cardosource Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
webapps multiple CVE-2026-1830

Jose Rivas ImageMagick - Infinite Loop in the MIFF decoder can lead to CPU exhaustion
local multiple CVE-2026-46522

Mina Nageh Salalma ZTE Routers - Unauthenticated Denial of Service
local multiple CVE-2026-34473

Mina Nageh Salalma ZTE ZXHN H188A V6 - Authentication Bypass
local multiple CVE-2026-34472

Mina Nageh Salalma ZTE H298A / H108N - Unauthenticated Credential Exposure
local multiple CVE-2026-34474

Ünsal Furkan Harani Wing FTP Server 8.1.3 - Authenticated Remote Code Execution
remote multiple CVE-2026-44403

Th3-SAx11 CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
webapps multiple CVE-2026-44376

Lukas Johannes Moeller strongSwan 5.9.13 - libsimaka EAP-SIM/AKA heap buffer overflow
remote multiple CVE-2026-35330

Lukas Johannes Moeller strongSwan 5.9.13 - DoS
dos multiple CVE-2026-35333

Max Gabriel EspoCRM 9.3.3 - SSRF
webapps multiple CVE-2026-33534

Gabriel Rodrigues OpenCATS 0.9.7.4 - SQL Injection
webapps multiple

alisunbul Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
webapps multiple CVE-2026-23918

Amir Hossein Jamshidi D-Link DSL2600U - 'rom-0' Admin Password Disclosure
hardware multiple

Amir Hossein Jamshidi Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover
webapps multiple CVE-2026-7567

Abdelazim Mohammed Cockpit 359 - RCE
webapps multiple CVE-2026-4631

Gabriel Rodrigues BookStack 25.12.1 - Denial of Service
webapps multiple