Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-61991 RCE | WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability | 10.0 CRITICAL | Ajax Load More AjaxLoadMore Cache | NVD, CVE.org | |
| CVE-2026-54860 RCE | WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Ozisti | NVD, CVE.org | |
| CVE-2026-54859 RCE | WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Preservation | NVD, CVE.org | |
| CVE-2026-54858 RCE | WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Printy | NVD, CVE.org | |
| CVE-2026-54856 RCE | WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX RexCoin | NVD, CVE.org | |
| CVE-2026-54857 RCE | WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability | 9.8 CRITICAL | ThemeREX Quirky | NVD, CVE.org | |
| CVE-2026-85899 RCE Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.1 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96203 RCE Truy cập trái phép | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96192 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based), microsoft edge | NVD, CVE.org | |
| CVE-2026-18894 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-101288 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104317 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104324 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104328 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-104339 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107326 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107327 RCE Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107328 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-107329 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110186 RCE | Langflow OSS is affected by multiple vulnerabilities | 9.8 CRITICAL | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110193 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110196 RCE Truy cập trái phép | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-110309 RCE | Langflow OSS is affected by multiple vulnerabilities | 8.8 HIGH | IBM Langflow OSS, langflow langflow | NVD, CVE.org | |
| CVE-2026-96198 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-96199 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-85897 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-85890 RCE | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 8.8 HIGH | Microsoft Microsoft Edge (Chromium-based) | NVD, CVE.org | |
| CVE-2026-119050 RCE | Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection | 8.1 HIGH | agno-agi agno | NVD, CVE.org | |
| CVE-2026-119028 RCE | oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values | 8.8 HIGH | oapi-codegen oapi-codegen | NVD, CVE.org | |
| CVE-2026-97854 RCE | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the ... | 9.8 CRITICAL | Yamaha Corporation NWR100 | NVD, CVE.org | |
| CVE-2026-103665 RCE | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a special... | 8.4 HIGH | Yamaha Corporation Yamaha LAN Monitor for Windows | NVD, CVE.org | |
| CVE-2026-97860 RCE | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary cod... | 8.4 HIGH | Yamaha Corporation YMS-VPN8, Yamaha Corporation YMS-VPN8-CP | NVD, CVE.org | |
| CVE-2026-115245 RCE | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload | 9.8 CRITICAL | Unknown Chat AI with Dispatcher | NVD, CVE.org | |
| CVE-2026-103693 RCE | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection | 9.0 CRITICAL | Unknown Frontend Dashboard, Unknown ProfileGrid | NVD, CVE.org | |
| CVE-2026-42922 RCE | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can ... | 9.8 CRITICAL | frangoteam Frangoteam | NVD, CVE.org | |
| CVE-2026-66088 RCE | Unrestricted Command Execution via system.execute | 9.4 CRITICAL | Apereo Foundation openEQUELLA | NVD, CVE.org | |
| CVE-2026-61567 RCE | AVideo-Encoder: unauthenticated command execution through streamer login trust | 10.0 CRITICAL | WWBN AVideo-Encoder | NVD, CVE.org | |
| CVE-2026-61564 RCE | AVideo-Encoder: unauthenticated installer PHP code injection | 10.0 CRITICAL | WWBN AVideo-Encoder | NVD, CVE.org | |
| CVE-2026-78674 RCE | Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution | 8.8 HIGH | WSO2 Enterprise Integrator (BPS profile), WSO2 Business Process Server | NVD, CVE.org | |
| CVE-2026-118683 RCE | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf | 8.8 HIGH | Project-MONAI MONAI | NVD, CVE.org | |
| CVE-2026-118633 RCE Lộ dữ liệu | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks ... | 8.1 HIGH | Sophos SG UTM | NVD, CVE.org | |
| CVE-2026-118619 RCE Lộ dữ liệu | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability | 8.8 HIGH | Ultralytics Ultralytics | NVD, CVE.org | |
| CVE-2026-118610 RCE | Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability | 8.8 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-118606 RCE | Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability | 8.8 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-118605 RCE | Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability | 8.0 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-118603 RCE | Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | 8.0 HIGH | Alpine iLX-F511 | NVD, CVE.org | |
| CVE-2026-106079 RCE Truy cập trái phép | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103408 RCE | Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options | 8.8 HIGH | Juniper Networks Session Smart Router | NVD, CVE.org | |
| CVE-2026-103406 RCE | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. | 9.8 CRITICAL | Juniper Networks Session Smart Conductor | NVD, CVE.org | |
| CVE-2026-103403 RCE | Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules | 8.8 HIGH | Juniper Networks Session Smart Router, Juniper Networks Session Smart Conductor | NVD, CVE.org |