diff --git a/2004/CVE-2004-0906.md b/2004/CVE-2004-0906.md
new file mode 100644
index 0000000000..4a51532dc9
--- /dev/null
+++ b/2004/CVE-2004-0906.md
@@ -0,0 +1,17 @@
+### [CVE-2004-0906](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0906)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2004/CVE-2004-1380.md b/2004/CVE-2004-1380.md
new file mode 100644
index 0000000000..9172da4162
--- /dev/null
+++ b/2004/CVE-2004-1380.md
@@ -0,0 +1,17 @@
+### [CVE-2004-1380](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1380)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the "Dialog Box Spoofing Vulnerability."
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2004/CVE-2004-1613.md b/2004/CVE-2004-1613.md
new file mode 100644
index 0000000000..ae112fe3e5
--- /dev/null
+++ b/2004/CVE-2004-1613.md
@@ -0,0 +1,17 @@
+### [CVE-2004-1613](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1613)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme.
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2005/CVE-2005-0141.md b/2005/CVE-2005-0141.md
new file mode 100644
index 0000000000..36e82514cf
--- /dev/null
+++ b/2005/CVE-2005-0141.md
@@ -0,0 +1,17 @@
+### [CVE-2005-0141](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0141)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links "with a custom getter and toString method" that are middle-clicked by the user to be opened in a new tab.
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2005/CVE-2005-0144.md b/2005/CVE-2005-0144.md
new file mode 100644
index 0000000000..fcfc3ad34c
--- /dev/null
+++ b/2005/CVE-2005-0144.md
@@ -0,0 +1,17 @@
+### [CVE-2005-0144](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0144)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2005/CVE-2005-0147.md b/2005/CVE-2005-0147.md
index 4b461aa6bc..7c0d8b3a66 100644
--- a/2005/CVE-2005-0147.md
+++ b/2005/CVE-2005-0147.md
@@ -10,6 +10,7 @@ Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, res
 ### POC
 
 #### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9578
 
 #### Github
diff --git a/2005/CVE-2005-0149.md b/2005/CVE-2005-0149.md
new file mode 100644
index 0000000000..4eeeabbb81
--- /dev/null
+++ b/2005/CVE-2005-0149.md
@@ -0,0 +1,17 @@
+### [CVE-2005-0149](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0149)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2005/CVE-2005-0232.md b/2005/CVE-2005-0232.md
index e2ac79f32c..bea39c8a83 100644
--- a/2005/CVE-2005-0232.md
+++ b/2005/CVE-2005-0232.md
@@ -11,6 +11,7 @@ Firefox 1.0 allows remote attackers to modify Boolean configuration parameters f
 
 #### Reference
 - http://marc.info/?l=bugtraq&m=110781055630856&w=2
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
 - http://www.redhat.com/support/errata/RHSA-2005-384.html
 
 #### Github
diff --git a/2005/CVE-2005-0399.md b/2005/CVE-2005-0399.md
new file mode 100644
index 0000000000..5a5ca89704
--- /dev/null
+++ b/2005/CVE-2005-0399.md
@@ -0,0 +1,17 @@
+### [CVE-2005-0399](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0399)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.
+
+### POC
+
+#### Reference
+- http://www.redhat.com/support/errata/RHSA-2005-323.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2006/CVE-2006-0983.md b/2006/CVE-2006-0983.md
index 8f4ed0f3ac..8889b36f34 100644
--- a/2006/CVE-2006-0983.md
+++ b/2006/CVE-2006-0983.md
@@ -11,6 +11,7 @@ Cross-site scripting (XSS) vulnerability in index.php in QwikiWiki 1.4 allows re
 
 #### Reference
 - http://securityreason.com/securityalert/510
+- http://sourceforge.net/forum/forum.php?forum_id=438526
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2008/CVE-2008-0017.md b/2008/CVE-2008-0017.md
index d5b798f297..4da467de9f 100644
--- a/2008/CVE-2008-0017.md
+++ b/2008/CVE-2008-0017.md
@@ -11,6 +11,7 @@ The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 - https://bugzilla.mozilla.org/show_bug.cgi?id=443299
 
diff --git a/2008/CVE-2008-5014.md b/2008/CVE-2008-5014.md
index bf362dcc23..f6853f36a8 100644
--- a/2008/CVE-2008-5014.md
+++ b/2008/CVE-2008-5014.md
@@ -11,6 +11,7 @@ jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thu
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9157
 
diff --git a/2008/CVE-2008-5015.md b/2008/CVE-2008-5015.md
index 0c185f6e63..1a59428fa3 100644
--- a/2008/CVE-2008-5015.md
+++ b/2008/CVE-2008-5015.md
@@ -10,6 +10,7 @@ Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when i
 ### POC
 
 #### Reference
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 
 #### Github
diff --git a/2008/CVE-2008-5016.md b/2008/CVE-2008-5016.md
index b2e911744f..4d85b05557 100644
--- a/2008/CVE-2008-5016.md
+++ b/2008/CVE-2008-5016.md
@@ -11,6 +11,7 @@ The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 
 #### Github
diff --git a/2008/CVE-2008-5017.md b/2008/CVE-2008-5017.md
index 6a2989f7d5..57c7bbc67b 100644
--- a/2008/CVE-2008-5017.md
+++ b/2008/CVE-2008-5017.md
@@ -11,6 +11,7 @@ Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firef
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 
 #### Github
diff --git a/2008/CVE-2008-5018.md b/2008/CVE-2008-5018.md
index f30fdb5884..903e168392 100644
--- a/2008/CVE-2008-5018.md
+++ b/2008/CVE-2008-5018.md
@@ -11,6 +11,7 @@ The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9872
 
diff --git a/2008/CVE-2008-5019.md b/2008/CVE-2008-5019.md
index 767a5df5e8..85c1dc585e 100644
--- a/2008/CVE-2008-5019.md
+++ b/2008/CVE-2008-5019.md
@@ -11,6 +11,7 @@ The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 
 #### Github
diff --git a/2008/CVE-2008-5021.md b/2008/CVE-2008-5021.md
index 5ade935d34..cbd8d402a0 100644
--- a/2008/CVE-2008-5021.md
+++ b/2008/CVE-2008-5021.md
@@ -11,6 +11,7 @@ nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunder
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9642
 
diff --git a/2008/CVE-2008-5022.md b/2008/CVE-2008-5022.md
index 0b93789454..432d320164 100644
--- a/2008/CVE-2008-5022.md
+++ b/2008/CVE-2008-5022.md
@@ -11,6 +11,7 @@ The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, F
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 
 #### Github
diff --git a/2008/CVE-2008-5023.md b/2008/CVE-2008-5023.md
index 85137c548e..1bf7be0bd7 100644
--- a/2008/CVE-2008-5023.md
+++ b/2008/CVE-2008-5023.md
@@ -11,6 +11,7 @@ Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 - https://bugzilla.mozilla.org/show_bug.cgi?id=424733
 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9908
diff --git a/2008/CVE-2008-5024.md b/2008/CVE-2008-5024.md
index da69fb8dfd..ca47168a6f 100644
--- a/2008/CVE-2008-5024.md
+++ b/2008/CVE-2008-5024.md
@@ -11,6 +11,7 @@ Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x b
 
 #### Reference
 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+- http://www.redhat.com/support/errata/RHSA-2008-0978.html
 - http://www.vupen.com/english/advisories/2009/0977
 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9063
 
diff --git a/2014/CVE-2014-125130.md b/2014/CVE-2014-125130.md
new file mode 100644
index 0000000000..db550aaa90
--- /dev/null
+++ b/2014/CVE-2014-125130.md
@@ -0,0 +1,17 @@
+### [CVE-2014-125130](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-125130)
+![](https://img.shields.io/static/v1?label=Product&message=CodeArt%20Google%20MP3%20Audio%20Player&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
+
+### POC
+
+#### Reference
+- https://www.exploit-db.com/exploits/35460
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2016/CVE-2016-11014.md b/2016/CVE-2016-11014.md
index 4f07549bd5..2702cce031 100644
--- a/2016/CVE-2016-11014.md
+++ b/2016/CVE-2016-11014.md
@@ -12,6 +12,7 @@ NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because th
 #### Reference
 - https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html
 - https://github.com/cybersecurityworks/Disclosed/issues/14
+- https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html
 - https://lists.openwall.net/full-disclosure/2016/01/11/5
 - https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html
 
diff --git a/2016/CVE-2016-11016.md b/2016/CVE-2016-11016.md
index 101d1e8e9d..857dcdce83 100644
--- a/2016/CVE-2016-11016.md
+++ b/2016/CVE-2016-11016.md
@@ -12,6 +12,7 @@ NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.
 #### Reference
 - https://cybersecurityworks.com/zerodays/cve-2016-11016-netgear.html
 - https://github.com/cybersecurityworks/Disclosed/issues/12
+- https://khalil-shreateh.com/khalil.shtml/it-highlights/592-Netgear-1.0.0.24-Cross-Site-Request-Forgery--.html
 - https://lists.openwall.net/full-disclosure/2016/01/11/1
 - https://packetstormsecurity.com/files/135194/Netgear-1.0.0.24-Cross-Site-Scripting.html
 
diff --git a/2020/CVE-2020-15038.md b/2020/CVE-2020-15038.md
index 47a97a2c0e..8502b51091 100644
--- a/2020/CVE-2020-15038.md
+++ b/2020/CVE-2020-15038.md
@@ -12,6 +12,7 @@ The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
 #### Reference
 - http://packetstormsecurity.com/files/158649/WordPress-Maintenance-Mode-By-SeedProd-5.1.1-Cross-Site-Scripting.html
 - https://wpvulndb.com/vulnerabilities/10283
+- https://www.getastra.com/blog/911/plugin-exploit/stored-xss-coming-soon-page-maintenance-mode-plugin/
 
 #### Github
 - https://github.com/20142995/nuclei-templates
diff --git a/2023/CVE-2023-32764.md b/2023/CVE-2023-32764.md
new file mode 100644
index 0000000000..3e56a86530
--- /dev/null
+++ b/2023/CVE-2023-32764.md
@@ -0,0 +1,18 @@
+### [CVE-2023-32764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32764)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=23.3.0.130%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.
+
+### POC
+
+#### Reference
+- https://www.compass-security.com/fileadmin/Research/Advisories/2023_01_CSNC-2023-002_LPE_Cloud_Client.txt
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2023/CVE-2023-54400.md b/2023/CVE-2023-54400.md
index 3876047a63..8b642d8ddf 100644
--- a/2023/CVE-2023-54400.md
+++ b/2023/CVE-2023-54400.md
@@ -10,6 +10,7 @@ Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.a
 ### POC
 
 #### Reference
+- https://github.com/emadshanab/goby-poc/blob/main/fumengyun%20%20AjaxMethod.ashx%20SQL%20injection.json
 - https://www.vulncheck.com/advisories/fumeng-cloud-sql-injection-via-ajaxmethod-ashx-getempbyname
 
 #### Github
diff --git a/2025/CVE-2025-32220.md b/2025/CVE-2025-32220.md
index 8cf1a75cf7..00e5268338 100644
--- a/2025/CVE-2025-32220.md
+++ b/2025/CVE-2025-32220.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through <= 10.30.23.
+Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.8.
 
 ### POC
 
diff --git a/2025/CVE-2025-70225.md b/2025/CVE-2025-70225.md
new file mode 100644
index 0000000000..d841f3b013
--- /dev/null
+++ b/2025/CVE-2025-70225.md
@@ -0,0 +1,17 @@
+### [CVE-2025-70225](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70225)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component
+
+### POC
+
+#### Reference
+- https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70225
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-70229.md b/2025/CVE-2025-70229.md
new file mode 100644
index 0000000000..b53434da1f
--- /dev/null
+++ b/2025/CVE-2025-70229.md
@@ -0,0 +1,17 @@
+### [CVE-2025-70229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70229)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSchedule.
+
+### POC
+
+#### Reference
+- https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70229
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-70616.md b/2025/CVE-2025-70616.md
new file mode 100644
index 0000000000..b17e7cb6cf
--- /dev/null
+++ b/2025/CVE-2025-70616.md
@@ -0,0 +1,17 @@
+### [CVE-2025-70616](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-70616)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A stack buffer overflow vulnerability exists in the Wincor Nixdorf wnBios64.sys kernel driver (version 1.2.0.0) in the IOCTL handler for code 0x80102058. The vulnerability is caused by missing bounds checking on the user-controlled Options parameter before copying data into a 40-byte stack buffer (Src[40]) using memmove. An attacker with local access can exploit this vulnerability by sending a crafted IOCTL request with Options > 40, causing a stack buffer overflow that may lead to kernel code execution, local privilege escalation, or denial of service (system crash). Additionally, the same IOCTL handler can leak kernel addresses and other sensitive stack data when reading beyond the buffer boundaries.
+
+### POC
+
+#### Reference
+- https://github.com/250wuyifan/wnBios64-CVE
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-101159.md b/2026/CVE-2026-101159.md
new file mode 100644
index 0000000000..9eaab9b453
--- /dev/null
+++ b/2026/CVE-2026-101159.md
@@ -0,0 +1,17 @@
+### [CVE-2026-101159](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101159)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Ultimate%20Review&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/1eefa81e-6134-498b-9615-b9a42cd99749/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-101160.md b/2026/CVE-2026-101160.md
new file mode 100644
index 0000000000..d9ddebdbb5
--- /dev/null
+++ b/2026/CVE-2026-101160.md
@@ -0,0 +1,17 @@
+### [CVE-2026-101160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101160)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Ultimate%20Review&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+
+### Description
+
+The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/d728523f-1f33-470f-b64f-e9e286d29b6b/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-101161.md b/2026/CVE-2026-101161.md
new file mode 100644
index 0000000000..cdf250ccb7
--- /dev/null
+++ b/2026/CVE-2026-101161.md
@@ -0,0 +1,17 @@
+### [CVE-2026-101161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101161)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Ultimate%20Review&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+
+### Description
+
+The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/c1c3e2d7-4833-4e51-a3c7-45e6d036a525/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-101162.md b/2026/CVE-2026-101162.md
new file mode 100644
index 0000000000..3664e2b63e
--- /dev/null
+++ b/2026/CVE-2026-101162.md
@@ -0,0 +1,17 @@
+### [CVE-2026-101162](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-101162)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Ultimate%20Review&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/b7a66222-4e30-4d70-9e2f-b91d421d285f/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-102626.md b/2026/CVE-2026-102626.md
new file mode 100644
index 0000000000..d2600b3290
--- /dev/null
+++ b/2026/CVE-2026-102626.md
@@ -0,0 +1,17 @@
+### [CVE-2026-102626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102626)
+![](https://img.shields.io/static/v1?label=Product&message=LimeSurvey&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.4.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20(XSS%20or%20'Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding.
+
+### POC
+
+#### Reference
+- https://fluidattacks.com/advisories/golden
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103001.md b/2026/CVE-2026-103001.md
new file mode 100644
index 0000000000..69bcd22e6e
--- /dev/null
+++ b/2026/CVE-2026-103001.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103001)
+![](https://img.shields.io/static/v1?label=Product&message=pyjwt&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.11.0%2C%20%3C%3D%202.13.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-471%3A%20Modification%20of%20Assumed-Immutable%20Data%20(MAID)&color=brightgreen)
+
+### Description
+
+PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.
+
+### POC
+
+#### Reference
+- https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103040.md b/2026/CVE-2026-103040.md
new file mode 100644
index 0000000000..24ab36aba3
--- /dev/null
+++ b/2026/CVE-2026-103040.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103040](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103040)
+![](https://img.shields.io/static/v1?label=Product&message=LightLLM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization%20of%20Untrusted%20Data&color=brightgreen)
+
+### Description
+
+LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted serialized objects to the profiler command queue.
+
+### POC
+
+#### Reference
+- https://github.com/ModelTC/LightLLM/issues/1597
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103042.md b/2026/CVE-2026-103042.md
new file mode 100644
index 0000000000..f700c2c03d
--- /dev/null
+++ b/2026/CVE-2026-103042.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103042](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103042)
+![](https://img.shields.io/static/v1?label=Product&message=LightLLM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposed_set_value method to store unbounded key-value pairs without size limits, causing the worker process to crash and triggering node failure.
+
+### POC
+
+#### Reference
+- https://github.com/ModelTC/LightLLM/issues/1595
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103043.md b/2026/CVE-2026-103043.md
new file mode 100644
index 0000000000..c9d0ae75b0
--- /dev/null
+++ b/2026/CVE-2026-103043.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103043](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103043)
+![](https://img.shields.io/static/v1?label=Product&message=anchorme&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Inefficient%20Regular%20Expression%20Complexity&color=brightgreen)
+
+### Description
+
+anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.
+
+### POC
+
+#### Reference
+- https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103053.md b/2026/CVE-2026-103053.md
new file mode 100644
index 0000000000..00b8d35f19
--- /dev/null
+++ b/2026/CVE-2026-103053.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103053](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103053)
+![](https://img.shields.io/static/v1?label=Product&message=AiSOC&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=9.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve actions on behalf of arbitrary principals, and dispatch containment actions using vendor credentials.
+
+### POC
+
+#### Reference
+- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
+- https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103054.md b/2026/CVE-2026-103054.md
new file mode 100644
index 0000000000..3706c77d02
--- /dev/null
+++ b/2026/CVE-2026-103054.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103054](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103054)
+![](https://img.shields.io/static/v1?label=Product&message=AiSOC&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=10.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim unclaimed tenants and read their security alerts, incidents, and posture metrics without consent.
+
+### POC
+
+#### Reference
+- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103055.md b/2026/CVE-2026-103055.md
new file mode 100644
index 0000000000..353edf941b
--- /dev/null
+++ b/2026/CVE-2026-103055.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103055](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103055)
+![](https://img.shields.io/static/v1?label=Product&message=AiSOC&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.5.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Hard-coded%20Cryptographic%20Key&color=brightgreen)
+
+### Description
+
+AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.
+
+### POC
+
+#### Reference
+- https://github.com/beenuar/AiSOC/security/advisories/GHSA-4m55-xhcm-wjcr
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103056.md b/2026/CVE-2026-103056.md
new file mode 100644
index 0000000000..36ce9b8e97
--- /dev/null
+++ b/2026/CVE-2026-103056.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103056)
+![](https://img.shields.io/static/v1?label=Product&message=AiSOC&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.2.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
+
+### POC
+
+#### Reference
+- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
+- https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q37-2wfw-xrx7
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103057.md b/2026/CVE-2026-103057.md
new file mode 100644
index 0000000000..41fa24ab0f
--- /dev/null
+++ b/2026/CVE-2026-103057.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103057](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103057)
+![](https://img.shields.io/static/v1?label=Product&message=AiSOC&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=5.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and Redis SSE channels or send unauthorized notifications to registered devices.
+
+### POC
+
+#### Reference
+- https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103087.md b/2026/CVE-2026-103087.md
new file mode 100644
index 0000000000..fc99fea307
--- /dev/null
+++ b/2026/CVE-2026-103087.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103087)
+![](https://img.shields.io/static/v1?label=Product&message=gosub-engine&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%20Uncontrolled%20Recursion&color=brightgreen)
+
+### Description
+
+Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack exhaustion and application crash) via an SVG document containing an excessive number of deeply nested elements. Because the engine does not limit the nesting depth of processed SVG nodes, rendering such a document overflows the thread stack and terminates the application. The malicious SVG can be embedded through the SRC attribute of an IMG element, and thus exploitation only requires the victim to visit an attacker-controlled web page.
+
+### POC
+
+#### Reference
+- https://github.com/gosub-io/gosub-engine/security/advisories/GHSA-c762-mxfh-vwvp
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103111.md b/2026/CVE-2026-103111.md
new file mode 100644
index 0000000000..8fdc3462d2
--- /dev/null
+++ b/2026/CVE-2026-103111.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103111](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111)
+![](https://img.shields.io/static/v1?label=Product&message=PCRE2&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%20Out-of-bounds%20Write&color=brightgreen)
+
+### Description
+
+PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
+
+### POC
+
+#### Reference
+- https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103113.md b/2026/CVE-2026-103113.md
new file mode 100644
index 0000000000..497ec83182
--- /dev/null
+++ b/2026/CVE-2026-103113.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103113](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103113)
+![](https://img.shields.io/static/v1?label=Product&message=openSIS-Classic&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/OS4ED/openSIS-Classic/issues/473
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103114.md b/2026/CVE-2026-103114.md
new file mode 100644
index 0000000000..0802676ea7
--- /dev/null
+++ b/2026/CVE-2026-103114.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103114](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103114)
+![](https://img.shields.io/static/v1?label=Product&message=openSIS-Classic&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/OS4ED/openSIS-Classic/issues/474
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103115.md b/2026/CVE-2026-103115.md
new file mode 100644
index 0000000000..3737c83f6f
--- /dev/null
+++ b/2026/CVE-2026-103115.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103115)
+![](https://img.shields.io/static/v1?label=Product&message=openSIS-Classic&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/OS4ED/openSIS-Classic/issues/475
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103116.md b/2026/CVE-2026-103116.md
new file mode 100644
index 0000000000..de43f9ad6a
--- /dev/null
+++ b/2026/CVE-2026-103116.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103116](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103116)
+![](https://img.shields.io/static/v1?label=Product&message=openSIS-Classic&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/OS4ED/openSIS-Classic/issues/476
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103117.md b/2026/CVE-2026-103117.md
new file mode 100644
index 0000000000..58caa10b17
--- /dev/null
+++ b/2026/CVE-2026-103117.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103117](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103117)
+![](https://img.shields.io/static/v1?label=Product&message=openSIS-Classic&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/OS4ED/openSIS-Classic/issues/477
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103222.md b/2026/CVE-2026-103222.md
new file mode 100644
index 0000000000..b1867f9b2c
--- /dev/null
+++ b/2026/CVE-2026-103222.md
@@ -0,0 +1,21 @@
+### [CVE-2026-103222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103222)
+![](https://img.shields.io/static/v1?label=Product&message=C-Blosc2&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.3.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.3.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Numeric%20Error&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
+
+### POC
+
+#### Reference
+- https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103241.md b/2026/CVE-2026-103241.md
new file mode 100644
index 0000000000..4e28fbc042
--- /dev/null
+++ b/2026/CVE-2026-103241.md
@@ -0,0 +1,43 @@
+### [CVE-2026-103241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103241)
+![](https://img.shields.io/static/v1?label=Product&message=vLLM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.10%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.11%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.12%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.13%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.15%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.16%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.17%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.18%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.19%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.20%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.21%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.22%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.23%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.24%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.25%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.26.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.6%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.7%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0.9%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen)
+
+### Description
+
+A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 0.29.1rc0 is able to resolve this issue. This patch is called 3439bad37e68ba9755a46f4f6b44a4aeaf1f60a9. Upgrading the affected component is advised.
+
+### POC
+
+#### Reference
+- https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103243.md b/2026/CVE-2026-103243.md
new file mode 100644
index 0000000000..1957d04426
--- /dev/null
+++ b/2026/CVE-2026-103243.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103243](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103243)
+![](https://img.shields.io/static/v1?label=Product&message=LightLLM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.
+
+### POC
+
+#### Reference
+- https://github.com/ModelTC/LightLLM/issues/1608
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103244.md b/2026/CVE-2026-103244.md
new file mode 100644
index 0000000000..49eedce5c4
--- /dev/null
+++ b/2026/CVE-2026-103244.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103244](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103244)
+![](https://img.shields.io/static/v1?label=Product&message=ground-station&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
+
+### POC
+
+#### Reference
+- https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103263.md b/2026/CVE-2026-103263.md
new file mode 100644
index 0000000000..e8f5854efc
--- /dev/null
+++ b/2026/CVE-2026-103263.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103263](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103263)
+![](https://img.shields.io/static/v1?label=Product&message=tornado&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen)
+
+### Description
+
+Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.
+
+### POC
+
+#### Reference
+- https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103293.md b/2026/CVE-2026-103293.md
new file mode 100644
index 0000000000..2fb2b1822c
--- /dev/null
+++ b/2026/CVE-2026-103293.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103293)
+![](https://img.shields.io/static/v1?label=Product&message=MPG&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+The MPG  WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/810447c9-4a8b-4d80-af7c-2f5fa8b13609/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103395.md b/2026/CVE-2026-103395.md
new file mode 100644
index 0000000000..9efda4a62e
--- /dev/null
+++ b/2026/CVE-2026-103395.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103395](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103395)
+![](https://img.shields.io/static/v1?label=Product&message=LightLLM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization%20of%20Untrusted%20Data&color=brightgreen)
+
+### Description
+
+LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.
+
+### POC
+
+#### Reference
+- https://github.com/ModelTC/LightLLM/issues/1610
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103396.md b/2026/CVE-2026-103396.md
new file mode 100644
index 0000000000..d8dd1a580a
--- /dev/null
+++ b/2026/CVE-2026-103396.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103396)
+![](https://img.shields.io/static/v1?label=Product&message=bbs-go&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
+
+### POC
+
+#### Reference
+- https://github.com/mlogclub/bbs-go/issues/303
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103471.md b/2026/CVE-2026-103471.md
new file mode 100644
index 0000000000..ac4fc6f0a2
--- /dev/null
+++ b/2026/CVE-2026-103471.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103471](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103471)
+![](https://img.shields.io/static/v1?label=Product&message=restbed&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.
+
+### POC
+
+#### Reference
+- https://github.com/Corvusoft/restbed/issues/558
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103472.md b/2026/CVE-2026-103472.md
new file mode 100644
index 0000000000..701b00c5a5
--- /dev/null
+++ b/2026/CVE-2026-103472.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103472](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103472)
+![](https://img.shields.io/static/v1?label=Product&message=restbed&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
+
+### POC
+
+#### Reference
+- https://github.com/Corvusoft/restbed/issues/558
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103514.md b/2026/CVE-2026-103514.md
new file mode 100644
index 0000000000..51f0dbf756
--- /dev/null
+++ b/2026/CVE-2026-103514.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103514)
+![](https://img.shields.io/static/v1?label=Product&message=WP%202FA&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen)
+
+### Description
+
+The WP 2FA  WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/e05aa5a3-cd04-428a-b6bb-0538ca1f6b4a/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103532.md b/2026/CVE-2026-103532.md
new file mode 100644
index 0000000000..24069c5459
--- /dev/null
+++ b/2026/CVE-2026-103532.md
@@ -0,0 +1,23 @@
+### [CVE-2026-103532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103532)
+![](https://img.shields.io/static/v1?label=Product&message=Immich&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.7.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.7.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.7.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.7.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.7.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.7.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be initiated remotely. The reported GitHub issue was closed with the label "duplicate".
+
+### POC
+
+#### Reference
+- https://github.com/immich-app/immich/issues/29599
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103533.md b/2026/CVE-2026-103533.md
new file mode 100644
index 0000000000..09a0010ed1
--- /dev/null
+++ b/2026/CVE-2026-103533.md
@@ -0,0 +1,19 @@
+### [CVE-2026-103533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103533)
+![](https://img.shields.io/static/v1?label=Product&message=databasement&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.7.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.7.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen)
+
+### Description
+
+A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema_name results in path traversal. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 1.7.2 will fix this issue. You should upgrade the affected component.
+
+### POC
+
+#### Reference
+- https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103534.md b/2026/CVE-2026-103534.md
new file mode 100644
index 0000000000..d0b1305908
--- /dev/null
+++ b/2026/CVE-2026-103534.md
@@ -0,0 +1,20 @@
+### [CVE-2026-103534](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103534)
+![](https://img.shields.io/static/v1?label=Product&message=databasement&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.7.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.7.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.2 is able to address this issue. The affected component should be upgraded.
+
+### POC
+
+#### Reference
+- https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103536.md b/2026/CVE-2026-103536.md
new file mode 100644
index 0000000000..9273a54dd5
--- /dev/null
+++ b/2026/CVE-2026-103536.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103536)
+![](https://img.shields.io/static/v1?label=Product&message=Supermarket&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication&color=brightgreen)
+
+### Description
+
+A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component save Endpoint. Such manipulation of the argument userId leads to missing authentication. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/ZongXR/SuperMarket/issues/32
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103538.md b/2026/CVE-2026-103538.md
new file mode 100644
index 0000000000..8967b9853c
--- /dev/null
+++ b/2026/CVE-2026-103538.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103538](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103538)
+![](https://img.shields.io/static/v1?label=Product&message=SuperMarket&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication&color=brightgreen)
+
+### Description
+
+A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the file order/src/main/java/com/supermarket/order/controller/OrderController.java of the component Order Deletion Endpoint. Performing a manipulation of the argument orderId results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/ZongXR/SuperMarket/issues/31
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103539.md b/2026/CVE-2026-103539.md
new file mode 100644
index 0000000000..37bb4c6b60
--- /dev/null
+++ b/2026/CVE-2026-103539.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103539](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103539)
+![](https://img.shields.io/static/v1?label=Product&message=SuperMarket&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication&color=brightgreen)
+
+### Description
+
+A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missing authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/ZongXR/SuperMarket/issues/30
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103540.md b/2026/CVE-2026-103540.md
new file mode 100644
index 0000000000..2fa86c5a50
--- /dev/null
+++ b/2026/CVE-2026-103540.md
@@ -0,0 +1,20 @@
+### [CVE-2026-103540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103540)
+![](https://img.shields.io/static/v1?label=Product&message=Form%20Tools&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.1.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20Used%20in%20a%20Template%20Engine&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incomplete%20Filtering%20of%20Special%20Elements&color=brightgreen)
+
+### Description
+
+A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page_titles leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/formtools/core/issues/956
+- https://github.com/wawyw/cve_report/blob/main/formtools_1.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103541.md b/2026/CVE-2026-103541.md
new file mode 100644
index 0000000000..6bf6cadc64
--- /dev/null
+++ b/2026/CVE-2026-103541.md
@@ -0,0 +1,20 @@
+### [CVE-2026-103541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103541)
+![](https://img.shields.io/static/v1?label=Product&message=Form%20Tools&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.1.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload&color=brightgreen)
+
+### Description
+
+A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/formtools/core/issues/957
+- https://github.com/wawyw/cve_report/blob/main/formtools_2.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103542.md b/2026/CVE-2026-103542.md
new file mode 100644
index 0000000000..d569cf5e25
--- /dev/null
+++ b/2026/CVE-2026-103542.md
@@ -0,0 +1,19 @@
+### [CVE-2026-103542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103542)
+![](https://img.shields.io/static/v1?label=Product&message=Form%20Tools&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.1.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen)
+
+### Description
+
+A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
+
+### POC
+
+#### Reference
+- https://github.com/formtools/core/issues/958
+- https://github.com/wawyw/cve_report/blob/main/formtools_3.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103543.md b/2026/CVE-2026-103543.md
new file mode 100644
index 0000000000..b197022814
--- /dev/null
+++ b/2026/CVE-2026-103543.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103543)
+![](https://img.shields.io/static/v1?label=Product&message=Leave%20Management%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_repository/issues/17
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103544.md b/2026/CVE-2026-103544.md
new file mode 100644
index 0000000000..3ada1ef162
--- /dev/null
+++ b/2026/CVE-2026-103544.md
@@ -0,0 +1,19 @@
+### [CVE-2026-103544](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103544)
+![](https://img.shields.io/static/v1?label=Product&message=OpenConstructionERP&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=14.8.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=14.8.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Exposure%20of%20Data%20Element%20to%20Wrong%20Session&color=brightgreen)
+
+### Description
+
+A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wrong session. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 15.0.0 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
+
+### POC
+
+#### Reference
+- https://github.com/datadrivenconstruction/OpenConstructionERP/security/advisories/GHSA-wfpw-cv5v-64j5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103648.md b/2026/CVE-2026-103648.md
new file mode 100644
index 0000000000..63f19f2c6b
--- /dev/null
+++ b/2026/CVE-2026-103648.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103648](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103648)
+![](https://img.shields.io/static/v1?label=Product&message=image-downloader&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.
+
+### POC
+
+#### Reference
+- https://gitlab.com/demsking/image-downloader/-/work_items/32
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103686.md b/2026/CVE-2026-103686.md
new file mode 100644
index 0000000000..9d391b89be
--- /dev/null
+++ b/2026/CVE-2026-103686.md
@@ -0,0 +1,34 @@
+### [CVE-2026-103686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103686)
+![](https://img.shields.io/static/v1?label=Product&message=dom-sanitizer&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.10%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.11%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.12%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.13%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.15%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.6%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.7%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.9%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen)
+
+### Description
+
+A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 1.0.16 is recommended to address this issue. Patch name: 4623b565d060bc02ca5a07d8c8241fe28e2edfda. It is suggested to upgrade the affected component.
+
+### POC
+
+#### Reference
+- https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-mrpv-6x26-mf6c
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103687.md b/2026/CVE-2026-103687.md
new file mode 100644
index 0000000000..5c7b329c27
--- /dev/null
+++ b/2026/CVE-2026-103687.md
@@ -0,0 +1,34 @@
+### [CVE-2026-103687](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103687)
+![](https://img.shields.io/static/v1?label=Product&message=dom-sanitizer&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.10%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.11%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.12%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.13%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.15%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.6%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.7%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1.0.9%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incomplete%20Blacklist&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Permissive%20List%20of%20Allowed%20Inputs&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
+
+### POC
+
+#### Reference
+- https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103690.md b/2026/CVE-2026-103690.md
new file mode 100644
index 0000000000..26079acd38
--- /dev/null
+++ b/2026/CVE-2026-103690.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103690](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103690)
+![](https://img.shields.io/static/v1?label=Product&message=Leave%20Management%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
+
+### POC
+
+#### Reference
+- https://github.com/ltranquility/submit_repository/issues/18
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103757.md b/2026/CVE-2026-103757.md
new file mode 100644
index 0000000000..bc40a5a45e
--- /dev/null
+++ b/2026/CVE-2026-103757.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103757](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103757)
+![](https://img.shields.io/static/v1?label=Product&message=budibase&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables that places an internal URL in an attachment column, causing the server to fetch it and return a presigned object-storage URL containing the response, such as cloud metadata credentials.
+
+### POC
+
+#### Reference
+- https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103761.md b/2026/CVE-2026-103761.md
new file mode 100644
index 0000000000..e4666c4cec
--- /dev/null
+++ b/2026/CVE-2026-103761.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103761](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103761)
+![](https://img.shields.io/static/v1?label=Product&message=Mooncake&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.
+
+### POC
+
+#### Reference
+- https://github.com/kvcache-ai/Mooncake/issues/4445
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103762.md b/2026/CVE-2026-103762.md
new file mode 100644
index 0000000000..0698110d68
--- /dev/null
+++ b/2026/CVE-2026-103762.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103762](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103762)
+![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen)
+
+### Description
+
+SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.
+
+### POC
+
+#### Reference
+- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mrf-mx66-vv6g
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103763.md b/2026/CVE-2026-103763.md
new file mode 100644
index 0000000000..355bbc8598
--- /dev/null
+++ b/2026/CVE-2026-103763.md
@@ -0,0 +1,18 @@
+### [CVE-2026-103763](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103763)
+![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+
+### Description
+
+SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebookInfo endpoint. Attackers, including anonymous visitors when no reader password is set, can query publish-visible notebooks to obtain document count, size and modification timestamps of hidden documents.
+
+### POC
+
+#### Reference
+- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ccxp-q3vg-jvgj
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103764.md b/2026/CVE-2026-103764.md
new file mode 100644
index 0000000000..068fb35de1
--- /dev/null
+++ b/2026/CVE-2026-103764.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103764)
+![](https://img.shields.io/static/v1?label=Product&message=Mooncake&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Untrusted%20Pointer%20Dereference&color=brightgreen)
+
+### Description
+
+Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size values using READ or WRITE opcodes to disclose KV cache contents, prompts and secrets or corrupt memory toward code execution.
+
+### POC
+
+#### Reference
+- https://github.com/kvcache-ai/Mooncake/issues/4441
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-103765.md b/2026/CVE-2026-103765.md
new file mode 100644
index 0000000000..f5e6344ad9
--- /dev/null
+++ b/2026/CVE-2026-103765.md
@@ -0,0 +1,17 @@
+### [CVE-2026-103765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103765)
+![](https://img.shields.io/static/v1?label=Product&message=Mooncake&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison segment descriptors such as tcp_data_port or re-create rpc_meta entries to redirect KV cache transfers to attacker-controlled listeners, or exhaust server memory.
+
+### POC
+
+#### Reference
+- https://github.com/kvcache-ai/Mooncake/issues/4444
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-104733.md b/2026/CVE-2026-104733.md
new file mode 100644
index 0000000000..ad870c3aed
--- /dev/null
+++ b/2026/CVE-2026-104733.md
@@ -0,0 +1,17 @@
+### [CVE-2026-104733](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104733)
+![](https://img.shields.io/static/v1?label=Product&message=ejabberd&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=User%20Impersonation&color=brightgreen)
+
+### Description
+
+User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid parameter in SASL-PLAIN mechanism.
+
+### POC
+
+#### Reference
+- https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-004/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-105043.md b/2026/CVE-2026-105043.md
new file mode 100644
index 0000000000..4f59feb3fb
--- /dev/null
+++ b/2026/CVE-2026-105043.md
@@ -0,0 +1,17 @@
+### [CVE-2026-105043](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105043)
+![](https://img.shields.io/static/v1?label=Product&message=Simulink&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-451%20User%20Interface%20(UI)%20Misrepresentation%20of%20Critical%20Information&color=brightgreen)
+
+### Description
+
+MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.
+
+### POC
+
+#### Reference
+- https://alexanderboll.dev/disclosures/simulink-vulnerability-concealed-blocks/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-105090.md b/2026/CVE-2026-105090.md
new file mode 100644
index 0000000000..2492c41eb6
--- /dev/null
+++ b/2026/CVE-2026-105090.md
@@ -0,0 +1,18 @@
+### [CVE-2026-105090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105090)
+![](https://img.shields.io/static/v1?label=Product&message=Formbricks&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=6.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage permission boundary. A workspace member holding only readWrite permission could configure Custom Head Scripts on a survey, an operation the documentation restricts to the Manage role. Because the configured scripts execute in the authenticated browser session of any user who opens the affected survey, a lower-privileged member can run arbitrary JavaScript (stored cross-site scripting) in the session of higher-privileged users. Fixed versions require Manage access to modify survey Custom Head Scripts.
+
+### POC
+
+#### Reference
+- https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-17531.md b/2026/CVE-2026-17531.md
index da46ac9f10..fc72d49ec1 100644
--- a/2026/CVE-2026-17531.md
+++ b/2026/CVE-2026-17531.md
@@ -15,6 +15,8 @@ A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by
 
 #### Reference
 - https://github.com/unitedbyai/droidclaw/issues/18
+- https://vuldb.com/vuln/383396
+- https://vuldb.com/vuln/383396/cti
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-19856.md b/2026/CVE-2026-19856.md
new file mode 100644
index 0000000000..97eea3f869
--- /dev/null
+++ b/2026/CVE-2026-19856.md
@@ -0,0 +1,17 @@
+### [CVE-2026-19856](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19856)
+![](https://img.shields.io/static/v1?label=Product&message=All%20in%20One%20SEO&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brightgreen)
+
+### Description
+
+The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/e35365d3-65de-45a7-9629-17aacd5299c7/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-50013.md b/2026/CVE-2026-50013.md
index 4b25ec0966..ad523f14a6 100644
--- a/2026/CVE-2026-50013.md
+++ b/2026/CVE-2026-50013.md
@@ -11,6 +11,7 @@ Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Ho
 ### POC
 
 #### Reference
+- https://github.com/SpectoLabs/hoverfly/pull/1227
 - https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg
 
 #### Github
diff --git a/2026/CVE-2026-52993.md b/2026/CVE-2026-52993.md
new file mode 100644
index 0000000000..be12401b9e
--- /dev/null
+++ b/2026/CVE-2026-52993.md
@@ -0,0 +1,19 @@
+### [CVE-2026-52993](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52993)
+![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4.15%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=d618d09a68e4eed7a435beb2e355250f6f40664a%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)
+
+### Description
+
+In the Linux kernel, the following vulnerability has been resolved:tipc: fix double-free in tipc_buf_append()tipc_msg_validate() can potentially reallocate the skb it is validating,freeing the old one.  In tipc_buf_append(), it was being called with apointer to a local variable which was a copy of the caller's skbpointer.If the skb was reallocated and validation subsequently failed, the errorhandling path would free the original skb pointer, which had alreadybeen freed, leading to double-free.Fix this by checking if head now points to a newly allocated reassembledskb.  If it does, reassign *headbuf for later freeing operations.
+
+### POC
+
+#### Reference
+- https://bugzilla.redhat.com/show_bug.cgi?id=2492437
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-62286.md b/2026/CVE-2026-62286.md
new file mode 100644
index 0000000000..733ef97270
--- /dev/null
+++ b/2026/CVE-2026-62286.md
@@ -0,0 +1,18 @@
+### [CVE-2026-62286](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62286)
+![](https://img.shields.io/static/v1?label=Product&message=dozzle&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%2010.6.7%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen)
+
+### Description
+
+Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7.
+
+### POC
+
+#### Reference
+- https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-62308.md b/2026/CVE-2026-62308.md
new file mode 100644
index 0000000000..1419588b16
--- /dev/null
+++ b/2026/CVE-2026-62308.md
@@ -0,0 +1,17 @@
+### [CVE-2026-62308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62308)
+![](https://img.shields.io/static/v1?label=Product&message=tugtainer&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.30.6%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost addresses, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind server-side request forgery (SSRF). This issue has been patched in version 1.30.6.
+
+### POC
+
+#### Reference
+- https://github.com/Quenary/tugtainer/security/advisories/GHSA-c2h5-ppv9-7vrq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-62911.md b/2026/CVE-2026-62911.md
new file mode 100644
index 0000000000..66284af045
--- /dev/null
+++ b/2026/CVE-2026-62911.md
@@ -0,0 +1,21 @@
+### [CVE-2026-62911](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62911)
+![](https://img.shields.io/static/v1?label=Product&message=Microsoft%20Exchange%20Server%202016%20Cumulative%20Update%2023&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Microsoft%20Exchange%20Server%202019%20Cumulative%20Update%2014&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Microsoft%20Exchange%20Server%202019%20Cumulative%20Update%2015&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Microsoft%20Exchange%20Server%20Subscription%20Edition%20RTM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=15.01.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=15.02.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-294%3A%20Authentication%20Bypass%20by%20Capture-replay&color=brightgreen)
+
+### Description
+
+Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
+
+### POC
+
+#### Reference
+- https://github.com/hypnguyen1209/CVE-2026-62911
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-62985.md b/2026/CVE-2026-62985.md
new file mode 100644
index 0000000000..a38a27f985
--- /dev/null
+++ b/2026/CVE-2026-62985.md
@@ -0,0 +1,17 @@
+### [CVE-2026-62985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62985)
+![](https://img.shields.io/static/v1?label=Product&message=request-filtering-agent&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.2.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-248%3A%20Uncaught%20Exception&color=brightgreen)
+
+### Description
+
+request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or 127.0.0.1. Because Node.js http.request and http.get expect connection failures to be delivered asynchronously, the throw bypassed req.on('error') and became an uncaught exception that could terminate the application process. Hostnames resolved through the asynchronous lookup path were not affected by this error-delivery asymmetry. This issue is fixed in version 3.2.1.
+
+### POC
+
+#### Reference
+- https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-62987.md b/2026/CVE-2026-62987.md
new file mode 100644
index 0000000000..72a5ebf46f
--- /dev/null
+++ b/2026/CVE-2026-62987.md
@@ -0,0 +1,18 @@
+### [CVE-2026-62987](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62987)
+![](https://img.shields.io/static/v1?label=Product&message=fabio&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.6.6%2C%20%3C%201.7.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-290%3A%20Authentication%20Bypass%20by%20Spoofing&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-348%3A%20Use%20of%20Less%20Trusted%20Source&color=brightgreen)
+
+### Description
+
+Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
+
+### POC
+
+#### Reference
+- https://github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63098.md b/2026/CVE-2026-63098.md
new file mode 100644
index 0000000000..e156c8d25a
--- /dev/null
+++ b/2026/CVE-2026-63098.md
@@ -0,0 +1,17 @@
+### [CVE-2026-63098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63098)
+![](https://img.shields.io/static/v1?label=Product&message=TheHive&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+TheHive through 4.1.24 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by sending a GET request to the /api/status endpoint, which lacks authentication enforcement in the StatusCtrl.scala handler. Attackers can obtain the datastore attachment protection password, configured authentication providers, SSO settings, MFA capabilities, and clustered node addresses and roles without any credentials.
+
+### POC
+
+#### Reference
+- https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63134.md b/2026/CVE-2026-63134.md
index 7830f3f625..9aa40adb6e 100644
--- a/2026/CVE-2026-63134.md
+++ b/2026/CVE-2026-63134.md
@@ -1,6 +1,7 @@
 ### [CVE-2026-63134](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63134)
 ![](https://img.shields.io/static/v1?label=Product&message=Malcolm&color=blue)
 ![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.07.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
 
 ### Description
diff --git a/2026/CVE-2026-63177.md b/2026/CVE-2026-63177.md
index 36db725280..25a07a8925 100644
--- a/2026/CVE-2026-63177.md
+++ b/2026/CVE-2026-63177.md
@@ -1,6 +1,7 @@
 ### [CVE-2026-63177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63177)
 ![](https://img.shields.io/static/v1?label=Product&message=Malcolm&color=blue)
 ![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.07.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
 
 ### Description
diff --git a/2026/CVE-2026-63459.md b/2026/CVE-2026-63459.md
new file mode 100644
index 0000000000..f273d7456b
--- /dev/null
+++ b/2026/CVE-2026-63459.md
@@ -0,0 +1,17 @@
+### [CVE-2026-63459](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63459)
+![](https://img.shields.io/static/v1?label=Product&message=vendure&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.6.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.
+
+### POC
+
+#### Reference
+- https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63630.md b/2026/CVE-2026-63630.md
new file mode 100644
index 0000000000..565506671f
--- /dev/null
+++ b/2026/CVE-2026-63630.md
@@ -0,0 +1,18 @@
+### [CVE-2026-63630](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63630)
+![](https://img.shields.io/static/v1?label=Product&message=bentopdf&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.8.7%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-201%3A%20Insertion%20of%20Sensitive%20Information%20Into%20Sent%20Data&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%3A%20Deserialization%20of%20Untrusted%20Data&color=brightgreen)
+
+### Description
+
+BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.
+
+### POC
+
+#### Reference
+- https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63635.md b/2026/CVE-2026-63635.md
new file mode 100644
index 0000000000..46158c01a1
--- /dev/null
+++ b/2026/CVE-2026-63635.md
@@ -0,0 +1,21 @@
+### [CVE-2026-63635](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63635)
+![](https://img.shields.io/static/v1?label=Product&message=OpenImageIO&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.0.21.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.1.0.0%2C%20%3C%203.1.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.2.0.0-dev%2C%20%3C%203.2.0.3-beta1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-129%3A%20Improper%20Validation%20of%20Array%20Index&color=brightgreen)
+
+### Description
+
+OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value to index fixed color-mode tables, causing a global out-of-bounds read and potentially a bogus allocation, resulting in denial of service. The affected implementation is identified by src/psd.imageio/psdinput.cpp, PSDInput::validate_header(), PSDInput::setup(), oiio:RawColor, psd:RawData, color_mode, and mode_channel_count, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
+
+### POC
+
+#### Reference
+- https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf
+- https://github.com/user-attachments/files/29539076/poc.zip
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63638.md b/2026/CVE-2026-63638.md
new file mode 100644
index 0000000000..bf128c669f
--- /dev/null
+++ b/2026/CVE-2026-63638.md
@@ -0,0 +1,19 @@
+### [CVE-2026-63638](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63638)
+![](https://img.shields.io/static/v1?label=Product&message=OpenImageIO&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.0.21.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.1.0.0%2C%20%3C%203.1.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.2.0.0-dev%2C%20%3C%203.2.0.3-beta1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen)
+
+### Description
+
+OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to a 32-bit imagespec, but libcineon maps the unsupported depth to an 8-byte value, so cineoninput::read_native_scanline() causes attacker-controlled data to be written beyond the 4-byte-per-pixel caller buffer, resulting in a heap out-of-bounds write and memory corruption. The affected implementation is identified by src/cineon.imageio/cineoninput.cpp, CineonInput::open(), CineonInput::read_native_scanline(), ComponentDataSize(), bit depth 26, and ImageSpec, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1.
+
+### POC
+
+#### Reference
+- https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63643.md b/2026/CVE-2026-63643.md
new file mode 100644
index 0000000000..8ec48b47fa
--- /dev/null
+++ b/2026/CVE-2026-63643.md
@@ -0,0 +1,18 @@
+### [CVE-2026-63643](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63643)
+![](https://img.shields.io/static/v1?label=Product&message=MagicMirror&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.37.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-441%3A%20Unintended%20Proxy%20or%20Intermediary%20('Confused%20Deputy')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.
+
+### POC
+
+#### Reference
+- https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-63645.md b/2026/CVE-2026-63645.md
new file mode 100644
index 0000000000..b08cbe0de4
--- /dev/null
+++ b/2026/CVE-2026-63645.md
@@ -0,0 +1,17 @@
+### [CVE-2026-63645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63645)
+![](https://img.shields.io/static/v1?label=Product&message=openobserve&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.90.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+
+### Description
+
+OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3.
+
+### POC
+
+#### Reference
+- https://github.com/openobserve/openobserve/security/advisories/GHSA-v496-g5c9-vqxw
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-64849.md b/2026/CVE-2026-64849.md
index b655390b4f..47f3e62408 100644
--- a/2026/CVE-2026-64849.md
+++ b/2026/CVE-2026-64849.md
@@ -1,11 +1,11 @@
 ### [CVE-2026-64849](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64849)
 ![](https://img.shields.io/static/v1?label=Product&message=mlflow&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=%3C%203.15.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.3.0%2C%20%3C%203.15.0%20&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
 
 ### Description
 
-MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
+MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
 
 ### POC
 
diff --git a/2026/CVE-2026-68495.md b/2026/CVE-2026-68495.md
new file mode 100644
index 0000000000..b451b47d56
--- /dev/null
+++ b/2026/CVE-2026-68495.md
@@ -0,0 +1,22 @@
+### [CVE-2026-68495](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68495)
+![](https://img.shields.io/static/v1?label=Product&message=jackson-dataformats-binary&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.19.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.2.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() decodes a definite-length property name with no length check, and CBORParser._decodeChunkedName() delegates to the value-oriented _finishChunkedText() routine, which validates maxStringLength rather than maxNameLength. An attacker who can have a CBOR document parsed may therefore embed a single property name of unbounded length; the parser buffers the whole name in memory before returning it, whatever maxNameLength is configured to. Because StreamReadConstraints.maxDocumentLength is also disabled by default, nothing else bounds the name under default settings, so the only limits are the attacker's upload capacity and available heap, leading to memory exhaustion and denial of service. No privileges beyond the ability to submit data to a parsing endpoint are required, and exploitation needs only that the bytes reach CBORFactory parsing, directly or through an ObjectMapper configured with the CBOR module. jackson-core's own JSON parsers enforce maxNameLength incrementally during name decoding; this gap is specific to the binary formats. maxNameLength and validateNameLength were introduced in jackson-core 2.16.0, so releases before 2.16.0 do not contain the constraint that is left unenforced. This issue is tracked together with the Smile parser defect in the same vendor advisory, GHSA-3v8f-v6vx-fmrm, which covers both binary formats. The CBOR parser defect (jackson-dataformats-binary issue #725) is CVE-2026-68495; the Smile parser defect (issue #726) is assigned CVE-2026-68496.
+
+### POC
+
+#### Reference
+- https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68496.md b/2026/CVE-2026-68496.md
new file mode 100644
index 0000000000..3c82ea8e8c
--- /dev/null
+++ b/2026/CVE-2026-68496.md
@@ -0,0 +1,22 @@
+### [CVE-2026-68496](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68496)
+![](https://img.shields.io/static/v1?label=Product&message=jackson-dataformats-binary&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.19.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.2.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows its internal name buffer through an unconstrained _growArrayTo() call and performs no length validation. An attacker who can have a Smile document parsed may therefore embed a single property name of unbounded length; the parser buffers the whole name in memory before returning it, whatever maxNameLength is configured to. Because StreamReadConstraints.maxDocumentLength is also disabled by default, nothing else bounds the name under default settings, so the only limits are the attacker's upload capacity and available heap, leading to memory exhaustion and denial of service. No privileges beyond the ability to submit data to a parsing endpoint are required, and exploitation needs only that the bytes reach SmileFactory parsing, directly or through an ObjectMapper configured with the Smile module. jackson-core's own JSON parsers enforce maxNameLength incrementally during name decoding; this gap is specific to the binary formats. maxNameLength and validateNameLength were introduced in jackson-core 2.16.0, so releases before 2.16.0 do not contain the constraint that is left unenforced. This issue is tracked together with the CBOR parser defect in the same vendor advisory, GHSA-3v8f-v6vx-fmrm, which covers both binary formats. The Smile parser defect (jackson-dataformats-binary issue #726) is CVE-2026-68496; the CBOR parser defect (issue #725) is assigned CVE-2026-68495.
+
+### POC
+
+#### Reference
+- https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68497.md b/2026/CVE-2026-68497.md
new file mode 100644
index 0000000000..43359193b5
--- /dev/null
+++ b/2026/CVE-2026-68497.md
@@ -0,0 +1,22 @@
+### [CVE-2026-68497](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68497)
+![](https://img.shields.io/static/v1?label=Product&message=jackson-databind&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.19.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.2.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1333%20Inefficient%20Regular%20Expression%20Complexity&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+
+### Description
+
+jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
+
+### POC
+
+#### Reference
+- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68514.md b/2026/CVE-2026-68514.md
new file mode 100644
index 0000000000..fecde5b0b5
--- /dev/null
+++ b/2026/CVE-2026-68514.md
@@ -0,0 +1,19 @@
+### [CVE-2026-68514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68514)
+![](https://img.shields.io/static/v1?label=Product&message=openexr&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.3.0%2C%20%3C%203.3.13%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.4.0%2C%20%3C%203.4.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%3A%20Heap-based%20Buffer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen)
+
+### Description
+
+OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep scanline EXR file. When a deep file declares a literal channel named left alongside layer-prefixed RGB channels left.R, left.G, and left.B, the wrapper processes the literal left channel first and allocates a scalar deep sample array for it, then reuses that same array as the coalesced destination for the prefixed RGB group. The deep reader registers sample slices with an RGB stride (three lanes) into storage that was allocated with scalar shape, so decoding the deep samples writes past the allocation. Opening such a file through the default public Python API, OpenEXR.File(path), causes a heap buffer overflow during normal deep sample decode, leading to memory corruption and a crash. This issue is fixed in versions 3.3.13 and 3.4.14.
+
+### POC
+
+#### Reference
+- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-mw28-66qc-c883
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68516.md b/2026/CVE-2026-68516.md
new file mode 100644
index 0000000000..940ffb255b
--- /dev/null
+++ b/2026/CVE-2026-68516.md
@@ -0,0 +1,18 @@
+### [CVE-2026-68516](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68516)
+![](https://img.shields.io/static/v1?label=Product&message=openexr&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.4.0%2C%20%3C%203.4.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-121%3A%20Stack-based%20Buffer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen)
+
+### Description
+
+OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.
+
+### POC
+
+#### Reference
+- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fw66-6xph-56jm
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68555.md b/2026/CVE-2026-68555.md
new file mode 100644
index 0000000000..904f469411
--- /dev/null
+++ b/2026/CVE-2026-68555.md
@@ -0,0 +1,17 @@
+### [CVE-2026-68555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68555)
+![](https://img.shields.io/static/v1?label=Product&message=coturn&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.15.0%2C%20%3C%204.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+
+### Description
+
+Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobile_begin_transition() in src/server/ns_turn_server.c disarms each new session's allocation timeout and overwrites the allocation's single mobile_pending_resume link, leaving earlier pending sessions unreachable by the cleanup path, while copy_auth_parameters() ignores inc_quota() failure. The attacker can therefore retain unbounded server-side sessions and exhaust process memory even when --user-quota=1 is configured. This issue is fixed in version 4.16.0.
+
+### POC
+
+#### Reference
+- https://github.com/coturn/coturn/security/advisories/GHSA-hpq3-g7x4-h7xx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68766.md b/2026/CVE-2026-68766.md
new file mode 100644
index 0000000000..d9f7e22dec
--- /dev/null
+++ b/2026/CVE-2026-68766.md
@@ -0,0 +1,17 @@
+### [CVE-2026-68766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68766)
+![](https://img.shields.io/static/v1?label=Product&message=hashcat&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen)
+
+### Description
+
+hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.
+
+### POC
+
+#### Reference
+- https://github.com/hashcat/hashcat/issues/4738
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-68928.md b/2026/CVE-2026-68928.md
new file mode 100644
index 0000000000..4680ce8038
--- /dev/null
+++ b/2026/CVE-2026-68928.md
@@ -0,0 +1,19 @@
+### [CVE-2026-68928](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68928)
+![](https://img.shields.io/static/v1?label=Product&message=Acode&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.11.6%2C%20%3C%201.12.7%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-749%3A%20Exposed%20Dangerous%20Method%20or%20Function&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-926%3A%20Improper%20Export%20of%20Android%20Application%20Components&color=brightgreen)
+
+### Description
+
+Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.
+
+### POC
+
+#### Reference
+- https://github.com/Acode-Foundation/Acode/security/advisories/GHSA-wm94-wp33-43gx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-7064.md b/2026/CVE-2026-7064.md
index 68962a27ff..3b7cd0ffee 100644
--- a/2026/CVE-2026-7064.md
+++ b/2026/CVE-2026-7064.md
@@ -1,5 +1,6 @@
 ### [CVE-2026-7064](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7064)
 ![](https://img.shields.io/static/v1?label=Product&message=browser-tools-mcp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=1.1%20&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=1.2.0%20&color=brightgreen)
@@ -8,7 +9,7 @@
 
 ### Description
 
-A flaw has been found in AgentDeskAI browser-tools-mcp up to 1.2.0. This issue affects some unknown processing of the file browser-tools-server/browser-connector.ts. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
+A flaw has been found in AgentDeskAI browser-tools-mcp up to 1.2.0. This issue affects some unknown processing of the file browser-tools-server/browser-connector.ts. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 2.0.0 is capable of addressing this issue. It is recommended to upgrade the affected component.
 
 ### POC
 
diff --git a/2026/CVE-2026-77019.md b/2026/CVE-2026-77019.md
new file mode 100644
index 0000000000..94545c6d40
--- /dev/null
+++ b/2026/CVE-2026-77019.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77019](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77019)
+![](https://img.shields.io/static/v1?label=Product&message=Apartment%20Visitor%20Management%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
+
+### POC
+
+#### Reference
+- https://github.com/Witiers/CVEs/issues/1
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77087.md b/2026/CVE-2026-77087.md
new file mode 100644
index 0000000000..ec15e7d1d6
--- /dev/null
+++ b/2026/CVE-2026-77087.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77087](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77087)
+![](https://img.shields.io/static/v1?label=Product&message=paperclip&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen)
+
+### Description
+
+Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.
+
+### POC
+
+#### Reference
+- https://github.com/paperclipai/paperclip/security/advisories/GHSA-x8hx-rhr2-9rf7
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77088.md b/2026/CVE-2026-77088.md
new file mode 100644
index 0000000000..bac906e8be
--- /dev/null
+++ b/2026/CVE-2026-77088.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77088)
+![](https://img.shields.io/static/v1?label=Product&message=justhtml&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
+
+### POC
+
+#### Reference
+- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77239.md b/2026/CVE-2026-77239.md
new file mode 100644
index 0000000000..dfb7b80a38
--- /dev/null
+++ b/2026/CVE-2026-77239.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77239)
+![](https://img.shields.io/static/v1?label=Product&message=wacrm&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%200.7.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen)
+
+### Description
+
+WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f.
+
+### POC
+
+#### Reference
+- https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77246.md b/2026/CVE-2026-77246.md
new file mode 100644
index 0000000000..de119c9570
--- /dev/null
+++ b/2026/CVE-2026-77246.md
@@ -0,0 +1,19 @@
+### [CVE-2026-77246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77246)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-441%3A%20Unintended%20Proxy%20or%20Intermediary%20('Confused%20Deputy')&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including X-Atlassian-Confluence-Url, to select a public attacker hostname or one allowed by MCP_ALLOWED_URL_DOMAINS. A caller can then invoke confluence_upload_attachment or the Jira attachment variant in src/mcp_atlassian/jira/attachments.py with a server-local file_path and cause the MCP process to send the file to the selected attachment endpoint. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-wv8v-v4c5-v75j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77247.md b/2026/CVE-2026-77247.md
new file mode 100644
index 0000000000..8955e62775
--- /dev/null
+++ b/2026/CVE-2026-77247.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77247](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77247)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-73%3A%20External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user deployments, a permitted client can disclose host files without shell or direct filesystem access. The advisory traces the vulnerable input and processing flow through AttachmentsMixin.upload_attachment, AttachmentsMixin.upload_attachments, file_path, file_paths, and jira update_issue, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77248.md b/2026/CVE-2026-77248.md
new file mode 100644
index 0000000000..35dcfc5e24
--- /dev/null
+++ b/2026/CVE-2026-77248.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77248)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment accepts an unrestricted file_path. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-selected Jira issue or Confluence page, and retrieve the contents. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, upload_attachment, file_path, and _get_fetcher, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-cc5h-2pwp-pvcc
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77250.md b/2026/CVE-2026-77250.md
new file mode 100644
index 0000000000..4abb25f552
--- /dev/null
+++ b/2026/CVE-2026-77250.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77250)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-312%3A%20Cleartext%20Storage%20of%20Sensitive%20Information&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using process-default permissions. On systems with a permissive umask, same-group or other local users and processes can read the persisted tokens and reuse the associated Atlassian access. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens, ~/.mcp-atlassian/oauth-<client_id>.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5xv-mhgm-v5f6
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77252.md b/2026/CVE-2026-77252.md
new file mode 100644
index 0000000000..1af1fac9d1
--- /dev/null
+++ b/2026/CVE-2026-77252.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77252](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77252)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists, and caller-provided project or space clauses can suppress the configured restriction. A caller can search projects or spaces outside the intended boundary when the configured Atlassian credentials can access them. The advisory traces the vulnerable input and processing flow through JIRA_PROJECTS_FILTER, CONFLUENCE_SPACES_FILTER, projects_filter, spaces_filter, SearchMixin.search_issues, and SearchMixin.search, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-rqwg-9346-fjjv
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77253.md b/2026/CVE-2026-77253.md
new file mode 100644
index 0000000000..e4e4b7b839
--- /dev/null
+++ b/2026/CVE-2026-77253.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77253)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or other files readable by the MCP process. The advisory traces the vulnerable input and processing flow through jira_upload_attachment, confluence_upload_attachment, file_path, and server-local filesystem, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77254.md b/2026/CVE-2026-77254.md
new file mode 100644
index 0000000000..ca1c31e6d1
--- /dev/null
+++ b/2026/CVE-2026-77254.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77254)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or Confluence credentials. A network caller can perform operations with the operator account's permissions unless the deployment has an independent authentication boundary. The advisory traces the vulnerable input and processing flow through streamable-http, UserTokenMiddleware, _get_fetcher, and global credentials, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc8m-84rp-53hx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77256.md b/2026/CVE-2026-77256.md
new file mode 100644
index 0000000000..80e591b8de
--- /dev/null
+++ b/2026/CVE-2026-77256.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77256)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-732%3A%20Incorrect%20Permission%20Assignment%20for%20Critical%20Resource&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77258.md b/2026/CVE-2026-77258.md
new file mode 100644
index 0000000000..aca60a9735
--- /dev/null
+++ b/2026/CVE-2026-77258.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77258](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77258)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment in src/mcp_atlassian/confluence/attachments.py accepts a caller-controlled file_path and opens the selected server-local file without restricting it to the workspace. A permitted Confluence MCP caller can upload the file as an attachment and disclose data readable by the server process. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-93xw-j965-9mx3
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77259.md b/2026/CVE-2026-77259.md
new file mode 100644
index 0000000000..de28963869
--- /dev/null
+++ b/2026/CVE-2026-77259.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77259](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77259)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-552%3A%20Files%20or%20Directories%20Accessible%20to%20External%20Parties&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-6cr4-ccf3-x7h4
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77260.md b/2026/CVE-2026-77260.md
new file mode 100644
index 0000000000..9b90b20b3f
--- /dev/null
+++ b/2026/CVE-2026-77260.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77260)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A permitted MCP caller can upload sensitive host files to an Atlassian destination and then retrieve their contents. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and CVE-2026-27825, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f4p7-qx46-wc5j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77265.md b/2026/CVE-2026-77265.md
new file mode 100644
index 0000000000..0a01cf2f84
--- /dev/null
+++ b/2026/CVE-2026-77265.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77265](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77265)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An unauthenticated caller can use a DNS-rebinding hostname that returns a public address during validation and an internal address during connection, causing requests to internal or metadata services. The advisory traces the vulnerable input and processing flow through X-Atlassian-Jira-Url, X-Atlassian-Confluence-Url, validate_url_for_ssrf, and DNS rebinding, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77266.md b/2026/CVE-2026-77266.md
new file mode 100644
index 0000000000..57d62c2b21
--- /dev/null
+++ b/2026/CVE-2026-77266.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77266](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77266)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen server-local file and exfiltrate it through Jira or Confluence. The advisory traces the vulnerable input and processing flow through upload_attachment, file_path, and path traversal, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mfv2-4wvm-9pgp
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77268.md b/2026/CVE-2026-77268.md
new file mode 100644
index 0000000000..1c04dbd50d
--- /dev/null
+++ b/2026/CVE-2026-77268.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77268](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77268)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-atlassian&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-732%3A%20Incorrect%20Permission%20Assignment%20for%20Critical%20Resource&color=brightgreen)
+
+### Description
+
+MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bits can read access and refresh tokens and reuse the associated Atlassian session. The advisory traces the vulnerable input and processing flow through ~/.mcp-atlassian, oauth-<client_id>.json, access_token, and refresh_token, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
+
+### POC
+
+#### Reference
+- https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77293.md b/2026/CVE-2026-77293.md
new file mode 100644
index 0000000000..fe351a3651
--- /dev/null
+++ b/2026/CVE-2026-77293.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77293)
+![](https://img.shields.io/static/v1?label=Product&message=TREK&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0.
+
+### POC
+
+#### Reference
+- https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77301.md b/2026/CVE-2026-77301.md
new file mode 100644
index 0000000000..46e72e1f40
--- /dev/null
+++ b/2026/CVE-2026-77301.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77301](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77301)
+![](https://img.shields.io/static/v1?label=Product&message=adm-zip&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.6.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-789%3A%20Memory%20Allocation%20with%20Excessive%20Size%20Value&color=brightgreen)
+
+### Description
+
+adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.
+
+### POC
+
+#### Reference
+- https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77310.md b/2026/CVE-2026-77310.md
new file mode 100644
index 0000000000..4133ede229
--- /dev/null
+++ b/2026/CVE-2026-77310.md
@@ -0,0 +1,22 @@
+### [CVE-2026-77310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77310)
+![](https://img.shields.io/static/v1?label=Product&message=com.fasterxml.jackson.core%3Ajackson-databind&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=tools.jackson.core%3Ajackson-databind&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0%2C%20%3C%202.18.9%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.19.0%2C%20%3C%202.21.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.22.0%2C%20%3C%202.22.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.0.0%2C%20%3C%203.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.2.0%2C%20%3C%203.2.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize() calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
+
+### POC
+
+#### Reference
+- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77320.md b/2026/CVE-2026-77320.md
new file mode 100644
index 0000000000..ccfbd26a79
--- /dev/null
+++ b/2026/CVE-2026-77320.md
@@ -0,0 +1,19 @@
+### [CVE-2026-77320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77320)
+![](https://img.shields.io/static/v1?label=Product&message=TREK&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-602%3A%20Client-Side%20Enforcement%20of%20Server-Side%20Security&color=brightgreen)
+
+### Description
+
+TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.
+
+### POC
+
+#### Reference
+- https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77321.md b/2026/CVE-2026-77321.md
new file mode 100644
index 0000000000..ae96822d3c
--- /dev/null
+++ b/2026/CVE-2026-77321.md
@@ -0,0 +1,19 @@
+### [CVE-2026-77321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77321)
+![](https://img.shields.io/static/v1?label=Product&message=TREK&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0.
+
+### POC
+
+#### Reference
+- https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77322.md b/2026/CVE-2026-77322.md
new file mode 100644
index 0000000000..aaf31c0796
--- /dev/null
+++ b/2026/CVE-2026-77322.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77322](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77322)
+![](https://img.shields.io/static/v1?label=Product&message=sipgo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.4.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-789%3A%20Memory%20Allocation%20with%20Excessive%20Size%20Value&color=brightgreen)
+
+### Description
+
+SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated WS or WSS peer can send a frame header declaring an extremely large payload, causing an oversized allocation or a makeslice length panic before the payload is read and crashing or exhausting memory in the server process. This issue is fixed in version 1.4.3.
+
+### POC
+
+#### Reference
+- https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77339.md b/2026/CVE-2026-77339.md
new file mode 100644
index 0000000000..41ac79900c
--- /dev/null
+++ b/2026/CVE-2026-77339.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77339)
+![](https://img.shields.io/static/v1?label=Product&message=process-compose&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.120.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-346%3A%20Origin%20Validation%20Error&color=brightgreen)
+
+### Description
+
+Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
+
+### POC
+
+#### Reference
+- https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77351.md b/2026/CVE-2026-77351.md
new file mode 100644
index 0000000000..e9ed7cd884
--- /dev/null
+++ b/2026/CVE-2026-77351.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77351](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77351)
+![](https://img.shields.io/static/v1?label=Product&message=Wallos&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%205.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation. When the scheduled notification cron job runs, it passes the stored host directly to PHPMailer, causing the Wallos server to open an outbound TCP connection to whatever address the attacker specified. This gives a low-privileged attacker a reliable mechanism to probe internal network services from the server's perspective. This issue has been patched in version 5.0.0.
+
+### POC
+
+#### Reference
+- https://github.com/ellite/Wallos/security/advisories/GHSA-mwqv-gv8x-9jcp
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77385.md b/2026/CVE-2026-77385.md
new file mode 100644
index 0000000000..92f254f2aa
--- /dev/null
+++ b/2026/CVE-2026-77385.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77385](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77385)
+![](https://img.shields.io/static/v1?label=Product&message=Kyoo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%205.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/zoriya/Kyoo/security/advisories/GHSA-fc8v-vr3q-hc46
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77415.md b/2026/CVE-2026-77415.md
new file mode 100644
index 0000000000..15b0151700
--- /dev/null
+++ b/2026/CVE-2026-77415.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77415](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77415)
+![](https://img.shields.io/static/v1?label=Product&message=jsonata&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.8.8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0%2C%20%3C%202.2.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
+
+### POC
+
+#### Reference
+- https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77421.md b/2026/CVE-2026-77421.md
new file mode 100644
index 0000000000..513351c880
--- /dev/null
+++ b/2026/CVE-2026-77421.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77421](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77421)
+![](https://img.shields.io/static/v1?label=Product&message=jline3&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.0.0%2C%20%3C%203.30.15%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0%2C%20%3C%204.3.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1333%3A%20Inefficient%20Regular%20Expression%20Complexity&color=brightgreen)
+
+### Description
+
+JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
+
+### POC
+
+#### Reference
+- https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77465.md b/2026/CVE-2026-77465.md
new file mode 100644
index 0000000000..88a28659ba
--- /dev/null
+++ b/2026/CVE-2026-77465.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77465](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77465)
+![](https://img.shields.io/static/v1?label=Product&message=toml-node&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.2.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%3A%20Uncontrolled%20Recursion&color=brightgreen)
+
+### Description
+
+toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry functions recurse through nested arrays and inline tables without a depth limit. A remote unauthenticated application parsing an attacker-controlled TOML document containing a few thousand nested arrays or inline tables can exhaust the Node.js call stack, raise an unexpected RangeError rather than the parser's SyntaxError, and terminate an unprotected request worker or process. The corresponding grammar source is src/toml.pegjs, where the generated parser must be bounded. This issue is fixed in version 4.2.0.
+
+### POC
+
+#### Reference
+- https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77518.md b/2026/CVE-2026-77518.md
new file mode 100644
index 0000000000..93f38ee69d
--- /dev/null
+++ b/2026/CVE-2026-77518.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77518](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77518)
+![](https://img.shields.io/static/v1?label=Product&message=MaxKB&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202.10.2-lts%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcp_tool_id in a workflow mcp-node so workflow debug uses the owner's MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.
+
+### POC
+
+#### Reference
+- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-x65c-w438-c58f
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77520.md b/2026/CVE-2026-77520.md
new file mode 100644
index 0000000000..57f7c2c191
--- /dev/null
+++ b/2026/CVE-2026-77520.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77520](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77520)
+![](https://img.shields.io/static/v1?label=Product&message=MaxKB&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202.10.2-lts%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range and the attacker knows or guesses its name, even though direct application detail and debug-open routes deny access. An attacker who can create and publish a workflow application can place the disclosed identifier in an attacker-owned workflow application-node, trigger that workflow, receive output generated by the victim application, and create durable application_chat and application_chat_record rows under the victim application because save and runtime paths do not verify permission to use the referenced application. No fixed version is available as of this review.
+
+### POC
+
+#### Reference
+- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-4w4r-h4x8-mg7h
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77521.md b/2026/CVE-2026-77521.md
new file mode 100644
index 0000000000..64ce23553d
--- /dev/null
+++ b/2026/CVE-2026-77521.md
@@ -0,0 +1,19 @@
+### [CVE-2026-77521](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77521)
+![](https://img.shields.io/static/v1?label=Product&message=MaxKB&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.10.5-lts%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-250%3A%20Execution%20with%20Unnecessary%20Privileges&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-749%3A%20Exposed%20Dangerous%20Method%20or%20Function&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.
+
+### POC
+
+#### Reference
+- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77522.md b/2026/CVE-2026-77522.md
new file mode 100644
index 0000000000..ad7b1ea888
--- /dev/null
+++ b/2026/CVE-2026-77522.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77522](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77522)
+![](https://img.shields.io/static/v1?label=Product&message=MaxKB&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202.10.3-lts%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.
+
+### POC
+
+#### Reference
+- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-ffxw-frpx-8rww
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77528.md b/2026/CVE-2026-77528.md
new file mode 100644
index 0000000000..fb04d1680c
--- /dev/null
+++ b/2026/CVE-2026-77528.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77528](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77528)
+![](https://img.shields.io/static/v1?label=Product&message=autobahn-python&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.7.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-409%3A%20Improper%20Handling%20of%20Highly%20Compressed%20Data%20(Data%20Amplification)&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1.
+
+### POC
+
+#### Reference
+- https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77601.md b/2026/CVE-2026-77601.md
new file mode 100644
index 0000000000..e7bc4db418
--- /dev/null
+++ b/2026/CVE-2026-77601.md
@@ -0,0 +1,17 @@
+### [CVE-2026-77601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77601)
+![](https://img.shields.io/static/v1?label=Product&message=cosmos&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.12.0%2C%20%3C%207.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.
+
+### POC
+
+#### Reference
+- https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77602.md b/2026/CVE-2026-77602.md
new file mode 100644
index 0000000000..652fa33ebe
--- /dev/null
+++ b/2026/CVE-2026-77602.md
@@ -0,0 +1,19 @@
+### [CVE-2026-77602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77602)
+![](https://img.shields.io/static/v1?label=Product&message=cosmos&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.1.0%2C%20%3C%207.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.
+
+### POC
+
+#### Reference
+- https://github.com/OpenC3/cosmos/commit/71943352a28128ef3e7e894319d97a656b5cd4f2
+- https://github.com/OpenC3/cosmos/commit/7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81
+- https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77605.md b/2026/CVE-2026-77605.md
new file mode 100644
index 0000000000..ec0c0d400a
--- /dev/null
+++ b/2026/CVE-2026-77605.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77605](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77605)
+![](https://img.shields.io/static/v1?label=Product&message=notepad-plus-plus&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%208.9.8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-706%3A%20Use%20of%20Incorrectly-Resolved%20Name%20or%20Reference&color=brightgreen)
+
+### Description
+
+Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd appended, and the user invokes Run by system on the text file on Windows 10 or Windows 11, Notepad++ can execute the sibling script as the current user instead of opening the selected file. This issue is fixed in version 8.9.8.
+
+### POC
+
+#### Reference
+- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-w5xq-frjg-w4cw
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77831.md b/2026/CVE-2026-77831.md
new file mode 100644
index 0000000000..978bb40a61
--- /dev/null
+++ b/2026/CVE-2026-77831.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77831](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77831)
+![](https://img.shields.io/static/v1?label=Product&message=ash_paper_trail&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.1.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=449cd2a93416853066378fa61c715e89f80dc854%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-407%20Inefficient%20Algorithmic%20Complexity&color=brightgreen)
+
+### Description
+
+Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use.With full-diff change tracking, AshPaperTrail.ChangeBuilders.FullDiff.ListChange pairs each prior array element against the new list by rebuilding the remaining-elements accumulator with acc ++ [tuple] on every step, copying the growing list each time, so the pairing scales cubically in the array length. Nothing bounds the length and the value comes straight from action input, so one request carrying a large accepted {:array, _} attribute forces tens of seconds of CPU and multi-gigabyte allocations.This issue affects ash_paper_trail: from 0.1.1 before 0.7.0.
+
+### POC
+
+#### Reference
+- https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-7c66-59m8-723c
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77846.md b/2026/CVE-2026-77846.md
new file mode 100644
index 0000000000..064239b40b
--- /dev/null
+++ b/2026/CVE-2026-77846.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77846](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77846)
+![](https://img.shields.io/static/v1?label=Product&message=ash_sqlite&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.1.2-rc.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=c12be48a5b6295593199b0e445b70a4aef81d1cd%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-943%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Data%20Query%20Logic&color=brightgreen)
+
+### Description
+
+Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.
+
+### POC
+
+#### Reference
+- https://github.com/ash-project/ash_sqlite/security/advisories/GHSA-hrp2-5hgw-c83c
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77950.md b/2026/CVE-2026-77950.md
new file mode 100644
index 0000000000..eb97a18529
--- /dev/null
+++ b/2026/CVE-2026-77950.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77950](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77950)
+![](https://img.shields.io/static/v1?label=Product&message=ash_typescript&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.8.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=cb01cc8749e5a2a17fb45aedbe75df30a9f1126e%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-209%20Generation%20of%20Error%20Message%20Containing%20Sensitive%20Information&color=brightgreen)
+
+### Description
+
+Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.This issue affects ash_typescript: from 0.8.0 before 0.18.0.
+
+### POC
+
+#### Reference
+- https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf-x963
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77956.md b/2026/CVE-2026-77956.md
new file mode 100644
index 0000000000..a3e4f87305
--- /dev/null
+++ b/2026/CVE-2026-77956.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77956](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77956)
+![](https://img.shields.io/static/v1?label=Product&message=ash_ai&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4aab131d40a0bd5a8cf0b3c4eaaa59d49565f3d1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.This issue affects ash_ai: from 0.1.0 before 1.0.0.
+
+### POC
+
+#### Reference
+- https://github.com/ash-project/ash_ai/security/advisories/GHSA-2g59-hg7m-qc83
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-77970.md b/2026/CVE-2026-77970.md
new file mode 100644
index 0000000000..365a84512e
--- /dev/null
+++ b/2026/CVE-2026-77970.md
@@ -0,0 +1,18 @@
+### [CVE-2026-77970](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77970)
+![](https://img.shields.io/static/v1?label=Product&message=ash_paper_trail&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=ffe5e03b14d26b73bff17f3eca811591788aba9c%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-312%20Cleartext%20Storage%20of%20Sensitive%20Information&color=brightgreen)
+
+### Description
+
+Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
+
+### POC
+
+#### Reference
+- https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-v645-6jm6-cgpj
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-79759.md b/2026/CVE-2026-79759.md
new file mode 100644
index 0000000000..19f5054a5b
--- /dev/null
+++ b/2026/CVE-2026-79759.md
@@ -0,0 +1,17 @@
+### [CVE-2026-79759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-79759)
+![](https://img.shields.io/static/v1?label=Product&message=Termix&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.7.0%2C%20%3C%202.5.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value. Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1.
+
+### POC
+
+#### Reference
+- https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-80517.md b/2026/CVE-2026-80517.md
new file mode 100644
index 0000000000..db26a68624
--- /dev/null
+++ b/2026/CVE-2026-80517.md
@@ -0,0 +1,17 @@
+### [CVE-2026-80517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80517)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Ultimate%20CSV%20Importer&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=7.17%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/2ac66402-2a79-42dd-9056-12c819112f07/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-80518.md b/2026/CVE-2026-80518.md
new file mode 100644
index 0000000000..f7d6ba592d
--- /dev/null
+++ b/2026/CVE-2026-80518.md
@@ -0,0 +1,17 @@
+### [CVE-2026-80518](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-80518)
+![](https://img.shields.io/static/v1?label=Product&message=WP%20Ultimate%20CSV%20Importer&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen)
+
+### Description
+
+The WP Ultimate CSV Importer  WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/80563420-5471-42a9-b022-b3d9792c07aa/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-84233.md b/2026/CVE-2026-84233.md
index 75009b23e8..844a3b7bf8 100644
--- a/2026/CVE-2026-84233.md
+++ b/2026/CVE-2026-84233.md
@@ -5,7 +5,7 @@
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Hardened%20Images&color=blue)
-![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
 
 ### Description
diff --git a/2026/CVE-2026-85015.md b/2026/CVE-2026-85015.md
new file mode 100644
index 0000000000..065437af24
--- /dev/null
+++ b/2026/CVE-2026-85015.md
@@ -0,0 +1,17 @@
+### [CVE-2026-85015](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85015)
+![](https://img.shields.io/static/v1?label=Product&message=Unlimited%20Elements%20for%20Elementor&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/aefcaecf-024d-4ec7-9b67-69d21addea7b/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-85568.md b/2026/CVE-2026-85568.md
new file mode 100644
index 0000000000..a1f67aed6c
--- /dev/null
+++ b/2026/CVE-2026-85568.md
@@ -0,0 +1,17 @@
+### [CVE-2026-85568](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-85568)
+![](https://img.shields.io/static/v1?label=Product&message=Unlimited%20Elements%20for%20Elementor&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.5.139%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/f4f2c1c5-ced9-44cb-b605-a7ce12ac867f/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-86832.md b/2026/CVE-2026-86832.md
new file mode 100644
index 0000000000..be22d2d6fe
--- /dev/null
+++ b/2026/CVE-2026-86832.md
@@ -0,0 +1,17 @@
+### [CVE-2026-86832](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86832)
+![](https://img.shields.io/static/v1?label=Product&message=MetForm&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen)
+
+### Description
+
+The MetForm  WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/d73e4c95-471b-4f22-97a0-b6a59f187bcd/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-86834.md b/2026/CVE-2026-86834.md
new file mode 100644
index 0000000000..34558c3b49
--- /dev/null
+++ b/2026/CVE-2026-86834.md
@@ -0,0 +1,17 @@
+### [CVE-2026-86834](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86834)
+![](https://img.shields.io/static/v1?label=Product&message=MetForm&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.2.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen)
+
+### Description
+
+The MetForm  WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/a56b7e26-9070-4c38-bdc1-7289b5829638/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-87514.md b/2026/CVE-2026-87514.md
new file mode 100644
index 0000000000..1a3b8e0608
--- /dev/null
+++ b/2026/CVE-2026-87514.md
@@ -0,0 +1,17 @@
+### [CVE-2026-87514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-87514)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.36%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/532916987
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-87564.md b/2026/CVE-2026-87564.md
new file mode 100644
index 0000000000..ad9c8c856a
--- /dev/null
+++ b/2026/CVE-2026-87564.md
@@ -0,0 +1,17 @@
+### [CVE-2026-87564](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-87564)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.36%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen)
+
+### Description
+
+Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/552342545
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-87612.md b/2026/CVE-2026-87612.md
new file mode 100644
index 0000000000..9fabf4ad9d
--- /dev/null
+++ b/2026/CVE-2026-87612.md
@@ -0,0 +1,17 @@
+### [CVE-2026-87612](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-87612)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.36%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Type%20confusion&color=brightgreen)
+
+### Description
+
+Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/554236352
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-87628.md b/2026/CVE-2026-87628.md
new file mode 100644
index 0000000000..12d1916cd7
--- /dev/null
+++ b/2026/CVE-2026-87628.md
@@ -0,0 +1,17 @@
+### [CVE-2026-87628](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-87628)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=153.0.8010.36%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/553770012
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-88782.md b/2026/CVE-2026-88782.md
new file mode 100644
index 0000000000..88a0095bbf
--- /dev/null
+++ b/2026/CVE-2026-88782.md
@@ -0,0 +1,17 @@
+### [CVE-2026-88782](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88782)
+![](https://img.shields.io/static/v1?label=Product&message=Kubio%20AI%20Page%20Builder&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-88783.md b/2026/CVE-2026-88783.md
new file mode 100644
index 0000000000..1bfd55e8c2
--- /dev/null
+++ b/2026/CVE-2026-88783.md
@@ -0,0 +1,17 @@
+### [CVE-2026-88783](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-88783)
+![](https://img.shields.io/static/v1?label=Product&message=Kubio%20AI%20Page%20Builder&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/94d11df1-dae7-479f-bc93-3db6b0925d99/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-88891.md b/2026/CVE-2026-88891.md
index 6ec7bf42a7..0b71a62fb7 100644
--- a/2026/CVE-2026-88891.md
+++ b/2026/CVE-2026-88891.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
+OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation in mutation resolvers.
 
 ### POC
 
diff --git a/2026/CVE-2026-89236.md b/2026/CVE-2026-89236.md
new file mode 100644
index 0000000000..95eb1f8a55
--- /dev/null
+++ b/2026/CVE-2026-89236.md
@@ -0,0 +1,17 @@
+### [CVE-2026-89236](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89236)
+![](https://img.shields.io/static/v1?label=Product&message=SaveTo%20Wishlist%20Lite&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The SaveTo Wishlist Lite  WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/7b92ed60-7bcb-4dcf-8c57-0afcaa6809b7/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-91078.md b/2026/CVE-2026-91078.md
new file mode 100644
index 0000000000..01044ea4dc
--- /dev/null
+++ b/2026/CVE-2026-91078.md
@@ -0,0 +1,17 @@
+### [CVE-2026-91078](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-91078)
+![](https://img.shields.io/static/v1?label=Product&message=TillKit&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen)
+
+### Description
+
+The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/7ab037d6-c670-4eaf-be0d-11cc9e20b18e/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-91775.md b/2026/CVE-2026-91775.md
index 08eee338ae..af9f114e8e 100644
--- a/2026/CVE-2026-91775.md
+++ b/2026/CVE-2026-91775.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
+LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.
 
 ### POC
 
diff --git a/2026/CVE-2026-92437.md b/2026/CVE-2026-92437.md
new file mode 100644
index 0000000000..e9533fd2db
--- /dev/null
+++ b/2026/CVE-2026-92437.md
@@ -0,0 +1,17 @@
+### [CVE-2026-92437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-92437)
+![](https://img.shields.io/static/v1?label=Product&message=Mailchimp%20for%20WooCommerce&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/47b3aa17-f7fd-42df-9ef0-e33b5da8f955/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-92923.md b/2026/CVE-2026-92923.md
new file mode 100644
index 0000000000..4cbc896c38
--- /dev/null
+++ b/2026/CVE-2026-92923.md
@@ -0,0 +1,17 @@
+### [CVE-2026-92923](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-92923)
+![](https://img.shields.io/static/v1?label=Product&message=Unlimited%20Elements%20for%20Elementor&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.5.142%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/1d02096b-81c4-421b-a7d3-b0ed7b1d173b/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-93982.md b/2026/CVE-2026-93982.md
index da66591354..0b8c8638a3 100644
--- a/2026/CVE-2026-93982.md
+++ b/2026/CVE-2026-93982.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.
+OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.
 
 ### POC
 
diff --git a/2026/CVE-2026-93983.md b/2026/CVE-2026-93983.md
index 4ad895f078..ea8b777ac1 100644
--- a/2026/CVE-2026-93983.md
+++ b/2026/CVE-2026-93983.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.
+OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.
 
 ### POC
 
diff --git a/2026/CVE-2026-93984.md b/2026/CVE-2026-93984.md
index f172192f90..e320f107f7 100644
--- a/2026/CVE-2026-93984.md
+++ b/2026/CVE-2026-93984.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
+OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
 
 ### POC
 
diff --git a/2026/CVE-2026-93985.md b/2026/CVE-2026-93985.md
index 3c01167931..e5769fe640 100644
--- a/2026/CVE-2026-93985.md
+++ b/2026/CVE-2026-93985.md
@@ -5,7 +5,7 @@
 
 ### Description
 
-OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
+OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
 
 ### POC
 
diff --git a/2026/CVE-2026-94238.md b/2026/CVE-2026-94238.md
new file mode 100644
index 0000000000..a0d1b12ff9
--- /dev/null
+++ b/2026/CVE-2026-94238.md
@@ -0,0 +1,17 @@
+### [CVE-2026-94238](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94238)
+![](https://img.shields.io/static/v1?label=Product&message=Loco%20Translate&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/76d339bf-094c-459d-9f6c-caeda5e97892/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-94239.md b/2026/CVE-2026-94239.md
new file mode 100644
index 0000000000..8f23a6d2ad
--- /dev/null
+++ b/2026/CVE-2026-94239.md
@@ -0,0 +1,17 @@
+### [CVE-2026-94239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94239)
+![](https://img.shields.io/static/v1?label=Product&message=Loco%20Translate&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/6ab3ec44-cf3b-43ac-8c84-51291e9759dc/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-96962.md b/2026/CVE-2026-96962.md
new file mode 100644
index 0000000000..ec706c26b0
--- /dev/null
+++ b/2026/CVE-2026-96962.md
@@ -0,0 +1,17 @@
+### [CVE-2026-96962](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96962)
+![](https://img.shields.io/static/v1?label=Product&message=Pie%20Register&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen)
+
+### Description
+
+The Pie Register  WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/bf634ddf-277e-46a4-9e5b-7253b3e02979/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-97062.md b/2026/CVE-2026-97062.md
index c9d37e3bcb..366bd79fc3 100644
--- a/2026/CVE-2026-97062.md
+++ b/2026/CVE-2026-97062.md
@@ -1,11 +1,12 @@
 ### [CVE-2026-97062](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97062)
 ![](https://img.shields.io/static/v1?label=Product&message=Aureus%20ERP&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
 ![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
 
 ### Description
 
-Aureus ERP through 1.6.0 stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.
+Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.
 
 ### POC
 
diff --git a/2026/CVE-2026-97876.md b/2026/CVE-2026-97876.md
new file mode 100644
index 0000000000..69be520dd9
--- /dev/null
+++ b/2026/CVE-2026-97876.md
@@ -0,0 +1,17 @@
+### [CVE-2026-97876](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97876)
+![](https://img.shields.io/static/v1?label=Product&message=grub2&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.12%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-822%20Untrusted%20pointer%20dereference&color=brightgreen)
+
+### Description
+
+A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
+
+### POC
+
+#### Reference
+- https://www.openwall.com/lists/oss-security/2026/09/13/5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/references.txt b/references.txt
index 2fc553e8ad..959c455d71 100644
--- a/references.txt
+++ b/references.txt
@@ -1249,6 +1249,7 @@ CVE-2004-0899 - https://docs.microsoft.com/en-us/security-updates/securitybullet
 CVE-2004-0900 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-042
 CVE-2004-0901 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-041
 CVE-2004-0902 - http://bugzilla.mozilla.org/show_bug.cgi?id=256316
+CVE-2004-0906 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2004-0908 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9745
 CVE-2004-0914 - http://www.linuxsecurity.com/content/view/106877/102/
 CVE-2004-0914 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9943
@@ -1402,6 +1403,7 @@ CVE-2004-1330 - http://marc.info/?l=bugtraq&m=110355931920123&w=2
 CVE-2004-1331 - http://securityreason.com/securityalert/3220
 CVE-2004-1335 - http://www.redhat.com/support/errata/RHSA-2005-017.html
 CVE-2004-1361 - http://marc.info/?l=bugtraq&m=110383690219440&w=2
+CVE-2004-1380 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2004-1392 - http://marc.info/?l=bugtraq&m=109898213806099&w=2
 CVE-2004-1392 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9279
 CVE-2004-1395 - http://aluigi.altervista.org/adv/lithsock-adv.txt
@@ -1500,6 +1502,7 @@ CVE-2004-1609 - http://marc.info/?l=bugtraq&m=109811852218478&w=2
 CVE-2004-1610 - http://marc.info/?l=bugtraq&m=109811852218478&w=2
 CVE-2004-1611 - http://marc.info/?l=bugtraq&m=109811852218478&w=2
 CVE-2004-1612 - http://marc.info/?l=bugtraq&m=109811852218478&w=2
+CVE-2004-1613 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2004-1618 - http://aluigi.altervista.org/adv/toneboom-adv.txt
 CVE-2004-1618 - http://marc.info/?l=bugtraq&m=109820344806472&w=2
 CVE-2004-1619 - http://marc.info/?l=bugtraq&m=109829017407842&w=2
@@ -1827,11 +1830,15 @@ CVE-2005-0124 - http://www.securityfocus.com/archive/1/428028/100/0/threaded
 CVE-2005-0135 - http://www.redhat.com/support/errata/RHSA-2005-366.html
 CVE-2005-0135 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9040
 CVE-2005-0136 - http://www.redhat.com/support/errata/RHSA-2005-663.html
+CVE-2005-0141 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2005-0142 - http://www.redhat.com/support/errata/RHSA-2005-384.html
 CVE-2005-0142 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9543
 CVE-2005-0143 - http://www.redhat.com/support/errata/RHSA-2005-384.html
+CVE-2005-0144 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2005-0146 - http://www.redhat.com/support/errata/RHSA-2005-384.html
+CVE-2005-0147 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2005-0147 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9578
+CVE-2005-0149 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2005-0160 - http://www.novell.com/linux/security/advisories/2005_16_sr.html
 CVE-2005-0161 - http://www.novell.com/linux/security/advisories/2005_16_sr.html
 CVE-2005-0176 - http://www.redhat.com/support/errata/RHSA-2005-092.html
@@ -1869,6 +1876,7 @@ CVE-2005-0230 - https://bugzilla.mozilla.org/show_bug.cgi?id=279945
 CVE-2005-0231 - http://marc.info/?l=bugtraq&m=110781134617144&w=2
 CVE-2005-0231 - http://www.redhat.com/support/errata/RHSA-2005-384.html
 CVE-2005-0232 - http://marc.info/?l=bugtraq&m=110781055630856&w=2
+CVE-2005-0232 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2005-0232 - http://www.redhat.com/support/errata/RHSA-2005-384.html
 CVE-2005-0233 - http://marc.info/?l=bugtraq&m=110782704923280&w=2
 CVE-2005-0233 - http://www.redhat.com/support/errata/RHSA-2005-384.html
@@ -1938,6 +1946,7 @@ CVE-2005-0384 - http://www.redhat.com/support/errata/RHSA-2005-366.html
 CVE-2005-0384 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9562
 CVE-2005-0398 - http://sourceforge.net/mailarchive/forum.php?thread_id=6787713&forum_id=32000
 CVE-2005-0398 - http://www.vupen.com/english/advisories/2005/0264
+CVE-2005-0399 - http://www.redhat.com/support/errata/RHSA-2005-323.html
 CVE-2005-0400 - http://www.redhat.com/support/errata/RHSA-2005-366.html
 CVE-2005-0400 - http://www.redhat.com/support/errata/RHSA-2005-663.html
 CVE-2005-0401 - http://marc.info/?l=bugtraq&m=111168413007891&w=2
@@ -4012,6 +4021,7 @@ CVE-2006-0972 - http://securityreason.com/securityalert/501
 CVE-2006-0973 - https://www.exploit-db.com/exploits/1525
 CVE-2006-0978 - http://securityreason.com/securityalert/504
 CVE-2006-0983 - http://securityreason.com/securityalert/510
+CVE-2006-0983 - http://sourceforge.net/forum/forum.php?forum_id=438526
 CVE-2006-0984 - http://securityreason.com/securityalert/511
 CVE-2006-0985 - http://NeoSecurityTeam.net/advisories/Advisory-17.txt
 CVE-2006-0986 - http://NeoSecurityTeam.net/advisories/Advisory-17.txt
@@ -11269,6 +11279,7 @@ CVE-2008-0016 - http://www.ubuntu.com/usn/usn-645-2
 CVE-2008-0016 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-0016 - https://bugzilla.mozilla.org/show_bug.cgi?id=443288
 CVE-2008-0017 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-0017 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-0017 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-0017 - https://bugzilla.mozilla.org/show_bug.cgi?id=443299
 CVE-2008-0020 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
@@ -15289,28 +15300,38 @@ CVE-2008-5013 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5013 - https://bugzilla.mozilla.org/show_bug.cgi?id=433610
 CVE-2008-5013 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9660
 CVE-2008-5014 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5014 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5014 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5014 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9157
+CVE-2008-5015 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5015 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5016 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5016 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5016 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5017 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5017 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5017 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5018 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5018 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5018 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5018 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9872
 CVE-2008-5019 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5019 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5019 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5021 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5021 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5021 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5021 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9642
 CVE-2008-5022 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5022 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5022 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5023 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5023 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5023 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5023 - https://bugzilla.mozilla.org/show_bug.cgi?id=424733
 CVE-2008-5023 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9908
 CVE-2008-5024 - http://www.redhat.com/support/errata/RHSA-2008-0977.html
+CVE-2008-5024 - http://www.redhat.com/support/errata/RHSA-2008-0978.html
 CVE-2008-5024 - http://www.vupen.com/english/advisories/2009/0977
 CVE-2008-5024 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9063
 CVE-2008-5029 - http://securityreason.com/securityalert/4573
@@ -33039,6 +33060,7 @@ CVE-2014-125126 - https://www.exploit-db.com/exploits/31264
 CVE-2014-125126 - https://www.vulncheck.com/advisories/simple-edocument-abitrary-file-upload-rce
 CVE-2014-125127 - https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125127
 CVE-2014-125128 - https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2014/CVE-2014-125128
+CVE-2014-125130 - https://www.exploit-db.com/exploits/35460
 CVE-2014-1359 - http://packetstormsecurity.com/files/167630/launchd-Heap-Corruption.html
 CVE-2014-1372 - https://code.google.com/p/google-security-research/issues/detail?id=18
 CVE-2014-1401 - http://packetstormsecurity.com/files/125079
@@ -46812,6 +46834,7 @@ CVE-2016-11012 - https://wpvulndb.com/vulnerabilities/8389
 CVE-2016-11013 - https://github.com/agentevolution/wp-listings/pull/52
 CVE-2016-11014 - https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html
 CVE-2016-11014 - https://github.com/cybersecurityworks/Disclosed/issues/14
+CVE-2016-11014 - https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html
 CVE-2016-11014 - https://lists.openwall.net/full-disclosure/2016/01/11/5
 CVE-2016-11014 - https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html
 CVE-2016-11015 - https://cybersecurityworks.com/zerodays/cve-2016-11015-netgear.html
@@ -46820,6 +46843,7 @@ CVE-2016-11015 - https://lists.openwall.net/full-disclosure/2016/01/11/4
 CVE-2016-11015 - https://packetstormsecurity.com/files/135215/Netgear-1.0.0.24-Cross-Site-Request-Forgery.html
 CVE-2016-11016 - https://cybersecurityworks.com/zerodays/cve-2016-11016-netgear.html
 CVE-2016-11016 - https://github.com/cybersecurityworks/Disclosed/issues/12
+CVE-2016-11016 - https://khalil-shreateh.com/khalil.shtml/it-highlights/592-Netgear-1.0.0.24-Cross-Site-Request-Forgery--.html
 CVE-2016-11016 - https://lists.openwall.net/full-disclosure/2016/01/11/1
 CVE-2016-11016 - https://packetstormsecurity.com/files/135194/Netgear-1.0.0.24-Cross-Site-Scripting.html
 CVE-2016-11017 - https://ctrlu.net/vuln/0002.html
@@ -80623,6 +80647,7 @@ CVE-2020-15025 - https://www.oracle.com/security-alerts/cpujan2021.html
 CVE-2020-15027 - https://slagle.tech/2020/07/06/cve-2020-15027/
 CVE-2020-15038 - http://packetstormsecurity.com/files/158649/WordPress-Maintenance-Mode-By-SeedProd-5.1.1-Cross-Site-Scripting.html
 CVE-2020-15038 - https://wpvulndb.com/vulnerabilities/10283
+CVE-2020-15038 - https://www.getastra.com/blog/911/plugin-exploit/stored-xss-coming-soon-page-maintenance-mode-plugin/
 CVE-2020-15046 - http://packetstormsecurity.com/files/158373/SuperMicro-IPMI-03.40-Cross-Site-Request-Forgery.html
 CVE-2020-15050 - http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html
 CVE-2020-15069 - https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal
@@ -114201,6 +114226,7 @@ CVE-2023-32750 - https://www.redteam-pentesting.de/en/advisories/-advisories-pub
 CVE-2023-32751 - https://www.redteam-pentesting.de/advisories/rt-sa-2023-004/
 CVE-2023-32751 - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
 CVE-2023-3276 - https://vuldb.com/?id.231626
+CVE-2023-32764 - https://www.compass-security.com/fileadmin/Research/Advisories/2023_01_CSNC-2023-002_LPE_Cloud_Client.txt
 CVE-2023-32766 - https://www.gitpod.io
 CVE-2023-32767 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-014.txt
 CVE-2023-32781 - http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html
@@ -119078,6 +119104,7 @@ CVE-2023-54363 - https://www.exploit-db.com/exploits/51638
 CVE-2023-54364 - https://www.exploit-db.com/exploits/51629
 CVE-2023-54398 - https://cn-sec.com/archives/2182384.html
 CVE-2023-54399 - https://cn-sec.com/archives/1861976.html
+CVE-2023-54400 - https://github.com/emadshanab/goby-poc/blob/main/fumengyun%20%20AjaxMethod.ashx%20SQL%20injection.json
 CVE-2023-54400 - https://www.vulncheck.com/advisories/fumeng-cloud-sql-injection-via-ajaxmethod-ashx-getempbyname
 CVE-2023-5441 - https://huntr.dev/bounties/b54cbdf5-3e85-458d-bb38-9ea2c0b669f2
 CVE-2023-5448 - https://research.cleantalk.org/cve-2023-5448-wp-register-profile-with-shortcode-csrf-to-password-reset-poc/
@@ -143345,8 +143372,10 @@ CVE-2025-70220 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-202
 CVE-2025-70221 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70221
 CVE-2025-70222 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70222
 CVE-2025-70223 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70223
+CVE-2025-70225 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70225
 CVE-2025-70226 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70226
 CVE-2025-70227 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70227
+CVE-2025-70229 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70229
 CVE-2025-70230 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70230
 CVE-2025-70231 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70231
 CVE-2025-70232 - https://github.com/akuma-QAQ/CVEreport/tree/main/D-link/CVE-2025-70232
@@ -143385,6 +143414,7 @@ CVE-2025-7049 - https://codecanyon.net/item/-wpgym-wordpress-gym-management-syst
 CVE-2025-7050 - https://wpcloudplugins.gitbook.io/docs/other/changelog
 CVE-2025-70559 - https://github.com/advisories/GHSA-f83h-ghpp-7wcc
 CVE-2025-70559 - https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-f83h-ghpp-7wcc
+CVE-2025-70616 - https://github.com/250wuyifan/wnBios64-CVE
 CVE-2025-70646 - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/5/1.md
 CVE-2025-70648 - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1803/6/1.md
 CVE-2025-70650 - https://github.com/0-fool/VulnbyCola/blob/main/Tenda/AX-1806/1/1.md
@@ -145639,6 +145669,10 @@ CVE-2026-101146 - https://drive.google.com/file/d/18fGYUBefbMreujzivIfFpPE8kWDLQ
 CVE-2026-101147 - https://wpscan.com/vulnerability/45ac761c-5736-4bd3-a3c1-892e703f5da6/
 CVE-2026-101148 - https://wpscan.com/vulnerability/5d6fce13-34e3-4ec6-9b47-a78dd7c94fed/
 CVE-2026-10115 - https://github.com/open5gs/open5gs/pull/4527
+CVE-2026-101159 - https://wpscan.com/vulnerability/1eefa81e-6134-498b-9615-b9a42cd99749/
+CVE-2026-101160 - https://wpscan.com/vulnerability/d728523f-1f33-470f-b64f-e9e286d29b6b/
+CVE-2026-101161 - https://wpscan.com/vulnerability/c1c3e2d7-4833-4e51-a3c7-45e6d036a525/
+CVE-2026-101162 - https://wpscan.com/vulnerability/b7a66222-4e30-4d70-9e2f-b91d421d285f/
 CVE-2026-10118 - https://bugzilla.redhat.com/show_bug.cgi?id=2460428
 CVE-2026-10119 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_6/6.md
 CVE-2026-10120 - https://github.com/wudipjq/my_vuln/blob/main/TRENDnet/vuln_7/7.md
@@ -145748,6 +145782,7 @@ CVE-2026-10259 - https://github.com/666324/H3C-Magic-B0-vuln/tree/main/H3C-Magic
 CVE-2026-10260 - https://github.com/6Justdododo6/CVE/issues/18
 CVE-2026-10261 - https://github.com/6Justdododo6/CVE/issues/19
 CVE-2026-10262 - https://github.com/6Justdododo6/CVE/issues/20
+CVE-2026-102626 - https://fluidattacks.com/advisories/golden
 CVE-2026-10264 - https://github.com/lharries/whatsapp-mcp/issues/241
 CVE-2026-10265 - https://github.com/Mr-Elymas/cve_submit/issues/2
 CVE-2026-10267 - https://github.com/biniamf/pocs/tree/main/janet-debug-janet-doframe-env-data-oobread
@@ -145779,18 +145814,74 @@ CVE-2026-10296 - https://github.com/ltranquility/vuln_submit/issues/7
 CVE-2026-10297 - https://github.com/ltranquility/vuln_submit/issues/8
 CVE-2026-10298 - https://github.com/ggml-org/whisper.cpp/issues/3807
 CVE-2026-10299 - https://github.com/Carm3nc1ta/vuln-test/blob/main/Online%20Hospital%20Management%20System%20has%20IDOR%20vulnerability%20in%20viewdoctortimings_php.md
+CVE-2026-103001 - https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
 CVE-2026-10302 - https://github.com/ltranquility/vuln_submit/issues/10
 CVE-2026-10303 - https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/
+CVE-2026-103040 - https://github.com/ModelTC/LightLLM/issues/1597
+CVE-2026-103042 - https://github.com/ModelTC/LightLLM/issues/1595
+CVE-2026-103043 - https://gist.github.com/mmadersbacher/46050b4224eb979431986cdef1dd2ad3
+CVE-2026-103053 - https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
+CVE-2026-103053 - https://github.com/beenuar/AiSOC/security/advisories/GHSA-g4h7-p63q-r8r4
+CVE-2026-103054 - https://github.com/beenuar/AiSOC/security/advisories/GHSA-mcg9-8pxf-j98v
+CVE-2026-103055 - https://github.com/beenuar/AiSOC/security/advisories/GHSA-4m55-xhcm-wjcr
+CVE-2026-103056 - https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2
+CVE-2026-103056 - https://github.com/beenuar/AiSOC/security/advisories/GHSA-7q37-2wfw-xrx7
+CVE-2026-103057 - https://github.com/beenuar/AiSOC/security/advisories/GHSA-mqjp-pcpr-7c37
+CVE-2026-103087 - https://github.com/gosub-io/gosub-engine/security/advisories/GHSA-c762-mxfh-vwvp
+CVE-2026-103111 - https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
+CVE-2026-103113 - https://github.com/OS4ED/openSIS-Classic/issues/473
+CVE-2026-103114 - https://github.com/OS4ED/openSIS-Classic/issues/474
+CVE-2026-103115 - https://github.com/OS4ED/openSIS-Classic/issues/475
+CVE-2026-103116 - https://github.com/OS4ED/openSIS-Classic/issues/476
+CVE-2026-103117 - https://github.com/OS4ED/openSIS-Classic/issues/477
+CVE-2026-103222 - https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc
+CVE-2026-103241 - https://gist.github.com/Yunzez/8e98d656aa667095b513161eb056d28e
 CVE-2026-103242 - https://access.redhat.com/security/cve/CVE-2026-103242
+CVE-2026-103243 - https://github.com/ModelTC/LightLLM/issues/1608
+CVE-2026-103244 - https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq
+CVE-2026-103263 - https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
+CVE-2026-103293 - https://wpscan.com/vulnerability/810447c9-4a8b-4d80-af7c-2f5fa8b13609/
+CVE-2026-103395 - https://github.com/ModelTC/LightLLM/issues/1610
+CVE-2026-103396 - https://github.com/mlogclub/bbs-go/issues/303
 CVE-2026-103470 - https://docs.grouper.internet2.edu/wiki/spaces/Grouper/pages/240549893/
+CVE-2026-103471 - https://github.com/Corvusoft/restbed/issues/558
+CVE-2026-103472 - https://github.com/Corvusoft/restbed/issues/558
+CVE-2026-103514 - https://wpscan.com/vulnerability/e05aa5a3-cd04-428a-b6bb-0538ca1f6b4a/
+CVE-2026-103532 - https://github.com/immich-app/immich/issues/29599
+CVE-2026-103533 - https://github.com/David-Crty/databasement/security/advisories/GHSA-x225-463f-pgww
+CVE-2026-103534 - https://github.com/David-Crty/databasement/security/advisories/GHSA-vx6q-v2gv-5fhv
+CVE-2026-103536 - https://github.com/ZongXR/SuperMarket/issues/32
+CVE-2026-103538 - https://github.com/ZongXR/SuperMarket/issues/31
+CVE-2026-103539 - https://github.com/ZongXR/SuperMarket/issues/30
+CVE-2026-103540 - https://github.com/formtools/core/issues/956
+CVE-2026-103540 - https://github.com/wawyw/cve_report/blob/main/formtools_1.md
+CVE-2026-103541 - https://github.com/formtools/core/issues/957
+CVE-2026-103541 - https://github.com/wawyw/cve_report/blob/main/formtools_2.md
+CVE-2026-103542 - https://github.com/formtools/core/issues/958
+CVE-2026-103542 - https://github.com/wawyw/cve_report/blob/main/formtools_3.md
+CVE-2026-103543 - https://github.com/ltranquility/submit_repository/issues/17
+CVE-2026-103544 - https://github.com/datadrivenconstruction/OpenConstructionERP/security/advisories/GHSA-wfpw-cv5v-64j5
 CVE-2026-103587 - https://hackmd.io/@leediay/four-reflected-xss-qloapps
 CVE-2026-103588 - https://hackmd.io/@leediay/four-reflected-xss-qloapps
 CVE-2026-103589 - https://hackmd.io/@leediay/four-reflected-xss-qloapps
 CVE-2026-103590 - https://hackmd.io/@leediay/four-reflected-xss-qloapps
+CVE-2026-103648 - https://gitlab.com/demsking/image-downloader/-/work_items/32
+CVE-2026-103686 - https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-mrpv-6x26-mf6c
+CVE-2026-103687 - https://github.com/rhukster/dom-sanitizer/security/advisories/GHSA-cjfg-j8jp-5xvc
+CVE-2026-103690 - https://github.com/ltranquility/submit_repository/issues/18
+CVE-2026-103757 - https://github.com/Budibase/budibase/security/advisories/GHSA-3c52-v5v2-3r56
+CVE-2026-103761 - https://github.com/kvcache-ai/Mooncake/issues/4445
+CVE-2026-103762 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-2mrf-mx66-vv6g
+CVE-2026-103763 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-ccxp-q3vg-jvgj
+CVE-2026-103764 - https://github.com/kvcache-ai/Mooncake/issues/4441
+CVE-2026-103765 - https://github.com/kvcache-ai/Mooncake/issues/4444
 CVE-2026-103766 - https://hackmd.io/@leediay/sqli-via-delete-ads-clipbucketv5
 CVE-2026-1046 - https://mattermost.com/security-updates
+CVE-2026-104733 - https://www.nsideattacklogic.de/advisories/NSIDE-SA-2026-004/
 CVE-2026-1050 - https://github.com/risesoft-y9/Digital-Infrastructure/issues/2
 CVE-2026-1050 - https://github.com/risesoft-y9/Digital-Infrastructure/issues/2#issue-3777863959
+CVE-2026-105043 - https://alexanderboll.dev/disclosures/simulink-vulnerability-concealed-blocks/
+CVE-2026-105090 - https://www.sec4check.pl/blog/posts/cve-formbricks-broken-access-control-stored-xss-custom-head-scripts.html
 CVE-2026-10512 - https://github.com/wolfSSL/wolfssl/pull/10536
 CVE-2026-10512 - https://www.wolfssl.com/docs/security-vulnerabilities/
 CVE-2026-10522 - https://wpscan.com/vulnerability/8d531f22-1e8b-4e35-adec-c9304f4f7a07/
@@ -148036,6 +148127,8 @@ CVE-2026-17529 - https://github.com/AstrBotDevs/AstrBot/issues/8780
 CVE-2026-1753 - https://wpscan.com/vulnerability/c42dbab9-b729-4748-88e5-0bd2f6d66e3d/
 CVE-2026-17530 - https://github.com/AstrBotDevs/AstrBot/issues/8781
 CVE-2026-17531 - https://github.com/unitedbyai/droidclaw/issues/18
+CVE-2026-17531 - https://vuldb.com/vuln/383396
+CVE-2026-17531 - https://vuldb.com/vuln/383396/cti
 CVE-2026-17533 - https://wpscan.com/vulnerability/13b57cdc-d954-4db6-94c2-53ad04ab0d34/
 CVE-2026-17540 - https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/
 CVE-2026-17541 - https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/
@@ -148530,6 +148623,7 @@ CVE-2026-19842 - https://wpscan.com/vulnerability/7b79d86e-d3f8-4d4f-929b-fd0054
 CVE-2026-19845 - https://github.com/panda666-888/vuls/blob/main/totolink/a800r/setStaticDhcpConfig.md
 CVE-2026-19848 - https://wpscan.com/vulnerability/362f4ed7-9637-4786-a72b-a48e9a12b9ff/
 CVE-2026-19855 - https://wpscan.com/vulnerability/c27f3657-261a-46cd-860c-0bdf5c849190/
+CVE-2026-19856 - https://wpscan.com/vulnerability/e35365d3-65de-45a7-9629-17aacd5299c7/
 CVE-2026-19857 - https://wpscan.com/vulnerability/5ff439f4-aa99-4198-b908-0cf098656cf7/
 CVE-2026-19858 - https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/
 CVE-2026-19859 - https://wpscan.com/vulnerability/19c115a5-4280-4b78-a460-140ecfc78d4f/
@@ -154979,6 +155073,7 @@ CVE-2026-50005 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/whit
 CVE-2026-50005 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-03
 CVE-2026-50006 - https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx
 CVE-2026-50007 - https://github.com/actualbudget/actual/security/advisories/GHSA-23vm-ffgg-qvjr
+CVE-2026-50013 - https://github.com/SpectoLabs/hoverfly/pull/1227
 CVE-2026-50013 - https://github.com/SpectoLabs/hoverfly/security/advisories/GHSA-qrh4-p6v4-mrfg
 CVE-2026-50014 - https://github.com/pnpm/pnpm/security/advisories/GHSA-p4xf-rf54-rj3x
 CVE-2026-50015 - https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4
@@ -155400,6 +155495,7 @@ CVE-2026-52946 - https://cert-portal.siemens.com/productcert/html/ssa-019113.htm
 CVE-2026-5295 - https://github.com/wolfSSL/wolfssl/pull/10116
 CVE-2026-52970 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html
 CVE-2026-52986 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html
+CVE-2026-52993 - https://bugzilla.redhat.com/show_bug.cgi?id=2492437
 CVE-2026-52998 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html
 CVE-2026-52999 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html
 CVE-2026-53001 - https://cert-portal.siemens.com/productcert/html/ssa-019113.html
@@ -157686,6 +157782,7 @@ CVE-2026-62241 - https://github.com/MohibShaikh/clawvet/security/advisories/GHSA
 CVE-2026-62242 - https://github.com/codecentric/spring-boot-admin/issues/5452
 CVE-2026-62246 - https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f
 CVE-2026-62283 - https://github.com/nezhahq/nezha/security/advisories/GHSA-q6xx-5vr8-p898
+CVE-2026-62286 - https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj
 CVE-2026-6229 - https://research.cleantalk.org/cve-2026-6229
 CVE-2026-62290 - https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258
 CVE-2026-62291 - https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x
@@ -157694,6 +157791,7 @@ CVE-2026-62293 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisori
 CVE-2026-62295 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2cq7-hg49-56gc
 CVE-2026-62296 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38
 CVE-2026-62299 - https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7
+CVE-2026-62308 - https://github.com/Quenary/tugtainer/security/advisories/GHSA-c2h5-ppv9-7vrq
 CVE-2026-62313 - https://github.com/lxc/incus/security/advisories/GHSA-53cg-qvg7-m8vg
 CVE-2026-62314 - https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg
 CVE-2026-62316 - https://github.com/microsoft/UFO/security/advisories/GHSA-vf4c-mf32-gf2h
@@ -157811,6 +157909,7 @@ CVE-2026-62857 - https://github.com/fedify-dev/fedify/security/advisories/GHSA-h
 CVE-2026-62867 - https://github.com/lxc/incus/security/advisories/GHSA-q7xw-r4w2-2wcm
 CVE-2026-6291 - https://github.com/wolfSSL/wolfssl/pull/10203
 CVE-2026-6291 - https://www.wolfssl.com/docs/security-vulnerabilities/
+CVE-2026-62911 - https://github.com/hypnguyen1209/CVE-2026-62911
 CVE-2026-62948 - https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f
 CVE-2026-62959 - https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4
 CVE-2026-62959 - https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g
@@ -157819,7 +157918,9 @@ CVE-2026-62960 - https://github.com/git-for-windows/git/security/advisories/GHSA
 CVE-2026-6297 - https://issues.chromium.org/issues/493628982
 CVE-2026-6298 - https://issues.chromium.org/issues/495700484
 CVE-2026-62982 - https://github.com/nicolargo/glances/security/advisories/GHSA-73wf-9vmv-5pv9
+CVE-2026-62985 - https://github.com/azu/request-filtering-agent/security/advisories/GHSA-r3r9-wp5j-pq5g
 CVE-2026-62986 - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-pf59-r2mc-x746
+CVE-2026-62987 - https://github.com/fabiolb/fabio/security/advisories/GHSA-fq95-v8xc-jm3v
 CVE-2026-62988 - https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh
 CVE-2026-62994 - https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv
 CVE-2026-62996 - https://github.com/smarty-php/smarty/security/advisories/GHSA-rjhh-76wf-8xmw
@@ -157847,6 +157948,7 @@ CVE-2026-63088 - https://github.com/stoatchat/stoatchat/security/advisories/GHSA
 CVE-2026-63093 - https://mindgard.ai/blog/cursor-0day-when-full-disclosure-becomes-the-only-protection-left
 CVE-2026-63095 - https://github.com/geo-chen/oss/blob/main/dendrite.md#finding-1-idor-in-post-account3piddelete-allows-any-authenticated-user-to-remove-any-other-users-third-party-identifier
 CVE-2026-63097 - https://github.com/geo-chen/oss/blob/main/dendrite.md#finding-3-context-returns-current-room-state-to-non-members-and-left-users-history-visibility-bypass
+CVE-2026-63098 - https://github.com/geo-chen/oss/blob/main/TheHive.md#finding-1-get-apistatus-exposes-attachment-protection-password-without-authentication
 CVE-2026-63101 - https://github.com/geo-chen/oss/blob/main/open-event-server.md
 CVE-2026-63107 - https://github.com/geo-chen/oss/blob/main/limesurvey.md
 CVE-2026-63108 - https://github.com/geo-chen/oss/blob/main/Roo-Code.md
@@ -157919,6 +158021,7 @@ CVE-2026-63428 - https://github.com/heyform/heyform/security/advisories/GHSA-r7v
 CVE-2026-63429 - https://github.com/heyform/heyform/security/advisories/GHSA-432x-54v2-p7p7
 CVE-2026-6343 - https://mattermost.com/security-updates
 CVE-2026-6345 - https://mattermost.com/security-updates
+CVE-2026-63459 - https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5
 CVE-2026-6346 - https://mattermost.com/security-updates
 CVE-2026-63464 - https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-7rx3-5wx3-5v76
 CVE-2026-6347 - https://mattermost.com/security-updates
@@ -157933,11 +158036,17 @@ CVE-2026-6361 - https://issues.chromium.org/issues/500036290
 CVE-2026-6362 - https://issues.chromium.org/issues/500066234
 CVE-2026-63628 - https://github.com/wevm/mppx/security/advisories/GHSA-vc9j-9wph-qghj
 CVE-2026-6363 - https://issues.chromium.org/issues/495751197
+CVE-2026-63630 - https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
 CVE-2026-63632 - https://github.com/onnx/onnx/security/advisories/GHSA-p893-rvq9-2xf9
+CVE-2026-63635 - https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-3c8w-9xvm-r6gf
+CVE-2026-63635 - https://github.com/user-attachments/files/29539076/poc.zip
+CVE-2026-63638 - https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-9hxv-jvgr-3x8g
 CVE-2026-6364 - https://issues.chromium.org/issues/502103414
 CVE-2026-63640 - https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8
 CVE-2026-63641 - https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3
 CVE-2026-63642 - https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g
+CVE-2026-63643 - https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j
+CVE-2026-63645 - https://github.com/openobserve/openobserve/security/advisories/GHSA-v496-g5c9-vqxw
 CVE-2026-63646 - https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm
 CVE-2026-63670 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jxwj-j7wr-gfrw
 CVE-2026-63671 - https://github.com/nuxt-content/mdc/security/advisories/GHSA-mxm6-v9r6-r94c
@@ -158371,17 +158480,23 @@ CVE-2026-6844 - https://bugzilla.redhat.com/show_bug.cgi?id=2460016
 CVE-2026-6845 - https://bugzilla.redhat.com/show_bug.cgi?id=2460012
 CVE-2026-68494 - https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9
 CVE-2026-68494 - https://github.com/advisories/GHSA-72hv-8253-57qq
+CVE-2026-68495 - https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
+CVE-2026-68496 - https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
+CVE-2026-68497 - https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7
 CVE-2026-68499 - https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836
 CVE-2026-6850 - https://mattermost.com/security-updates
 CVE-2026-68502 - https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154
 CVE-2026-68502 - https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4
 CVE-2026-68503 - https://github.com/grisuno/LazyOwn/releases/tag/release/0.2.154
 CVE-2026-68503 - https://github.com/grisuno/LazyOwn/security/advisories/GHSA-38jf-j9x7-jf6f
+CVE-2026-68514 - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-mw28-66qc-c883
+CVE-2026-68516 - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fw66-6xph-56jm
 CVE-2026-68517 - https://github.com/nicolargo/glances/security/advisories/GHSA-fp27-88fp-2phg
 CVE-2026-68519 - https://github.com/nicolargo/glances/commit/5c07c0d96423e9d5b9de71dd92e3717c66f504bd
 CVE-2026-68519 - https://github.com/nicolargo/glances/security/advisories/GHSA-59fj-m2j6-hcxh
 CVE-2026-68553 - https://github.com/coturn/coturn/security/advisories/GHSA-4g7c-p5wg-j4hp
 CVE-2026-68554 - https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc
+CVE-2026-68555 - https://github.com/coturn/coturn/security/advisories/GHSA-hpq3-g7x4-h7xx
 CVE-2026-68558 - https://github.com/wekan/wekan/releases/tag/v9.74
 CVE-2026-68559 - https://github.com/wekan/wekan/commit/7bbd1a3fad5d868fd01d79b5908913e215698e8e
 CVE-2026-68559 - https://github.com/wekan/wekan/releases/tag/v9.74
@@ -158399,6 +158514,7 @@ CVE-2026-6867 - https://gitlab.com/wireshark/wireshark/-/work_items/21191
 CVE-2026-6868 - https://gitlab.com/wireshark/wireshark/-/work_items/21185
 CVE-2026-6869 - https://gitlab.com/wireshark/wireshark/-/work_items/21190
 CVE-2026-6870 - https://gitlab.com/wireshark/wireshark/-/work_items/21189
+CVE-2026-68766 - https://github.com/hashcat/hashcat/issues/4738
 CVE-2026-68767 - https://github.com/hashcat/hashcat/issues/4739
 CVE-2026-68768 - https://github.com/hashcat/hashcat/issues/4740
 CVE-2026-68770 - https://github.com/huggingface/sentence-transformers/issues/3801
@@ -158406,6 +158522,7 @@ CVE-2026-6878 - https://github.com/zast-ai/vulnerability-reports/blob/main/byted
 CVE-2026-68900 - https://github.com/wekan/wekan/security/advisories/GHSA-8r5p-4q9j-f5jx
 CVE-2026-68901 - https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx
 CVE-2026-68922 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5
+CVE-2026-68928 - https://github.com/Acode-Foundation/Acode/security/advisories/GHSA-wm94-wp33-43gx
 CVE-2026-68929 - https://github.com/labring/FastGPT/security/advisories/GHSA-q4pr-3qpg-9q5v
 CVE-2026-6893 - https://bugzilla.redhat.com/show_bug.cgi?id=2459963
 CVE-2026-68930 - https://github.com/Eugeny/russh/security/advisories/GHSA-m65r-rprj-r5rg
@@ -159370,10 +159487,13 @@ CVE-2026-77013 - https://wpscan.com/vulnerability/83d578d5-bd47-421b-9b17-00c41f
 CVE-2026-77016 - https://wpscan.com/vulnerability/26f8c020-a5d0-4561-9802-c8c53b7755e4/
 CVE-2026-77017 - https://wpscan.com/vulnerability/8764a981-09a8-4949-a5d1-599987fb73f6/
 CVE-2026-77018 - https://wpscan.com/vulnerability/2d13eaeb-d2ac-4f21-9acf-32152f03bdb8/
+CVE-2026-77019 - https://github.com/Witiers/CVEs/issues/1
 CVE-2026-7702 - https://github.com/ngocnn97/security-advisories/blob/main/AFFiNE_BAC_PoC.mp4
 CVE-2026-77022 - https://github.com/AdminSafe/CVE/issues/5
 CVE-2026-7703 - https://gist.github.com/TrebledJ/585a20525e45549f299d282233632608
 CVE-2026-7704 - https://gist.github.com/TrebledJ/585a20525e45549f299d282233632608
+CVE-2026-77087 - https://github.com/paperclipai/paperclip/security/advisories/GHSA-x8hx-rhr2-9rf7
+CVE-2026-77088 - https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j
 CVE-2026-7709 - https://drive.google.com/drive/folders/1rosrcfxcHrQM7_GOiBwzY_GnCfXoFuVR?usp=drive_link
 CVE-2026-7709 - https://vuldb.com/submit/805823
 CVE-2026-7710 - https://github.com/9str0IL/CVE/issues/5
@@ -159391,29 +159511,66 @@ CVE-2026-7716 - https://github.com/QAp89/CVE/blob/main/SQL1.md
 CVE-2026-7720 - https://vuldb.com/submit/807198
 CVE-2026-7722 - https://gist.github.com/nedlir/f576abbb0e491dc9bb7e106c140dda04
 CVE-2026-7723 - https://gist.github.com/nedlir/f1ab8aa038aafbcc6beeef21fab1d74f
+CVE-2026-77239 - https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j
 CVE-2026-7724 - https://gist.github.com/nedlir/fa99777e8989414585d08c3625bf044a
+CVE-2026-77246 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-wv8v-v4c5-v75j
+CVE-2026-77247 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f6pj-qv47-g96w
+CVE-2026-77248 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-cc5h-2pwp-pvcc
 CVE-2026-7725 - https://gist.github.com/nedlir/c37d90dda5f715790eafc970b2ef0c8a
+CVE-2026-77250 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g5xv-mhgm-v5f6
+CVE-2026-77252 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-rqwg-9346-fjjv
+CVE-2026-77253 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc25-24vv-fxxm
+CVE-2026-77254 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-vc8m-84rp-53hx
+CVE-2026-77256 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-76pr-5669-3xf5
+CVE-2026-77258 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-93xw-j965-9mx3
+CVE-2026-77259 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-6cr4-ccf3-x7h4
+CVE-2026-77260 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-f4p7-qx46-wc5j
+CVE-2026-77265 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-49xv-9743-pw8w
+CVE-2026-77266 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-mfv2-4wvm-9pgp
+CVE-2026-77268 - https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-4596-2p6p-28cv
 CVE-2026-7728 - https://github.com/BruceJqs/public_exp/issues/35
 CVE-2026-7728 - https://github.com/ryanjoachim/mcp-rtfm/issues/5
 CVE-2026-7729 - https://github.com/BruceJqs/public_exp/issues/36
 CVE-2026-7729 - https://github.com/pixelsock/directus-mcp/issues/13
+CVE-2026-77293 - https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf
 CVE-2026-7730 - https://github.com/BruceJqs/public_exp/issues/37
 CVE-2026-7730 - https://github.com/privsim/mcp-test-runner/issues/24
+CVE-2026-77301 - https://github.com/cthackers/adm-zip/security/advisories/GHSA-7q85-xj36-vmfc
 CVE-2026-7731 - https://github.com/QAp89/CVE/blob/main/SQL3.md
+CVE-2026-77310 - https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6
 CVE-2026-7732 - https://github.com/QAp89/CVE/blob/main/Arbitrary%20file%20upload%20leading%20to%20RCE1.md
+CVE-2026-77320 - https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx
+CVE-2026-77321 - https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq
+CVE-2026-77322 - https://github.com/emiago/sipgo/security/advisories/GHSA-8h6x-h86x-75wh
+CVE-2026-77339 - https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v
 CVE-2026-77348 - https://github.com/ellite/Wallos/security/advisories/GHSA-hhjq-82f8-m6rc
+CVE-2026-77351 - https://github.com/ellite/Wallos/security/advisories/GHSA-mwqv-gv8x-9jcp
 CVE-2026-7738 - https://github.com/BruceJqs/public_exp/issues/38
 CVE-2026-7738 - https://github.com/puchunjie/doc-tools-mcp/issues/4
 CVE-2026-7738 - https://vuldb.com/vuln/360913/cti
+CVE-2026-77385 - https://github.com/zoriya/Kyoo/security/advisories/GHSA-fc8v-vr3q-hc46
 CVE-2026-7739 - https://github.com/justdan96/tsMuxer/issues/895
 CVE-2026-7739 - https://vuldb.com/submit/807647
 CVE-2026-77392 - https://gist.github.com/rionyxraiza/6b22a5e02da6b8581495761ff7393760
 CVE-2026-7740 - https://github.com/justdan96/tsMuxer/issues/899
 CVE-2026-7741 - https://github.com/yuji0903/silver-guide/issues/18
+CVE-2026-77415 - https://github.com/jsonata-js/jsonata/security/advisories/GHSA-66mm-25pp-rfff
 CVE-2026-7742 - https://github.com/yuji0903/silver-guide/issues/19
+CVE-2026-77421 - https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw
 CVE-2026-7743 - https://github.com/yuji0903/silver-guide/issues/20
 CVE-2026-7744 - https://github.com/yuji0903/silver-guide/issues/21
 CVE-2026-7745 - https://github.com/yuji0903/silver-guide/issues/22
+CVE-2026-77465 - https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf
+CVE-2026-77518 - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-x65c-w438-c58f
+CVE-2026-77520 - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-4w4r-h4x8-mg7h
+CVE-2026-77521 - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-f36j-f34j-h3rx
+CVE-2026-77522 - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-ffxw-frpx-8rww
+CVE-2026-77528 - https://github.com/crossbario/autobahn-python/security/advisories/GHSA-hxp9-w8x3-p566
+CVE-2026-77601 - https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f
+CVE-2026-77602 - https://github.com/OpenC3/cosmos/commit/71943352a28128ef3e7e894319d97a656b5cd4f2
+CVE-2026-77602 - https://github.com/OpenC3/cosmos/commit/7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81
+CVE-2026-77602 - https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977
+CVE-2026-77605 - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-w5xq-frjg-w4cw
 CVE-2026-77643 - https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html
 CVE-2026-77689 - https://wpscan.com/vulnerability/ac597716-193d-419f-b55c-802ee979385e/
 CVE-2026-77693 - https://wpscan.com/vulnerability/630de65a-d3ca-4690-a21a-985616ebfad1/
@@ -159451,7 +159608,9 @@ CVE-2026-77794 - https://wpscan.com/vulnerability/c8cdc20f-d6ca-4e02-b8ab-68cd93
 CVE-2026-7782 - https://bytium.com/insights/perfex-crm-3-4-1-cross-tenant-broken-access-control-on-project-discussion-comments
 CVE-2026-77826 - https://wpscan.com/vulnerability/b79a83e8-d7b0-4aa8-b2ba-37a7eecd437b/
 CVE-2026-7783 - https://bytium.com/insights/blind-sql-injection-in-perfex-crm-3-4-1
+CVE-2026-77831 - https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-7c66-59m8-723c
 CVE-2026-7784 - https://github.com/RTGS2017/NagaAgent/issues/311
+CVE-2026-77846 - https://github.com/ash-project/ash_sqlite/security/advisories/GHSA-hrp2-5hgw-c83c
 CVE-2026-7785 - https://github.com/A-G-U-P-T-A/wireshark-mcp/issues/1
 CVE-2026-77853 - https://5g.liteon.com/security/flexfi/
 CVE-2026-77875 - https://fluidattacks.com/advisories/grin
@@ -159460,6 +159619,9 @@ CVE-2026-77884 - https://fluidattacks.com/advisories/suicide
 CVE-2026-7790 - https://cna.erlef.org/cves/CVE-2026-7790.html
 CVE-2026-77945 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md
 CVE-2026-77946 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_NTP_Timezone_Config_Stack_Overflow.md
+CVE-2026-77950 - https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf-x963
+CVE-2026-77956 - https://github.com/ash-project/ash_ai/security/advisories/GHSA-2g59-hg7m-qc83
+CVE-2026-77970 - https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-v645-6jm6-cgpj
 CVE-2026-78011 - https://psirt.watchguard.com/CVE-2026-78011
 CVE-2026-78030 - https://metacpan.org/release/HMBRAND/DBI-1.653/changes
 CVE-2026-78038 - https://github.com/ash-project/ash_oban/security/advisories/GHSA-gj9p-x393-rf9h
@@ -159914,6 +160076,7 @@ CVE-2026-7974 - https://issues.chromium.org/issues/497649372
 CVE-2026-79740 - https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities
 CVE-2026-79741 - https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities
 CVE-2026-7975 - https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html
+CVE-2026-79759 - https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8
 CVE-2026-7976 - https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html
 CVE-2026-7976 - https://issues.chromium.org/issues/497736679
 CVE-2026-7977 - https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html
@@ -160118,6 +160281,8 @@ CVE-2026-80494 - https://wpscan.com/vulnerability/fdc0fefb-c090-4972-9867-d10903
 CVE-2026-80513 - https://wpscan.com/vulnerability/09c9b9e7-c178-4f05-80d8-d4d77b7c5050/
 CVE-2026-80514 - https://wpscan.com/vulnerability/1c08e9ba-b68a-4e77-970f-3dc7c7cd74f9/
 CVE-2026-80515 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/752
+CVE-2026-80517 - https://wpscan.com/vulnerability/2ac66402-2a79-42dd-9056-12c819112f07/
+CVE-2026-80518 - https://wpscan.com/vulnerability/80563420-5471-42a9-b022-b3d9792c07aa/
 CVE-2026-80530 - http://www.openwall.com/lists/oss-security/2026/09/03/1
 CVE-2026-8071 - https://wpscan.com/vulnerability/0d4635b5-2d79-4337-a1ad-6b8d02cfd64b/
 CVE-2026-8074 - https://mattermost.com/security-updates
@@ -161096,6 +161261,7 @@ CVE-2026-85009 - https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-916029
 CVE-2026-85010 - https://wpscan.com/vulnerability/3ebcb11a-9f8c-48e3-8b1f-f91bb2518c34/
 CVE-2026-85013 - https://bugzilla.redhat.com/show_bug.cgi?id=2465635
 CVE-2026-85013 - https://github.com/envmodules/modules/security/advisories/GHSA-8hrw-p88g-qhmg
+CVE-2026-85015 - https://wpscan.com/vulnerability/aefcaecf-024d-4ec7-9b67-69d21addea7b/
 CVE-2026-85016 - https://wpscan.com/vulnerability/1d488c84-2797-4c02-8c13-54b80e4128dc/
 CVE-2026-85017 - https://wpscan.com/vulnerability/459a7479-ebd8-4e46-a709-cb86d0386f9b/
 CVE-2026-85021 - https://gist.github.com/TrebledJ/0e8466e5c39a6fb7dca8a3acdfbe2ddc#file-cvd_dify_vuln1_20260705-md
@@ -161232,6 +161398,7 @@ CVE-2026-85530 - https://wpscan.com/vulnerability/83fcea02-345a-443c-b14e-316533
 CVE-2026-8554 - https://issues.chromium.org/issues/499131214
 CVE-2026-8555 - https://issues.chromium.org/issues/500033878
 CVE-2026-8556 - https://issues.chromium.org/issues/500052361
+CVE-2026-85568 - https://wpscan.com/vulnerability/f4f2c1c5-ced9-44cb-b605-a7ce12ac867f/
 CVE-2026-85569 - https://wpscan.com/vulnerability/ddbae988-37a2-4fb7-a813-bbc708f1f1c9/
 CVE-2026-8557 - https://issues.chromium.org/issues/502978647
 CVE-2026-85572 - https://wpscan.com/vulnerability/a02f2c69-69cf-46fa-b4cf-0cf990d71e57/
@@ -161577,6 +161744,8 @@ CVE-2026-86815 - https://wpscan.com/vulnerability/fa66c458-f14f-47bc-87e6-b60320
 CVE-2026-86823 - https://wpscan.com/vulnerability/2db98679-24ca-494e-a8fd-f6417a0f1ea8/
 CVE-2026-86824 - https://wpscan.com/vulnerability/62ee25d9-ec38-402c-9959-37fd89708aca/
 CVE-2026-8683 - https://mattermost.com/security-updates
+CVE-2026-86832 - https://wpscan.com/vulnerability/d73e4c95-471b-4f22-97a0-b6a59f187bcd/
+CVE-2026-86834 - https://wpscan.com/vulnerability/a56b7e26-9070-4c38-bdc1-7289b5829638/
 CVE-2026-86837 - https://wpscan.com/vulnerability/5bfed7cf-5bf3-4a3b-a2b6-9f9d48f52fd5/
 CVE-2026-86838 - https://wpscan.com/vulnerability/1c8a53e7-5556-4dcb-a461-c6df253d0b7a/
 CVE-2026-86839 - https://wpscan.com/vulnerability/3ab8b879-3ef7-4aa4-8620-1bde99697dcb/
@@ -161787,6 +161956,7 @@ CVE-2026-87504 - https://issues.chromium.org/issues/499206649
 CVE-2026-87510 - https://issues.chromium.org/issues/532957878
 CVE-2026-87512 - https://issues.chromium.org/issues/541715128
 CVE-2026-87513 - https://issues.chromium.org/issues/511773417
+CVE-2026-87514 - https://issues.chromium.org/issues/532916987
 CVE-2026-87516 - https://issues.chromium.org/issues/513608513
 CVE-2026-87517 - https://issues.chromium.org/issues/517581661
 CVE-2026-87529 - https://issues.chromium.org/issues/536423794
@@ -161806,6 +161976,7 @@ CVE-2026-87555 - https://issues.chromium.org/issues/517337579
 CVE-2026-87557 - https://issues.chromium.org/issues/497635917
 CVE-2026-87559 - https://issues.chromium.org/issues/514011926
 CVE-2026-8756 - https://gist.github.com/YLChen-007/550cb92f3489c317ff049fc7d7ea6b99
+CVE-2026-87564 - https://issues.chromium.org/issues/552342545
 CVE-2026-87569 - https://issues.chromium.org/issues/523277481
 CVE-2026-87570 - https://issues.chromium.org/issues/517215407
 CVE-2026-87574 - https://issues.chromium.org/issues/517092658
@@ -161826,9 +161997,11 @@ CVE-2026-87603 - https://issues.chromium.org/issues/501627201
 CVE-2026-87604 - https://issues.chromium.org/issues/536648007
 CVE-2026-87606 - https://issues.chromium.org/issues/495933780
 CVE-2026-87611 - https://issues.chromium.org/issues/495876543
+CVE-2026-87612 - https://issues.chromium.org/issues/554236352
 CVE-2026-87616 - https://issues.chromium.org/issues/520469117
 CVE-2026-87621 - https://issues.chromium.org/issues/536664909
 CVE-2026-87622 - https://issues.chromium.org/issues/517602176
+CVE-2026-87628 - https://issues.chromium.org/issues/553770012
 CVE-2026-87632 - https://issues.chromium.org/issues/538197156
 CVE-2026-87637 - https://issues.chromium.org/issues/534863145
 CVE-2026-87640 - https://issues.chromium.org/issues/498482618
@@ -161938,6 +162111,8 @@ CVE-2026-88621 - https://github.com/returnwrong/returnwrong-security-advisories/
 CVE-2026-88742 - https://hekk.one/posts/research/cve-2026-88742/
 CVE-2026-88743 - https://hekk.one/posts/research/cve-2026-88743/
 CVE-2026-88764 - https://wpscan.com/vulnerability/54fdf46e-0385-40a3-b3bc-a862dc0fb03e/
+CVE-2026-88782 - https://wpscan.com/vulnerability/b45063f1-65a0-44cb-9565-0242f30fd7a3/
+CVE-2026-88783 - https://wpscan.com/vulnerability/94d11df1-dae7-479f-bc93-3db6b0925d99/
 CVE-2026-88788 - https://wpscan.com/vulnerability/6175fc16-960b-4dbe-bda2-21b4ce7de54b/
 CVE-2026-88791 - https://wpscan.com/vulnerability/a8aa5685-e36e-4e1f-a259-fab3910ee550/
 CVE-2026-88792 - https://wpscan.com/vulnerability/49671af2-af51-44e6-8c0a-3039c50d04e5/
@@ -162022,6 +162197,7 @@ CVE-2026-89162 - https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-
 CVE-2026-89190 - https://wpscan.com/vulnerability/570e6bfb-cfe9-4a6f-8759-c6e99e19e272/
 CVE-2026-89193 - https://wpscan.com/vulnerability/3c90d1c5-fd45-4a82-9357-504d7a0e5adc/
 CVE-2026-89212 - https://portal.perforce.com/s/cve/a91Qi000003CxPBIA0/xml-external-entity-in-akana-api-platform
+CVE-2026-89236 - https://wpscan.com/vulnerability/7b92ed60-7bcb-4dcf-8c57-0afcaa6809b7/
 CVE-2026-89237 - https://wpscan.com/vulnerability/92355b31-995b-4151-a414-51d3430d0fd6/
 CVE-2026-89239 - https://github.com/WWBN/AVideo/security/advisories/GHSA-3pp9-g99w-qw3j
 CVE-2026-89240 - https://github.com/WWBN/AVideo/security/advisories/GHSA-87qx-9wgx-954f
@@ -162291,6 +162467,7 @@ CVE-2026-91051 - https://wpscan.com/vulnerability/e24a9497-8fb4-4067-8421-194725
 CVE-2026-91072 - https://wpscan.com/vulnerability/c77770c5-d1af-47f6-9aee-a50d4a919732/
 CVE-2026-91073 - https://wpscan.com/vulnerability/50d0d5b6-2204-4af3-92d5-75085ce2f176/
 CVE-2026-91077 - https://wpscan.com/vulnerability/9db8d1c4-2bf8-4259-b95f-b131fc385a2e/
+CVE-2026-91078 - https://wpscan.com/vulnerability/7ab037d6-c670-4eaf-be0d-11cc9e20b18e/
 CVE-2026-9110 - https://issues.chromium.org/issues/503551154
 CVE-2026-9111 - https://issues.chromium.org/issues/504551032
 CVE-2026-9112 - https://issues.chromium.org/issues/489791425
@@ -162375,6 +162552,7 @@ CVE-2026-92425 - https://wpscan.com/vulnerability/b6d64e8f-e52a-4286-bd78-15f7a3
 CVE-2026-92430 - https://wpscan.com/vulnerability/1f1d7de5-cb7c-4440-b998-c6f15ecc6b4c/
 CVE-2026-92435 - https://wpscan.com/vulnerability/4b3f9c83-8986-40d9-ab1a-848550ea7882/
 CVE-2026-92436 - https://wpscan.com/vulnerability/f4d7b94a-7699-464c-a646-5946837b363a/
+CVE-2026-92437 - https://wpscan.com/vulnerability/47b3aa17-f7fd-42df-9ef0-e33b5da8f955/
 CVE-2026-92438 - https://wpscan.com/vulnerability/eeed1378-2c51-4d38-9dda-4a13ce330b25/
 CVE-2026-9245 - https://devolutions.net/security/advisories/DEVO-2026-0013/
 CVE-2026-92455 - https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crm-customer-messaging-endpoints
@@ -162412,6 +162590,7 @@ CVE-2026-92918 - https://www.vulncheck.com/advisories/admin3-through-3.0.0-sessi
 CVE-2026-92919 - https://www.vulncheck.com/advisories/admin3-through-3.0.0-arbitrary-file-write-via-path-traversal-in-storage-upload-filename
 CVE-2026-92920 - https://www.vulncheck.com/advisories/admin3-through-3.0.0-session-not-invalidated-when-a-user-account-is-disabled
 CVE-2026-92921 - https://www.vulncheck.com/advisories/admin3-through-3.0.0-weak-password-hashing-via-single-round-md5
+CVE-2026-92923 - https://wpscan.com/vulnerability/1d02096b-81c4-421b-a7d3-b0ed7b1d173b/
 CVE-2026-92924 - https://wpscan.com/vulnerability/28be6bd7-311d-4338-8256-7378e268c0f8/
 CVE-2026-92928 - https://www.securifera.com/advisories/
 CVE-2026-92929 - https://www.securifera.com/advisories/
@@ -162567,6 +162746,8 @@ CVE-2026-94184 - https://www.openwall.com/lists/oss-security/2026/06/27/8
 CVE-2026-9419 - https://github.com/zzzxc643/CVE1/blob/main/EMPLOYEE_MANAGEMENT_SYSTEM/vul17.md
 CVE-2026-94194 - https://cna.erlef.org/cves/CVE-2026-94194.html
 CVE-2026-94194 - https://osv.dev/vulnerability/EEF-CVE-2026-94194
+CVE-2026-94238 - https://wpscan.com/vulnerability/76d339bf-094c-459d-9f6c-caeda5e97892/
+CVE-2026-94239 - https://wpscan.com/vulnerability/6ab3ec44-cf3b-43ac-8c84-51291e9759dc/
 CVE-2026-9426 - https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_10/10.md
 CVE-2026-94274 - https://wpscan.com/vulnerability/23965307-678d-4f59-beae-5a8b33af9a75/
 CVE-2026-9429 - https://github.com/Litengzheng/vuldb_new2/blob/main/F1202/vul_31/README.md
@@ -162763,6 +162944,7 @@ CVE-2026-96896 - https://wpscan.com/vulnerability/7ab467f9-4340-464c-a436-978a5a
 CVE-2026-96897 - https://wpscan.com/vulnerability/f9fd04f4-282d-486f-8561-dbf02250282a/
 CVE-2026-96899 - https://wpscan.com/vulnerability/649584c7-0549-4080-92f0-bf4b9e8ee789/
 CVE-2026-9693 - https://mattermost.com/security-updates
+CVE-2026-96962 - https://wpscan.com/vulnerability/bf634ddf-277e-46a4-9e5b-7253b3e02979/
 CVE-2026-9698 - https://metacpan.org/release/HMBRAND/DBI-1.648/changes
 CVE-2026-9699 - https://mattermost.com/security-updates
 CVE-2026-9702 - https://wpscan.com/vulnerability/79b27813-3d75-46a3-98d3-e6d8eb8ad467/
@@ -162788,6 +162970,7 @@ CVE-2026-97368 - https://aibot88.github.io/CVERequest/SpringBlade/issue2.html
 CVE-2026-97404 - https://launchpad.net/bugs/2164987
 CVE-2026-9759 - https://gitlab.com/wireshark/wireshark/-/work_items/21243
 CVE-2026-97685 - https://fluidattacks.com/es/advisories/zoo
+CVE-2026-97876 - https://www.openwall.com/lists/oss-security/2026/09/13/5
 CVE-2026-9810 - https://wpscan.com/vulnerability/6378a370-fe2f-48e7-984f-6e6c575dba60/
 CVE-2026-9815 - https://wpscan.com/vulnerability/043f449f-fc65-4218-83d2-7742e62f2af3/
 CVE-2026-9816 - https://mattermost.com/security-updates