# CVEs published 2026-06-01

377 CVEs were published on June 1, 2026: 21 critical, 138 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-10514](https://cve.now/CVE-2026-10514.md): 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting (CVSS 4.8, 1Panel-dev CordysCRM)
- [CVE-2026-10302](https://cve.now/CVE-2026-10302.md): itsourcecode Fees Management System manage\_fee.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-9048](https://cve.now/CVE-2026-9048.md): Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3, Revolution Slider Slider Revolution)
- [CVE-2026-9050](https://cve.now/CVE-2026-9050.md): Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation (CVSS 4.3, Revolution Slider Slider Revolution)
- [CVE-2026-10301](https://cve.now/CVE-2026-10301.md): itsourcecode Fees Management System index.php cross site scripting (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-10300](https://cve.now/CVE-2026-10300.md): SGLang Inference HTTP Endpoint lora\_manager.py assertion (CVSS 6.3, SGLang)
- [CVE-2026-10299](https://cve.now/CVE-2026-10299.md): code-projects Online Hospital Management System viewdoctortimings.php resource injection (CVSS 5.1, code-projects Online Hospital Management System)
- [CVE-2026-10298](https://cve.now/CVE-2026-10298.md): ggml-org whisper.cpp ggml.c whisper\_model\_load null pointer dereference (CVSS 4.8, ggml-org whisper.cpp)
- [CVE-2026-25879](https://cve.now/CVE-2026-25879.md): Langroid has Prompt to SQL Injection, Leading to RCE (CVSS 9.8, langroid)
- [CVE-2026-28511](https://cve.now/CVE-2026-28511.md): elabftw has entry title leakage through autocompletion search (CVSS 4.3, elabftw)
- [CVE-2026-10297](https://cve.now/CVE-2026-10297.md): itsourcecode Fees Management System manage\_course.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-25277](https://cve.now/CVE-2026-25277.md): Buffer Copy Without Checking Size of Input in Secure Processor (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25276](https://cve.now/CVE-2026-25276.md): Improper Validation of Array Index in Secure Processor (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25260](https://cve.now/CVE-2026-25260.md): Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25259](https://cve.now/CVE-2026-25259.md): Out-of-bounds Write in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25258](https://cve.now/CVE-2026-25258.md): Out-of-bounds Read in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-24092](https://cve.now/CVE-2026-24092.md): Improper Validation of Syntactic Correctness of Input in Display (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24091](https://cve.now/CVE-2026-24091.md): Improper Validation of Syntactic Correctness of Input in Display (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24090](https://cve.now/CVE-2026-24090.md): Missing Authentication for Critical Function in HLOS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2026-24089](https://cve.now/CVE-2026-24089.md): Improper Validation of Syntactic Correctness of Input in Kernel (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24088](https://cve.now/CVE-2026-24088.md): Missing Authentication for Critical Function in Boot (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2026-24087](https://cve.now/CVE-2026-24087.md): Improper Validation of Syntactic Correctness of Input in Kernel (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24085](https://cve.now/CVE-2026-24085.md): Stack-based Buffer Overflow in Display (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2025-59614](https://cve.now/CVE-2025-59614.md): Out-of-bounds Write in Windows Compute (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59613](https://cve.now/CVE-2025-59613.md): Stack-based Buffer Overflow in Windows Compute (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59612](https://cve.now/CVE-2025-59612.md): Stack-based Buffer Overflow in Windows Compute (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59611](https://cve.now/CVE-2025-59611.md): Out-of-bounds Write in Core Services (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59610](https://cve.now/CVE-2025-59610.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver (CVSS 6.4, Qualcomm Snapdragon)
- [CVE-2025-59609](https://cve.now/CVE-2025-59609.md): Buffer Over-read in WLAN Host Communication (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2025-59606](https://cve.now/CVE-2025-59606.md): NULL Pointer Dereference in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59605](https://cve.now/CVE-2025-59605.md): Out-of-bounds Write in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59604](https://cve.now/CVE-2025-59604.md): NULL Pointer Dereference in SPS Applications (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59601](https://cve.now/CVE-2025-59601.md): Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2026-24782](https://cve.now/CVE-2026-24782.md): Kiteworks Secure Data Forms has a SQL Injection vulnerability (CVSS 7.6, kiteworks Secure Data Forms)
- [CVE-2026-10296](https://cve.now/CVE-2026-10296.md): itsourcecode Fees Management System ajax.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-24761](https://cve.now/CVE-2026-24761.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 3.7, kiteworks Secure Data Forms)
- [CVE-2026-24756](https://cve.now/CVE-2026-24756.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 4.3, kiteworks Secure Data Forms)
- [CVE-2026-24755](https://cve.now/CVE-2026-24755.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 5.4, kiteworks Secure Data Forms)
- [CVE-2026-24754](https://cve.now/CVE-2026-24754.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 5.4, kiteworks security-advisories)
- [CVE-2026-24753](https://cve.now/CVE-2026-24753.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 6.5, kiteworks Secure Data Forms)
- [CVE-2026-10295](https://cve.now/CVE-2026-10295.md): SourceCodester Customer Review App review\_app.py get\_all\_reviews denial of service (CVSS 4.8, SourceCodester Customer Review App)
- [CVE-2026-24752](https://cve.now/CVE-2026-24752.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 8.2, kiteworks Secure Data Forms)
- [CVE-2019-25718](https://cve.now/CVE-2019-25718.md): Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass (CVSS 8.6, Dräger Infinity Explorer C700)
- [CVE-2026-10294](https://cve.now/CVE-2026-10294.md): PackageKit API pk-transaction.c g\_file\_test improper authorization (CVSS 5.3, PackageKit)
- [CVE-2026-40965](https://cve.now/CVE-2026-40965.md): Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. (CVSS 10.0, Cloud Foundry Foundation uaa\_release · Cloud Foundry Founda…)
- [CVE-2026-10293](https://cve.now/CVE-2026-10293.md): UTT HiPER 1200GW formFireWall strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2019-25716](https://cve.now/CVE-2019-25716.md): Dräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network Packet (CVSS 7.1, Dräger Infinity Delta · Dräger Infinity Kappa)
- [CVE-2026-28586](https://cve.now/CVE-2026-28586.md): In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. (CVSS 3.3, Google Android)
- [CVE-2026-28581](https://cve.now/CVE-2026-28581.md): In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the… (CVSS 4.0, Google Android)
- [CVE-2026-28580](https://cve.now/CVE-2026-28580.md): In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-28578](https://cve.now/CVE-2026-28578.md): In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2026-28577](https://cve.now/CVE-2026-28577.md): In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. (CVSS 7.8, Google Android)
- [CVE-2026-0100](https://cve.now/CVE-2026-0100.md): In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2026-0099](https://cve.now/CVE-2026-0099.md): In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in… (CVSS 7.8, Google Android)
- [CVE-2026-0098](https://cve.now/CVE-2026-0098.md): In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2026-0097](https://cve.now/CVE-2026-0097.md): In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. (CVSS 8.0, Google Android)
- [CVE-2026-0096](https://cve.now/CVE-2026-0096.md): In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or… (CVSS 7.8, Google Android)
- [CVE-2026-0095](https://cve.now/CVE-2026-0095.md): In l2c\_fcr\_clone\_buf of l2c\_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process… (CVSS 8.0, Google Android)
- [CVE-2026-0094](https://cve.now/CVE-2026-0094.md): In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to… (CVSS 7.8, Google Android)
- [CVE-2026-0093](https://cve.now/CVE-2026-0093.md): In multiple locations, there is a possible misleading UI due to obfuscation. (CVSS 7.8, Google Android)
- [CVE-2026-0091](https://cve.now/CVE-2026-0091.md): In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. (CVSS 7.8, Google Android)
- [CVE-2026-0089](https://cve.now/CVE-2026-0089.md): In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2026-0088](https://cve.now/CVE-2026-0088.md): In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or… (CVSS 7.8, Google Android)
- [CVE-2026-0087](https://cve.now/CVE-2026-0087.md): In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a… (CVSS 7.8, Google Android)
- [CVE-2026-0086](https://cve.now/CVE-2026-0086.md): In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. (CVSS 6.8, Google Android)
- [CVE-2026-0085](https://cve.now/CVE-2026-0085.md): In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2026-0080](https://cve.now/CVE-2026-0080.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0079](https://cve.now/CVE-2026-0079.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. (CVSS 5.5, Google Android)
- [CVE-2026-0078](https://cve.now/CVE-2026-0078.md): In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-0077](https://cve.now/CVE-2026-0077.md): In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the… (CVSS 7.8, Google Android)
- [CVE-2026-0076](https://cve.now/CVE-2026-0076.md): In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-0075](https://cve.now/CVE-2026-0075.md): In multiple functions, there is a possible way to access the contacts database due to a SQL injection. (CVSS 7.8, Google Android)
- [CVE-2026-0074](https://cve.now/CVE-2026-0074.md): In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2026-0070](https://cve.now/CVE-2026-0070.md): In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input… (CVSS 5.5, Google Android)
- [CVE-2026-0069](https://cve.now/CVE-2026-0069.md): In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2026-0067](https://cve.now/CVE-2026-0067.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a permanent denial of service due to a logic error… (CVSS 5.5, Google Android)
- [CVE-2026-0061](https://cve.now/CVE-2026-0061.md): In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay… (CVSS 5.9, Google Android)
- [CVE-2026-0060](https://cve.now/CVE-2026-0060.md): In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root… (CVSS 5.5, Google Android)
- [CVE-2026-0059](https://cve.now/CVE-2026-0059.md): In multiple functions of sdp\_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. (CVSS 8.0, Google Android)
- [CVE-2026-0056](https://cve.now/CVE-2026-0056.md): In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. (CVSS 3.3, Google Android)
- [CVE-2026-0055](https://cve.now/CVE-2026-0055.md): In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid… (CVSS 6.2, Google Android)
- [CVE-2026-0052](https://cve.now/CVE-2026-0052.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0051](https://cve.now/CVE-2026-0051.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. (CVSS 6.5, Google Android)
- [CVE-2026-0050](https://cve.now/CVE-2026-0050.md): In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. (CVSS 3.3, Google Android)
- [CVE-2026-0048](https://cve.now/CVE-2026-0048.md): In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. (CVSS 6.8, Google Android)
- [CVE-2026-0046](https://cve.now/CVE-2026-0046.md): In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay… (CVSS 6.2, Google Android)
- [CVE-2026-0045](https://cve.now/CVE-2026-0045.md): In bta\_jv\_rfcomm\_connect of bta\_jv\_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-0044](https://cve.now/CVE-2026-0044.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause the system to crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0043](https://cve.now/CVE-2026-0043.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. (CVSS 5.5, Google Android)
- [CVE-2026-0042](https://cve.now/CVE-2026-0042.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2026-0041](https://cve.now/CVE-2026-0041.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible UBSan failure due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0040](https://cve.now/CVE-2026-0040.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0039](https://cve.now/CVE-2026-0039.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0036](https://cve.now/CVE-2026-0036.md): In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. (CVSS 7.8, Google Android)
- [CVE-2026-0018](https://cve.now/CVE-2026-0018.md): In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation (CVSS 5.5, Google Android)
- [CVE-2026-0016](https://cve.now/CVE-2026-0016.md): In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a pe (CVSS 3.3, Google Android)
- [CVE-2026-0009](https://cve.now/CVE-2026-0009.md): In multiple locations, there is a possible tapjacking due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48652](https://cve.now/CVE-2025-48652.md): In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48649](https://cve.now/CVE-2025-48649.md): In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. (CVSS 7.8, Google Android)
- [CVE-2025-48648](https://cve.now/CVE-2025-48648.md): In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2025-48616](https://cve.now/CVE-2025-48616.md): In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic… (CVSS 3.3, Google Android)
- [CVE-2025-48595](https://cve.now/CVE-2025-48595.md): In multiple locations, there is a possible way to achieve code execution due to an integer overflow. (CVSS 8.4, KEV, Google Android)
- [CVE-2025-48570](https://cve.now/CVE-2025-48570.md): In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-32348](https://cve.now/CVE-2025-32348.md): In multiple locations, there is a possible background activity launch due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2025-26418](https://cve.now/CVE-2025-26418.md): In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account… (CVSS 7.8, Google Android)
- [CVE-2025-22426](https://cve.now/CVE-2025-22426.md): In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-22424](https://cve.now/CVE-2025-22424.md): In multiple locations, there is a possible way to reveal images across users due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-40964](https://cve.now/CVE-2026-40964.md): Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain… (CVSS 7.5, Cloud Foundry Foundation log-cache\_release · Cloud Foundry…)
- [CVE-2026-49491](https://cve.now/CVE-2026-49491.md): Pixa Bank 2.0 SQL Injection via agence-ajax.php API (CVSS 8.8, Pixastudio Pixa Bank)
- [CVE-2018-25435](https://cve.now/CVE-2018-25435.md): ZeusCart 4.0 Deactivate Customer Accounts CSRF (CVSS 6.9, ZeusCart)
- [CVE-2018-25434](https://cve.now/CVE-2018-25434.md): WP AutoSuggest 0.24 SQL Injection via autosuggest.php (CVSS 8.8, eliekhoury WP AutoSuggest)
- [CVE-2018-25433](https://cve.now/CVE-2018-25433.md): Joomla JE Photo Gallery 1.1 SQL Injection via categoryid (CVSS 8.8, Joomlaextensions JE Photo Gallery)
- [CVE-2018-25432](https://cve.now/CVE-2018-25432.md): Arm Whois 3.11 Buffer Overflow via ASLR Bypass (CVSS 8.6, Armcode Arm Whois)
- [CVE-2018-25431](https://cve.now/CVE-2018-25431.md): No-Cms 1.0 SQL Injection via order\_by Parameter (CVSS 7.1, goFrendiAsgard No-CMS)
- [CVE-2018-25430](https://cve.now/CVE-2018-25430.md): Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter (CVSS 7.1, Paroiciel)
- [CVE-2018-25429](https://cve.now/CVE-2018-25429.md): Paroiciel 11.20 SQL Injection via zProIdPro Parameter (CVSS 7.1, Paroiciel)
- [CVE-2018-25428](https://cve.now/CVE-2018-25428.md): Paroiciel 11.20 SQL Injection via tRecIdListe Parameter (CVSS 8.8, Paroiciel)
- [CVE-2018-25427](https://cve.now/CVE-2018-25427.md): Arm Whois 3.11 Buffer Overflow via SEH Overwrite (CVSS 9.3, Armcode Arm Whois)
- [CVE-2026-10292](https://cve.now/CVE-2026-10292.md): UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-10291](https://cve.now/CVE-2026-10291.md): Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos (CVSS 5.3, Enderfga claw-orchestrator · @enderfga/claw-orchestrator)
- [CVE-2026-10290](https://cve.now/CVE-2026-10290.md): code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation System)
- [CVE-2026-10289](https://cve.now/CVE-2026-10289.md): code-projects Hotel and Tourism Reservation System tour.php cross site scripting (CVSS 5.3, code-projects Hotel and Tourism Reservation System)
- [CVE-2026-10288](https://cve.now/CVE-2026-10288.md): code-projects Hotel and Tourism Reservation System Admin Login login.php password\_verify improper authentication (CVSS 6.9, code-projects Hotel and Tourism Reservation System)
- [CVE-2026-49433](https://cve.now/CVE-2026-49433.md): DeepAI api.deepai.org/change\_user\_email CSRF (CVSS 2.3, api.deepai.org)
- [CVE-2026-49140](https://cve.now/CVE-2026-49140.md): Nanobot \< 0.2.1 Denial of Service via Matrix Media Download Handler (CVSS 5.3, HKUDS nanobot)
- [CVE-2026-49139](https://cve.now/CVE-2026-49139.md): Nanobot \< 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning (CVSS 7.0, HKUDS nanobot)
- [CVE-2026-10287](https://cve.now/CVE-2026-10287.md): SourceCodester SEO Meta Tag Extractor index.php get\_headers server-side request forgery (CVSS 6.9, SourceCodester SEO Meta Tag Extractor)
- [CVE-2026-49138](https://cve.now/CVE-2026-49138.md): Nanobot \< 0.2.1 SSRF via web\_fetch Tool Redirect Following (CVSS 5.3, HKUDS nanobot · nanobot-ai)
- [CVE-2026-10286](https://cve.now/CVE-2026-10286.md): CodeAstro Payroll System home\_employee.php sql injection (CVSS 5.3, CodeAstro Payroll System)
- [CVE-2026-5419](https://cve.now/CVE-2026-5419.md): Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal (CVSS 3.7, gnutls · Red Hat Enterprise Linux +6)
- [CVE-2026-10285](https://cve.now/CVE-2026-10285.md): DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization (CVSS 5.3, DevaslanPHP project-management)
- [CVE-2026-49136](https://cve.now/CVE-2026-49136.md): Banana Slides 0.4.0 Path Traversal via generate\_image() in ai\_service.py (CVSS 8.7, Anionex banana-slides)
- [CVE-2021-46747](https://cve.now/CVE-2021-46747.md): Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to… (CVSS 7.1, AMD Athlon™ 3000 Series Mobile Processors with Radeon™… +23)
- [CVE-2026-10284](https://cve.now/CVE-2026-10284.md): DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization (CVSS 5.3, DevaslanPHP project-management)
- [CVE-2026-49135](https://cve.now/CVE-2026-49135.md): CodexBar \< 0.32.0 Insecure Temporary File Handling in Notarization Workflow (CVSS 7.2, steipete CodexBar)
- [CVE-2026-49134](https://cve.now/CVE-2026-49134.md): CodexBar \< 0.32.0 Privilege Escalation via CLI Installer Temp File (CVSS 7.5, steipete CodexBar)
- [CVE-2026-24751](https://cve.now/CVE-2026-24751.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 8.2, kiteworks Secure Data Forms)
- [CVE-2026-43625](https://cve.now/CVE-2026-43625.md): CodexBar \< 0.32.0 Session Cookie Exposure via HTTP Redirect (CVSS 8.2, steipete CodexBar)
- [CVE-2026-10283](https://cve.now/CVE-2026-10283.md): Bottelet DaybydayCRM Setting missing authentication (CVSS 5.3, Bottelet DaybydayCRM)
- [CVE-2026-10282](https://cve.now/CVE-2026-10282.md): Bottelet DaybydayCRM DocumentsController.php view improper authorization (CVSS 5.3, Bottelet DaybydayCRM)
- [CVE-2026-47294](https://cve.now/CVE-2026-47294.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-43624](https://cve.now/CVE-2026-43624.md): F5-TTS 1.1.20 Path Traversal via finetune\_gradio.py create\_data\_project() (CVSS 8.8, SWivid F5-TTS)
- [CVE-2026-10281](https://cve.now/CVE-2026-10281.md): Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication (CVSS 6.9, Enderfga claw-orchestrator · @enderfga/claw-orchestrator)
- [CVE-2026-23638](https://cve.now/CVE-2026-23638.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 6.5, kiteworks Secure Data Forms)
- [CVE-2026-43623](https://cve.now/CVE-2026-43623.md): microtar 0.1.0 Stack-Based Buffer Overflow via raw\_to\_header() (CVSS 8.7, rxi microtar)
- [CVE-2026-9330](https://cve.now/CVE-2026-9330.md): IBM WebSphere Application Server is affected by remote code execution (CVSS 8.5, IBM WebSphere Application Server)
- [CVE-2026-30963](https://cve.now/CVE-2026-30963.md): Capsule Namespace Hijacking via subresource (CVSS 3.9, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-10280](https://cve.now/CVE-2026-10280.md): horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery (CVSS 6.9, horizon921 mcpilot)
- [CVE-2026-9319](https://cve.now/CVE-2026-9319.md): IBM WebSphere Application Server is affected by a remote code execution vulnerability (CVSS 9.0, IBM WebSphere Application Server)
- [CVE-2026-9614](https://cve.now/CVE-2026-9614.md): An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain… (CVSS 8.8, Ivanti Neurons for ITSM)
- [CVE-2026-9311](https://cve.now/CVE-2026-9311.md): IBM WebSphere Application Server is affected by remote code execution (CVSS 9.0, IBM WebSphere Application Server)
- [CVE-2026-40990](https://cve.now/CVE-2026-40990.md): Unbounded cache for function definitions (CVSS 5.7, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2026-40989](https://cve.now/CVE-2026-40989.md): Self Routing guard bypassed via function composition (CVSS 5.7, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2026-8644](https://cve.now/CVE-2026-8644.md): IBM WebSphere Application Server is affected by an identity spoofing vulnerability (CVSS 9.1, IBM WebSphere Application Server)
- [CVE-2026-10279](https://cve.now/CVE-2026-10279.md): hiraishikentaro wezterm-mcp switch\_pane/write\_to\_specific\_pane wezterm\_executor.ts os command injection (CVSS 5.3, hiraishikentaro wezterm-mcp)
- [CVE-2026-7770](https://cve.now/CVE-2026-7770.md): IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator (CVSS 8.8, IBM i Access Family)
- [CVE-2026-22872](https://cve.now/CVE-2026-22872.md): Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability (CVSS 6.9, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-0072](https://cve.now/CVE-2026-0072.md): In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. (CVSS 10.0, Google Android XR)
- [CVE-2026-41013](https://cve.now/CVE-2026-41013.md): Tenant-controlled comma smuggles arbitrary CIFS mount options (CVSS 8.1, CloudFoundry Foundation smb-volume-release · CloudFoundry F…)
- [CVE-2026-43958](https://cve.now/CVE-2026-43958.md): Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-10278](https://cve.now/CVE-2026-10278.md): ishayoyo excel-mcp read\_file/write\_file index.ts path traversal (CVSS 5.3, ishayoyo excel-mcp)
- [CVE-2026-45727](https://cve.now/CVE-2026-45727.md): CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion (CVSS 8.8, CloakHQ CloakBrowser · cloakbrowser)
- [CVE-2026-45302](https://cve.now/CVE-2026-45302.md): Prototype Pollution in parse-nested-form-data via \`proto\` in FormData field names (CVSS 8.2, milamer parse-nested-form-data · parse-nested-form-data)
- [CVE-2026-45729](https://cve.now/CVE-2026-45729.md): ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input (CVSS 4.3, thorvg)
- [CVE-2024-52011](https://cve.now/CVE-2024-52011.md): launch-editor vulnerable to command injection via the crafted request on Windows (CVSS 7.5, vitejs launch-editor · vitejs vite +2)
- [CVE-2026-10277](https://cve.now/CVE-2026-10277.md): j3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control (CVSS 5.3, j3k0 mcp-google-workspace)
- [CVE-2026-45810](https://cve.now/CVE-2026-45810.md): Nextcloud: Propfind requests for file comments allowed to load comments for other files (CVSS 6.8, nextcloud security-advisories)
- [CVE-2026-45722](https://cve.now/CVE-2026-45722.md): Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views (CVSS 7.1, nextcloud security-advisories)
- [CVE-2026-45691](https://cve.now/CVE-2026-45691.md): Nextcloud: Bypass of second factor authentication on DAV endpoints (CVSS 5.9, nextcloud security-advisories)
- [CVE-2026-49121](https://cve.now/CVE-2026-49121.md): AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization (CVSS 9.2, ROCm aiter)
- [CVE-2026-45690](https://cve.now/CVE-2026-45690.md): Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay (CVSS 5.9, nextcloud security-advisories)
- [CVE-2026-45545](https://cve.now/CVE-2026-45545.md): Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution (CVSS 8.2, nextcloud security-advisories)
- [CVE-2026-45544](https://cve.now/CVE-2026-45544.md): Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService (CVSS 4.3, nextcloud security-advisories)
- [CVE-2026-45543](https://cve.now/CVE-2026-45543.md): Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share (CVSS 5.3, nextcloud security-advisories)
- [CVE-2026-10276](https://cve.now/CVE-2026-10276.md): hekmon8 Jenkins-server-mcp get\_build\_status/get\_build\_log/trigger\_build index.ts jobPath server-side request forgery (CVSS 5.3, hekmon8 Jenkins-server-mcp)
- [CVE-2026-45286](https://cve.now/CVE-2026-45286.md): Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint (CVSS 4.3, nextcloud security-advisories)
- [CVE-2026-45284](https://cve.now/CVE-2026-45284.md): Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate (CVSS 4.6, nextcloud security-advisories)
- [CVE-2026-45285](https://cve.now/CVE-2026-45285.md): Nextcloud: Hidden Public Link creation when sharing to a Team External Member (CVSS 6.4, nextcloud security-advisories)
- [CVE-2026-45283](https://cve.now/CVE-2026-45283.md): Nextcloud: Files Lock app allows users to lock and unlock files of other users (CVSS 6.3, nextcloud security-advisories)
- [CVE-2026-45282](https://cve.now/CVE-2026-45282.md): Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file… (CVSS 6.5, nextcloud security-advisories)
- [CVE-2026-45281](https://cve.now/CVE-2026-45281.md): Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update (CVSS 8.1, nextcloud security-advisories)
- [CVE-2026-45279](https://cve.now/CVE-2026-45279.md): Nextcloud: Limited path traversal via template API if using \`{lang}\` in config (CVSS 4.4, nextcloud security-advisories)
- [CVE-2026-45278](https://cve.now/CVE-2026-45278.md): Nextcloud: Open Redirect in user\_oidc login flow via protocol-relative URL bypass (CVSS 3.3, nextcloud security-advisories)
- [CVE-2026-45277](https://cve.now/CVE-2026-45277.md): Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations (CVSS 3.3, nextcloud security-advisories)
- [CVE-2026-45275](https://cve.now/CVE-2026-45275.md): Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers (CVSS 6.5, nextcloud security-advisories)
- [CVE-2026-10275](https://cve.now/CVE-2026-10275.md): OpenSC pkcs11-tool Key Generation pkcs11-tool.c test\_kpgen\_certwrite buffer overflow (CVSS 2.3, OpenSC)
- [CVE-2026-45267](https://cve.now/CVE-2026-45267.md): Nextcloud: Missing permission check for from submissions (CVSS 6.5, nextcloud security-advisories)
- [CVE-2026-45266](https://cve.now/CVE-2026-45266.md): Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling (CVSS 3.5, nextcloud security-advisories)
- [CVE-2026-45159](https://cve.now/CVE-2026-45159.md): Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner (CVSS 3.5, nextcloud security-advisories)
- [CVE-2026-45157](https://cve.now/CVE-2026-45157.md): Nextcloud: Valid share tokens allow to access tempory upload files of share owner (CVSS 6.3, nextcloud security-advisories)
- [CVE-2026-45156](https://cve.now/CVE-2026-45156.md): Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC (CVSS 8.1, nextcloud security-advisories)
- [CVE-2026-45155](https://cve.now/CVE-2026-45155.md): Nextcloud: Private circle can be added to another circle via API (CVSS 2.6, nextcloud security-advisories)
- [CVE-2026-45154](https://cve.now/CVE-2026-45154.md): Nextcloud: Improper Access Control in Collectives (CVSS 2.6, nextcloud security-advisories)
- [CVE-2026-45153](https://cve.now/CVE-2026-45153.md): Nextcloud: PIN bypass in PassCodeActivity via back button (CVSS 4.6, nextcloud security-advisories)
- [CVE-2026-45264](https://cve.now/CVE-2026-45264.md): Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames (CVSS 4.3, nextcloud security-advisories)
- [CVE-2026-10274](https://cve.now/CVE-2026-10274.md): indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery (CVSS 5.3, indrasishbanerjee aem-mcp-server)
- [CVE-2026-8501](https://cve.now/CVE-2026-8501.md): CVE-2026-8501 (CVSS 7.8, Symantec PC Tools Internet Security)
- [CVE-2026-46243](https://cve.now/CVE-2026-46243.md): smb: client: reject userspace cifs.spnego descriptions (CVSS 7.1, Linux)
- [CVE-2026-10273](https://cve.now/CVE-2026-10273.md): php-censor Webhook Endpoint GitBuild.php os command injection (CVSS 6.9, php-censor)
- [CVE-2026-45131](https://cve.now/CVE-2026-45131.md): CloudPirates Open Source Helm Charts: GitHub Actions pull\_request\_target workflow allows secret exfiltration via fork pull requests (CVSS 10.0, CloudPirates-io helm-charts)
- [CVE-2026-45132](https://cve.now/CVE-2026-45132.md): CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling (CVSS 10.0, CloudPirates-io helm-charts)
- [CVE-2026-45701](https://cve.now/CVE-2026-45701.md): Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens (CVSS 6.9, sulu · sulu/sulu)
- [CVE-2026-44740](https://cve.now/CVE-2026-44740.md): go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion (CVSS 6.5, go-git go-billy · github.com/go-git/go-billy/v5 +1)
- [CVE-2026-44211](https://cve.now/CVE-2026-44211.md): Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability (CVSS 9.6, cline)
- [CVE-2026-10272](https://cve.now/CVE-2026-10272.md): a4m4 Student-Management-System deleteform.php improper authorization (CVSS 6.9, a4m4 Student-Management-System)
- [CVE-2022-4991](https://cve.now/CVE-2022-4991.md): Tychon is vulnerable to privilege escalation due to OPENSSLDIR location (CVSS 7.4, Tychon)
- [CVE-2026-10271](https://cve.now/CVE-2026-10271.md): a4m4 Student-Management-System Admin Endpoint admin redirect (CVSS 5.3, a4m4 Student-Management-System)
- [CVE-2026-10118](https://cve.now/CVE-2026-10118.md): Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication (CVSS 7.8, Red Hat Enterprise Linux · Red Hat AI Inference Server +2)
- [CVE-2026-10270](https://cve.now/CVE-2026-10270.md): D-Link DI-7001 MINI API httpd\_debug.asp sprintf stack-based overflow (CVSS 8.7, D-Link DI-7001 MINI)
- [CVE-2026-42671](https://cve.now/CVE-2026-42671.md): WordPress GeoDirectory plugin \<= 2.8.157 - Broken Access Control vulnerability (CVSS 6.5, Paolo GeoDirectory)
- [CVE-2026-42672](https://cve.now/CVE-2026-42672.md): WordPress WP Directory Kit plugin \<= 1.5.1 - SQL Injection vulnerability (CVSS 9.3, WP Directory Kit)
- [CVE-2026-42673](https://cve.now/CVE-2026-42673.md): WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin \<= 3.3.6 - Sensitive Data Exposure… (CVSS 7.5, Logtivity Activity Logs Activity Logs, User Activity Tracki…)
- [CVE-2026-42674](https://cve.now/CVE-2026-42674.md): WordPress Advanced Access Manager plugin \<= 7.1.0 - Bypass Vulnerability vulnerability (CVSS 7.5, AAM Plugin Advanced Access Manager)
- [CVE-2026-42675](https://cve.now/CVE-2026-42675.md): WordPress Hydra Booking plugin \<= 1.1.41 - Broken Access Control vulnerability (CVSS 7.3, Themefic Hydra Booking)
- [CVE-2026-42676](https://cve.now/CVE-2026-42676.md): WordPress myCred plugin \<= 3.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, myCred)
- [CVE-2026-42677](https://cve.now/CVE-2026-42677.md): WordPress WP Document Revisions plugin \<= 3.8.1 - Broken Access Control vulnerability (CVSS 7.5, Ben Balter WP Document Revisions)
- [CVE-2026-10269](https://cve.now/CVE-2026-10269.md): decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization (CVSS 5.3, decolua 9router)
- [CVE-2026-42678](https://cve.now/CVE-2026-42678.md): WordPress GiveWP plugin \<= 4.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Liquid Web / StellarWP GiveWP)
- [CVE-2026-42679](https://cve.now/CVE-2026-42679.md): WordPress Classified Listing plugin \<= 5.3.8 - Arbitrary File Download vulnerability (CVSS 6.5, Mamunur Rashid Classified Listing)
- [CVE-2026-8643](https://cve.now/CVE-2026-8643.md): pip can extract console\_scripts and gui\_scripts outside installation directory (CVSS 4.1, Python Packaging Authority pip · pip)
- [CVE-2026-10268](https://cve.now/CVE-2026-10268.md): janet-lang janet marsh.c unmarshal\_one\_fiber integer overflow (CVSS 4.8, janet-lang janet)
- [CVE-2026-0826](https://cve.now/CVE-2026-0826.md): Poly Voice – Possible Remote Control of Certain Poly Devices (CVSS 9.2, HP poly\_trio\_8300 · HP poly\_trio\_8500 +2)
- [CVE-2026-42680](https://cve.now/CVE-2026-42680.md): WordPress Contest Gallery Pro plugin \<= 29.0.1 - Privilege Escalation vulnerability (CVSS 9.8, Wasiliy Strecker / ContestGallery developer Contest Gallery…)
- [CVE-2026-42681](https://cve.now/CVE-2026-42681.md): WordPress e2pdf plugin \<= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, E2Pdf.com e2pdf)
- [CVE-2026-42682](https://cve.now/CVE-2026-42682.md): WordPress wpForo Forum plugin \<= 3.0.6 - Broken Access Control vulnerability (CVSS 9.1, Tomdever wpForo Forum)
- [CVE-2026-10267](https://cve.now/CVE-2026-10267.md): janet-lang janet debug.c doframe out-of-bounds (CVSS 4.8, janet-lang janet)
- [CVE-2026-42683](https://cve.now/CVE-2026-42683.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-48839](https://cve.now/CVE-2026-48839.md): WordPress WP Statistics plugin \<= 14.16.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VeronaLabs WP Statistics)
- [CVE-2026-48865](https://cve.now/CVE-2026-48865.md): WordPress LearnPress plugin \<= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThimPress LearnPress)
- [CVE-2026-48866](https://cve.now/CVE-2026-48866.md): WordPress Gravity Forms plugin \<= 2.10.0.1 - Arbitrary File Deletion vulnerability (CVSS 9.6, Rocketgenius Gravity Forms)
- [CVE-2026-48879](https://cve.now/CVE-2026-48879.md): WordPress AIWU plugin \<= 1.4.17 - Privilege Escalation vulnerability (CVSS 9.8, Sergey AIWU)
- [CVE-2026-8931](https://cve.now/CVE-2026-8931.md): Critical RCE vulnerability in Disig Web Signer (CVSS 9.4, Disig Web Signer)
- [CVE-2026-10265](https://cve.now/CVE-2026-10265.md): itsourcecode Content Management System edit\_topic.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10264](https://cve.now/CVE-2026-10264.md): lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal (CVSS 5.1, lharries whatsapp-mcp)
- [CVE-2026-10263](https://cve.now/CVE-2026-10263.md): SourceCodester Computer Repair Shop Management System manage\_product.php sql injection (CVSS 6.9, SourceCodester Computer Repair Shop Management System)
- [CVE-2026-10262](https://cve.now/CVE-2026-10262.md): code-projects Real State Services Login loginuser.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-10261](https://cve.now/CVE-2026-10261.md): CodeAstro Online Job Portal application\_status.php sql injection (CVSS 6.9, CodeAstro Online Job Portal)
- [CVE-2026-42251](https://cve.now/CVE-2026-42251.md): Hard-coded credentials in KS-SOMED (CVSS 8.7, KAMSOFT KS-SOMED)
- [CVE-2026-10533](https://cve.now/CVE-2026-10533.md): Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation (CVSS 5.0, Red Hat OpenShift Container Platform)
- [CVE-2024-40646](https://cve.now/CVE-2024-40646.md): Vertex Vulnerable to Path Traversal (CVSS 8.6, vertex-app vertex)
- [CVE-2026-48559](https://cve.now/CVE-2026-48559.md): Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags (CVSS 5.1, epoupon lms)
- [CVE-2026-10260](https://cve.now/CVE-2026-10260.md): CodeAstro Online Job Portal delete-jobs.php sql injection (CVSS 6.9, CodeAstro Online Job Portal)
- [CVE-2026-10259](https://cve.now/CVE-2026-10259.md): H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow (CVSS 8.7, H3C Magic B0)
- [CVE-2026-10258](https://cve.now/CVE-2026-10258.md): itsourcecode Content Management System add\_sub\_topic.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10257](https://cve.now/CVE-2026-10257.md): itsourcecode Content Management System update\_ss\_img.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10256](https://cve.now/CVE-2026-10256.md): itsourcecode Content Management System save\_comment.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10255](https://cve.now/CVE-2026-10255.md): SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell\_statement access control (CVSS 6.9, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-10254](https://cve.now/CVE-2026-10254.md): SourceCodester Pet Grooming Management Software admin file information disclosure (CVSS 6.9, SourceCodester Pet Grooming Management Software)
- [CVE-2026-10532](https://cve.now/CVE-2026-10532.md): Logback deserialization whitelist bypass for Proxy objects (CVSS 2.9, QOS.CH Sarl logback · ch.qos.logback:logback-core)
- [CVE-2026-10253](https://cve.now/CVE-2026-10253.md): itsourcecode Online House Rental System manage\_payment.php sql injection (CVSS 6.9, itsourcecode Online House Rental System)
- [CVE-2026-9309](https://cve.now/CVE-2026-9309.md): Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2026-9308](https://cve.now/CVE-2026-9308.md): Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2026-10252](https://cve.now/CVE-2026-10252.md): itsourcecode Online House Rental System manage\_tenant.php sql injection (CVSS 6.9, itsourcecode Online House Rental System)
- [CVE-2026-34193](https://cve.now/CVE-2026-34193.md): GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw\_to\_ptr() (CVSS 4.3, Imagination Technologies Graphics DDK)
- [CVE-2026-10251](https://cve.now/CVE-2026-10251.md): itsourcecode Online House Rental System ajax.php login sql injection (CVSS 6.9, itsourcecode Online House Rental System)
- [CVE-2026-10250](https://cve.now/CVE-2026-10250.md): itsourcecode Online Blood Bank Management System campsdetails.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2026-10249](https://cve.now/CVE-2026-10249.md): itsourcecode Online Blood Bank Management System viewrequest.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2026-10248](https://cve.now/CVE-2026-10248.md): SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create\_supplier csv injection (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-49328](https://cve.now/CVE-2026-49328.md): Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF (CVSS 5.3, Apache Software Foundation org.apache.fesod:fesod-sheet · o…)
- [CVE-2026-10247](https://cve.now/CVE-2026-10247.md): SourceCodester Pharmacy Sales and Inventory System main create\_generic\_name cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-10246](https://cve.now/CVE-2026-10246.md): SourceCodester Pharmacy Sales and Inventory System main create\_medicine\_presentation cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-25600](https://cve.now/CVE-2026-25600.md): Credential Exposure Vulnerability in Trac PDBM (CVSS 6.4, Trac d.o.o. PDBM)
- [CVE-2026-10245](https://cve.now/CVE-2026-10245.md): SourceCodester Pharmacy Sales and Inventory System main create\_supplier cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-25599](https://cve.now/CVE-2026-25599.md): Missing authentication and clear‑text data transmission affecting Orca heat pumps (CVSS 6.3, Orca Energy Orca heat pump · Orca Energy Orca user portal)
- [CVE-2026-10244](https://cve.now/CVE-2026-10244.md): SourceCodester Pharmacy Sales and Inventory System main create\_medicine\_name cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-40549](https://cve.now/CVE-2026-40549.md): Cross-Site Request Forgery in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2026-40548](https://cve.now/CVE-2026-40548.md): Unrestricted Upload of File with Dangerous Type in SOPlanning (CVSS 6.4, SOPlanning)
- [CVE-2026-40547](https://cve.now/CVE-2026-40547.md): Path Traversal in SOPlanning (CVSS 6.4, SOPlanning)
- [CVE-2026-40546](https://cve.now/CVE-2026-40546.md): Multiple SQL Injections in SOPlanning (CVSS 8.7, SOPlanning)
- [CVE-2026-40545](https://cve.now/CVE-2026-40545.md): Reflected XSS in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2026-40544](https://cve.now/CVE-2026-40544.md): Stored XSS in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2026-40543](https://cve.now/CVE-2026-40543.md): Missing Authorization in SOPlanning (CVSS 8.8, SOPlanning)
- [CVE-2026-10243](https://cve.now/CVE-2026-10243.md): code-projects Smart Parking System Admin Endpoint missing authentication (CVSS 6.9, code-projects Smart Parking System)
- [CVE-2026-10242](https://cve.now/CVE-2026-10242.md): itsourcecode Content Management System instructions.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-48827](https://cve.now/CVE-2026-48827.md): Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git (CVSS 7.1, Apache Software Foundation org.apache.sshd:sshd-git · org.a…)
- [CVE-2026-10241](https://cve.now/CVE-2026-10241.md): jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side… (CVSS 5.3, jeecgboot The server processes these URLs)
- [CVE-2026-9024](https://cve.now/CVE-2026-9024.md): Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release… (CVSS 8.7, Dassault Systèmes DELMIA Service Process Engineer)
- [CVE-2026-10240](https://cve.now/CVE-2026-10240.md): JeecgBoot test server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-44825](https://cve.now/CVE-2026-44825.md): Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users (CVSS 8.1, Apache Software Foundation org.apache.solr:solr-core · org.…)
- [CVE-2026-10239](https://cve.now/CVE-2026-10239.md): JeecgBoot edit WordUtil.addImage server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-49361](https://cve.now/CVE-2026-49361.md): Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability (CVSS 7.5, Apache Software Foundation Apache Fluss · org.apache.fluss:…)
- [CVE-2026-40861](https://cve.now/CVE-2026-40861.md): Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-40961](https://cve.now/CVE-2026-40961.md): Apache Airflow: Open Redirect Bypass Vulnerability (CVSS 7.2, Apache Software Foundation apache-airflow-core · apache-… +1)
- [CVE-2026-40963](https://cve.now/CVE-2026-40963.md): Apache Airflow: DAG authorization bypass on /ui/structure/structure\_data (CVSS 3.1, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-41014](https://cve.now/CVE-2026-41014.md): Apache Airflow: per-DAG RBAC bypass on /ui/partitioned\_dag\_runs endpoints (CVSS 4.3, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-49267](https://cve.now/CVE-2026-49267.md): Apache Airflow: No certificate validation on SMTP STARTTLS connections (CVSS 5.9, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-41017](https://cve.now/CVE-2026-41017.md): Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy (CVSS 5.9, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-41084](https://cve.now/CVE-2026-41084.md): Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation (CVSS 7.5, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-42252](https://cve.now/CVE-2026-42252.md): Apache Airflow: BashOperator Jinja2 injection via dag\_run.conf — low-privilege user pattern (CVSS 9.1, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-42360](https://cve.now/CVE-2026-42360.md): Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-42358](https://cve.now/CVE-2026-42358.md): Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-42359](https://cve.now/CVE-2026-42359.md): Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN\_XCOM\_KEYS validator (CVSS 8.8, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-45360](https://cve.now/CVE-2026-45360.md): Apache Airflow: Arbitrary import in custom deadline-reference deserialization (CVSS 7.3, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-8474](https://cve.now/CVE-2026-8474.md): Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances. (CVSS 5.3, StormShield Network Security)
- [CVE-2026-45426](https://cve.now/CVE-2026-45426.md): Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access (CVSS 3.1, Apache Software Foundation apache-airflow-core · airflow +1)
- [CVE-2026-46764](https://cve.now/CVE-2026-46764.md): Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter (CVSS 4.3, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-7858](https://cve.now/CVE-2026-7858.md): Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and… (CVSS 9.8, Dassault Systèmes Teamwork Cloud - Standard Edition · Da… +3)
- [CVE-2026-10237](https://cve.now/CVE-2026-10237.md): SourceCodester Water Billing Management System User Management manage\_user sql injection (CVSS 5.1, SourceCodester Water Billing Management System)
- [CVE-2026-48726](https://cve.now/CVE-2026-48726.md): Apache Airflow: revoke\_token() unreachable in FabAuthManager / KeycloakAuthManager logout path (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-49298](https://cve.now/CVE-2026-49298.md): Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments (CVSS 8.8, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-10236](https://cve.now/CVE-2026-10236.md): SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization (CVSS 6.9, SourceCodester Water Billing Management System)
- [CVE-2026-42253](https://cve.now/CVE-2026-42253.md): Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties (CVSS 6.1, Apache Software Foundation org.apache.activemq:apache-ac… +2)
- [CVE-2026-42588](https://cve.now/CVE-2026-42588.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector (CVSS 8.1, Apache Software Foundation org.apache.activemq:activemq-… +4)
- [CVE-2026-45505](https://cve.now/CVE-2026-45505.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia \`addNetworkConnector\` Discovery Wrapper Bypass (CVSS 8.8, Apache Software Foundation org.apache.activemq:activemq-… +4)
- [CVE-2026-46605](https://cve.now/CVE-2026-46605.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal (CVSS 4.3, Apache Software Foundation org.apache.activemq:activemq-… +2)
- [CVE-2026-49157](https://cve.now/CVE-2026-49157.md): Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default (CVSS 8.8, Apache Software Foundation org.apache.activemq:apache-activ…)
- [CVE-2026-49270](https://cve.now/CVE-2026-49270.md): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) (CVSS 5.9, Apache Software Foundation org.apache.activemq:activemq-… +4)
- [CVE-2026-32325](https://cve.now/CVE-2026-32325.md): Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. (CVSS 7.8, Fsas Technologies ServerView Agents for Windows)
- [CVE-2026-27788](https://cve.now/CVE-2026-27788.md): Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. (CVSS 7.8, Fsas Technologies ServerView Agents for Windows)
- [CVE-2026-10235](https://cve.now/CVE-2026-10235.md): CodeAstro Ingredients Stock Management System stock\_manager.php sql injection (CVSS 5.3, CodeAstro Ingredients Stock Management System)
- [CVE-2026-35563](https://cve.now/CVE-2026-35563.md): Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname (CVSS 8.8, Apache Software Foundation org.apache.directory.api:api-lda…)
- [CVE-2026-10234](https://cve.now/CVE-2026-10234.md): Mettle sendportal Campaign webview cross site scripting (CVSS 5.1, Mettle sendportal)
- [CVE-2026-45192](https://cve.now/CVE-2026-45192.md): Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response (CVSS 6.5, Apache Software Foundation apache-airflow · Apache Softw… +2)
- [CVE-2026-10233](https://cve.now/CVE-2026-10233.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read\_sequence\_infos out-of-bounds (CVSS 4.8, Assimp)
- [CVE-2026-10232](https://cve.now/CVE-2026-10232.md): Assimp ASE File scene.cpp ~aiNode use after free (CVSS 4.8, Assimp)
- [CVE-2026-10231](https://cve.now/CVE-2026-10231.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract\_anim\_value heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10230](https://cve.now/CVE-2026-10230.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read\_animations heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10229](https://cve.now/CVE-2026-10229.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read\_meshes heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10228](https://cve.now/CVE-2026-10228.md): raisulislamg4 student\_management\_system\_by\_php admission\_form\_check.php cross site scripting (CVSS 5.1, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10227](https://cve.now/CVE-2026-10227.md): raisulislamg4 student\_management\_system\_by\_php User Creation add\_user\_check.php sql injection (CVSS 6.9, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10226](https://cve.now/CVE-2026-10226.md): raisulislamg4 student\_management\_system\_by\_php delete.php sql injection (CVSS 6.9, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10225](https://cve.now/CVE-2026-10225.md): raisulislamg4 student\_management\_system\_by\_php Login login\_check.php sql injection (CVSS 6.9, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10224](https://cve.now/CVE-2026-10224.md): NousResearch hermes-agent Webhook Endpoint feishu.py \_handle\_webhook\_request resource consumption (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-10223](https://cve.now/CVE-2026-10223.md): NousResearch hermes-agent memory\_tool.py \_scan\_memory\_content injection (CVSS 5.3, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-10222](https://cve.now/CVE-2026-10222.md): NousResearch hermes-agent config.py \_sanitize\_env\_lines injection (CVSS 6.3, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-10221](https://cve.now/CVE-2026-10221.md): NousResearch hermes-agent run\_agent.py \_compress\_context injection (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-48187](https://cve.now/CVE-2026-48187.md): Email with special content can lead to DoS (CVSS 5.7, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-48188](https://cve.now/CVE-2026-48188.md): SQL Injection via MySQL Quote Method (CVSS 9.1, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-48189](https://cve.now/CVE-2026-48189.md): Bypass DedicatedAgentToCustomerGroups Setting (CVSS 5.7, OTRS AG OTRS)
- [CVE-2026-48190](https://cve.now/CVE-2026-48190.md): Incorrect handling of permissions in External Interface Config Item List module (CVSS 3.5, OTRS AG OTRS)
- [CVE-2026-48191](https://cve.now/CVE-2026-48191.md): Wrong Permission Handling in Document Search Article Meta Filters (CVSS 3.5, OTRS AG OTRS)
- [CVE-2026-48208](https://cve.now/CVE-2026-48208.md): Denial-of-Service via SVG Rendering in Ticket (CVSS 6.5, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-48209](https://cve.now/CVE-2026-48209.md): Reflected XSS in authenticated agent context (CVSS 7.1, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-10220](https://cve.now/CVE-2026-10220.md): NousResearch hermes-agent skills\_tool.py skill\_view injection (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-20456](https://cve.now/CVE-2026-20456.md): In wlan STA driver, there is a possible system crash due to a missing bounds check. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20455](https://cve.now/CVE-2026-20455.md): In geniezone, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek chipset)
- [CVE-2026-20454](https://cve.now/CVE-2026-20454.md): In geniezone, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek chipset)
- [CVE-2026-20453](https://cve.now/CVE-2026-20453.md): In geniezone, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20452](https://cve.now/CVE-2026-20452.md): In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow. (CVSS 8.0, MediaTek chipset)
- [CVE-2026-10219](https://cve.now/CVE-2026-10219.md): nextlevelbuilder GoClaw write\_file Tool fsbridge.go FsBridge.WriteFile os command injection (CVSS 6.9, nextlevelbuilder GoClaw · github.com/nextlevelbuilder/goclaw)
- [CVE-2026-10218](https://cve.now/CVE-2026-10218.md): nextlevelbuilder GoClaw evolution\_handlers.go auth improper authorization (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-10217](https://cve.now/CVE-2026-10217.md): nextlevelbuilder GoClaw RoleAdmin Gateway tts\_config.go handleSave privileges management (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-10216](https://cve.now/CVE-2026-10216.md): unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication (CVSS 6.3, unitedbyai droidclaw)
- [CVE-2026-10215](https://cve.now/CVE-2026-10215.md): Dolibarr ERP CRM Leave Request REST API api\_holidays.class.php checkUserAccessToObject improper authorization (CVSS 5.3, Dolibarr ERP CRM · dolibarr/dolibarr)
- [CVE-2026-10214](https://cve.now/CVE-2026-10214.md): zhayujie chatgpt-on-wechat Bash Tool bash.py \_get\_safety\_warning os command injection (CVSS 6.9, zhayujie chatgpt-on-wechat)
- [CVE-2026-10213](https://cve.now/CVE-2026-10213.md): AstrBotDevs AstrBot API Endpoint delete path traversal (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-10212](https://cve.now/CVE-2026-10212.md): AstrBotDevs AstrBot astr\_main\_agent.py astr\_main\_agent authorization (CVSS 5.3, AstrBotDevs AstrBot · astrbot)
- [CVE-2026-10211](https://cve.now/CVE-2026-10211.md): AstrBotDevs AstrBot fs.py \_normalize\_rw\_path authorization (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-10210](https://cve.now/CVE-2026-10210.md): AstrBotDevs AstrBot skill\_manager.py \_sanitize\_prompt\_description injection (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-10209](https://cve.now/CVE-2026-10209.md): code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection (CVSS 5.3, code-projects Online Hospital Management System)
- [CVE-2026-10208](https://cve.now/CVE-2026-10208.md): code-projects Online Hospital Management System login\_1.php login\_user sql injection (CVSS 6.9, code-projects Online Hospital Management System)
- [CVE-2026-10206](https://cve.now/CVE-2026-10206.md): D-Link DI-8400 dbsrv.asp stack-based overflow (CVSS 8.7, D-Link DI-8400)
- [CVE-2026-10205](https://cve.now/CVE-2026-10205.md): Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-55664](https://cve.now/CVE-2025-55664.md): A heap buffer overflow in the m2tsdmx\_send\_packet function (filters/dmx\_m2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of… (CVSS 5.5)
- [CVE-2025-60481](https://cve.now/CVE-2025-60481.md): A NULL pointer dereference in the gf\_odf\_ac4\_cfg\_dsi\_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows… (CVSS 5.5)
- [CVE-2025-60483](https://cve.now/CVE-2025-60483.md): A NULL pointer dereference in the gf\_ac4\_pres\_b\_4\_back\_channels\_present function (/media\_tools/av\_parsers.c) of GPAC Project/MP4Box before… (CVSS 5.5)
- [CVE-2025-60485](https://cve.now/CVE-2025-60485.md): A segmentation violation in the gf\_isom\_apple\_set\_tag\_ex function (/isomedia/isom\_write.c) of GPAC Project/MP4Box before 26.02.0 allows… (CVSS 5.5)
- [CVE-2025-60486](https://cve.now/CVE-2025-60486.md): A heap use-after-free in the dasher\_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a… (CVSS 5.5)
- [CVE-2025-60495](https://cve.now/CVE-2025-60495.md): A segmentation violation in the gf\_media\_get\_color\_info function (/media\_tools/isom\_tools.c) of GPAC Project/MP4Box before 26.02.0 allows… (CVSS 5.5)
- [CVE-2025-70099](https://cve.now/CVE-2025-70099.md): A NULL pointer dereference in the ext4\_dir\_en\_get\_name\_len function in include/ext4\_dir.h of lwext4 1.0.0 allows attackers to cause a… (CVSS 7.5)
- [CVE-2026-37220](https://cve.now/CVE-2026-37220.md): FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2\_SETUP\_REQUEST is sent. (CVSS 7.5)
- [CVE-2026-37221](https://cve.now/CVE-2026-37221.md): FlexRIC v2.0.0 crashes when receiving a RIC\_SUBSCRIPTION\_RESPONSE with an unknown ric\_id that has no corresponding pending event. (CVSS 7.5)
- [CVE-2026-37222](https://cve.now/CVE-2026-37222.md): FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. (CVSS 7.5)
- [CVE-2026-37223](https://cve.now/CVE-2026-37223.md): FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. (CVSS 7.5)
- [CVE-2026-37224](https://cve.now/CVE-2026-37224.md): FlexRIC v2.0.0 crashes when receiving a duplicate E2\_SETUP\_REQUEST from the same or spoofed E2 Node. (CVSS 7.5)
- [CVE-2026-37225](https://cve.now/CVE-2026-37225.md): FlexRIC v2.0.0 crashes when the iApp receives an E42\_RIC\_SUBSCRIPTION\_REQUEST with an empty ricEventTriggerDefinition field. (CVSS 7.5)
- [CVE-2026-37226](https://cve.now/CVE-2026-37226.md): FlexRIC v2.0.0 crashes when the iApp receives an E42\_RIC\_SUBSCRIPTION\_REQUEST referencing a non-existent E2 Node. (CVSS 7.5)
- [CVE-2026-37227](https://cve.now/CVE-2026-37227.md): FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the… (CVSS 7.5)
- [CVE-2026-37228](https://cve.now/CVE-2026-37228.md): FlexRIC v2.0.0 contains a reachable assertion in e2ap\_recv\_sctp\_msg() (src/lib/ep/e2ap\_ep.c). (CVSS 7.5)
- [CVE-2026-37229](https://cve.now/CVE-2026-37229.md): FlexRIC v2.0.0 contains a reachable assertion in e2ap\_create\_pdu() triggered when ASN.1 PER decoding fails. (CVSS 7.5)
- [CVE-2026-37230](https://cve.now/CVE-2026-37230.md): FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC\_INDICATION message with a ran\_func\_id that does not exist in its registry. (CVSS 7.5)
- [CVE-2026-37231](https://cve.now/CVE-2026-37231.md): FlexRIC v2.0.0 uses a uint16\_t counter for xapp\_id assignment but stores the value in uint32\_t message fields. (CVSS 7.5)
- [CVE-2026-37232](https://cve.now/CVE-2026-37232.md): An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. (CVSS 8.6)
- [CVE-2026-37233](https://cve.now/CVE-2026-37233.md): FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. (CVSS 7.5)
- [CVE-2026-37234](https://cve.now/CVE-2026-37234.md): FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp\_ids by sending multiple E42\_SETUP\_REQUESTs. (CVSS 8.2)
- [CVE-2026-37235](https://cve.now/CVE-2026-37235.md): FlexRIC v2.0.0 trusts the xapp\_id field from E42 message payloads without binding it to the sender's SCTP association. (CVSS 7.5)
- [CVE-2026-38950](https://cve.now/CVE-2026-38950.md): An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.