CVEs published by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

CVEs published by Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government (CVE Numbering Authority). 12 tracked.

CVE-2026-66300 MEDIUM 5.0 SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection funct
CVE-2026-113876 MEDIUM 4.3 SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions
CVE-2026-113875 LOW 3.1 On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creatio
CVE-2026-113874 HIGH 8.1 SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a
CVE-2026-113873 HIGH 7.5 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to se
CVE-2026-67180 HIGH 8.4 Google Turbinia allows arbitrary command execution via worker tasks
CVE-2026-67179 HIGH 7.8 Genkit does not properly validate host request headers
CVE-2026-97635 HIGH 8.1 The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file upl
CVE-2026-96652 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96654 MEDIUM 6.5 EXPLOITED UPGRADE Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
CVE-2026-96655 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
CVE-2026-96656 HIGH 7.2 EXPLOITED UPGRADE Plex Media Server External Control of File Name or Path Vulnerability