Browse CVEs

MEDIUM 5.3 CVE-2026-71433 LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the … No fix yet Fix from $1,6002026-08-06 MEDIUM 6.8 CVE-2026-5336 The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes th… No fix yet Fix from $1,6002026-08-06 MEDIUM 5.3 CVE-2026-48078 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticat… No fix yet Fix from $1,6002026-08-06 HIGH 8.0 CVE-2026-48080 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/ten… No fix yet Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-45378 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-documen… No fix yet Fix from $1,9502026-08-06 CRITICAL 9.8 CVE-2026-54489 Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. … Virtual Storage Integrator 10.11.1.0+ Fix from $2,3002026-08-06 MEDIUM 6.5 CVE-2026-16954 The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, … No fix yet Fix from $1,6002026-08-06 HIGH 7.5 CVE-2026-18050 The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads,… No fix yet Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-13153 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public… No fix yet Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-13154 The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before queryin… No fix yet Fix from $1,9502026-08-06 MEDIUM 5.3 CVE-2026-14240 The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory wi… No fix yet Fix from $1,6002026-08-06 MEDIUM 5.3 CVE-2026-14314 The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced … No fix yet Fix from $1,6002026-08-06 MEDIUM 5.3 CVE-2026-18974 A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the compon… No fix yet Fix from $1,6002026-08-06 MEDIUM 6.5 CVE-2026-10128 IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment varia… Langflow 1.11.0+ Fix from $1,6002026-08-05 HIGH 7.5 CVE-2026-60023 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted… Answer 2.0.2+ Fix from $1,9502026-08-05 MEDIUM 6.2 CVE-2026-71293 Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns th… No fix yet Fix from $1,6002026-08-05 HIGH 7.5 CVE-2026-61891 In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/… Theia 1.74.0+ Fix from $1,9502026-08-05 HIGH 7.5 CVE-2026-16603 The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticate… No fix yet Fix from $1,9502026-08-05 HIGH 7.5 CVE-2026-16604 The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allow… No fix yet Fix from $1,9502026-08-05 MEDIUM 6.5 CVE-2026-16968 The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated … No fix yet Fix from $1,6002026-08-05 HIGH 7.5 CVE-2026-16602 The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint,… No fix yet Fix from $1,9502026-08-05 MEDIUM 6.5 CVE-2026-70491 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tool… No fix yet Fix from $1,6002026-08-04 CRITICAL 9.2 CVE-2026-70478 Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:… No fix yet Fix from $2,3002026-08-04 HIGH 8.3 CVE-2026-70473 Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-histor… No fix yet Fix from $1,9502026-08-04 MEDIUM 6.5 CVE-2026-18809 Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3. No fix yet Fix from $1,6002026-08-04 HIGH 7.5 CVE-2026-67972 An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading … No fix yet Fix from $1,9502026-08-03 MEDIUM 5.3 CVE-2026-69153 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19,… Postcss 8.5.23+ Fix from $1,6002026-08-03 HIGH 7.5 CVE-2026-67357 ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.cluste… No fix yet Fix from $1,9502026-08-02 HIGH 7.5 CVE-2026-15236 The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the con… No fix yet Fix from $1,9502026-08-02 HIGH 8.8 CVE-2026-67343 ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retriev… No fix yet Fix from $1,9502026-08-01