# CVEs published 2026-06-24

521 CVEs were published on June 24, 2026: 56 critical, 210 high. Days are UTC.

- [CVE-2026-8663](https://cve.now/CVE-2026-8663.md): OS Command Injection in Rapid7 InsightConnect RPM Plugin (CVSS 6.0, Rapid7 InsightConnect RPM Plugin)
- [CVE-2026-40079](https://cve.now/CVE-2026-40079.md): Cacti: Command Injection via escape\_command() no-op in RRDtool execution (CVSS 8.6, cacti)
- [CVE-2026-7569](https://cve.now/CVE-2026-7569.md): Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9787](https://cve.now/CVE-2026-9787.md): Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9786](https://cve.now/CVE-2026-9786.md): Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9785](https://cve.now/CVE-2026-9785.md): Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9784](https://cve.now/CVE-2026-9784.md): Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9783](https://cve.now/CVE-2026-9783.md): Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-39951](https://cve.now/CVE-2026-39951.md): Cacti: Stored SQL Injection via graph\_name\_regexp in Reports feature (CVSS 7.6, cacti)
- [CVE-2026-9782](https://cve.now/CVE-2026-9782.md): Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9781](https://cve.now/CVE-2026-9781.md): Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9780](https://cve.now/CVE-2026-9780.md): Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-7570](https://cve.now/CVE-2026-7570.md): Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-39948](https://cve.now/CVE-2026-39948.md): Cacti has SQL Injection via rfilter parameter in RLIKE clauses (CVSS 9.3, cacti)
- [CVE-2026-39955](https://cve.now/CVE-2026-39955.md): Cacti has Pre-Authentication SQL Injection via unanchored FILTER\_VALIDATE\_REGEXP in graph\_view.php (CVSS 9.8, cacti)
- [CVE-2026-39938](https://cve.now/CVE-2026-39938.md): Cacti: Unauthenticated RCE on Graph Image (CVSS 9.8, cacti)
- [CVE-2026-39900](https://cve.now/CVE-2026-39900.md): Cacti: Reflected XSS via tab parameter in auth\_profile.php JavaScript context (CVSS 5.3, cacti)
- [CVE-2026-39899](https://cve.now/CVE-2026-39899.md): Cacti: Path Traversal via filename parameter in package\_import.php (CVSS 6.9, cacti)
- [CVE-2026-39897](https://cve.now/CVE-2026-39897.md): Cacti has a Reflected XSS Vulnerability via html\_auth\_footer (CVSS 5.3, cacti)
- [CVE-2026-39894](https://cve.now/CVE-2026-39894.md): Cacti: RRDtool metric shift via LC\_NUMERIC locale comma decimal formatting (CVSS 2.9, cacti)
- [CVE-2026-39893](https://cve.now/CVE-2026-39893.md): Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph\_view.php (CVSS 9.8, cacti)
- [CVE-2026-2050](https://cve.now/CVE-2026-2050.md): GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-49979](https://cve.now/CVE-2026-49979.md): Appsmith: SSRF via \`POST /api/v1/admin/send-test-email\` — JavaMail Bypasses WebClient IP Filter (CVSS 5.1, appsmithorg appsmith)
- [CVE-2026-55454](https://cve.now/CVE-2026-55454.md): Appsmith: Caddy admin API exposed without authentication (CVSS 9.9, appsmithorg appsmith)
- [CVE-2026-9779](https://cve.now/CVE-2026-9779.md): ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability (CVSS 7.2, ATEN Unizon)
- [CVE-2026-9778](https://cve.now/CVE-2026-9778.md): ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, ATEN Unizon)
- [CVE-2026-9777](https://cve.now/CVE-2026-9777.md): ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, ATEN Unizon)
- [CVE-2026-9776](https://cve.now/CVE-2026-9776.md): ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, ATEN Unizon)
- [CVE-2026-9775](https://cve.now/CVE-2026-9775.md): ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 5.5, ATEN Unizon)
- [CVE-2026-9774](https://cve.now/CVE-2026-9774.md): ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 5.5, ATEN Unizon)
- [CVE-2026-55455](https://cve.now/CVE-2026-55455.md): Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist (CVSS 5.3, appsmithorg appsmith)
- [CVE-2026-10043](https://cve.now/CVE-2026-10043.md): MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, MosaicML Composer)
- [CVE-2026-9773](https://cve.now/CVE-2026-9773.md): Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Unraid)
- [CVE-2026-9772](https://cve.now/CVE-2026-9772.md): Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Unraid)
- [CVE-2026-50189](https://cve.now/CVE-2026-50189.md): Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route (CVSS 8.9, appsmithorg appsmith)
- [CVE-2026-10642](https://cve.now/CVE-2026-10642.md): Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-53765](https://cve.now/CVE-2026-53765.md): chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory (CVSS 6.1, ChromeDevTools chrome-devtools-mcp · chrome-devtools-mcp)
- [CVE-2026-53766](https://cve.now/CVE-2026-53766.md): chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots (CVSS 6.1, ChromeDevTools chrome-devtools-mcp · chrome-devtools-mcp)
- [CVE-2026-52794](https://cve.now/CVE-2026-52794.md): Sentry: Inefficient Regular Expression Complexity in sentry (CVSS 7.5, getsentry sentry)
- [CVE-2026-55570](https://cve.now/CVE-2026-55570.md): SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped \`data-obj\` attribute (Bypass for CVE-2026-45375's patch) (CVSS 9.0, siyuan-note siyuan)
- [CVE-2026-54759](https://cve.now/CVE-2026-54759.md): SiYuan: Lute HTML sanitizer allows \`\<iframe\>\` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron… (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-47110](https://cve.now/CVE-2026-47110.md): Tiptap for PHP \< 2.1.1 DoS via Malformed href Attribute (CVSS 7.1, ueberdosis tiptap-php · ueberdosis/tiptap-php)
- [CVE-2026-50551](https://cve.now/CVE-2026-50551.md): SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54158](https://cve.now/CVE-2026-54158.md): SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54070](https://cve.now/CVE-2026-54070.md): SiYuan: Stored XSS in Bazaar marketplace via package README event handlers (CVSS 7.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54069](https://cve.now/CVE-2026-54069.md): SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54068](https://cve.now/CVE-2026-54068.md): SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon (CVSS 5.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54067](https://cve.now/CVE-2026-54067.md): SiYuan: Stored XSS to RCE via CSS-snippet \<style\> breakout in renderSnippet() (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54066](https://cve.now/CVE-2026-54066.md): SiYuan: Path Traversal via Double URL Encoding in /assets/\*path (publish mode arbitrary file─read) (CVSS 7.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-55762](https://cve.now/CVE-2026-55762.md): Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected \`/api/v1/fingerprint\`… (CVSS 8.1, RocketChat Rocket.Chat)
- [CVE-2026-55759](https://cve.now/CVE-2026-55759.md): Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay (CVSS 7.4, RocketChat Rocket.Chat)
- [CVE-2026-55666](https://cve.now/CVE-2026-55666.md): Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth (CVSS 9.3, RocketChat Rocket.Chat)
- [CVE-2026-49278](https://cve.now/CVE-2026-49278.md): Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation (CVSS 6.7, RocketChat Rocket.Chat)
- [CVE-2026-49277](https://cve.now/CVE-2026-49277.md): Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation (CVSS 2.3, RocketChat Rocket.Chat)
- [CVE-2026-45757](https://cve.now/CVE-2026-45757.md): Rocket.Chat: users.deactivateIdle\` deactivates accounts without revoking existing login tokens (CVSS 2.3, RocketChat Rocket.Chat)
- [CVE-2026-33543](https://cve.now/CVE-2026-33543.md): FOSSBilling: Authentication bypass allows unauthenticated administrator creation (CVSS 9.3, FOSSBilling)
- [CVE-2026-46423](https://cve.now/CVE-2026-46423.md): Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty (CVSS 9.3, RocketChat Rocket.Chat)
- [CVE-2026-45689](https://cve.now/CVE-2026-45689.md): Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO (CVSS 9.1, RocketChat Rocket.Chat)
- [CVE-2026-45688](https://cve.now/CVE-2026-45688.md): Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack (CVSS 9.1, RocketChat Rocket.Chat)
- [CVE-2026-45687](https://cve.now/CVE-2026-45687.md): Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage (CVSS 8.5, RocketChat Rocket.Chat)
- [CVE-2026-45677](https://cve.now/CVE-2026-45677.md): Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS (CVSS 8.7, RocketChat Rocket.Chat)
- [CVE-2026-33235](https://cve.now/CVE-2026-33235.md): AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features (CVSS 7.7, Significant-Gravitas AutoGPT)
- [CVE-2026-47733](https://cve.now/CVE-2026-47733.md): Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images (CVSS 4.4, RocketChat Rocket.Chat)
- [CVE-2026-32315](https://cve.now/CVE-2026-32315.md): motionEye: World-Readable Configuration File Exposes Admin Password Hash (CVSS 5.5, motioneye-project motioneye · motioneye)
- [CVE-2026-13208](https://cve.now/CVE-2026-13208.md): Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body (CVSS 6.5, Red Hat OpenShift Virtualization)
- [CVE-2026-13201](https://cve.now/CVE-2026-13201.md): Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption (CVSS 7.3, Red Hat Container Native Virtualization)
- [CVE-2026-52797](https://cve.now/CVE-2026-52797.md): Gogs: Overwriting critical files results in a denial of service (CVSS 8.5, gogs · gogs.io/gogs)
- [CVE-2026-52813](https://cve.now/CVE-2026-52813.md): Gogs: Path Traversal in organization name results in RCE through Git hooks (CVSS 10.0, gogs · gogs.io/gogs)
- [CVE-2026-52812](https://cve.now/CVE-2026-52812.md): Gogs: LFS dedupe path leaks private repo content across tenants (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-52811](https://cve.now/CVE-2026-52811.md): Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym (CVSS 9.0, gogs · gogs.io/gogs)
- [CVE-2026-52810](https://cve.now/CVE-2026-52810.md): Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-11998](https://cve.now/CVE-2026-11998.md): AngularJS XSS via SCE resource URL sanitization bypass (CVSS 7.6, Google angular · angular)
- [CVE-2026-52809](https://cve.now/CVE-2026-52809.md): Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET\_PASSWORD\_CODE\_LIVES (CVSS 6.8, gogs · gogs.io/gogs)
- [CVE-2026-31978](https://cve.now/CVE-2026-31978.md): motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint (CVSS 6.5, motioneye-project motioneye · motioneye)
- [CVE-2026-52808](https://cve.now/CVE-2026-52808.md): Gogs: Write-level collaborators can mutate admin-only repository settings via API (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-52816](https://cve.now/CVE-2026-52816.md): Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS (CVSS 5.4, gogs · gogs.io/gogs)
- [CVE-2026-52807](https://cve.now/CVE-2026-52807.md): Gogs: DOM-based XSS via Milestone Name on New Issue Page (CVSS 4.8, gogs · gogs.io/gogs)
- [CVE-2026-52805](https://cve.now/CVE-2026-52805.md): Gogs: Migration Redirect Bypass Leads to Internal Repository Theft (CVSS 8.7, gogs · gogs.io/gogs)
- [CVE-2026-52806](https://cve.now/CVE-2026-52806.md): Gogs: RCE via git rebase --exec argument injection in pull request merge (CVSS 9.9, gogs · gogs.io/gogs)
- [CVE-2026-52804](https://cve.now/CVE-2026-52804.md): Gogs: Privilege Escalation via Collaboration Access Mode Validation (CVSS 5.5, gogs · gogs.io/gogs)
- [CVE-2026-52799](https://cve.now/CVE-2026-52799.md): Gogs: Missing Authorization in Attachment Download (CVSS 7.5, gogs · gogs.io/gogs)
- [CVE-2026-52801](https://cve.now/CVE-2026-52801.md): Gogs: Ability to import local repositories via Mirror Settings (CVSS 8.1, gogs · gogs.io/gogs)
- [CVE-2026-52800](https://cve.now/CVE-2026-52800.md): Gogs: CSRF Leading to Organization Owner Takeover (CVSS 8.8, gogs · gogs.io/gogs)
- [CVE-2026-52802](https://cve.now/CVE-2026-52802.md): Gogs: Open Redirect via redirect\_to in Gogs (CVSS 5.4, gogs · gogs.io/gogs)
- [CVE-2026-52814](https://cve.now/CVE-2026-52814.md): Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) (CVSS 5.5, gogs · gogs.io/gogs)
- [CVE-2026-52798](https://cve.now/CVE-2026-52798.md): Gogs: Stored XSS in \`.ipynb\` Preview (CVSS 8.9, gogs · gogs.io/gogs)
- [CVE-2026-52796](https://cve.now/CVE-2026-52796.md): Gogs: DoS in rendering issue index pattern (CVSS 3.5, gogs · gogs.io/gogs)
- [CVE-2026-47267](https://cve.now/CVE-2026-47267.md): Gogs: SSRF in webhook deliveries (CVSS 8.3, gogs · gogs.io/gogs)
- [CVE-2026-25119](https://cve.now/CVE-2026-25119.md): Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers (CVSS 7.7, gogs · gogs.io/gogs)
- [CVE-2026-52795](https://cve.now/CVE-2026-52795.md): Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity (CVSS 4.3, gogs)
- [CVE-2025-64719](https://cve.now/CVE-2025-64719.md): Gogs: Denial of Service in repository/wiki file listing web pages (CVSS 4.9, gogs · gogs.io/gogs)
- [CVE-2026-52815](https://cve.now/CVE-2026-52815.md): Gogs: Unauthenticated Organization Teams Information Disclosure via API (CVSS 5.5, gogs · gogs.io/gogs)
- [CVE-2026-50129](https://cve.now/CVE-2026-50129.md): Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH\_TRANSFORMER (CVSS 7.5, mastodon)
- [CVE-2026-50128](https://cve.now/CVE-2026-50128.md): Mastodon: Spoofing of attribution domains (CVSS 5.3, mastodon)
- [CVE-2026-1840](https://cve.now/CVE-2026-1840.md): Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface (CVSS 8.7, Hubbell Aclara Metrum Cellular Web Interface)
- [CVE-2026-7539](https://cve.now/CVE-2026-7539.md): HP Dock Accessory WMI Provider Installer Security Update (CVSS 7.3, HP Dock Accessory)
- [CVE-2026-48028](https://cve.now/CVE-2026-48028.md): Mastodon: Removal of integrity-protected JSON entries from signed activities (CVSS 6.5, mastodon)
- [CVE-2026-47389](https://cve.now/CVE-2026-47389.md): Mastodon: SSRF protection bypass on older Ruby versions (CVSS 8.6, mastodon)
- [CVE-2026-46349](https://cve.now/CVE-2026-46349.md): Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring (CVSS 5.3, mastodon)
- [CVE-2026-46348](https://cve.now/CVE-2026-46348.md): Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) (CVSS 8.7, mastodon)
- [CVE-2026-27708](https://cve.now/CVE-2026-27708.md): FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access (CVSS 7.1, FOSSBilling)
- [CVE-2026-55583](https://cve.now/CVE-2026-55583.md): Twenty: Cross-workspace IDOR in AgentTurnResolver (CVSS 7.6, twentyhq twenty)
- [CVE-2026-23879](https://cve.now/CVE-2026-23879.md): py7zr: Arbitrary File Write Vulnerability (CVSS 8.0, miurahr py7zr · py7zr)
- [CVE-2026-13037](https://cve.now/CVE-2026-13037.md): Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a… (CVSS 7.8, Google Chrome)
- [CVE-2026-13036](https://cve.now/CVE-2026-13036.md): Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-13035](https://cve.now/CVE-2026-13035.md): Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-13034](https://cve.now/CVE-2026-13034.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the… (CVSS 4.7, Google Chrome)
- [CVE-2026-13031](https://cve.now/CVE-2026-13031.md): Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-13030](https://cve.now/CVE-2026-13030.md): Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive… (CVSS 5.3, Google Chrome)
- [CVE-2026-13029](https://cve.now/CVE-2026-13029.md): Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a… (CVSS 7.5, Google Chrome)
- [CVE-2026-13027](https://cve.now/CVE-2026-13027.md): Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2026-13026](https://cve.now/CVE-2026-13026.md): Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit… (CVSS 8.8, Google Chrome)
- [CVE-2026-13025](https://cve.now/CVE-2026-13025.md): Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-13024](https://cve.now/CVE-2026-13024.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had… (CVSS 4.2, Google Chrome)
- [CVE-2026-13023](https://cve.now/CVE-2026-13023.md): Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to… (CVSS 5.3, Google Chrome)
- [CVE-2026-13022](https://cve.now/CVE-2026-13022.md): Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the… (CVSS 3.1, Google Chrome)
- [CVE-2026-13021](https://cve.now/CVE-2026-13021.md): Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass… (CVSS 4.3, Google Chrome)
- [CVE-2026-13038](https://cve.now/CVE-2026-13038.md): Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-13033](https://cve.now/CVE-2026-13033.md): Out of bounds read and write in Blink\>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute… (CVSS 8.8, Google Chrome)
- [CVE-2026-13032](https://cve.now/CVE-2026-13032.md): Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox… (CVSS 9.6, Google Chrome)
- [CVE-2026-13028](https://cve.now/CVE-2026-13028.md): Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox… (CVSS 9.6, Google Chrome)
- [CVE-2026-49220](https://cve.now/CVE-2026-49220.md): Jellyfin: Potential XSS in user management (CVSS 5.7, jellyfin)
- [CVE-2026-48793](https://cve.now/CVE-2026-48793.md): Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path (CVSS 8.8, jellyfin)
- [CVE-2026-49246](https://cve.now/CVE-2026-49246.md): Jellyfin: Potential MKV attachment filename path traversal to RCE (CVSS 1.7, jellyfin)
- [CVE-2026-49247](https://cve.now/CVE-2026-49247.md): Jellyfin: Potential Authenticated path traversal in /ClientLog/Document (CVSS 8.8, jellyfin)
- [CVE-2026-53943](https://cve.now/CVE-2026-53943.md): Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header (CVSS 9.6, TryGhost Ghost · ghost)
- [CVE-2026-12760](https://cve.now/CVE-2026-12760.md): Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200 (CVSS 7.1, TP-Link Systems Tapo C200)
- [CVE-2026-53944](https://cve.now/CVE-2026-53944.md): Ghost: Private IP filtering bypass to make server-side requests to internal services (CVSS 5.8, TryGhost Ghost · ghost)
- [CVE-2026-53945](https://cve.now/CVE-2026-53945.md): Ghost: Server-side request forgery via DNS rebinding in external request handling (CVSS 4.0, TryGhost Ghost · ghost)
- [CVE-2026-53946](https://cve.now/CVE-2026-53946.md): Ghost: Mobiledoc image-size fetch SSRF (CVSS 5.4, TryGhost Ghost · ghost)
- [CVE-2026-53947](https://cve.now/CVE-2026-53947.md): Ghost: Member existence leak via magic link sign-in response (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-53948](https://cve.now/CVE-2026-53948.md): Ghost: File Upload Content-Type Spoofing (CVSS 5.4, TryGhost Ghost · ghost)
- [CVE-2026-53949](https://cve.now/CVE-2026-53949.md): Ghost Content API filter bypass reveals private fields (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-53950](https://cve.now/CVE-2026-53950.md): @tryghost/activitypub: XSS in Ghost's ActivityPub client (CVSS 7.5, TryGhost Ghost · @tryghost/activitypub)
- [CVE-2026-49980](https://cve.now/CVE-2026-49980.md): Rclone: Unauthenticated command execution in \`rclone rcd --rc-serve\` via inline remote instantiation, bypassing CVE-2026-41179 fix (CVSS 9.8, rclone · github.com/rclone/rclone +1)
- [CVE-2026-44017](https://cve.now/CVE-2026-44017.md): Docling: Unsafe Zip Extraction in EasyOCR Model Download (CVSS 7.5, docling-project docling · docling)
- [CVE-2026-44022](https://cve.now/CVE-2026-44022.md): Docling: Potential Path Traversal via LaTeX \\includegraphics and \\input Commands (CVSS 5.5, docling-project docling · docling)
- [CVE-2026-44020](https://cve.now/CVE-2026-44020.md): Docling: Unsafe XML Entity Expansion in USPTO Patent Backend (CVSS 7.5, docling-project docling · docling)
- [CVE-2026-44016](https://cve.now/CVE-2026-44016.md): Docling: Unsafe Playwright-based HTML Rendering (CVSS 8.2, docling-project docling · docling)
- [CVE-2026-48704](https://cve.now/CVE-2026-48704.md): Warp Markdown notebook links may open executable local files (CVSS 8.8, warpdotdev warp)
- [CVE-2026-48719](https://cve.now/CVE-2026-48719.md): Warp branch selector command injection via Git branch names (CVSS 8.0, warpdotdev warp)
- [CVE-2026-48720](https://cve.now/CVE-2026-48720.md): Warp: SSH remote output can lead to local file overwrite and persistence (CVSS 8.8, warpdotdev warp)
- [CVE-2026-48721](https://cve.now/CVE-2026-48721.md): Warp: Env-var prefixes can lead to denylisted command autoexecution (CVSS 8.6, warpdotdev warp)
- [CVE-2026-48731](https://cve.now/CVE-2026-48731.md): Warp: Linux external editor command injection (CVSS 7.8, warpdotdev warp)
- [CVE-2026-48732](https://cve.now/CVE-2026-48732.md): Warp: Remote SSH cwd can lead to unauthorized remote command execution (CVSS 8.8, warpdotdev warp)
- [CVE-2026-54686](https://cve.now/CVE-2026-54686.md): Warp: DCS lifecycle hook spoofing can alter terminal session metadata (CVSS 4.3, warpdotdev warp)
- [CVE-2026-54699](https://cve.now/CVE-2026-54699.md): Warp: OS command injection when opening terminal links from WSL (CVSS 7.7, warpdotdev warp)
- [CVE-2026-48703](https://cve.now/CVE-2026-48703.md): Warp: Command Injection via Warp code search tool arguments (CVSS 7.8, warpdotdev warp)
- [CVE-2026-48725](https://cve.now/CVE-2026-48725.md): Warp may allow terminal output to access the local clipboard through OSC 52 (CVSS 8.1, warpdotdev warp)
- [CVE-2026-55611](https://cve.now/CVE-2026-55611.md): AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) (CVSS 0.0, Mintplex-Labs anything-llm)
- [CVE-2026-48789](https://cve.now/CVE-2026-48789.md): AnythingLLM: Windows path containment bypass in document folder route (CVSS 4.3, Mintplex-Labs anything-llm)
- [CVE-2026-49851](https://cve.now/CVE-2026-49851.md): Mistune: Potential DoS via quadratic-time parsing in parse\_link\_text (CVSS 8.7, lepture mistune · mistune)
- [CVE-2026-53130](https://cve.now/CVE-2026-53130.md): fs/omfs: reject s\_sys\_blocksize smaller than OMFS\_DIR\_START (CVSS 7.8, Linux)
- [CVE-2026-53129](https://cve.now/CVE-2026-53129.md): fs/mbcache: cancel shrink work before destroying the cache (no CVSS, Linux)
- [CVE-2026-53128](https://cve.now/CVE-2026-53128.md): drbd: Balance RCU calls in drbd\_adm\_dump\_devices() (no CVSS, Linux)
- [CVE-2026-53127](https://cve.now/CVE-2026-53127.md): block: fix zones\_cond memory leak on zone revalidation error paths (no CVSS, Linux)
- [CVE-2026-53126](https://cve.now/CVE-2026-53126.md): blk-cgroup: fix disk reference leak in blkcg\_maybe\_throttle\_current() (no CVSS, Linux)
- [CVE-2026-53125](https://cve.now/CVE-2026-53125.md): md: fix array\_state=clear sysfs deadlock (no CVSS, Linux)
- [CVE-2026-53124](https://cve.now/CVE-2026-53124.md): ublk: reset per-IO canceled flag on each fetch (no CVSS, Linux)
- [CVE-2026-53123](https://cve.now/CVE-2026-53123.md): md: wake raid456 reshape waiters before suspend (no CVSS, Linux)
- [CVE-2026-53122](https://cve.now/CVE-2026-53122.md): btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (no CVSS, Linux)
- [CVE-2026-53121](https://cve.now/CVE-2026-53121.md): amd-pstate: Fix memory leak in amd\_pstate\_epp\_cpu\_init() (no CVSS, Linux)
- [CVE-2026-53120](https://cve.now/CVE-2026-53120.md): PCI: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53119](https://cve.now/CVE-2026-53119.md): platform/wmi: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53118](https://cve.now/CVE-2026-53118.md): vdpa: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53117](https://cve.now/CVE-2026-53117.md): s390/cio: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53116](https://cve.now/CVE-2026-53116.md): s390/ap: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53115](https://cve.now/CVE-2026-53115.md): bus: fsl-mc: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53114](https://cve.now/CVE-2026-53114.md): perf/amd/ibs: Avoid calling perf\_allow\_kernel() from the IBS NMI handler (no CVSS, Linux)
- [CVE-2026-53113](https://cve.now/CVE-2026-53113.md): wifi: ath11k: fix memory leaks in beacon template setup (no CVSS, Linux)
- [CVE-2026-53112](https://cve.now/CVE-2026-53112.md): wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq\_prepare\_bcn\_tasklet (no CVSS, Linux)
- [CVE-2026-53111](https://cve.now/CVE-2026-53111.md): bpf: test\_run: Fix the null pointer dereference issue in bpf\_lwt\_xmit\_push\_encap (no CVSS, Linux)
- [CVE-2026-53110](https://cve.now/CVE-2026-53110.md): s390/bpf: Zero-extend bpf prog return values and kfunc arguments (CVSS 7.8, Linux)
- [CVE-2026-53109](https://cve.now/CVE-2026-53109.md): powerpc/pgtable-frag: Fix bad page state in pte\_frag\_destroy (no CVSS, Linux)
- [CVE-2026-53108](https://cve.now/CVE-2026-53108.md): powerpc/64s: Fix unmap race with PMD migration entries (no CVSS, Linux)
- [CVE-2026-53107](https://cve.now/CVE-2026-53107.md): wifi: libertas: don't kill URBs in interrupt context (no CVSS, Linux)
- [CVE-2026-53106](https://cve.now/CVE-2026-53106.md): bpf: Do not allow deleting local storage in NMI (no CVSS, Linux)
- [CVE-2026-53105](https://cve.now/CVE-2026-53105.md): wifi: mt76: mt7925: prevent NULL vif dereference in mt7925\_mac\_write\_txwi (no CVSS, Linux)
- [CVE-2026-53104](https://cve.now/CVE-2026-53104.md): wifi: mt76: Fix memory leak destroying device (no CVSS, Linux)
- [CVE-2026-53103](https://cve.now/CVE-2026-53103.md): wifi: mt76: mt7925: fix potential deadlock in mt7925\_roc\_abort\_sync (no CVSS, Linux)
- [CVE-2026-53102](https://cve.now/CVE-2026-53102.md): wifi: mt76: Fix memory leak after mt76\_connac\_mcu\_alloc\_sta\_req() (no CVSS, Linux)
- [CVE-2026-53101](https://cve.now/CVE-2026-53101.md): wifi: mt76: mt7921: fix potential deadlock in mt7921\_roc\_abort\_sync (no CVSS, Linux)
- [CVE-2026-53100](https://cve.now/CVE-2026-53100.md): wifi: mt76: fix deadlock in remain-on-channel (no CVSS, Linux)
- [CVE-2026-53099](https://cve.now/CVE-2026-53099.md): bpf: Switch CONFIG\_CFI\_CLANG to CONFIG\_CFI (no CVSS, Linux)
- [CVE-2026-53098](https://cve.now/CVE-2026-53098.md): wifi: mt76: mt7915: fix use-after-free bugs in mt7915\_mac\_dump\_work() (no CVSS, Linux)
- [CVE-2026-53097](https://cve.now/CVE-2026-53097.md): wifi: mt76: mt7996: fix use-after-free bugs in mt7996\_mac\_dump\_work() (no CVSS, Linux)
- [CVE-2026-53096](https://cve.now/CVE-2026-53096.md): bpf: Use RCU-safe iteration in dev\_map\_redirect\_multi() SKB path (CVSS 7.8, Linux)
- [CVE-2026-53095](https://cve.now/CVE-2026-53095.md): bpf: Fix abuse of kprobe\_write\_ctx via freplace (no CVSS, Linux)
- [CVE-2026-53094](https://cve.now/CVE-2026-53094.md): bpf: Fix stale offload-\>prog pointer after constant blinding (CVSS 7.8, Linux)
- [CVE-2026-53093](https://cve.now/CVE-2026-53093.md): wifi: brcmfmac: Fix error pointer dereference (no CVSS, Linux)
- [CVE-2026-53092](https://cve.now/CVE-2026-53092.md): bpf: Fix linked reg delta tracking when src\_reg == dst\_reg (CVSS 7.8, Linux)
- [CVE-2026-53091](https://cve.now/CVE-2026-53091.md): net: pull headers in qdisc\_pkt\_len\_segs\_init() (CVSS 8.4, Linux)
- [CVE-2026-53090](https://cve.now/CVE-2026-53090.md): bpf: Fix ld\_{abs,ind} failure path analysis in subprogs (CVSS 7.8, Linux)
- [CVE-2026-53089](https://cve.now/CVE-2026-53089.md): bpf: Fix use-after-free in offloaded map/prog info fill (no CVSS, Linux)
- [CVE-2026-53088](https://cve.now/CVE-2026-53088.md): net: bcmgenet: fix off-by-one in bcmgenet\_put\_txcb (CVSS 9.8, Linux)
- [CVE-2026-53087](https://cve.now/CVE-2026-53087.md): net: bcmgenet: fix leaking free\_bds (CVSS 7.5, Linux)
- [CVE-2026-53086](https://cve.now/CVE-2026-53086.md): net: bcmgenet: fix racing timeout handler (CVSS 9.8, Linux)
- [CVE-2026-53085](https://cve.now/CVE-2026-53085.md): bpf: fix mm lifecycle in open-coded task\_vma iterator (CVSS 7.8, Linux)
- [CVE-2026-53084](https://cve.now/CVE-2026-53084.md): bpf: return VMA snapshot from task\_vma iterator (no CVSS, Linux)
- [CVE-2026-53083](https://cve.now/CVE-2026-53083.md): bpf: Fix RCU stall in bpf\_fd\_array\_map\_clear() (no CVSS, Linux)
- [CVE-2026-53082](https://cve.now/CVE-2026-53082.md): net: hamradio: 6pack: fix uninit-value in sixpack\_receive\_buf (no CVSS, Linux)
- [CVE-2026-53081](https://cve.now/CVE-2026-53081.md): bpf: Enforce regsafe base id consistency for BPF\_ADD\_CONST scalars (CVSS 7.8, Linux)
- [CVE-2026-53080](https://cve.now/CVE-2026-53080.md): net/sched: cls\_fw: fix NULL dereference of "old" filters before change() (no CVSS, Linux)
- [CVE-2026-53079](https://cve.now/CVE-2026-53079.md): net\_sched: fix skb memory leak in deferred qdisc drops (no CVSS, Linux)
- [CVE-2026-53078](https://cve.now/CVE-2026-53078.md): bpf: Fix same-register dst/src OOB read and pointer leak in sock\_ops (CVSS 7.8, Linux)
- [CVE-2026-53077](https://cve.now/CVE-2026-53077.md): net/rds: Restrict use of RDS/IB to the initial network namespace (CVSS 7.8, Linux)
- [CVE-2026-53076](https://cve.now/CVE-2026-53076.md): bpf: Fix OOB in pcpu\_init\_value (CVSS 7.1, Linux)
- [CVE-2026-53075](https://cve.now/CVE-2026-53075.md): ppp: require CAP\_NET\_ADMIN in target netns for unattached ioctls (CVSS 8.8, Linux)
- [CVE-2026-53074](https://cve.now/CVE-2026-53074.md): bpf: reject short IPv4/IPv6 inputs in bpf\_prog\_test\_run\_skb (no CVSS, Linux)
- [CVE-2026-53073](https://cve.now/CVE-2026-53073.md): Bluetooth: hci\_ldisc: Clear HCI\_UART\_PROTO\_INIT on error (no CVSS, Linux)
- [CVE-2026-53072](https://cve.now/CVE-2026-53072.md): Bluetooth: fix locking in hci\_conn\_request\_evt() with HCI\_PROTO\_DEFER (CVSS 8.8, Linux)
- [CVE-2026-53071](https://cve.now/CVE-2026-53071.md): Bluetooth: l2cap: Add missing chan lock in l2cap\_ecred\_reconf\_rsp (CVSS 8.8, Linux)
- [CVE-2026-53070](https://cve.now/CVE-2026-53070.md): sctp: disable BH before calling udp\_tunnel\_xmit\_skb() (CVSS 7.5, Linux)
- [CVE-2026-53069](https://cve.now/CVE-2026-53069.md): net, bpf: fix null-ptr-deref in xdp\_master\_redirect() for down master (CVSS 7.5, Linux)
- [CVE-2026-53068](https://cve.now/CVE-2026-53068.md): drm/komeda: fix integer overflow in AFBC framebuffer size check (CVSS 7.1, Linux)
- [CVE-2026-53067](https://cve.now/CVE-2026-53067.md): PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc (no CVSS, Linux)
- [CVE-2026-53066](https://cve.now/CVE-2026-53066.md): drm/sun4i: backend: fix error pointer dereference (no CVSS, Linux)
- [CVE-2026-53065](https://cve.now/CVE-2026-53065.md): ASoC: sti: use managed regmap\_field allocations (no CVSS, Linux)
- [CVE-2026-53064](https://cve.now/CVE-2026-53064.md): dm cache: fix null-deref with concurrent writes in passthrough mode (no CVSS, Linux)
- [CVE-2026-53063](https://cve.now/CVE-2026-53063.md): dm cache: fix write hang in passthrough mode (no CVSS, Linux)
- [CVE-2026-53062](https://cve.now/CVE-2026-53062.md): dm cache policy smq: fix missing locks in invalidating cache blocks (CVSS 7.8, Linux)
- [CVE-2026-53061](https://cve.now/CVE-2026-53061.md): dm cache: fix dirty mapping checking in passthrough mode switching (no CVSS, Linux)
- [CVE-2026-53060](https://cve.now/CVE-2026-53060.md): dm cache metadata: fix memory leak on metadata abort retry (no CVSS, Linux)
- [CVE-2026-53059](https://cve.now/CVE-2026-53059.md): dm log: fix out-of-bounds write due to region\_count overflow (CVSS 6.3, Linux)
- [CVE-2026-53058](https://cve.now/CVE-2026-53058.md): drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic\_enable() (no CVSS, Linux)
- [CVE-2026-53057](https://cve.now/CVE-2026-53057.md): iommu/riscv: Add IOTINVAL after updating DDT/PDT entries (CVSS 8.8, Linux)
- [CVE-2026-53056](https://cve.now/CVE-2026-53056.md): drm/msm/dpu: fix mismatch between power and frequency (no CVSS, Linux)
- [CVE-2026-53055](https://cve.now/CVE-2026-53055.md): crypto: hisilicon/sec2 - prevent req used-after-free for sec (CVSS 9.8, Linux)
- [CVE-2026-53054](https://cve.now/CVE-2026-53054.md): drm/msm: Fix VM\_BIND UNMAP locking (CVSS 7.8, Linux)
- [CVE-2026-53053](https://cve.now/CVE-2026-53053.md): iommu/amd: Fix clone\_alias() to use the original device's devid (CVSS 8.8, Linux)
- [CVE-2026-53052](https://cve.now/CVE-2026-53052.md): ASoC: qcom: qdsp6: topology: check widget type before accessing data (no CVSS, Linux)
- [CVE-2026-53051](https://cve.now/CVE-2026-53051.md): PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (no CVSS, Linux)
- [CVE-2026-53050](https://cve.now/CVE-2026-53050.md): quota: Fix race of dquot\_scan\_active() with quota deactivation (CVSS 7.8, Linux)
- [CVE-2026-53049](https://cve.now/CVE-2026-53049.md): gfs2: add some missing log locking (CVSS 9.8, Linux)
- [CVE-2026-53048](https://cve.now/CVE-2026-53048.md): gfs2: prevent NULL pointer dereference during unmount (no CVSS, Linux)
- [CVE-2026-53047](https://cve.now/CVE-2026-53047.md): efi/capsule-loader: fix incorrect sizeof in phys array reallocation (no CVSS, Linux)
- [CVE-2026-53046](https://cve.now/CVE-2026-53046.md): ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine (CVSS 9.8, Linux)
- [CVE-2026-53045](https://cve.now/CVE-2026-53045.md): memory: tegra124-emc: Fix dll\_change check (CVSS 9.8, Linux)
- [CVE-2026-53044](https://cve.now/CVE-2026-53044.md): soc/tegra: cbb: Fix incorrect ARRAY\_SIZE in fabric lookup tables (CVSS 7.1, Linux)
- [CVE-2026-53043](https://cve.now/CVE-2026-53043.md): ocfs2/dlm: validate qr\_numregions in dlm\_match\_regions() (CVSS 9.1, Linux)
- [CVE-2026-53042](https://cve.now/CVE-2026-53042.md): fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal (no CVSS, Linux)
- [CVE-2026-53041](https://cve.now/CVE-2026-53041.md): ocfs2: fix listxattr handling when the buffer is full (CVSS 7.1, Linux)
- [CVE-2026-53040](https://cve.now/CVE-2026-53040.md): ocfs2: validate bg\_bits during freefrag scan (CVSS 7.1, Linux)
- [CVE-2026-53039](https://cve.now/CVE-2026-53039.md): ocfs2: validate group add input before caching (no CVSS, Linux)
- [CVE-2026-53038](https://cve.now/CVE-2026-53038.md): ima\_fs: Correctly create securityfs files for unsupported hash algos (no CVSS, Linux)
- [CVE-2026-53037](https://cve.now/CVE-2026-53037.md): HID: usbhid: fix deadlock in hid\_post\_reset() (no CVSS, Linux)
- [CVE-2026-53036](https://cve.now/CVE-2026-53036.md): bpf, arm64: Fix off-by-one in check\_imm signed range check (CVSS 7.8, Linux)
- [CVE-2026-53035](https://cve.now/CVE-2026-53035.md): bpf, sockmap: Fix af\_unix iter deadlock (no CVSS, Linux)
- [CVE-2026-53034](https://cve.now/CVE-2026-53034.md): bpf, sockmap: Fix af\_unix null-ptr-deref in proto update (no CVSS, Linux)
- [CVE-2026-53033](https://cve.now/CVE-2026-53033.md): bpf, sockmap: Take state lock for af\_unix iter (CVSS 7.8, Linux)
- [CVE-2026-53032](https://cve.now/CVE-2026-53032.md): bpf: Fix NULL deref in map\_kptr\_match\_type for scalar regs (no CVSS, Linux)
- [CVE-2026-53031](https://cve.now/CVE-2026-53031.md): bpf: Validate node\_id in arena\_alloc\_pages() (CVSS 7.8, Linux)
- [CVE-2026-53030](https://cve.now/CVE-2026-53030.md): i3c: master: renesas: Fix memory leak in renesas\_i3c\_i3c\_xfers() (no CVSS, Linux)
- [CVE-2026-53029](https://cve.now/CVE-2026-53029.md): fs/ntfs3: prevent uninitialized lcn caused by zero len (no CVSS, Linux)
- [CVE-2026-53028](https://cve.now/CVE-2026-53028.md): usb: typec: Fix error pointer dereference (no CVSS, Linux)
- [CVE-2026-53027](https://cve.now/CVE-2026-53027.md): fs/ntfs3: fix missing run load for vcn0 in attr\_data\_get\_block\_locked() (no CVSS, Linux)
- [CVE-2026-53026](https://cve.now/CVE-2026-53026.md): NFSD: fix nfs4\_file access extra count in nfsd4\_add\_rdaccess\_to\_wrdeleg (CVSS 7.5, Linux)
- [CVE-2026-53025](https://cve.now/CVE-2026-53025.md): greybus: raw: fix use-after-free on cdev close (CVSS 7.8, Linux)
- [CVE-2026-53024](https://cve.now/CVE-2026-53024.md): greybus: raw: fix use-after-free if write is called after disconnect (CVSS 7.8, Linux)
- [CVE-2026-53023](https://cve.now/CVE-2026-53023.md): fs/ntfs3: terminate the cached volume label after UTF-8 conversion (no CVSS, Linux)
- [CVE-2026-53022](https://cve.now/CVE-2026-53022.md): platform/x86: dell-wmi-sysman: bound enumeration string aggregation (no CVSS, Linux)
- [CVE-2026-53021](https://cve.now/CVE-2026-53021.md): scsi: target: core: Fix integer overflow in UNMAP bounds check (no CVSS, Linux)
- [CVE-2026-53020](https://cve.now/CVE-2026-53020.md): um: Fix potential race condition in TLB sync (CVSS 7.8, Linux)
- [CVE-2026-53019](https://cve.now/CVE-2026-53019.md): clk: spacemit: ccu\_mix: fix inverted condition in ccu\_mix\_trigger\_fc() (no CVSS, Linux)
- [CVE-2026-53018](https://cve.now/CVE-2026-53018.md): f2fs: avoid reading already updated pages during GC (no CVSS, Linux)
- [CVE-2026-53017](https://cve.now/CVE-2026-53017.md): f2fs: fix data loss caused by incorrect use of nat\_entry flag (no CVSS, Linux)
- [CVE-2026-53016](https://cve.now/CVE-2026-53016.md): crypto: ccp - copy IV using skcipher ivsize (CVSS 7.8, Linux)
- [CVE-2026-53015](https://cve.now/CVE-2026-53015.md): erofs: unify lcn as u64 for 32-bit platforms (no CVSS, Linux)
- [CVE-2026-53014](https://cve.now/CVE-2026-53014.md): net/sched: act\_mirred: fix wrong device for mac\_header\_xmit check in tcf\_blockcast\_redir (no CVSS, Linux)
- [CVE-2026-53013](https://cve.now/CVE-2026-53013.md): macvlan: fix macvlan\_get\_size() not reserving space for IFLA\_MACVLAN\_BC\_CUTOFF (no CVSS, Linux)
- [CVE-2026-53012](https://cve.now/CVE-2026-53012.md): nexthop: fix IPv6 route referencing IPv4 nexthop (no CVSS, Linux)
- [CVE-2026-53011](https://cve.now/CVE-2026-53011.md): net/sched: taprio: fix use-after-free in advance\_sched() on schedule switch (CVSS 7.8, Linux)
- [CVE-2026-53010](https://cve.now/CVE-2026-53010.md): ksmbd: fix use-after-free in smb2\_open during durable reconnect (CVSS 9.8, Linux)
- [CVE-2026-53009](https://cve.now/CVE-2026-53009.md): ice: fix double-free of tx\_buf skb (CVSS 7.8, Linux)
- [CVE-2026-53008](https://cve.now/CVE-2026-53008.md): ice: fix race condition in TX timestamp ring cleanup (no CVSS, Linux)
- [CVE-2026-53007](https://cve.now/CVE-2026-53007.md): ice: fix potential NULL pointer deref in error path of ice\_set\_ringparam() (no CVSS, Linux)
- [CVE-2026-53006](https://cve.now/CVE-2026-53006.md): ipv6: fix possible UAF in icmpv6\_rcv() (CVSS 9.8, Linux)
- [CVE-2026-53005](https://cve.now/CVE-2026-53005.md): af\_unix: Drop all SCM attributes for SOCKMAP. (CVSS 7.8, Linux)
- [CVE-2026-53004](https://cve.now/CVE-2026-53004.md): sctp: fix OOB write to userspace in sctp\_getsockopt\_peer\_auth\_chunks (no CVSS, Linux)
- [CVE-2026-53003](https://cve.now/CVE-2026-53003.md): pppoe: drop PFC frames (CVSS 7.5, Linux)
- [CVE-2026-53002](https://cve.now/CVE-2026-53002.md): netfilter: conntrack: remove sprintf usage (CVSS 9.8, Linux)
- [CVE-2026-53001](https://cve.now/CVE-2026-53001.md): netfilter: xtables: restrict several matches to inet family (no CVSS, Linux)
- [CVE-2026-53000](https://cve.now/CVE-2026-53000.md): netfilter: nat: use kfree\_rcu to release ops (CVSS 7.8, Linux)
- [CVE-2026-52999](https://cve.now/CVE-2026-52999.md): netfilter: nfnetlink\_osf: fix out-of-bounds read on option matching (CVSS 9.1, Linux)
- [CVE-2026-52998](https://cve.now/CVE-2026-52998.md): netfilter: nfnetlink\_osf: fix potential NULL dereference in ttl check (CVSS 7.5, Linux)
- [CVE-2026-52997](https://cve.now/CVE-2026-52997.md): net/sched: sch\_dualpi2: drain both C-queue and L-queue in dualpi2\_change() (no CVSS, Linux)
- [CVE-2026-52996](https://cve.now/CVE-2026-52996.md): ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open (no CVSS, Linux)
- [CVE-2026-52995](https://cve.now/CVE-2026-52995.md): net/rds: zero per-item info buffer before handing it to visitors (no CVSS, Linux)
- [CVE-2026-52994](https://cve.now/CVE-2026-52994.md): vsock/virtio: fix MSG\_ZEROCOPY pinned-pages accounting (no CVSS, Linux)
- [CVE-2026-52993](https://cve.now/CVE-2026-52993.md): tipc: fix double-free in tipc\_buf\_append() (CVSS 9.8, Linux · :linux\_kernel:)
- [CVE-2026-52992](https://cve.now/CVE-2026-52992.md): fs/adfs: validate nzones in adfs\_validate\_bblk() (no CVSS, Linux)
- [CVE-2026-52991](https://cve.now/CVE-2026-52991.md): sched/psi: fix race between file release and pressure write (CVSS 7.8, Linux)
- [CVE-2026-52990](https://cve.now/CVE-2026-52990.md): fsnotify: fix inode reference leak in fsnotify\_recalc\_mask() (no CVSS, Linux)
- [CVE-2026-52989](https://cve.now/CVE-2026-52989.md): nvmet-tcp: propagate nvmet\_tcp\_build\_pdu\_iovec() errors to its callers (CVSS 9.8, Linux)
- [CVE-2026-52988](https://cve.now/CVE-2026-52988.md): netfilter: nf\_tables: join hook list via splice\_list\_rcu() in commit phase (CVSS 7.1, Linux)
- [CVE-2026-52987](https://cve.now/CVE-2026-52987.md): drm/amdgpu: avoid double drm\_exec\_fini() in userq validate (CVSS 7.8, Linux)
- [CVE-2026-52986](https://cve.now/CVE-2026-52986.md): netfilter: nf\_conntrack\_sip: don't use simple\_strtoul (CVSS 9.8, Linux)
- [CVE-2026-52985](https://cve.now/CVE-2026-52985.md): netdevsim: zero initialize struct iphdr in dummy sk\_buff (no CVSS, Linux)
- [CVE-2026-52984](https://cve.now/CVE-2026-52984.md): net/sched: netem: fix queue limit check to include reordered packets (no CVSS, Linux)
- [CVE-2026-52983](https://cve.now/CVE-2026-52983.md): net: airoha: fix BQL imbalance in TX path (CVSS 7.5, Linux)
- [CVE-2026-52982](https://cve.now/CVE-2026-52982.md): net: usb: rtl8150: fix use-after-free in rtl8150\_start\_xmit() (CVSS 9.8, Linux)
- [CVE-2026-52981](https://cve.now/CVE-2026-52981.md): neigh: let neigh\_xmit take skb ownership (CVSS 7.5, Linux)
- [CVE-2026-52980](https://cve.now/CVE-2026-52980.md): sched/fair: Clear rel\_deadline when initializing forked entities (no CVSS, Linux)
- [CVE-2026-52979](https://cve.now/CVE-2026-52979.md): net: psp: check for device unregister when creating assoc (no CVSS, Linux)
- [CVE-2026-52978](https://cve.now/CVE-2026-52978.md): net: psp: require admin permission for dev-set and key-rotate (no CVSS, Linux)
- [CVE-2026-52977](https://cve.now/CVE-2026-52977.md): futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (no CVSS, Linux)
- [CVE-2026-52976](https://cve.now/CVE-2026-52976.md): drm/xe: Fix error cleanup in xe\_exec\_queue\_create\_ioctl() (CVSS 7.8, Linux)
- [CVE-2026-52975](https://cve.now/CVE-2026-52975.md): bonding: 3ad: implement proper RCU rules for port-\>aggregator (CVSS 7.8, Linux)
- [CVE-2026-52974](https://cve.now/CVE-2026-52974.md): net: tls: fix strparser anchor skb leak on offload RX setup failure (CVSS 7.5, Linux)
- [CVE-2026-52973](https://cve.now/CVE-2026-52973.md): futex: Drop CLONE\_THREAD requirement for private default hash alloc (CVSS 7.8, Linux)
- [CVE-2026-52972](https://cve.now/CVE-2026-52972.md): crypto: af\_alg - Cap AEAD AD length to 0x80000000 (CVSS 7.0, Linux)
- [CVE-2026-52971](https://cve.now/CVE-2026-52971.md): net: ena: PHC: Fix potential use-after-free in get\_timestamp (CVSS 7.8, Linux)
- [CVE-2026-52970](https://cve.now/CVE-2026-52970.md): netfilter: nft\_ct: fix missing expect put in obj eval (no CVSS, Linux)
- [CVE-2026-52969](https://cve.now/CVE-2026-52969.md): KVM: Reject wrapped offset in kvm\_reset\_dirty\_gfn() (CVSS 7.0, Linux)
- [CVE-2026-52968](https://cve.now/CVE-2026-52968.md): KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic (CVSS 8.8, Linux)
- [CVE-2026-52967](https://cve.now/CVE-2026-52967.md): smb/client: fix possible infinite loop and oob read in symlink\_data() (CVSS 8.1, Linux)
- [CVE-2026-52966](https://cve.now/CVE-2026-52966.md): drm: Replace old pointer to new idr (no CVSS, Linux)
- [CVE-2026-52965](https://cve.now/CVE-2026-52965.md): drm/ttm: Fix ttm\_bo\_swapout() infinite LRU walk on swapout failure (no CVSS, Linux)
- [CVE-2026-52964](https://cve.now/CVE-2026-52964.md): ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (no CVSS, Linux)
- [CVE-2026-52963](https://cve.now/CVE-2026-52963.md): ALSA: usb-audio: Bound MIDI endpoint descriptor scans (no CVSS, Linux)
- [CVE-2026-52962](https://cve.now/CVE-2026-52962.md): ceph: fix a buffer leak in \_\_ceph\_setxattr() (no CVSS, Linux)
- [CVE-2026-52961](https://cve.now/CVE-2026-52961.md): ceph: fix BUG\_ON in \_\_ceph\_build\_xattrs\_blob() due to stale blob size (no CVSS, Linux)
- [CVE-2026-52960](https://cve.now/CVE-2026-52960.md): ceph: put folios not suitable for writeback (CVSS 7.5, Linux)
- [CVE-2026-52959](https://cve.now/CVE-2026-52959.md): virt: sev-guest: Do not use host-controlled page order in cleanup path (CVSS 7.8, Linux)
- [CVE-2026-52958](https://cve.now/CVE-2026-52958.md): libceph: Fix potential out-of-bounds access in osdmap\_decode() (CVSS 9.1, Linux)
- [CVE-2026-52957](https://cve.now/CVE-2026-52957.md): libceph: Fix potential null-ptr-deref in decode\_choose\_args() (CVSS 7.5, Linux)
- [CVE-2026-52956](https://cve.now/CVE-2026-52956.md): libceph: Fix potential out-of-bounds access in \_\_ceph\_x\_decrypt() (CVSS 7.5, Linux)
- [CVE-2026-52955](https://cve.now/CVE-2026-52955.md): libceph: Fix potential out-of-bounds access in crush\_decode() (CVSS 9.8, Linux)
- [CVE-2026-52954](https://cve.now/CVE-2026-52954.md): libceph: handle rbtree insertion error in decode\_choose\_args() (CVSS 7.5, Linux)
- [CVE-2026-52953](https://cve.now/CVE-2026-52953.md): iommu/vt-d: Fix oops due to out of scope access (CVSS 7.1, Linux)
- [CVE-2026-52952](https://cve.now/CVE-2026-52952.md): iommu: Fix WARN\_ON in \_\_iommu\_group\_set\_domain\_nofail() due to reset (CVSS 8.8, Linux)
- [CVE-2026-52951](https://cve.now/CVE-2026-52951.md): drm/xe/dma-buf: handle empty bo and UAF races (CVSS 7.8, Linux)
- [CVE-2026-52950](https://cve.now/CVE-2026-52950.md): drm/xe/dma-buf: fix UAF with retry loop (CVSS 7.8, Linux)
- [CVE-2026-52949](https://cve.now/CVE-2026-52949.md): drm/ttm: Fix ttm\_bo\_shrink() infinite LRU walk on backup failure (no CVSS, Linux)
- [CVE-2026-52948](https://cve.now/CVE-2026-52948.md): i2c: dev: prevent integer overflow in I2C\_TIMEOUT ioctl (no CVSS, Linux)
- [CVE-2026-52947](https://cve.now/CVE-2026-52947.md): net: qrtr: fix refcount saturation and potential UAF in qrtr\_port\_remove (CVSS 7.8, Linux)
- [CVE-2026-52946](https://cve.now/CVE-2026-52946.md): fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (CVSS 7.5, Linux)
- [CVE-2026-52945](https://cve.now/CVE-2026-52945.md): Revert "wireguard: device: enable threaded NAPI" (CVSS 7.5, Linux)
- [CVE-2026-54297](https://cve.now/CVE-2026-54297.md): Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters (CVSS 7.5, lostisland faraday · faraday)
- [CVE-2026-54906](https://cve.now/CVE-2026-54906.md): concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption (CVSS 2.1, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54904](https://cve.now/CVE-2026-54904.md): concurrent-ruby: \`AtomicReference#update\` livelocks when the stored value is \`Float::NAN\` (CVSS 8.2, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54905](https://cve.now/CVE-2026-54905.md): concurrent-ruby: \`ReentrantReadWriteLock\` read-count overflow grants a write lock without exclusivity (CVSS 2.0, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-13164](https://cve.now/CVE-2026-13164.md): Unauthenticated self-registration in MailerUp allows access to stored email data (CVSS 8.8, Mailerup)
- [CVE-2026-50712](https://cve.now/CVE-2026-50712.md): Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-50711](https://cve.now/CVE-2026-50711.md): Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50710](https://cve.now/CVE-2026-50710.md): Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters\_config (CVSS 4.6, Frappe Framework)
- [CVE-2026-50709](https://cve.now/CVE-2026-50709.md): Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-55488](https://cve.now/CVE-2026-55488.md): motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read (CVSS 7.7, motioneye-project motioneye · motioneye)
- [CVE-2026-50708](https://cve.now/CVE-2026-50708.md): Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-50705](https://cve.now/CVE-2026-50705.md): Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-56121](https://cve.now/CVE-2026-56121.md): Feast \< 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization (CVSS 9.3, feast-dev feast · feast)
- [CVE-2026-50704](https://cve.now/CVE-2026-50704.md): Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50703](https://cve.now/CVE-2026-50703.md): Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-50701](https://cve.now/CVE-2026-50701.md): Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering (CVSS 5.1, Frappe Framework)
- [CVE-2026-56111](https://cve.now/CVE-2026-56111.md): Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler (CVSS 8.3, MarlinFirmware Marlin)
- [CVE-2026-50700](https://cve.now/CVE-2026-50700.md): Frappe Framework 17.0.0-dev - Stored XSS in frappe.get\_avatar image rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50699](https://cve.now/CVE-2026-50699.md): Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50698](https://cve.now/CVE-2026-50698.md): Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-12986](https://cve.now/CVE-2026-12986.md): A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows… (CVSS 7.3, Payara Server · fish.payara.distributions:payara)
- [CVE-2026-11877](https://cve.now/CVE-2026-11877.md): Missing Authorization Vulnerability in OpenText Access Manager (CVSS 6.3, OpenText Access Manager)
- [CVE-2026-11878](https://cve.now/CVE-2026-11878.md): Reflected Cross-Site Scripting vulnerability in OpenText Access Manager (CVSS 8.2, OpenText Access Manager)
- [CVE-2026-12537](https://cve.now/CVE-2026-12537.md): Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows (CVSS 10.0, Google Cloud Gemini CLI · Google Cloud run-gemini-cli Gi… +2)
- [CVE-2026-35025](https://cve.now/CVE-2026-35025.md): ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR (CVSS 8.6, ProFTPD Project ProFTPD)
- [CVE-2026-57307](https://cve.now/CVE-2026-57307.md): A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers with Overall/Read… (CVSS 4.2, Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…)
- [CVE-2026-57306](https://cve.now/CVE-2026-57306.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers to… (CVSS 4.2, Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…)
- [CVE-2026-57305](https://cve.now/CVE-2026-57305.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an… (CVSS 5.4, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57304](https://cve.now/CVE-2026-57304.md): A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an… (CVSS 5.4, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57303](https://cve.now/CVE-2026-57303.md): Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers… (CVSS 7.1, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57302](https://cve.now/CVE-2026-57302.md): Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be… (CVSS 4.3, Jenkins Project Jenkins FitNesse Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57301](https://cve.now/CVE-2026-57301.md): Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing… (CVSS 8.8, Jenkins Project Jenkins OWASP ZAP Plugin · org.jenkins-ci.p…)
- [CVE-2026-57300](https://cve.now/CVE-2026-57300.md): A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb\_2557fe and earlier allows attackers with Item/Read permission to… (CVSS 4.3, Jenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…)
- [CVE-2026-57299](https://cve.now/CVE-2026-57299.md): Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read… (CVSS 4.3, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57298](https://cve.now/CVE-2026-57298.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows… (CVSS 5.4, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57297](https://cve.now/CVE-2026-57297.md): A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read… (CVSS 5.4, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57296](https://cve.now/CVE-2026-57296.md): Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided… (CVSS 8.8, Jenkins Project Jenkins External Workspace Manager Plugin ·…)
- [CVE-2026-57295](https://cve.now/CVE-2026-57295.md): A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers to… (CVSS 5.4, Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…)
- [CVE-2026-57294](https://cve.now/CVE-2026-57294.md): A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers with Overall/Read permission… (CVSS 5.4, Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…)
- [CVE-2026-57293](https://cve.now/CVE-2026-57293.md): An incorrect permission check in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers with global Item/Configure… (CVSS 4.3, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57292](https://cve.now/CVE-2026-57292.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers to connect to… (CVSS 5.4, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57291](https://cve.now/CVE-2026-57291.md): Missing permission checks in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allow attackers with Overall/Read permission to… (CVSS 5.4, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57290](https://cve.now/CVE-2026-57290.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b\_84449 and earlier allows attackers to… (CVSS 4.3, Jenkins Project Jenkins Priority Sorter Plugin · org.jenkin…)
- [CVE-2026-57289](https://cve.now/CVE-2026-57289.md): Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for… (CVSS 4.8, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2026-42450](https://cve.now/CVE-2026-42450.md): OpenColorIO vulnerable to stack buffer overflow via unbounded \`sscanf %s\` in Spi3D (.spi3d) LUT parser (CVSS 8.4, AcademySoftwareFoundation OpenColorIO)
- [CVE-2026-57288](https://cve.now/CVE-2026-57288.md): Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows… (CVSS 3.7, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-57287](https://cve.now/CVE-2026-57287.md): Jenkins Job Configuration History Plugin 1356.ve360da\_6c523a\_ and earlier does not redact the encrypted values of secrets when displaying… (CVSS 4.3, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2026-57286](https://cve.now/CVE-2026-57286.md): A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca\_ and earlier allows attackers with Item/Read permission to… (CVSS 4.3, Jenkins Project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2026-57285](https://cve.now/CVE-2026-57285.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read… (CVSS 4.3, Jenkins Project Jenkins GitHub Branch Source Plugin · org.j…)
- [CVE-2026-57284](https://cve.now/CVE-2026-57284.md): Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline… (CVSS 4.3, Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…)
- [CVE-2026-57283](https://cve.now/CVE-2026-57283.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to… (CVSS 4.3, Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…)
- [CVE-2026-57282](https://cve.now/CVE-2026-57282.md): Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated… (CVSS 5.0, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2026-57281](https://cve.now/CVE-2026-57281.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions… (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-57280](https://cve.now/CVE-2026-57280.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed… (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-13163](https://cve.now/CVE-2026-13163.md): Lack of input validation in Mailerup input parameter leads to Open Redirect (CVSS 5.3, Mailerup)
- [CVE-2026-12242](https://cve.now/CVE-2026-12242.md): AdRotate Banner Manager \<= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute (CVSS 8.8, adegans AdRotate Banner Manager)
- [CVE-2026-56761](https://cve.now/CVE-2026-56761.md): hono - HTML Injection via Improper JSX Attribute Name Handling in SSR (CVSS 5.3, hono)
- [CVE-2026-56370](https://cve.now/CVE-2026-56370.md): ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56368](https://cve.now/CVE-2026-56368.md): ImageMagick - Memory Leak in Raw Pixel Data Coders (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56358](https://cve.now/CVE-2026-56358.md): n8n - Stored Cross-Site Scripting in Form Trigger Node (CVSS 5.1, n8n)
- [CVE-2026-56351](https://cve.now/CVE-2026-56351.md): n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes (CVSS 5.3, n8n)
- [CVE-2026-56338](https://cve.now/CVE-2026-56338.md): Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56337](https://cve.now/CVE-2026-56337.md): Capgo - Information Disclosure via Unauthenticated RPC Function exist\_app\_v2 (CVSS 6.9, Capgo)
- [CVE-2026-56310](https://cve.now/CVE-2026-56310.md): Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass (CVSS 5.3, Cap-go capgo)
- [CVE-2026-56302](https://cve.now/CVE-2026-56302.md): Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security (CVSS 6.9, Capgo)
- [CVE-2026-56272](https://cve.now/CVE-2026-56272.md): Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing (CVSS 5.6, Flowise)
- [CVE-2026-56270](https://cve.now/CVE-2026-56270.md): Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint (CVSS 8.7, Flowise)
- [CVE-2026-56269](https://cve.now/CVE-2026-56269.md): Flowise - Weak Default Token Hash Secret in JWT Token Encryption (CVSS 4.3, Flowise)
- [CVE-2026-56262](https://cve.now/CVE-2026-56262.md): Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server (CVSS 6.9, Crawl4AI)
- [CVE-2026-56257](https://cve.now/CVE-2026-56257.md): Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update (CVSS 7.1, Capgo)
- [CVE-2026-56256](https://cve.now/CVE-2026-56256.md): Capgo - Two-Factor Authentication Bypass via Organization Management API (CVSS 7.1, Capgo)
- [CVE-2026-56245](https://cve.now/CVE-2026-56245.md): Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record\_build\_time RPC (CVSS 8.8, Cap-go capgo)
- [CVE-2026-56244](https://cve.now/CVE-2026-56244.md): Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key (CVSS 7.1, Capgo)
- [CVE-2026-56237](https://cve.now/CVE-2026-56237.md): Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation (CVSS 9.3, Capgo)
- [CVE-2026-56232](https://cve.now/CVE-2026-56232.md): Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header (CVSS 8.7, Capgo)
- [CVE-2026-56231](https://cve.now/CVE-2026-56231.md): Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter (CVSS 7.2, Capgo)
- [CVE-2026-56223](https://cve.now/CVE-2026-56223.md): Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user (CVSS 9.3, Capgo)
- [CVE-2025-71361](https://cve.now/CVE-2025-71361.md): picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch\_tip (CVSS 7.6, picklescan)
- [CVE-2025-71354](https://cve.now/CVE-2025-71354.md): picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetText (CVSS 7.6, picklescan)
- [CVE-2025-71332](https://cve.now/CVE-2025-71332.md): Flowise - SQL Injection in importChatflows API via chatflow.id Parameter (CVSS 8.5, Flowise)
- [CVE-2026-13140](https://cve.now/CVE-2026-13140.md): Stored Cross-Site Scripting in Canarytokens.org (CVSS 1.1, Thinkst Applied Research Canarytokens)
- [CVE-2026-13150](https://cve.now/CVE-2026-13150.md): SSRF in Pentestify PDF generation endpoint via Host header (CVSS 6.9, Pentestify)
- [CVE-2026-52944](https://cve.now/CVE-2026-52944.md): ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL\_SET\_SPARSE (no CVSS, Linux)
- [CVE-2026-11968](https://cve.now/CVE-2026-11968.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in TortoiseGit (CVSS 5.5, TortoiseGit team TortoiseGit)
- [CVE-2026-52943](https://cve.now/CVE-2026-52943.md): net: skbuff: fix missing zerocopy reference in pskb\_carve helpers (CVSS 7.8, Linux)
- [CVE-2026-10745](https://cve.now/CVE-2026-10745.md): Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log… (CVSS 7.9, upKeeper Solutions upKeeper Instant Privilege Access)
- [CVE-2026-56052](https://cve.now/CVE-2026-56052.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.15.0.5 - SQL Injection vulnerability (CVSS 7.6, Funnel Builder by FunnelKit)
- [CVE-2026-52942](https://cve.now/CVE-2026-52942.md): netfilter: nf\_log: validate MAC header was set before dumping it (CVSS 7.1, Linux)
- [CVE-2026-52941](https://cve.now/CVE-2026-52941.md): net/smc: avoid NULL deref of conn-\>lnk in smc\_msg\_event tracepoint (no CVSS, Linux)
- [CVE-2026-52940](https://cve.now/CVE-2026-52940.md): tun: zero the whole vnet header in tun\_put\_user() (no CVSS, Linux)
- [CVE-2026-52939](https://cve.now/CVE-2026-52939.md): net/rds: fix NULL deref in rds\_ib\_send\_cqe\_handler() on masked atomic completion (no CVSS, Linux)
- [CVE-2026-52938](https://cve.now/CVE-2026-52938.md): bpf: Fix NULL pointer dereference in bpf\_sk\_storage\_clone and diag paths (no CVSS, Linux)
- [CVE-2026-52937](https://cve.now/CVE-2026-52937.md): tap: fix stack info leak in tap\_ioctl() SIOCGIFHWADDR (no CVSS, Linux)
- [CVE-2026-52936](https://cve.now/CVE-2026-52936.md): crypto: jitterentropy - replace long-held spinlock with mutex (no CVSS, Linux)
- [CVE-2026-52935](https://cve.now/CVE-2026-52935.md): xfrm: espintcp: do not reuse an in-progress partial send (CVSS 7.8, Linux)
- [CVE-2026-52934](https://cve.now/CVE-2026-52934.md): batman-adv: tvlv: reject oversized TVLV packets (CVSS 8.8, Linux)
- [CVE-2026-52933](https://cve.now/CVE-2026-52933.md): io\_uring/poll: fix signed comparison in io\_poll\_get\_ownership() (CVSS 7.8, Linux)
- [CVE-2026-52932](https://cve.now/CVE-2026-52932.md): xfrm: ipcomp: Free destination pages on acomp errors (CVSS 7.5, Linux)
- [CVE-2026-52931](https://cve.now/CVE-2026-52931.md): batman-adv: tp\_meter: avoid use of uninit sender vars (CVSS 9.8, Linux)
- [CVE-2026-52930](https://cve.now/CVE-2026-52930.md): ipc/shm: serialize orphan cleanup with shm\_nattch updates (no CVSS, Linux)
- [CVE-2026-52929](https://cve.now/CVE-2026-52929.md): sctp: stream: fully roll back denied add-stream state (CVSS 7.5, Linux)
- [CVE-2026-52928](https://cve.now/CVE-2026-52928.md): af\_unix: Reject SIOCATMARK on non-stream sockets (no CVSS, Linux)
- [CVE-2026-52927](https://cve.now/CVE-2026-52927.md): netfilter: ebtables: fix OOB read in compat\_mtw\_from\_user (CVSS 7.8, Linux)
- [CVE-2026-52926](https://cve.now/CVE-2026-52926.md): batman-adv: clear current gateway during teardown (no CVSS, Linux)
- [CVE-2026-52925](https://cve.now/CVE-2026-52925.md): vrf: Fix a potential NPD when removing a port from a VRF (no CVSS, Linux)
- [CVE-2026-52924](https://cve.now/CVE-2026-52924.md): sctp: purge outqueue on stale COOKIE-ECHO handling (CVSS 9.8, Linux)
- [CVE-2026-52923](https://cve.now/CVE-2026-52923.md): ipc: limit next\_id allocation to the valid ID range (CVSS 7.8, Linux)
- [CVE-2026-52922](https://cve.now/CVE-2026-52922.md): batman-adv: dat: handle forward allocation error (CVSS 7.5, Linux)
- [CVE-2026-52921](https://cve.now/CVE-2026-52921.md): netfilter: ipset: stop hash: range iteration at end (no CVSS, Linux)
- [CVE-2026-52920](https://cve.now/CVE-2026-52920.md): netfilter: xt\_policy: fix strict mode inbound policy matching (CVSS 8.3, Linux)
- [CVE-2026-52919](https://cve.now/CVE-2026-52919.md): batman-adv: fix tp\_meter counter underflow during shutdown (CVSS 7.8, Linux)
- [CVE-2026-52918](https://cve.now/CVE-2026-52918.md): Bluetooth: serialize accept\_q access (CVSS 8.8, Linux)
- [CVE-2026-52917](https://cve.now/CVE-2026-52917.md): sctp: diag: reject stale associations in dump\_one path (CVSS 7.1, Linux)
- [CVE-2026-52916](https://cve.now/CVE-2026-52916.md): batman-adv: frag: disallow unicast fragment in fragment (no CVSS, Linux)
- [CVE-2026-52915](https://cve.now/CVE-2026-52915.md): netfilter: ip6t\_hbh: reject oversized option lists (CVSS 7.1, Linux)
- [CVE-2026-52914](https://cve.now/CVE-2026-52914.md): batman-adv: fix fragment reassembly length accounting (CVSS 9.8, Linux)
- [CVE-2026-52913](https://cve.now/CVE-2026-52913.md): batman-adv: v: stop OGMv2 on disabled interface (no CVSS, Linux)
- [CVE-2026-52912](https://cve.now/CVE-2026-52912.md): netfilter: nf\_queue: hold bridge skb-\>dev while queued (CVSS 7.8, Linux)
- [CVE-2026-7761](https://cve.now/CVE-2026-7761.md): Ultimate Member \<= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure (CVSS 8.8, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-9710](https://cve.now/CVE-2026-9710.md): Themeco Cornerstone \< 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure (CVSS 7.7, Cornerstone)
- [CVE-2026-9709](https://cve.now/CVE-2026-9709.md): Themeco Cornerstone \< 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure (CVSS 7.7, Cornerstone)
- [CVE-2026-10753](https://cve.now/CVE-2026-10753.md): Site Kit by Google \< 1.176.0 - Editor+ Email Reporting Settings Update (CVSS 2.7, Site Kit by Google)
- [CVE-2026-10749](https://cve.now/CVE-2026-10749.md): Post Duplicator \< 3.0.15 - Contributor+ PHP Object Injection via customMetaData (CVSS 7.2, Post Duplicator)
- [CVE-2026-10735](https://cve.now/CVE-2026-10735.md): ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server (CVSS 7.5, smart-post-show-pro · Real Testimonials Pro +1)
- [CVE-2026-10531](https://cve.now/CVE-2026-10531.md): AI Share & Summarize \< 2.0.4 - Contributor+ Stored XSS via title\_style Shortcode Attribute (CVSS 5.4, AI Share & Summarize)
- [CVE-2026-13006](https://cve.now/CVE-2026-13006.md): Incomplete protection against CVE-2025-11226 (CVSS 7.0, QOS.CH Sarl Logback-core)
- [CVE-2026-8690](https://cve.now/CVE-2026-8690.md): RentMy Real-Time Rental Management Plugin \<= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy\_cdn\_request… (CVSS 5.3, RentMy Real-Time Rental Management Plugin)
- [CVE-2026-9178](https://cve.now/CVE-2026-9178.md): WP Forms Connector \<= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint (CVSS 7.5, hancock11 WP Forms Connector)
- [CVE-2026-11997](https://cve.now/CVE-2026-11997.md): Bulk SEO Image \<= 1.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, seo\_tools Bulk SEO Image)
- [CVE-2026-8622](https://cve.now/CVE-2026-8622.md): Image Sizes on Demand \<= 1.3 - Reflected Cross-Site Scripting via PHP\_SELF Server Variable (CVSS 6.1, pixelwelt Image Sizes on Demand)
- [CVE-2026-9612](https://cve.now/CVE-2026-9612.md): WhatsOrder \<= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs (CVSS 5.3, yapacdev WhatsOrder – Instant Checkout for WooCommerce)
- [CVE-2026-8688](https://cve.now/CVE-2026-8688.md): Advance Nav Menu Manager \<= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm\_save\_menu\_data… (CVSS 4.3, krishaweb Advance Nav Menu Manager)
- [CVE-2026-9620](https://cve.now/CVE-2026-9620.md): WP Latest Posts \<= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute (CVSS 6.4, joomunited WP Latest Posts)
- [CVE-2026-8865](https://cve.now/CVE-2026-8865.md): Avalon23 Products Filter for WooCommerce \<= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, paradigmatools Avalon23 Products Filter for WooCommerce)
- [CVE-2026-8896](https://cve.now/CVE-2026-8896.md): MIR blocks and shortcodes \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, mirsoftware MIR blocks and shortcodes)
- [CVE-2026-9183](https://cve.now/CVE-2026-9183.md): 24liveblog \<= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization (CVSS 4.3, 24liveblog – live blog tool)
- [CVE-2026-12416](https://cve.now/CVE-2026-12416.md): Invoice Generator \<= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset\_user\_id' Parameter (CVSS 9.8, pravel Invoice Generator)
- [CVE-2026-12417](https://cve.now/CVE-2026-12417.md): SignUp & SignIn \<= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset\_activation\_code' Leading to… (CVSS 9.8, pravel SignUp & SignIn)
- [CVE-2026-9643](https://cve.now/CVE-2026-9643.md): WP Meta SEO \<= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST\_URI in 404 Logging (CVSS 7.2, joomunited WP Meta SEO)
- [CVE-2026-9172](https://cve.now/CVE-2026-9172.md): Devs Accounting \<= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint (CVSS 5.3, ajitdas Devs Accounting – Simple Accounting and Invoicing S…)
- [CVE-2026-6292](https://cve.now/CVE-2026-6292.md): MP Customize Login Page \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, manuelpadillac MP Customize Login Page)
- [CVE-2026-9616](https://cve.now/CVE-2026-9616.md): Generate Security.txt \<= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete\_securitytxt AJAX… (CVSS 4.3, verenigingvanregistrars Generate Security.txt)
- [CVE-2026-8617](https://cve.now/CVE-2026-8617.md): SearchPlus \<= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus\_save\_token &… (CVSS 5.3, ailchev SearchPlus)
- [CVE-2026-9184](https://cve.now/CVE-2026-9184.md): 24liveblog \<= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update\_lb24\_token AJAX action (CVSS 4.3, 24liveblog – live blog tool)
- [CVE-2026-8705](https://cve.now/CVE-2026-8705.md): ClearSale Total \<= 3.4.2 - Unauthenticated SQL Injection (CVSS 7.5, ClearSale Total)
- [CVE-2026-8628](https://cve.now/CVE-2026-8628.md): EntreDroppers \<= 1.1.2 - Reflected Cross-Site Scripting via PHP\_SELF Parameter (CVSS 6.1, owencutajar EntreDroppers)
- [CVE-2026-12095](https://cve.now/CVE-2026-12095.md): Kargo Takip \<= 1.2 - Unauthenticated Server-Side Request Forgery via 'api\_url' Parameter (CVSS 7.2, bytuncay Kargo Takip)
- [CVE-2026-10552](https://cve.now/CVE-2026-10552.md): Blue Captcha \<= 2.0.1 - Cross-Site Request Forgery via 'blcap\_action' Parameter (CVSS 4.3, jotis Blue Captcha)
- [CVE-2026-8614](https://cve.now/CVE-2026-8614.md): Assistio \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via… (CVSS 4.3, assistioai Assistio)
- [CVE-2026-7617](https://cve.now/CVE-2026-7617.md): Secufor\_OAuth \<= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth\_unregister\_action' AJAX Action (CVSS 5.3, Secufor\_OAuth)
- [CVE-2026-9619](https://cve.now/CVE-2026-9619.md): Reviews and Rating \<= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync\_reviews AJAX Action (CVSS 4.3, berfect Reviews and Rating – Docplanner)
- [CVE-2026-9724](https://cve.now/CVE-2026-9724.md): MotorDesk \<= 1.1.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, MotorDesk)
- [CVE-2026-4297](https://cve.now/CVE-2026-4297.md): Welcome Software Publishing \<= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption'… (CVSS 8.8, newscred Welcome Software Publishing)
- [CVE-2026-12094](https://cve.now/CVE-2026-12094.md): Advanced Contact Form 7 \<= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form\_id'… (CVSS 5.3, iamranit Advanced Contact Form 7 – Compact DB)
- [CVE-2026-10092](https://cve.now/CVE-2026-10092.md): Cincopa video and media plug-in \<= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments (CVSS 7.2, nicashmu Cincopa video and media plug-in)
- [CVE-2026-9179](https://cve.now/CVE-2026-9179.md): WP Forms Connector \<= 1.8 - Unauthenticated SQL Injection via 'order' Parameter (CVSS 7.5, hancock11 WP Forms Connector)
- [CVE-2026-11370](https://cve.now/CVE-2026-11370.md): WP Meta SEO \<= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new\_link' Parameter (CVSS 6.4, joomunited WP Meta SEO)
- [CVE-2026-9175](https://cve.now/CVE-2026-9175.md): Devs Accounting \<= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter (CVSS 5.3, ajitdas Devs Accounting – Simple Accounting and Invoicing S…)
- [CVE-2026-9721](https://cve.now/CVE-2026-9721.md): Book a Room Event Calendar \<= 1.9 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, chuhpl Book a Room Event Calendar)
- [CVE-2026-10091](https://cve.now/CVE-2026-10091.md): Email JavaScript Cloak \<= 1.03 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, cgarvey Email JavaScript Cloak)
- [CVE-2026-12100](https://cve.now/CVE-2026-12100.md): URL Preview \<= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (CVSS 7.2, abhisheksaha11 URL Preview)
- [CVE-2026-8905](https://cve.now/CVE-2026-8905.md): Osiris Signature Banner \<= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend\_text' Parameter (CVSS 6.1, osiris8 Osiris Signature Banner)
- [CVE-2026-9539](https://cve.now/CVE-2026-9539.md): libslirp TCP URG OOB Read Information Leak (CVSS 6.5, freedesktop.org libslirp)
- [CVE-2026-12851](https://cve.now/CVE-2026-12851.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12850](https://cve.now/CVE-2026-12850.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12849](https://cve.now/CVE-2026-12849.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12486](https://cve.now/CVE-2026-12486.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12848](https://cve.now/CVE-2026-12848.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12847](https://cve.now/CVE-2026-12847.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12846](https://cve.now/CVE-2026-12846.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12485](https://cve.now/CVE-2026-12485.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12488](https://cve.now/CVE-2026-12488.md): GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability (CVSS 6.2, GeoVision)
- [CVE-2026-3652](https://cve.now/CVE-2026-3652.md): ARForms \<= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter (CVSS 7.2, ARforms)
- [CVE-2026-11614](https://cve.now/CVE-2026-11614.md): Xpro Addons \<= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom\_attributes' Parameter of Multiple Widgets (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-12681](https://cve.now/CVE-2026-12681.md): Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. (CVSS 8.9, Google go-attestation · github.com/google/go-attestation)
- [CVE-2026-54639](https://cve.now/CVE-2026-54639.md): Style Dictionary - Prototype Pollution in convertTokenData utility function (CVSS 8.8, style-dictionary)
- [CVE-2025-60466](https://cve.now/CVE-2025-60466.md): A use-after-free in the gf\_filter\_pid\_get\_packet function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 allows… (CVSS 5.0)
- [CVE-2025-60467](https://cve.now/CVE-2025-60467.md): A use-after-free in the gf\_filter\_pid\_inst\_swap\_delete\_task function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 allow (CVSS 7.5)
- [CVE-2025-60468](https://cve.now/CVE-2025-60468.md): GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. (CVSS 5.5)
- [CVE-2025-60471](https://cve.now/CVE-2025-60471.md): A use-after-free in the gf\_filter\_pid\_reconfigure\_task\_discard function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0… (CVSS 5.5)
- [CVE-2025-60473](https://cve.now/CVE-2025-60473.md): A NULL pointer dereference in the gf\_filter\_in\_parent\_chain function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0… (CVSS 5.5)
- [CVE-2025-60474](https://cve.now/CVE-2025-60474.md): A buffer overflow in the gf\_media\_import function (/media\_tools/av\_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to… (CVSS 7.5)
- [CVE-2026-49269](https://cve.now/CVE-2026-49269.md): Apple M1 GPUs retain register file data between compute shader dispatches from different processes. (CVSS 8.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.