| CVE-2026-59885pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-59310vCenter directory-traversal vulnerability VMware Cloud Foundation, VMware vSphere Foundation, VMware vCenter, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-58882CVE-2026-58882 Google Android Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-58115CVE-2026-58115 Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Siemens SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2), Siemens SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2), Siemens SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) Versions & vendor guidance → |
Not in downloaded KEV |
10Critical |
| CVE-2026-55803Drupal core - Critical - PHP object injection - SA-CORE-2026-005 Drupal Drupal core Versions & vendor guidance → |
Not in downloaded KEV |
5.9Medium |
| CVE-2026-55649GeoNode has Stored XSS in Documents metadata abstract field GeoNode geonode Versions & vendor guidance → |
Not in downloaded KEV |
6.3Medium |
| CVE-2026-55607Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV |
7.7High |
| CVE-2026-55098Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 Basekick-Labs arc Versions & vendor guidance → |
Not in downloaded KEV |
6.5Medium |
| CVE-2026-54724Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint kiwitcms Kiwi Versions & vendor guidance → |
Not in downloaded KEV |
6.1Medium |
| CVE-2026-54499Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders stanfordnlp stanza Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-54316Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV |
6Medium |
| CVE-2026-54121Active Directory Certificate Services Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV |
8.8High |
| CVE-2026-5281Google Dawn Use-After-Free Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) Adobe Adobe Commerce, Adobe Adobe Commerce B2B, Adobe Magento Open Source, Adobe Adobe Commerce Events Versions & vendor guidance → |
Known exploitedCISA KEV |
9.3Critical |
| CVE-2026-47735Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks Basekick-Labs arc Versions & vendor guidance → |
Not in downloaded KEV |
7.1High |
| CVE-2026-4762CVE-2026-4762 Axis Communications AB AXIS Camera Station Pro Versions & vendor guidance → |
Not in downloaded KEV |
8.8High |
| CVE-2026-46429GeoNode: Unrestricted File Upload GeoNode geonode Versions & vendor guidance → |
Not in downloaded KEV |
5.5Medium |
| CVE-2026-46406Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV |
4.4Medium |
| CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescing Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV |
7.8High |
| CVE-2026-45659Microsoft SharePoint Remote Code Execution Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor github copilot-cli Versions & vendor guidance → |
Not in downloaded KEV |
8.5High |
| CVE-2026-44470Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV |
8.5High |
| CVE-2026-44467Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV |
7.4High |
| CVE-2026-44267Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter enspirit elo Versions & vendor guidance → |
Not in downloaded KEV |
9.8Critical |
| CVE-2026-44266Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels enspirit elo Versions & vendor guidance → |
Not in downloaded KEV |
9.8Critical |