# CVEs published 2026-09-14

779 CVEs were published on September 14, 2026: 65 critical, 235 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-90842](https://cve.now/CVE-2026-90842.md): PHPGurukul Blood Donor Management System Login\_Model.php cleartext storage in file (CVSS 6.3, PHPGurukul Blood Donor Management System)
- [CVE-2026-90841](https://cve.now/CVE-2026-90841.md): PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection (CVSS 6.9, PHPGurukul Blood Donor Management System)
- [CVE-2026-90840](https://cve.now/CVE-2026-90840.md): PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php \_\_construct improper authentication (CVSS 6.9, PHPGurukul Blood Donor Management System)
- [CVE-2026-90835](https://cve.now/CVE-2026-90835.md): michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting (CVSS 5.1, michaelliao itranswarp)
- [CVE-2026-90831](https://cve.now/CVE-2026-90831.md): GNU Binutils ELF String Table elf-strtab.c \_bfd\_elf\_strtab\_delref memory corruption (CVSS 4.8, GNU Binutils)
- [CVE-2026-90830](https://cve.now/CVE-2026-90830.md): GNU Binutils Section Merge merge.c \_bfd\_write\_merged\_section null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-75945](https://cve.now/CVE-2026-75945.md): A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-75944](https://cve.now/CVE-2026-75944.md): A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently… (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-90829](https://cve.now/CVE-2026-90829.md): GNU Binutils SHT\_GROUP Section elf.c bfd\_elf\_set\_group\_contents null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-75943](https://cve.now/CVE-2026-75943.md): A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all… (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-91201](https://cve.now/CVE-2026-91201.md): DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage (CVSS 5.3, arc53 DocsGPT)
- [CVE-2026-91200](https://cve.now/CVE-2026-91200.md): DevSpace through 6.3.21 Path Traversal via tar extraction (CVSS 8.7, devspace)
- [CVE-2026-91199](https://cve.now/CVE-2026-91199.md): Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint (CVSS 5.3, refly-ai refly)
- [CVE-2026-91198](https://cve.now/CVE-2026-91198.md): GrowthBook through 5.0.1 Information Disclosure via Public Endpoints (CVSS 6.9, growthbook)
- [CVE-2026-91197](https://cve.now/CVE-2026-91197.md): Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory (CVSS 7.1, flowable-engine)
- [CVE-2026-81900](https://cve.now/CVE-2026-81900.md): Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight) (CVSS 7.3, Concrete CMS)
- [CVE-2026-14986](https://cve.now/CVE-2026-14986.md): Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction (CVSS 6.8, zephyrproject zephyr)
- [CVE-2026-77191](https://cve.now/CVE-2026-77191.md): All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization… (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-18116](https://cve.now/CVE-2026-18116.md): Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications (CVSS 7.3, Concrete CMS)
- [CVE-2026-90828](https://cve.now/CVE-2026-90828.md): GNU Binutils ELF Orphan Section ldelf.c elf\_orphan\_compatible null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-73449](https://cve.now/CVE-2026-73449.md): On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic… (CVSS 5.9, Arista Networks EOS)
- [CVE-2026-91146](https://cve.now/CVE-2026-91146.md): Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme (CVSS 5.3, jointakahe takahe)
- [CVE-2026-91145](https://cve.now/CVE-2026-91145.md): Activiti through 7.1.0.M6 Expression Injection via Mail Task (CVSS 7.1, Activiti)
- [CVE-2026-91144](https://cve.now/CVE-2026-91144.md): ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint (CVSS 8.7, zfile-dev zfile)
- [CVE-2026-91143](https://cve.now/CVE-2026-91143.md): goproxy through 15.3 Authentication Bypass via CONNECT (CVSS 6.9, snail007 goproxy)
- [CVE-2026-90827](https://cve.now/CVE-2026-90827.md): GPAC MP4Box base\_scenegraph.c gf\_node\_deactivate\_ex use after free (CVSS 4.8, GPAC)
- [CVE-2026-12944](https://cve.now/CVE-2026-12944.md): Incomplete Security Scanner Blocklist Enables Network-Based Code Execution (CVSS 9.6, IBM Langflow OSS)
- [CVE-2026-76081](https://cve.now/CVE-2026-76081.md): ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions (CVSS 5.5, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-90826](https://cve.now/CVE-2026-90826.md): GPAC MP4Box base\_scenegraph.c gf\_node\_del out-of-bounds (CVSS 2.4, GPAC)
- [CVE-2026-18117](https://cve.now/CVE-2026-18117.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name (CVSS 7.3, Concrete CMS)
- [CVE-2026-91181](https://cve.now/CVE-2026-91181.md): Data Retention Teams Endpoint Leaks Private Team Invite ID (CVSS 6.5, Mattermost)
- [CVE-2026-12756](https://cve.now/CVE-2026-12756.md): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (CVSS 7.1, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-12758](https://cve.now/CVE-2026-12758.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 5.4, IBM Cloud Pak for Business Automation)
- [CVE-2026-90825](https://cve.now/CVE-2026-90825.md): GPAC MP4Box base\_scenegraph.c gf\_node\_unregister use after free (CVSS 4.8, GPAC)
- [CVE-2026-12759](https://cve.now/CVE-2026-12759.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.5, IBM Cloud Pak for Business Automation)
- [CVE-2026-13265](https://cve.now/CVE-2026-13265.md): IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection (CVSS 6.8, IBM MQ)
- [CVE-2026-13275](https://cve.now/CVE-2026-13275.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-13285](https://cve.now/CVE-2026-13285.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-13293](https://cve.now/CVE-2026-13293.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 8.8, IBM MQ)
- [CVE-2026-13287](https://cve.now/CVE-2026-13287.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-14275](https://cve.now/CVE-2026-14275.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 6.3, IBM i Access Family)
- [CVE-2026-14276](https://cve.now/CVE-2026-14276.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 6.3, IBM i Access Family)
- [CVE-2026-14277](https://cve.now/CVE-2026-14277.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 6.3, IBM i Access Family)
- [CVE-2026-18069](https://cve.now/CVE-2026-18069.md): IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine \[\] (CVSS 6.0, IBM i)
- [CVE-2026-19273](https://cve.now/CVE-2026-19273.md): The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-19086](https://cve.now/CVE-2026-19086.md): IBM i is Affected By Multiple Vulnerabilities in PASE \[, \] (CVSS 3.3, IBM i)
- [CVE-2026-90824](https://cve.now/CVE-2026-90824.md): GPAC MP4Box dom\_events.c gf\_sg\_dom\_event\_bubble stack-based overflow (CVSS 4.8, GPAC)
- [CVE-2026-19280](https://cve.now/CVE-2026-19280.md): IBM i is Affected By Multiple Vulnerabilities in PASE \[, \] (CVSS 5.2, IBM i)
- [CVE-2026-90896](https://cve.now/CVE-2026-90896.md): Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII (CVSS 8.2, MarcosCamara01 Ecommerce Template)
- [CVE-2026-19290](https://cve.now/CVE-2026-19290.md): IBM Sterling File Gateway is Vulnerable to Improper Access Control (CVSS 7.5, IBM Sterling File Gateway)
- [CVE-2026-75792](https://cve.now/CVE-2026-75792.md): IBM Sterling Secure Proxy is vulnerable to multiple issues (CVSS 4.3, IBM Sterling Secure Proxy)
- [CVE-2026-78415](https://cve.now/CVE-2026-78415.md): IBM Sterling Secure Proxy is vulnerable to multiple issues (CVSS 5.4, IBM Sterling Secure Proxy)
- [CVE-2026-7884](https://cve.now/CVE-2026-7884.md): IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2026-68489](https://cve.now/CVE-2026-68489.md): Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to… (CVSS 8.7, WebPros Plesk extension "Ruby" · WebPros Plesk extension "N…)
- [CVE-2026-67399](https://cve.now/CVE-2026-67399.md): Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. (CVSS 9.3, WebPros WHMCS)
- [CVE-2026-65409](https://cve.now/CVE-2026-65409.md): A type confusion issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84559](https://cve.now/CVE-2026-84559.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-28960](https://cve.now/CVE-2026-28960.md): A denial-of-service issue was addressed with improved validation. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-43741](https://cve.now/CVE-2026-43741.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-28937](https://cve.now/CVE-2026-28937.md): This issue was addressed through improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-86876](https://cve.now/CVE-2026-86876.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.2, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84518](https://cve.now/CVE-2026-84518.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2026-84631](https://cve.now/CVE-2026-84631.md): This issue was addressed with additional entitlement checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-84563](https://cve.now/CVE-2026-84563.md): A logic issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2026-84534](https://cve.now/CVE-2026-84534.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-43690](https://cve.now/CVE-2026-43690.md): A race condition was addressed with improved locking. (CVSS 4.7, Apple macOS)
- [CVE-2026-84522](https://cve.now/CVE-2026-84522.md): A race condition was addressed with improved state management. (CVSS 5.9, Apple macOS)
- [CVE-2026-86909](https://cve.now/CVE-2026-86909.md): A logic issue was addressed with improved state management. (CVSS 4.4, Apple macOS)
- [CVE-2026-43686](https://cve.now/CVE-2026-43686.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84575](https://cve.now/CVE-2026-84575.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86883](https://cve.now/CVE-2026-86883.md): A privacy issue was addressed with improved handling of files. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-64756](https://cve.now/CVE-2026-64756.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65393](https://cve.now/CVE-2026-65393.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple Xcode · Apple macOS)
- [CVE-2026-65405](https://cve.now/CVE-2026-65405.md): A memory initialization issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-64701](https://cve.now/CVE-2026-64701.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2026-84555](https://cve.now/CVE-2026-84555.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple macOS)
- [CVE-2026-65413](https://cve.now/CVE-2026-65413.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-64717](https://cve.now/CVE-2026-64717.md): A race condition was addressed with improved state handling. (CVSS 6.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84543](https://cve.now/CVE-2026-84543.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.5, Apple macOS)
- [CVE-2026-86895](https://cve.now/CVE-2026-86895.md): An information disclosure issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-84514](https://cve.now/CVE-2026-84514.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-43761](https://cve.now/CVE-2026-43761.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-84580](https://cve.now/CVE-2026-84580.md): The issue was addressed with improved checks. (CVSS 8.4, Apple macOS)
- [CVE-2026-84611](https://cve.now/CVE-2026-84611.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84492](https://cve.now/CVE-2026-84492.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84538](https://cve.now/CVE-2026-84538.md): A denial-of-service issue was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2026-84607](https://cve.now/CVE-2026-84607.md): A race condition was addressed with improved state management. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86905](https://cve.now/CVE-2026-86905.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84596](https://cve.now/CVE-2026-84596.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84578](https://cve.now/CVE-2026-84578.md): A logic issue was addressed with improved checks. (CVSS 8.8, Apple macOS)
- [CVE-2026-84597](https://cve.now/CVE-2026-84597.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86904](https://cve.now/CVE-2026-86904.md): A privacy issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2026-43664](https://cve.now/CVE-2026-43664.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84606](https://cve.now/CVE-2026-84606.md): A privacy issue was addressed with improved handling of identifiers. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-43808](https://cve.now/CVE-2026-43808.md): A use-after-free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-43737](https://cve.now/CVE-2026-43737.md): An authorization issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84581](https://cve.now/CVE-2026-84581.md): A buffer overflow was addressed with improved bounds checking. (CVSS 8.4, Apple macOS)
- [CVE-2026-86894](https://cve.now/CVE-2026-86894.md): A logic issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2026-84515](https://cve.now/CVE-2026-84515.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2026-65412](https://cve.now/CVE-2026-65412.md): A null pointer dereference was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65404](https://cve.now/CVE-2026-65404.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84554](https://cve.now/CVE-2026-84554.md): An integer overflow was addressed with improved input validation. (CVSS 5.9, Apple macOS)
- [CVE-2026-86882](https://cve.now/CVE-2026-86882.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84574](https://cve.now/CVE-2026-84574.md): A permissions issue was addressed with improved state management. (CVSS 4.4, Apple macOS)
- [CVE-2026-43687](https://cve.now/CVE-2026-43687.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84489](https://cve.now/CVE-2026-84489.md): A buffer overflow was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84523](https://cve.now/CVE-2026-84523.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43691](https://cve.now/CVE-2026-43691.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-84535](https://cve.now/CVE-2026-84535.md): An authorization issue was addressed with improved state management. (CVSS 8.2, Apple macOS)
- [CVE-2026-64761](https://cve.now/CVE-2026-64761.md): A privacy issue was addressed with improved handling of user preferences. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-43783](https://cve.now/CVE-2026-43783.md): A race condition was addressed with improved locking. (CVSS 7.8, Apple macOS)
- [CVE-2026-64736](https://cve.now/CVE-2026-64736.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84562](https://cve.now/CVE-2026-84562.md): A race condition was addressed with additional validation. (CVSS 4.7, Apple macOS)
- [CVE-2026-84630](https://cve.now/CVE-2026-84630.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86898](https://cve.now/CVE-2026-86898.md): A logic issue was addressed with improved state management. (CVSS 5.4, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-84519](https://cve.now/CVE-2026-84519.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65371](https://cve.now/CVE-2026-65371.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65408](https://cve.now/CVE-2026-65408.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84558](https://cve.now/CVE-2026-84558.md): A double free issue was addressed with improved memory management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84626](https://cve.now/CVE-2026-84626.md): An information disclosure issue was addressed with improved state management. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86924](https://cve.now/CVE-2026-86924.md): A memory corruption issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86885](https://cve.now/CVE-2026-86885.md): An input validation issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS)
- [CVE-2026-65395](https://cve.now/CVE-2026-65395.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65403](https://cve.now/CVE-2026-65403.md): This issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84553](https://cve.now/CVE-2026-84553.md): A resource exhaustion issue was addressed with improved input validation. (CVSS 7.5, Apple macOS)
- [CVE-2026-65383](https://cve.now/CVE-2026-65383.md): This issue was addressed with improved checks. (CVSS 4.4, Apple macOS)
- [CVE-2026-65415](https://cve.now/CVE-2026-65415.md): A race condition was addressed with additional validation. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86893](https://cve.now/CVE-2026-86893.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-84512](https://cve.now/CVE-2026-84512.md): A buffer overflow was addressed with improved bounds checking. (CVSS 8.8, Apple macOS)
- [CVE-2026-43788](https://cve.now/CVE-2026-43788.md): An integer overflow was addressed with improved input validation. (CVSS 6.6, Apple macOS)
- [CVE-2026-84569](https://cve.now/CVE-2026-84569.md): An access issue was addressed with additional sandbox restrictions on the system pasteboards. (CVSS 5.5, Apple macOS)
- [CVE-2026-84586](https://cve.now/CVE-2026-84586.md): An information disclosure issue was addressed with improved state management. (CVSS 5.5, Apple macOS · Apple watchOS)
- [CVE-2026-84617](https://cve.now/CVE-2026-84617.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84601](https://cve.now/CVE-2026-84601.md): A permissions issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-86903](https://cve.now/CVE-2026-86903.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86889](https://cve.now/CVE-2026-86889.md): A certificate validation issue was addressed with improved certificate validation. (CVSS 4.8, Apple macOS)
- [CVE-2026-84621](https://cve.now/CVE-2026-84621.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65399](https://cve.now/CVE-2026-65399.md): A file quarantine bypass was addressed with additional checks. (CVSS 4.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65376](https://cve.now/CVE-2026-65376.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple macOS)
- [CVE-2026-28966](https://cve.now/CVE-2026-28966.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84549](https://cve.now/CVE-2026-84549.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.5, Apple macOS)
- [CVE-2026-65360](https://cve.now/CVE-2026-65360.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86870](https://cve.now/CVE-2026-86870.md): A heap buffer overflow was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84565](https://cve.now/CVE-2026-84565.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84532](https://cve.now/CVE-2026-84532.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-43696](https://cve.now/CVE-2026-43696.md): An authorization issue was addressed with improved entitlement checks. (CVSS 5.3, Apple macOS)
- [CVE-2026-84524](https://cve.now/CVE-2026-84524.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43815](https://cve.now/CVE-2026-43815.md): A buffer overflow was addressed with improved bounds checking. (CVSS 8.8, Apple macOS)
- [CVE-2026-84573](https://cve.now/CVE-2026-84573.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-84572](https://cve.now/CVE-2026-84572.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84525](https://cve.now/CVE-2026-84525.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple macOS)
- [CVE-2026-43697](https://cve.now/CVE-2026-43697.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 4.3, Apple macOS)
- [CVE-2026-84533](https://cve.now/CVE-2026-84533.md): A cryptographic issue was addressed with improved integrity checks. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-43785](https://cve.now/CVE-2026-43785.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84564](https://cve.now/CVE-2026-84564.md): An uninitialized memory issue was addressed with improved memory initialization. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84636](https://cve.now/CVE-2026-84636.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-65361](https://cve.now/CVE-2026-65361.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-84548](https://cve.now/CVE-2026-84548.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-65398](https://cve.now/CVE-2026-65398.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65377](https://cve.now/CVE-2026-65377.md): A memory corruption issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84620](https://cve.now/CVE-2026-84620.md): An integer overflow was addressed with improved input validation. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86888](https://cve.now/CVE-2026-86888.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84509](https://cve.now/CVE-2026-84509.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-65357](https://cve.now/CVE-2026-65357.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86902](https://cve.now/CVE-2026-86902.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-84600](https://cve.now/CVE-2026-84600.md): An authorization issue was addressed with improved state management. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43674](https://cve.now/CVE-2026-43674.md): An authentication issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-84616](https://cve.now/CVE-2026-84616.md): A type confusion issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84568](https://cve.now/CVE-2026-84568.md): A path traversal issue was addressed with improved path validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-84587](https://cve.now/CVE-2026-84587.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2026-43789](https://cve.now/CVE-2026-43789.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2026-86892](https://cve.now/CVE-2026-86892.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-84513](https://cve.now/CVE-2026-84513.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65414](https://cve.now/CVE-2026-65414.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84544](https://cve.now/CVE-2026-84544.md): An integer overflow was addressed with improved input validation. (CVSS 7.5, Apple macOS)
- [CVE-2026-65382](https://cve.now/CVE-2026-65382.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-65402](https://cve.now/CVE-2026-65402.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84552](https://cve.now/CVE-2026-84552.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86884](https://cve.now/CVE-2026-86884.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84505](https://cve.now/CVE-2026-84505.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2026-65354](https://cve.now/CVE-2026-65354.md): A permissions issue was addressed with additional restrictions. (CVSS 8.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86901](https://cve.now/CVE-2026-86901.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84603](https://cve.now/CVE-2026-84603.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS +1)
- [CVE-2026-86917](https://cve.now/CVE-2026-86917.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2026-84615](https://cve.now/CVE-2026-84615.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2026-43677](https://cve.now/CVE-2026-43677.md): An out-of-bounds write issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple macOS)
- [CVE-2026-84584](https://cve.now/CVE-2026-84584.md): This issue was addressed with improved handling of symlinks. (CVSS 8.4, Apple macOS)
- [CVE-2026-65342](https://cve.now/CVE-2026-65342.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-84510](https://cve.now/CVE-2026-84510.md): A heap buffer overflow was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86891](https://cve.now/CVE-2026-86891.md): An authorization issue was addressed with improved state management. (CVSS 3.5, Apple macOS · Apple watchOS)
- [CVE-2026-28968](https://cve.now/CVE-2026-28968.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65381](https://cve.now/CVE-2026-65381.md): A validation issue existed in the entitlement verification. (CVSS 8.8, Apple macOS)
- [CVE-2026-84551](https://cve.now/CVE-2026-84551.md): A logic issue was addressed with improved validation. (CVSS 4.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65401](https://cve.now/CVE-2026-65401.md): A race condition was addressed with improved state handling. (CVSS 5.5, Apple macOS)
- [CVE-2026-65378](https://cve.now/CVE-2026-65378.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84506](https://cve.now/CVE-2026-84506.md): A use after free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS)
- [CVE-2026-64752](https://cve.now/CVE-2026-64752.md): A memory corruption issue was addressed by removing the vulnerable code. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-86887](https://cve.now/CVE-2026-86887.md): A privacy issue was addressed by removing sensitive data. (CVSS 3.3, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-43790](https://cve.now/CVE-2026-43790.md): The issue was addressed with improved memory handling. (CVSS 9.1, Apple macOS)
- [CVE-2026-65358](https://cve.now/CVE-2026-65358.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84571](https://cve.now/CVE-2026-84571.md): A buffer overflow was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84526](https://cve.now/CVE-2026-84526.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84619](https://cve.now/CVE-2026-84619.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.1, Apple macOS)
- [CVE-2026-84530](https://cve.now/CVE-2026-84530.md): An information disclosure issue was addressed with improved memory management. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43786](https://cve.now/CVE-2026-43786.md): This issue was addressed with additional entitlement checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-84588](https://cve.now/CVE-2026-84588.md): A memory corruption issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple macOS)
- [CVE-2026-84567](https://cve.now/CVE-2026-84567.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2026-20683](https://cve.now/CVE-2026-20683.md): An authentication issue was addressed with improved state management. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84635](https://cve.now/CVE-2026-84635.md): A logic issue was addressed with improved state management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-28933](https://cve.now/CVE-2026-28933.md): A use-after-free issue was addressed with improved memory management. (CVSS 5.5, Apple macOS)
- [CVE-2026-28899](https://cve.now/CVE-2026-28899.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-65362](https://cve.now/CVE-2026-65362.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-65374](https://cve.now/CVE-2026-65374.md): A memory corruption issue was addressed with improved validation. (CVSS 8.8, Apple macOS)
- [CVE-2026-84623](https://cve.now/CVE-2026-84623.md): An authorization issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-84622](https://cve.now/CVE-2026-84622.md): A memory initialization issue was addressed with improved memory handling. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-28836](https://cve.now/CVE-2026-28836.md): A correctness issue was addressed with improved checks. (CVSS 6.1, Apple macOS)
- [CVE-2026-65375](https://cve.now/CVE-2026-65375.md): The issue was addressed with improved authentication. (CVSS 7.5, Apple macOS)
- [CVE-2026-84589](https://cve.now/CVE-2026-84589.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2026-84566](https://cve.now/CVE-2026-84566.md): The issue was addressed with improved memory handling. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-43787](https://cve.now/CVE-2026-43787.md): A logic issue was addressed with improved checks. (CVSS 5.9, Apple macOS)
- [CVE-2026-84531](https://cve.now/CVE-2026-84531.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84618](https://cve.now/CVE-2026-84618.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-43695](https://cve.now/CVE-2026-43695.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84527](https://cve.now/CVE-2026-84527.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43683](https://cve.now/CVE-2026-43683.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84570](https://cve.now/CVE-2026-84570.md): A logic issue was addressed with improved checks. (CVSS 4.4, Apple macOS)
- [CVE-2026-43791](https://cve.now/CVE-2026-43791.md): A validation issue was addressed with improved input sanitization. (CVSS 6.5, Apple macOS)
- [CVE-2026-65359](https://cve.now/CVE-2026-65359.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86869](https://cve.now/CVE-2026-86869.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84507](https://cve.now/CVE-2026-84507.md): A race condition was addressed with improved state handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-64753](https://cve.now/CVE-2026-64753.md): A permissions issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-86886](https://cve.now/CVE-2026-86886.md): A path traversal issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2026-84550](https://cve.now/CVE-2026-84550.md): A race condition was addressed with additional validation. (CVSS 4.7, Apple macOS)
- [CVE-2026-65380](https://cve.now/CVE-2026-65380.md): An issue existed in the handling of snapshots. (CVSS 5.5, Apple macOS)
- [CVE-2026-64712](https://cve.now/CVE-2026-64712.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-84546](https://cve.now/CVE-2026-84546.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84511](https://cve.now/CVE-2026-84511.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86890](https://cve.now/CVE-2026-86890.md): A logic issue was addressed with improved checks. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-84585](https://cve.now/CVE-2026-84585.md): A permissions issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84497](https://cve.now/CVE-2026-84497.md): A buffer overflow was addressed with improved size validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84602](https://cve.now/CVE-2026-84602.md): A type confusion issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86900](https://cve.now/CVE-2026-86900.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2026-64790](https://cve.now/CVE-2026-64790.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-65355](https://cve.now/CVE-2026-65355.md): An information disclosure issue was addressed with improved state management. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84593](https://cve.now/CVE-2026-84593.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2026-84598](https://cve.now/CVE-2026-84598.md): A path traversal issue was addressed with improved path validation. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-84577](https://cve.now/CVE-2026-84577.md): An access issue was addressed with additional sandbox restrictions. (CVSS 8.2, Apple macOS)
- [CVE-2026-84609](https://cve.now/CVE-2026-84609.md): A permissions issue was addressed with improved path validation. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43684](https://cve.now/CVE-2026-43684.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84520](https://cve.now/CVE-2026-84520.md): A buffer overflow was addressed with improved size validation. (CVSS 9.8, Apple macOS)
- [CVE-2026-43692](https://cve.now/CVE-2026-43692.md): A validation issue was addressed with improved input sanitization. (CVSS 8.8, Apple macOS)
- [CVE-2026-84536](https://cve.now/CVE-2026-84536.md): An integer underflow was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2026-65348](https://cve.now/CVE-2026-65348.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84561](https://cve.now/CVE-2026-84561.md): A double free issue was addressed with improved memory management. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-28935](https://cve.now/CVE-2026-28935.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65364](https://cve.now/CVE-2026-65364.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.5, Apple macOS)
- [CVE-2026-43702](https://cve.now/CVE-2026-43702.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84625](https://cve.now/CVE-2026-84625.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65352](https://cve.now/CVE-2026-65352.md): An information disclosure issue was addressed with improved state management. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-43688](https://cve.now/CVE-2026-43688.md): A memory corruption issue was addressed with improved input validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86911](https://cve.now/CVE-2026-86911.md): This issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-65344](https://cve.now/CVE-2026-65344.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-86878](https://cve.now/CVE-2026-86878.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2026-84516](https://cve.now/CVE-2026-84516.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 8.1, Apple macOS)
- [CVE-2026-86897](https://cve.now/CVE-2026-86897.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-84541](https://cve.now/CVE-2026-84541.md): An input validation issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-65411](https://cve.now/CVE-2026-65411.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-65407](https://cve.now/CVE-2026-65407.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65391](https://cve.now/CVE-2026-65391.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-86881](https://cve.now/CVE-2026-86881.md): A certificate validation issue was addressed with improved certificate validation. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84629](https://cve.now/CVE-2026-84629.md): This issue was addressed with additional entitlement checks. (CVSS 7.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-84628](https://cve.now/CVE-2026-84628.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65390](https://cve.now/CVE-2026-65390.md): An integer overflow was addressed with improved input validation. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-84556](https://cve.now/CVE-2026-84556.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple macOS)
- [CVE-2026-65406](https://cve.now/CVE-2026-65406.md): A logic issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65369](https://cve.now/CVE-2026-65369.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84540](https://cve.now/CVE-2026-84540.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-64714](https://cve.now/CVE-2026-64714.md): A memory corruption issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65410](https://cve.now/CVE-2026-65410.md): The issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43719](https://cve.now/CVE-2026-43719.md): A use-after-free issue was addressed with improved memory management. (CVSS 6.5, Apple macOS)
- [CVE-2026-86879](https://cve.now/CVE-2026-86879.md): A denial-of-service issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS)
- [CVE-2026-84517](https://cve.now/CVE-2026-84517.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-28938](https://cve.now/CVE-2026-28938.md): A privacy issue was addressed by moving sensitive data. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-43762](https://cve.now/CVE-2026-43762.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-65345](https://cve.now/CVE-2026-65345.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84583](https://cve.now/CVE-2026-84583.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84612](https://cve.now/CVE-2026-84612.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86910](https://cve.now/CVE-2026-86910.md): A permissions issue was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-84491](https://cve.now/CVE-2026-84491.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43689](https://cve.now/CVE-2026-43689.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84487](https://cve.now/CVE-2026-84487.md): An integer overflow was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65353](https://cve.now/CVE-2026-65353.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84624](https://cve.now/CVE-2026-84624.md): A permissions issue was addressed with improved path validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-65365](https://cve.now/CVE-2026-65365.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-28934](https://cve.now/CVE-2026-28934.md): A buffer overflow was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-84632](https://cve.now/CVE-2026-84632.md): The issue was addressed with improved memory handling. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84560](https://cve.now/CVE-2026-84560.md): An authorization issue was addressed with improved state management. (CVSS 6.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84537](https://cve.now/CVE-2026-84537.md): The issue was addressed with improved memory handling. (CVSS 6.6, Apple macOS)
- [CVE-2026-84521](https://cve.now/CVE-2026-84521.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84576](https://cve.now/CVE-2026-84576.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-90820](https://cve.now/CVE-2026-90820.md): a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization (CVSS 5.3, a2aproject a2a-java)
- [CVE-2026-81901](https://cve.now/CVE-2026-81901.md): Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the \`PUT /pages/{cID}\` endpoint (CVSS 7.2, Concrete CMS)
- [CVE-2026-81902](https://cve.now/CVE-2026-81902.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup (CVSS 7.1, Concrete CMS)
- [CVE-2026-12763](https://cve.now/CVE-2026-12763.md): Langflow is vulnerable to authentication bypass and insufficient session expiration (CVSS 4.2, IBM Langflow OSS)
- [CVE-2026-12765](https://cve.now/CVE-2026-12765.md): Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-90819](https://cve.now/CVE-2026-90819.md): a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification… (CVSS 6.9, a2aproject a2a-java)
- [CVE-2026-12766](https://cve.now/CVE-2026-12766.md): Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-12767](https://cve.now/CVE-2026-12767.md): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-13107](https://cve.now/CVE-2026-13107.md): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (CVSS 7.1, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-53714](https://cve.now/CVE-2026-53714.md): Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode (CVSS 7.4, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-13260](https://cve.now/CVE-2026-13260.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53716](https://cve.now/CVE-2026-53716.md): Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit (CVSS 6.5, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-90818](https://cve.now/CVE-2026-90818.md): netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request… (CVSS 5.3, netease-youdao LobsterAI)
- [CVE-2026-53715](https://cve.now/CVE-2026-53715.md): Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock (CVSS 5.3, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-81903](https://cve.now/CVE-2026-81903.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon (CVSS 7.0, Concrete CMS)
- [CVE-2026-53719](https://cve.now/CVE-2026-53719.md): Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization (CVSS 6.5, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-13272](https://cve.now/CVE-2026-13272.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 5.4, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-13276](https://cve.now/CVE-2026-13276.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.1, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53718](https://cve.now/CVE-2026-53718.md): Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass (CVSS 6.4, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-13277](https://cve.now/CVE-2026-13277.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 4.7, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53713](https://cve.now/CVE-2026-53713.md): Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure (CVSS 9.1, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-53717](https://cve.now/CVE-2026-53717.md): Envoy Gateway: OCI layer extraction allocates make(\[\]byte, h.Size) from untrusted tar header (CVSS 6.5, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-15396](https://cve.now/CVE-2026-15396.md): IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-15412](https://cve.now/CVE-2026-15412.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-54559](https://cve.now/CVE-2026-54559.md): PocketSphinx: Buffer overflows in language and acoustic model loading code (CVSS 6.9, cmusphinx pocketsphinx · pocketsphinx)
- [CVE-2026-54334](https://cve.now/CVE-2026-54334.md): UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor \`ReadCLen\` (CVSS 9.8, theopolis uefi-firmware-parser · uefi-firmware)
- [CVE-2026-54333](https://cve.now/CVE-2026-54333.md): UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable (CVSS 9.8, theopolis uefi-firmware-parser · uefi-firmware)
- [CVE-2026-19816](https://cve.now/CVE-2026-19816.md): PackageKit: dnf5 backend ignores SIMULATE on RepoRemove (CVSS 7.1, PackageKit · Fedora +1)
- [CVE-2026-54247](https://cve.now/CVE-2026-54247.md): Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS (CVSS 4.3, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-54246](https://cve.now/CVE-2026-54246.md): Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication (CVSS 5.7, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-15634](https://cve.now/CVE-2026-15634.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-65838](https://cve.now/CVE-2026-65838.md): Skipper: an oversized declared-\`Content-Length\` body still hands OPA an empty \`parsed\_body\`, so deny-on-presence Rego policies fail OPEN… (CVSS 8.2, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-55244](https://cve.now/CVE-2026-55244.md): ASTEVAL: Sandbox Escape via BaseException Subclasses (CVSS 5.0, lmfit asteval · asteval)
- [CVE-2026-90816](https://cve.now/CVE-2026-90816.md): FFmpeg Duration hlsproto.c parse\_playlist denial of service (CVSS 5.3, FFmpeg)
- [CVE-2026-15887](https://cve.now/CVE-2026-15887.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2026-54632](https://cve.now/CVE-2026-54632.md): SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) (CVSS 7.5, sipsorcery-org sipsorcery · SIPSorcery)
- [CVE-2026-15955](https://cve.now/CVE-2026-15955.md): IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of… (CVSS 7.5, IBM Db2)
- [CVE-2026-16186](https://cve.now/CVE-2026-16186.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2026-54628](https://cve.now/CVE-2026-54628.md): Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode (CVSS 8.6, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-16185](https://cve.now/CVE-2026-16185.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.4, IBM WebSphere Application Server)
- [CVE-2026-82028](https://cve.now/CVE-2026-82028.md): Magistrala \< 1.0.0 SQL Injection via format Parameter in Reader API (CVSS 8.7, absmach magistrala)
- [CVE-2026-50006](https://cve.now/CVE-2026-50006.md): Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode (CVSS 9.1, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-54629](https://cve.now/CVE-2026-54629.md): Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode (CVSS 7.5, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-47253](https://cve.now/CVE-2026-47253.md): Anyquery: Path Traversal in \`clear\_plugin\_cache\` Allows Arbitrary Directory Deletion (CVSS 7.3, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-16187](https://cve.now/CVE-2026-16187.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-18119](https://cve.now/CVE-2026-18119.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values (CVSS 7.0, Concrete CMS)
- [CVE-2026-54447](https://cve.now/CVE-2026-54447.md): garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store (CVSS 8.4, cyberjunky python-garminconnect · garminconnect)
- [CVE-2026-16188](https://cve.now/CVE-2026-16188.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2026-55209](https://cve.now/CVE-2026-55209.md): resdata insufficiently validates untrusted GRDECL files (CVSS 9.8, equinor resdata · resdata)
- [CVE-2026-16190](https://cve.now/CVE-2026-16190.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 3.1, IBM WebSphere Application Server)
- [CVE-2026-16189](https://cve.now/CVE-2026-16189.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2026-73497](https://cve.now/CVE-2026-73497.md): MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to… (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-16335](https://cve.now/CVE-2026-16335.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.1, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16338](https://cve.now/CVE-2026-16338.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 9.9, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16435](https://cve.now/CVE-2026-16435.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2026-73496](https://cve.now/CVE-2026-73496.md): MCP Atlassian: Arbitrary server-side file read via attachment upload (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-16432](https://cve.now/CVE-2026-16432.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 7.7, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16428](https://cve.now/CVE-2026-16428.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-55093](https://cve.now/CVE-2026-55093.md): tract-nnef: integer overflow in NNEF \`.dat\` tensor parser yields an out-of-bounds read on model load (CVSS 6.1, sonos tract · tract-nnef)
- [CVE-2026-90815](https://cve.now/CVE-2026-90815.md): FFmpeg Convolution Filter vf\_convolution.c setup\_3x3 out-of-bounds (CVSS 5.3, FFmpeg)
- [CVE-2026-16466](https://cve.now/CVE-2026-16466.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16673](https://cve.now/CVE-2026-16673.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16702](https://cve.now/CVE-2026-16702.md): IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference (CVSS 6.5, IBM Db2)
- [CVE-2026-17047](https://cve.now/CVE-2026-17047.md): IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery \[\] (CVSS 5.4, IBM Db2 Mirror for i)
- [CVE-2026-17133](https://cve.now/CVE-2026-17133.md): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (CVSS 7.8, IBM App Connect Enterprise)
- [CVE-2026-17156](https://cve.now/CVE-2026-17156.md): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (CVSS 7.8, IBM App Connect Enterprise)
- [CVE-2026-17463](https://cve.now/CVE-2026-17463.md): IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVSS 6.5, IBM Db2)
- [CVE-2026-17416](https://cve.now/CVE-2026-17416.md): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (CVSS 7.8, IBM App Connect Enterprise)
- [CVE-2026-17467](https://cve.now/CVE-2026-17467.md): Vulnerabilities exists in IBM Cloud Pak for Data System (CVSS 8.2, IBM Cloud Pak for Data System)
- [CVE-2026-17628](https://cve.now/CVE-2026-17628.md): Langflow is affected by improper authentication due to missing password verification in the password reset endpoint (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-18065](https://cve.now/CVE-2026-18065.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 5.3, IBM i)
- [CVE-2026-18251](https://cve.now/CVE-2026-18251.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 4.3, IBM i)
- [CVE-2026-16148](https://cve.now/CVE-2026-16148.md): Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-16147](https://cve.now/CVE-2026-16147.md): it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption (CVSS 6.8, zephyrproject zephyr)
- [CVE-2026-15924](https://cve.now/CVE-2026-15924.md): Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-90814](https://cve.now/CVE-2026-90814.md): cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-19624](https://cve.now/CVE-2026-19624.md): NetworkManager-l2tp: local privilege escalation via ipsec.conf injection (CVSS 7.8, NetworkManager-l2tp · Fedora)
- [CVE-2026-90813](https://cve.now/CVE-2026-90813.md): cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-82049](https://cve.now/CVE-2026-82049.md): tarfile extraction filters allow file modification and content disclosure via hard link to symlink (CVSS 8.4, Python Software Foundation CPython · libpython +2)
- [CVE-2026-82519](https://cve.now/CVE-2026-82519.md): Really Simple Security \< 9.8.2 Authorization Bypass via profile-page update handler (CVSS 2.3, reallysimpleplugins Really Simple Security)
- [CVE-2026-90812](https://cve.now/CVE-2026-90812.md): cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-15893](https://cve.now/CVE-2026-15893.md): Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-90811](https://cve.now/CVE-2026-90811.md): cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure (CVSS 4.8, cosmicstack-labs mercury-agent)
- [CVE-2026-18151](https://cve.now/CVE-2026-18151.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 4.2, IBM i)
- [CVE-2026-82035](https://cve.now/CVE-2026-82035.md): PyMuPDF 1.28.2 Path Traversal via extract\_objects() Font Branch (CVSS 7.1, PyMuPDF)
- [CVE-2026-90810](https://cve.now/CVE-2026-90810.md): cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-18515](https://cve.now/CVE-2026-18515.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 4.3, IBM i)
- [CVE-2026-19543](https://cve.now/CVE-2026-19543.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 6.2, IBM Common Licensing)
- [CVE-2026-89023](https://cve.now/CVE-2026-89023.md): ThemeAtelier Domain For Sale \< 3.5.2 Missing Authorization via REST API (CVSS 8.8, ThemeAtelier Domain For Sale)
- [CVE-2026-90809](https://cve.now/CVE-2026-90809.md): HKUDS nanobot ExecTool shell.py ExecTool.\_spawn argument injection (CVSS 6.9, HKUDS nanobot)
- [CVE-2026-59178](https://cve.now/CVE-2026-59178.md): ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade (CVSS 9.8, esphome device-builder · esphome-device-builder)
- [CVE-2026-89021](https://cve.now/CVE-2026-89021.md): MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction (CVSS 6.9, MikroTik RouterOS)
- [CVE-2026-89020](https://cve.now/CVE-2026-89020.md): MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path Leading to Privilege Escalation (CVSS 8.7, MikroTik RouterOS)
- [CVE-2026-77884](https://cve.now/CVE-2026-77884.md): Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure (CVSS 7.1, Brain Trust Gallery - Private Photo Vault)
- [CVE-2026-86830](https://cve.now/CVE-2026-86830.md): Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center (CVSS 7.2, AWS iam-identity-center-team)
- [CVE-2026-90808](https://cve.now/CVE-2026-90808.md): HKUDS nanobot ExecTool shell.py ExecTool.\_spawn incomplete blacklist (CVSS 5.3, HKUDS nanobot)
- [CVE-2026-55832](https://cve.now/CVE-2026-55832.md): Tract: Arbitrary file read via unsanitized ONNX external\_data \`location\` (path traversal) on model load in tract-onnx (CVSS 6.1, sonos tract · tract-onnx)
- [CVE-2026-54181](https://cve.now/CVE-2026-54181.md): backpack/crud: Stored XSS in the color column — the \`@if($column\['escaped'\])\` branches are inverted (CVSS 5.4, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54177](https://cve.now/CVE-2026-54177.md): backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of \`shell.php\` reach the webserver (CVSS 6.6, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54176](https://cve.now/CVE-2026-54176.md): backpack/crud: MyAccountController allows changing the login email without a current-password check (CVSS 6.5, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54180](https://cve.now/CVE-2026-54180.md): backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) (CVSS 7.6, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-91081](https://cve.now/CVE-2026-91081.md): Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint (CVSS 6.9, suitenumerique docs)
- [CVE-2026-91080](https://cve.now/CVE-2026-91080.md): webhook through 2.8.3 Memory Exhaustion via Oversized Request Body (CVSS 8.7, adnanh webhook)
- [CVE-2026-91079](https://cve.now/CVE-2026-91079.md): Huly Platform through 0.7.426 SSRF via Print Service (CVSS 6.3, hcengineering platform)
- [CVE-2026-90946](https://cve.now/CVE-2026-90946.md): DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket (CVSS 8.7, AsyncFuncAI deepwiki-open)
- [CVE-2026-90945](https://cve.now/CVE-2026-90945.md): Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret (CVSS 9.3, crawlab-team crawlab)
- [CVE-2026-90944](https://cve.now/CVE-2026-90944.md): Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse (CVSS 8.8, krayin laravel-crm)
- [CVE-2026-90942](https://cve.now/CVE-2026-90942.md): Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints (CVSS 9.3, casdoor)
- [CVE-2026-57570](https://cve.now/CVE-2026-57570.md): backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation (CVSS 6.5, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54178](https://cve.now/CVE-2026-54178.md): backpack/crud: Arbitrary file deletion via attacker-controlled clear\_\<attr\>\[\] in HasUploadFields::uploadMultipleFilesToDisk (CVSS 8.1, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54182](https://cve.now/CVE-2026-54182.md): backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) (CVSS 8.1, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54175](https://cve.now/CVE-2026-54175.md): backpack/crud: Unverified password change in MyAccountController via mass assignment (CVSS 7.6, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-44162](https://cve.now/CVE-2026-44162.md): fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in \`in\_s3\` (CVSS 2.7, fluent-plugin-s3)
- [CVE-2026-90807](https://cve.now/CVE-2026-90807.md): nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following (CVSS 5.3, nanocoai NanoClaw)
- [CVE-2026-86836](https://cve.now/CVE-2026-86836.md): In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a… (CVSS 8.4, Eclipse Foundation Eclipse Ankaios)
- [CVE-2026-57583](https://cve.now/CVE-2026-57583.md): OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source (CVSS 3.3, OpenZeppelin contracts-wizard · @openzeppelin wizard +7)
- [CVE-2026-54723](https://cve.now/CVE-2026-54723.md): devpi: Database contents leak (CVSS 6.5, devpi · devpi-server)
- [CVE-2026-57578](https://cve.now/CVE-2026-57578.md): DotVVM: Missing authorization in AuthorizeActionFilter (CVSS 9.2, riganti dotvvm)
- [CVE-2026-57577](https://cve.now/CVE-2026-57577.md): DotVVM: ReDOS in routing (CVSS 8.2, riganti dotvvm)
- [CVE-2026-57581](https://cve.now/CVE-2026-57581.md): DotVVM: Unrestricted file upload (CVSS 5.3, riganti dotvvm)
- [CVE-2026-73494](https://cve.now/CVE-2026-73494.md): blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser (CVSS 7.4, http4s blaze · org.http4s blaze-http\_2.13 +5)
- [CVE-2026-53752](https://cve.now/CVE-2026-53752.md): docx4j: Stack Overflow via Cyclic \`w:basedOn\` Style Chain leads to Denial of Service (CVSS 7.5, plutext docx4j · org.docx4j docx4j-core +1)
- [CVE-2026-90806](https://cve.now/CVE-2026-90806.md): DjangoCRM django-crm Bulk Case Update bulk\_views.py BulkUpdateCasesView authorization (CVSS 5.3, DjangoCRM django-crm)
- [CVE-2026-53659](https://cve.now/CVE-2026-53659.md): http4k: Unbounded gzip decompression in \`ServerFilters.GZip\` / \`RequestFilters.GunZip\` allowed memory-exhaustion DoS (CVSS 7.5, http4k · org.http4k:http4k-core)
- [CVE-2026-85892](https://cve.now/CVE-2026-85892.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Edge)
- [CVE-2026-47256](https://cve.now/CVE-2026-47256.md): OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with… (CVSS 5.3, open-telemetry opentelemetry-collector-contrib · github.com…)
- [CVE-2026-55091](https://cve.now/CVE-2026-55091.md): flat-to-nested: Prototype pollution in flat-to-nested convert() via proto parent/id key (CVSS 7.5, joaonuno flat-to-nested-js · flat-to-nested)
- [CVE-2026-54150](https://cve.now/CVE-2026-54150.md): next-video: Unauthenticated arbitrary file read via /api/video request handler (CVSS 6.9, muxinc next-video · next-video)
- [CVE-2026-55866](https://cve.now/CVE-2026-55866.md): SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected (CVSS 3.7, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2026-55847](https://cve.now/CVE-2026-55847.md): Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering (CVSS 6.1, allure-framework allure2 · io.qameta.allure allure-gener… +1)
- [CVE-2026-55846](https://cve.now/CVE-2026-55846.md): Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read (CVSS 6.2, allure-framework allure2 · io.qameta.allure:allure-commandl…)
- [CVE-2026-85921](https://cve.now/CVE-2026-85921.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Windows)
- [CVE-2026-19542](https://cve.now/CVE-2026-19542.md): Stack-based out-of-bounds write in tdelete during tree rebalancing (CVSS 5.6, The GNU C Library glibc)
- [CVE-2026-53495](https://cve.now/CVE-2026-53495.md): containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service (CVSS 6.8, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-54567](https://cve.now/CVE-2026-54567.md): Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) (CVSS 7.5, jugmac00 flask-reuploaded · flask-reuploaded)
- [CVE-2026-49400](https://cve.now/CVE-2026-49400.md): October CMS: PHP Object Injection via Backend Widget Session Storage (CVSS 3.3, octobercms october · october/system)
- [CVE-2026-90805](https://cve.now/CVE-2026-90805.md): subhajitkhan online-clinic-management-system doctorlogin.php sql injection (CVSS 6.9, subhajitkhan online-clinic-management-system)
- [CVE-2026-70658](https://cve.now/CVE-2026-70658.md): pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier (CVSS 7.4, pay-rails pay · pay)
- [CVE-2026-49250](https://cve.now/CVE-2026-49250.md): Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields (CVSS 8.7, edmundhung conform · @conform-to/dom)
- [CVE-2026-91021](https://cve.now/CVE-2026-91021.md): CVE-2026-91021 (CVSS 5.4, Trilium Trillium Notes)
- [CVE-2026-54087](https://cve.now/CVE-2026-54087.md): EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField (CVSS 7.6, EasyCorp EasyAdminBundle · easycorp/easyadmin-bundle)
- [CVE-2026-34151](https://cve.now/CVE-2026-34151.md): XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ (CVSS 8.2, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2026-19499](https://cve.now/CVE-2026-19499.md): Buffer overflow in strfmon and strfmon\_l right-justification padding (CVSS 7.7, The GNU C Library glibc)
- [CVE-2026-55253](https://cve.now/CVE-2026-55253.md): LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure (CVSS 7.7, langchain-ai langchain-mongodb · langchain-ai langgraph-… +3)
- [CVE-2026-46696](https://cve.now/CVE-2026-46696.md): October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls (CVSS 3.3, octobercms system · october/system)
- [CVE-2026-50157](https://cve.now/CVE-2026-50157.md): Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK (CVSS 6.5, auth0 symfony · auth0/symfony)
- [CVE-2026-50276](https://cve.now/CVE-2026-50276.md): dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-rb · datadog)
- [CVE-2026-50270](https://cve.now/CVE-2026-50270.md): dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-java · com.datadoghq dd-java-agent +1)
- [CVE-2026-90804](https://cve.now/CVE-2026-90804.md): GNU Binutils Eh Frame Section elf-eh-frame.c \_bfd\_elf\_write\_section\_eh\_frame buffer overflow (CVSS 2.4, GNU Binutils)
- [CVE-2026-59960](https://cve.now/CVE-2026-59960.md): Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core (CVSS 7.5, argos-ci argos-javascript · @argos-ci/core)
- [CVE-2026-55102](https://cve.now/CVE-2026-55102.md): hashi-vault-js: Vault token and secret values exposed in thrown errors (CVSS 5.8, kyndryl-open-source hashi-vault-js · hashi-vault-js)
- [CVE-2026-55837](https://cve.now/CVE-2026-55837.md): dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens (CVSS 6.8, dbt-labs dbt-mcp · dbt-mcp)
- [CVE-2026-55073](https://cve.now/CVE-2026-55073.md): WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF (CVSS 6.2, Kozea WeasyPrint · weasyprint)
- [CVE-2026-57579](https://cve.now/CVE-2026-57579.md): Alchemy: Unauthenticated nested page API leaks restricted & unpublished content (CVSS 7.5, AlchemyCMS alchemy\_cms · alchemy\_cms)
- [CVE-2026-55416](https://cve.now/CVE-2026-55416.md): Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without… (CVSS 8.8, pimcore · pimcore/pimcore)
- [CVE-2026-55072](https://cve.now/CVE-2026-55072.md): Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name (CVSS 8.5, pimcore · pimcore/pimcore)
- [CVE-2026-55451](https://cve.now/CVE-2026-55451.md): gettext-converter: Prototype pollution in js2i18next() via crafted translation keys (CVSS 8.3, locize gettext-converter · gettext-converter)
- [CVE-2026-90803](https://cve.now/CVE-2026-90803.md): GNU Binutils ld elf64-x86-64.c elf\_x86\_64\_relocate\_section buffer overflow (CVSS 4.8, GNU Binutils)
- [CVE-2026-90802](https://cve.now/CVE-2026-90802.md): GNU Binutils ld libbfd.c bfd\_putl64 null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-90801](https://cve.now/CVE-2026-90801.md): GNU Binutils ld cache.c cache\_bwrite buffer overflow (CVSS 4.8, GNU Binutils)
- [CVE-2026-54452](https://cve.now/CVE-2026-54452.md): safeurl: Missing IPv6 CIDR Ranges in Blocklist (CVSS 6.3, doyensec safeurl · github.com/doyensec/safeurl)
- [CVE-2026-15923](https://cve.now/CVE-2026-15923.md): Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max\_blk\_size (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-53496](https://cve.now/CVE-2026-53496.md): ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes (CVSS 5.3, mattiasw ExifReader · exifreader)
- [CVE-2026-84445](https://cve.now/CVE-2026-84445.md): gRPC-Go: Denial of Service (DoS) via crash due to missing \`:authority\` and \`Host\` headers in the xDS servers (CVSS 8.7, grpc-go · google.golang.org/grpc)
- [CVE-2026-76442](https://cve.now/CVE-2026-76442.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 7.5, Cisco Secure Email)
- [CVE-2026-76461](https://cve.now/CVE-2026-76461.md): Cisco Secure Email Gateway SQL Injection Vulnerability (CVSS 9.8, KEV, Cisco Secure Email)
- [CVE-2026-54156](https://cve.now/CVE-2026-54156.md): node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS (CVSS 7.5, node-opcua)
- [CVE-2026-76443](https://cve.now/CVE-2026-76443.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email)
- [CVE-2026-76440](https://cve.now/CVE-2026-76440.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email)
- [CVE-2026-20353](https://cve.now/CVE-2026-20353.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email)
- [CVE-2026-76441](https://cve.now/CVE-2026-76441.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email and Web Manager)
- [CVE-2026-54155](https://cve.now/CVE-2026-54155.md): node-opcua: Missing nonce verification in UserNameIdentityToken authentication (CVSS 7.7, node-opcua)
- [CVE-2026-57497](https://cve.now/CVE-2026-57497.md): webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules (CVSS 5.3, quic-go webtransport-go · github.com/quic-go/webtransport-go)
- [CVE-2026-61701](https://cve.now/CVE-2026-61701.md): Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution (CVSS 8.8, cesargb laravel-magiclink · cesargb/laravel-magiclink)
- [CVE-2026-90796](https://cve.now/CVE-2026-90796.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-53708](https://cve.now/CVE-2026-53708.md): ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (\`/admin/gateways/test\`) (CVSS 6.6, IBM mcp-context-forge · IBM mcp-contextforge-gateway +1)
- [CVE-2026-90996](https://cve.now/CVE-2026-90996.md): Sssd: sssd: denial of service in nss responder via crafted zero-length requests (CVSS 4.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-90995](https://cve.now/CVE-2026-90995.md): Sssd: sssd: local denial of service due to null pointer dereference in pam responder (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-90994](https://cve.now/CVE-2026-90994.md): Sssd: sssd: denial of service via malformed pam v1 requests (CVSS 4.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-55795](https://cve.now/CVE-2026-55795.md): Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass (CVSS 6.9, craftcms commerce · craftcms/commerce)
- [CVE-2026-4103](https://cve.now/CVE-2026-4103.md): Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution (CVSS 6.4, WSO2 API Control Plane · WSO2 API Manager)
- [CVE-2026-55235](https://cve.now/CVE-2026-55235.md): langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication (CVSS 5.9, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-81301](https://cve.now/CVE-2026-81301.md): Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access (CVSS 8.5, Ekia File Manager)
- [CVE-2026-55236](https://cve.now/CVE-2026-55236.md): langgraph-api: Incomplete assistant authorization in LangGraph Server run creation (CVSS 5.9, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-90795](https://cve.now/CVE-2026-90795.md): itsourcecode Loan Management System navbar.php cross site scripting (CVSS 5.3, itsourcecode Loan Management System)
- [CVE-2026-54529](https://cve.now/CVE-2026-54529.md): SQLAdmin: Unvalidated sortBy parameter in \`ModelView\` bypasses \`column\_sortable\_list\` (CVSS 5.3, smithyhq sqladmin · sqladmin)
- [CVE-2026-90943](https://cve.now/CVE-2026-90943.md): parallax filament-comments through 3.0.0 Stored XSS via Comment Body (CVSS 8.7, parallax/filament-comments)
- [CVE-2026-61534](https://cve.now/CVE-2026-61534.md): Yayson: Prototype pollution in the Store/LegacyStore deserialization (CVSS 9.1, confetti yayson · yayson)
- [CVE-2026-47701](https://cve.now/CVE-2026-47701.md): OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth (CVSS 7.7, open-telemetry opentelemetry-operator · github.com/open-tel…)
- [CVE-2026-88819](https://cve.now/CVE-2026-88819.md): In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. (CVSS 6.3, Eclipse Foundation Eclipse Data Plane Core)
- [CVE-2026-54541](https://cve.now/CVE-2026-54541.md): Nimiq: Panic in TrieProof::verify via child\_index unwrap on equal-length keys (CVSS 3.7, nimiq core-rs-albatross · nimiq-primitives)
- [CVE-2026-90794](https://cve.now/CVE-2026-90794.md): GPAC MP4Box vrml\_tools.c gf\_sg\_script\_load use after free (CVSS 5.3, GPAC)
- [CVE-2026-54542](https://cve.now/CVE-2026-54542.md): Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof (CVSS 3.7, nimiq core-rs-albatross · nimiq-primitives)
- [CVE-2025-24890](https://cve.now/CVE-2025-24890.md): gix-sec safe.directory protections absent for elevated administrators (CVSS 6.8, GitoxideLabs gitoxide · gix-sec)
- [CVE-2026-90463](https://cve.now/CVE-2026-90463.md): Sssd: local oob read in nss service request parsers (\`sss\_nss\_protocol\_parse\_svc\_name\` / \`sss\_nss\_protocol\_parse\_svc\_port\`) (CVSS 4.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-90947](https://cve.now/CVE-2026-90947.md): Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-90793](https://cve.now/CVE-2026-90793.md): GPAC MP4Box base\_scenegraph.c gf\_node\_get\_name use after free (CVSS 5.3, GPAC)
- [CVE-2026-57145](https://cve.now/CVE-2026-57145.md): PraisonAI: Arbitrary File Read/Write via \`multiedit\` Tool Without Path Validation (CVSS 9.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57132](https://cve.now/CVE-2026-57132.md): PraisonAI: PRAISONAI\_CALL\_AUTH=disabled environment variable unconditionally disables authentication (CVSS 8.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57131](https://cve.now/CVE-2026-57131.md): praisonai: Jobs API exposes agent-execution endpoints with no authentication (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57124](https://cve.now/CVE-2026-57124.md): PraisonAI UI MCP connect endpoint allows unauthenticated local command execution (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57122](https://cve.now/CVE-2026-57122.md): PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) (CVSS 8.6, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57127](https://cve.now/CVE-2026-57127.md): praisonai: recipe serve auth middleware silently disables itself when no secret is set (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56839](https://cve.now/CVE-2026-56839.md): PraisonAI Code agent tools fail open without a workspace boundary (CVSS 7.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-90792](https://cve.now/CVE-2026-90792.md): GPAC MP4Box base\_scenegraph.c gf\_node\_list\_get\_child null pointer dereference (CVSS 5.3, GPAC)
- [CVE-2026-57119](https://cve.now/CVE-2026-57119.md): PraisonAI: Unauthenticated Local File Inclusion via agent\_file path in the Jobs API (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57129](https://cve.now/CVE-2026-57129.md): PraisonAI: Arbitrary File Read via \`@file:\` Mention Path Traversal (CVSS 7.5, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-57126](https://cve.now/CVE-2026-57126.md): praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS (CVSS 8.5, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-57120](https://cve.now/CVE-2026-57120.md): PraisonAI: execute\_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder (CVSS 6.5, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-59570](https://cve.now/CVE-2026-59570.md): Android ZCC denial of service (CVSS 7.5, Zscaler Client Connector)
- [CVE-2026-57123](https://cve.now/CVE-2026-57123.md): PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in (CVSS 9.8, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-90791](https://cve.now/CVE-2026-90791.md): GPAC MP4Box base\_scenegraph.c gf\_node\_unregister use after free (CVSS 5.3, GPAC)
- [CVE-2026-59569](https://cve.now/CVE-2026-59569.md): Android ZCC VPN API method privilege escalation (CVSS 8.1, Zscaler Client Connector)
- [CVE-2026-25687](https://cve.now/CVE-2026-25687.md): ZCC race condition in ZPA tunnel handler (CVSS 8.1, Zscaler Client Connector)
- [CVE-2026-90790](https://cve.now/CVE-2026-90790.md): a2aproject a2a-python Push Notification Sender base\_push\_notification\_sender.py \_dispatch\_notification server-side request forgery (CVSS 5.3, a2aproject a2a-python)
- [CVE-2026-57130](https://cve.now/CVE-2026-57130.md): PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters (CVSS 8.1, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-57128](https://cve.now/CVE-2026-57128.md): PraisonAI: Unauthenticated Event Injection via SSE \`/publish\` Endpoint (CVSS 4.3, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-57115](https://cve.now/CVE-2026-57115.md): PraisonAI: SpiderTools redirect-target SSRF protection bypass (CVSS 6.5, MervinPraison PraisonAI · MervinPraison praisonaiagents +1)
- [CVE-2026-57125](https://cve.now/CVE-2026-57125.md): PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonaiagents +2)
- [CVE-2026-82427](https://cve.now/CVE-2026-82427.md): Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name (CVSS 7.8, Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-82428](https://cve.now/CVE-2026-82428.md): Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys (CVSS 8.8, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-82429](https://cve.now/CVE-2026-82429.md): Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher (CVSS 7.8, Apache Software Foundation org.apache.storm:storm-core)
- [CVE-2026-82430](https://cve.now/CVE-2026-82430.md): Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant (CVSS 7.8, Apache Software Foundation org.apache.storm:storm-core)
- [CVE-2026-90789](https://cve.now/CVE-2026-90789.md): itsourcecode Leave Management System login.php sql injection (CVSS 6.9, itsourcecode Leave Management System)
- [CVE-2026-82431](https://cve.now/CVE-2026-82431.md): Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users (CVSS 9.8, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-82433](https://cve.now/CVE-2026-82433.md): Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI (CVSS 6.5, Apache Software Foundation org.apache.storm:storm-server ·…)
- [CVE-2026-82432](https://cve.now/CVE-2026-82432.md): Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides (CVSS 8.1, Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-82019](https://cve.now/CVE-2026-82019.md): TripleLift video-bundle.js DOM-based XSS via postMessage (CVSS 2.3, TripleLift video-bundle.js)
- [CVE-2026-82434](https://cve.now/CVE-2026-82434.md): Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs (CVSS 10.0, Apache Software Foundation org.apache.storm:storm-server ·…)
- [CVE-2026-12985](https://cve.now/CVE-2026-12985.md): Mattermost DCR redirect URI allowlist bypass via improper URL component validation (CVSS 6.8, Mattermost)
- [CVE-2026-15600](https://cve.now/CVE-2026-15600.md): SQL Injection in Alior Bank raty PrestaShop module (CVSS 8.6, Alior Bank raty)
- [CVE-2026-7848](https://cve.now/CVE-2026-7848.md): SQL Injection in Alior Bank raty PrestaShop module (CVSS 8.6, Alior Bank raty)
- [CVE-2026-82435](https://cve.now/CVE-2026-82435.md): Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder (CVSS 9.8, Apache Software Foundation org.apache.storm:storm-client)
- [CVE-2026-82437](https://cve.now/CVE-2026-82437.md): Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer (CVSS 4.3, Apache Software Foundation org.apache.storm:storm-webapp)
- [CVE-2026-82426](https://cve.now/CVE-2026-82426.md): Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location (CVSS 6.5, Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-82438](https://cve.now/CVE-2026-82438.md): Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins (CVSS 8.1, Apache Software Foundation org.apache.storm:storm-webapp)
- [CVE-2026-90788](https://cve.now/CVE-2026-90788.md): magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection (CVSS 5.1, magicblack MacCMS10)
- [CVE-2026-82439](https://cve.now/CVE-2026-82439.md): Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC (CVSS 9.8, Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-82920](https://cve.now/CVE-2026-82920.md): Mattermost ABAC parent policy bypass via policy update endpoint (CVSS 5.5, Mattermost)
- [CVE-2026-82441](https://cve.now/CVE-2026-82441.md): Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys (CVSS 9.1, Apache Software Foundation org.apache.storm:storm-server)
- [CVE-2026-90941](https://cve.now/CVE-2026-90941.md): novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint (CVSS 4.3, 201206030 novel-plus)
- [CVE-2026-90940](https://cve.now/CVE-2026-90940.md): novel-plus through 5.3.3 Default Cache Management Password in the Front Portal (CVSS 5.3, 201206030 novel-plus)
- [CVE-2026-90939](https://cve.now/CVE-2026-90939.md): novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint (CVSS 6.5, 201206030 novel-plus)
- [CVE-2026-84179](https://cve.now/CVE-2026-84179.md): Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page (CVSS 6.5, Apache Software Foundation org.apache.storm:storm-server ·…)
- [CVE-2026-86348](https://cve.now/CVE-2026-86348.md): MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process (CVSS 4.3, Mattermost)
- [CVE-2026-86349](https://cve.now/CVE-2026-86349.md): Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting (CVSS 4.3, Mattermost)
- [CVE-2026-90787](https://cve.now/CVE-2026-90787.md): Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management (CVSS 6.9, Soarkey StudentManagement)
- [CVE-2026-90786](https://cve.now/CVE-2026-90786.md): Dvidelabs flatcc Duplicate Symbol semantics.c align\_order\_members assertion (CVSS 6.9, Dvidelabs flatcc)
- [CVE-2026-73191](https://cve.now/CVE-2026-73191.md): Apache Syncope: CAS service URL injection via Forwarded HTTP headers (CVSS 6.1, Apache Software Foundation org.apache.syncope:syncope-sra)
- [CVE-2026-7208](https://cve.now/CVE-2026-7208.md): Yealink SIP-T33G \< 124.87.0.0 Race Condition via Diagnostic File Deletion (CVSS 6.0, Yealink SIP-T33G)
- [CVE-2026-73195](https://cve.now/CVE-2026-73195.md): Apache Syncope: CSV export spreadsheet formula injection (CVSS 7.3, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-73236](https://cve.now/CVE-2026-73236.md): Apache Syncope: Cross-Realm authorization bypass in delegated administration (CVSS 7.5, Apache Software Foundation Apache Syncope)
- [CVE-2026-90961](https://cve.now/CVE-2026-90961.md): MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials (CVSS 9.3, MISP)
- [CVE-2026-90949](https://cve.now/CVE-2026-90949.md): Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-90948](https://cve.now/CVE-2026-90948.md): Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-90785](https://cve.now/CVE-2026-90785.md): Dvidelabs flatcc Struct Analysis semantics.c analyze\_struct assertion (CVSS 6.9, Dvidelabs flatcc)
- [CVE-2026-73370](https://cve.now/CVE-2026-73370.md): Apache Syncope: Cross-Realm boundaries reconciliation bypass (CVSS 9.8, Apache Software Foundation org.apache.syncope.core.idm:sync…)
- [CVE-2026-73178](https://cve.now/CVE-2026-73178.md): Apache Syncope: JWT Access Token takeover (CVSS 7.5, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-90957](https://cve.now/CVE-2026-90957.md): MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures (CVSS 5.1, MISP)
- [CVE-2026-90784](https://cve.now/CVE-2026-90784.md): Dvidelabs flatcc semantics.c fb\_clear\_parser memory leak (CVSS 6.9, Dvidelabs flatcc)
- [CVE-2026-78299](https://cve.now/CVE-2026-78299.md): In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract… (CVSS 9.1, Eclipse Foundation Eclipse Embedded CDT)
- [CVE-2026-73470](https://cve.now/CVE-2026-73470.md): Apache Syncope: Delegating users can grant unowned Roles (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-73579](https://cve.now/CVE-2026-73579.md): Apache Syncope: Non-recursive Any search could skip Realms restrictions (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-75015](https://cve.now/CVE-2026-75015.md): Apache Syncope: Nested secrets leak cleartext into audit records readable (CVSS 4.9, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-75030](https://cve.now/CVE-2026-75030.md): Apache Syncope: Incomplete authorization checks for Group members deprovisioning (CVSS 9.8, Apache Software Foundation org.apache.syncope.core.idrepo:s…)
- [CVE-2026-77051](https://cve.now/CVE-2026-77051.md): Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-73668](https://cve.now/CVE-2026-73668.md): Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values (CVSS 9.8, Apache Software Foundation org.apache.syncope.core.idm:sync…)
- [CVE-2026-77147](https://cve.now/CVE-2026-77147.md): Apache Syncope: Groovy Sandbox escape for empty CommandArgs (CVSS 6.5, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-90938](https://cve.now/CVE-2026-90938.md): LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket (CVSS 8.8, langbot-app LangBot)
- [CVE-2026-90937](https://cve.now/CVE-2026-90937.md): froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL (CVSS 9.4, froxlor)
- [CVE-2026-90936](https://cve.now/CVE-2026-90936.md): Froxlor before 2.3.7 Information Disclosure via customer\_email.php (CVSS 5.3, froxlor · froxlor/froxlor)
- [CVE-2026-90935](https://cve.now/CVE-2026-90935.md): Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API (CVSS 5.3, froxlor · froxlor/froxlor)
- [CVE-2026-90934](https://cve.now/CVE-2026-90934.md): EspoCRM before 10.0.4 Field-level Security Bypass via Attendees (CVSS 8.7, espocrm)
- [CVE-2026-90933](https://cve.now/CVE-2026-90933.md): laradashboard through 1.2.2 Missing Authorization via License API (CVSS 7.1, laradashboard)
- [CVE-2026-90932](https://cve.now/CVE-2026-90932.md): LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE (CVSS 8.6, laradashboard)
- [CVE-2026-90931](https://cve.now/CVE-2026-90931.md): LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload (CVSS 5.1, laradashboard)
- [CVE-2026-90930](https://cve.now/CVE-2026-90930.md): File Browser through 2.63.23 Path Traversal via Symlink Alias (CVSS 7.6, filebrowser)
- [CVE-2026-90929](https://cve.now/CVE-2026-90929.md): File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup (CVSS 7.2, filebrowser)
- [CVE-2026-90928](https://cve.now/CVE-2026-90928.md): File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint (CVSS 7.1, filebrowser)
- [CVE-2026-90927](https://cve.now/CVE-2026-90927.md): filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message (CVSS 7.1, filebrowser)
- [CVE-2024-58383](https://cve.now/CVE-2024-58383.md): Froxlor before 2.2.0 Insecure File Permissions mysql.conf (CVSS 8.4, froxlor · froxlor/froxlor)
- [CVE-2026-77181](https://cve.now/CVE-2026-77181.md): Apache Syncope: ClientApp update entitlement not effective (CVSS 9.8, Apache Software Foundation org.apache.syncope.core.am:synco…)
- [CVE-2026-90716](https://cve.now/CVE-2026-90716.md): marcobambini Gravity Number gravity\_parser.c parse\_number\_expression out-of-bounds (CVSS 5.1, marcobambini Gravity)
- [CVE-2026-90955](https://cve.now/CVE-2026-90955.md): MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load (CVSS 4.6, MISP)
- [CVE-2026-77883](https://cve.now/CVE-2026-77883.md): Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist (CVSS 4.9, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-90715](https://cve.now/CVE-2026-90715.md): marcobambini Gravity udp json-parser gravity\_json.c integer overflow (CVSS 6.9, marcobambini Gravity)
- [CVE-2026-78318](https://cve.now/CVE-2026-78318.md): Apache Syncope: Unauthenticated reflected XSS in Console and Enduser (CVSS 6.1, Apache Software Foundation org.apache.syncope.client.idrepo…)
- [CVE-2026-78330](https://cve.now/CVE-2026-78330.md): Apache Syncope: Privilege escalation for admin user via JWT authentication (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-78336](https://cve.now/CVE-2026-78336.md): Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user (CVSS 7.5, Apache Software Foundation org.apache.syncope.ext.oidcc4ui:…)
- [CVE-2026-90714](https://cve.now/CVE-2026-90714.md): marcobambini Gravity JSON parser gravity\_json.c memory corruption (CVSS 5.3, marcobambini Gravity)
- [CVE-2026-12258](https://cve.now/CVE-2026-12258.md): Inadequate access control in the Hiperdino REST API (CVSS 9.2, Hiperdino REST API)
- [CVE-2026-90713](https://cve.now/CVE-2026-90713.md): vllm-project vLLM tiktoken vocab File mod.rs new denial of service (CVSS 4.8, vllm-project vLLM)
- [CVE-2026-90712](https://cve.now/CVE-2026-90712.md): Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service (CVSS 5.3, Gitlawb openclaude)
- [CVE-2026-90919](https://cve.now/CVE-2026-90919.md): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization (CVSS 9.3, ModelTC LightLLM)
- [CVE-2026-90710](https://cve.now/CVE-2026-90710.md): taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery (CVSS 6.9, taisan tarzan-cms)
- [CVE-2026-21391](https://cve.now/CVE-2026-21391.md): Improper Claim Validation in PingAM OIDC Provider (CVSS 9.5, Ping Identity PingAM)
- [CVE-2026-90709](https://cve.now/CVE-2026-90709.md): Yot CMS Admin Console admin.php eval code injection (CVSS 5.1, Yot CMS)
- [CVE-2026-79701](https://cve.now/CVE-2026-79701.md): Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 (CVSS 6.9, joomshaper.com SP Page Builder (Pro) extension for Joomla)
- [CVE-2026-81566](https://cve.now/CVE-2026-81566.md): Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 5.1, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-90708](https://cve.now/CVE-2026-90708.md): Yot CMS Cookie global.php login sql injection (CVSS 6.9, Yot CMS)
- [CVE-2026-81565](https://cve.now/CVE-2026-81565.md): Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 6.9, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-79700](https://cve.now/CVE-2026-79700.md): Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro… (CVSS 6.9, joomshaper.com SP Page Builder (Pro) extension for Joomla)
- [CVE-2026-81564](https://cve.now/CVE-2026-81564.md): Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free… (CVSS 7.0, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-78375](https://cve.now/CVE-2026-78375.md): Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1… (CVSS 8.6, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-10556](https://cve.now/CVE-2026-10556.md): Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. (CVSS 5.3, Mattermost)
- [CVE-2026-82232](https://cve.now/CVE-2026-82232.md): Apache Syncope: SQL injection via sort parameter in Task search (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-90707](https://cve.now/CVE-2026-90707.md): Open5GS Old AMF Discovery Fallback nnrf-handler.c amf\_nnrf\_try\_old\_amf\_discovery\_fallback use after free (CVSS 6.9, Open5GS)
- [CVE-2026-13417](https://cve.now/CVE-2026-13417.md): Boards plugin denial of service via unvalidated block fields.properties (CVSS 4.3, Mattermost)
- [CVE-2026-86460](https://cve.now/CVE-2026-86460.md): Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence (CVSS 9.8, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-9812](https://cve.now/CVE-2026-9812.md): Missing property field ownership validation in Playbooks run property update endpoint (CVSS 6.5, Mattermost)
- [CVE-2026-20773](https://cve.now/CVE-2026-20773.md): Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint (CVSS 8.5, Ping Identity PingFederate)
- [CVE-2026-87779](https://cve.now/CVE-2026-87779.md): Apache Syncope: AES Secret Key disclosure via log output (CVSS 7.5, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-8821](https://cve.now/CVE-2026-8821.md): Playbooks run owner channel membership permission bypass (CVSS 7.1, Mattermost)
- [CVE-2026-5132](https://cve.now/CVE-2026-5132.md): Unbounded zlib decompression in Calls SDP WebSocket messages (CVSS 6.5, Mattermost)
- [CVE-2026-15814](https://cve.now/CVE-2026-15814.md): Uploading a crafted image causes excessive memory allocation in the Mattermost Server (CVSS 6.5, Mattermost)
- [CVE-2026-87785](https://cve.now/CVE-2026-87785.md): Apache Syncope: JWT subject spoofing (CVSS 9.1, Apache Software Foundation org.apache.syncope.core:syncope-…)
- [CVE-2026-90891](https://cve.now/CVE-2026-90891.md): ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access Control (CVSS 6.8, ASRock Polychrome SYNC/RGB for MB · ASRock Polychrome SYNC/…)
- [CVE-2026-10542](https://cve.now/CVE-2026-10542.md): Playbooks channel action update validation issue (CVSS 5.0, Mattermost)
- [CVE-2026-90890](https://cve.now/CVE-2026-90890.md): ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference (CVSS 6.8, ASRock Polychrome SYNC/RGB for MB · ASRock Polychrome SYNC/…)
- [CVE-2026-14344](https://cve.now/CVE-2026-14344.md): Inconsistent authorization checks in Mattermost Boards endpoints (CVSS 4.3, Mattermost)
- [CVE-2026-12882](https://cve.now/CVE-2026-12882.md): Mattermost Markdown autolink parsing denial of service (CVSS 4.3, Mattermost)
- [CVE-2026-90706](https://cve.now/CVE-2026-90706.md): D-Link DWR-M921 formWsc os command injection (CVSS 5.1, D-Link DWR-M921)
- [CVE-2026-11993](https://cve.now/CVE-2026-11993.md): Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion (CVSS 4.3, Mattermost)
- [CVE-2026-89180](https://cve.now/CVE-2026-89180.md): Thinking Software Technology｜EFence - SQL Injection (CVSS 8.7, Thinking Software Technology EFence)
- [CVE-2026-14259](https://cve.now/CVE-2026-14259.md): Board archive import bypasses team board creation permissions (CVSS 4.3, Mattermost)
- [CVE-2026-87802](https://cve.now/CVE-2026-87802.md): Apache Syncope: SRA OAuth2 JWT signature verification bypass (CVSS 9.1, Apache Software Foundation org.apache.syncope:syncope-sra)
- [CVE-2026-90898](https://cve.now/CVE-2026-90898.md): Bifrost unauthenticated remote code execution via MCP stdio client registration (CVSS 9.8, maximhq Bifrost)
- [CVE-2026-90705](https://cve.now/CVE-2026-90705.md): D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection (CVSS 5.1, D-Link DWR-M921)
- [CVE-2026-68570](https://cve.now/CVE-2026-68570.md): Apache Doris: Authorization bypass leading to unauthorized data access (CVSS 6.5, Apache Software Foundation Apache Doris)
- [CVE-2026-90704](https://cve.now/CVE-2026-90704.md): D-Link DWR-M921 formDiskPartition system command injection (CVSS 5.1, D-Link DWR-M921)
- [CVE-2026-72524](https://cve.now/CVE-2026-72524.md): Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables (CVSS 8.8, Apache Software Foundation Apache Doris)
- [CVE-2026-90894](https://cve.now/CVE-2026-90894.md): Parallels Desktop local privilege escalation via appliance extract argument injection (CVSS 7.8, Parallels Desktop for Mac)
- [CVE-2026-90703](https://cve.now/CVE-2026-90703.md): D-Link DWR-M921 formDiskCreateShare system os command injection (CVSS 9.4, D-Link DWR-M921)
- [CVE-2026-90895](https://cve.now/CVE-2026-90895.md): MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection (CVSS 8.4, MISP)
- [CVE-2026-90702](https://cve.now/CVE-2026-90702.md): D-Link DWR-M921 formDiskFormat system os command injection (CVSS 9.4, D-Link DWR-M921)
- [CVE-2026-90701](https://cve.now/CVE-2026-90701.md): subhajitkhan online-clinic-management-system listdoctor.php sql injection (CVSS 6.9, subhajitkhan online-clinic-management-system)
- [CVE-2026-90893](https://cve.now/CVE-2026-90893.md): MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints (CVSS 5.1, MISP)
- [CVE-2026-90700](https://cve.now/CVE-2026-90700.md): itsourcecode Sales and Inventory System pro\_edit1.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-88932](https://cve.now/CVE-2026-88932.md): multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads (CVSS 5.3, multer)
- [CVE-2026-90699](https://cve.now/CVE-2026-90699.md): D-Link DWR-M920 formPinManageSetup sub\_41E60C os command injection (CVSS 9.4, D-Link DWR-M920)
- [CVE-2026-90698](https://cve.now/CVE-2026-90698.md): memcached mcmc Tokenizer proto\_text.c try\_read\_command\_asciiauth out-of-bounds (CVSS 6.9, memcached)
- [CVE-2026-90697](https://cve.now/CVE-2026-90697.md): SourceCodester Inventory Management System invoice.php authorization (CVSS 5.3, SourceCodester Inventory Management System)
- [CVE-2026-89321](https://cve.now/CVE-2026-89321.md): Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an… (CVSS 4.3, Eclipse Foundation Eclipse OpenVSX)
- [CVE-2026-90696](https://cve.now/CVE-2026-90696.md): SourceCodester Inventory Management System Product Management products\_handler.php cross site scripting (CVSS 5.1, SourceCodester Inventory Management System)
- [CVE-2026-90695](https://cve.now/CVE-2026-90695.md): SourceCodester Inventory Management System Vendor Management vendors\_handler.php cross site scripting (CVSS 5.1, SourceCodester Inventory Management System)
- [CVE-2026-90694](https://cve.now/CVE-2026-90694.md): SourceCodester Inventory Management System Customer Management customers\_handler.php cross site scripting (CVSS 5.1, SourceCodester Inventory Management System)
- [CVE-2026-12518](https://cve.now/CVE-2026-12518.md): Local privilege escalation in the Logi Options+ updater service on Windows (CVSS 8.5, Logitech Logi Options+)
- [CVE-2026-90693](https://cve.now/CVE-2026-90693.md): D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow (CVSS 9.4, D-Link DIR-878)
- [CVE-2026-90692](https://cve.now/CVE-2026-90692.md): D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow (CVSS 9.4, D-Link DIR-878)
- [CVE-2026-71198](https://cve.now/CVE-2026-71198.md): In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. (CVSS 7.0, OpenStack Glance)
- [CVE-2026-85125](https://cve.now/CVE-2026-85125.md): The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. (CVSS 5.4, YAMAP -Social Trekking GPS App)
- [CVE-2026-82796](https://cve.now/CVE-2026-82796.md): SolarView Compact contains a cross-site scripting vulnerability in Image Management. (CVSS 5.4, Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F)
- [CVE-2026-82795](https://cve.now/CVE-2026-82795.md): SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. (CVSS 5.4, Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F)
- [CVE-2026-82794](https://cve.now/CVE-2026-82794.md): SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. (CVSS 8.8, Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F)
- [CVE-2026-82793](https://cve.now/CVE-2026-82793.md): Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. (CVSS 7.2, Contec Co. CAN-2-WF · Contec Co. CAN-2-USB)
- [CVE-2026-82765](https://cve.now/CVE-2026-82765.md): Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. (CVSS 8.1, Contec Co. FXA5000 · Contec Co. FXA5020 +18)
- [CVE-2026-82792](https://cve.now/CVE-2026-82792.md): Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. (CVSS 5.2, Contec Co. CAN-2-WF · Contec Co. CAN-2-USB)
- [CVE-2026-82791](https://cve.now/CVE-2026-82791.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication… (CVSS 8.8, Contec Co. CAN-2-WF · Contec Co. CAN-2-USB)
- [CVE-2026-82790](https://cve.now/CVE-2026-82790.md): Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. (CVSS 5.4, Contec Co. PC-HELPER Wireless I/O DIO-0404RY-LWF · Contec C…)
- [CVE-2026-90691](https://cve.now/CVE-2026-90691.md): 0x4m4 HexStrike AI API Files Endpoint hexstrike\_server.py FileOperationsManager path traversal (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-82789](https://cve.now/CVE-2026-82789.md): An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). (CVSS 8.8, Contec CONPROSYS HMI System)
- [CVE-2026-82763](https://cve.now/CVE-2026-82763.md): Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. (CVSS 5.4, Contec Co. FXA5000 · Contec Co. FXA5020 +18)
- [CVE-2026-82787](https://cve.now/CVE-2026-82787.md): Missing authentication for critical function vulnerability exists in CPSL-08P1EN. (CVSS 9.8, Contec Co. CPSL-08P1EN)
- [CVE-2026-82788](https://cve.now/CVE-2026-82788.md): Cross-site scripting vulnerability exists in CPSL-08P1EN. (CVSS 6.1, Contec Co. CPSL-08P1EN)
- [CVE-2026-82786](https://cve.now/CVE-2026-82786.md): Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*. (CVSS 6.3, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…)
- [CVE-2026-82785](https://cve.now/CVE-2026-82785.md): Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*. (CVSS 4.3, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…)
- [CVE-2026-82784](https://cve.now/CVE-2026-82784.md): Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*. (CVSS 6.5, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…)
- [CVE-2026-82783](https://cve.now/CVE-2026-82783.md): Plaintext storage of a password issue exists in CONPROSYS nano Series . (CVSS 4.2, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1)
- [CVE-2026-82782](https://cve.now/CVE-2026-82782.md): Out-of-bounds write vulnerability exists in CONPROSYS nano Series. (CVSS 4.3, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1)
- [CVE-2026-82781](https://cve.now/CVE-2026-82781.md): Cross-site scripting vulnerability exists in CONPROSYS nano Series. (CVSS 5.4, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1)
- [CVE-2026-82780](https://cve.now/CVE-2026-82780.md): Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. (CVSS 8.8, Contec Co. CPS-TM341G5MB-ADSC1-931 · Contec Co. CPS-TM34… +1)
- [CVE-2026-82779](https://cve.now/CVE-2026-82779.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. (CVSS 8.8, Contec Co. CPS-TM341G5MB-ADSC1-931 · Contec Co. CPS-TM34… +1)
- [CVE-2026-82778](https://cve.now/CVE-2026-82778.md): An exposure of information through directory listing issue exists in CONPROSYS PAC Series. (CVSS 4.3, Contec Co. Integrated Type CPS-PC341\[\]\[\]-\*-9201 · Contec Co…)
- [CVE-2026-82777](https://cve.now/CVE-2026-82777.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. (CVSS 8.8, Contec Co. Integrated Type CPS-PC341\[\]\[\]-\*-9201 · Contec Co…)
- [CVE-2026-82776](https://cve.now/CVE-2026-82776.md): Cross-site scripting vulnerability exists in CONPROSYS PAC Series. (CVSS 6.1, Contec Co. Integrated Type CPS-PC341\[\]\[\]-\*-9201 · Contec Co…)
- [CVE-2026-82775](https://cve.now/CVE-2026-82775.md): An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. (CVSS 4.3, Contec Co. M2M Gateway Integrated Type CPS-MG341\* · Cont… +2)
- [CVE-2026-82774](https://cve.now/CVE-2026-82774.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series… (CVSS 8.8, Contec Co. M2M Gateway Integrated Type CPS-MG341\* · Cont… +2)
- [CVE-2026-82773](https://cve.now/CVE-2026-82773.md): Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. (CVSS 6.1, Contec Co. M2M Gateway Integrated Type CPS-MG341\* · Cont… +2)
- [CVE-2026-82772](https://cve.now/CVE-2026-82772.md): Buffer overflow vulnerability exists in Contec EC1000 series. (CVSS 8.8, Contec Co. ECE1000 · Contec Co. ECE1020 +1)
- [CVE-2026-82771](https://cve.now/CVE-2026-82771.md): Cross-site scripting vulnerability exists in Contec EC1000 series. (CVSS 5.4, Contec Co. ECE1000 · Contec Co. ECE1020 +1)
- [CVE-2026-82770](https://cve.now/CVE-2026-82770.md): Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. (CVSS 8.8, Contec Co. RP-WAH-SR1 · Contec Co. RP-WAH-SR2 +2)
- [CVE-2026-82768](https://cve.now/CVE-2026-82768.md): Path traversal vulnerability exists in SGA1000. (CVSS 8.1, Contec Co. SGA1000)
- [CVE-2026-82769](https://cve.now/CVE-2026-82769.md): Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. (CVSS 5.4, Contec Co. RP-WAH-SR1 · Contec Co. RP-WAH-SR2 +2)
- [CVE-2026-82767](https://cve.now/CVE-2026-82767.md): Cross-site scripting vulnerability exists in SGA1000. (CVSS 5.2, Contec Co. SGA1000)
- [CVE-2026-82766](https://cve.now/CVE-2026-82766.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. (CVSS 8.8, Contec Co. SGA1000)
- [CVE-2026-82764](https://cve.now/CVE-2026-82764.md): Cross-site request forgery vulnerability exists in multiple Contec products. (CVSS 4.3, Contec Co. FXA5000 · Contec Co. FXA5020 +31)
- [CVE-2026-82762](https://cve.now/CVE-2026-82762.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000… (CVSS 8.8, Contec Co. FXA5000 · Contec Co. FXA5020 +18)
- [CVE-2026-68955](https://cve.now/CVE-2026-68955.md): The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. (CVSS 7.8, The installer for Rakuten Kobo Desktop Application)
- [CVE-2026-90690](https://cve.now/CVE-2026-90690.md): 0x4m4 HexStrike AI API Tools Endpoint hexstrike\_server.py subprocess.Popen os command injection (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-85196](https://cve.now/CVE-2026-85196.md): Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla \< 20.0.0, Users Anywhere extension for Joomla… (CVSS 5.3, regularlabs.com Articles Anywhere (Pro) extension for Jooml…)
- [CVE-2026-88852](https://cve.now/CVE-2026-88852.md): Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla \< 7.0.0, Snippets Pro… (CVSS 7.5, regularlabs.com Snippets (Free) extension for Joomla · regu…)
- [CVE-2026-85190](https://cve.now/CVE-2026-85190.md): Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla \< 5.0.5 (CVSS 7.5, regularlabs.com Quick Index (Free, Pro) extension for Joomla)
- [CVE-2026-85192](https://cve.now/CVE-2026-85192.md): Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla \< 8.0.0 (CVSS 9.4, regularlabs.com Conditional Content Pro extension for Joomla)
- [CVE-2026-85189](https://cve.now/CVE-2026-85189.md): Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla \< 17.0.0 (CVSS 7.5, regularlabs.com Modals (Free, Pro) extension for Joomla)
- [CVE-2026-90689](https://cve.now/CVE-2026-90689.md): Tenda W20E formDelWebAuthWhiteUser stack-based overflow (CVSS 8.7, Tenda W20E)
- [CVE-2026-85195](https://cve.now/CVE-2026-85195.md): Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla \< 20.0.0 (CVSS 7.5, regularlabs.com Articles Anywhere (Free, Pro) extension for…)
- [CVE-2026-88853](https://cve.now/CVE-2026-88853.md): Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla \< 17.0.0 (CVSS 7.5, regularlabs.com Modals (Pro) extension for Joomla)
- [CVE-2026-85191](https://cve.now/CVE-2026-85191.md): Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla \< 3.1.0 (CVSS 7.5, regularlabs.com Tabs & Accordions (Free, Pro) extension for…)
- [CVE-2026-85188](https://cve.now/CVE-2026-85188.md): Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) \< 12.1.0, Conditional Content (Free… (CVSS 6.9, regularlabs.com Advanced Module Manager (Free, Pro) exte… +2)
- [CVE-2026-90688](https://cve.now/CVE-2026-90688.md): Tenda W20E HTTP formIPMacBindAdd stack-based overflow (CVSS 7.1, Tenda W20E)
- [CVE-2026-16726](https://cve.now/CVE-2026-16726.md): Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows. (CVSS 6.8, panasonic PANATERM · panasonic RTEX LogReader)
- [CVE-2026-90687](https://cve.now/CVE-2026-90687.md): GPAC MP4Box base\_scenegraph.c gf\_node\_changed\_internal use after free (CVSS 5.3, GPAC)
- [CVE-2026-90686](https://cve.now/CVE-2026-90686.md): GPAC MP4Box loader\_bt.c gf\_bt\_report memory corruption (CVSS 6.9, GPAC)
- [CVE-2026-90685](https://cve.now/CVE-2026-90685.md): GPAC MP4Box lsr\_dec.c lsr\_exec\_command\_list assertion (CVSS 2.4, GPAC)
- [CVE-2026-90684](https://cve.now/CVE-2026-90684.md): GPAC MP4Box base\_scenegraph.c gf\_node\_get\_field\_count assertion (CVSS 2.4, GPAC)
- [CVE-2026-90683](https://cve.now/CVE-2026-90683.md): GPAC MP4Box base\_scenegraph.c gf\_node\_unregister assertion (CVSS 4.8, GPAC)
- [CVE-2026-90682](https://cve.now/CVE-2026-90682.md): Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow (CVSS 4.8, Matthias-Wandel jhead)
- [CVE-2026-90681](https://cve.now/CVE-2026-90681.md): Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds (CVSS 4.8, Matthias-Wandel jhead)
- [CVE-2026-90680](https://cve.now/CVE-2026-90680.md): D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow (CVSS 9.4, D-Link DIR-823G)
- [CVE-2026-90623](https://cve.now/CVE-2026-90623.md): andreashappe cochise SSH Host Key ssh\_connection.py asyncssh.connect certificate validation (CVSS 6.3, andreashappe cochise)
- [CVE-2026-90622](https://cve.now/CVE-2026-90622.md): GNU libredwg Layer Encoding dwg.spec DWG\_TABLE null pointer dereference (CVSS 4.8, GNU libredwg)
- [CVE-2026-90621](https://cve.now/CVE-2026-90621.md): ipa-lab HackingBuddyGPT ssh\_run\_command.py ssh\_run\_command os command injection (CVSS 5.3, ipa-lab HackingBuddyGPT)
- [CVE-2026-90620](https://cve.now/CVE-2026-90620.md): 0x4m4 HexStrike AI API Command Endpoint hexstrike\_server.py missing authentication (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-90619](https://cve.now/CVE-2026-90619.md): 0x4m4 HexStrike AI Execute Endpoint hexstrike\_server.py os command injection (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-90618](https://cve.now/CVE-2026-90618.md): GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute\_command os command injection (CVSS 6.9, GH05TCREW PentestAgent)
- [CVE-2026-90617](https://cve.now/CVE-2026-90617.md): GH05TCREW PentestAgent MCP HTTP Server main.py run\_task os command injection (CVSS 6.9, GH05TCREW PentestAgent)
- [CVE-2026-90615](https://cve.now/CVE-2026-90615.md): SourceCodester Class and Exam Timetabling System subject1.php cross site scripting (CVSS 5.3, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-90614](https://cve.now/CVE-2026-90614.md): FedML-AI FedML MQTT+S3 Communication Backend remote\_storage.py S3Storage.read\_model deserialization (CVSS 5.3, FedML-AI FedML)
- [CVE-2026-90613](https://cve.now/CVE-2026-90613.md): GPAC MP4Box stbl\_read.c stbl\_GetSampleInfos assertion (CVSS 4.8, GPAC)
- [CVE-2026-90612](https://cve.now/CVE-2026-90612.md): GPAC MP4Box scene\_dump.c gf\_sm\_dump\_command\_list assertion (CVSS 4.8, GPAC)
- [CVE-2026-90611](https://cve.now/CVE-2026-90611.md): GPAC MP4Box loader\_xmt.c xmt\_parse\_element assertion (CVSS 4.8, GPAC)
- [CVE-2026-90610](https://cve.now/CVE-2026-90610.md): GPAC MP4Box svg\_attributes.c gf\_svg\_attributes\_copy buffer over-read (CVSS 4.8, GPAC)
- [CVE-2026-90609](https://cve.now/CVE-2026-90609.md): GPAC MP4Box vrml\_tools.c null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-90608](https://cve.now/CVE-2026-90608.md): Totolink A3002MU boa formPortFw buffer overflow (CVSS 9.4, Totolink A3002MU)
- [CVE-2026-90607](https://cve.now/CVE-2026-90607.md): Totolink A3002MU boa formNewSchedule buffer overflow (CVSS 9.4, Totolink A3002MU)
- [CVE-2023-22631](https://cve.now/CVE-2023-22631.md): PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor. (CVSS 2.7, Paessler PRTG Network Monitor)
- [CVE-2023-22632](https://cve.now/CVE-2023-22632.md): PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor. (CVSS 2.7, Paessler PRTG Network Monitor)
- [CVE-2023-24034](https://cve.now/CVE-2023-24034.md): An issue was discovered in twilio\_ajax\_handler.php in Nagios XI before 5.9.3. (CVSS 3.1, Nagios XI)
- [CVE-2023-24035](https://cve.now/CVE-2023-24035.md): An issue was discovered in Nagios XI before 5.9.3. (CVSS 3.5, Nagios XI)
- [CVE-2023-24283](https://cve.now/CVE-2023-24283.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of… (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24284](https://cve.now/CVE-2023-24284.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is\_markable() function. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24285](https://cve.now/CVE-2023-24285.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long… (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24286](https://cve.now/CVE-2023-24286.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24287](https://cve.now/CVE-2023-24287.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24288](https://cve.now/CVE-2023-24288.md): An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an… (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24291](https://cve.now/CVE-2023-24291.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-28148](https://cve.now/CVE-2023-28148.md): A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. (CVSS 7.2, Paessler PRTG Network Monitor)
- [CVE-2023-29377](https://cve.now/CVE-2023-29377.md): An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. (CVSS 6.6, Softing Secure Integration Server)
- [CVE-2023-32778](https://cve.now/CVE-2023-32778.md): An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. (CVSS 3.3, ILIAS)
- [CVE-2023-32803](https://cve.now/CVE-2023-32803.md): The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root… (CVSS 7.5, Amazon ca-certificates)
- [CVE-2023-34854](https://cve.now/CVE-2023-34854.md): HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. (CVSS 6.6, digitaldruid HotelDruid)
- [CVE-2023-37252](https://cve.now/CVE-2023-37252.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. (CVSS 3.1, MediaWiki CheckUser)
- [CVE-2023-37253](https://cve.now/CVE-2023-37253.md): An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. (CVSS 3.1, MediaWiki ProofreadPage)
- [CVE-2023-37366](https://cve.now/CVE-2023-37366.md): An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos… (CVSS 2.8, Samsung Exynos 850 firmware)
- [CVE-2023-40772](https://cve.now/CVE-2023-40772.md): A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted… (CVSS 4.3, DataEase)
- [CVE-2023-45023](https://cve.now/CVE-2023-45023.md): The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation… (CVSS 4.2, TYPO3 femanager · in2code/femanager)
- [CVE-2023-45858](https://cve.now/CVE-2023-45858.md): A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files. (CVSS 8.6, Paessler PRTG Network Monitor)
- [CVE-2023-46035](https://cve.now/CVE-2023-46035.md): The svg\_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. (CVSS 5.9, fnando svg\_optimizer · svg\_optimizer)
- [CVE-2023-46273](https://cve.now/CVE-2023-46273.md): Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah\_bgd buffer overflow via… (CVSS 8.8, extremenetworks IQ Engine)
- [CVE-2023-50459](https://cve.now/CVE-2023-50459.md): An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. (CVSS 5.4, TYPO3 femanager · in2code/femanager)
- [CVE-2023-50460](https://cve.now/CVE-2023-50460.md): An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. (CVSS 5.4, TYPO3 femanager)
- [CVE-2023-50461](https://cve.now/CVE-2023-50461.md): An issue was discovered in the direct\_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. (CVSS 8.8, TYPO3 direct\_mail · directmailteam/direct-mail)
- [CVE-2023-50462](https://cve.now/CVE-2023-50462.md): An issue was discovered in the content\_consent (aka Content Consent) extension through 2.0.1 for TYPO3. (CVSS 5.3, TYPO3 content\_consent · t3s/content-consent)
- [CVE-2023-51769](https://cve.now/CVE-2023-51769.md): Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages. (CVSS 6.1, Frappe)
- [CVE-2024-23176](https://cve.now/CVE-2024-23176.md): An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. (CVSS 5.4, MediaWiki MassMessage)
- [CVE-2025-26790](https://cve.now/CVE-2025-26790.md): Withsecure Atlant with Capricorn engine before 2025-01-20\_02 allows a Remote Denial of Service via an out-of-bounds memory read during… (CVSS 3.7, WithSecure Atlant)
- [CVE-2025-64031](https://cve.now/CVE-2025-64031.md): libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to… (CVSS 2.5, libarchive)
- [CVE-2025-68624](https://cve.now/CVE-2025-68624.md): N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound… (CVSS 4.3, N-able Mail Assure)
- [CVE-2026-23786](https://cve.now/CVE-2026-23786.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 2.8, Samsung Exynos 1280 firmware)
- [CVE-2026-23787](https://cve.now/CVE-2026-23787.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23788](https://cve.now/CVE-2026-23788.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23789](https://cve.now/CVE-2026-23789.md): An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… (CVSS 7.8, Samsung Exynos 850 firmware)
- [CVE-2026-23790](https://cve.now/CVE-2026-23790.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23791](https://cve.now/CVE-2026-23791.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23792](https://cve.now/CVE-2026-23792.md): An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500… (CVSS 4.0, Samsung Exynos 1080 firmware)
- [CVE-2026-23793](https://cve.now/CVE-2026-23793.md): An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. (CVSS 3.5, Samsung Exynos 1330 firmware)
- [CVE-2026-25832](https://cve.now/CVE-2026-25832.md): In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. (CVSS 3.7, TrustedFirmware Mbed TLS)
- [CVE-2026-31278](https://cve.now/CVE-2026-31278.md): An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows… (CVSS 7.7, supremainc BioStar)
- [CVE-2026-33956](https://cve.now/CVE-2026-33956.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33957](https://cve.now/CVE-2026-33957.md): An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. (CVSS 4.2, Samsung Exynos 1580 firmware)
- [CVE-2026-33960](https://cve.now/CVE-2026-33960.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33962](https://cve.now/CVE-2026-33962.md): An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. (CVSS 2.8, Samsung Exynos 850 firmware)
- [CVE-2026-33963](https://cve.now/CVE-2026-33963.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 7.5, Samsung Exynos 1330 firmware)
- [CVE-2026-33964](https://cve.now/CVE-2026-33964.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. (CVSS 6.4, Samsung Exynos 1580 firmware)
- [CVE-2026-33966](https://cve.now/CVE-2026-33966.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33967](https://cve.now/CVE-2026-33967.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33968](https://cve.now/CVE-2026-33968.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33970](https://cve.now/CVE-2026-33970.md): An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200… (CVSS 3.5, Samsung Exynos 850 firmware)
- [CVE-2026-38924](https://cve.now/CVE-2026-38924.md): In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. (CVSS 2.9, Oraios AI Serena)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.