plaincve:~$

Topics /

Web apps

Websites, APIs and web frameworks

Vulnerability · KEV
CVE-2026-109618
PHP out-of-memory corruption RCE (PHP2shell)
Web appsMemory corruption (RCE)
Critical9.8Not listed—
CVE-2026-53995
MLflow trace ID path traversal
AI securityWeb appsPath traversal
High8.2Not listed—
CVE-2026-108860
BotSharp hard-coded JWT key authentication bypass
Web appsAI securityHard-coded cryptographic key
Critical9.3Not listed—
CVE-2026-21589
Atlassian Data Center unauthenticated file read
Web appsPath traversal file access
Critical9.3Listed—
CVE-2026-105134
AhsayCBS Replication Receiver command injection
InfrastructureWeb appsOS command injection
Critical9.3Listed—
CVE-2026-109527
MCP Python SDK unbounded request body DoS
AI securityWeb appsUnbounded allocation (DoS)
High7.5Not listed—
CVE-2026-76504
Cisco Catalyst SD-WAN Manager API authentication bypass
InfrastructureWeb appsAuth bypass (URL encoding)
Critical9.8Listed—
CVE-2026-79538
MetaMCP inspector proxy command injection
AI securityWeb appsCommand injection / code exec
Critical9.8Not listed—
CVE-2026-65660
SharePoint Server code injection RCE
Web appsInfrastructureCode injection
High8.8Listed—
CVE-2026-61742
DBHub MCP server DNS rebinding
AI securityWeb appsMissing auth, origin check
Critical9.3Not listed—
CVE-2026-110644
nodejs-whisper file name command injection
Web appsOS command injection
Critical9.3Not listed—
CVE-2021-3199
ONLYOFFICE Document Server upload path traversal
Web appsInfrastructurePath traversal
Critical9.8Listed—