| CVE-2026-65400Apple macOS Improper Authentication Vulnerability Apple macOS Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-65339CVE-2026-65339 Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance → |
Not in downloaded KEV |
5Medium |
| CVE-2026-64849MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) mlflow mlflow Versions & vendor guidance → |
Known exploitedCISA KEV |
9.3Critical |
| CVE-2026-63288CVE-2026-63288 Axis Communications AB AXIS A1210 - Secure Entry, Axis Communications AB AXIS A1601 - Secure Entry, Axis Communications AB AXIS A1610 - Secure Entry, Axis Communications AB AXIS A1710, Axis Communications AB AXIS A1810 - Secure Entry Versions & vendor guidance → |
Not in downloaded KEV |
8.3High |
| CVE-2026-63183OmniAuth: Host Header Injection Vulnerability omniauth omniauth Versions & vendor guidance → |
Not in downloaded KEV |
6.9Medium |
| CVE-2026-63077JetBrains TeamCity Deserialization of Untrusted Data Vulnerability JetBrains TeamCity Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution WordPress WordPress Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-62848Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution metalama Metalama Versions & vendor guidance → |
Not in downloaded KEV |
7.3High |
| CVE-2026-62662Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences pocket-id pocket-id Versions & vendor guidance → |
Not in downloaded KEV |
7.7High |
| CVE-2026-62374SD JWT JS: Tampered disclosures silently dropped instead of rejected openwallet-foundation @sd-jwt/core, openwallet-foundation @sd-jwt/decode Versions & vendor guidance → |
Not in downloaded KEV |
7.1High |
| CVE-2026-62361listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials knadh listmonk Versions & vendor guidance → |
Not in downloaded KEV |
5.5Medium |
| CVE-2026-62331praktor: Telegram upload traversal permits persistent agent instruction injection mtzanidakis praktor Versions & vendor guidance → |
Not in downloaded KEV |
8.2High |
| CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources filecoin-project filecoin-pin Versions & vendor guidance → |
Not in downloaded KEV |
6.5Medium |
| CVE-2026-62284OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy osac-project osac-operator Versions & vendor guidance → |
Not in downloaded KEV |
8.6High |
| CVE-2026-61536Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE masci banks Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query WordPress WordPress Versions & vendor guidance → |
Known exploitedCISA KEV |
5.9Medium |
| CVE-2026-60004Gitea Code Injection Vulnerability Gitea Gitea Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-59886pyasn1: Uncontrolled resource consumption when converting decoded REAL values pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-59885pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-59822LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback BerriAI litellm Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-59310vCenter directory-traversal vulnerability VMware Cloud Foundation, VMware vSphere Foundation, VMware vCenter, VMware Telco Cloud Infrastructure, VMware Telco Cloud Platform Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-58882CVE-2026-58882 Google Android Versions & vendor guidance → |
Not in downloaded KEV |
7.5High |
| CVE-2026-58704Google Pixel Improper Authorization Vulnerability Google Android Versions & vendor guidance → |
Known exploitedCISA KEV |
8.8High |
| CVE-2026-58644Microsoft SharePoint Remote Code Execution Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance → |
Known exploitedCISA KEV |
9.8Critical |
| CVE-2026-58115CVE-2026-58115 Siemens SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2), Siemens SIMATIC IoT2050 Basic (6ES7647-0BA00-0YA2), Siemens SIMATIC IoT2050 M.2 (6ES7647-0BB00-1YA2), Siemens SIMATIC IoT2050 SM (6ES7647-0CA00-1AA2) Versions & vendor guidance → |
Not in downloaded KEV |
10Critical |