New
CVE-2026-26988: LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parame...
CVE-2026-26987: LibreNMS affected by reflected XSS via email field: LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0.
CVE-2026-26960: node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction: node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting ...
CVE-2026-26980: Ghost has a SQL Injection in its Content API: Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.
CVE-2026-26977: Frappe Learning Management System exposes details of unpublished courses to unauthorized users: Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.
Updated
CVE-2026-2350: Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.: Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.
CVE-2026-2605: Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.: Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
CVE-2026-26119: Windows Admin Center Elevation of Privilege Vulnerability: Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
CVE-2026-20841: Windows Notepad App Remote Code Execution Vulnerability: Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code locally.
CVE-2026-20846: GDI+ Denial of Service Vulnerability: Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
CISA Known Exploited Vulnerabilities
CVE-2021-22175 GitLab GitLab: GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.
CVE-2026-22769 Dell RecoverPoint for Virtual Machines (RP4VMs): Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.
CVE-2008-0015 Microsoft Windows: Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
CVE-2024-7694 TeamT5 ThreatSonar Anti-Ransomware: TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system commands on the server.
CVE-2026-2441 Google Chromium: Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.