-124415-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-alejandro-alex-reservations-alex-reservations-allows-sql-i2026-11-13 https://bugrater.com/releases/cve-2026-124418-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-ahmad-wp-job-portal-wp-job-portal-allows-stored-xss-this-i2026-11-13 https://bugrater.com/releases/cve-2026-124420-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-themeisle-woody-ad-snippets-insert-php-allows-reflected-xs2026-11-13 https://bugrater.com/releases/cve-2026-124965-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-rtcamp-inc-rtmedia-for-wordpress-buddypress-and-bbpress2026-11-13 https://bugrater.com/releases/cve-2026-124970-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-wp-base-wp-base-booking-wp-base-booking-of-appointments-se2026-11-13 https://bugrater.com/releases/cve-2026-125432-weak-password-recovery-mechanism-for-forgotten-password-vulnerability-in-relywp-recaptcha-for-woocommerce-recaptcha-woo-allows-password-recovery-exploitation-th2026-11-13 https://bugrater.com/releases/cve-2026-125440-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-cristi-n-l-vaque-s2member-s2member-allows-code-injection-this-iss2026-11-13 https://bugrater.com/releases/cve-2026-125452-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-denishua-wpjam-basic-wpjam-basic-allows-reflected-xss-this2026-11-13 https://bugrater.com/releases/cve-2026-125783-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-madalin-ungureanu-custom-post-types-and-custom-fields-crea2026-11-13 https://bugrater.com/releases/cve-2026-125792-missing-authorization-vulnerability-in-andy-moyle-church-admin-church-admin-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-a2026-11-13 https://bugrater.com/releases/cve-2026-125794-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-hupe13-extension-for-leaflet-map-extensions-leaflet-map-al2026-11-13 https://bugrater.com/releases/cve-2026-125802-insertion-of-sensitive-information-into-sent-data-vulnerability-in-brainstorm-force-spectra-ultimate-addons-for-gutenberg-allows-retrieve-embedded-sensitive-dat2026-11-13 https://bugrater.com/releases/cve-2026-125807-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-htmega-ht-mega-ht-mega-for-elementor-allows-stored-xss-thi2026-11-13 https://bugrater.com/releases/cve-2026-125808-missing-authorization-vulnerability-in-htmega-ht-mega-ht-mega-for-elementor-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-a2026-11-13 https://bugrater.com/releases/cve-2026-125809-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-mycred-mycred-mycred-allows-stored-xss-this-issue-affects2026-11-13 https://bugrater.com/releases/cve-2026-125810-missing-authorization-vulnerability-in-mycred-mycred-mycred-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-mycred-f2026-11-13 https://bugrater.com/releases/cve-2026-125811-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-vulnerability-in-mycred-mycred-mycred-allows-blind-sql-injection-this-issue2026-11-13 https://bugrater.com/releases/cve-2026-125819-missing-authorization-vulnerability-in-publishpress-gutenberg-blocks-advanced-gutenberg-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-13 https://bugrater.com/releases/cve-2026-125821-improper-neutralization-of-script-related-html-tags-in-a-web-page-basic-xss-vulnerability-in-pt-norther-lights-production-mapsvg-mapsvg-lite-interactive-vecto2026-11-13 https://bugrater.com/releases/cve-2026-125824-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-wp-go-maps-wp-go-maps-wp-google-maps-allows-stored-xss-thi2026-11-13 https://bugrater.com/releases/cve-2026-125825-missing-authorization-vulnerability-in-webful-creations-repairbuddy-computer-repair-shop-allows-exploiting-incorrectly-configured-access-control-security-levels2026-11-13 https://bugrater.com/releases/cve-2026-125827-missing-authorization-vulnerability-in-liquid-web-stellarwp-event-tickets-event-tickets-allows-exploiting-incorrectly-configured-access-control-security-level2026-11-13 https://bugrater.com/releases/cve-2026-125831-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-ideabox-creations-powerpack-lite-for-beaver-builder-powerp2026-11-13 https://bugrater.com/releases/cve-2026-125834-missing-authorization-vulnerability-in-wp-media-imagify-imagify-allows-exploiting-incorrectly-configured-access-control-security-levels-this-issue-affects-imagi2026-11-13 https://bugrater.com/releases/cve-2026-125835-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-crocoblock-jettabs-jet-tabs-allows-stored-xss-this-issue-a2026-11-13 https://bugrater.com/releases/cve-2026-125837-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-thethemefoundry-make-make-allows-reflected-xss-this-issue2026-11-13 https://bugrater.com/releases/cve-2026-125851-unrestricted-upload-of-file-with-dangerous-type-vulnerability-in-themagnifico52-hotel-booking-lite-hotel-booking-lite-allows-upload-a-web-shell-to-a-web-server2026-11-13 https://bugrater.com/releases/cve-2026-125852-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-in-realtyna-realtyna-organic-idx-plugin-real-estate-listing-realtyn2026-11-13 https://bugrater.com/releases/cve-2026-125853-missing-authorization-vulnerability-in-everestthemes-everest-backup-everest-backup-allows-exploiting-incorrectly-configured-access-control-security-levels-this2026-11-13 https://bugrater.com/releases/cve-2026-125854-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-unbounce-unbounce-landing-pages-unbounce-allows-stored-xss2026-11-13 https://bugrater.com/releases/cve-2026-125855-deserialization-of-untrusted-data-vulnerability-in-elextensions-elex-wordpress-helpdesk-customer-ticketing-system-elex-helpdesk-customer-support-ticket-system2026-11-13 https://bugrater.com/releases/cve-2026-125856-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-vulnerability-in-sarah-giles-dynamic-user-directory-dynamic-user-directory2026-11-13 https://bugrater.com/releases/cve-2026-125858-missing-authorization-vulnerability-in-cleverreach-cleverreach-wp-cleverreach-wp-allows-exploiting-incorrectly-configured-access-control-security-levels-this-i2026-11-13 https://bugrater.com/releases/cve-2026-127031-in-eclipse-aas4j-before-3-0-1-xmlschemavalidator-validateschema-and-aasxvalidator-validateschema-which-calls-it-validates-untrusted-xml-with-a-defau2026-11-13 https://bugrater.com/releases/cve-2026-127102-in-eclipse-basyx-go-components-versions-up-to-and-including-1-1-2-abac-enabled-deployments-of-the-submodel-repository-and-the-aas-environment-return-submodel-e2026-11-13 https://bugrater.com/releases/cve-2026-128907-missing-authentication-for-a-critical-function-cwe-306-in-the-management-service-uavmonitor-usbv1-of-the-1300-communications-board-in-dji-aeroscope-mobile2026-11-13 https://bugrater.com/releases/cve-2026-128908-os-command-injection-cwe-78-in-the-network-configuration-handling-of-the-management-service-uavmonitor-usbv1-of-the-1300-communications-board-in-dji-aerosco2026-11-13 https://bugrater.com/releases/cve-2026-128909-improper-verification-of-cryptographic-signature-cwe-347-in-the-firmware-update-handler-of-the-management-service-uavmonitor-usbv1-of-the-1300-communication2026-11-13 https://bugrater.com/releases/cve-2026-128910-use-of-hard-coded-credentials-cwe-798-on-the-1300-communications-board-in-dji-aeroscope-mobile-tp703-firmware-03-00-00-26-with-1300-communications-board-fi2026-11-13 https://bugrater.com/releases/cve-2026-128970-psono-server-community-edition-versions-1-12-6-through-7-5-0-and-psono-server-enterprise-edition-before-7-5-1-do-not-require-accepted-group-membership-when-auth2026-11-13 https://bugrater.com/releases/cve-2026-128990-xschem-2-9-9-through-3-4-7-contains-a-heap-out-of-bounds-write-vulnerability-in-read-dataset-in-src-rawtovcd-c-due-to-an-unchecked-variable-index-attackers-c2026-11-13 https://bugrater.com/releases/cve-2026-128991-xschem-2-9-9-through-3-4-7-contains-an-out-of-bounds-read-vulnerability-in-read-xschem-file-in-src-save-c-that-mishandles-embedded-symbol-records-lacking-a-pr2026-11-13 https://bugrater.com/releases/cve-2026-129092-ccc-attestation-sig-attested-tls-poc-through-commit-731ca82-contains-a-time-of-check-time-of-use-vulnerability-because-evidence-is-appraised-only-once-during-th2026-11-13 https://bugrater.com/releases/cve-2024-58406-huatian-dynamic-oa8000-collaborative-office-system-contains-an-unauthenticated-path-traversal-vulnerability-in-oaapp-jsp-trace-ntkodownload-jsp-where-the-file2026-11-13 https://bugrater.com/releases/cve-2026-105622-improper-restriction-of-excessive-authentication-attempts-in-the-wamp-cra-challenge-response-authentication-path-in-zenitel-connect-before-1-11-0-allows-remot2026-11-13 https://bugrater.com/releases/cve-2026-105623-the-web-interface-in-zenitel-connect-before-1-11-0-serves-production-javascript-source-maps-without-authentication-which-allows-remote-attackers-to-obtain-the2026-11-13 https://bugrater.com/releases/cve-2026-105624-the-login-flow-in-zenitel-connect-before-1-11-0-applies-per-account-lockout-on-repeated-failed-login-attempts-which-allows-remote-attackers-to-cause-a-denial-o2026-11-13 https://bugrater.com/releases/cve-2026-105625-the-web-interface-in-zenitel-connect-before-1-11-0-loads-an-integration-iframe-without-sandboxing-or-origin-restrictions-which-allows-remote-attackers-to-prese2026-11-13 https://bugrater.com/releases/cve-2026-105671-the-login-flow-in-zenitel-connect-before-1-11-0-returns-different-error-responses-depending-on-whether-a-submitted-username-exists-which-allows-remote-attacker2026-11-13 https://bugrater.com/releases/cve-2026-109091-a-buffer-overflow-in-handling-edid-display-range-descriptors-in-x-org-xwayland-before-24-1-15-and-x-server-before-21-1-26-could-be-used-by-malicious-monitors-to2026-11-13 https://bugrater.com/releases/cve-2026-121808-improper-handling-of-highly-compressed-data-data-amplification-vulnerability-in-elixir-grpc-grpc-core-and-grpc-allows-unauthenticated-attackers-to-exhaust-ser2026-11-13 https://bugrater.com/releases/cve-2026-123635-missing-release-of-resource-after-effective-lifetime-vulnerability-in-elixir-grpc-grpc-server-allows-a-client-to-stall-all-later-calls-on-a-shared-http-2-connec2026-11-13 https://bugrater.com/releases/cve-2026-124278-authorization-bypass-through-user-controlled-key-vulnerability-in-elixir-grpc-grpc-server-and-grpc-allows-an-attacker-to-make-a-handler-act-on-a-resource-other2026-11-13 https://bugrater.com/releases/cve-2026-128034-in-gittuf-before-0-18-0-verification-of-file-protection-rules-uses-the-quoted-escaped-pathnames-that-git-prints-by-default-for-files-with-special-characters2026-11-13 https://bugrater.com/releases/cve-2026-128037-in-gittuf-0-10-0-through-0-15-0-when-a-minimum-threshold-global-rule-and-a-policy-rule-protect-the-same-namespace-verification-gives-the-global-rule-s-check-o2026-11-13 https://bugrater.com/releases/cve-2026-129094-utcp-http-before-1-1-14-contains-a-server-side-request-forgery-vulnerability-that-allows-remote-manuals-to-reach-loopback-services-by-bypassing-the-remote-loop2026-11-13 https://bugrater.com/releases/cve-2026-129110-syspass-3-0-1-through-3-2-11-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-reinstall-an-already-installed-instance-by2026-11-13 https://bugrater.com/releases/cve-2026-63079-rbh-access-technologies-integra32-security-management-system-5-1-11-r5-0-contains-an-unauthenticated-deserialization-vulnerability-in-its-deprecated-net-remoti2026-11-13 https://bugrater.com/releases/cve-2026-95377-os-command-injection-in-the-tftp-provisioning-module-of-zenitel-edgeaudioclient-before-9-6-3-0-and-10-x-before-10-1-3-0-on-vsff6-vsff8-vsff8mp-vsff8mn-and2026-11-13 https://bugrater.com/releases/cve-2026-95378-path-traversal-in-the-certificate-upload-endpoint-api-certificate-upload-of-the-turbineweb-web-interface-in-zenitel-vsff6-vsff8-vsff8mp-vsff8mn-and-vsft2026-11-13 https://bugrater.com/releases/cve-2026-95379-path-traversal-in-the-certificate-deletecertificate-json-rpc-method-post-api-rpc-of-the-turbineweb-web-interface-in-zenitel-vsff6-vsff8-vsff8mp-vsff8mn-a2026-11-13 https://bugrater.com/releases/cve-2026-95613-the-prest-database-rest-api-in-zenitel-connect-firmware-before-1-11-0-signs-and-verifies-jwts-with-the-platform-ca-private-key-which-is-stored-on-a-data-volume2026-11-13 https://bugrater.com/releases/cve-2026-95614-the-host-configuration-watcher-in-zenitel-connect-before-1-11-0-applies-a-rsyslog-configuration-file-written-to-a-data-volume-that-is-shared-with-the-hiatus-app2026-11-13 https://bugrater.com/releases/cve-2026-95615-os-command-injection-vulnerability-in-audio-messages-api-in-zenitel-connect-before-1-11-0-allows-remote-authenticated-users-to-execute-arbitrary-os-commands-as2026-11-13 https://bugrater.com/releases/cve-2026-121809-loop-with-unreachable-exit-condition-infinite-loop-vulnerability-in-elixir-grpc-grpc-server-and-grpc-allows-unauthenticated-attackers-to-occupy-a-beam-sched2026-11-13 https://bugrater.com/releases/cve-2026-124279-allocation-of-resources-without-limits-or-throttling-vulnerability-in-elixir-grpc-grpc-server-allows-unauthenticated-attackers-to-exhaust-server-memory-via-clie2026-11-13 https://bugrater.com/releases/cve-2026-128986-in-eclipse-basyx-go-components-versions-up-to-and-including-1-1-3-abac-enabled-deployments-match-route-access-rules-against-the-fully-decoded-request-path-w2026-11-13 https://bugrater.com/releases/cve-2026-129116-c-kermit-from-7-0-197-before-11-1-515-contains-an-authentication-bypass-vulnerability-in-the-iksd-ssl-build-that-leaves-telnet-authentication-state-at-auth-vali2026-11-13 https://bugrater.com/releases/cve-2026-129117-c-kermit-8-0-200-before-11-1-515-contains-an-improper-certificate-validation-vulnerability-that-allows-machine-in-the-middle-attackers-to-impersonate-telnet-ser2026-11-13 https://bugrater.com/releases/cve-2026-129118-c-kermit-8-0-200-before-11-1-515-contains-an-improper-certificate-hostname-validation-vulnerability-that-allows-attackers-to-impersonate-hosts-by-abusing-wildca2026-11-13 https://bugrater.com/releases/cve-2026-129119-c-kermit-from-6-0-192-before-11-1-515-contains-a-file-collision-protection-bypass-that-allows-malicious-senders-to-append-data-to-existing-files-by-marking-tran2026-11-13 https://bugrater.com/releases/cve-2026-129120-c-kermit-11-0-506-before-11-1-515-contains-a-receive-confirm-bypass-vulnerability-that-allows-malicious-kermit-servers-to-write-unrequested-files-without-prompt2026-11-13 https://bugrater.com/releases/cve-2026-129121-c-kermit-8-0-200-before-11-1-515-contains-a-path-traversal-vulnerability-in-doftpget-in-ckcftp-c-that-allows-malicious-ftp-servers-to-write-files-outside-the2026-11-13 https://bugrater.com/releases/cve-2026-129122-c-kermit-6-0-192-before-11-1-515-contains-a-buffer-overflow-vulnerability-in-tn-snenv-in-ckctel-c-that-allows-malicious-telnet-servers-to-corrupt-client-memor2026-11-13 https://bugrater.com/releases/cve-2026-129123-c-kermit-8-0-200-before-11-1-515-contains-a-buffer-overflow-vulnerability-in-getreply-in-ckcftp-c-that-allows-malicious-ftp-servers-to-overwrite-client-memory2026-11-13 https://bugrater.com/releases/cve-2026-129124-c-kermit-before-11-1-515-contains-an-os-command-injection-vulnerability-that-allows-remote-clients-to-execute-shell-commands-by-supplying-unquoted-arguments-to2026-11-13 https://bugrater.com/releases/cve-2026-129125-c-kermit-6-0-192-before-11-1-515-contains-a-remote-code-execution-vulnerability-that-allows-kermit-clients-to-run-shell-commands-on-servers-with-host-commands-d2026-11-13 https://bugrater.com/releases/cve-2026-129126-c-kermit-before-11-1-515-contains-a-heap-buffer-overflow-vulnerability-in-putsrv-in-ckcfns-c-that-allows-malicious-peers-to-write-past-the-srvcmd-buffer-by-se2026-11-13 https://bugrater.com/releases/cve-2026-129127-sqlbot-through-1-10-3-contains-a-weak-password-hashing-vulnerability-that-stores-local-account-passwords-in-sys-user-password-as-unsalted-md5-digests-via-md5pwd2026-11-13 https://bugrater.com/releases/cve-2026-129128-goose-cli-1-35-0-before-1-53-0-contains-a-local-code-execution-vulnerability-that-allows-attackers-to-run-commands-by-setting-diff-external-in-a-repository-s-g2026-11-13 https://bugrater.com/releases/cve-2026-129129-aisoc-12-1-0-before-23-3-0-contains-a-missing-authentication-vulnerability-that-allows-unauthenticated-attackers-to-query-the-enrichment-service-through-next-js2026-11-13 https://bugrater.com/releases/cve-2026-129130-agent-device-from-0-21-36-before-0-21-37-contains-a-local-file-disclosure-vulnerability-that-allows-authenticated-remote-callers-to-read-daemon-host-files-by-op2026-11-13 https://bugrater.com/releases/cve-2026-129131-gameyfin-before-2-6-2-contains-a-missing-authorization-vulnerability-that-allows-unauthenticated-attackers-to-bypass-login-required-mode-by-calling-hilla-endpoi2026-11-13 https://bugrater.com/releases/cve-2026-129132-mrbs-before-1-13-0-contains-an-ldap-injection-vulnerability-in-web-lib-mrbs-auth-authldap-php-that-interpolates-unescaped-login-usernames-into-dn-search-and-gro2026-11-13 https://bugrater.com/releases/cve-2026-129133-mrbs-before-1-13-0-contains-a-csv-formula-injection-vulnerability-that-allows-authenticated-users-to-inject-spreadsheet-formulas-because-the-escape-function-i2026-11-13 https://bugrater.com/releases/cve-2026-129134-mrbs-before-1-13-0-contains-a-password-reset-poisoning-vulnerability-that-allows-unauthenticated-attackers-to-redirect-reset-links-by-forging-the-host-header-wh2026-11-13 https://bugrater.com/releases/cve-2026-129135-picoquic-before-2026-11-05-3e2e3d3-contains-an-integer-overflow-vulnerability-in-picoquic-decode-time-stamp-frame-that-allows-remote-quic-peers-to-corrupt-sto2026-11-13 https://bugrater.com/releases/cve-2026-63150-omnispace-agora-project-through-26-10-0-contains-a-cross-site-request-forgery-vulnerability-that-allows-remote-attackers-to-forge-privileged-actions-such-as-adm2026-11-13 https://bugrater.com/releases/cve-2026-63151-omnispace-agora-project-through-26-10-0-contains-a-predictable-token-generation-vulnerability-that-allows-unauthenticated-attackers-to-access-private-calendar-d2026-11-13 https://bugrater.com/releases/cve-2026-63155-omnispace-agora-project-through-26-10-0-contains-an-open-redirect-vulnerability-that-allows-remote-attackers-to-redirect-users-to-arbitrary-external-urls-by-man2026-11-13 https://bugrater.com/releases/cve-2026-63164-omnispace-agora-project-through-26-10-0-contains-an-insecure-direct-object-reference-vulnerability-that-allows-authenticated-attackers-to-access-another-user-s2026-11-13 https://bugrater.com/releases/cve-2026-63166-omnispace-agora-project-through-26-10-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-attackers-to-inject-malicious-html-markup-by-controllin2026-11-13 https://bugrater.com/releases/cve-2026-63167-omnispace-agora-project-through-26-10-0-contains-a-sql-injection-vulnerability-that-allows-authenticated-general-administrators-to-inject-arbitrary-sql-by-setti2026-11-13 https://bugrater.com/releases/cve-2026-63170-omnispace-agora-project-through-26-10-0-contains-a-predictable-token-generation-vulnerability-that-allows-unauthenticated-attackers-to-forge-the-shared-calendar2026-11-13 https://bugrater.com/releases/cve-2026-123177-a-flaw-was-found-in-dnf5daemon-server-unauthenticated-d-bus-methods-pass-caller-controlled-url-or-rpm-path-patterns-into-a-root-privileged-cmdline-package-loa2026-11-13 https://bugrater.com/releases/cve-2026-123965-a-prompt-injection-vulnerability-in-all-versions-of-jet-admin-cloud-platform-allows-a-remote-attacker-with-a-free-account-to-expose-sensitive-env-configuration2026-11-13 https://bugrater.com/releases/cve-2026-124041-catalis-patriot-properties-webpro-5-0-allows-a-remote-unauthenticated-attacker-to-execute-arbitrary-sql-queries-against-the-underlying-mssql-database-enabling2026-11-13 https://bugrater.com/releases/cve-2026-124666-authentication-bypass-by-spoofing-vulnerability-in-apache-apisix-on-a-route-where-multi-auth-falls-back-from-wolf-rbac-to-another-successful-authenticator2026-11-13 https://bugrater.com/releases/cve-2026-124679-authentication-bypass-by-spoofing-vulnerability-in-apache-apisix-on-routes-using-jwe-decrypt-with-strict-false-and-a-forward-header-distinct-from-the-token2026-11-13 https://bugrater.com/releases/cve-2026-124680-interpretation-conflict-resulting-in-incorrect-authorization-vulnerability-in-apache-apisix-an-unauthenticated-client-can-reach-upstream-paths-protected2026-11-13 https://bugrater.com/releases/cve-2026-124716-incorrect-authorization-vulnerability-in-apache-apisix-an-authenticated-user-who-holds-any-one-of-a-route-s-required-permissions-or-scopes-can-reach-the-pro2026-11-13 https://bugrater.com/releases/cve-2026-124719-authentication-bypass-by-spoofing-vulnerability-in-apache-apisix-when-a-route-s-configured-headers-carry-a-caller-identity-and-the-openapi-document-declares2026-11-13 https://bugrater.com/releases/cve-2026-124723-interpretation-conflict-leading-to-incorrect-authorization-vulnerability-in-apache-apisix-with-match-uri-encoded-slash-enabled-and-skip-mtls-uri-regex-conf2026-11-13 https://bugrater.com/releases/cve-2026-124726-relative-path-traversal-with-unintended-proxy-vulnerability-in-apache-apisix-a-caller-of-the-mcp-endpoint-can-invoke-endpoints-the-openapi-document-never-d2026-11-13 https://bugrater.com/releases/cve-2026-126091-dental-practice-sites-hosted-with-identalsoft-send-a-json-response-to-any-user-who-loads-certain-pages-containing-sensitive-information-including-oauth-credent2026-11-13 https://bugrater.com/releases/cve-2026-129139-paicoding-from-commit-b8206b9-through-commit-903adce-uses-predictable-credentials-for-accounts-created-via-zsxq-login-because-loginbyzsxq-derives-both-the-user2026-11-13 https://bugrater.com/releases/cve-2026-129140-paicoding-1-0-0-through-1-0-3-contains-a-stored-cross-site-scripting-vulnerability-in-image-upload-because-imageserviceimpl-validatestaticimg-accepts-svg-files2026-11-13 https://bugrater.com/releases/cve-2026-129141-paicoding-1-0-0-through-1-0-3-contains-a-stored-cross-site-scripting-vulnerability-because-seoinjectservice-embeds-user-profile-text-without-escaping-in-an-inli2026-11-13 https://bugrater.com/releases/cve-2026-129142-paicoding-commit-766c48b-through-commit-903adce-contains-a-stored-cross-site-scripting-vulnerability-in-payment-notifications-where-notifymsglistener-inserts-t2026-11-13 https://bugrater.com/releases/cve-2026-129143-paicoding-1-0-3-contains-a-missing-authorization-vulnerability-in-the-articlerestcontroller-article-detail-endpoint-that-allows-unauthenticated-attackers-to-rea2026-11-13 https://bugrater.com/releases/cve-2026-129144-paicoding-1-0-3-contains-a-payment-bypass-vulnerability-that-allows-authenticated-attackers-to-unlock-paid-articles-by-guessing-weak-payment-confirmation-codes2026-11-13 https://bugrater.com/releases/cve-2026-129151-surveyking-1-13-2-contains-a-missing-authorization-vulnerability-in-result-lookup-the-anonymous-survey-view-leaks-the-lookup-configuration-including-its-passw2026-11-13 https://bugrater.com/releases/cve-2026-129152-surveyking-1-12-0-through-1-13-2-contains-an-authentication-bypass-vulnerability-that-allows-unauthenticated-attackers-to-submit-survey-responses-because-answer2026-11-13 https://bugrater.com/releases/cve-2026-129153-surveyking-1-12-0-through-1-13-2-contains-an-authorization-bypass-in-the-linked-survey-feature-that-fails-to-verify-the-referenced-linksurveyid-belongs-to-the-c2026-11-13 https://bugrater.com/releases/cve-2026-129154-surveyking-1-13-0-through-1-13-2-contains-a-stored-cross-site-scripting-vulnerability-because-the-server-accepts-a-respondent-supplied-survey-snapshot-and-the-f2026-11-13 https://bugrater.com/releases/cve-2026-129155-djangoblog-2-0-0-0-through-2-1-0-0-contains-a-stored-cross-site-scripting-vulnerability-because-the-class-filter-comment-sanitizer-passes-event-handler-attribut2026-11-13 https://bugrater.com/releases/cve-2026-129156-djangoblog-commit-d186b1c-through-commit-6134ed6-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-oauth-users-to-inject-script-via2026-11-13 https://bugrater.com/releases/cve-2026-129157-ragent-1-0-0-through-1-1-0-contains-a-missing-authorization-vulnerability-in-ragtracecontroller-that-allows-any-logged-in-user-to-view-all-users-rag-traces-at2026-11-13 https://bugrater.com/releases/cve-2026-129158-ragent-1-1-0-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-to-inject-scripts-by-uploading-svg-knowledge-base-documents-se2026-11-13 https://bugrater.com/releases/cve-2026-129160-free-fs-2-0-1-through-2-3-1-contains-an-sql-injection-vulnerability-in-fileshareserviceimpl-getpages-which-passes-the-orderby-parameter-of-the-apis-share-page2026-11-13 https://bugrater.com/releases/cve-2026-129161-dromara-free-fs-2-0-1-through-2-3-1-contains-an-improper-restriction-of-authentication-attempts-vulnerability-that-allows-unauthenticated-attackers-to-brute-for2026-11-13 https://bugrater.com/releases/cve-2026-129162-dromara-free-fs-2-0-1-through-2-3-1-contains-a-missing-authentication-vulnerability-in-filestreamcontroller-preview-that-allows-unauthenticated-attackers-to-dow2026-11-13 https://bugrater.com/releases/cve-2026-129163-dromara-free-fs-2-0-1-through-2-3-1-contains-a-stored-cross-site-scripting-vulnerability-that-allows-registered-users-to-run-script-by-uploading-html-files-serv2026-11-13 https://bugrater.com/releases/cve-2026-129164-dromara-free-fs-2-0-1-through-2-3-1-contains-an-authorization-bypass-vulnerability-that-allows-attackers-to-access-code-protected-shares-because-share-codes-are2026-11-13 https://bugrater.com/releases/cve-2026-129165-tactical-rmm-0-17-0-through-1-6-1-contains-an-arbitrary-file-read-in-the-reporting-templates-preview-endpoint-because-weasyprint-resolves-file-links-in-use2026-11-13 https://bugrater.com/releases/cve-2026-129166-keep-0-34-10-through-0-55-0-contains-a-blind-sql-injection-vulnerability-in-its-cel-to-sql-converter-which-inserts-bracket-indexed-json-keys-from-cel-filters-u2026-11-13 https://bugrater.com/releases/cve-2026-129167-seafile-seadoc-converter-2-0-4-before-2-0-11-and-3-0-0-before-3-0-8-contains-an-absolute-path-traversal-vulnerability-that-allows-unauthenticated-attackers-hold2026-11-13 https://bugrater.com/releases/cve-2026-129168-pmail-2-9-1-through-2-9-8-contains-a-stored-cross-site-scripting-vulnerability-because-the-attachments-id-cid-endpoint-returns-email-attachments-verbatim-w2026-11-13 https://bugrater.com/releases/cve-2026-129169-pmail-2-5-0-through-2-9-8-contains-a-stored-cross-site-scripting-vulnerability-that-allows-authenticated-users-to-inject-scripts-by-sending-unsanitized-html-thr2026-11-13 https://bugrater.com/releases/cve-2026-129170-filecodebox-2-2-1-through-2-8-4-contains-a-stored-cross-site-scripting-vulnerability-in-rendermarkdownpreview-which-returns-unsanitized-text-when-the-marked-pa2026-11-13 https://bugrater.com/releases/cve-2026-129171-nginxpulse-1-5-0-before-1-6-26-contains-an-unauthenticated-sql-injection-vulnerability-that-allows-remote-attackers-to-append-sql-via-the-id-and-locationtype-pa2026-11-13 https://bugrater.com/releases/cve-2026-129172-edgeever-1-9-0-before-2-13-0-contains-a-stored-cross-site-scripting-vulnerability-in-the-backup-restore-endpoint-put-api-v1-restores-json-resources-id-which2026-11-13 https://bugrater.com/releases/cve-2026-63173-omnispace-agora-project-through-26-10-0-contains-a-broken-access-control-vulnerability-in-which-the-isautor-function-in-mdlobject-php-grants-accessright-3-bas2026-11-13 https://bugrater.com/releases/cve-2026-129217-in-frrouting-frr-8-3-through-10-5-1-bgp-notify-decapsulate-hard-reset-in-bgpd-bgp-packet-c-does-not-validate-the-length-of-the-data-field-of-a-received-bgp2026-11-13 https://bugrater.com/releases/tvos-27-2-12026-11-14 https://bugrater.com/releases/visionos-27-2-12026-11-14 https://bugrater.com/releases/macos-sequoia-15-8-22026-11-14 https://bugrater.com/releases/commerce-license-moderately-critical-access-bypass-sa-contrib-2026-3232026-11-14 https://bugrater.com/releases/authenticator-login-plus-2fa-moderately-critical-authentication-bypass-sa-contrib-2026-3222026-11-14 https://bugrater.com/releases/authenticator-login-plus-2fa-moderately-critical-authentication-bypass-sa-contrib-2026-3212026-11-14 https://bugrater.com/releases/authenticator-login-plus-2fa-moderately-critical-authentication-bypass-sa-contrib-2026-3202026-11-14 https://bugrater.com/releases/texts-key-based-strings-and-translations-moderately-critical-cross-site-request-forgery-sa-contrib-2026-3192026-11-14 https://bugrater.com/releases/texts-key-based-strings-and-translations-moderately-critical-cross-site-scripting-sa-contrib-2026-3182026-11-14 https://bugrater.com/releases/paragraphs-edit-moderately-critical-improper-authorization-sa-contrib-2026-3172026-11-14 https://bugrater.com/releases/graphql-core-schema-critical-improper-authorization-sa-contrib-2026-3162026-11-14 https://bugrater.com/releases/cve-2026-127213-learnpress-course-wishlist-add-on-before-4-1-2-contains-an-insecure-direct-object-reference-vulnerability-that-allows-remote-attackers-to-manipulate-any-user-s2026-11-14 https://bugrater.com/releases/cve-2026-127214-flowise-through-3-1-4-contains-a-server-side-request-forgery-vulnerability-that-allows-authenticated-attackers-with-chatflows-or-agentflows-create-update-permis2026-11-14 https://bugrater.com/releases/cve-2026-127215-kanbanz-by-softaculous-plugin-for-wordpress-before-1-0-3-contains-a-broken-access-control-vulnerability-that-allows-authenticated-kanban-staff-users-to-access-a2026-11-14 https://bugrater.com/releases/cve-2026-128100-vault-community-edition-and-vault-enterprise-did-not-apply-explicit-acl-policy-deny-rules-to-letter-case-variants-of-user-and-group-names-in-auth-methods-that-t2026-11-14 https://bugrater.com/releases/cve-2026-105983-the-email-marketing-4dem-wordpress-plugin-through-2-0-5-does-not-perform-authorization-or-capability-checks-on-several-of-its-ajax-actions-and-rest-routes-allo2026-11-14 https://bugrater.com/releases/cve-2026-105984-the-email-marketing-4dem-wordpress-plugin-through-2-0-5-does-not-perform-authorization-or-capability-checks-on-several-of-its-ajax-actions-allowing-unauthentic2026-11-14 https://bugrater.com/releases/cve-2026-111033-the-countdown-coming-soon-maintenance-wordpress-plugin-through-3-0-8-does-not-perform-authorization-or-nonce-checks-when-saving-countdown-data-on-post-save2026-11-14 https://bugrater.com/releases/cve-2026-111034-the-countdown-coming-soon-maintenance-wordpress-plugin-through-3-0-8-does-not-check-that-the-user-is-allowed-to-browse-content-before-returning-post-titles-f2026-11-14 https://bugrater.com/releases/cve-2026-116528-the-chargely-free-subscriptions-for-woocommernce-wordpress-plugin-through-1-0-does-not-perform-any-authorization-check-on-a-rest-api-route-that-returns-its-stor2026-11-14 https://bugrater.com/releases/cve-2026-117487-the-flatsome-wordpress-theme-before-3-20-13-does-not-perform-a-capability-or-nonce-check-on-an-ajax-action-available-to-unauthenticated-users-and-does-not-rest2026-11-14 https://bugrater.com/releases/cve-2026-117490-the-flatsome-wordpress-theme-before-3-20-13-does-not-enforce-the-acting-user-s-publish-and-post-type-restrictions-on-an-ajax-save-action-allowing-users-with-a2026-11-14 https://bugrater.com/releases/cve-2026-118181-the-duplicate-post-wordpress-plugin-before-1-5-8-does-not-perform-a-capability-check-when-saving-its-global-settings-relying-only-on-its-own-role-access-list2026-11-14 https://bugrater.com/releases/cve-2026-118182-the-duplicate-post-wordpress-plugin-before-1-5-8-does-not-check-that-a-user-duplicating-a-post-is-allowed-to-edit-it-which-when-the-slug-takeover-option-is-en2026-11-14 https://bugrater.com/releases/cve-2026-118183-the-duplicate-post-wordpress-plugin-before-1-5-8-does-not-check-whether-a-user-may-publish-posts-when-duplicating-one-allowing-users-of-a-role-an-administrator2026-11-14 https://bugrater.com/releases/cve-2026-119258-the-swipe-wordpress-plugin-through-1-4-does-not-properly-authenticate-a-login-request-before-issuing-a-wordpress-session-cookie-allowing-unauthenticated-attack2026-11-14 https://bugrater.com/releases/cve-2026-123046-the-seojuice-wordpress-plugin-before-2-12-0-does-not-correctly-restrict-a-rest-api-authentication-filter-disabling-wordpress-s-rest-nonce-protection-for-the-wh2026-11-14 https://bugrater.com/releases/cve-2026-123122-the-checkout-files-upload-for-woocommerce-wordpress-plugin-before-2-4-1-does-not-verify-that-a-file-uploaded-at-checkout-is-really-one-of-its-allowed-image-type2026-11-14 https://bugrater.com/releases/cve-2026-124649-the-lightbox-with-photoswipe-wordpress-plugin-before-5-19-0-does-not-properly-sanitise-link-titles-and-other-caption-sources-before-inserting-them-as-html-into2026-11-14 https://bugrater.com/releases/cve-2026-126640-the-wp-ultimate-csv-importer-wordpress-plugin-before-9-3-does-not-escape-values-from-imported-files-before-using-them-in-sql-queries-when-importing-lifterlms-c2026-11-14 https://bugrater.com/releases/cve-2026-126697-the-quick-page-post-redirect-plugin-wordpress-plugin-before-5-2-4-was-distributed-with-a-hidden-update-mechanism-that-fetched-quick-page-post-redirect-plugin-wo2026-11-14 https://bugrater.com/releases/cve-2026-129319-create-ecdh-is-a-browserifiable-implementation-of-node-js-crypto-createecdh-in-versions-4-0-4-and-below-the-javascript-implementation-browser-js-used-by-bro2026-11-14 https://bugrater.com/releases/cve-2026-129181-a-vulnerability-has-been-found-in-projectworlds-visitor-management-system-1-0-this-issue-affects-the-function-mysqli-query-of-the-file-img-user-20page-php-of2026-11-14 https://bugrater.com/releases/cve-2026-18742-the-flatsome-theme-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-data-text-sec-data-title-and-title-attributes-via-custom-html-block-in2026-11-14 https://bugrater.com/releases/cve-2026-129247-a-security-flaw-has-been-discovered-in-yangzongzhuan-ruoyi-up-to-4-8-3-impacted-is-the-function-velocityutils-getfilename-of-the-file-velocityutils-java-of-the2026-11-14 https://bugrater.com/releases/cve-2026-129248-a-weakness-has-been-identified-in-akaunting-up-to-3-3-0-the-affected-element-is-the-function-calculation-to-quantity-of-the-file-helpers-php-of-the-component-i2026-11-14 https://bugrater.com/releases/cve-2026-129258-a-vulnerability-was-identified-in-tenda-ac18-15-03-05-05-multi-15-03-05-19-build-6318-affected-by-this-vulnerability-is-an-unknown-functionality-of-the-file-c2026-11-14 https://bugrater.com/releases/cve-2026-129259-a-weakness-has-been-identified-in-mereithhh-vanblog-up-to-0-54-0-this-affects-an-unknown-part-of-the-file-packages-server-src-types-access-access-ts-of-the-com2026-11-14 https://bugrater.com/releases/cve-2026-110531-the-fv-player-8-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-fv-player-videos-parameter-in-all-versions-up-to-and-including-8-12026-11-14 https://bugrater.com/releases/cve-2026-116753-the-multi-step-for-contact-form-7-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-multipart-field-name-array-key-parameter-in-all2026-11-14 https://bugrater.com/releases/cve-2026-120687-the-lightbox-modal-popup-wordpress-plugin-foobox-plugin-for-wordpress-is-vulnerable-to-stored-dom-based-cross-site-scripting-via-the-img-alt-attribute-insi2026-11-14 https://bugrater.com/releases/cve-2026-127115-the-buddyforms-plugin-for-wordpress-is-vulnerable-to-stored-cross-site-scripting-via-the-buddyforms-form-content-parameter-in-all-versions-up-to-and-includin2026-11-14 https://bugrater.com/releases/cve-2026-129260-a-security-vulnerability-has-been-detected-in-mereithhh-vanblog-up-to-0-54-0-this-vulnerability-affects-the-function-fs-readfilesync-of-the-file-local-provider2026-11-14 https://bugrater.com/releases/cve-2026-129261-a-vulnerability-was-found-in-kingston-fury-ctrl-rgb-control-software-up-to-2-0-66-0-the-impacted-element-is-an-unknown-function-in-the-library-ntiolib-x64-sys2026-11-14 https://bugrater.com/releases/cve-2026-129262-a-weakness-has-been-identified-in-wuxi-wubang-security-software-wubang-five-in-one-safety-production-management-information-system-up-to-3-5-affected-by-this-v2026-11-14 https://bugrater.com/releases/cve-2026-129264-a-security-vulnerability-has-been-detected-in-sox-ng-up-to-14-8-1-affected-by-this-issue-is-the-function-read-samples-voc-of-the-file-src-voc-c-of-the-componen2026-11-14 https://bugrater.com/releases/cve-2026-129267-a-vulnerability-was-found-in-sergix44-xbackbone-up-to-3-8-2-impacted-is-the-function-mediacontroller-getrawbyid-of-the-file-app-controllers-mediacontroller-ph2026-11-14 https://bugrater.com/releases/cve-2026-129447-kroki-before-0-36-0-contains-a-reflected-cross-site-scripting-vulnerability-in-the-dbml-svg-endpoint-that-allows-unauthenticated-attackers-to-inject-javascript2026-11-14 https://bugrater.com/releases/cve-2026-129456-in-frrouting-bgpd-accepts-a-tunnel-encapsulation-attribute-type-23-whose-outer-tlv-length-does-not-match-the-length-of-the-attribute-the-mismatch-is-only-lo2026-11-14