# CVEs published 2026-08-05

429 CVEs were published on August 5, 2026: 53 critical, 206 high. Days are UTC.

- [CVE-2026-18970](https://cve.now/CVE-2026-18970.md): Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2026-18969](https://cve.now/CVE-2026-18969.md): Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2026-19028](https://cve.now/CVE-2026-19028.md): HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-19027](https://cve.now/CVE-2026-19027.md): HDF5 out-of-bounds heap read in N-Bit filter decompression (CVSS 6.9, The HDF Group HDF5)
- [CVE-2026-18968](https://cve.now/CVE-2026-18968.md): ttttonyhe OBlog tags.php cross site scripting (CVSS 5.3, ttttonyhe OBlog)
- [CVE-2026-67531](https://cve.now/CVE-2026-67531.md): FrontMCP: CodeCall sandbox escape -\> host RCE via live Zod schema exposure by getTool (CVSS 9.3, agentfront frontmcp)
- [CVE-2026-19026](https://cve.now/CVE-2026-19026.md): Nbit filter NULL/short parameter-array dereference (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-19025](https://cve.now/CVE-2026-19025.md): HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-19024](https://cve.now/CVE-2026-19024.md): HDF5 H5Pget\_fill\_value NULL Pointer Dereference via Malformed Fill Value Message (CVSS 8.2, The HDF Group HDF5)
- [CVE-2026-19023](https://cve.now/CVE-2026-19023.md): HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-71321](https://cve.now/CVE-2026-71321.md): Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation (CVSS 7.5, nuxt)
- [CVE-2026-71320](https://cve.now/CVE-2026-71320.md): Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props (CVSS 8.1, nuxt)
- [CVE-2026-71319](https://cve.now/CVE-2026-71319.md): Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution (CVSS 9.6, nuxt devtools · @nuxt/devtools)
- [CVE-2026-71318](https://cve.now/CVE-2026-71318.md): Nuxt: Unauthorized Component Instantiation via Server Island Props (CVSS 4.8, nuxt)
- [CVE-2026-71316](https://cve.now/CVE-2026-71316.md): Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients (CVSS 7.5, nuxt)
- [CVE-2026-71315](https://cve.now/CVE-2026-71315.md): Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) (CVSS 8.2, nuxt)
- [CVE-2026-71314](https://cve.now/CVE-2026-71314.md): Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering (CVSS 7.5, nuxt)
- [CVE-2026-71313](https://cve.now/CVE-2026-71313.md): rclone: Local Encoding Path Traversal (CVSS 6.9, rclone · github.com/rclone/rclone)
- [CVE-2026-18839](https://cve.now/CVE-2026-18839.md): Popt-devel: popt-static: size\_t underflow in singleoptionhelp (CVSS 2.2, rpm-software-management popt · Red Hat Hardened Images +3)
- [CVE-2026-71312](https://cve.now/CVE-2026-71312.md): rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution (CVSS 8.0, rclone · github.com/rclone/rclone)
- [CVE-2026-71311](https://cve.now/CVE-2026-71311.md): rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines (CVSS 6.4, rclone · github.com/rclone/rclone)
- [CVE-2026-34966](https://cve.now/CVE-2026-34966.md): Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass (CVSS 8.3, Gitea · code.gitea.io/gitea +1)
- [CVE-2026-17583](https://cve.now/CVE-2026-17583.md): Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check (CVSS 8.4, Thermo Fisher Applied Biosystems 3500/3500xL Series Data… +6)
- [CVE-2026-71310](https://cve.now/CVE-2026-71310.md): rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory (CVSS 5.9, rclone · github.com/rclone/rclone)
- [CVE-2026-18959](https://cve.now/CVE-2026-18959.md): yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal (CVSS 5.3, yushine InnoShop)
- [CVE-2026-71309](https://cve.now/CVE-2026-71309.md): rclone: Incomplete path validation allows backend root escape in serve restic (CVSS 8.6, rclone · github.com/rclone/rclone)
- [CVE-2026-18411](https://cve.now/CVE-2026-18411.md): Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100 (CVSS 7.2, Acrisure KARR BT · Acrisure DR-100)
- [CVE-2026-15996](https://cve.now/CVE-2026-15996.md): Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters (CVSS 6.6, GitHub Enterprise Server)
- [CVE-2026-21766](https://cve.now/CVE-2026-21766.md): HCL Digital Experience and Digital Experience Compose insufficiently protects credentials (CVSS 5.4, HCLSoftware HCL Digital Experience and Digital Experience C…)
- [CVE-2026-18954](https://cve.now/CVE-2026-18954.md): Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server (CVSS 5.5, AWS documentdb-mcp-server)
- [CVE-2026-17556](https://cve.now/CVE-2026-17556.md): Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header (CVSS 8.8, GitHub Enterprise Server)
- [CVE-2026-18958](https://cve.now/CVE-2026-18958.md): imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection (CVSS 6.9, imranrisal-dev Student-Management-System)
- [CVE-2026-55524](https://cve.now/CVE-2026-55524.md): PraisonAI: SSRF in web\_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) (CVSS 7.5, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-70618](https://cve.now/CVE-2026-70618.md): Spacebar Server Missing Authorization via member-ids Endpoint (CVSS 5.3, Spacebar Server)
- [CVE-2026-70617](https://cve.now/CVE-2026-70617.md): Spacebar Server Missing Authorization via Group DM Recipient Endpoint (CVSS 8.6, Spacebar Server)
- [CVE-2026-66885](https://cve.now/CVE-2026-66885.md): Livebook Teams identity callback lacks state binding, allowing login CSRF (CVSS 6.8, livebook-dev livebook · livebook)
- [CVE-2026-66298](https://cve.now/CVE-2026-66298.md): JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts (CVSS 8.6, livebook-dev livebook · livebook)
- [CVE-2026-66297](https://cve.now/CVE-2026-66297.md): Unescaped deployment environment variables in generated setup commands (CVSS 5.0, livebook-dev livebook · livebook)
- [CVE-2026-66881](https://cve.now/CVE-2026-66881.md): Path traversal in imported file\_entries name allows arbitrary file write via URL-type entry download (CVSS 7.0, livebook-dev livebook · livebook)
- [CVE-2026-68746](https://cve.now/CVE-2026-68746.md): Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access (CVSS 7.7, livebook-dev livebook · livebook)
- [CVE-2026-70616](https://cve.now/CVE-2026-70616.md): boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint (CVSS 7.1, boringproxy)
- [CVE-2026-70615](https://cve.now/CVE-2026-70615.md): boringproxy 0.10.0 SSH authorized\_keys Injection via Tunnel Creation (CVSS 8.5, boringproxy)
- [CVE-2026-18953](https://cve.now/CVE-2026-18953.md): Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server (CVSS 8.6, aws-transform-mcp-server)
- [CVE-2026-55523](https://cve.now/CVE-2026-55523.md): PraisonAI has a\`web\_crawl\` SSRF protection bypass via unchecked redirect targets (CVSS 7.7, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-69111](https://cve.now/CVE-2026-69111.md): Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop (CVSS 8.7, milvus-io milvus · milvus)
- [CVE-2026-55522](https://cve.now/CVE-2026-55522.md): PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code (CVSS 7.8, MervinPraison PraisonAI · MervinPraison praisonaiagents +2)
- [CVE-2026-18485](https://cve.now/CVE-2026-18485.md): Local Privilege Escalation in NI-PAL (CVSS 8.5, NI-PAL)
- [CVE-2026-17624](https://cve.now/CVE-2026-17624.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-17633](https://cve.now/CVE-2026-17633.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-17632](https://cve.now/CVE-2026-17632.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-48168](https://cve.now/CVE-2026-48168.md): PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name (CVSS 10.0, MervinPraison PraisonAI)
- [CVE-2026-9196](https://cve.now/CVE-2026-9196.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-8182](https://cve.now/CVE-2026-8182.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-9201](https://cve.now/CVE-2026-9201.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-8478](https://cve.now/CVE-2026-8478.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-8183](https://cve.now/CVE-2026-8183.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 7.7, IBM Langflow OSS)
- [CVE-2026-7658](https://cve.now/CVE-2026-7658.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-9130](https://cve.now/CVE-2026-9130.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-10547](https://cve.now/CVE-2026-10547.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 5.9, IBM Langflow OSS)
- [CVE-2026-7869](https://cve.now/CVE-2026-7869.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-8470](https://cve.now/CVE-2026-8470.md): Langflow is affected by weaknesses in secret handling and sensitive configuration access (CVSS 7.4, IBM Langflow OSS)
- [CVE-2026-63457](https://cve.now/CVE-2026-63457.md): A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out)
- [CVE-2026-9205](https://cve.now/CVE-2026-9205.md): Langflow is affected by weaknesses in secret handling and sensitive configuration access (CVSS 7.4, IBM Langflow OSS · langflow)
- [CVE-2026-70612](https://cve.now/CVE-2026-70612.md): Electron: Sandboxed iframes can launch external protocol handlers (CVSS 5.4, electron)
- [CVE-2026-70611](https://cve.now/CVE-2026-70611.md): Electron: DevTools embedder handler executes arbitrary files via shell open (CVSS 6.9, electron)
- [CVE-2026-10128](https://cve.now/CVE-2026-10128.md): Langflow is affected by weaknesses in secret handling and sensitive configuration access (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-70610](https://cve.now/CVE-2026-70610.md): Electron: contextBridge object copy honors prototype setters (CVSS 5.4, electron)
- [CVE-2026-70448](https://cve.now/CVE-2026-70448.md): Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing… (CVSS 7.1, Jenkins Project Jenkins Ivy Report Plugin)
- [CVE-2026-70447](https://cve.now/CVE-2026-70447.md): Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate… (CVSS 4.3, Jenkins Project Jenkins AWS CodeBuild Plugin)
- [CVE-2026-70446](https://cve.now/CVE-2026-70446.md): Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate… (CVSS 4.3, Jenkins Project Jenkins CodeSonar Plugin)
- [CVE-2026-70445](https://cve.now/CVE-2026-70445.md): Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate… (CVSS 4.3, Jenkins Project Jenkins Sauce OnDemand Plugin)
- [CVE-2026-70444](https://cve.now/CVE-2026-70444.md): A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission… (CVSS 4.3, Jenkins Project Jenkins Violation Comments to GitLab Plugin)
- [CVE-2026-70443](https://cve.now/CVE-2026-70443.md): Jenkins Horreum Plugin 0.16.162.v33b\_4a\_a\_b\_5f828 and earlier does not set the appropriate context for credentials lookup, allowing… (CVSS 4.3, Jenkins Project Jenkins Horreum Plugin)
- [CVE-2026-70442](https://cve.now/CVE-2026-70442.md): Jenkins Google Chat Notification Plugin 166.ve6b\_de280f2e8 and earlier does not set the appropriate context for credentials lookup… (CVSS 4.3, Jenkins Project Jenkins Google Chat Notification Plugin)
- [CVE-2026-70441](https://cve.now/CVE-2026-70441.md): Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a… (CVSS 5.4, Jenkins Project Jenkins Summary Display Plugin)
- [CVE-2026-70440](https://cve.now/CVE-2026-70440.md): Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript… (CVSS 5.4, Jenkins Project Jenkins Qualys Container Scanning Connector…)
- [CVE-2026-70439](https://cve.now/CVE-2026-70439.md): Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate… (CVSS 6.5, Jenkins Project Jenkins XML Job to Job DSL Plugin)
- [CVE-2026-70438](https://cve.now/CVE-2026-70438.md): A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission… (CVSS 4.3, Jenkins Project Jenkins Parameterized Remote Trigger Plugin)
- [CVE-2026-70437](https://cve.now/CVE-2026-70437.md): Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa\_f0215cf5 and earlier does not use a constant-time comparison function when… (CVSS 3.7, Jenkins Project Jenkins Webhook Secret Credentials Provider…)
- [CVE-2026-70436](https://cve.now/CVE-2026-70436.md): Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an… (CVSS 4.3, Jenkins Project Jenkins External Workspace Manager Plugin)
- [CVE-2026-70435](https://cve.now/CVE-2026-70435.md): A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an… (CVSS 4.2, Jenkins Project Jenkins SCM-Manager Plugin)
- [CVE-2026-70434](https://cve.now/CVE-2026-70434.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an… (CVSS 4.2, Jenkins Project Jenkins SCM-Manager Plugin)
- [CVE-2026-70433](https://cve.now/CVE-2026-70433.md): Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate… (CVSS 4.3, Jenkins Project Jenkins HCL AppScan Plugin)
- [CVE-2026-70432](https://cve.now/CVE-2026-70432.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier allows attackers to execute… (CVSS 8.8, Jenkins Project Jenkins Multijob Plugin)
- [CVE-2026-70431](https://cve.now/CVE-2026-70431.md): Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier provides Groovy scripting features that do not integrate with Script Security… (CVSS 8.8, Jenkins Project Jenkins Multijob Plugin)
- [CVE-2026-70430](https://cve.now/CVE-2026-70430.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project… (CVSS 2.7, Jenkins Project Jenkins)
- [CVE-2026-70429](https://cve.now/CVE-2026-70429.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing… (CVSS 8.1, Jenkins Project Jenkins)
- [CVE-2026-70428](https://cve.now/CVE-2026-70428.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names… (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-70427](https://cve.now/CVE-2026-70427.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the… (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-70426](https://cve.now/CVE-2026-70426.md): In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and… (CVSS 9.0, Jenkins Project Jenkins · Jenkins Project Remoting)
- [CVE-2026-9081](https://cve.now/CVE-2026-9081.md): Langflow OSS is affected by server-side request forgery in provider validation and API request functionality (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-7657](https://cve.now/CVE-2026-7657.md): Langflow OSS is affected by server-side request forgery in provider validation and API request functionality (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-70609](https://cve.now/CVE-2026-70609.md): Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (CVSS 5.7, electron)
- [CVE-2026-44605](https://cve.now/CVE-2026-44605.md): Rpm: heap buffer overflow in ndb slot table parsing (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-70608](https://cve.now/CVE-2026-70608.md): Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path (CVSS 7.2, electron)
- [CVE-2026-17625](https://cve.now/CVE-2026-17625.md): Langflow is affected by OS Command Injection in Model Context Protocol features (CVSS 7.2, IBM Langflow OSS)
- [CVE-2026-10716](https://cve.now/CVE-2026-10716.md): Directus \<12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation (CVSS 7.5, Directus)
- [CVE-2026-17623](https://cve.now/CVE-2026-17623.md): Langflow is affected OS Command Injection in Model Context Protocol features (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-17630](https://cve.now/CVE-2026-17630.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 7.2, IBM Langflow OSS)
- [CVE-2026-20313](https://cve.now/CVE-2026-20313.md): Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerabilities (CVSS 7.7, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20311](https://cve.now/CVE-2026-20311.md): Cisco IOS XE Software Web UI Denial of Service Vulnerability (CVSS 6.3, Cisco IOS XE Software)
- [CVE-2026-20289](https://cve.now/CVE-2026-20289.md): Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability (CVSS 5.7, Cisco RoomOS Software)
- [CVE-2026-17626](https://cve.now/CVE-2026-17626.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-20312](https://cve.now/CVE-2026-20312.md): Cisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vulnerabilities (CVSS 8.8, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20310](https://cve.now/CVE-2026-20310.md): Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access (CVSS 9.1, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-18927](https://cve.now/CVE-2026-18927.md): imranrisal-dev Student-Management-System Shared Upload Helper student\_profile\_pic.php storeProfileImage unrestricted upload (CVSS 5.3, imranrisal-dev Student-Management-System)
- [CVE-2026-20303](https://cve.now/CVE-2026-20303.md): Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities (CVSS 9.9, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20294](https://cve.now/CVE-2026-20294.md): Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability (CVSS 6.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2026-20301](https://cve.now/CVE-2026-20301.md): Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software · Cisco IOS)
- [CVE-2026-20288](https://cve.now/CVE-2026-20288.md): Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability (CVSS 6.5, Cisco Enterprise NFV Infrastructure Software · Cisco Unifie…)
- [CVE-2026-8446](https://cve.now/CVE-2026-8446.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-7646](https://cve.now/CVE-2026-7646.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-9077](https://cve.now/CVE-2026-9077.md): Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-70607](https://cve.now/CVE-2026-70607.md): Electron: window.open features string controls some window options considered privileged (CVSS 5.3, electron)
- [CVE-2026-20308](https://cve.now/CVE-2026-20308.md): Cisco IOS XE Software Web-Based Management Interface Vulnerability (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2026-20304](https://cve.now/CVE-2026-20304.md): Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities (CVSS 9.9, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20273](https://cve.now/CVE-2026-20273.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20272](https://cve.now/CVE-2026-20272.md): Cisco IOS XE Software Security Hardening Release (CVSS 9.8, Cisco IOS XE Software)
- [CVE-2026-20271](https://cve.now/CVE-2026-20271.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20270](https://cve.now/CVE-2026-20270.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20269](https://cve.now/CVE-2026-20269.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20268](https://cve.now/CVE-2026-20268.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20267](https://cve.now/CVE-2026-20267.md): Cisco IOS XE Software Security Hardening Release (CVSS 9.0, Cisco IOS XE Software)
- [CVE-2026-20263](https://cve.now/CVE-2026-20263.md): Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20200](https://cve.now/CVE-2026-20200.md): Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2026-17617](https://cve.now/CVE-2026-17617.md): Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator (CVSS 8.5, IBM Application Gateway Operator)
- [CVE-2026-20124](https://cve.now/CVE-2026-20124.md): Cisco IOS XE Software SNMP Denial of Service Vulnerability (CVSS 7.7, Cisco IOS XE Software)
- [CVE-2026-20198](https://cve.now/CVE-2026-20198.md): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Enterprise NFV Infrastructure Software · Cisco Unifie…)
- [CVE-2026-20028](https://cve.now/CVE-2026-20028.md): Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability (CVSS 5.0, Cisco Terminal Services Agent)
- [CVE-2026-14587](https://cve.now/CVE-2026-14587.md): Unathenticated connection can hold Bolt channel open (CVSS 5.5, neo4j Enterprise Edition · neo4j Community Edition)
- [CVE-2026-70606](https://cve.now/CVE-2026-70606.md): Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (CVSS 5.9, electron)
- [CVE-2026-15656](https://cve.now/CVE-2026-15656.md): IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to… (CVSS 4.3, IBM Maximo Application Suite)
- [CVE-2026-18531](https://cve.now/CVE-2026-18531.md): IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to… (CVSS 5.3, IBM Maximo Application Suite)
- [CVE-2026-70605](https://cve.now/CVE-2026-70605.md): Electron: HTTP redirect followed into local file loader (CVSS 5.9, electron)
- [CVE-2026-10025](https://cve.now/CVE-2026-10025.md): IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability (CVSS 8.2, IBM QRadar)
- [CVE-2026-70604](https://cve.now/CVE-2026-70604.md): Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (CVSS 7.4, electron)
- [CVE-2026-13477](https://cve.now/CVE-2026-13477.md): IBM QRadar SIEM is vulnerable to remote code execution by privileged users (CVSS 4.7, IBM QRadar)
- [CVE-2026-8400](https://cve.now/CVE-2026-8400.md): Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July… (CVSS 8.1, IBM WebSphere Application Server)
- [CVE-2026-12730](https://cve.now/CVE-2026-12730.md): Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers (CVSS 3.8, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-70603](https://cve.now/CVE-2026-70603.md): Electron: shell.openPath path validation bypass via embedded null byte (CVSS 6.0, electron)
- [CVE-2026-70602](https://cve.now/CVE-2026-70602.md): Electron: Extension tab APIs operate across session boundaries (CVSS 6.6, electron)
- [CVE-2026-12762](https://cve.now/CVE-2026-12762.md): Insertion of Sensitive Information into Externally-Accessible File in IBM Business Automation Insights (CVSS 5.3, IBM Cloud Pak For Business Automation)
- [CVE-2026-70601](https://cve.now/CVE-2026-70601.md): Electron: Context isolation bypass via Function.prototype.bind hijack (CVSS 7.5, electron)
- [CVE-2026-70600](https://cve.now/CVE-2026-70600.md): Electron: Cross-origin iframe can position native autofill popup (CVSS 3.1, electron)
- [CVE-2026-9203](https://cve.now/CVE-2026-9203.md): Server-side request forgery in Progress MarkLogic Server (CVSS 8.5, Progress Software MarkLogic Server)
- [CVE-2026-9195](https://cve.now/CVE-2026-9195.md): Cross-site scripting in Progress MarkLogic Server Query Console (CVSS 9.3, Progress Software MarkLogic Server)
- [CVE-2026-9193](https://cve.now/CVE-2026-9193.md): Privilege escalation in Progress MarkLogic Server Hadoop integration (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-70599](https://cve.now/CVE-2026-70599.md): Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin (CVSS 5.9, electron)
- [CVE-2026-9192](https://cve.now/CVE-2026-9192.md): Authentication bypass in Progress MarkLogic Server ODBC App Server (CVSS 9.8, Progress Software MarkLogic Server)
- [CVE-2026-9190](https://cve.now/CVE-2026-9190.md): HTTP request smuggling in Progress MarkLogic Server (CVSS 9.1, Progress Software MarkLogic Server)
- [CVE-2026-8709](https://cve.now/CVE-2026-8709.md): Privilege escalation in Progress MarkLogic Server REST document patch operation (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-7557](https://cve.now/CVE-2026-7557.md): SAML authentication bypass in Progress MarkLogic Server (CVSS 9.1, Progress Software MarkLogic Server)
- [CVE-2026-7329](https://cve.now/CVE-2026-7329.md): Privilege escalation in Progress MarkLogic Server REST query interfaces (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-7327](https://cve.now/CVE-2026-7327.md): Privilege escalation in Progress MarkLogic Server REST API document processing (CVSS 8.1, Progress Software MarkLogic Server)
- [CVE-2026-7326](https://cve.now/CVE-2026-7326.md): Cross-site request forgery in Progress MarkLogic Server Admin UI (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-70598](https://cve.now/CVE-2026-70598.md): Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size (CVSS 3.9, electron)
- [CVE-2026-70597](https://cve.now/CVE-2026-70597.md): Electron: Parent process code-sign check is spoofable (CVSS 6.3, electron)
- [CVE-2026-60053](https://cve.now/CVE-2026-60053.md): Apache Answer: Residual Administrative API Key Access After Role or Account Revocation (CVSS 9.1, Apache Software Foundation Apache Answer)
- [CVE-2026-60023](https://cve.now/CVE-2026-60023.md): Apache Answer: Unauthorized disclosure of deleted or pending answer content (CVSS 7.5, Apache Software Foundation Apache Answer)
- [CVE-2026-50749](https://cve.now/CVE-2026-50749.md): Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions (CVSS 6.5, Apache Software Foundation Apache Answer)
- [CVE-2026-48912](https://cve.now/CVE-2026-48912.md): Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL (CVSS 6.5, Apache Software Foundation Apache Answer)
- [CVE-2026-15572](https://cve.now/CVE-2026-15572.md): Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation (CVSS 8.8, Red Hat build of Keycloak)
- [CVE-2026-48911](https://cve.now/CVE-2026-48911.md): Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow (CVSS 7.5, Apache Software Foundation Apache Answer)
- [CVE-2026-48834](https://cve.now/CVE-2026-48834.md): Apache Answer: Denial of service via crafted Accept-Language header parsing (CVSS 7.5, Apache Software Foundation Apache Answer)
- [CVE-2026-16442](https://cve.now/CVE-2026-16442.md): Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction (CVSS 7.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-53992](https://cve.now/CVE-2026-53992.md): Reflected XSS in ProjectSend thumbnails-regenerate.php via start\_date / end\_date Parameters (CVSS 5.1, ProjectSend)
- [CVE-2026-49331](https://cve.now/CVE-2026-49331.md): Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths (CVSS 6.5, Red Hat OpenShift Container Platform)
- [CVE-2026-39924](https://cve.now/CVE-2026-39924.md): Flarum \< 1.8.16 Session Persistence via Improper Access Token Revocation (CVSS 7.6, Flarum Framework)
- [CVE-2026-70596](https://cve.now/CVE-2026-70596.md): Ghost: Cross-Site Scripting in Feature Image Captions (CVSS 4.3, TryGhost Ghost · ghost)
- [CVE-2026-15587](https://cve.now/CVE-2026-15587.md): Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header (CVSS 9.4, Google Cloud Google SecOps)
- [CVE-2026-39923](https://cve.now/CVE-2026-39923.md): Flarum \< 1.8.16 Password Reset Token Expiry Bypass via POST /reset (CVSS 9.2, Flarum Framework)
- [CVE-2026-70595](https://cve.now/CVE-2026-70595.md): Ghost: Server-Side Request Forgery Mitigation Issue (CVSS 4.0, TryGhost Ghost · ghost)
- [CVE-2026-12410](https://cve.now/CVE-2026-12410.md): CCleaner local privilege escalation via link following on uninstall (CVSS 7.8, Gen Digital CCleaner)
- [CVE-2026-17613](https://cve.now/CVE-2026-17613.md): CVE-2026-17613 (CVSS 7.5, Penpot)
- [CVE-2026-54876](https://cve.now/CVE-2026-54876.md): Client-Side Memory Leak in OCSP Response Checking (CVSS 7.5, OpenSSL)
- [CVE-2026-16100](https://cve.now/CVE-2026-16100.md): Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text (CVSS 6.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16071](https://cve.now/CVE-2026-16071.md): Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary (CVSS 5.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16102](https://cve.now/CVE-2026-16102.md): Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (CVSS 8.1, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-15573](https://cve.now/CVE-2026-15573.md): Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (CVSS 8.1, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16443](https://cve.now/CVE-2026-16443.md): Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation (CVSS 7.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-67623](https://cve.now/CVE-2026-67623.md): Mistral Vibe \< 2.23.3 Arbitrary Command Execution via git fsmonitor Hook (CVSS 8.6, mistralai mistral-vibe)
- [CVE-2026-15979](https://cve.now/CVE-2026-15979.md): Content Egg \<= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion (CVSS 8.1, keywordrush Content Egg – Affiliate Product Importer & Pric…)
- [CVE-2026-7529](https://cve.now/CVE-2026-7529.md): wiseCampaign \<= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API (CVSS 7.5, wisemattic wiseCampaign – WooCommerce Conversions Made Easy)
- [CVE-2026-17506](https://cve.now/CVE-2026-17506.md): Independent Analytics \<= 2.15.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, bensibley Independent Analytics – WordPress Analytics Plugin)
- [CVE-2026-7456](https://cve.now/CVE-2026-7456.md): Udimi Tools \<= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action (CVSS 6.5, webocoders Udimi Tools)
- [CVE-2026-71227](https://cve.now/CVE-2026-71227.md): Libkcapi: infinite loop denial of service in libkcapi \_kcapi\_aio\_read\_all() due to unhandled io\_getevents() timeout return (CVSS 5.1, Stephan Muelle libkcapi · Red Hat Enterprise Linux +2)
- [CVE-2026-71294](https://cve.now/CVE-2026-71294.md): Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions (CVSS 7.7, Cotonti)
- [CVE-2026-71293](https://cve.now/CVE-2026-71293.md): Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current\_user Variable (CVSS 6.2, statamic cms · statamic/cms)
- [CVE-2026-71292](https://cve.now/CVE-2026-71292.md): Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter (CVSS 7.2, intelliants subrion)
- [CVE-2026-71291](https://cve.now/CVE-2026-71291.md): Bolt CMS Server-Side Template Injection via Unsandboxed allow\_twig Field Rendering (CVSS 8.8, bolt core)
- [CVE-2026-71226](https://cve.now/CVE-2026-71226.md): Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path (CVSS 7.3, Stephan Muelle libkcapi · Red Hat Enterprise Linux +2)
- [CVE-2026-71289](https://cve.now/CVE-2026-71289.md): NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API (CVSS 9.8, NASA-AMMOS anms)
- [CVE-2026-71288](https://cve.now/CVE-2026-71288.md): Koha SQL Injection via order\_by and {order}\_ovalue Parameters in guided\_reports.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-71287](https://cve.now/CVE-2026-71287.md): Cacti sanitize\_sql\_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection (CVSS 8.8, cacti)
- [CVE-2026-71286](https://cve.now/CVE-2026-71286.md): ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString (CVSS 6.1, miguelcobain ember-dynamic-render-template)
- [CVE-2026-71285](https://cve.now/CVE-2026-71285.md): Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages (CVSS 8.1, louislam uptime-kuma)
- [CVE-2026-71284](https://cve.now/CVE-2026-71284.md): Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename (CVSS 7.2, fledge-iot fledge)
- [CVE-2026-71283](https://cve.now/CVE-2026-71283.md): Fledge IoT Gateway Backup Restore Tar Path Traversal (CVSS 4.9, fledge-iot fledge)
- [CVE-2026-71282](https://cve.now/CVE-2026-71282.md): ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter (CVSS 6.5, chirpstack)
- [CVE-2026-71281](https://cve.now/CVE-2026-71281.md): peft Unsafe Deserialization via torch.load() Without weights\_only in LoRA-GA and CorDA Modules (CVSS 8.8, huggingface peft)
- [CVE-2026-71280](https://cve.now/CVE-2026-71280.md): go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch (CVSS 8.5, go-shiori shiori)
- [CVE-2026-71279](https://cve.now/CVE-2026-71279.md): Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution (CVSS 8.1, Koenkk zigbee2mqtt)
- [CVE-2026-71278](https://cve.now/CVE-2026-71278.md): rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation (CVSS 9.8, iot-ecology rust-iot-platform)
- [CVE-2026-71277](https://cve.now/CVE-2026-71277.md): rust-iot-platform Authentication Bypass via Non-Validated Authorization Header (CVSS 9.1, iot-ecology rust-iot-platform)
- [CVE-2026-71276](https://cve.now/CVE-2026-71276.md): Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter (CVSS 7.1, absmach magistrala)
- [CVE-2026-71275](https://cve.now/CVE-2026-71275.md): OpenBK7231T - Reflected XSS via OTA host Parameter (CVSS 5.4, openshwprojects OpenBK7231T\_App)
- [CVE-2026-71274](https://cve.now/CVE-2026-71274.md): OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels (CVSS 8.5, openshwprojects OpenBK7231T\_App)
- [CVE-2026-71273](https://cve.now/CVE-2026-71273.md): OpenBK7231T CSRF in /cfg\_wifi\_set Leading to Implicit Web Password Disable and WiFi Hijack (CVSS 6.5, openshwprojects OpenBK7231T\_App)
- [CVE-2026-71272](https://cve.now/CVE-2026-71272.md): Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() (CVSS 8.5, usememos memos)
- [CVE-2026-71271](https://cve.now/CVE-2026-71271.md): Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass (CVSS 8.5, usememos memos)
- [CVE-2026-71270](https://cve.now/CVE-2026-71270.md): Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess (CVSS 8.6, Stirling-Tools Stirling-PDF)
- [CVE-2026-71268](https://cve.now/CVE-2026-71268.md): OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write (CVSS 9.9, thiagoralves OpenPLC\_v3)
- [CVE-2026-71267](https://cve.now/CVE-2026-71267.md): microtar Stack Buffer Overflow in mtar\_write\_file\_header() and mtar\_write\_dir\_header() (CVSS 9.8, rxi microtar)
- [CVE-2026-71266](https://cve.now/CVE-2026-71266.md): tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing (CVSS 7.8, syoyo tinyobjloader-c)
- [CVE-2026-71265](https://cve.now/CVE-2026-71265.md): Domoticz MochadTCP Stack Buffer Overflow via MOCHAD\_RFSEC strcpy() (CVSS 7.5, domoticz)
- [CVE-2026-71264](https://cve.now/CVE-2026-71264.md): WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State (CVSS 8.2, Aircoookie WLED)
- [CVE-2026-71263](https://cve.now/CVE-2026-71263.md): FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() (CVSS 9.1, cwalter-at FreeModbus)
- [CVE-2026-71262](https://cve.now/CVE-2026-71262.md): IoTSharp BlobStorageController Missing Authentication and Path Traversal (CVSS 9.8, IoTSharp)
- [CVE-2026-71261](https://cve.now/CVE-2026-71261.md): dr\_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds (CVSS 7.8, mackron dr\_libs)
- [CVE-2026-71260](https://cve.now/CVE-2026-71260.md): ESPHome web\_server Plaintext Password Disclosure via JSON "value" Field (CVSS 6.5, esphome)
- [CVE-2026-71259](https://cve.now/CVE-2026-71259.md): ESPHome external\_components file:// Scheme Validation Bypass Leading to Remote Code Execution (CVSS 8.6, esphome)
- [CVE-2026-71225](https://cve.now/CVE-2026-71225.md): Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries (CVSS 6.5, Stephan Muelle libkcapi · Red Hat Enterprise Linux +2)
- [CVE-2026-16022](https://cve.now/CVE-2026-16022.md): Command Injection in @oblique/cli (CVSS 7.8, Swiss Federal Office of Information Technology, Systems and…)
- [CVE-2026-0516](https://cve.now/CVE-2026-0516.md): A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the… (CVSS 6.5, SonicWall SonicOS)
- [CVE-2026-71256](https://cve.now/CVE-2026-71256.md): nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object\_id (CVSS 9.8, debevv nanoMODBUS)
- [CVE-2026-71255](https://cve.now/CVE-2026-71255.md): nanoMODBUS Client-Side Out-of-Bounds Write via object\_length in recv\_read\_device\_identification\_res() (CVSS 8.6, debevv nanoMODBUS)
- [CVE-2026-71254](https://cve.now/CVE-2026-71254.md): nanoMODBUS Server-Side Out-of-Bounds Write in handle\_read\_file\_record() (CVSS 9.8, debevv nanoMODBUS)
- [CVE-2026-18933](https://cve.now/CVE-2026-18933.md): wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal (CVSS 7.2, wp-downloadmanager)
- [CVE-2026-64582](https://cve.now/CVE-2026-64582.md): RDMA/rxe: Fix a use-after-free problem in rxe\_mmap (CVSS 7.8, Linux)
- [CVE-2026-46581](https://cve.now/CVE-2026-46581.md): In Eclipse Mojarra versions 2.3 and following, URL handing in \`DefaultFaceletFactory\` does not properly sanitize and/or block remote URLs… (CVSS 7.5, Eclipse Foundation Eclipse Mojarra)
- [CVE-2026-61891](https://cve.now/CVE-2026-61891.md): In Eclipse Theia versions up to and including 1.73.1, the \`@theia/filesystem\` backend exposes HTTP file-download endpoints (\`GET /file\`… (CVSS 7.5, Eclipse Foundation Eclipse Theia)
- [CVE-2026-60009](https://cve.now/CVE-2026-60009.md): In Eclipse Theia versions up to and including 1.73.1, the \`@theia/filesystem\` backend binds \`POST /file-upload\` in every… (CVSS 8.8, Eclipse Foundation Eclipse Theia)
- [CVE-2026-71252](https://cve.now/CVE-2026-71252.md): toner-management - Unauthenticated State-Changing Admin Actions (CVSS 8.2, raghav993 toner-management)
- [CVE-2026-71251](https://cve.now/CVE-2026-71251.md): Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint (CVSS 6.5, akaunting)
- [CVE-2026-71250](https://cve.now/CVE-2026-71250.md): Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding (CVSS 4.3, firefly-iii)
- [CVE-2026-71249](https://cve.now/CVE-2026-71249.md): 299Ko - Unauthenticated Reflected XSS in Public Contact Form (CVSS 6.1, 299Ko)
- [CVE-2026-71248](https://cve.now/CVE-2026-71248.md): Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion (CVSS 9.8, Harsh21Patel Inventory-Management-System-PHP)
- [CVE-2026-71247](https://cve.now/CVE-2026-71247.md): Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents (CVSS 6.5, documenso)
- [CVE-2026-71246](https://cve.now/CVE-2026-71246.md): Pixelfed - Authenticated SSRF via Remote URL Search (CVSS 4.3, pixelfed)
- [CVE-2026-71244](https://cve.now/CVE-2026-71244.md): Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host (CVSS 6.5, paperless-ngx)
- [CVE-2026-71243](https://cve.now/CVE-2026-71243.md): backmeup (npm) - OS Command Injection via Backup Option Values (CVSS 8.8, adaltas backmeup)
- [CVE-2026-71242](https://cve.now/CVE-2026-71242.md): Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy (CVSS 8.2, crater-invoice crater)
- [CVE-2026-71241](https://cve.now/CVE-2026-71241.md): Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History (CVSS 7.5, lyric777 Book-Management-System)
- [CVE-2026-71240](https://cve.now/CVE-2026-71240.md): DjangoCRM - Unauthenticated Open Redirect via toggle\_default\_sorting next\_url Parameter (CVSS 4.3, DjangoCRM django-crm)
- [CVE-2026-71239](https://cve.now/CVE-2026-71239.md): DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering (CVSS 8.1, DjangoCRM django-crm)
- [CVE-2026-71238](https://cve.now/CVE-2026-71238.md): DjangoCRM - Hardcoded Django SECRET\_KEY Enables Session and CSRF Token Forgery (CVSS 9.1, DjangoCRM django-crm)
- [CVE-2026-71237](https://cve.now/CVE-2026-71237.md): Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin (CVSS 9.8, Miantang IoT-PHP)
- [CVE-2026-71236](https://cve.now/CVE-2026-71236.md): Grocy - Stored XSS via HTMLPurifier Output Double-Decode (CVSS 8.7, grocy)
- [CVE-2026-71235](https://cve.now/CVE-2026-71235.md): Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine (CVSS 8.8, absmach magistrala)
- [CVE-2026-71234](https://cve.now/CVE-2026-71234.md): Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token (CVSS 7.5, documize community)
- [CVE-2026-71233](https://cve.now/CVE-2026-71233.md): InvoiceNinja - Stored XSS via Invoice/Quote Terms Field (CVSS 8.7, invoiceninja)
- [CVE-2026-71232](https://cve.now/CVE-2026-71232.md): MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE (CVSS 7.2, magicblack maccms10)
- [CVE-2026-71231](https://cve.now/CVE-2026-71231.md): IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie (CVSS 9.8, thebradleysanders IOTSmartHome)
- [CVE-2026-12609](https://cve.now/CVE-2026-12609.md): In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the \`@theia/plugin-ext\` backend exposes the… (CVSS 7.5, Eclipse Foundation Eclipse Theia)
- [CVE-2026-14574](https://cve.now/CVE-2026-14574.md): In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the \`PreferenceUtils.merge\` function in \`@theia/core\` recursively merges… (CVSS 5.7, Eclipse Foundation Eclipse Theia)
- [CVE-2026-66747](https://cve.now/CVE-2026-66747.md): ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant (CVSS 9.3, Zbtlink CPE2801 Firmware · Zbtlink WE1026-5G-WD Firmware +18)
- [CVE-2026-14304](https://cve.now/CVE-2026-14304.md): In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based… (CVSS 4.6, Eclipse Foundation Eclipse Accessibility Tools Framework)
- [CVE-2026-17578](https://cve.now/CVE-2026-17578.md): Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement (CVSS 2.3, Kong Event Gateway)
- [CVE-2026-44945](https://cve.now/CVE-2026-44945.md): Cross-Cluster Impersonation Confused-Deputy Privilege Escalation (CVSS 9.1, SUSE Rancher)
- [CVE-2026-25703](https://cve.now/CVE-2026-25703.md): Potential information leakage from manager /network/graph API in NeuVector (CVSS 7.3, SUSE NeuVector)
- [CVE-2026-0931](https://cve.now/CVE-2026-0931.md): Denial-of-service vulnerability in M-Files Server (CVSS 6.9, M-Files Server)
- [CVE-2026-15452](https://cve.now/CVE-2026-15452.md): Smash Balloon Social Photo Feed \<= 6.11.3 - Reflected Cross-Site Scripting via REQUEST\_URI Query String (CVSS 4.7, smub Smash Balloon Social Photo Feed – Easy Social Feeds Pl…)
- [CVE-2026-10090](https://cve.now/CVE-2026-10090.md): Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding… (CVSS 9.0, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-10059](https://cve.now/CVE-2026-10059.md): Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator… (CVSS 9.1, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-8029](https://cve.now/CVE-2026-8029.md): SQL Injection Vulnerability in ZTE SmartLife App (CVSS 3.9, ZTE SmartLife)
- [CVE-2026-64581](https://cve.now/CVE-2026-64581.md): xfrm: fix sk\_dst\_cache double-free in xfrm\_user\_policy() (CVSS 7.8, Linux)
- [CVE-2026-64580](https://cve.now/CVE-2026-64580.md): xfrm6: clear dst.dev on error to avoid double netdev\_put in xfrm6\_fill\_dst() (CVSS 7.8, Linux)
- [CVE-2026-64579](https://cve.now/CVE-2026-64579.md): xfrm: policy: preallocate inexact bins before xfrm\_hash\_rebuild reinsert (no CVSS, Linux)
- [CVE-2026-64578](https://cve.now/CVE-2026-64578.md): ksmbd: validate compound request size before reading StructureSize2 (CVSS 8.2, Linux)
- [CVE-2026-64577](https://cve.now/CVE-2026-64577.md): gtp: check skb\_pull\_data() return in gtp1u\_send\_echo\_resp() (CVSS 7.5, Linux)
- [CVE-2026-64576](https://cve.now/CVE-2026-64576.md): nexthop: initialize extack in nh\_res\_bucket\_migrate() (CVSS 7.1, Linux)
- [CVE-2026-64575](https://cve.now/CVE-2026-64575.md): bpf: tcp: fix double sock release on batch realloc (CVSS 7.8, Linux)
- [CVE-2026-64574](https://cve.now/CVE-2026-64574.md): wifi: mac80211: tear down new links on vif update error path (CVSS 7.8, Linux)
- [CVE-2026-64573](https://cve.now/CVE-2026-64573.md): Bluetooth: qca: fix NVM tag length underflow in TLV parser (no CVSS, Linux)
- [CVE-2026-64572](https://cve.now/CVE-2026-64572.md): ipv4: fib: free fib\_alias with kfree\_rcu() on insert error path (no CVSS, Linux)
- [CVE-2026-64571](https://cve.now/CVE-2026-64571.md): wifi: p54: validate RX frame length in p54\_rx\_eeprom\_readback() (no CVSS, Linux)
- [CVE-2026-64570](https://cve.now/CVE-2026-64570.md): wifi: mac80211: fix fils\_discovery double free on alloc failure (CVSS 7.8, Linux)
- [CVE-2026-64569](https://cve.now/CVE-2026-64569.md): mpls: fix NULL deref in mpls\_valid\_fib\_dump\_req() on CONFIG\_INET=n (no CVSS, Linux)
- [CVE-2026-64568](https://cve.now/CVE-2026-64568.md): wifi: mac80211: fix unsol\_bcast\_probe\_resp double free on alloc failure (CVSS 7.8, Linux)
- [CVE-2026-64567](https://cve.now/CVE-2026-64567.md): btrfs: reject free space cache with more entries than pages (CVSS 7.8, Linux)
- [CVE-2026-64566](https://cve.now/CVE-2026-64566.md): xfrm: iptfs: propagate SKBFL\_SHARED\_FRAG in iptfs\_skb\_add\_frags() (CVSS 9.8, Linux)
- [CVE-2026-55997](https://cve.now/CVE-2026-55997.md): Long-lived Rancher registration token exposed in plaintext (CVSS 8.8, rancher)
- [CVE-2026-55998](https://cve.now/CVE-2026-55998.md): Cluster Existence Oracle via Unauthenticated Import Endpoint (CVSS 5.3, SUSE Rancher)
- [CVE-2026-59675](https://cve.now/CVE-2026-59675.md): Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service (CVSS 7.5, SUSE Rancher)
- [CVE-2026-55996](https://cve.now/CVE-2026-55996.md): Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent (CVSS 4.3, SUSE Rancher)
- [CVE-2026-11920](https://cve.now/CVE-2026-11920.md): JoomSport \<= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter (CVSS 4.9, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2026-11977](https://cve.now/CVE-2026-11977.md): WP Post Author \<= 3.9.1 - Authenticated (Author+) SQL Injection (CVSS 6.5, afthemes WP Post Author – Author Box, Multiple Authors, Gue…)
- [CVE-2026-7520](https://cve.now/CVE-2026-7520.md): MailChimp Forms by MailMunch \<= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign\_in'… (CVSS 8.1, Mailmunch Forms for Mailchimp)
- [CVE-2026-11969](https://cve.now/CVE-2026-11969.md): WP TripAdvisor Review Slider \<= 14.3 - Authenticated (Administrator+) SQL Injection (CVSS 4.9, jgwhite33 WP TripAdvisor Review Slider)
- [CVE-2026-4431](https://cve.now/CVE-2026-4431.md): Easy Post Submission \<= 2.3.0 - Missing Authorization (CVSS 9.1, themeruby Easy Post Submission – Frontend Posting, Guest Pu…)
- [CVE-2026-6020](https://cve.now/CVE-2026-6020.md): ShopLentor \<= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API (CVSS 7.2, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-71215](https://cve.now/CVE-2026-71215.md): art-template - Path Traversal in Sub-Template Resolution via include()/extend() (CVSS 7.5, art-template)
- [CVE-2026-71214](https://cve.now/CVE-2026-71214.md): NASA-AMMOS plandev - Client-Supplied session\_variables Bypass Hasura-Origin Authorization in sequencing-server (CVSS 9.8, NASA-AMMOS plandev)
- [CVE-2026-71213](https://cve.now/CVE-2026-71213.md): typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force (CVSS 9.1, typemill)
- [CVE-2026-71212](https://cve.now/CVE-2026-71212.md): xidown - Argument Injection via Unterminated yt-dlp Command Line Construction (CVSS 4.4, indravoyager xidown)
- [CVE-2026-71211](https://cve.now/CVE-2026-71211.md): mlflow - Unvalidated Gateway Secret api\_base Enables SSRF via Gateway Proxy Endpoint (CVSS 7.1, mlflow)
- [CVE-2026-71210](https://cve.now/CVE-2026-71210.md): mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access (CVSS 5.3, mealie-recipes mealie)
- [CVE-2026-71209](https://cve.now/CVE-2026-71209.md): audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal (CVSS 7.5, advplyr audiobookshelf)
- [CVE-2026-71208](https://cve.now/CVE-2026-71208.md): KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation (CVSS 6.5, KubeSphere)
- [CVE-2026-71207](https://cve.now/CVE-2026-71207.md): Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass (CVSS 9.8, mrswapnilsahu Stock-Inventory-Management-System)
- [CVE-2026-71206](https://cve.now/CVE-2026-71206.md): shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion (CVSS 8.2, go-shiori shiori)
- [CVE-2026-71205](https://cve.now/CVE-2026-71205.md): changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force (CVSS 6.5, dgtlmoon changedetection.io)
- [CVE-2026-71204](https://cve.now/CVE-2026-71204.md): changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement (CVSS 6.3, dgtlmoon changedetection.io)
- [CVE-2026-71203](https://cve.now/CVE-2026-71203.md): changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema (CVSS 5.3, dgtlmoon changedetection.io)
- [CVE-2026-71202](https://cve.now/CVE-2026-71202.md): raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic (CVSS 7.5, kosinix raster)
- [CVE-2026-70378](https://cve.now/CVE-2026-70378.md): imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic (CVSS 7.5, theotherphil imagecli)
- [CVE-2026-70377](https://cve.now/CVE-2026-70377.md): imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service (CVSS 7.5, theotherphil imagecli)
- [CVE-2026-70376](https://cve.now/CVE-2026-70376.md): Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE (CVSS 9.6, pluck-cms Pluck CMS)
- [CVE-2026-55747](https://cve.now/CVE-2026-55747.md): PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools (CVSS 6.8, The-Pocket PocketFlow)
- [CVE-2026-55739](https://cve.now/CVE-2026-55739.md): Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion (CVSS 8.2, crater-invoice Crater)
- [CVE-2026-54418](https://cve.now/CVE-2026-54418.md): Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass (CVSS 8.1, Leantime)
- [CVE-2026-54416](https://cve.now/CVE-2026-54416.md): Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist (CVSS 7.2, pluck-cms Pluck CMS)
- [CVE-2026-61486](https://cve.now/CVE-2026-61486.md): Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input (CVSS 9.8, Apache Software Foundation Apache Lucy)
- [CVE-2026-61484](https://cve.now/CVE-2026-61484.md): Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -\> RCE/DoS (CVSS 9.8, Apache Software Foundation Apache Lucy)
- [CVE-2026-12000](https://cve.now/CVE-2026-12000.md): Page and Post Restriction \<= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API (CVSS 7.5, cyberlord92 Page and Post Restriction)
- [CVE-2026-7105](https://cve.now/CVE-2026-7105.md): Xpro Addons \<= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get\_menu\_content\_editor() Function (CVSS 4.3, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-6972](https://cve.now/CVE-2026-6972.md): SKT Skill Bar \<= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sonalsinha21 SKT Skill Bar)
- [CVE-2026-7441](https://cve.now/CVE-2026-7441.md): Simple Yearly Archive \<= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, alphawolf Simple Yearly Archive)
- [CVE-2026-7444](https://cve.now/CVE-2026-7444.md): Search Analytics for WP \<= 1.4.16 - Cross-Site Request Forgery (CVSS 8.1, cornelraiu-1 Search Analytics for WP)
- [CVE-2026-5651](https://cve.now/CVE-2026-5651.md): Askeet \<= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql\_query' Parameter (CVSS 4.9, 2wstechnologies Askeet — Talk to Your WooCommerce Data)
- [CVE-2026-7693](https://cve.now/CVE-2026-7693.md): Backup Migration \<= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter (CVSS 7.2, inisev Backup Migration)
- [CVE-2026-18881](https://cve.now/CVE-2026-18881.md): TableOn \<= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment\_count' Filter Parameter (CVSS 7.5, realmag777 TableOn – WordPress Posts Table Filterable)
- [CVE-2026-6147](https://cve.now/CVE-2026-6147.md): LightSync Pro \<= 2.1.6 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, lightsyncpro LightSync Pro – Connect & Sync Cloud Assets |…)
- [CVE-2026-15281](https://cve.now/CVE-2026-15281.md): User Access Manager \<= 2.3.12 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, gm\_alex User Access Manager)
- [CVE-2026-17505](https://cve.now/CVE-2026-17505.md): TranslatePress \<= 3.2.5 - Reflected Cross-Site Scripting (CVSS 6.1, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-11454](https://cve.now/CVE-2026-11454.md): Groundhogg — CRM, Newsletters, and Marketing Automation \<= 4.5.2 - Insecure Direct Object Reference (CVSS 6.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-5116](https://cve.now/CVE-2026-5116.md): Contact Form 7 – Dynamic Text Extension \<= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 4.4, sevenspark DTX – Dynamic Text Extension for Contact Form)
- [CVE-2026-17532](https://cve.now/CVE-2026-17532.md): Seraphinite Accelerator \<= 2.29.18 - Reflected Cross-Site Scripting (CVSS 6.1, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-6079](https://cve.now/CVE-2026-6079.md): Material Dashboard \<= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion (CVSS 7.3, ho3einie Material Dashboard)
- [CVE-2026-6627](https://cve.now/CVE-2026-6627.md): WPFormify \<= 1.1.1 - Missing Authorization (CVSS 8.2, saadiqbal WPFormify – Stripe Payments with Form and Checkout)
- [CVE-2026-7726](https://cve.now/CVE-2026-7726.md): Layouts for WPBakery \<= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle\_sync' AJAX Action (CVSS 6.5, techeshta Layouts for WPBakery)
- [CVE-2026-6639](https://cve.now/CVE-2026-6639.md): AI Chatbot & Workflow Automation by AIWU \<= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 7.5, wupsales AI Copilot – Content Generator)
- [CVE-2026-5581](https://cve.now/CVE-2026-5581.md): Multi Uploader for Gravity Forms \<= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion (CVSS 9.1, sh1zen Multi Uploader for Gravity Forms)
- [CVE-2026-5108](https://cve.now/CVE-2026-5108.md): Super Progressive Web Apps \<= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting (CVSS 4.4, superpwa Super Progressive Web Apps)
- [CVE-2026-61483](https://cve.now/CVE-2026-61483.md): Apache Lucy: QueryParser unbounded recursion on deeply-nested query -\> C-stack-overflow DoS (CVSS 7.5, Apache Software Foundation Apache Lucy)
- [CVE-2026-71201](https://cve.now/CVE-2026-71201.md): In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned… (CVSS 5.0, OpenStack Ironic)
- [CVE-2026-49004](https://cve.now/CVE-2026-49004.md): PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product (CVSS 6.5, ZTE NX799J)
- [CVE-2026-17515](https://cve.now/CVE-2026-17515.md): MLS Import \< 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport\_logger\_per\_item (CVSS 4.3, MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings)
- [CVE-2026-16055](https://cve.now/CVE-2026-16055.md): Contest Gallery \< 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post\_cg\_login (CVSS 7.5, Contest Gallery)
- [CVE-2026-16036](https://cve.now/CVE-2026-16036.md): miniOrange 2FA \< 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding (CVSS 7.5, miniOrange 2FA)
- [CVE-2026-15372](https://cve.now/CVE-2026-15372.md): WP 2FA \< 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider (CVSS 7.5, WP 2FA)
- [CVE-2026-15360](https://cve.now/CVE-2026-15360.md): Ajax Load More \< 8.0.1 - Unauthenticated SQL Injection via custom\_args (CVSS 9.1, Ajax Load More)
- [CVE-2026-15210](https://cve.now/CVE-2026-15210.md): Login/Signup with Phone Number, OTP Verification \< 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force (CVSS 9.1, OTP Login With Phone Number, OTP Verification)
- [CVE-2026-15230](https://cve.now/CVE-2026-15230.md): YayPricing \< 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure (CVSS 8.1, YayPricing)
- [CVE-2026-14553](https://cve.now/CVE-2026-14553.md): Zportals \< 6.3.4 - Subscriber+ Arbitrary File Upload (CVSS 8.1, zportals)
- [CVE-2025-15677](https://cve.now/CVE-2025-15677.md): GeoDirectory \< 2.8.110 - Editor+ Stored XSS via Place Categories (CVSS 3.5, GeoDirectory)
- [CVE-2026-16993](https://cve.now/CVE-2026-16993.md): DHL for WooCommerce \< 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory (CVSS 3.7, DHL Shipping Germany for WooCommerce)
- [CVE-2026-16981](https://cve.now/CVE-2026-16981.md): DHL for WooCommerce \< 4.0.1 - Unauthenticated Shipping Label Download via IDOR (CVSS 5.3, DHL Shipping Germany for WooCommerce)
- [CVE-2026-16968](https://cve.now/CVE-2026-16968.md): GeoDirectory \< 2.8.168 - Contributor+ User Email Disclosure via geodir\_json\_search\_users (CVSS 6.5, GeoDirectory)
- [CVE-2026-16942](https://cve.now/CVE-2026-16942.md): WP Custom HTML Pages \<= 0.6.2 - Author+ Stored XSS (CVSS 5.4, WP Custom HTML Page)
- [CVE-2026-16940](https://cve.now/CVE-2026-16940.md): Custom Fields for WooCommerce \< 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal (CVSS 10.0, Custom Fields)
- [CVE-2026-16746](https://cve.now/CVE-2026-16746.md): MultiVendorX \< 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint (CVSS 2.7, MultiVendorX)
- [CVE-2026-16736](https://cve.now/CVE-2026-16736.md): User Registration & Membership \< 5.2.6 - Unauthenticated Account Creation While Registration Disabled (CVSS 7.5, User Registration & Membership)
- [CVE-2026-16613](https://cve.now/CVE-2026-16613.md): GDPR Cookie Compliance \< 5.1.0 - Cookie Deletion and Forced Logout via CSRF (CVSS 4.3, GDPR Cookie Compliance)
- [CVE-2026-16605](https://cve.now/CVE-2026-16605.md): MultiVendorX \< 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization (CVSS 7.2, MultiVendorX)
- [CVE-2026-16604](https://cve.now/CVE-2026-16604.md): Content Protector (Passster) \< 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute (CVSS 7.5, Passster)
- [CVE-2026-16603](https://cve.now/CVE-2026-16603.md): Content Protector (Passster) \< 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API (CVSS 7.5, Passster)
- [CVE-2026-16602](https://cve.now/CVE-2026-16602.md): Content Protector (Passster) \< 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint (CVSS 7.5, Passster)
- [CVE-2026-16583](https://cve.now/CVE-2026-16583.md): Orbit Fox by ThemeIsle \< 3.0.8 - Author+ Stored XSS via SVG Upload (CVSS 6.1, Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie…)
- [CVE-2026-16573](https://cve.now/CVE-2026-16573.md): Bit Form \< 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload (CVSS 7.5, Bit Form)
- [CVE-2026-16561](https://cve.now/CVE-2026-16561.md): Sunshine Photo Cart \< 3.6.12 - Unauthenticated Private Gallery Comment Disclosure (CVSS 7.5, Sunshine Photo Cart)
- [CVE-2026-68080](https://cve.now/CVE-2026-68080.md): Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service (CVSS 6.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-70375](https://cve.now/CVE-2026-70375.md): HashBrown CMS - OS Command Injection via Git Deployer Branch Field (CVSS 8.8, HashBrownCMS hashbrown-cms)
- [CVE-2026-70374](https://cve.now/CVE-2026-70374.md): HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation (CVSS 8.8, HashBrownCMS hashbrown-cms)
- [CVE-2026-67592](https://cve.now/CVE-2026-67592.md): Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 7.5, Apache Software Foundation org.apache.qpid:protonj2)
- [CVE-2026-67555](https://cve.now/CVE-2026-67555.md): Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 6.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68078](https://cve.now/CVE-2026-68078.md): Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 6.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-66277](https://cve.now/CVE-2026-66277.md): Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 6.5, Apache Software Foundation org.apache.qpid:proton-j)
- [CVE-2026-67554](https://cve.now/CVE-2026-67554.md): Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68077](https://cve.now/CVE-2026-68077.md): Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service (CVSS 6.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-66276](https://cve.now/CVE-2026-66276.md): Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service (CVSS 6.5, Apache Software Foundation org.apache.qpid:proton-j)
- [CVE-2026-67591](https://cve.now/CVE-2026-67591.md): Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation org.apache.qpid:protonj2)
- [CVE-2026-67553](https://cve.now/CVE-2026-67553.md): Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68075](https://cve.now/CVE-2026-68075.md): Apache Qpid Broker-J: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-66275](https://cve.now/CVE-2026-66275.md): Apache Qpid Proton-J: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation org.apache.qpid:proton-j)
- [CVE-2026-67590](https://cve.now/CVE-2026-67590.md): Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow (CVSS 7.5, Apache Software Foundation org.apache.qpid:protonj2)
- [CVE-2026-67552](https://cve.now/CVE-2026-67552.md): Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow (CVSS 7.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68073](https://cve.now/CVE-2026-68073.md): Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow (CVSS 7.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-66274](https://cve.now/CVE-2026-66274.md): Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow (CVSS 7.5, Apache Software Foundation org.apache.qpid:proton-j · org.a…)
- [CVE-2026-67589](https://cve.now/CVE-2026-67589.md): Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation org.apache.qpid:protonj2)
- [CVE-2026-5062](https://cve.now/CVE-2026-5062.md): PrettyLinks \<= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9, supercleanse PrettyLinks – Affiliate Link Management, URL S…)
- [CVE-2026-7753](https://cve.now/CVE-2026-7753.md): Cost Calculator Builder \<= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure (CVSS 6.5, stylemix Cost Calculator Builder)
- [CVE-2026-15941](https://cve.now/CVE-2026-15941.md): Relevanssi \<= 4.27.1 and Relevanssi Premium \<= 2.30.2 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, Relevanssi Premium – A Better Search · comesio Relevanssi –…)
- [CVE-2026-67551](https://cve.now/CVE-2026-67551.md): Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68060](https://cve.now/CVE-2026-68060.md): Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-66273](https://cve.now/CVE-2026-66273.md): Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation org.apache.qpid:proton-j)
- [CVE-2026-67588](https://cve.now/CVE-2026-67588.md): Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation org.apache.qpid:protonj2)
- [CVE-2026-67465](https://cve.now/CVE-2026-67465.md): Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68074](https://cve.now/CVE-2026-68074.md): Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation org.apache.qpid:qpid-broker-plug…)
- [CVE-2026-66257](https://cve.now/CVE-2026-66257.md): Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation org.apache.qpid:proton-j)
- [CVE-2026-71192](https://cve.now/CVE-2026-71192.md): In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account)… (CVSS 6.0, OpenStack Swift)
- [CVE-2026-71191](https://cve.now/CVE-2026-71191.md): In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on… (CVSS 6.0, OpenStack Swift)
- [CVE-2026-71190](https://cve.now/CVE-2026-71190.md): In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic… (CVSS 8.7, OpenStack Swift)
- [CVE-2026-18903](https://cve.now/CVE-2026-18903.md): yeqifu warehouse FileController.java path traversal (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-55707](https://cve.now/CVE-2026-55707.md): In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. (CVSS 7.1, OpenStack Neutron)
- [CVE-2026-18902](https://cve.now/CVE-2026-18902.md): H3C NX15 esps repeaterproc command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-66839](https://cve.now/CVE-2026-66839.md): NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). (CVSS 6.7, Integrated Systems Technologies NetKids iMark)
- [CVE-2026-66344](https://cve.now/CVE-2026-66344.md): NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). (CVSS 6.7, Integrated Systems Technologies NetKids iMark)
- [CVE-2026-9273](https://cve.now/CVE-2026-9273.md): Membership Plugin – Kadence Memberships \<= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover (CVSS 9.3, stellarwp Membership Plugin – Kadence Memberships)
- [CVE-2026-11421](https://cve.now/CVE-2026-11421.md): ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support \<= 1.17.4 - Authenticated (Custom+) SQL Injection via… (CVSS 6.5, wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…)
- [CVE-2026-8790](https://cve.now/CVE-2026-8790.md): Football Pool \<= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting (CVSS 6.1, antoineh Football Pool)
- [CVE-2026-18322](https://cve.now/CVE-2026-18322.md): Smart Popup by Supsystic \<= 1.12.0 - Unauthenticated Privilege Escalation to Administrator (CVSS 8.8, supsysticcom Smart Popup by Supsystic)
- [CVE-2026-15918](https://cve.now/CVE-2026-15918.md): VikAppointments – Services Booking Calendar \<= 1.2.19 - Unauthenticated SQL Injection (CVSS 7.5, e4jvikwp VikAppointments Services Booking Calendar)
- [CVE-2026-8761](https://cve.now/CVE-2026-8761.md): Dokan \<= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation (CVSS 8.8, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-16143](https://cve.now/CVE-2026-16143.md): VikRentItems Flexible Rental Management System \<= 1.2.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, e4jvikwp VikRentItems Flexible Rental Management System)
- [CVE-2026-18901](https://cve.now/CVE-2026-18901.md): H3C NX15 Web API esps service.add routine (CVSS 8.6, H3C NX15)
- [CVE-2026-18900](https://cve.now/CVE-2026-18900.md): H3C NX15 Backend RPC esps file.exec os command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-18898](https://cve.now/CVE-2026-18898.md): UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-18897](https://cve.now/CVE-2026-18897.md): UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-18907](https://cve.now/CVE-2026-18907.md): PathTravelsal Vulnerability in com.talpa.hibrowser (CVSS 7.5, TECNO Mobile Hi Browser)
- [CVE-2026-18896](https://cve.now/CVE-2026-18896.md): lavkush-maurya Student-Registration-System changepass.php sql injection (CVSS 5.3, lavkush-maurya Student-Registration-System)
- [CVE-2026-18895](https://cve.now/CVE-2026-18895.md): UTT HiPER 1250GW APSecurity\_5g strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-18859](https://cve.now/CVE-2026-18859.md): ESAFENET CDG usbkey;logindojojs sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2026-18856](https://cve.now/CVE-2026-18856.md): Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery (CVSS 5.1, Poesis Rhymix CMS)
- [CVE-2026-18854](https://cve.now/CVE-2026-18854.md): Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection (CVSS 6.9, Shandong Hoteam PDM Product Data Management System)
- [CVE-2025-63822](https://cve.now/CVE-2025-63822.md): SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. (CVSS 8.1)
- [CVE-2025-63823](https://cve.now/CVE-2025-63823.md): My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to… (CVSS 9.8)
- [CVE-2025-70962](https://cve.now/CVE-2025-70962.md): Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2026-52466](https://cve.now/CVE-2026-52466.md): Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. (CVSS 9.8)
- [CVE-2026-67863](https://cve.now/CVE-2026-67863.md): In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. (CVSS 7.5)
- [CVE-2026-67864](https://cve.now/CVE-2026-67864.md): An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation… (CVSS 7.5)
- [CVE-2026-67865](https://cve.now/CVE-2026-67865.md): S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. (CVSS 7.5)
- [CVE-2026-67866](https://cve.now/CVE-2026-67866.md): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the… (CVSS 7.5)
- [CVE-2026-67867](https://cve.now/CVE-2026-67867.md): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions… (CVSS 7.5)
- [CVE-2026-67869](https://cve.now/CVE-2026-67869.md): Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service\_Call validates… (CVSS 7.5)
- [CVE-2026-67870](https://cve.now/CVE-2026-67870.md): In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId… (CVSS 9.8)
- [CVE-2026-67871](https://cve.now/CVE-2026-67871.md): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes… (CVSS 7.5)
- [CVE-2026-67872](https://cve.now/CVE-2026-67872.md): An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling (CVSS 7.5)
- [CVE-2026-67873](https://cve.now/CVE-2026-67873.md): A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.