Vulnerability Notes
- CVE-2026-92885 - Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
- CVE-2026-65220 - Supermicro BMC IPMI feature contains a Privilege escalation vulnerability
- CVE-2026-18450 - Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
- CVE-2026-75891 - Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
- CVE-2026-116843 - Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode
- CVE-2026-116816 - llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
- CVE-2024-58400 - llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
- CVE-2026-116826 - YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
- CVE-2026-116825 - YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
- CVE-2026-116818 - OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
- CVE-2026-116811 - OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
- CVE-2026-116808 - OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
- CVE-2026-116747 - Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
- CVE-2026-116738 - VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
- CVE-2026-116724 - FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow
- CVE-2026-116589 - Datadog dd-trace-py: IAST instrumentation can lead to application DOS