# CVEs published 2026-09-22

453 CVEs were published on September 22, 2026: 85 critical, 178 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2026-95833](https://cve.now/CVE-2026-95833.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-95830](https://cve.now/CVE-2026-95830.md): theRealSain Pixtream post\_upload.php unrestricted upload (CVSS 5.3, theRealSain Pixtream)
- [CVE-2026-95829](https://cve.now/CVE-2026-95829.md): TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection (CVSS 5.3, TDuckCloud tduck-platform)
- [CVE-2026-94367](https://cve.now/CVE-2026-94367.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. (CVSS 7.2, OpenEye Apex Network Video Recorder)
- [CVE-2026-92930](https://cve.now/CVE-2026-92930.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a… (CVSS 6.2, OpenEye Apex Network Video Recorder)
- [CVE-2026-92929](https://cve.now/CVE-2026-92929.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when… (CVSS 5.3, OpenEye Apex Network Video Recorder)
- [CVE-2026-92928](https://cve.now/CVE-2026-92928.md): OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential… (CVSS 6.5, OpenEye Apex Network Video Recorder)
- [CVE-2026-61685](https://cve.now/CVE-2026-61685.md): ReactPress has SQL injection via dynamic column names in TypeORM query builders (CVSS 7.5, fecommunity reactpress · @fecommunity/reactpress)
- [CVE-2026-57576](https://cve.now/CVE-2026-57576.md): plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length (CVSS 6.5, plone.app.dexterity · plone.app.contenttypes +1)
- [CVE-2026-95828](https://cve.now/CVE-2026-95828.md): Mstfakts College-Management-System Authentication server.php session\_start session fixiation (CVSS 5.3, Mstfakts College-Management-System)
- [CVE-2026-95820](https://cve.now/CVE-2026-95820.md): anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload (CVSS 5.3, anirbandutta9 College-Notes-Gallery)
- [CVE-2026-18176](https://cve.now/CVE-2026-18176.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18173](https://cve.now/CVE-2026-18173.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 3.7, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18172](https://cve.now/CVE-2026-18172.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18169](https://cve.now/CVE-2026-18169.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.9, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18170](https://cve.now/CVE-2026-18170.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18163](https://cve.now/CVE-2026-18163.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18162](https://cve.now/CVE-2026-18162.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18161](https://cve.now/CVE-2026-18161.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 4.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18156](https://cve.now/CVE-2026-18156.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18154](https://cve.now/CVE-2026-18154.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.0, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18153](https://cve.now/CVE-2026-18153.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18152](https://cve.now/CVE-2026-18152.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18137](https://cve.now/CVE-2026-18137.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18134](https://cve.now/CVE-2026-18134.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-95819](https://cve.now/CVE-2026-95819.md): anirbandutta9 College-Notes-Gallery login.php sql injection (CVSS 6.9, anirbandutta9 College-Notes-Gallery)
- [CVE-2026-18133](https://cve.now/CVE-2026-18133.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.4, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-19202](https://cve.now/CVE-2026-19202.md): Token Cache Reuse in mcp-toolbox-sdk-python (CVSS 9.1, Google mcp-toolbox-sdk-python)
- [CVE-2026-18132](https://cve.now/CVE-2026-18132.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18131](https://cve.now/CVE-2026-18131.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.2, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18124](https://cve.now/CVE-2026-18124.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18123](https://cve.now/CVE-2026-18123.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.6, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18114](https://cve.now/CVE-2026-18114.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 6.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18095](https://cve.now/CVE-2026-18095.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18074](https://cve.now/CVE-2026-18074.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.2, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-18066](https://cve.now/CVE-2026-18066.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.9, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17647](https://cve.now/CVE-2026-17647.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17646](https://cve.now/CVE-2026-17646.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.5, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17645](https://cve.now/CVE-2026-17645.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17644](https://cve.now/CVE-2026-17644.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17643](https://cve.now/CVE-2026-17643.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17637](https://cve.now/CVE-2026-17637.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17636](https://cve.now/CVE-2026-17636.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 8.8, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17635](https://cve.now/CVE-2026-17635.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 9.1, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17620](https://cve.now/CVE-2026-17620.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 5.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17618](https://cve.now/CVE-2026-17618.md): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (CVSS 7.3, IBM Financial Transaction Manager (FTM) for RedHat OpenShift)
- [CVE-2026-17472](https://cve.now/CVE-2026-17472.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 9.6, IBM Concert)
- [CVE-2026-17465](https://cve.now/CVE-2026-17465.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.5, IBM Concert)
- [CVE-2026-17102](https://cve.now/CVE-2026-17102.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16672](https://cve.now/CVE-2026-16672.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16469](https://cve.now/CVE-2026-16469.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16468](https://cve.now/CVE-2026-16468.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16426](https://cve.now/CVE-2026-16426.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.5, IBM Concert)
- [CVE-2026-16346](https://cve.now/CVE-2026-16346.md): DataStage on Cloud Pak for Data has several vulnerabilities (CVSS 9.9, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-15915](https://cve.now/CVE-2026-15915.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 6.2, IBM Concert)
- [CVE-2025-12767](https://cve.now/CVE-2025-12767.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.3, IBM Concert)
- [CVE-2025-36084](https://cve.now/CVE-2025-36084.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.9, IBM Concert)
- [CVE-2026-75101](https://cve.now/CVE-2026-75101.md): Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository… (CVSS 6.0, GitHub Enterprise Server)
- [CVE-2026-77912](https://cve.now/CVE-2026-77912.md): Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline (CVSS 7.4, GitHub Enterprise Server)
- [CVE-2026-77987](https://cve.now/CVE-2026-77987.md): GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery (CVSS 9.3, GitHub Enterprise Server)
- [CVE-2026-88020](https://cve.now/CVE-2026-88020.md): Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3 (CVSS 6.1, Autonomy Logic OpenPLC Runtime)
- [CVE-2026-96260](https://cve.now/CVE-2026-96260.md): Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (CVSS 6.5, Mattermost)
- [CVE-2026-96259](https://cve.now/CVE-2026-96259.md): Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (CVSS 5.5, Mattermost)
- [CVE-2026-96269](https://cve.now/CVE-2026-96269.md): GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affect (CVSS 7.5, GNU Emacs)
- [CVE-2026-77426](https://cve.now/CVE-2026-77426.md): Unleash: Missing await on permission check + cross-project IDOR in admin API (CVSS 7.1, unleash · unleash-server)
- [CVE-2026-67615](https://cve.now/CVE-2026-67615.md): openEQUELLA \< 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker (CVSS 8.7, Apereo Foundation openEQUELLA)
- [CVE-2026-77425](https://cve.now/CVE-2026-77425.md): Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write)… (CVSS 4.3, unleash · unleash-server)
- [CVE-2026-91018](https://cve.now/CVE-2026-91018.md): Double Free in lwIP (lightweight IP) (CVSS 8.8, lwIP API)
- [CVE-2026-76910](https://cve.now/CVE-2026-76910.md): Unleash: Clone-feature lets a user copy a feature from a project they cannot read (CVSS 5.3, unleash · unleash-server)
- [CVE-2026-95815](https://cve.now/CVE-2026-95815.md): OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging (CVSS 7.2, OpenClaw iOS)
- [CVE-2026-95814](https://cve.now/CVE-2026-95814.md): Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check (CVSS 8.6, dani-garcia vaultwarden)
- [CVE-2026-95813](https://cve.now/CVE-2026-95813.md): e621ng before 26.09.16 Open Redirect via URL Parameters (CVSS 5.3, e621ng)
- [CVE-2026-95812](https://cve.now/CVE-2026-95812.md): ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters (CVSS 5.3, MacWarrior clipbucket-v5)
- [CVE-2026-76909](https://cve.now/CVE-2026-76909.md): Unleash: CR-approval email renders user-controlled raw HTML (CVSS 2.1, unleash · unleash-server)
- [CVE-2026-62364](https://cve.now/CVE-2026-62364.md): wlc may disclose API tokens to project-configured URLs (CVSS 2.3, WeblateOrg wlc · wlc)
- [CVE-2026-94450](https://cve.now/CVE-2026-94450.md): Potential denial of service when configured to send Retry packets in s2n-quic (CVSS 7.5, AWS s2n-quic)
- [CVE-2026-79767](https://cve.now/CVE-2026-79767.md): Gardener: Authorization Bypass via Group Subject Injection (CVSS 5.5, gardener · github.com/gardener/gardener +1)
- [CVE-2026-61570](https://cve.now/CVE-2026-61570.md): MPXJ: XXE Vulnerability in MerlinReader (CVSS 7.5, joniles mpxj · net.sf.mpxj:mpxj +5)
- [CVE-2026-65829](https://cve.now/CVE-2026-65829.md): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (CVSS 5.3, joniles mpxj · mpxj +5)
- [CVE-2026-77322](https://cve.now/CVE-2026-77322.md): SIPGO: DoS via unvalidated WebSocket frame length (CVSS 7.5, emiago sipgo · github.com/emiago/sipgo)
- [CVE-2026-58268](https://cve.now/CVE-2026-58268.md): SIPGO: DoS via unvalidated Content-Length in the stream parser (CVSS 7.5, emiago sipgo · github.com/emiago/sipgo)
- [CVE-2026-87121](https://cve.now/CVE-2026-87121.md): Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application (CVSS 9.8, lwIP TCP/IP Stack MQTT)
- [CVE-2026-83805](https://cve.now/CVE-2026-83805.md): Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs (CVSS 6.4, nautobot)
- [CVE-2026-83801](https://cve.now/CVE-2026-83801.md): Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text (CVSS 5.4, nautobot)
- [CVE-2026-63104](https://cve.now/CVE-2026-63104.md): Kaneo 2.3.12 \< 2.12.2 Missing Authorization via Bulk Task Endpoint (CVSS 7.2, usekaneo kaneo)
- [CVE-2026-47116](https://cve.now/CVE-2026-47116.md): LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH (CVSS 9.2, LTSecurity LTK3500SF)
- [CVE-2026-94574](https://cve.now/CVE-2026-94574.md): CVE-2026-94574 (CVSS 7.8, GNU Wget (Windows Builds) Wget)
- [CVE-2026-89281](https://cve.now/CVE-2026-89281.md): CVE-2026-89281 (CVSS 8.4, Apache HTTP Server Project Apache Lounge Windows)
- [CVE-2026-89282](https://cve.now/CVE-2026-89282.md): CVE-2026-89282 (CVSS 9.1, Apache HTTP Server Project Apache Lounge Windows)
- [CVE-2026-62985](https://cve.now/CVE-2026-62985.md): request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process (CVSS 7.5, azu request-filtering-agent · request-filtering-agent)
- [CVE-2026-28325](https://cve.now/CVE-2026-28325.md): SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability (CVSS 8.8, SolarWinds Observability Self-Hosted)
- [CVE-2026-76717](https://cve.now/CVE-2026-76717.md): Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 5.3, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76716](https://cve.now/CVE-2026-76716.md): Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE) (CVSS 5.3, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76715](https://cve.now/CVE-2026-76715.md): Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.1, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76714](https://cve.now/CVE-2026-76714.md): Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76713](https://cve.now/CVE-2026-76713.md): Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76712](https://cve.now/CVE-2026-76712.md): Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and… (CVSS 7.3, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76711](https://cve.now/CVE-2026-76711.md): Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.5, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76710](https://cve.now/CVE-2026-76710.md): Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 7.5, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76709](https://cve.now/CVE-2026-76709.md): Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 9.8, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-76708](https://cve.now/CVE-2026-76708.md): Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE) (CVSS 9.8, Hewlett Packard Enterprise (HPE) ALE)
- [CVE-2026-59991](https://cve.now/CVE-2026-59991.md): psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry (CVSS 7.5, psd-tools)
- [CVE-2026-28324](https://cve.now/CVE-2026-28324.md): SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVSS 9.8, SolarWinds Observability Self-Hosted)
- [CVE-2026-63628](https://cve.now/CVE-2026-63628.md): mppx: Gas Draining with access list (CVSS 6.9, wevm mppx · mppx)
- [CVE-2026-63627](https://cve.now/CVE-2026-63627.md): mppx: Gas Draining with padding (CVSS 6.9, wevm mppx · mppx)
- [CVE-2026-91129](https://cve.now/CVE-2026-91129.md): Home Assistant: mDNS Server-Side Request Forgery (CVSS 5.4, home-assistant core · homeassistant)
- [CVE-2026-91130](https://cve.now/CVE-2026-91130.md): Home Assistant: XSS in Statistics Graph Card (CVSS 9.3, home-assistant core · homeassistant)
- [CVE-2026-57149](https://cve.now/CVE-2026-57149.md): plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection (CVSS 9.9, plone.app.portlets · plone-app-portlets)
- [CVE-2026-63386](https://cve.now/CVE-2026-63386.md): js-toml: Uncontrolled recursion in \`load()\` causes \`RangeError\` (stack exhaustion) on deeply nested input (CVSS 5.3, sunnyadn js-toml)
- [CVE-2026-77399](https://cve.now/CVE-2026-77399.md): icalendar: Denial of service via unbounded VALARM REPEAT expansion (CVSS 6.5, collective icalendar)
- [CVE-2026-84395](https://cve.now/CVE-2026-84395.md): Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.1, Adobe Premiere)
- [CVE-2026-83963](https://cve.now/CVE-2026-83963.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-81998](https://cve.now/CVE-2026-81998.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-83962](https://cve.now/CVE-2026-83962.md): Substance3D - Modeler | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-79906](https://cve.now/CVE-2026-79906.md): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2026-94462](https://cve.now/CVE-2026-94462.md): Spree: Broken Access Control in \`PATCH /api/v3/store/carts/:id/associate\` (IDOR) (CVSS 7.1, spree · spree\_api)
- [CVE-2026-75743](https://cve.now/CVE-2026-75743.md): Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352) (CVSS 7.1, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-75745](https://cve.now/CVE-2026-75745.md): Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-82000](https://cve.now/CVE-2026-82000.md): Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.6, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-75744](https://cve.now/CVE-2026-75744.md): Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-81995](https://cve.now/CVE-2026-81995.md): Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20) (CVSS 9.1, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-81999](https://cve.now/CVE-2026-81999.md): Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 8.7, Adobe AEM 6.5 Forms JEE · Adobe AEM 6.5 LTS Forms JEE)
- [CVE-2026-75689](https://cve.now/CVE-2026-75689.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-83964](https://cve.now/CVE-2026-83964.md): Adobe Connect | Improper Certificate Validation (CWE-295) (CVSS 6.2, Adobe Connect)
- [CVE-2026-34689](https://cve.now/CVE-2026-34689.md): Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.6, Adobe Connect)
- [CVE-2026-75686](https://cve.now/CVE-2026-75686.md): Adobe Connect | Improper Input Validation (CWE-20) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75682](https://cve.now/CVE-2026-75682.md): Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.9, Adobe Connect)
- [CVE-2026-48361](https://cve.now/CVE-2026-48361.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 6.1, Adobe Connect)
- [CVE-2026-75698](https://cve.now/CVE-2026-75698.md): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75684](https://cve.now/CVE-2026-75684.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75697](https://cve.now/CVE-2026-75697.md): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 9.3, Adobe Connect)
- [CVE-2026-75658](https://cve.now/CVE-2026-75658.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75656](https://cve.now/CVE-2026-75656.md): Bridge | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Bridge)
- [CVE-2026-75649](https://cve.now/CVE-2026-75649.md): Bridge | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75676](https://cve.now/CVE-2026-75676.md): Bridge | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75655](https://cve.now/CVE-2026-75655.md): Bridge | Uncontrolled Recursion (CWE-674) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75665](https://cve.now/CVE-2026-75665.md): Bridge | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-75663](https://cve.now/CVE-2026-75663.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge)
- [CVE-2026-77246](https://cve.now/CVE-2026-77246.md): MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path (CVSS 7.4, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-75632](https://cve.now/CVE-2026-75632.md): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-75634](https://cve.now/CVE-2026-75634.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 4.3, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-75633](https://cve.now/CVE-2026-75633.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-19480](https://cve.now/CVE-2026-19480.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-89277](https://cve.now/CVE-2026-89277.md): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-75638](https://cve.now/CVE-2026-75638.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 6.5, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-76194](https://cve.now/CVE-2026-76194.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 4.3, Adobe Content Credentials Rust SDK · Adobe Content Credenti…)
- [CVE-2026-77248](https://cve.now/CVE-2026-77248.md): MCP Atlassian: Unauthenticated arbitrary local file read via upload\_attachment file\_path, chained with missing auth on streamable-http transport (CVSS 8.6, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95862](https://cve.now/CVE-2026-95862.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to… (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77256](https://cve.now/CVE-2026-77256.md): MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask (CVSS 8.3, sooperset mcp-atlassian)
- [CVE-2026-95861](https://cve.now/CVE-2026-95861.md): A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices… (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77249](https://cve.now/CVE-2026-77249.md): MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup (CVSS 5.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77259](https://cve.now/CVE-2026-77259.md): MCP Atlassian: Arbitrary file read via confluence\_upload\_attachment allows exfiltration of server credentials (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77268](https://cve.now/CVE-2026-77268.md): MCP Atlassian: Insecure File Permissions on OAuth Token Storage (CVSS 5.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77558](https://cve.now/CVE-2026-77558.md): A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to… (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77556](https://cve.now/CVE-2026-77556.md): A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to… (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77555](https://cve.now/CVE-2026-77555.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to… (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77544](https://cve.now/CVE-2026-77544.md): A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to… (CVSS 7.5, Ubiquiti Dream Machines · Ubiquiti Enterprise Firewalls +5)
- [CVE-2026-77247](https://cve.now/CVE-2026-77247.md): MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file\_path parameters (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-84396](https://cve.now/CVE-2026-84396.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2026-76192](https://cve.now/CVE-2026-76192.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2026-77272](https://cve.now/CVE-2026-77272.md): MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler (CVSS 5.4, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77269](https://cve.now/CVE-2026-77269.md): MCP Atlassian: Path traversal in upload\_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77266](https://cve.now/CVE-2026-77266.md): MCP Atlassian: Path traversal in upload\_attachment allows arbitrary file read and exfiltration via MCP tool call (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77255](https://cve.now/CVE-2026-77255.md): MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update\_issue (CVSS 8.6, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95831](https://cve.now/CVE-2026-95831.md): Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL (CVSS 7.8, Crypt-SelfCertificate)
- [CVE-2026-77262](https://cve.now/CVE-2026-77262.md): MCP Atlassian: Path Traversal / Arbitrary File Read in confluence\_upload\_attachment MCP tool (incomplete fix of CVE-2026-27825) (CVSS 8.6, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77254](https://cve.now/CVE-2026-77254.md): MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials (CVSS 9.1, sooperset mcp-atlassian)
- [CVE-2026-77253](https://cve.now/CVE-2026-77253.md): MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files (CVSS 7.1, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77257](https://cve.now/CVE-2026-77257.md): MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77261](https://cve.now/CVE-2026-77261.md): MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches (CVSS 7.1, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77260](https://cve.now/CVE-2026-77260.md): MCP Atlassian: Arbitrary local file READ via unconstrained file\_path in upload\_attachment (Confluence + Jira) (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77271](https://cve.now/CVE-2026-77271.md): MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825) (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95660](https://cve.now/CVE-2026-95660.md): Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection (CVSS 5.3, Moonshot AI Kimi Code)
- [CVE-2026-77242](https://cve.now/CVE-2026-77242.md): MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned) (CVSS 7.5, sooperset mcp-atlassian)
- [CVE-2026-77243](https://cve.now/CVE-2026-77243.md): MCP Atlassian: ENABLED\_TOOLS / Toolset authorization bypass (CVSS 8.8, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77251](https://cve.now/CVE-2026-77251.md): MCP Atlassian: JIRA\_PROJECTS\_FILTER / CONFLUENCE\_SPACES\_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-43643](https://cve.now/CVE-2026-43643.md): Softaculous Virtualizor Authorization Bypass via Billing Module Handler (CVSS 8.7, Softaculous Virtualizor)
- [CVE-2026-77252](https://cve.now/CVE-2026-77252.md): MCP Atlassian: JIRA\_PROJECTS\_FILTER and CONFLUENCE\_SPACES\_FILTER can be bypassed in search tools (CVSS 6.5, sooperset mcp-atlassian)
- [CVE-2026-43642](https://cve.now/CVE-2026-43642.md): Softaculous Virtualizor PHP Object Injection via Billing Module Handler (CVSS 9.2, Softaculous Virtualizor)
- [CVE-2026-77267](https://cve.now/CVE-2026-77267.md): mcp-atlassian has an incomplete SSRF remediation (CVSS 8.3, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-43641](https://cve.now/CVE-2026-43641.md): Softaculous Virtualizor OS Command Injection via Billing Module Handler (CVSS 9.3, Softaculous Virtualizor)
- [CVE-2026-77250](https://cve.now/CVE-2026-77250.md): MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions (CVSS 6.1, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-18626](https://cve.now/CVE-2026-18626.md): Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (CVSS 6.8, RTI Connext Professional)
- [CVE-2026-18462](https://cve.now/CVE-2026-18462.md): Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource… (CVSS 7.3, RTI Connext Professional)
- [CVE-2026-18461](https://cve.now/CVE-2026-18461.md): Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection. (CVSS 9.2, RTI Connext Professional)
- [CVE-2026-18460](https://cve.now/CVE-2026-18460.md): Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (CVSS 6.9, RTI Connext Professional)
- [CVE-2026-18459](https://cve.now/CVE-2026-18459.md): Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. (CVSS 8.7, RTI Connext Professional)
- [CVE-2026-18458](https://cve.now/CVE-2026-18458.md): Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion')… (CVSS 6.8, RTI Connext Professional)
- [CVE-2026-18457](https://cve.now/CVE-2026-18457.md): Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (CVSS 8.3, RTI Connext Professional)
- [CVE-2026-11389](https://cve.now/CVE-2026-11389.md): Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion')… (CVSS 6.8, RTI Connext Professional)
- [CVE-2026-11388](https://cve.now/CVE-2026-11388.md): Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. (CVSS 6.9, RTI Connext Professional)
- [CVE-2026-8849](https://cve.now/CVE-2026-8849.md): Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. (CVSS 7.7, RTI Connext Professional)
- [CVE-2026-7866](https://cve.now/CVE-2026-7866.md): Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (CVSS 10.0, RTI Connext Professional)
- [CVE-2026-77244](https://cve.now/CVE-2026-77244.md): \[mcp-atlassian\] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token (CVSS 10.0, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77265](https://cve.now/CVE-2026-77265.md): MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow (CVSS 5.9, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77270](https://cve.now/CVE-2026-77270.md): MCP Atlassian: Arbitrary File Read via Upload Attachment Tools (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95657](https://cve.now/CVE-2026-95657.md): dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting (CVSS 5.1, dgtlmoon Changedetection.io)
- [CVE-2026-75703](https://cve.now/CVE-2026-75703.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-84412](https://cve.now/CVE-2026-84412.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-89276](https://cve.now/CVE-2026-89276.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-83660](https://cve.now/CVE-2026-83660.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-82013](https://cve.now/CVE-2026-82013.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-82003](https://cve.now/CVE-2026-82003.md): Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20) (CVSS 8.5, Adobe Campaign Classic)
- [CVE-2026-82009](https://cve.now/CVE-2026-82009.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.1, Adobe Campaign Classic)
- [CVE-2026-75721](https://cve.now/CVE-2026-75721.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-75723](https://cve.now/CVE-2026-75723.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-75699](https://cve.now/CVE-2026-75699.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-73369](https://cve.now/CVE-2026-73369.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-82011](https://cve.now/CVE-2026-82011.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.1, Adobe Campaign Classic)
- [CVE-2026-82443](https://cve.now/CVE-2026-82443.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.6, Adobe Campaign Classic)
- [CVE-2026-82008](https://cve.now/CVE-2026-82008.md): Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-89275](https://cve.now/CVE-2026-89275.md): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-75728](https://cve.now/CVE-2026-75728.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 9.1, Adobe Campaign Classic)
- [CVE-2026-82010](https://cve.now/CVE-2026-82010.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-77258](https://cve.now/CVE-2026-77258.md): MCP Atlassian: Arbitrary file read/exfiltration via upload\_attachment missing validate\_safe\_path() (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-77274](https://cve.now/CVE-2026-77274.md): MCP Atlassian: SSRF Protection Bypass (CVSS 8.8, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-95624](https://cve.now/CVE-2026-95624.md): Tauri framework v2 malicious downgrade via allow\_downgrades from frontend code (CVSS 6.8, tauri-plugin-updater)
- [CVE-2026-95656](https://cve.now/CVE-2026-95656.md): dgtlmoon changedetection.io Preview Endpoint init.py add\_watch\_ui\_snapshot server-side request forgery (CVSS 6.9, dgtlmoon changedetection.io)
- [CVE-2026-85995](https://cve.now/CVE-2026-85995.md): Notepad++: Authenticode verification bypass allows modified updater execution (CVSS 7.3, notepad-plus-plus)
- [CVE-2026-86056](https://cve.now/CVE-2026-86056.md): Notepad++: Null pointer dereference in NPPM\_SAVESESSION message handler causes crash (DoS) (CVSS 5.5, notepad-plus-plus)
- [CVE-2026-77605](https://cve.now/CVE-2026-77605.md): Notepad++ “Run by system” executes \*.txt.cmd when user selected \*.txt (target confusion → command execution) (CVSS 7.8, notepad-plus-plus)
- [CVE-2026-86054](https://cve.now/CVE-2026-86054.md): Notepad++: Stack Buffer Overflow in \`NppParameters::writeSession\` via overlong session path (CVSS 7.8, notepad-plus-plus)
- [CVE-2026-85288](https://cve.now/CVE-2026-85288.md): Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog (CVSS 6.7, notepad-plus-plus)
- [CVE-2026-85279](https://cve.now/CVE-2026-85279.md): Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value (CVSS 8.6, notepad-plus-plus)
- [CVE-2026-93345](https://cve.now/CVE-2026-93345.md): MikroTik RouterOS \< 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI (CVSS 8.7, MikroTik RouterOS)
- [CVE-2026-94384](https://cve.now/CVE-2026-94384.md): Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda (CVSS 8.1, amazon-connect-salesforce-lambda)
- [CVE-2026-83597](https://cve.now/CVE-2026-83597.md): Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution (CVSS 7.0, netdata)
- [CVE-2026-83600](https://cve.now/CVE-2026-83600.md): Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent (CVSS 6.5, netdata)
- [CVE-2026-83598](https://cve.now/CVE-2026-83598.md): Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair (CVSS 7.8, netdata)
- [CVE-2026-83603](https://cve.now/CVE-2026-83603.md): Netdata: Local Root via ndsudo Arbitrary socket\_path → fail2ban-client Pickle RCE (CVSS 8.4, netdata)
- [CVE-2026-83601](https://cve.now/CVE-2026-83601.md): Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write (CVSS 6.5, netdata)
- [CVE-2026-83602](https://cve.now/CVE-2026-83602.md): Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP\_ACL\_NOCHECK (CVSS 6.5, netdata)
- [CVE-2026-83599](https://cve.now/CVE-2026-83599.md): Netdata: WebSocket Decompression Bomb (CVSS 7.5, netdata)
- [CVE-2026-84301](https://cve.now/CVE-2026-84301.md): FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests (CVSS 6.3, labring FastGPT)
- [CVE-2026-95818](https://cve.now/CVE-2026-95818.md): AT\_SECURE program buffer overflow via $ORIGIN processing (CVSS 3.6, The GNU C Library glibc)
- [CVE-2026-76805](https://cve.now/CVE-2026-76805.md): Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode (CVSS 5.3, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-76802](https://cve.now/CVE-2026-76802.md): Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass (CVSS 4.7, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-87902](https://cve.now/CVE-2026-87902.md): An unauthenticated attacker can make \`get\_page\_template()\` page-template resolution include a chosen readable local \`.php\` file outside the (CVSS 8.1, KEV, WordPress)
- [CVE-2026-76804](https://cve.now/CVE-2026-76804.md): Nuclei: Local File Read via Workflow File-Protocol Gate Bypass (CVSS 5.5, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-76803](https://cve.now/CVE-2026-76803.md): Nuclei: Local File Read via MySQL Client Sandbox Bypass (CVSS 5.3, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-83803](https://cve.now/CVE-2026-83803.md): Sentry: Unsafe pickle deserialization in Relocation Feature (CVSS 7.7, getsentry sentry)
- [CVE-2026-86062](https://cve.now/CVE-2026-86062.md): LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content (CVSS 6.1, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-85740](https://cve.now/CVE-2026-85740.md): LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard (CVSS 7.1, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-85734](https://cve.now/CVE-2026-85734.md): LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks (CVSS 9.1, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-94455](https://cve.now/CVE-2026-94455.md): Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key (CVSS 7.1, GitroomHQ postiz-app)
- [CVE-2026-85725](https://cve.now/CVE-2026-85725.md): LightRAG: Plaintext Passwords Compared Without Constant-Time Function (CVSS 5.9, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-85709](https://cve.now/CVE-2026-85709.md): LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses (CVSS 5.3, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-86059](https://cve.now/CVE-2026-86059.md): Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one (CVSS 9.6, dokploy)
- [CVE-2026-94456](https://cve.now/CVE-2026-94456.md): Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys (CVSS 9.1, GitroomHQ postiz-app)
- [CVE-2026-56682](https://cve.now/CVE-2026-56682.md): 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header (CVSS 5.3, decolua 9router · 9router)
- [CVE-2026-56681](https://cve.now/CVE-2026-56681.md): 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header (CVSS 7.3, decolua 9router · 9router)
- [CVE-2026-86805](https://cve.now/CVE-2026-86805.md): AT\_SECURE programs may load attacker-controlled code via $ORIGIN (CVSS 6.3, The GNU C Library glibc)
- [CVE-2026-86698](https://cve.now/CVE-2026-86698.md): Refresh tokens accepted as private repository credentials at the CDN (CVSS 2.3, hexpm hex.pm · hexpm)
- [CVE-2026-75517](https://cve.now/CVE-2026-75517.md): Novu: Cross-Environment Integration Manipulation (IDOR) (CVSS 6.5, novuhq novu · @novu api-service)
- [CVE-2026-90462](https://cve.now/CVE-2026-90462.md): Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization (CVSS 5.4, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-75511](https://cve.now/CVE-2026-75511.md): Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs (CVSS 5.3, novuhq novu · @novu api-service)
- [CVE-2026-75510](https://cve.now/CVE-2026-75510.md): Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme (CVSS 5.1, novuhq novu · @novu/js)
- [CVE-2026-94640](https://cve.now/CVE-2026-94640.md): Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-70410](https://cve.now/CVE-2026-70410.md): Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins (CVSS 8.8, Apache Software Foundation org.apache.calcite.avatica:avati…)
- [CVE-2026-88010](https://cve.now/CVE-2026-88010.md): Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle (CVSS 6.3, traefik · github.com/traefik/traefik/v3 +1)
- [CVE-2026-75608](https://cve.now/CVE-2026-75608.md): Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information (CVSS 7.7, blakeblackshear frigate)
- [CVE-2026-75607](https://cve.now/CVE-2026-75607.md): Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations (CVSS 8.1, blakeblackshear frigate)
- [CVE-2026-77637](https://cve.now/CVE-2026-77637.md): Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope (CVSS 3.8, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-77633](https://cve.now/CVE-2026-77633.md): Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service (CVSS 7.1, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-79913](https://cve.now/CVE-2026-79913.md): Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and… (CVSS 6.5, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-95655](https://cve.now/CVE-2026-95655.md): Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel (CVSS 8.6, Webkul Aureus ERP)
- [CVE-2026-95654](https://cve.now/CVE-2026-95654.md): Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token (CVSS 9.1, David-Crty Databasement)
- [CVE-2026-95653](https://cve.now/CVE-2026-95653.md): Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token (CVSS 8.7, concretecms-community-store community\_store)
- [CVE-2026-80156](https://cve.now/CVE-2026-80156.md): Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-63374](https://cve.now/CVE-2026-63374.md): AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing (CVSS 9.3, agronholm anyio · anyio)
- [CVE-2026-80155](https://cve.now/CVE-2026-80155.md): Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation (CVSS 10.0, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80154](https://cve.now/CVE-2026-80154.md): Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass (CVSS 8.9, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80152](https://cve.now/CVE-2026-80152.md): Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-92706](https://cve.now/CVE-2026-92706.md): Dark Reader: Ability to request icon-like bitmap data from certain local web servers (CVSS 3.4, darkreader)
- [CVE-2026-80151](https://cve.now/CVE-2026-80151.md): Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80150](https://cve.now/CVE-2026-80150.md): Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter (CVSS 7.7, LANTRONIX SLC8000 · LANTRONIX EMG8500 +3)
- [CVE-2026-80149](https://cve.now/CVE-2026-80149.md): Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter (CVSS 7.7, LANTRONIX SLC8000 · LANTRONIX EMG8500 +3)
- [CVE-2026-80148](https://cve.now/CVE-2026-80148.md): Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation (CVSS 7.7, LANTRONIX SLC8000 · LANTRONIX EMG8500 +3)
- [CVE-2026-85055](https://cve.now/CVE-2026-85055.md): Twenty: Field-level read bypass (CVSS 7.1, twentyhq twenty)
- [CVE-2026-80147](https://cve.now/CVE-2026-80147.md): Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80146](https://cve.now/CVE-2026-80146.md): Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-77621](https://cve.now/CVE-2026-77621.md): Vector: Arbitrary file write in the file sink via templated path (path traversal). (CVSS 9.3, vectordotdev vector)
- [CVE-2026-80145](https://cve.now/CVE-2026-80145.md): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-77620](https://cve.now/CVE-2026-77620.md): Vector: Unauthenticated denial of service in the \`logstash\` source via nested compressed frames (stack exhaustion and decompression… (CVSS 8.7, vectordotdev vector)
- [CVE-2026-80144](https://cve.now/CVE-2026-80144.md): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-80143](https://cve.now/CVE-2026-80143.md): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read (CVSS 9.4, LANTRONIX SLC8000 · LANTRONIX EMG8500 +5)
- [CVE-2026-77619](https://cve.now/CVE-2026-77619.md): Vector: Unauthenticated denial of service in the \`logstash\` source via unbounded memory allocation. (CVSS 8.7, vectordotdev vector)
- [CVE-2026-81883](https://cve.now/CVE-2026-81883.md): radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode (CVSS 3.3, radareorg radare2)
- [CVE-2026-81885](https://cve.now/CVE-2026-81885.md): radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser (CVSS 5.5, radareorg radare2)
- [CVE-2026-81882](https://cve.now/CVE-2026-81882.md): radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser (CVSS 3.3, radareorg radare2)
- [CVE-2026-81886](https://cve.now/CVE-2026-81886.md): radare2: Uncontrolled memory allocation in radare2 dmp64 parser (CVSS 5.5, radareorg radare2)
- [CVE-2026-81884](https://cve.now/CVE-2026-81884.md): radare2: Heap out-of-bounds read in radare2 Mach-O LC\_DATA\_IN\_CODE parser (CVSS 2.5, radareorg radare2)
- [CVE-2026-81880](https://cve.now/CVE-2026-81880.md): radare2: Uncontrolled resource consumption in radare2 PEF loader (CVSS 5.5, radareorg radare2)
- [CVE-2026-95806](https://cve.now/CVE-2026-95806.md): MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths (CVSS 7.7, MISP)
- [CVE-2026-81879](https://cve.now/CVE-2026-81879.md): radare2: Heap out-of-bounds read in radare2 ELF PN\_XNUM handling (CVSS 5.5, radareorg radare2)
- [CVE-2026-81878](https://cve.now/CVE-2026-81878.md): radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser (CVSS 5.5, radareorg radare2)
- [CVE-2026-81881](https://cve.now/CVE-2026-81881.md): radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser (CVSS 3.3, radareorg radare2)
- [CVE-2026-95805](https://cve.now/CVE-2026-95805.md): MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction (CVSS 5.3, MISP)
- [CVE-2026-19915](https://cve.now/CVE-2026-19915.md): HP Support Assistant - Local Escalation of Privilege (CVSS 7.3, HP Support Assistant)
- [CVE-2026-95754](https://cve.now/CVE-2026-95754.md): MISP: Disabled-user check ineffective in pre-authentication TOTP login branch (CVSS 6.9, MISP)
- [CVE-2026-89407](https://cve.now/CVE-2026-89407.md): jackson-core: quadratic backtracking in NumberInput.PATTERN\_FLOAT via looksLikeValidNumber() enables ReDoS (CVSS 7.5, com.fasterxml.jackson.core:jackson-core · FasterXML tool… +1)
- [CVE-2026-95703](https://cve.now/CVE-2026-95703.md): MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp\_name (CVSS 5.1, MISP)
- [CVE-2026-95701](https://cve.now/CVE-2026-95701.md): MISP Path Traversal via Organization Name in Org-Statistics Logo Check (CVSS 5.1, MISP)
- [CVE-2026-95698](https://cve.now/CVE-2026-95698.md): MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name (CVSS 5.3, MISP)
- [CVE-2026-95697](https://cve.now/CVE-2026-95697.md): MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata (CVSS 5.3, MISP)
- [CVE-2026-95501](https://cve.now/CVE-2026-95501.md): mtrano APENCMS Template weasel.php eval code injection (CVSS 4.8, mtrano APENCMS)
- [CVE-2026-95693](https://cve.now/CVE-2026-95693.md): MISP Information Disclosure via Forged Upload Path (CVSS 5.3, MISP)
- [CVE-2026-94127](https://cve.now/CVE-2026-94127.md): BIG-IP APM OAuth vulnerability (CVSS 9.8, KEV, F5 BIG-IP)
- [CVE-2026-95500](https://cve.now/CVE-2026-95500.md): JosephChuks php-file-manager-with-code-editor Save codeEditor.php file\_put\_contents unrestricted upload (CVSS 6.9, JosephChuks php-file-manager-with-code-editor)
- [CVE-2026-94570](https://cve.now/CVE-2026-94570.md): CVE-2026-94570 (CVSS 5.9, SGLang)
- [CVE-2026-95685](https://cve.now/CVE-2026-95685.md): MISP Missing Authorization on replaceSuggestionInReport Event Report Action (CVSS 5.3, MISP)
- [CVE-2026-84388](https://cve.now/CVE-2026-84388.md): A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions may allow… (CVSS 9.1, Fortinet FortiPAM Chrome Extension)
- [CVE-2026-65112](https://cve.now/CVE-2026-65112.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. (CVSS 6.5, NVIDIA Infrastructure Controller)
- [CVE-2026-65118](https://cve.now/CVE-2026-65118.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. (CVSS 7.5, NVIDIA Infrastructure Controller)
- [CVE-2026-65117](https://cve.now/CVE-2026-65117.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. (CVSS 5.0, NVIDIA Infrastructure Controller)
- [CVE-2026-65115](https://cve.now/CVE-2026-65115.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. (CVSS 6.5, NVIDIA Infrastructure Controller)
- [CVE-2026-65114](https://cve.now/CVE-2026-65114.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical… (CVSS 8.3, NVIDIA Infrastructure Controller)
- [CVE-2026-65113](https://cve.now/CVE-2026-65113.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. (CVSS 9.8, NVIDIA Infrastructure Controller)
- [CVE-2026-65130](https://cve.now/CVE-2026-65130.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. (CVSS 8.0, NVIDIA Infrastructure Controller)
- [CVE-2026-65129](https://cve.now/CVE-2026-65129.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. (CVSS 6.7, NVIDIA Infrastructure Controller)
- [CVE-2026-65128](https://cve.now/CVE-2026-65128.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. (CVSS 8.8, NVIDIA Infrastructure Controller)
- [CVE-2026-65127](https://cve.now/CVE-2026-65127.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information… (CVSS 4.1, NVIDIA Infrastructure Controller)
- [CVE-2026-65126](https://cve.now/CVE-2026-65126.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral… (CVSS 5.0, NVIDIA Infrastructure Controller)
- [CVE-2026-65125](https://cve.now/CVE-2026-65125.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. (CVSS 6.6, NVIDIA Infrastructure Controller)
- [CVE-2026-65124](https://cve.now/CVE-2026-65124.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. (CVSS 5.9, NVIDIA Infrastructure Controller)
- [CVE-2026-65121](https://cve.now/CVE-2026-65121.md): NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. (CVSS 8.2, NVIDIA Infrastructure Controller)
- [CVE-2026-93088](https://cve.now/CVE-2026-93088.md): CVE-2026-93088 (CVSS 9.8, SGLang)
- [CVE-2026-95683](https://cve.now/CVE-2026-95683.md): MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL (CVSS 5.3, MISP)
- [CVE-2026-65179](https://cve.now/CVE-2026-65179.md): NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via… (CVSS 8.8, NVIDIA NeMo Speech)
- [CVE-2026-65178](https://cve.now/CVE-2026-65178.md): NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model\_config.yaml can inject unsafe… (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-65111](https://cve.now/CVE-2026-65111.md): NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-24239](https://cve.now/CVE-2026-24239.md): NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-24267](https://cve.now/CVE-2026-24267.md): NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an… (CVSS 7.8, NVIDIA NeMo Speech)
- [CVE-2026-93344](https://cve.now/CVE-2026-93344.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_get\_page\_content AJAX (CVSS 7.1, WebWizards MarketKing)
- [CVE-2026-93343](https://cve.now/CVE-2026-93343.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_admin\_vendors\_ajax (CVSS 7.1, WebWizards MarketKing)
- [CVE-2026-95682](https://cve.now/CVE-2026-95682.md): MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View (CVSS 4.8, MISP)
- [CVE-2026-93342](https://cve.now/CVE-2026-93342.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_duplicate\_product AJAX (CVSS 5.3, WebWizards MarketKing)
- [CVE-2026-12718](https://cve.now/CVE-2026-12718.md): SQLi in Karel Electronics' KarelIPS (CVSS 9.8, Karel Electronic Industry and Trade KarelIPS)
- [CVE-2026-93341](https://cve.now/CVE-2026-93341.md): MarketKing \< 2.1.72 Missing Authorization via marketking\_send\_refund AJAX (CVSS 5.3, WebWizards MarketKing)
- [CVE-2026-95679](https://cve.now/CVE-2026-95679.md): MISP Unauthenticated Blind SSRF via XML Body Processing (CVSS 6.9, MISP)
- [CVE-2026-95675](https://cve.now/CVE-2026-95675.md): D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface (CVSS 9.3, D-LINK DAP-1360)
- [CVE-2026-95499](https://cve.now/CVE-2026-95499.md): JosephChuks php-file-manager-with-code-editor filemanager.php move\_uploaded\_file unrestricted upload (CVSS 6.9, JosephChuks php-file-manager-with-code-editor)
- [CVE-2026-95674](https://cve.now/CVE-2026-95674.md): MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation (CVSS 5.3, MISP)
- [CVE-2026-95671](https://cve.now/CVE-2026-95671.md): MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add (CVSS 5.3, MISP)
- [CVE-2026-95667](https://cve.now/CVE-2026-95667.md): MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials (CVSS 6.9, MISP)
- [CVE-2026-95666](https://cve.now/CVE-2026-95666.md): Unbounded post ID array in the bulk reactions endpoint allows denial of service (CVSS 4.3, Mattermost)
- [CVE-2026-95665](https://cve.now/CVE-2026-95665.md): MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON (CVSS 5.1, MISP)
- [CVE-2026-95396](https://cve.now/CVE-2026-95396.md): sfturing hosp\_order Public Search Handlers HospitalController.java cross site scripting (CVSS 5.3, sfturing hosp\_order)
- [CVE-2026-93616](https://cve.now/CVE-2026-93616.md): Directory Traversal and File upload allows execution of arbitrary script on the Management Server (CVSS 9.8, KEV, checkpoint Quantum Security Management)
- [CVE-2026-95661](https://cve.now/CVE-2026-95661.md): MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List (CVSS 5.1, MISP)
- [CVE-2026-95619](https://cve.now/CVE-2026-95619.md): Gcc: libstdc++ integer overflow in \`new\` operator (CVSS 7.7, Red Hat Enterprise Linux · Red Hat Hardened Images +2)
- [CVE-2026-95659](https://cve.now/CVE-2026-95659.md): MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread (CVSS 4.8, MISP)
- [CVE-2026-95658](https://cve.now/CVE-2026-95658.md): MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules (CVSS 6.9, MISP)
- [CVE-2026-95273](https://cve.now/CVE-2026-95273.md): dgtlmoon changedetection.io visual\_selector\_data flask\_app.py static\_content path traversal (CVSS 5.3, dgtlmoon changedetection.io)
- [CVE-2026-95272](https://cve.now/CVE-2026-95272.md): dgtlmoon changedetection.io Screenshot flask\_app.py static\_content path traversal (CVSS 6.3, dgtlmoon changedetection.io)
- [CVE-2026-75791](https://cve.now/CVE-2026-75791.md): Authentication bypass vulnerability (CVSS 8.6, Zohocorp ManageEngine ADSelfService Plus)
- [CVE-2026-95271](https://cve.now/CVE-2026-95271.md): dgtlmoon changedetection.io Authentication Hook flask\_app.py check\_authentication improper authentication (CVSS 6.9, dgtlmoon changedetection.io)
- [CVE-2026-74849](https://cve.now/CVE-2026-74849.md): Remote code execution vulnerability (CVSS 9.8, Zohocorp ManageEngine ADSelfService Plus)
- [CVE-2026-87119](https://cve.now/CVE-2026-87119.md): mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed (CVSS 8.2, ZenHive mpp · mpp)
- [CVE-2026-89420](https://cve.now/CVE-2026-89420.md): Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free (CVSS 7.1, ZenHive mpp · mpp)
- [CVE-2026-95270](https://cve.now/CVE-2026-95270.md): dgtlmoon changedetection.io Hash Comparison flask\_app.py check\_password timing discrepancy (CVSS 6.3, dgtlmoon changedetection.io)
- [CVE-2026-63279](https://cve.now/CVE-2026-63279.md): Out of bounds read in PICT image import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63278](https://cve.now/CVE-2026-63278.md): Package URLs can be used to exfiltrate arbitrary INI file values and environment variables (CVSS 6.7, The Document Foundation LibreOffice)
- [CVE-2026-63276](https://cve.now/CVE-2026-63276.md): Stack buffer overflow in CFF to Type 1 font conversion (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63275](https://cve.now/CVE-2026-63275.md): Stack buffer overflow in CFF font hint handling (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63274](https://cve.now/CVE-2026-63274.md): Heap buffer overflow in PDF import stream handling (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63273](https://cve.now/CVE-2026-63273.md): Heap buffer overflow in PDF import encryption handling (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-63272](https://cve.now/CVE-2026-63272.md): Heap buffer overflow in WMF text record import (CVSS 5.4, The Document Foundation LibreOffice)
- [CVE-2026-95623](https://cve.now/CVE-2026-95623.md): Tauri framework v2 SSRF Protection Bypass via HTTP Redirects (CVSS 5.6, tauri-plugin-http)
- [CVE-2026-90990](https://cve.now/CVE-2026-90990.md): Livestatus injection via monitoring filter values (CVSS 5.3, Checkmk)
- [CVE-2026-92882](https://cve.now/CVE-2026-92882.md): Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses (CVSS 2.3, Checkmk)
- [CVE-2026-25265](https://cve.now/CVE-2026-25265.md): Creation of Temporary File with Insecure Permissions in Qualcomm Software Center (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25264](https://cve.now/CVE-2026-25264.md): Uncontrolled Search Path Element in Qualcomm Software Center (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25262](https://cve.now/CVE-2026-25262.md): Write-what-where Condition in Primary Bootloader (CVSS 6.9, Qualcomm Snapdragon)
- [CVE-2026-25255](https://cve.now/CVE-2026-25255.md): Exposed function in Qualcomm Package Manager and Qualcomm Software Center. (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25254](https://cve.now/CVE-2026-25254.md): Improper authorization in Qualcomm Software Center (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2026-90882](https://cve.now/CVE-2026-90882.md): Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data (CVSS 8.7, Eclipse Foundation open-vsx.org)
- [CVE-2026-94117](https://cve.now/CVE-2026-94117.md): WordPress HashBar – WordPress Notification Bar plugin \<= 2.0.3 - SQL Injection vulnerability (CVSS 7.6, DevItems HashBar – WordPress Notification Bar)
- [CVE-2026-93556](https://cve.now/CVE-2026-93556.md): Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini (CVSS 9.3, Kompini Tankuam Places)
- [CVE-2026-65634](https://cve.now/CVE-2026-65634.md): Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder (CVSS 8.2, Erlang OTP)
- [CVE-2026-68956](https://cve.now/CVE-2026-68956.md): SSH daemon allocates unbounded idle session channels, bypassing max\_channels (CVSS 7.1, Erlang OTP)
- [CVE-2026-89422](https://cve.now/CVE-2026-89422.md): TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre\_shared\_key extension (CVSS 9.3, Erlang OTP)
- [CVE-2026-93928](https://cve.now/CVE-2026-93928.md): WordPress Taxi Booking Manager for WooCommerce plugin \< 2.0.8 - Broken Authentication vulnerability (CVSS 7.3, Magepeople Taxi Booking Manager for WooCommerce)
- [CVE-2026-95508](https://cve.now/CVE-2026-95508.md): Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu (CVSS 7.4, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-15095](https://cve.now/CVE-2026-15095.md): Product Feed Manager for WooCommerce \<= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter (CVSS 4.9, wahid0003 Product Feed Manager for WooCommerce – CTX Feed –…)
- [CVE-2026-9231](https://cve.now/CVE-2026-9231.md): WP Travel Engine \<= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute (CVSS 7.5, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2026-95503](https://cve.now/CVE-2026-95503.md): Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled (CVSS 6.8, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-93836](https://cve.now/CVE-2026-93836.md): WPC Product Bundles for WooCommerce \<= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter (CVSS 7.2, wpclever WPC Product Bundles for WooCommerce)
- [CVE-2026-9004](https://cve.now/CVE-2026-9004.md): WP-CRM System \<= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact\_id' Parameter (CVSS 4.3, nofearinc WP-CRM System – Manage Clients and Projects)
- [CVE-2026-7622](https://cve.now/CVE-2026-7622.md): ThumbPress \<= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation (CVSS 4.3, codexpert ThumbPress – Compress Images, Manage Thumbnails,…)
- [CVE-2026-18345](https://cve.now/CVE-2026-18345.md): WP User Manager \<= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback (CVSS 4.3, wpusermanager WP User Manager – User Profile Builder & Memb…)
- [CVE-2025-1280](https://cve.now/CVE-2025-1280.md): BM Content Builder \< 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, SeaTheme BM Content Builder)
- [CVE-2025-14487](https://cve.now/CVE-2025-14487.md): Handily \<= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe\_publishbale\_key'… (CVSS 5.3, kamleshyadav Handily)
- [CVE-2026-93778](https://cve.now/CVE-2026-93778.md): WP Yelp Review Slider \<= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp\_download\_source) (CVSS 7.2, jgwhite33 WP Yelp Review Slider)
- [CVE-2026-92235](https://cve.now/CVE-2026-92235.md): WP Ultimate Review \<= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs\_submit\_review\_data\[xs\_reviw\_summery\]'… (CVSS 8.1, roxnor WP Ultimate Review)
- [CVE-2026-91092](https://cve.now/CVE-2026-91092.md): wpForo Forum \<= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo\_post\_edit Action / Forged… (CVSS 4.3, tomdever wpForo Forum)
- [CVE-2026-6922](https://cve.now/CVE-2026-6922.md): WP Table Builder \<= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter (CVSS 7.1, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2026-1645](https://cve.now/CVE-2026-1645.md): Hostel \<= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom\_currency' Parameter and Localization file URL… (CVSS 4.4, prasunsen Hostel)
- [CVE-2026-18439](https://cve.now/CVE-2026-18439.md): Tutor LMS \<= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion… (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2025-1281](https://cve.now/CVE-2025-1281.md): BM Content Builder \< 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, SeaTheme BM Content Builder)
- [CVE-2026-4123](https://cve.now/CVE-2026-4123.md): RW Elephant Rental Inventory \<= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle\_cache'… (CVSS 4.3, rwelephant01 RW Elephant Rental Inventory)
- [CVE-2025-14484](https://cve.now/CVE-2025-14484.md): Image Buzz \<= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay\_api' Parameter (CVSS 5.3, kamleshyadav Image Buzz)
- [CVE-2025-14486](https://cve.now/CVE-2025-14486.md): PixelPlay \<= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear\_api\_type' Parameter (CVSS 5.3, kamleshyadav PixelPlay)
- [CVE-2026-92969](https://cve.now/CVE-2026-92969.md): HUSKY \<= 1.4.4 - Unauthenticated Local File Inclusion via 'custom\_tpl' Shortcode Attribute via 'woof\_draw\_products' AJAX (CVSS 8.1, realmag777 HUSKY – Products Filter for WooCommerce Professi…)
- [CVE-2026-16778](https://cve.now/CVE-2026-16778.md): Live Composer \<= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc\_module\_downloads\_output' Shortcode Content (CVSS 6.4, livecomposer Live Composer – Free WordPress Website Builder)
- [CVE-2026-12995](https://cve.now/CVE-2026-12995.md): Custom Field Template \<= 2.7.8 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Media File Deletion via… (CVSS 4.3, hiroaki-miyashita Custom Field Template)
- [CVE-2026-93952](https://cve.now/CVE-2026-93952.md): Security Advisory 0183 (CVSS 10.0, KEV, Arista Networks VeloCloud Orchestrator (VCO) On-Prem)
- [CVE-2026-87082](https://cve.now/CVE-2026-87082.md): Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode\_punycode (CVSS 7.5, Net-IDN-Encode)
- [CVE-2026-87081](https://cve.now/CVE-2026-87081.md): Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length… (CVSS 7.5, Net-IDN-Encode)
- [CVE-2026-87080](https://cve.now/CVE-2026-87080.md): Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in… (CVSS 9.1, Net-IDN-Encode)
- [CVE-2026-87079](https://cve.now/CVE-2026-87079.md): Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in… (CVSS 7.5, Net-IDN-Encode)
- [CVE-2026-87078](https://cve.now/CVE-2026-87078.md): Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode\_punycode (CVSS 9.1, Net-IDN-Encode)
- [CVE-2026-74766](https://cve.now/CVE-2026-74766.md): Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the… (CVSS 8.4, Net-IDN-Encode)
- [CVE-2026-74765](https://cve.now/CVE-2026-74765.md): Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in… (CVSS 6.5, Net-IDN-Encode)
- [CVE-2016-15059](https://cve.now/CVE-2016-15059.md): Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in… (CVSS 9.8, Net-IDN-Encode)
- [CVE-2026-91827](https://cve.now/CVE-2026-91827.md): Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export (CVSS 7.5, Ninja Forms)
- [CVE-2026-92438](https://cve.now/CVE-2026-92438.md): Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin (CVSS 8.8, Ninja Forms)
- [CVE-2026-94504](https://cve.now/CVE-2026-94504.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.15.3 - Stored Cross-Site Scripting (CVSS 7.2, kstover Ninja Forms – Contact Form Builder with Calculators…)
- [CVE-2026-89412](https://cve.now/CVE-2026-89412.md): TranslatePress \<= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-88788](https://cve.now/CVE-2026-88788.md): Text Styler \<= 1.1.1 - Contributor+ Stored XSS (CVSS 6.8, Text Styler)
- [CVE-2026-93655](https://cve.now/CVE-2026-93655.md): Booking Calendar \<= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc\_auto\_fill' Parameter (CVSS 6.1, wpdevelop Booking Calendar)
- [CVE-2026-12470](https://cve.now/CVE-2026-12470.md): CMP \<= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp\_ajax\_import\_settings AJAX Action (CVSS 7.2, CMP – Coming Soon & Maintenance Plugin by NiteoThemes)
- [CVE-2026-85653](https://cve.now/CVE-2026-85653.md): Contextual Related Posts \<= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other\_attributes' Block Parameter (CVSS 6.4, ajay Contextual Related Posts)
- [CVE-2026-19658](https://cve.now/CVE-2026-19658.md): Give Tributes \<= 2.3.1 - Unauthenticated PHP Object Injection via 'give\_tributes\_ecard\_notify\[recipient\]\[personalized\]\[\]' Parameter (CVSS 9.8, LiquidWeb Give Tributes)
- [CVE-2026-13355](https://cve.now/CVE-2026-13355.md): Meta Box AIO \<= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to… (CVSS 9.8, Meta Box Frontend Submission)
- [CVE-2026-94493](https://cve.now/CVE-2026-94493.md): Gigatech PDV5701 WebSocket Service index.html missing authentication (CVSS 10.0, Gigatech PDV5701)
- [CVE-2026-93712](https://cve.now/CVE-2026-93712.md): Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public\_dir via relative path segments in the File route handler (CVSS 7.5, Dancer2)
- [CVE-2026-93711](https://cve.now/CVE-2026-93711.md): Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers\_to\_array (CVSS 6.5, Dancer2)
- [CVE-2026-93710](https://cve.now/CVE-2026-93710.md): Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response… (CVSS 7.5, Dancer2)
- [CVE-2026-93709](https://cve.now/CVE-2026-93709.md): Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage… (CVSS 5.3, Dancer2)
- [CVE-2026-94492](https://cve.now/CVE-2026-94492.md): Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection (CVSS 5.3, Yonyou U8cloud)
- [CVE-2026-76974](https://cve.now/CVE-2026-76974.md): Information Disclosure vulnerability in SAP Fiori Launchpad (CVSS 5.3, SAP\_SE SAP Fiori Launchpad)
- [CVE-2026-94491](https://cve.now/CVE-2026-94491.md): Yonyou KSOA search\_list.jsp sql injection (CVSS 6.9, Yonyou KSOA)
- [CVE-2026-37603](https://cve.now/CVE-2026-37603.md): Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS)… (CVSS 6.5)
- [CVE-2026-37604](https://cve.now/CVE-2026-37604.md): pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in \_protected/framework/Ip/Ip.class.php from th (CVSS 6.5)
- [CVE-2026-75432](https://cve.now/CVE-2026-75432.md): An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scann (CVSS 5.1)
- [CVE-2026-79311](https://cve.now/CVE-2026-79311.md): webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render\_jinja.\_\_init\_\_(). (CVSS 6.1)
- [CVE-2026-79312](https://cve.now/CVE-2026-79312.md): webpy web.py 0.76 is vulnerable to Session Fixation. (CVSS 6.8)
- [CVE-2026-79313](https://cve.now/CVE-2026-79313.md): webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. (CVSS 9.8)
- [CVE-2026-79314](https://cve.now/CVE-2026-79314.md): A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. (CVSS 8.8)
- [CVE-2026-79315](https://cve.now/CVE-2026-79315.md): A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. (CVSS 4.7)
- [CVE-2026-88339](https://cve.now/CVE-2026-88339.md): A NULL pointer dereference vulnerability exists in the gf\_sg\_vrml\_field\_clone() function of GPAC 2d7da22e (26.08-DEV). (CVSS 5.5)
- [CVE-2026-88340](https://cve.now/CVE-2026-88340.md): An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. (CVSS 7.6)
- [CVE-2026-88341](https://cve.now/CVE-2026-88341.md): A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. (CVSS 5.5)
- [CVE-2026-88344](https://cve.now/CVE-2026-88344.md): An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. (CVSS 7.5)
- [CVE-2026-88345](https://cve.now/CVE-2026-88345.md): An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. (CVSS 7.5)
- [CVE-2026-88350](https://cve.now/CVE-2026-88350.md): An integer overflow vulnerability exists in MPack 1.1.1 in mpack\_node\_cstr\_alloc() and mpack\_node\_utf8\_cstr\_alloc(). (CVSS 6.2)
- [CVE-2026-88414](https://cve.now/CVE-2026-88414.md): MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). (CVSS 9.8)
- [CVE-2026-88415](https://cve.now/CVE-2026-88415.md): MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). (CVSS 8.7)
- [CVE-2026-88416](https://cve.now/CVE-2026-88416.md): MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature. (CVSS 9.8)
- [CVE-2026-88418](https://cve.now/CVE-2026-88418.md): CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin reques (CVSS 8.8)
- [CVE-2026-88419](https://cve.now/CVE-2026-88419.md): An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of… (CVSS 8.8)
- [CVE-2026-88624](https://cve.now/CVE-2026-88624.md): Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory… (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.