# CVEs published 2026-11-12

387 CVEs were published on November 12, 2026: 30 critical, 176 high. 14 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-498d5eb864](https://cve.now/SZB-498d5eb864): SCKit malware reported in ScreenConnect attacks targeting MSPs
- [SZB-53b611532f](https://cve.now/SZB-53b611532f): TSMC says no intrusion found after employee data was offered for sale
- [SZB-f45d3069b4](https://cve.now/SZB-f45d3069b4): Siemens reports Node2Shell Brotli flaw (CVE-2026-111497) in Desigo CC and Gridscale X
- [SZB-9d96703e23](https://cve.now/SZB-9d96703e23): Island reports 186 lookalike AI domains serving ClickFix lures and Net Guard malware
- [SZB-14f7eea4a0](https://cve.now/SZB-14f7eea4a0): Citrix patches critical NetScaler and Secure Access Client flaws, including authentication bypass
- [SZB-33a311bb79](https://cve.now/SZB-33a311bb79): Apache patches critical HTTP Server RCE flaw CVE-2026-119618
- [SZB-92e20603fc](https://cve.now/SZB-92e20603fc): Apify reports unauthorized access to internal systems and rotates API tokens
- [SZB-082f439dad](https://cve.now/SZB-082f439dad): Siemens RUGGEDCOM APE1808 affected by PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619
- [SZB-34b40f857b](https://cve.now/SZB-34b40f857b): Google Cloud warns three AMD Turin CPU flaws could leak data across VMs
- [SZB-e8aac6829d](https://cve.now/SZB-e8aac6829d): N-able investigates new N-central exploits claimed to give root RCE
- [SZB-c5bb586913](https://cve.now/SZB-c5bb586913): PTC patches critical Windchill and FlexPLM RCE flaw CVE-2026-126325
- [SZB-03e2ca31f9](https://cve.now/SZB-03e2ca31f9): Red Hat reports critical Quay flaw CVE-2026-123710 enabling signing-key takeover
- [SZB-0ddeb66320](https://cve.now/SZB-0ddeb66320): Node.js fixes 16 vulnerabilities, including HTTP/2 crash and memory-leak flaws
- [SZB-b1fc427f51](https://cve.now/SZB-b1fc427f51): Aikido Security reports attacker used 4,837 hijacked GitHub accounts to plant CI secret stealer

## CVEs

- [CVE-2026-126839](https://cve.now/CVE-2026-126839.md): Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization (CVSS 2.3, MongoDB C# Driver)
- [CVE-2026-126792](https://cve.now/CVE-2026-126792.md): Heap overflow via oversized RSA signature in GCP KMS signing callback (CVSS 5.6, MongoDB Libmongocrypt Driver)
- [CVE-2026-127275](https://cve.now/CVE-2026-127275.md): Linksys EA8100 JNAP API ui\_server.lua SetUnsecuredWiFiWarning missing authentication (CVSS 10.0, Linksys EA8100)
- [CVE-2026-120868](https://cve.now/CVE-2026-120868.md): Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler… (CVSS 9.3, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2026-127274](https://cve.now/CVE-2026-127274.md): Linksys EA8100 CheckAdminPassword excessive authentication (CVSS 6.3, Linksys EA8100)
- [CVE-2026-127273](https://cve.now/CVE-2026-127273.md): Linksys EA8100 JNAP API IsAdminPasswordDefault missing authentication (CVSS 5.3, Linksys EA8100)
- [CVE-2026-128067](https://cve.now/CVE-2026-128067.md): Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size (CVSS 8.4, python-pillow Pillow · pillow)
- [CVE-2026-128066](https://cve.now/CVE-2026-128066.md): Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data (CVSS 8.7, python-pillow Pillow · pillow)
- [CVE-2026-128065](https://cve.now/CVE-2026-128065.md): @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied (CVSS 6.9, grpc-node · @grpc/grpc-js-xds)
- [CVE-2026-126367](https://cve.now/CVE-2026-126367.md): @grpc/grpc-js: safe\_regex incorrectly applies partial string matching for patterns with alternation (CVSS 4.8, grpc-node · @grpc/grpc-js-xds)
- [CVE-2026-126366](https://cve.now/CVE-2026-126366.md): msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM (CVSS 7.5, msgpack-ruby · msgpack)
- [CVE-2026-126365](https://cve.now/CVE-2026-126365.md): Astro: XSS via unescaped code for unsupported languages in @astrojs/prism (CVSS 5.4, withastro astro · @astrojs prism +1)
- [CVE-2026-126364](https://cve.now/CVE-2026-126364.md): Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems (CVSS 6.3, withastro astro)
- [CVE-2026-93333](https://cve.now/CVE-2026-93333.md): HashiCorp Vault log injection in audit device prefix handling (CVSS 2.7, HashiCorp Vault)
- [CVE-2026-93335](https://cve.now/CVE-2026-93335.md): HashiCorp Vault ACL deny bypass via trailing slash in request paths (CVSS 6.5, HashiCorp Vault)
- [CVE-2026-126363](https://cve.now/CVE-2026-126363.md): Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js (CVSS 2.3, withastro astro · @astrojs/solid-js)
- [CVE-2026-92735](https://cve.now/CVE-2026-92735.md): HashiCorp Vault credential disclosure via SSRF in integrated storage join (CVSS 5.9, HashiCorp Vault)
- [CVE-2026-126362](https://cve.now/CVE-2026-126362.md): Astro: Reflected XSS via unescaped slot names in @astrojs/svelte (CVSS 2.3, withastro astro · @astrojs/svelte)
- [CVE-2026-126361](https://cve.now/CVE-2026-126361.md): Astro: XSS via attribute injection in dynamic tag names (CVSS 2.3, withastro astro)
- [CVE-2026-126360](https://cve.now/CVE-2026-126360.md): OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api (CVSS 5.3, open-telemetry opentelemetry-python)
- [CVE-2026-126359](https://cve.now/CVE-2026-126359.md): Hono: \`css\` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection (CVSS 3.4, honojs hono · hono)
- [CVE-2026-126358](https://cve.now/CVE-2026-126358.md): Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator (CVSS 5.3, honojs hono · hono)
- [CVE-2026-127212](https://cve.now/CVE-2026-127212.md): Dokploy \< 0.31.1 Broken Access Control via readAppMonitoring (CVSS 5.3, dokploy)
- [CVE-2026-126357](https://cve.now/CVE-2026-126357.md): Hono: \`mount()\` and \`app.mount()\` can forward a path that bypasses middleware scoped inside the mount prefix (CVSS 5.3, honojs hono · hono)
- [CVE-2026-126356](https://cve.now/CVE-2026-126356.md): Hono: \`validator('form')\` skips validation for \`multipart/form-data\` requests with extra parameters (CVSS 5.3, honojs hono · hono)
- [CVE-2026-126355](https://cve.now/CVE-2026-126355.md): Hono: \`csrf()\` does not check requests sent by hyperlink auditing (\`text/ping\`) (CVSS 5.3, honojs hono · hono)
- [CVE-2026-126354](https://cve.now/CVE-2026-126354.md): Addressable URI normalization resolves some dotted path segments to the wrong path (CVSS 4.8, sporkmonger addressable · addressable)
- [CVE-2026-126353](https://cve.now/CVE-2026-126353.md): Addressable: Regular Expression Denial of Service in Addressable templates with several exploded variables (CVSS 5.9, sporkmonger addressable)
- [CVE-2026-126352](https://cve.now/CVE-2026-126352.md): Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables (CVSS 5.9, sporkmonger addressable · addressable)
- [CVE-2026-126351](https://cve.now/CVE-2026-126351.md): Addressable: Denial of service in URI path normalization (CVSS 5.9, sporkmonger addressable · addressable)
- [CVE-2026-126350](https://cve.now/CVE-2026-126350.md): Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions (CVSS 5.9, sporkmonger addressable · addressable)
- [CVE-2026-126349](https://cve.now/CVE-2026-126349.md): Addressable display\_uri can show misleading hosts containing bidi and invisible characters (CVSS 3.1, sporkmonger addressable · addressable)
- [CVE-2026-126348](https://cve.now/CVE-2026-126348.md): Addressable display\_uri can show misleading hosts with invalid Punycode A-labels (CVSS 4.3, sporkmonger addressable · addressable)
- [CVE-2026-126347](https://cve.now/CVE-2026-126347.md): Tornado: Open redirect via triple-slash redirect paths (CVSS 3.1, tornadoweb tornado)
- [CVE-2026-126823](https://cve.now/CVE-2026-126823.md): Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared… (CVSS 7.3, MongoDB Atlas SQL JDBC Driver)
- [CVE-2026-127211](https://cve.now/CVE-2026-127211.md): MultiVendorX WordPress Plugin \< 5.0.22 Broken Access Control via stores REST Route (CVSS 7.1, MultiVendorX – WooCommerce Multivendor Marketplace AI Power…)
- [CVE-2026-126346](https://cve.now/CVE-2026-126346.md): basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF (CVSS 5.9, patrickjuchli basic-ftp · basic-ftp)
- [CVE-2026-126345](https://cve.now/CVE-2026-126345.md): basic-ftp: Uncaught TypeError in MLSD directory-listing parser via proto fact name causes DoS in Client.list() (CVSS 5.3, patrickjuchli basic-ftp · basic-ftp)
- [CVE-2026-126344](https://cve.now/CVE-2026-126344.md): @hono/node-server: WebSocket upgrade request-target starting with \`//\` replaces the host in \`c.req.url\`, bypassing \`Origin\` checks (CVSS 5.4, honojs node-server)
- [CVE-2026-126343](https://cve.now/CVE-2026-126343.md): @hono/node-server: Unhandled \`ECONNRESET\` on the socket during an asynchronous WebSocket upgrade crashes the process (CVSS 5.3, honojs node-server · @hono/node-server)
- [CVE-2026-126210](https://cve.now/CVE-2026-126210.md): @hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy (CVSS 5.3, honojs node-server · @hono/node-server)
- [CVE-2026-127209](https://cve.now/CVE-2026-127209.md): Xiaomi Mi Browser \< 14.66.0 Path Traversal via ThirdDocViewerActivity (CVSS 5.1, Xiaomi Mi Browser)
- [CVE-2026-91141](https://cve.now/CVE-2026-91141.md): CVE-2026-91141 (no CVSS, COVESA vSomeIp)
- [CVE-2026-126793](https://cve.now/CVE-2026-126793.md): Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper (CVSS 8.0, aws-advanced-go-wrapper)
- [CVE-2026-126209](https://cve.now/CVE-2026-126209.md): Loofah allowed\_uri? treats javascript&#x3a alert(1) as safe (CVSS 5.3, flavorjones loofah · loofah)
- [CVE-2026-126208](https://cve.now/CVE-2026-126208.md): Loofah: SVG \`\<textPath\>\` and \`\<mpath\>\` bypass local-reference restriction (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-127208](https://cve.now/CVE-2026-127208.md): datamodel-code-generator \< 0.84.0 Code Injection via x-python-type Annotation (CVSS 8.6, datamodel-code-generator)
- [CVE-2026-126207](https://cve.now/CVE-2026-126207.md): Loofah: CSS url() sanitization bypass via escaped parentheses (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-126206](https://cve.now/CVE-2026-126206.md): Loofah allowed\_uri? treats data:text&sol;html as safe text/plain (CVSS 5.3, flavorjones loofah · loofah)
- [CVE-2026-106018](https://cve.now/CVE-2026-106018.md): Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. (CVSS 8.7, Johnson Controls EasyIO FW)
- [CVE-2026-127207](https://cve.now/CVE-2026-127207.md): Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions (CVSS 5.3, Sendcloud for WooCommerce: Automated Shipping, Branded Trac…)
- [CVE-2026-127206](https://cve.now/CVE-2026-127206.md): Image CAPTCHA for Contact Form 7 and WPForms 3.3.29 CAPTCHA Bypass (CVSS 6.9, Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook)
- [CVE-2026-126205](https://cve.now/CVE-2026-126205.md): Loofah: Regular expression denial of service in the SVG local-reference check (CVSS 5.3, flavorjones loofah · loofah)
- [CVE-2026-86324](https://cve.now/CVE-2026-86324.md): Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-86323](https://cve.now/CVE-2026-86323.md): Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-86322](https://cve.now/CVE-2026-86322.md): Foreman: authorization flaw in the foreman::controller::useraware#find\_user handling used by api::v2::personalaccesstokenscontroller (CVSS 8.8, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-124015](https://cve.now/CVE-2026-124015.md): Dixell/Copeland XWEB EVO Authentication Bypass via users.lua (CVSS 8.2, Copeland XWEB EVO)
- [CVE-2026-124014](https://cve.now/CVE-2026-124014.md): Dixell/Copeland XWEB EVO Unauthenticated Configuration Write via config.lua (CVSS 8.8, Copeland XWEB EVO)
- [CVE-2026-47711](https://cve.now/CVE-2026-47711.md): BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life\_Safety\_Zone.accepted-modes on the default BACnet/IP server (CVSS 8.6, bacnet-stack)
- [CVE-2026-111456](https://cve.now/CVE-2026-111456.md): Candlepin: consumer certificate can register systems in another organization (CVSS 7.1, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-107443](https://cve.now/CVE-2026-107443.md): Foreman: foreman: api host template render discloses secrets to view\_hosts users (incomplete cve-2026-96659 fix) (CVSS 7.7, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-107360](https://cve.now/CVE-2026-107360.md): Red Hat Satellite allow-list bypass in safemode jail (CVSS 9.6, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-107152](https://cve.now/CVE-2026-107152.md): Rubygem-smart\_proxy\_dynflow: dynflow console authorizes any client certificate the capsule ca signed (CVSS 7.1, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +1)
- [CVE-2026-124013](https://cve.now/CVE-2026-124013.md): Dixell/Copeland XWEB EVO OS Command Injection via api.lua (CVSS 8.7, Copeland XWEB EVO)
- [CVE-2026-47710](https://cve.now/CVE-2026-47710.md): BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow (CVSS 8.2, bacnet-stack)
- [CVE-2026-47259](https://cve.now/CVE-2026-47259.md): BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding (CVSS 8.2, bacnet-stack)
- [CVE-2026-47258](https://cve.now/CVE-2026-47258.md): BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding (CVSS 8.2, bacnet-stack)
- [CVE-2026-47257](https://cve.now/CVE-2026-47257.md): BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success (CVSS 8.1, bacnet-stack)
- [CVE-2026-47217](https://cve.now/CVE-2026-47217.md): BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server (CVSS 7.5, bacnet-stack)
- [CVE-2026-46677](https://cve.now/CVE-2026-46677.md): BACnet Stack: Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData\[\] Mismatch (CVSS 6.5, bacnet-stack)
- [CVE-2026-124012](https://cve.now/CVE-2026-124012.md): Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass (CVSS 9.2, Copeland XWEB EVO)
- [CVE-2026-46676](https://cve.now/CVE-2026-46676.md): BACnet Stack: Uninitialized Value Use in AtomicReadFile-ACK Record-Access Encoder Causes Response Corruption and Conditional Information… (CVSS 5.3, bacnet-stack)
- [CVE-2026-46674](https://cve.now/CVE-2026-46674.md): BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount (CVSS 7.5, bacnet-stack)
- [CVE-2026-127120](https://cve.now/CVE-2026-127120.md): Governikus AusweisApp Mobile StartPAOSResponse cross site scripting (CVSS 5.3, Governikus AusweisApp Mobile)
- [CVE-2026-45341](https://cve.now/CVE-2026-45341.md): BACnet Stack: NULL pointer dereference in bacnet\_device\_object\_reference\_decode() when WriteProperty updates Structured View… (CVSS 7.5, bacnet-stack)
- [CVE-2026-45265](https://cve.now/CVE-2026-45265.md): Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack (CVSS 8.2, bacnet-stack)
- [CVE-2026-52786](https://cve.now/CVE-2026-52786.md): BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData() (CVSS 7.1, bacnet-stack)
- [CVE-2026-124011](https://cve.now/CVE-2026-124011.md): Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua (CVSS 6.9, Copeland XWEB EVO)
- [CVE-2026-124010](https://cve.now/CVE-2026-124010.md): Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi (CVSS 9.3, Copeland XWEB EVO)
- [CVE-2026-124009](https://cve.now/CVE-2026-124009.md): Dixell/Copeland XWEB EVO OS Command Injection via backup.lua (CVSS 8.6, Copeland XWEB EVO)
- [CVE-2026-124008](https://cve.now/CVE-2026-124008.md): Dixell/Copeland XWEB EVO OS Command Injection via devices.lua (CVSS 8.6, Copeland XWEB EVO)
- [CVE-2026-124007](https://cve.now/CVE-2026-124007.md): Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field (CVSS 9.2, Copeland XWEB EVO)
- [CVE-2026-124006](https://cve.now/CVE-2026-124006.md): Dixell/Copeland XWEB EVO Predictable Root Password Generation (CVSS 9.2, Copeland XWEB EVO)
- [CVE-2026-124005](https://cve.now/CVE-2026-124005.md): Dixell/Copeland XWEB EVO Predictable Administrator Password Generation (CVSS 9.2, Copeland XWEB EVO)
- [CVE-2026-124004](https://cve.now/CVE-2026-124004.md): Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password (CVSS 9.3, Copeland XWEB EVO)
- [CVE-2026-68548](https://cve.now/CVE-2026-68548.md): Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate (CVSS 9.4, xyproto algernon)
- [CVE-2026-124003](https://cve.now/CVE-2026-124003.md): Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection (CVSS 8.5, Copeland XWEB EVO)
- [CVE-2026-0455](https://cve.now/CVE-2026-0455.md): The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block… (CVSS 5.9, AMD Versal™ AI Edge Series Gen 2 Adaptive SoCs · AMD Ver… +1)
- [CVE-2026-124002](https://cve.now/CVE-2026-124002.md): Copeland XWEB EVO pre-auth command injection via username field (CVSS 9.3, Copeland XWEB EVO)
- [CVE-2026-0460](https://cve.now/CVE-2026-0460.md): Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt… (CVSS 1.0, AMD Bootgen)
- [CVE-2025-0043](https://cve.now/CVE-2025-0043.md): Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their… (CVSS 7.0, AMD Vivado Software)
- [CVE-2024-21963](https://cve.now/CVE-2024-21963.md): An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a… (CVSS 6.0, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 7002 Serie… +44)
- [CVE-2025-54507](https://cve.now/CVE-2025-54507.md): Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with… (CVSS 5.9, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2024-36344](https://cve.now/CVE-2024-36344.md): Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted… (CVSS 6.9, AMD EPYC™ 4004 Series Processors · AMD EPYC™ 9005 Serie… +45)
- [GHSA-7M8X-X364-M26J](https://cve.now/GHSA-7M8X-X364-M26J.md): Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients (medium (no CVSS), signalk-server)
- [CVE-2026-0101](https://cve.now/CVE-2026-0101.md): Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass… (CVSS 6.8, AMD EPYC™ 9005 Series Processors · AMD EPYC™ Embedded 9005…)
- [CVE-2026-0004](https://cve.now/CVE-2026-0004.md): A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on the system to infer… (CVSS 5.7, AMD EPYC™ 9005 Series Processors · AMD EPYC™ 8005 Serie… +17)
- [CVE-2025-54501](https://cve.now/CVE-2025-54501.md): Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially… (CVSS 5.9, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9005 Series… +2)
- [CVE-2024-21954](https://cve.now/CVE-2024-21954.md): Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation… (CVSS 7.0, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series… +2)
- [CVE-2026-0436](https://cve.now/CVE-2026-0436.md): Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver could allow an… (CVSS 6.9, AMD EPYC™ 9005 Series Processors · AMD Instinct™ MI300C +1)
- [CVE-2026-18379](https://cve.now/CVE-2026-18379.md): Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo (CVSS 8.8, Red Hat Enterprise Linux)
- [CVE-2026-127119](https://cve.now/CVE-2026-127119.md): Unverified ownership of the default EMR cluster log location in AWS SDK for pandas (CVSS 5.3, aws-sdk-pandas)
- [CVE-2026-126204](https://cve.now/CVE-2026-126204.md): express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still… (CVSS 3.7, express-rate-limit)
- [CVE-2026-126838](https://cve.now/CVE-2026-126838.md): Rust Driver public Client Debug output exposes CSFLE KMS master-key material (CVSS 5.7, MongoDB Rust Driver)
- [CVE-2026-120033](https://cve.now/CVE-2026-120033.md): FRRouting remote crash in bgpd via reachable assertion (CVSS 6.0, frrouting)
- [CVE-2026-117544](https://cve.now/CVE-2026-117544.md): jDownloads extension for Joomla remote file access via IDOR in other\_file\_id (CVSS 8.2, jdownloads.com jDownloads extension for Joomla)
- [CVE-2026-126203](https://cve.now/CVE-2026-126203.md): Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values (CVSS 6.1, flavorjones loofah · loofah)
- [CVE-2026-127235](https://cve.now/CVE-2026-127235.md): OpenNMS reflected cross-site scripting in the web UI via request parameters (CVSS 6.1, The OpenNMS Group Meridian · The OpenNMS Group Horizon)
- [CVE-2026-121619](https://cve.now/CVE-2026-121619.md): Symfony: The "private\_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse… (CVSS 6.3, sensiolabs symfony/framework-bundle · sensiolabs symfony/ht…)
- [CVE-2026-117542](https://cve.now/CVE-2026-117542.md): jDownloads extension for Joomla path traversal in update\_file handling (CVSS 5.1, jdownloads.com jDownloads extension for Joomla)
- [CVE-2026-127236](https://cve.now/CVE-2026-127236.md): OpenNMS argument injection in ad-hoc RRD graphs (CVSS 5.4, The OpenNMS Group Meridian · The OpenNMS Group Horizon)
- [CVE-2026-120467](https://cve.now/CVE-2026-120467.md): AcyMailing extension for Joomla and WordPress subscription tampering in mailing list component (CVSS 7.1, Datasolution AcyMailing extension for Joomla and WordPress)
- [CVE-2026-120468](https://cve.now/CVE-2026-120468.md): Datasolution AcyMailing Extension for Joomla information disclosure in mailing list data (CVSS 6.9, Datasolution AcyMailing extension for Joomla)
- [CVE-2026-117551](https://cve.now/CVE-2026-117551.md): jDownloads extension for Joomla remote code execution via frontend thumbnail upload (CVSS 10.0, jdownloads.com jDownloads extension for Joomla)
- [CVE-2026-120471](https://cve.now/CVE-2026-120471.md): Datasolution AcyMailing Extension for Joomla access control bypass in site modules (CVSS 6.9, Datasolution AcyMailing extension for Joomla)
- [CVE-2026-120470](https://cve.now/CVE-2026-120470.md): Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0… (CVSS 6.9, Datasolution AcyMailing extension for Joomla and WordPress)
- [CVE-2026-120466](https://cve.now/CVE-2026-120466.md): Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 (CVSS 8.8, Datasolution AcyMailing extension for Joomla and WordPress)
- [CVE-2026-120469](https://cve.now/CVE-2026-120469.md): Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 (CVSS 5.1, Datasolution AcyMailing extension for Joomla and WordPress)
- [CVE-2026-117550](https://cve.now/CVE-2026-117550.md): Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads \< 4.1.8 (CVSS 7.1, jdownloads.com jDownloads extension for Joomla)
- [CVE-2026-117543](https://cve.now/CVE-2026-117543.md): Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads \< 4.1.8 (CVSS 8.9, jdownloads.com jDownloads extension for Joomla)
- [CVE-2026-127101](https://cve.now/CVE-2026-127101.md): Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-127100](https://cve.now/CVE-2026-127100.md): Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-127099](https://cve.now/CVE-2026-127099.md): Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion (CVSS 5.9, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-118495](https://cve.now/CVE-2026-118495.md): Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 (CVSS 8.8, Datasolution AcyMailing extension for Joomla and WordPress)
- [CVE-2026-127063](https://cve.now/CVE-2026-127063.md): DataComm RMM+ auth bypass via default API secret (CVSS 9.3, DataComm RMM+)
- [CVE-2026-127204](https://cve.now/CVE-2026-127204.md): WooCommerce PayPal Pro Payment Gateway \< 4.1.1 Payment Bypass via pp\_capture\_order (CVSS 8.7, wp.insider Payment Gateway for PayPal Pro, PayPal Checkout…)
- [CVE-2026-106475](https://cve.now/CVE-2026-106475.md): Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials (CVSS 7.1, Grafana Elasticsearch Datasource · Grafana OSS +1)
- [CVE-2026-107365](https://cve.now/CVE-2026-107365.md): Unintended API access through the Google Cloud Monitoring data source resource proxy (CVSS 5.3, Grafana (built-in) Google Cloud Monitoring Datasource ·… +1)
- [CVE-2026-81843](https://cve.now/CVE-2026-81843.md): Memory exhaustion denial of service in Elasticsearch data source index patterns (CVSS 6.5, Grafana OSS · Grafana Elasticsearch Datasource +1)
- [CVE-2026-106472](https://cve.now/CVE-2026-106472.md): Server-side request forgery in the Prometheus data source resource API (CVSS 6.3, Grafana OSS · Grafana Enterprise +1)
- [CVE-2026-126199](https://cve.now/CVE-2026-126199.md): pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword (CVSS 6.8, pgedge-postgres-mcp)
- [CVE-2026-126198](https://cve.now/CVE-2026-126198.md): pgEdge Postgres MCP Server custom tools performed writes without user confirmation (CVSS 3.1, pgedge-postgres-mcp)
- [CVE-2026-126197](https://cve.now/CVE-2026-126197.md): pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters (CVSS 8.8, pgedge-postgres-mcp)
- [CVE-2026-119275](https://cve.now/CVE-2026-119275.md): Akaunting 3.3.0 - Stored XSS through imported invoice numbers (CVSS 7.0, Akaunting)
- [CVE-2026-126196](https://cve.now/CVE-2026-126196.md): pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query\_database (CVSS 8.1, pgedge-postgres-mcp)
- [CVE-2026-126831](https://cve.now/CVE-2026-126831.md): Cpio: cpio: stack-based buffer overflow in write\_out\_tar\_header() with long usernames/groupnames (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-124702](https://cve.now/CVE-2026-124702.md): URL Redirection to Untrusted Site in Progress Telerik UI for WPF (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2026-124700](https://cve.now/CVE-2026-124700.md): URL Redirection to Untrusted Site in Progress Telerik UI for WinForms (CVSS 7.8, Progress Software Telerik UI for WinForms)
- [CVE-2026-71363](https://cve.now/CVE-2026-71363.md): Awx: unauthenticated debug endpoints trigger scheduler operations (CVSS 5.3, Red Hat Ansible Automation Platform)
- [CVE-2026-106146](https://cve.now/CVE-2026-106146.md): Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing (CVSS 8.6, Progress Software Telerik UI for ASP.NET MVC)
- [CVE-2026-106154](https://cve.now/CVE-2026-106154.md): Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser (CVSS 8.6, Progress Software Telerik UI for ASP.NET Core)
- [CVE-2026-126193](https://cve.now/CVE-2026-126193.md): Soup Sieve: Uncontrolled recursion in Soup Sieve CSS parser lets nested pseudo-class selectors exhaust the Python call stack (CVSS 5.3, facelessuser soupsieve)
- [CVE-2026-124698](https://cve.now/CVE-2026-124698.md): Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip (CVSS 7.1, Progress Software Kendo UI for jQuery)
- [CVE-2026-126192](https://cve.now/CVE-2026-126192.md): Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time (CVSS 6.3, facelessuser soupsieve · soupsieve)
- [CVE-2026-124697](https://cve.now/CVE-2026-124697.md): Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip (CVSS 7.1, Progress Software Kendo UI for jQuery)
- [CVE-2026-126835](https://cve.now/CVE-2026-126835.md): \[Node.js Driver\] OIDC ENVIRONMENT confusion bypasses ALLOWED\_HOSTS and leaks human-callback bearer tokens (CVSS 5.9, MongoDB Node.js Driver)
- [CVE-2026-124696](https://cve.now/CVE-2026-124696.md): Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names (CVSS 7.1, Progress Software Kendo UI for jQuery)
- [CVE-2026-82977](https://cve.now/CVE-2026-82977.md): The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows… (CVSS 8.4, WebPros Plesk)
- [CVE-2026-126837](https://cve.now/CVE-2026-126837.md): Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV… (CVSS 9.1, MongoDB Node.js Driver)
- [CVE-2026-126191](https://cve.now/CVE-2026-126191.md): Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS\_ESCAPES/IDENTIFIER (CVSS 7.5, facelessuser soupsieve)
- [CVE-2026-121876](https://cve.now/CVE-2026-121876.md): Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers) (CVSS 7.9, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-126190](https://cve.now/CVE-2026-126190.md): Soup Sieve: Polynomial-time denial of service in the descendant combinator (CVSS 7.5, facelessuser soupsieve · soupsieve)
- [CVE-2026-126189](https://cve.now/CVE-2026-126189.md): Soup Sieve: Quadratic-time denial of service when matching \`:has()\` (CVSS 5.3, facelessuser soupsieve)
- [CVE-2026-124695](https://cve.now/CVE-2026-124695.md): Cross-Site Scripting in Kendo UI for jQuery Form Item Hints (CVSS 7.1, Progress Software Kendo UI for jQuery)
- [CVE-2026-127203](https://cve.now/CVE-2026-127203.md): AppFlowy Cloud 0.9.64 Stored XSS via Blob Upload Content-Type (CVSS 5.1, AppFlowy-IO AppFlowy-Cloud)
- [CVE-2026-124691](https://cve.now/CVE-2026-124691.md): Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown (CVSS 7.1, Progress Software Kendo UI for jQuery)
- [CVE-2026-127202](https://cve.now/CVE-2026-127202.md): MLflow \< 3.18.0 Path Traversal via model\_id in log\_outputs API (CVSS 6.3, mlflow)
- [CVE-2025-10698](https://cve.now/CVE-2025-10698.md): Improper File Permissions on Private Key Files in Docker Deployments (CVSS 6.0, OpenText Identity Console)
- [CVE-2026-16052](https://cve.now/CVE-2026-16052.md): Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel (CVSS 2.3, Python Software Foundation CPython)
- [CVE-2026-127030](https://cve.now/CVE-2026-127030.md): Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-127029](https://cve.now/CVE-2026-127029.md): Freeradius: stack-based buffer overflow via unbounded eap-sim identity length (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-127145](https://cve.now/CVE-2026-127145.md): SOGo before 5.12.13 SSRF via Web Calendar Subscriptions (CVSS 5.3, Alinto sogo)
- [CVE-2026-127141](https://cve.now/CVE-2026-127141.md): SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait (CVSS 7.1, Alinto sogo)
- [CVE-2026-127135](https://cve.now/CVE-2026-127135.md): SOGo before 5.12.13 Sieve Script Injection via Notification Address (CVSS 5.3, Alinto sogo)
- [CVE-2026-70642](https://cve.now/CVE-2026-70642.md): ToolJet \< 3.21.94 Authorization Bypass via app-environments/init (CVSS 5.3, ToolJet)
- [CVE-2026-127131](https://cve.now/CVE-2026-127131.md): SOGo before 5.12.13 Missing Rate Limiting on TOTP Verification (CVSS 9.1, Alinto sogo)
- [CVE-2026-127121](https://cve.now/CVE-2026-127121.md): SOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailView (CVSS 7.1, Alinto sogo)
- [CVE-2026-127111](https://cve.now/CVE-2026-127111.md): SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force (CVSS 9.1, Alinto sogo)
- [CVE-2026-126329](https://cve.now/CVE-2026-126329.md): Docker Sandboxes privilege escalation through untrusted state directories (CVSS 7.3, Docker Sandboxes)
- [CVE-2026-126330](https://cve.now/CVE-2026-126330.md): Docker Sandboxes restores removed automatically assigned port publications (CVSS 2.4, Docker Sandboxes)
- [CVE-2026-19809](https://cve.now/CVE-2026-19809.md): Kernel stack information disclosure in the charger\_get\_prop() system call handler (CVSS 3.3, zephyrproject zephyr)
- [CVE-2026-91007](https://cve.now/CVE-2026-91007.md): Arbitrary supervisor-mode function pointer injection via charger\_set\_prop() syscall in the charger driver API (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-127109](https://cve.now/CVE-2026-127109.md): CVE-2026-127109 (no CVSS, Promzard)
- [CVE-2026-123790](https://cve.now/CVE-2026-123790.md): Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution (no CVSS, ComfyUI-Easy-Use)
- [CVE-2026-126998](https://cve.now/CVE-2026-126998.md): JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery (CVSS 6.9, JeecgBoot)
- [CVE-2026-126997](https://cve.now/CVE-2026-126997.md): JeecgBoot server-side request forgery in flow-run endpoint (CVSS 6.9, JeecgBoot)
- [CVE-2026-6467](https://cve.now/CVE-2026-6467.md): PostgreSQL code execution as superuser in extension scripts (CVSS 7.2, PostgreSQL)
- [CVE-2026-6460](https://cve.now/CVE-2026-6460.md): PostgreSQL remote code execution in type handling during DDL (CVSS 8.8, PostgreSQL)
- [CVE-2026-18447](https://cve.now/CVE-2026-18447.md): PostgreSQL arbitrary code execution via SQL function type confusion (CVSS 8.8, PostgreSQL)
- [CVE-2026-16240](https://cve.now/CVE-2026-16240.md): PostgreSQL pg\_basebackup can use backup manifest content as a format string (CVSS 3.7, PostgreSQL)
- [CVE-2026-16237](https://cve.now/CVE-2026-16237.md): PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition (CVSS 5.4, PostgreSQL)
- [CVE-2026-14661](https://cve.now/CVE-2026-14661.md): PostgreSQL dblink and subscriptions can append to arbitrary files (CVSS 8.1, PostgreSQL)
- [CVE-2026-120154](https://cve.now/CVE-2026-120154.md): PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies (CVSS 4.3, PostgreSQL)
- [CVE-2026-120153](https://cve.now/CVE-2026-120153.md): PostgreSQL remote code execution in extension script substitutions (CVSS 7.2, PostgreSQL)
- [CVE-2026-120152](https://cve.now/CVE-2026-120152.md): PostgreSQL pg\_show\_all\_settings() use-after-free discloses memory (CVSS 4.3, PostgreSQL)
- [CVE-2026-120151](https://cve.now/CVE-2026-120151.md): PostgreSQL remote code execution in plpgsql record assignment (CVSS 8.8, PostgreSQL)
- [CVE-2026-120150](https://cve.now/CVE-2026-120150.md): PostgreSQL expanded-record domain-check use-after-free executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-120149](https://cve.now/CVE-2026-120149.md): PostgreSQL FDW batch-insert mismatch executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-120148](https://cve.now/CVE-2026-120148.md): PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code (CVSS 8.1, PostgreSQL)
- [CVE-2026-120147](https://cve.now/CVE-2026-120147.md): PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-120146](https://cve.now/CVE-2026-120146.md): PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks (CVSS 4.3, PostgreSQL)
- [CVE-2026-120145](https://cve.now/CVE-2026-120145.md): PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-120144](https://cve.now/CVE-2026-120144.md): PostgreSQL arbitrary code execution in type-cache invalidation (CVSS 8.8, PostgreSQL)
- [CVE-2026-120143](https://cve.now/CVE-2026-120143.md): PostgreSQL code execution via use-after-free in trigger functions (CVSS 8.8, PostgreSQL)
- [CVE-2026-120142](https://cve.now/CVE-2026-120142.md): PostgreSQL arbitrary code execution in anonymous RECORD types (CVSS 8.8, PostgreSQL)
- [CVE-2026-120141](https://cve.now/CVE-2026-120141.md): PostgreSQL arbitrary code execution in set-returning functions (CVSS 8.8, PostgreSQL)
- [CVE-2026-120139](https://cve.now/CVE-2026-120139.md): PostgreSQL code execution via integer overflow in tuple sizing (CVSS 8.8, PostgreSQL)
- [CVE-2026-116336](https://cve.now/CVE-2026-116336.md): PostgreSQL arbitrary code execution in REINDEX CONCURRENTLY (CVSS 8.8, PostgreSQL)
- [CVE-2026-116335](https://cve.now/CVE-2026-116335.md): PostgreSQL code execution in operator commutator and negator links (CVSS 8.8, PostgreSQL)
- [CVE-2026-116333](https://cve.now/CVE-2026-116333.md): PostgreSQL parallel B-tree array scan reads beyond array bounds (CVSS 6.5, PostgreSQL)
- [CVE-2026-116332](https://cve.now/CVE-2026-116332.md): PostgreSQL code execution via use-after-free in portal setup (CVSS 8.8, PostgreSQL)
- [CVE-2026-116331](https://cve.now/CVE-2026-116331.md): PostgreSQL code execution in min/max aggregate optimization (CVSS 8.8, PostgreSQL)
- [CVE-2026-126996](https://cve.now/CVE-2026-126996.md): SakanaAI text-to-LoRA Checkpoint Loading model\_loading.py get\_tokenizer path traversal (CVSS 5.3, SakanaAI text-to-LoRA)
- [CVE-2026-116330](https://cve.now/CVE-2026-116330.md): PostgreSQL pg\_dump tar restore.sql fails to block psql command injection (CVSS 8.8, PostgreSQL)
- [CVE-2026-116329](https://cve.now/CVE-2026-116329.md): PostgreSQL statistics import type confusion executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-116328](https://cve.now/CVE-2026-116328.md): PostgreSQL generation memory context integer wraparound executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-116327](https://cve.now/CVE-2026-116327.md): PostgreSQL security\_barrier analysis can expose hidden values through indirect expressions (CVSS 4.3, PostgreSQL)
- [CVE-2026-116326](https://cve.now/CVE-2026-116326.md): PostgreSQL plperl tied-object exceptions follow stale sigjmp\_buf (CVSS 8.8, PostgreSQL)
- [CVE-2026-116325](https://cve.now/CVE-2026-116325.md): PostgreSQL reindexdb index name quoting allows SQL injection (CVSS 8.0, PostgreSQL)
- [CVE-2026-116323](https://cve.now/CVE-2026-116323.md): PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-116322](https://cve.now/CVE-2026-116322.md): PostgreSQL pre-authentication cancel request can leak a spinlock (CVSS 5.3, PostgreSQL)
- [CVE-2026-116321](https://cve.now/CVE-2026-116321.md): PostgreSQL unterminated name value discloses server memory (CVSS 4.3, PostgreSQL)
- [CVE-2026-116320](https://cve.now/CVE-2026-116320.md): PostgreSQL code execution via use-after-free in plperl (CVSS 8.8, PostgreSQL)
- [CVE-2026-116319](https://cve.now/CVE-2026-116319.md): PostgreSQL use-after-free leads to code execution in plperl (CVSS 8.8, PostgreSQL)
- [CVE-2026-116318](https://cve.now/CVE-2026-116318.md): PostgreSQL SQL injection in pg\_dump not-null constraint names (CVSS 8.8, PostgreSQL)
- [CVE-2026-116317](https://cve.now/CVE-2026-116317.md): PostgreSQL code execution via ts\_rank\_cd() heap overflow (CVSS 8.8, PostgreSQL)
- [CVE-2026-116316](https://cve.now/CVE-2026-116316.md): PostgreSQL arbitrary SQL execution via pg\_temp type planting (CVSS 8.8, PostgreSQL)
- [CVE-2026-116315](https://cve.now/CVE-2026-116315.md): PostgreSQL arbitrary code execution in tsvector\_delete() (CVSS 8.8, PostgreSQL)
- [CVE-2026-116314](https://cve.now/CVE-2026-116314.md): PostgreSQL arbitrary code execution in pg\_restore (CVSS 8.8, PostgreSQL)
- [CVE-2026-116313](https://cve.now/CVE-2026-116313.md): PostgreSQL code execution in vacuumdb via untrusted search path (CVSS 7.2, PostgreSQL)
- [CVE-2026-116312](https://cve.now/CVE-2026-116312.md): PostgreSQL MERGE can place the wrong row in a trigger transition table (CVSS 5.4, PostgreSQL)
- [CVE-2026-116311](https://cve.now/CVE-2026-116311.md): PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables (CVSS 5.4, PostgreSQL)
- [CVE-2026-116310](https://cve.now/CVE-2026-116310.md): PostgreSQL COPY error context uses freed field storage (CVSS 4.3, PostgreSQL)
- [CVE-2026-116309](https://cve.now/CVE-2026-116309.md): PostgreSQL type confusion enables code execution in plperl (CVSS 8.8, PostgreSQL)
- [CVE-2026-116308](https://cve.now/CVE-2026-116308.md): PostgreSQL dict\_int reads beyond zero-length tokens (CVSS 4.3, PostgreSQL)
- [CVE-2026-116307](https://cve.now/CVE-2026-116307.md): PostgreSQL authenticated remote code execution in plperl (CVSS 8.8, PostgreSQL)
- [CVE-2026-116306](https://cve.now/CVE-2026-116306.md): PostgreSQL arbitrary code execution in composite-type field assignment (CVSS 8.8, PostgreSQL)
- [CVE-2026-116304](https://cve.now/CVE-2026-116304.md): PostgreSQL arbitrary code execution in parallel RECORD type handling (CVSS 8.8, PostgreSQL)
- [CVE-2026-116303](https://cve.now/CVE-2026-116303.md): PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions (CVSS 3.1, PostgreSQL)
- [CVE-2026-71367](https://cve.now/CVE-2026-71367.md): Awx: websocket broadcast groups leak cross-organization job metadata (CVSS 4.3, Red Hat Ansible Automation Platform)
- [CVE-2026-120869](https://cve.now/CVE-2026-120869.md): An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance (CVSS 9.3, Citrix NetScaler Console)
- [CVE-2026-123039](https://cve.now/CVE-2026-123039.md): Check Point local privilege escalation to root in DynamicCLI daemon (CVSS 7.8, checkpoint Quantum Security Gateway · checkpoint Quantum Se…)
- [CVE-2026-120490](https://cve.now/CVE-2026-120490.md): Check Point Scalable Platforms sync protection bypass in NAT rules (CVSS 3.8, checkpoint Scalable Platforms)
- [CVE-2026-107484](https://cve.now/CVE-2026-107484.md): Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user (CVSS 7.3, checkpoint Quantum Security Gateway · checkpoint Quantum Se…)
- [CVE-2026-126995](https://cve.now/CVE-2026-126995.md): tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal (CVSS 5.3, tjake Jlama)
- [CVE-2026-92083](https://cve.now/CVE-2026-92083.md): Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer (CVSS 7.8, TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pa…)
- [CVE-2026-124018](https://cve.now/CVE-2026-124018.md): Gutenverse Form WordPress Plugin \< 3.2.2 CSV Formula Injection via Form Submission (CVSS 5.3, Jegstudio Gutenverse Form – Contact Form Builder, Block For…)
- [CVE-2026-124628](https://cve.now/CVE-2026-124628.md): In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that… (CVSS 8.7, Octopus Deploy Octopus Server)
- [CVE-2026-124627](https://cve.now/CVE-2026-124627.md): In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in… (CVSS 8.7, Octopus Deploy Octopus Server)
- [CVE-2026-116835](https://cve.now/CVE-2026-116835.md): In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit… (CVSS 8.7, Octopus Deploy Octopus Server)
- [CVE-2026-114467](https://cve.now/CVE-2026-114467.md): Out-of-bounds Write in Git (CVSS 3.3, Git)
- [CVE-2026-114466](https://cve.now/CVE-2026-114466.md): Insufficient Granularity of Access Control in Git (CVSS 4.4, Git)
- [CVE-2026-114469](https://cve.now/CVE-2026-114469.md): Out-of-bounds Read in Git (CVSS 4.4, Git)
- [CVE-2026-127058](https://cve.now/CVE-2026-127058.md): WonderCMS before 3.7.0 Unverified Password Change via saveAction (CVSS 6.9, wondercms)
- [CVE-2026-97845](https://cve.now/CVE-2026-97845.md): Uncontrolled recursion vulnerability in QXmlSimpleReader XML parsing impacts Qt (CVSS 4.3, qt)
- [CVE-2026-125285](https://cve.now/CVE-2026-125285.md): TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability (CVSS 8.8, TIBCO Platform’s Self-Hosted Control Plane)
- [CVE-2026-125870](https://cve.now/CVE-2026-125870.md): BookStack before 26.09.3 Broken Access Control via ImageController (CVSS 2.3, bookstackapp bookstack)
- [CVE-2026-75869](https://cve.now/CVE-2026-75869.md): Authenticated command injection (CVSS 8.8, Zohocorp DDI Central)
- [CVE-2026-127056](https://cve.now/CVE-2026-127056.md): PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan (CVSS 8.7, mholt PapaParse)
- [CVE-2026-111552](https://cve.now/CVE-2026-111552.md): Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure (CVSS 7.1, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure)
- [CVE-2026-75868](https://cve.now/CVE-2026-75868.md): Broken Access Control (CVSS 8.1, Zohocorp DDI Central)
- [CVE-2026-126994](https://cve.now/CVE-2026-126994.md): braindecode Model Config Deserialization util.py resolve\_type\_kwargs externally-controlled input to select classes or code (CVSS 5.3, braindecode)
- [CVE-2026-110951](https://cve.now/CVE-2026-110951.md): Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure (CVSS 7.5, Hyper Teknoloji Ltd. Şti. Hyper E-Commerce Infrastructure)
- [CVE-2026-75867](https://cve.now/CVE-2026-75867.md): Broken Access Control (CVSS 8.1, Zohocorp DDI Central)
- [CVE-2026-127050](https://cve.now/CVE-2026-127050.md): Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback (CVSS 7.1, inisev Backup Migration)
- [CVE-2026-123139](https://cve.now/CVE-2026-123139.md): Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser… (CVSS 5.8, Opera Neon)
- [CVE-2026-75864](https://cve.now/CVE-2026-75864.md): Broken Access Control (CVSS 8.1, Zohocorp DDI Central)
- [CVE-2026-19422](https://cve.now/CVE-2026-19422.md): Authentication Bypass (CVSS 9.1, Zohocorp DDI Central)
- [CVE-2026-126993](https://cve.now/CVE-2026-126993.md): SiteServer SSCMS captcha inadequate encryption (CVSS 6.9, SiteServer SSCMS)
- [CVE-2026-19421](https://cve.now/CVE-2026-19421.md): Authenticated Injection (CVSS 8.8, Zohocorp DDI Central)
- [CVE-2026-127046](https://cve.now/CVE-2026-127046.md): MISP Modules Website Exposes External Tool API Keys in /external\_tools/list Response (CVSS 9.2, misp-modules)
- [RUSTSEC-2026-0501](https://cve.now/RUSTSEC-2026-0501.md): Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key (no CVSS, bsv-rs)
- [RUSTSEC-2026-0528](https://cve.now/RUSTSEC-2026-0528.md): Ref Swap use-after-free in swap types reachable from safe code (no CVSS, ref-swap)
- [RUSTSEC-2026-0533](https://cve.now/RUSTSEC-2026-0533.md): ammonia cross-site scripting in HTML sanitizer via SVG and MathML (no CVSS, ammonia)
- [CVE-2026-124705](https://cve.now/CVE-2026-124705.md): URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI (CVSS 7.8, Progress Software Telerik UI for .NET MAUI)
- [CVE-2026-127036](https://cve.now/CVE-2026-127036.md): ibi WebFOCUS - OS Command Injection Vulnerability (CVSS 8.6, ibi WebFOCUS)
- [CVE-2026-13764](https://cve.now/CVE-2026-13764.md): Masterstudy - Education WordPress Theme \<= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, StylemixThemes Masterstudy - Education WordPress Theme)
- [CVE-2026-16135](https://cve.now/CVE-2026-16135.md): VibeBP \<= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set\_email\_notification\_settings() (CVSS 8.8, VibeThemes VibeBP)
- [CVE-2026-2982](https://cve.now/CVE-2026-2982.md): WP Table Builder – Drag & Drop Table Builder \<= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' (CVSS 5.4, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2026-15309](https://cve.now/CVE-2026-15309.md): CourseCure Courses \<= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax\_save\_settings' Endpoint (CVSS 8.8, WishList Member CourseCure Courses)
- [CVE-2026-114369](https://cve.now/CVE-2026-114369.md): Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket… (CVSS 2.7, Qt Framework)
- [CVE-2026-124704](https://cve.now/CVE-2026-124704.md): Deserialization of Untrusted Data in Progress Telerik UI for WPF (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2026-124703](https://cve.now/CVE-2026-124703.md): Improper Control of Generation of Code in Progress Telerik UI for WPF (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2026-126644](https://cve.now/CVE-2026-126644.md): Ansible.posix: authorized\_key module follows a parent-directory symlink allowing writes outside the intended directory (CVSS 3.9, Red Hat Enterprise Linux)
- [CVE-2026-126643](https://cve.now/CVE-2026-126643.md): Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource (CVSS 6.5, Red Hat Ansible Automation Platform)
- [CVE-2026-126641](https://cve.now/CVE-2026-126641.md): Ansible-pylibssh: accepts a changed ssh host key when host\_key\_auto\_add is enabled (CVSS 6.5, Red Hat Ansible Automation Platform)
- [CVE-2026-124701](https://cve.now/CVE-2026-124701.md): Deserialization of Untrusted Data in Progress Telerik UI for WinForms (CVSS 7.8, Progress Software Telerik UI for WinForms)
- [CVE-2026-124023](https://cve.now/CVE-2026-124023.md): Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper (low (no CVSS), Apache Software Foundation Apache Axis2/C)
- [CVE-2026-123765](https://cve.now/CVE-2026-123765.md): Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls. (low (no CVSS), Apache Software Foundation org.apache.sling:org.apache.slin…)
- [CVE-2026-124699](https://cve.now/CVE-2026-124699.md): Improper Control of Generation of Code in Progress Telerik UI for WinForms (CVSS 7.8, Progress Software Telerik UI for WinForms)
- [CVE-2026-118975](https://cve.now/CVE-2026-118975.md): XML External Entity (XXE) Injection in Telerik Reporting SVG Processing (CVSS 6.5, Progress Software Telerik Reporting)
- [CVE-2026-127016](https://cve.now/CVE-2026-127016.md): MISP Modules Website: Missing Authorization on External Tool Management Endpoints (CVSS 9.2, misp-modules)
- [CVE-2026-106140](https://cve.now/CVE-2026-106140.md): Deserialization of Untrusted Data in Telerik Reporting Report Designers (CVSS 7.3, Progress Software Telerik Reporting)
- [CVE-2026-76173](https://cve.now/CVE-2026-76173.md): SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft (CVSS 8.8, Sgestion / EasySoft WhatsApp for Dolibarr)
- [CVE-2026-90908](https://cve.now/CVE-2026-90908.md): Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator (CVSS 9.3, Azul Payara Payara Server · Azul Payara Payara Micro)
- [CVE-2026-110003](https://cve.now/CVE-2026-110003.md): Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution (CVSS 9.3, Azul Payara Payara Server)
- [CVE-2026-126642](https://cve.now/CVE-2026-126642.md): Awx: webhook credential assignment omits use\_role check, exposing another user's token (CVSS 6.5, Red Hat Ansible Automation Platform)
- [CVE-2026-47832](https://cve.now/CVE-2026-47832.md): OpenStack Application Credentials Logged in Cleartext to BOSH Debug Logs (CVSS 7.3, CloudFoundry Foundation bosh-openstack-cpi-release)
- [CVE-2026-40820](https://cve.now/CVE-2026-40820.md): Authenticated SQLi in getVpnData function (CVSS 6.9, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-125836](https://cve.now/CVE-2026-125836.md): WordPress Simple JWT Login plugin \<= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Nicu Micle Simple JWT Login)
- [CVE-2026-126991](https://cve.now/CVE-2026-126991.md): SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input (CVSS 5.3, misp-modules)
- [CVE-2026-118855](https://cve.now/CVE-2026-118855.md): Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status (CVSS 7.0, Akaunting)
- [CVE-2026-82292](https://cve.now/CVE-2026-82292.md): NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt (CVSS 1.9, qt)
- [CVE-2026-113408](https://cve.now/CVE-2026-113408.md): Git path traversal lets attackers write files in repo cloning (CVSS 3.3, Git)
- [CVE-2026-12591](https://cve.now/CVE-2026-12591.md): Privilege Escalation (CVSS 9.9, Zohocorp M365 Manager Plus)
- [CVE-2026-12507](https://cve.now/CVE-2026-12507.md): Authenticated remote code execution (CVSS 9.1, Zohocorp AssetExplorer · Zohocorp ServiceDesk Plus +1)
- [CVE-2026-87772](https://cve.now/CVE-2026-87772.md): Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About (CVSS 7.8, TÜBİTAK BİLGEM Software Technologies Research Institute Par…)
- [CVE-2026-8331](https://cve.now/CVE-2026-8331.md): TimePictra ermote code execution via file upload (CVSS 8.8, Microchip TimePictra)
- [CVE-2026-8332](https://cve.now/CVE-2026-8332.md): TimePictra root password hardcoded in installation files (CVSS 8.8, Microchip TimePictra)
- [CVE-2026-8333](https://cve.now/CVE-2026-8333.md): TimePictra Stored Cross-site Scripting (CVSS 9.4, Microchip TimePictra)
- [CVE-2026-118597](https://cve.now/CVE-2026-118597.md): Akaunting 3.3.0 - Stored XSS in custom invoice payment terms (CVSS 7.2, Akaunting)
- [CVE-2026-76792](https://cve.now/CVE-2026-76792.md): User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification (CVSS 8.1, User Verification by PickPlugins)
- [CVE-2026-124817](https://cve.now/CVE-2026-124817.md): Clockinator Lite \< 1.1.0 - Unauthenticated Leave Record Modification (CVSS 5.3, Clockinator Lite)
- [CVE-2026-124815](https://cve.now/CVE-2026-124815.md): Clockinator Lite \< 1.1.0 - Unauthenticated SQLi via Record Deletion Actions (CVSS 10.0, Clockinator Lite)
- [CVE-2026-124814](https://cve.now/CVE-2026-124814.md): Ultimate Addons for Elementor Forms \< 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter (CVSS 9.8, Ultimate Addons for Elementor Forms)
- [CVE-2026-124665](https://cve.now/CVE-2026-124665.md): Order Tracking \< 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR (CVSS 5.3, Order Tracking)
- [CVE-2026-124653](https://cve.now/CVE-2026-124653.md): Mine CloudVod \< 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure (CVSS 6.5, Mine CloudVod)
- [CVE-2026-124652](https://cve.now/CVE-2026-124652.md): Mine CloudVod \< 2.6.6 - Subscriber+ Order Information Disclosure via IDOR (CVSS 4.3, Mine CloudVod)
- [CVE-2026-124648](https://cve.now/CVE-2026-124648.md): TI WooCommerce Wishlist \< 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key (CVSS 5.3, TI WooCommerce Wishlist)
- [CVE-2026-124647](https://cve.now/CVE-2026-124647.md): TI WooCommerce Wishlist \< 2.0.7 - Unauthenticated SQLi via tinv\_wishlistkey Cookie (CVSS 8.6, TI WooCommerce Wishlist)
- [CVE-2026-123092](https://cve.now/CVE-2026-123092.md): WP Remote Users Sync \< 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action (CVSS 7.5, WP Remote Users Sync)
- [CVE-2026-123044](https://cve.now/CVE-2026-123044.md): ContentPen \< 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure (CVSS 7.5, ContentPen)
- [CVE-2026-122003](https://cve.now/CVE-2026-122003.md): Abilities Bridge \< 1.4.2 - Administrator Account Creation via CSRF (CVSS 8.8, Abilities Bridge)
- [CVE-2026-121498](https://cve.now/CVE-2026-121498.md): Askany \< 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR (CVSS 4.8, AskAny)
- [CVE-2026-119040](https://cve.now/CVE-2026-119040.md): Defender Security \< 6.4.1 - 2FA Bypass via Unthrottled OTP Verification (CVSS 7.5, Defender Security)
- [CVE-2026-119039](https://cve.now/CVE-2026-119039.md): Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detection (CVSS 5.3, Defender Security)
- [CVE-2026-118531](https://cve.now/CVE-2026-118531.md): Directorist \< 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update (CVSS 3.1, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-118421](https://cve.now/CVE-2026-118421.md): WP Directory Kit \< 1.6.3 - Listing Admin+ SQL Injection via 'order\_by' Parameter (CVSS 6.8, WP Directory Kit)
- [CVE-2026-110959](https://cve.now/CVE-2026-110959.md): Descope \< 1.2.0 - Unauthenticated Account Takeover (CVSS 9.8, Descope)
- [CVE-2026-110072](https://cve.now/CVE-2026-110072.md): Photo Gallery by 10Web \< 1.8.49 - Contributor+ Stored XSS via watermark\_url Shortcode Attribute (CVSS 6.8, Photo Gallery by 10Web)
- [CVE-2026-110041](https://cve.now/CVE-2026-110041.md): Crop-Thumbnails \< 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints (CVSS 3.8, Crop Thumbnails)
- [CVE-2026-106027](https://cve.now/CVE-2026-106027.md): Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion via EveryPay Status Callback (CVSS 5.3, Oxygen MyData for WooCommerce)
- [CVE-2026-101107](https://cve.now/CVE-2026-101107.md): An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. (CVSS 8.0, SoftBank Air Terminal)
- [CVE-2026-111436](https://cve.now/CVE-2026-111436.md): Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux. (CVSS 4.4, openEuler iSulad)
- [CVE-2026-111435](https://cve.now/CVE-2026-111435.md): Relative path traversal vulnerability in openEuler iSulad on Linux. (CVSS 7.4, openEuler iSulad)
- [CVE-2026-111434](https://cve.now/CVE-2026-111434.md): Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux. (CVSS 5.6, openEuler iSulad)
- [CVE-2026-111433](https://cve.now/CVE-2026-111433.md): UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. (CVSS 8.6, openEuler iSulad)
- [CVE-2026-76954](https://cve.now/CVE-2026-76954.md): An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM)… (CVSS 9.8, Synology DiskStation Manager)
- [CVE-2026-85101](https://cve.now/CVE-2026-85101.md): An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before… (CVSS 8.6, Synology DiskStation Manager)
- [CVE-2026-88266](https://cve.now/CVE-2026-88266.md): An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before… (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-81559](https://cve.now/CVE-2026-81559.md): A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-81558](https://cve.now/CVE-2026-81558.md): A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1… (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-77738](https://cve.now/CVE-2026-77738.md): A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-74850](https://cve.now/CVE-2026-74850.md): An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM)… (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-19414](https://cve.now/CVE-2026-19414.md): A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1… (CVSS 4.3, Synology DiskStation Manager)
- [CVE-2026-85098](https://cve.now/CVE-2026-85098.md): A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows… (CVSS 5.3, Synology DiskStation Manager)
- [CVE-2026-124993](https://cve.now/CVE-2026-124993.md): An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 5.3, Synology DiskStation Manager)
- [CVE-2026-92379](https://cve.now/CVE-2026-92379.md): An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM)… (CVSS 5.4, Synology DiskStation Manager)
- [CVE-2026-81557](https://cve.now/CVE-2026-81557.md): An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before… (CVSS 5.4, Synology DiskStation Manager)
- [CVE-2026-19833](https://cve.now/CVE-2026-19833.md): A missing authorization vulnerability in the ACL API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows… (CVSS 5.4, Synology DiskStation Manager)
- [CVE-2026-13656](https://cve.now/CVE-2026-13656.md): An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM)… (CVSS 5.4, Synology DiskStation Manager)
- [CVE-2026-15201](https://cve.now/CVE-2026-15201.md): An improper certificate validation vulnerability in the Support Form in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 5.9, Synology DiskStation Manager)
- [CVE-2026-87801](https://cve.now/CVE-2026-87801.md): An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before… (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2026-16550](https://cve.now/CVE-2026-16550.md): An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2026-15198](https://cve.now/CVE-2026-15198.md): A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before… (CVSS 6.5, Synology DiskStation Manager)
- [CVE-2026-86343](https://cve.now/CVE-2026-86343.md): An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 6.8, Synology DiskStation Manager)
- [CVE-2026-75785](https://cve.now/CVE-2026-75785.md): An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM)… (CVSS 7.2, Synology DiskStation Manager)
- [CVE-2026-18633](https://cve.now/CVE-2026-18633.md): An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1… (CVSS 7.5, Synology DiskStation Manager)
- [CVE-2026-81584](https://cve.now/CVE-2026-81584.md): An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM)… (CVSS 8.1, Synology DiskStation Manager)
- [CVE-2026-19048](https://cve.now/CVE-2026-19048.md): An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 8.1, Synology DiskStation Manager)
- [CVE-2026-18596](https://cve.now/CVE-2026-18596.md): An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before… (CVSS 8.1, Synology DiskStation Manager)
- [CVE-2026-74857](https://cve.now/CVE-2026-74857.md): A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and… (CVSS 8.8, Synology DiskStation Manager)
- [CVE-2026-18792](https://cve.now/CVE-2026-18792.md): An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM)… (CVSS 8.8, Synology DiskStation Manager)
- [CVE-2026-13672](https://cve.now/CVE-2026-13672.md): An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before… (CVSS 8.8, Synology DiskStation Manager)
- [CVE-2026-117687](https://cve.now/CVE-2026-117687.md): Movable Type provided by Six Apart Ltd. (CVSS 7.3, Six Apart Movable Type)
- [CVE-2026-114556](https://cve.now/CVE-2026-114556.md): MailEnable Save Directory Traversal Arbitrary File Creation Vulnerability (CVSS 7.4, MailEnable)
- [CVE-2026-114558](https://cve.now/CVE-2026-114558.md): OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114568](https://cve.now/CVE-2026-114568.md): OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114567](https://cve.now/CVE-2026-114567.md): OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114566](https://cve.now/CVE-2026-114566.md): OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114565](https://cve.now/CVE-2026-114565.md): OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114564](https://cve.now/CVE-2026-114564.md): OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114563](https://cve.now/CVE-2026-114563.md): OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114562](https://cve.now/CVE-2026-114562.md): OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114561](https://cve.now/CVE-2026-114561.md): OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114560](https://cve.now/CVE-2026-114560.md): OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114559](https://cve.now/CVE-2026-114559.md): OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-114569](https://cve.now/CVE-2026-114569.md): OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-122044](https://cve.now/CVE-2026-122044.md): Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability (CVSS 8.8, Philips Hue Bridge Pro)
- [CVE-2026-118632](https://cve.now/CVE-2026-118632.md): Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability (CVSS 8.0, Philips Hue Bridge Pro)
- [CVE-2026-118631](https://cve.now/CVE-2026-118631.md): Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability (CVSS 3.8, Philips Hue Bridge Pro)
- [CVE-2026-121753](https://cve.now/CVE-2026-121753.md): Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2026-121752](https://cve.now/CVE-2026-121752.md): Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2026-121744](https://cve.now/CVE-2026-121744.md): Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2026-121743](https://cve.now/CVE-2026-121743.md): Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2026-121742](https://cve.now/CVE-2026-121742.md): Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2026-13269](https://cve.now/CVE-2026-13269.md): Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability (CVSS 7.5, Quest NetVault Backup)
- [CVE-2026-13270](https://cve.now/CVE-2026-13270.md): Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability (CVSS 7.5, Quest NetVault Backup)
- [CVE-2026-121741](https://cve.now/CVE-2026-121741.md): Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Trimble SketchUp)
- [CVE-2025-10935](https://cve.now/CVE-2025-10935.md): libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, libilbm)
- [CVE-2026-126957](https://cve.now/CVE-2026-126957.md): ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c (CVSS 5.3, zephyrproject-rtos Zephyr)
- [CVE-2026-126795](https://cve.now/CVE-2026-126795.md): ToolJet Onboarding Signup Endpoint util.service.ts activateUserWithPassword missing authentication (CVSS 6.9, ToolJet)
- [CVE-2026-126673](https://cve.now/CVE-2026-126673.md): Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in \_dump\_qr (no CVSS, Data-Dump-Streamer)
- [CVE-2026-126785](https://cve.now/CVE-2026-126785.md): rmalright TR-VISION HOME IOCTL WFanManager.sys sub\_11504 default permission (CVSS 9.3, rmalright TR-VISION HOME)
- [CVE-2026-125785](https://cve.now/CVE-2026-125785.md): WordPress JetEngine plugin \<= 3.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2026-125786](https://cve.now/CVE-2026-125786.md): WordPress Quiz And Survey Master plugin \<= 11.3.0 - Content Injection vulnerability (CVSS 5.3, ExpressTech Quiz And Survey Master)
- [CVE-2026-125787](https://cve.now/CVE-2026-125787.md): WordPress Quiz And Survey Master plugin \<= 11.3.0 - Broken Access Control vulnerability (CVSS 5.4, ExpressTech Quiz And Survey Master)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-11-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.