| CVE-2026-71881 | TRUNG BÌNH4.8 | Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting | 07/11/2026 |
| CVE-2026-27356 | TRUNG BÌNH5.3 | Missing Authorization vulnerability in ibericode MC4WP mailchimp-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MC4WP: from n/a through 4.14.1. | 06/11/2026 |
| CVE-2026-123471 | TRUNG BÌNH4.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2. | 06/11/2026 |
| CVE-2026-122670 | TRUNG BÌNH5.4 | Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Polylang: from n/a through 3.9. | 06/11/2026 |
| CVE-2026-120851 | TRUNG BÌNH4.3 | Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0. | 06/11/2026 |
| CVE-2026-120845 | TRUNG BÌNH6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5. | 06/11/2026 |
| CVE-2026-119519 | TRUNG BÌNH4.3 | Missing Authorization vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1068. | 06/11/2026 |
| CVE-2026-118786 | TRUNG BÌNH6.8 | Improper input validation in non-secure-callable (NSC)
veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example
(multicore_examples/rpmsg_lite_pingpong_tzm) up to releases 26.06.00-lts and
26.09.00 may allow a non-secure caller to supply unvalidated pointers and size
values, potentially resulting in disc | 06/11/2026 |
| CVE-2026-118785 | TRUNG BÌNH6.7 | Improper handling of non-secure-world input in NSC veneer
functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples),
affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a
non-secure caller to supply unvalidated pointers or untrusted data, causing a
timing side-channel, TOCTOU condition, | 06/11/2026 |
| CVE-2026-109469 | NGHIÊM TRỌNG10.0 | Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network. | 06/11/2026 |
| CVE-2026-94619 | TRUNG BÌNH5.9 | FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a low-privileged user with uplo | 06/11/2026 |
| CVE-2026-94618 | TRUNG BÌNH5.4 | FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart() to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with distinct per-user hom | 06/11/2026 |
| CVE-2026-77442 | TRUNG BÌNH5.9 | Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership che | 06/11/2026 |
| CVE-2026-69128 | TRUNG BÌNH4.6 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query too | 06/11/2026 |
| CVE-2026-68935 | NGHIÊM TRỌNG9.1 | Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API connections can enable this field to b | 06/11/2026 |
| CVE-2026-68933 | CAO7.5 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public p | 06/11/2026 |
| CVE-2026-59104 | NGHIÊM TRỌNG9.8 | UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fields is interpreted as \"use the only us | 06/11/2026 |
| CVE-2026-50240 | CAO8.8 | A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provision | 06/11/2026 |
| CVE-2026-48057 | THẤP2.1 | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained intermediate CA can issue a cert | 06/11/2026 |
| CVE-2026-47738 | TRUNG BÌNH5.3 | liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQS_KEM_encaps_derand can dereference an uninitialized encaps_derand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821, NTRU-HPS-4096-1229, NTRU-HRSS | 06/11/2026 |