# CVEs published 2026-05-08

424 CVEs were published on May 8, 2026: 54 critical, 137 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-42455](https://cve.now/CVE-2026-42455.md): LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) (CVSS 8.8, linkwarden)
- [CVE-2026-44313](https://cve.now/CVE-2026-44313.md): LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function (CVSS 9.1, linkwarden)
- [CVE-2026-42456](https://cve.now/CVE-2026-42456.md): AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) (CVSS 4.3, Mintplex-Labs anything-llm)
- [CVE-2026-42354](https://cve.now/CVE-2026-42354.md): Sentry: Improper authentication on SAML SSO process allows user identity linking (CVSS 9.1, getsentry sentry · sentry)
- [CVE-2026-42454](https://cve.now/CVE-2026-42454.md): Termix: OS Command Injection in Docker Container Management Endpoints (CVSS 9.9, Termix-SSH Termix)
- [CVE-2026-42453](https://cve.now/CVE-2026-42453.md): Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass (CVSS 8.7, Termix-SSH Termix)
- [CVE-2026-42452](https://cve.now/CVE-2026-42452.md): Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP (CVSS 8.1, Termix-SSH Termix)
- [CVE-2026-42451](https://cve.now/CVE-2026-42451.md): Grimmory: Stored XSS via Malicious EPUB Enables Session Token Theft (CVSS 6.3, grimmory-tools grimmory)
- [CVE-2026-41682](https://cve.now/CVE-2026-41682.md): pupnp: Port truncation via atoi() cast in parse\_uri() allows SSRF port confusion (CVSS 6.9, pupnp)
- [CVE-2026-45130](https://cve.now/CVE-2026-45130.md): Vim: Heap Buffer Overflow in spell file loading (CVSS 6.6, vim)
- [CVE-2026-44656](https://cve.now/CVE-2026-44656.md): Vim: OS Command Injection via 'path' completion (CVSS 4.6, vim)
- [CVE-2026-42307](https://cve.now/CVE-2026-42307.md): Vim: OS Command Injection in netrw (CVSS 4.4, vim)
- [CVE-2026-42350](https://cve.now/CVE-2026-42350.md): Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter (CVSS 5.1, akuity kargo · github.com/akuity/kargo)
- [CVE-2026-42352](https://cve.now/CVE-2026-42352.md): pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber (CVSS 8.6, geopython pygeoapi · pygeoapi)
- [CVE-2026-42351](https://cve.now/CVE-2026-42351.md): pygeoapi: Path Traversal in STAC FileSystemProvider (CVSS 7.5, geopython pygeoapi · pygeoapi)
- [CVE-2026-42556](https://cve.now/CVE-2026-42556.md): Postiz stored XSS in public preview page (CVSS 8.9, gitroomhq postiz-app)
- [CVE-2026-42346](https://cve.now/CVE-2026-42346.md): Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths (CVSS 6.5, gitroomhq postiz-app)
- [CVE-2026-42298](https://cve.now/CVE-2026-42298.md): Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev (CVSS 10.0, gitroomhq postiz-app)
- [CVE-2026-42339](https://cve.now/CVE-2026-42339.md): New API: SSRF Filter Bypass via 0.0.0.0 (CVSS 7.1, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-41432](https://cve.now/CVE-2026-41432.md): New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud (CVSS 7.1, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-44286](https://cve.now/CVE-2026-44286.md): FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation (CVSS 2.3, labring FastGPT)
- [CVE-2026-44284](https://cve.now/CVE-2026-44284.md): FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution (CVSS 6.3, labring FastGPT)
- [CVE-2026-42345](https://cve.now/CVE-2026-42345.md): FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dot (CVSS 7.7, labring FastGPT)
- [CVE-2026-42344](https://cve.now/CVE-2026-42344.md): FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints (CVSS 6.3, labring FastGPT)
- [CVE-2026-42343](https://cve.now/CVE-2026-42343.md): FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion (CVSS 6.3, labring FastGPT)
- [CVE-2026-42302](https://cve.now/CVE-2026-42302.md): FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox (CVSS 9.8, labring FastGPT)
- [CVE-2026-42224](https://cve.now/CVE-2026-42224.md): ipl/web is vulnerable to reflected XSS by malformed search requests (CVSS 7.6, Icinga ipl-web · ipl/web)
- [CVE-2026-41520](https://cve.now/CVE-2026-41520.md): Cillium exposes sensitive information included in the cilium-bugtool debug archive (CVSS 7.9, cilium · github.com/cilium/cilium)
- [CVE-2026-44987](https://cve.now/CVE-2026-44987.md): SysReptor: Privilege Escalation from User Admin to Superuser (CVSS 3.8, Syslifters sysreptor)
- [CVE-2026-42291](https://cve.now/CVE-2026-42291.md): SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional (CVSS 6.8, Syslifters sysreptor)
- [CVE-2026-42206](https://cve.now/CVE-2026-42206.md): Roadiz OpenID Connect nonce generated but never validated — ID token replay attack (CVSS 5.7, roadiz core-bundle-dev-app · roadiz/openid)
- [CVE-2026-42287](https://cve.now/CVE-2026-42287.md): Emlog: SQL Injection Vulnerability in log\_model.php within addLog() and updateLog() Functions (CVSS 10.0, emlog)
- [CVE-2026-42286](https://cve.now/CVE-2026-42286.md): Emlog: Cross-Site Request Forgery in Admin Functions (CVSS 8.4, emlog)
- [CVE-2026-41517](https://cve.now/CVE-2026-41517.md): Emlog: Remote Code Execution via Malicious Plugin Upload (CVSS 0.0, emlog)
- [CVE-2026-41486](https://cve.now/CVE-2026-41486.md): Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization (CVSS 8.9, ray-project ray · ve-ray +1)
- [CVE-2026-42209](https://cve.now/CVE-2026-42209.md): FlashMQ: Division by zero crash when using non-default deferred retained message setting (CVSS 6.5, halfgaar FlashMQ)
- [CVE-2026-42213](https://cve.now/CVE-2026-42213.md): SolidCAM-GPPL-IDE: Path traversal in \`inc\` directive enables file probing and NTLM-hash leak (CVSS 5.1, anzory SolidCAM-GPPL-IDE)
- [CVE-2026-42212](https://cve.now/CVE-2026-42212.md): SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser (CVSS 7.1, anzory SolidCAM-GPPL-IDE)
- [CVE-2026-42205](https://cve.now/CVE-2026-42205.md): Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources (CVSS 8.8, avo-hq avo · avo)
- [CVE-2026-42195](https://cve.now/CVE-2026-42195.md): Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host (CVSS 3.4, jgraph drawio)
- [CVE-2026-42202](https://cve.now/CVE-2026-42202.md): nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields (CVSS 6.5, almirhodzic nova-toggle-5 · almirhodzic/nova-toggle-5)
- [CVE-2026-42199](https://cve.now/CVE-2026-42199.md): Grid: Integer Overflow in Grid::expand\_rows Leads to Safe-API Undefined Behavior (CVSS 6.2, becheran grid · grid)
- [CVE-2026-42192](https://cve.now/CVE-2026-42192.md): Plunk: Stored XSS in campaign view (CVSS 5.4, useplunk plunk)
- [CVE-2026-42193](https://cve.now/CVE-2026-42193.md): Plunk: SNS webhook forgery (CVSS 9.1, useplunk plunk)
- [CVE-2026-44400](https://cve.now/CVE-2026-44400.md): MailEnable Enterprise Premium \< 10.55 Authorization Bypass via WebAdmin (CVSS 8.7, MailEnable Enterprise Premium)
- [CVE-2026-7807](https://cve.now/CVE-2026-7807.md): SmarterTools SmarterMail \< Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API (CVSS 8.7, SmarterTools SmarterMail)
- [CVE-2026-42189](https://cve.now/CVE-2026-42189.md): Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth (CVSS 7.5, Eugeny russh · russh)
- [CVE-2026-42160](https://cve.now/CVE-2026-42160.md): Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend (CVSS 10.0, sovity dataspace-portal)
- [CVE-2026-42190](https://cve.now/CVE-2026-42190.md): RedwoodSDK: Same-site CSRF in in server actions (CVSS 5.3, redwoodjs sdk · rwsdk)
- [CVE-2026-42180](https://cve.now/CVE-2026-42180.md): Lemmy: SSRF in /api/v3/post via Webmention dispatch (CVSS 6.3, LemmyNet lemmy · lemmy\_api\_common)
- [CVE-2026-42181](https://cve.now/CVE-2026-42181.md): Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image (CVSS 6.5, LemmyNet lemmy · lemmy\_api\_common)
- [CVE-2026-42185](https://cve.now/CVE-2026-42185.md): People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation (CVSS 5.5, suitenumerique people)
- [CVE-2026-42176](https://cve.now/CVE-2026-42176.md): Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing \`jti\` validation) (CVSS 6.7, Erudika scoold)
- [CVE-2026-44694](https://cve.now/CVE-2026-44694.md): n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths (CVSS 7.2, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-42282](https://cve.now/CVE-2026-42282.md): n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode (CVSS 4.3, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-41495](https://cve.now/CVE-2026-41495.md): n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests (CVSS 5.3, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-41511](https://cve.now/CVE-2026-41511.md): OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle (CVSS 6.2, ironfede openmcdf · OpenMcdf)
- [CVE-2026-29201](https://cve.now/CVE-2026-29201.md): Insufficient input validation of the feature file name in \`feature::LOADFEATUREFILE\` adminbin call can cause arbitrary file read when a rela (CVSS 8.6, WebPros cPanel · WebPros WP Squared)
- [CVE-2026-29202](https://cve.now/CVE-2026-29202.md): Insufficient input validation of the \`plugin\` parameter of the \`create\_user\` plugin allows arbitrary Perl code execution on behalf of the al (CVSS 5.3, WebPros cPanel · WebPros WP Squared)
- [CVE-2026-29203](https://cve.now/CVE-2026-29203.md): A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system fil (CVSS 5.3, WebPros cPanel · WebPros WP Squared)
- [CVE-2026-8178](https://cve.now/CVE-2026-8178.md): Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver (CVSS 8.1, Amazon Redshift JDBC Driver · com.amazon.redshift:redshift-…)
- [CVE-2026-6659](https://cve.now/CVE-2026-6659.md): Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts (CVSS 7.5, RSAVAGE Crypt::PasswdMD5)
- [CVE-2026-42072](https://cve.now/CVE-2026-42072.md): Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access (CVSS 9.8, orneryd NornicDB · github.com/orneryd/nornicdb)
- [CVE-2026-42030](https://cve.now/CVE-2026-42030.md): MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer (CVSS 6.1, MapServer)
- [CVE-2026-42028](https://cve.now/CVE-2026-42028.md): novaGallery: Unauthenticated Path Traversal in Album and Cached Image Routes Allows Reading Images Outside Gallery Root (CVSS 5.3, novafacile novagallery)
- [CVE-2026-41889](https://cve.now/CVE-2026-41889.md): pgx: SQL Injection via placeholder confusion with dollar quoted string literals (CVSS 2.3, jackc pgx · github.com/jackc/pgx +2)
- [CVE-2026-41887](https://cve.now/CVE-2026-41887.md): Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) (CVSS 4.9, flarum framework · flarum/core)
- [CVE-2026-41886](https://cve.now/CVE-2026-41886.md): locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor (CVSS 7.5, locize)
- [CVE-2026-42793](https://cve.now/CVE-2026-42793.md): Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe (CVSS 8.2, absinthe-graphql absinthe)
- [CVE-2026-42794](https://cve.now/CVE-2026-42794.md): Reflected XSS via backslash bypass in GraphiQL js\_escape in absinthe\_plug (CVSS 2.3, absinthe-graphql absinthe\_plug)
- [CVE-2026-43967](https://cve.now/CVE-2026-43967.md): Quadratic fragment-name uniqueness check causes denial of service in absinthe (CVSS 8.7, absinthe-graphql absinthe)
- [CVE-2026-41885](https://cve.now/CVE-2026-41885.md): Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend (CVSS 6.5, i18next-locize-backend)
- [CVE-2026-41693](https://cve.now/CVE-2026-41693.md): i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite (CVSS 8.2, i18next-fs-backend)
- [CVE-2026-41883](https://cve.now/CVE-2026-41883.md): OmniFaces: EL injection via crafted resource name in wildcard CDN mapping (CVSS 8.1, omnifaces · org.omnifaces:omnifaces)
- [CVE-2026-42353](https://cve.now/CVE-2026-42353.md): Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters (CVSS 8.2, i18next-http-middleware)
- [CVE-2026-41683](https://cve.now/CVE-2026-41683.md): HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header (CVSS 8.6, i18next-http-middleware)
- [CVE-2026-41690](https://cve.now/CVE-2026-41690.md): Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters (CVSS 8.6, i18next-http-middleware)
- [CVE-2026-41591](https://cve.now/CVE-2026-41591.md): Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping (CVSS 6.4, marko-js marko · marko +1)
- [CVE-2026-41070](https://cve.now/CVE-2026-41070.md): openvpn-auth-oauth2 returns FUNC\_SUCCESS on client-deny, allowing unauthenticated VPN access (CVSS 10.0, jkroepke openvpn-auth-oauth2 · github.com/jkroepke/openvpn-…)
- [CVE-2026-44499](https://cve.now/CVE-2026-44499.md): ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning (CVSS 8.7, ZcashFoundation zebra · zebrad)
- [CVE-2026-44500](https://cve.now/CVE-2026-44500.md): ZEBRA: Allocation Amplification in Inbound Network Deserializers (CVSS 5.3, ZcashFoundation zebra · zebra-network +2)
- [CVE-2026-44498](https://cve.now/CVE-2026-44498.md): ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops (CVSS 9.2, ZcashFoundation zebra · zebrad)
- [CVE-2026-44497](https://cve.now/CVE-2026-44497.md): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer (CVSS 9.3, ZcashFoundation zebra · zebra-script +1)
- [CVE-2026-41585](https://cve.now/CVE-2026-41585.md): ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients (CVSS 6.9, ZcashFoundation zebra · zebra-rpc +1)
- [CVE-2026-41584](https://cve.now/CVE-2026-41584.md): ZEBRA: rk Identity Point Panic in Transaction Verification (CVSS 9.2, ZcashFoundation zebra · zebrad +1)
- [CVE-2026-41583](https://cve.now/CVE-2026-41583.md): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling (CVSS 9.3, ZcashFoundation zebra · zebrad +1)
- [CVE-2026-41588](https://cve.now/CVE-2026-41588.md): RELATE: Timing Attack Vulnerability in course/auth.py — check\_sign\_in\_key() (CVSS 9.0, inducer relate)
- [CVE-2026-41576](https://cve.now/CVE-2026-41576.md): Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template (CVSS 7.1, Ajax30 BraveCMS-2.0)
- [CVE-2026-41524](https://cve.now/CVE-2026-41524.md): Ajax30/BraveCMS-2.0: Stored XSS in Page / Article Content (CVSS 8.7, Ajax30 BraveCMS-2.0)
- [CVE-2026-41575](https://cve.now/CVE-2026-41575.md): th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability (CVSS 6.1, th30d4y IP)
- [CVE-2026-41574](https://cve.now/CVE-2026-41574.md): Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass (CVSS 9.3, nhost · github.com/nhost/nhost)
- [CVE-2026-41570](https://cve.now/CVE-2026-41570.md): PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes (CVSS 7.8, sebastianbergmann phpunit · phpunit/phpunit)
- [CVE-2026-41308](https://cve.now/CVE-2026-41308.md): Password Pusher: JSON API \`/p.json\` file upload alias bypasses file-push authentication (CVSS 6.5, pglombardo PasswordPusher)
- [CVE-2026-41487](https://cve.now/CVE-2026-41487.md): Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys (CVSS 5.3, langfuse)
- [CVE-2026-43475](https://cve.now/CVE-2026-43475.md): scsi: storvsc: Fix scheduling while atomic on PREEMPT\_RT (no CVSS, Linux)
- [CVE-2026-43474](https://cve.now/CVE-2026-43474.md): fs: init flags\_valid before calling vfs\_fileattr\_get (no CVSS, Linux)
- [CVE-2026-43473](https://cve.now/CVE-2026-43473.md): scsi: mpi3mr: Add NULL checks when resetting request and reply queues (no CVSS, Linux)
- [CVE-2026-43472](https://cve.now/CVE-2026-43472.md): unshare: fix unshare\_fs() handling (no CVSS, Linux)
- [CVE-2026-43471](https://cve.now/CVE-2026-43471.md): scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd\_add\_command\_trace() (no CVSS, Linux)
- [CVE-2026-43470](https://cve.now/CVE-2026-43470.md): nfs: return EISDIR on nfs3\_proc\_create if d\_alias is a dir (no CVSS, Linux)
- [CVE-2026-43469](https://cve.now/CVE-2026-43469.md): xprtrdma: Decrement re\_receiving on the early exit paths (CVSS 7.5, Linux)
- [CVE-2026-43468](https://cve.now/CVE-2026-43468.md): net/mlx5: Fix deadlock between devlink lock and esw-\>wq (no CVSS, Linux)
- [CVE-2026-43467](https://cve.now/CVE-2026-43467.md): net/mlx5: Fix crash when moving to switchdev mode (no CVSS, Linux)
- [CVE-2026-43466](https://cve.now/CVE-2026-43466.md): net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (CVSS 8.2, Linux)
- [CVE-2026-43465](https://cve.now/CVE-2026-43465.md): net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (CVSS 9.8, Linux)
- [CVE-2026-43464](https://cve.now/CVE-2026-43464.md): net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (CVSS 7.5, Linux)
- [CVE-2026-43463](https://cve.now/CVE-2026-43463.md): rxrpc, afs: Fix missing error pointer check after rxrpc\_kernel\_lookup\_peer() (no CVSS, Linux)
- [CVE-2026-43462](https://cve.now/CVE-2026-43462.md): net: spacemit: Fix error handling in emac\_tx\_mem\_map() (CVSS 7.5, Linux)
- [CVE-2026-43461](https://cve.now/CVE-2026-43461.md): spi: amlogic: spifc-a4: Fix DMA mapping error handling (CVSS 7.8, Linux)
- [CVE-2026-43460](https://cve.now/CVE-2026-43460.md): spi: rockchip-sfc: Fix double-free in remove() callback (no CVSS, Linux)
- [CVE-2026-43459](https://cve.now/CVE-2026-43459.md): ASoC: soc-core: flush delayed work before removing DAIs and widgets (CVSS 7.3, Linux)
- [CVE-2026-43458](https://cve.now/CVE-2026-43458.md): serial: caif: hold tty-\>link reference in ldisc\_open and ser\_release (no CVSS, Linux)
- [CVE-2026-43457](https://cve.now/CVE-2026-43457.md): mctp: i2c: fix skb memory leak in receive path (no CVSS, Linux)
- [CVE-2026-43456](https://cve.now/CVE-2026-43456.md): bonding: fix type confusion in bond\_setup\_by\_slave() (CVSS 7.8, Linux)
- [CVE-2026-43455](https://cve.now/CVE-2026-43455.md): mctp: route: hold key-\>lock in mctp\_flow\_prepare\_output() (no CVSS, Linux)
- [CVE-2026-43454](https://cve.now/CVE-2026-43454.md): netfilter: nf\_tables: Fix for duplicate device in netdev hooks (CVSS 7.8, Linux)
- [CVE-2026-43453](https://cve.now/CVE-2026-43453.md): netfilter: nft\_set\_pipapo: fix stack out-of-bounds read in pipapo\_drop() (no CVSS, Linux)
- [CVE-2026-43452](https://cve.now/CVE-2026-43452.md): netfilter: x\_tables: guard option walkers against 1-byte tail reads (CVSS 8.2, Linux)
- [CVE-2026-43451](https://cve.now/CVE-2026-43451.md): netfilter: nfnetlink\_queue: fix entry leak in bridge verdict error path (no CVSS, Linux)
- [CVE-2026-43450](https://cve.now/CVE-2026-43450.md): netfilter: nfnetlink\_cthelper: fix OOB read in nfnl\_cthelper\_dump\_table() (no CVSS, Linux)
- [CVE-2026-43449](https://cve.now/CVE-2026-43449.md): nvme-pci: Fix slab-out-of-bounds in nvme\_dbbuf\_set (no CVSS, Linux)
- [CVE-2026-43448](https://cve.now/CVE-2026-43448.md): nvme-pci: Fix race bug in nvme\_poll\_irqdisable() (no CVSS, Linux)
- [CVE-2026-43447](https://cve.now/CVE-2026-43447.md): iavf: fix PTP use-after-free during reset (CVSS 7.8, Linux)
- [CVE-2026-43446](https://cve.now/CVE-2026-43446.md): accel/amdxdna: Fix runtime suspend deadlock when there is pending job (no CVSS, Linux)
- [CVE-2026-43445](https://cve.now/CVE-2026-43445.md): e1000/e1000e: Fix leak in DMA error cleanup (no CVSS, Linux)
- [CVE-2026-43444](https://cve.now/CVE-2026-43444.md): drm/amdkfd: Unreserve bo if queue update failed (no CVSS, Linux)
- [CVE-2026-43443](https://cve.now/CVE-2026-43443.md): ASoC: amd: acp-mach-common: Add missing error check for clock acquisition (no CVSS, Linux)
- [CVE-2026-43442](https://cve.now/CVE-2026-43442.md): io\_uring: fix physical SQE bounds check for SQE\_MIXED 128-byte ops (CVSS 7.1, Linux)
- [CVE-2026-43441](https://cve.now/CVE-2026-43441.md): net: bonding: Fix nd\_tbl NULL dereference when IPv6 is disabled (CVSS 7.5, Linux)
- [CVE-2026-43440](https://cve.now/CVE-2026-43440.md): net/mana: Null service\_wq on setup error to prevent double destroy (no CVSS, Linux)
- [CVE-2026-43439](https://cve.now/CVE-2026-43439.md): cgroup: fix race between task migration and iteration (no CVSS, Linux)
- [CVE-2026-43438](https://cve.now/CVE-2026-43438.md): sched\_ext: Remove redundant css\_put() in scx\_cgroup\_init() (CVSS 7.8, Linux)
- [CVE-2026-43437](https://cve.now/CVE-2026-43437.md): ALSA: pcm: fix use-after-free on linked stream runtime in snd\_pcm\_drain() (CVSS 7.8, Linux)
- [CVE-2026-43436](https://cve.now/CVE-2026-43436.md): ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces (no CVSS, Linux)
- [CVE-2026-43435](https://cve.now/CVE-2026-43435.md): rust\_binder: fix oneway spam detection (no CVSS, Linux)
- [CVE-2026-43434](https://cve.now/CVE-2026-43434.md): rust\_binder: check ownership before using vma (CVSS 7.8, Linux)
- [CVE-2026-43433](https://cve.now/CVE-2026-43433.md): rust\_binder: avoid reading the written value in offsets array (CVSS 7.8, Linux)
- [CVE-2026-43432](https://cve.now/CVE-2026-43432.md): usb: xhci: Fix memory leak in xhci\_disable\_slot() (no CVSS, Linux)
- [CVE-2026-43431](https://cve.now/CVE-2026-43431.md): xhci: Fix NULL pointer dereference when reading portli debugfs files (no CVSS, Linux)
- [CVE-2026-43430](https://cve.now/CVE-2026-43430.md): usb: yurex: fix race in probe (no CVSS, Linux)
- [CVE-2026-43429](https://cve.now/CVE-2026-43429.md): USB: usbtmc: Use usb\_bulk\_msg\_killable() with user-specified timeouts (no CVSS, Linux)
- [CVE-2026-43428](https://cve.now/CVE-2026-43428.md): USB: core: Limit the length of unkillable synchronous timeouts (no CVSS, Linux)
- [CVE-2026-43427](https://cve.now/CVE-2026-43427.md): usb: class: cdc-wdm: fix reordering issue in read code path (no CVSS, Linux)
- [CVE-2026-43426](https://cve.now/CVE-2026-43426.md): usb: renesas\_usbhs: fix use-after-free in ISR during device removal (no CVSS, Linux)
- [CVE-2026-43425](https://cve.now/CVE-2026-43425.md): usb: image: mdc800: kill download URB on timeout (no CVSS, Linux)
- [CVE-2026-43424](https://cve.now/CVE-2026-43424.md): usb: gadget: f\_tcm: Fix NULL pointer dereferences in nexus handling (no CVSS, Linux)
- [CVE-2026-43421](https://cve.now/CVE-2026-43421.md): usb: gadget: f\_ncm: Fix net\_device lifecycle with device\_move (no CVSS, Linux)
- [CVE-2026-43420](https://cve.now/CVE-2026-43420.md): ceph: fix i\_nlink underrun during async unlink (no CVSS, Linux)
- [CVE-2025-67486](https://cve.now/CVE-2025-67486.md): Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields (CVSS 8.6, dolibarr)
- [CVE-2026-43419](https://cve.now/CVE-2026-43419.md): ceph: fix memory leaks in ceph\_mdsc\_build\_path() (no CVSS, Linux)
- [CVE-2026-43418](https://cve.now/CVE-2026-43418.md): sched/mmcid: Prevent CID stalls due to concurrent forks (no CVSS, Linux)
- [CVE-2026-43417](https://cve.now/CVE-2026-43417.md): sched/mmcid: Handle vfork()/CLONE\_VM correctly (no CVSS, Linux)
- [CVE-2026-43416](https://cve.now/CVE-2026-43416.md): powerpc, perf: Check that current-\>mm is alive before getting user callchain (no CVSS, Linux)
- [CVE-2026-43415](https://cve.now/CVE-2026-43415.md): scsi: ufs: core: Fix SError in ufshcd\_rtc\_work() during UFS suspend (no CVSS, Linux)
- [CVE-2026-43414](https://cve.now/CVE-2026-43414.md): scsi: qla2xxx: Completely fix fcport double free (CVSS 9.8, Linux)
- [CVE-2026-43413](https://cve.now/CVE-2026-43413.md): scsi: hisi\_sas: Fix NULL pointer exception during user\_scan() (no CVSS, Linux)
- [CVE-2026-43412](https://cve.now/CVE-2026-43412.md): ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start (no CVSS, Linux)
- [CVE-2026-43411](https://cve.now/CVE-2026-43411.md): tipc: fix divide-by-zero in tipc\_sk\_filter\_connect() (no CVSS, Linux)
- [CVE-2026-43410](https://cve.now/CVE-2026-43410.md): firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled (no CVSS, Linux)
- [CVE-2026-43409](https://cve.now/CVE-2026-43409.md): kprobes: avoid crash when rmmod/insmod after ftrace killed (no CVSS, Linux)
- [CVE-2026-43408](https://cve.now/CVE-2026-43408.md): ceph: add a bunch of missing ceph\_path\_info initializers (CVSS 7.8, Linux)
- [CVE-2026-43407](https://cve.now/CVE-2026-43407.md): libceph: Fix potential out-of-bounds access in ceph\_handle\_auth\_reply() (CVSS 9.1, Linux)
- [CVE-2026-43406](https://cve.now/CVE-2026-43406.md): libceph: prevent potential out-of-bounds reads in process\_message\_header() (CVSS 9.1, Linux)
- [CVE-2026-43405](https://cve.now/CVE-2026-43405.md): libceph: Use u32 for non-negative values in ceph\_monmap\_decode() (CVSS 7.5, Linux)
- [CVE-2026-43404](https://cve.now/CVE-2026-43404.md): mm: Fix a hmm\_range\_fault() livelock / starvation problem (no CVSS, Linux)
- [CVE-2026-43403](https://cve.now/CVE-2026-43403.md): nsfs: tighten permission checks for ns iteration ioctls (CVSS 8.8, Linux)
- [CVE-2026-43402](https://cve.now/CVE-2026-43402.md): kthread: consolidate kthread exit paths to prevent use-after-free (CVSS 9.8, Linux)
- [CVE-2026-43401](https://cve.now/CVE-2026-43401.md): cpufreq: intel\_pstate: Fix NULL pointer dereference in update\_cpu\_qos\_request() (no CVSS, Linux)
- [CVE-2026-43400](https://cve.now/CVE-2026-43400.md): drm/amdgpu: add upper bound check on user inputs in signal ioctl (no CVSS, Linux)
- [CVE-2026-43399](https://cve.now/CVE-2026-43399.md): drm/amdgpu/userq: Fix reference leak in amdgpu\_userq\_wait\_ioctl (no CVSS, Linux)
- [CVE-2026-43398](https://cve.now/CVE-2026-43398.md): drm/amdgpu: add upper bound check on user inputs in wait ioctl (no CVSS, Linux)
- [CVE-2026-43397](https://cve.now/CVE-2026-43397.md): drm/bridge: samsung-dsim: Fix memory leak in error path (no CVSS, Linux)
- [CVE-2026-43396](https://cve.now/CVE-2026-43396.md): drm/xe/sync: Fix user fence leak on alloc failure (no CVSS, Linux)
- [CVE-2026-43395](https://cve.now/CVE-2026-43395.md): drm/xe/sync: Cleanup partially initialized sync on parse failure (no CVSS, Linux)
- [CVE-2026-43394](https://cve.now/CVE-2026-43394.md): nfsd: Fix cred ref leak in nfsd\_nl\_listener\_set\_doit(). (no CVSS, Linux)
- [CVE-2026-43393](https://cve.now/CVE-2026-43393.md): btrfs: fix chunk map leak in btrfs\_map\_block() after btrfs\_chunk\_map\_num\_copies() (no CVSS, Linux)
- [CVE-2026-43392](https://cve.now/CVE-2026-43392.md): sched\_ext: Fix starvation of scx\_enable() under fair-class saturation (no CVSS, Linux)
- [CVE-2026-43391](https://cve.now/CVE-2026-43391.md): nsfs: tighten permission checks for handle opening (CVSS 8.8, Linux)
- [CVE-2026-43390](https://cve.now/CVE-2026-43390.md): nstree: tighten permission checks for listing (no CVSS, Linux)
- [CVE-2026-43389](https://cve.now/CVE-2026-43389.md): mm: memfd\_luo: always dirty all folios (no CVSS, Linux)
- [CVE-2026-43388](https://cve.now/CVE-2026-43388.md): mm/damon/core: clear walk\_control on inactive context in damos\_walk() (no CVSS, Linux)
- [CVE-2026-43387](https://cve.now/CVE-2026-43387.md): staging: rtl8723bs: properly validate the data in rtw\_get\_ie\_ex() (no CVSS, Linux)
- [CVE-2026-43386](https://cve.now/CVE-2026-43386.md): staging: rtl8723bs: fix potential out-of-bounds read in rtw\_restruct\_wmm\_ie (no CVSS, Linux)
- [CVE-2026-43385](https://cve.now/CVE-2026-43385.md): net: Fix rcu\_tasks stall in threaded busypoll (CVSS 7.5, Linux)
- [CVE-2026-43384](https://cve.now/CVE-2026-43384.md): net/tcp-ao: Fix MAC comparison to be constant-time (CVSS 9.8, Linux)
- [CVE-2026-43383](https://cve.now/CVE-2026-43383.md): net/tcp-md5: Fix MAC comparison to be constant-time (CVSS 9.4, Linux)
- [CVE-2026-43382](https://cve.now/CVE-2026-43382.md): batman-adv: Avoid double-rtnl\_lock ELP metric worker (no CVSS, Linux)
- [CVE-2026-43381](https://cve.now/CVE-2026-43381.md): nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (no CVSS, Linux)
- [CVE-2026-43380](https://cve.now/CVE-2026-43380.md): hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (CVSS 7.8, Linux)
- [CVE-2026-43379](https://cve.now/CVE-2026-43379.md): ksmbd: fix use-after-free in smb\_lazy\_parent\_lease\_break\_close() (CVSS 9.8, Linux)
- [CVE-2026-43378](https://cve.now/CVE-2026-43378.md): smb: server: fix use-after-free in smb2\_open() (CVSS 9.8, Linux)
- [CVE-2026-43377](https://cve.now/CVE-2026-43377.md): ksmbd: Don't log keys in SMB3 signing and encryption key generation (CVSS 8.1, Linux)
- [CVE-2026-43376](https://cve.now/CVE-2026-43376.md): ksmbd: fix use-after-free by using call\_rcu() for oplock\_info (CVSS 9.8, Linux)
- [CVE-2026-43375](https://cve.now/CVE-2026-43375.md): net: mctp: fix device leak on probe failure (no CVSS, Linux)
- [CVE-2026-43374](https://cve.now/CVE-2026-43374.md): net: nexthop: fix percpu use-after-free in remove\_nh\_grp\_entry (CVSS 7.8, Linux)
- [CVE-2026-43373](https://cve.now/CVE-2026-43373.md): net: ncsi: fix skb leak in error paths (CVSS 7.5, Linux)
- [CVE-2026-43372](https://cve.now/CVE-2026-43372.md): net: dsa: microchip: Fix error path in PTP IRQ setup (no CVSS, Linux)
- [CVE-2026-43371](https://cve.now/CVE-2026-43371.md): net: macb: Shuffle the tx ring before enabling tx (no CVSS, Linux)
- [CVE-2026-43370](https://cve.now/CVE-2026-43370.md): drm/amdgpu: Fix use-after-free race in VM acquire (CVSS 7.8, Linux)
- [CVE-2026-43369](https://cve.now/CVE-2026-43369.md): drm/amd: Fix NULL pointer dereference in device cleanup (no CVSS, Linux)
- [CVE-2026-43368](https://cve.now/CVE-2026-43368.md): drm/i915: Fix potential overflow of shmem scatterlist length (CVSS 7.8, Linux)
- [CVE-2026-43367](https://cve.now/CVE-2026-43367.md): drm/amd: Fix a few more NULL pointer dereference in device cleanup (no CVSS, Linux)
- [CVE-2026-43366](https://cve.now/CVE-2026-43366.md): io\_uring/kbuf: check if target buffer list is still legacy on recycle (CVSS 7.8, Linux)
- [CVE-2026-43365](https://cve.now/CVE-2026-43365.md): xfs: fix undersized l\_iclog\_roundoff values (CVSS 8.2, Linux)
- [CVE-2026-43364](https://cve.now/CVE-2026-43364.md): ublk: fix NULL pointer dereference in ublk\_ctrl\_set\_size() (no CVSS, Linux)
- [CVE-2026-43363](https://cve.now/CVE-2026-43363.md): x86/apic: Disable x2apic on resume if the kernel expects so (no CVSS, Linux)
- [CVE-2026-43362](https://cve.now/CVE-2026-43362.md): smb: client: fix in-place encryption corruption in SMB2\_write() (CVSS 8.1, Linux)
- [CVE-2026-43361](https://cve.now/CVE-2026-43361.md): btrfs: fix transaction abort when snapshotting received subvolumes (no CVSS, Linux)
- [CVE-2026-43360](https://cve.now/CVE-2026-43360.md): btrfs: fix transaction abort on file creation due to name hash collision (no CVSS, Linux)
- [CVE-2026-43359](https://cve.now/CVE-2026-43359.md): btrfs: fix transaction abort on set received ioctl due to item overflow (no CVSS, Linux)
- [CVE-2026-43358](https://cve.now/CVE-2026-43358.md): btrfs: add missing RCU unlock in error path in try\_release\_subpage\_extent\_buffer() (no CVSS, Linux)
- [CVE-2026-43357](https://cve.now/CVE-2026-43357.md): iio: gyro: mpu3050-core: fix pm\_runtime error handling (no CVSS, Linux)
- [CVE-2026-43356](https://cve.now/CVE-2026-43356.md): iio: imu: adis: Fix NULL pointer dereference in adis\_init (no CVSS, Linux)
- [CVE-2026-43355](https://cve.now/CVE-2026-43355.md): iio: light: bh1780: fix PM runtime leak on error path (no CVSS, Linux)
- [CVE-2026-43354](https://cve.now/CVE-2026-43354.md): iio: proximity: hx9023s: Protect against division by zero in set\_samp\_freq (no CVSS, Linux)
- [CVE-2026-43353](https://cve.now/CVE-2026-43353.md): i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (CVSS 7.8, Linux)
- [CVE-2026-43352](https://cve.now/CVE-2026-43352.md): i3c: mipi-i3c-hci: Correct RING\_CTRL\_ABORT handling in DMA dequeue (CVSS 7.8, Linux)
- [CVE-2026-43351](https://cve.now/CVE-2026-43351.md): KVM: arm64: Eagerly init vgic dist/redist on vgic creation (no CVSS, Linux)
- [CVE-2026-41512](https://cve.now/CVE-2026-41512.md): Remote code execution via JavaScript injection in \`BrowserAutomation::PlaywrightService\` (CVSS 9.9, 0din-ai ai-scanner)
- [CVE-2026-32803](https://cve.now/CVE-2026-32803.md): Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 con (CVSS 3.3, Dell PowerScale OneFS)
- [CVE-2026-41507](https://cve.now/CVE-2026-41507.md): Remote Code Execution (RCE) via String Literal Injection into math-codegen (CVSS 9.8, mauriciopoppe math-codegen · math-codegen)
- [CVE-2026-41509](https://cve.now/CVE-2026-41509.md): Integer underflow in crypto\_sign\_open() leads to buffer overflow (CVSS 6.9, CROSS-signature CROSS-implementation)
- [CVE-2026-41506](https://cve.now/CVE-2026-41506.md): go-git Credential leak via cross-host redirect in smart HTTP transport (CVSS 4.7, go-git · github.com/go-git/go-git/v5 +1)
- [CVE-2026-43350](https://cve.now/CVE-2026-43350.md): smb: client: require a full NFS mode SID before reading mode bits (CVSS 7.6, Linux)
- [CVE-2026-43349](https://cve.now/CVE-2026-43349.md): f2fs: fix to avoid uninit-value access in f2fs\_sanity\_check\_node\_footer (no CVSS, Linux)
- [CVE-2026-43348](https://cve.now/CVE-2026-43348.md): mshv\_vtl: Fix vmemmap\_shift exceeding MAX\_FOLIO\_ORDER (no CVSS, Linux)
- [CVE-2026-43347](https://cve.now/CVE-2026-43347.md): arm64: dts: qcom: monaco: Reserve full Gunyah metadata region (CVSS 7.5, Linux)
- [CVE-2026-43346](https://cve.now/CVE-2026-43346.md): ice: ptp: don't WARN when controlling PF is unavailable (no CVSS, Linux)
- [CVE-2026-43345](https://cve.now/CVE-2026-43345.md): net: ipa: fix event ring index not programmed for IPA v5.0+ (CVSS 7.5, Linux)
- [CVE-2026-43344](https://cve.now/CVE-2026-43344.md): perf/x86/intel/uncore: Fix die ID init and look up bugs (no CVSS, Linux)
- [CVE-2026-44340](https://cve.now/CVE-2026-44340.md): PraisonAI: Symlink-extraction bypass of \`\_safe\_extractall\` writes outside \`dest\_dir\` (CVSS 8.7, MervinPraison PraisonAI · praisonai)
- [CVE-2026-39816](https://cve.now/CVE-2026-39816.md): Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService (CVSS 7.5, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2026-43343](https://cve.now/CVE-2026-43343.md): usb: gadget: f\_subset: Fix unbalanced refcnt in geth\_free (no CVSS, Linux)
- [CVE-2026-43342](https://cve.now/CVE-2026-43342.md): usb: gadget: f\_rndis: Protect RNDIS options with mutex (no CVSS, Linux)
- [CVE-2026-43341](https://cve.now/CVE-2026-43341.md): net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVSS 9.8, Linux)
- [CVE-2026-43340](https://cve.now/CVE-2026-43340.md): comedi: Reinit dev-\>spinlock between attachments to low-level drivers (no CVSS, Linux)
- [CVE-2026-44339](https://cve.now/CVE-2026-44339.md): PraisonAI has unsafe tool resolution in \`ToolExecutionMixin.execute\_tool\`: undeclared \`\_\_main\_\_\` callables execute (CVSS 8.6, MervinPraison PraisonAI · praisonaiagents +1)
- [CVE-2026-44338](https://cve.now/CVE-2026-44338.md): PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution (CVSS 7.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-44337](https://cve.now/CVE-2026-44337.md): PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries (CVSS 6.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-44336](https://cve.now/CVE-2026-44336.md): PraisonAI MCP \`tools/call\` path-traversal and RCE via Python \`.pth\` injection (CVSS 9.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-43339](https://cve.now/CVE-2026-43339.md): ipv6: prevent possible UaF in addrconf\_permanent\_addr() (CVSS 7.8, Linux)
- [CVE-2026-43338](https://cve.now/CVE-2026-43338.md): btrfs: reserve enough transaction items for qgroup ioctls (no CVSS, Linux)
- [CVE-2026-43337](https://cve.now/CVE-2026-43337.md): drm/amd/display: Fix NULL pointer dereference in dcn401\_init\_hw() (no CVSS, Linux)
- [CVE-2026-43336](https://cve.now/CVE-2026-43336.md): lib/crypto: chacha: Zeroize permuted\_state before it leaves scope (CVSS 7.5, Linux)
- [CVE-2026-43335](https://cve.now/CVE-2026-43335.md): interconnect: qcom: sm8450: Fix NULL pointer dereference in icc\_link\_nodes() (no CVSS, Linux)
- [CVE-2026-43334](https://cve.now/CVE-2026-43334.md): Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVSS 8.8, Linux)
- [CVE-2026-43333](https://cve.now/CVE-2026-43333.md): bpf: reject direct access to nullable PTR\_TO\_BUF pointers (no CVSS, Linux)
- [CVE-2026-43332](https://cve.now/CVE-2026-43332.md): thermal: core: Fix thermal zone device registration error path (CVSS 7.8, Linux)
- [CVE-2026-43331](https://cve.now/CVE-2026-43331.md): x86/kexec: Disable KCOV instrumentation after load\_segments() (no CVSS, Linux)
- [CVE-2026-43330](https://cve.now/CVE-2026-43330.md): crypto: caam - fix overflow on long hmac keys (CVSS 7.8, Linux)
- [CVE-2026-43329](https://cve.now/CVE-2026-43329.md): netfilter: flowtable: strictly check for maximum number of actions (CVSS 7.8, Linux)
- [CVE-2026-43328](https://cve.now/CVE-2026-43328.md): cpufreq: governor: fix double free in cpufreq\_dbs\_governor\_init() error path (no CVSS, Linux)
- [CVE-2026-43327](https://cve.now/CVE-2026-43327.md): USB: dummy-hcd: Fix locking/synchronization error (no CVSS, Linux)
- [CVE-2026-43326](https://cve.now/CVE-2026-43326.md): sched\_ext: Fix SCX\_KICK\_WAIT deadlock by deferring wait to balance callback (no CVSS, Linux)
- [CVE-2026-43325](https://cve.now/CVE-2026-43325.md): wifi: iwlwifi: mvm: don't send a 6E related command when not supported (no CVSS, Linux)
- [CVE-2026-43324](https://cve.now/CVE-2026-43324.md): USB: dummy-hcd: Fix interrupt synchronization error (CVSS 7.8, Linux)
- [CVE-2026-43323](https://cve.now/CVE-2026-43323.md): sched/fair: Fix zero\_vruntime tracking fix (no CVSS, Linux)
- [CVE-2026-43322](https://cve.now/CVE-2026-43322.md): Bluetooth: hci\_sync: Fix UAF in le\_read\_features\_complete (CVSS 8.8, Linux)
- [CVE-2026-44335](https://cve.now/CVE-2026-44335.md): SSRF bypass in PraisonAI (CVSS 7.7, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-43321](https://cve.now/CVE-2026-43321.md): bpf: Properly mark live registers for indirect jumps (CVSS 7.8, Linux)
- [CVE-2026-43320](https://cve.now/CVE-2026-43320.md): drm/amd/display: Fix dsc eDP issue (no CVSS, Linux)
- [CVE-2026-43319](https://cve.now/CVE-2026-43319.md): spi: spidev: fix lock inversion between spi\_lock and buf\_lock (no CVSS, Linux)
- [CVE-2026-43318](https://cve.now/CVE-2026-43318.md): drm/amdgpu: fix sync handling in amdgpu\_dma\_buf\_move\_notify (no CVSS, Linux)
- [CVE-2026-43317](https://cve.now/CVE-2026-43317.md): most: core: fix leak on early registration failure (no CVSS, Linux)
- [CVE-2026-43316](https://cve.now/CVE-2026-43316.md): media: solo6x10: Check for out of bounds chip\_id (no CVSS, Linux)
- [CVE-2025-71302](https://cve.now/CVE-2025-71302.md): drm/panthor: fix for dma-fence safe access rules (CVSS 7.8, Linux)
- [CVE-2026-44334](https://cve.now/CVE-2026-44334.md): PraisonAI: Unauthenticated RCE via \`tool\_override.py\` (CVSS 8.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-41497](https://cve.now/CVE-2026-41497.md): Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-41496](https://cve.now/CVE-2026-41496.md): PraisonAI: SQL Injection via unvalidated \`table\_prefix\` in 9 conversation store backends (incomplete fix for CVE-2026-40315) (CVSS 8.1, MervinPraison PraisonAI · praisonai +1)
- [CVE-2026-44126](https://cve.now/CVE-2026-44126.md): Insecure deserialization (CVSS 9.2, SEPPmail AG Secure Email Gateway)
- [CVE-2025-71301](https://cve.now/CVE-2025-71301.md): drm/tests: shmem: Hold reservation lock around vmap/vunmap (no CVSS, Linux)
- [CVE-2025-71300](https://cve.now/CVE-2025-71300.md): Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" (CVSS 7.8, Linux)
- [CVE-2026-44125](https://cve.now/CVE-2026-44125.md): Missing Authorization in GINAv2 (CVSS 9.3, SEPPmail AG Secure Email Gateway)
- [CVE-2026-44129](https://cve.now/CVE-2026-44129.md): Server-side template injection (CVSS 8.3, SEPPmail AG Secure Email Gateway)
- [CVE-2026-41493](https://cve.now/CVE-2026-41493.md): yard: Possible arbitrary path traversal and file access via yard server (CVSS 6.9, lsegal yard · yard)
- [CVE-2026-44128](https://cve.now/CVE-2026-44128.md): Unauthenticated Remote Code Execution (CVSS 9.3, SEPPmail AG Secure Email Gateway)
- [CVE-2026-44127](https://cve.now/CVE-2026-44127.md): Local File Inclusion (LFI) and Arbitrary File Deletion (CVSS 8.8, SEPPmail AG Secure Email Gateway)
- [CVE-2026-7864](https://cve.now/CVE-2026-7864.md): Exposure of Sensitive Information to an Unauthorized Actor (CVSS 6.9, SEPPmail AG Secure Email Gateway)
- [CVE-2026-43315](https://cve.now/CVE-2026-43315.md): KVM: nSVM: Remove a user-triggerable WARN on nested\_svm\_load\_cr3() succeeding (no CVSS, Linux)
- [CVE-2026-43314](https://cve.now/CVE-2026-43314.md): dm: remove fake timeout to avoid leak request (no CVSS, Linux)
- [CVE-2026-43313](https://cve.now/CVE-2026-43313.md): ACPI: processor: Fix NULL-pointer dereference in acpi\_processor\_errata\_piix4() (no CVSS, Linux)
- [CVE-2026-43312](https://cve.now/CVE-2026-43312.md): media: i2c: ov5647: Initialize subdev before controls (no CVSS, Linux)
- [CVE-2026-43311](https://cve.now/CVE-2026-43311.md): soc/tegra: pmc: Fix unsafe generic\_handle\_irq() call (no CVSS, Linux)
- [CVE-2026-43310](https://cve.now/CVE-2026-43310.md): media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC (no CVSS, Linux)
- [CVE-2026-43309](https://cve.now/CVE-2026-43309.md): md raid: fix hang when stopping arrays with metadata through dm-raid (no CVSS, Linux)
- [CVE-2026-43308](https://cve.now/CVE-2026-43308.md): btrfs: don't BUG() on unexpected delayed ref type in run\_one\_delayed\_ref() (no CVSS, Linux)
- [CVE-2026-43307](https://cve.now/CVE-2026-43307.md): iio: accel: adxl380: Avoid reading more entries than present in FIFO (CVSS 7.8, Linux)
- [CVE-2026-43306](https://cve.now/CVE-2026-43306.md): bpf: crypto: Use the correct destructor kfunc type (no CVSS, Linux)
- [CVE-2026-43305](https://cve.now/CVE-2026-43305.md): drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path (no CVSS, Linux)
- [CVE-2026-43304](https://cve.now/CVE-2026-43304.md): libceph: define and enforce CEPH\_MAX\_KEY\_LEN (CVSS 9.8, Linux)
- [CVE-2026-43303](https://cve.now/CVE-2026-43303.md): mm/page\_alloc: clear page-\>private in free\_pages\_prepare() (CVSS 7.8, Linux)
- [CVE-2026-43302](https://cve.now/CVE-2026-43302.md): drm/v3d: Set DMA segment size to avoid debug warnings (no CVSS, Linux)
- [CVE-2026-43301](https://cve.now/CVE-2026-43301.md): media: chips-media: wave5: Fix PM runtime usage count underflow (no CVSS, Linux)
- [CVE-2026-43300](https://cve.now/CVE-2026-43300.md): drm/panel: Fix a possible null-pointer dereference in jdi\_panel\_dsi\_remove() (no CVSS, Linux)
- [CVE-2026-43299](https://cve.now/CVE-2026-43299.md): btrfs: do not ASSERT() when the fs flips RO inside btrfs\_repair\_io\_failure() (no CVSS, Linux)
- [CVE-2026-43298](https://cve.now/CVE-2026-43298.md): drm/amdgpu: Skip vcn poison irq release on VF (no CVSS, Linux)
- [CVE-2026-43297](https://cve.now/CVE-2026-43297.md): media: rockchip: rga: Fix possible ERR\_PTR dereference in rga\_buf\_init() (no CVSS, Linux)
- [CVE-2026-43296](https://cve.now/CVE-2026-43296.md): octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (CVSS 7.5, Linux)
- [CVE-2026-43295](https://cve.now/CVE-2026-43295.md): rapidio: replace rio\_free\_net() with kfree() in rio\_scan\_alloc\_net() (no CVSS, Linux)
- [CVE-2026-43294](https://cve.now/CVE-2026-43294.md): drm: renesas: rz-du: mipi\_dsi: fix kernel panic when rebooting for some panels (no CVSS, Linux)
- [CVE-2026-43293](https://cve.now/CVE-2026-43293.md): media: chips-media: wave5: Fix kthread worker destruction in polling mode (no CVSS, Linux)
- [CVE-2026-43292](https://cve.now/CVE-2026-43292.md): mm/vmalloc: prevent RCU stalls in kasan\_release\_vmalloc\_node (no CVSS, Linux)
- [CVE-2026-43291](https://cve.now/CVE-2026-43291.md): net: nfc: nci: Fix parameter validation for packet data (CVSS 8.3, Linux)
- [CVE-2026-43290](https://cve.now/CVE-2026-43290.md): media: uvcvideo: Return queued buffers on start\_streaming() failure (CVSS 7.8, Linux)
- [CVE-2026-43289](https://cve.now/CVE-2026-43289.md): kexec: derive purgatory entry from symbol (no CVSS, Linux)
- [CVE-2026-43288](https://cve.now/CVE-2026-43288.md): ext4: move ext4\_percpu\_param\_init() before ext4\_mb\_init() (no CVSS, Linux)
- [CVE-2026-41491](https://cve.now/CVE-2026-41491.md): Dapr: Service Invocation path traversal ACL bypass (CVSS 8.1, dapr · github.com/dapr/dapr)
- [CVE-2026-43287](https://cve.now/CVE-2026-43287.md): drm: Account property blob allocations to memcg (no CVSS, Linux)
- [CVE-2026-43286](https://cve.now/CVE-2026-43286.md): mm/hugetlb: restore failed global reservations to subpool (no CVSS, Linux)
- [CVE-2026-43285](https://cve.now/CVE-2026-43285.md): mm/slab: do not access current-\>mems\_allowed\_seq if !allow\_spin (no CVSS, Linux)
- [CVE-2025-71299](https://cve.now/CVE-2025-71299.md): spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing (no CVSS, Linux)
- [CVE-2025-71298](https://cve.now/CVE-2025-71298.md): drm/tests: shmem: Hold reservation lock around madvise (no CVSS, Linux)
- [CVE-2025-71297](https://cve.now/CVE-2025-71297.md): wifi: rtw88: 8822b: Avoid WARNING in rtw8822b\_config\_trx\_mode() (no CVSS, Linux)
- [CVE-2025-71296](https://cve.now/CVE-2025-71296.md): drm/tests: shmem: Hold reservation lock around purge (no CVSS, Linux)
- [CVE-2026-41423](https://cve.now/CVE-2026-41423.md): Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server (CVSS 8.7, angular · @angular/platform-server)
- [CVE-2026-41161](https://cve.now/CVE-2026-41161.md): Username Enumeration via Timing Attack (CVSS 6.9, Sync-in server · @sync-in/server)
- [CVE-2022-50994](https://cve.now/CVE-2022-50994.md): DrayTek Vigor 2960 \< 1.5.1.4 OS Command Injection via mainfunction.cgi (CVSS 9.2, DrayTek Vigor)
- [CVE-2026-25199](https://cve.now/CVE-2026-25199.md): Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access (CVSS 9.1, Apache Software Foundation Apache CloudStack)
- [CVE-2026-25077](https://cve.now/CVE-2026-25077.md): Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates (CVSS 8.8, Apache Software Foundation Apache CloudStack)
- [CVE-2025-69233](https://cve.now/CVE-2025-69233.md): Apache CloudStack: Domain/account resources limits not honored (CVSS 6.5, Apache Software Foundation Apache CloudStack)
- [CVE-2025-66467](https://cve.now/CVE-2025-66467.md): Apache CloudStack: MinIO policy remains intact on bucket deletion (CVSS 8.0, Apache Software Foundation Apache CloudStack)
- [CVE-2025-66172](https://cve.now/CVE-2025-66172.md): Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to (CVSS 8.1, Apache Software Foundation Apache CloudStack)
- [CVE-2026-8077](https://cve.now/CVE-2026-8077.md): Weak credentials vulnerability in the CashDro 3 web administration panel (CVSS 8.6, CashDro 3 Administration Panel)
- [CVE-2025-66171](https://cve.now/CVE-2025-66171.md): Apache CloudStack: Any user can create a new VM from backups they should not have access to (CVSS 6.5, Apache Software Foundation Apache CloudStack)
- [CVE-2025-66170](https://cve.now/CVE-2025-66170.md): Apache CloudStack: Any user can list backups that they should not have access to (CVSS 6.5, Apache Software Foundation Apache CloudStack)
- [CVE-2026-8076](https://cve.now/CVE-2026-8076.md): Weak credentials vulnerability in the CashDro 3 web administration panel (CVSS 9.3, CashDro 3 Administration Panel)
- [CVE-2026-8153](https://cve.now/CVE-2026-8153.md): Command injection in Dashboard Server interface (CVSS 9.8, Universal Robots PolyScope)
- [CVE-2026-3318](https://cve.now/CVE-2026-3318.md): Multiple vulnerabilities in Cradle e-commerce (CVSS 5.3, Cradle e-commerce)
- [CVE-2026-7475](https://cve.now/CVE-2026-7475.md): Sky Addons \<= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script (CVSS 6.4, wowdevs Sky Addons – Elementor Addons with Widgets & Templa…)
- [CVE-2026-5341](https://cve.now/CVE-2026-5341.md): NMR Strava activities \<= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, mirceatm NMR Strava activities)
- [CVE-2026-7650](https://cve.now/CVE-2026-7650.md): E2Pdf – Export Pdf Tool for WordPress \<= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, oleksandrz E2Pdf – Export Pdf Tool for WordPress)
- [CVE-2026-6213](https://cve.now/CVE-2026-6213.md): Remote Spark SparkView RCE (CVSS 10.0, Remote Spark (https://www.remotespark.com/) SparkView)
- [CVE-2026-7330](https://cve.now/CVE-2026-7330.md): Auto Affiliate Links \<= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter (CVSS 7.2, thedark Auto Affiliate Links)
- [CVE-2026-5127](https://cve.now/CVE-2026-5127.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, wedevs User Frontend: AI Powered Frontend Posting, User Dir…)
- [CVE-2013-10075](https://cve.now/CVE-2013-10075.md): Apache::Session versions through 1.94 for Perl re-creates deleted sessions (CVSS 9.1, CHORNY Apache::Session)
- [CVE-2026-43284](https://cve.now/CVE-2026-43284.md): xfrm: esp: avoid in-place decrypt on shared skb frags (CVSS 8.8, Linux)
- [CVE-2026-44928](https://cve.now/CVE-2026-44928.md): In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. (CVSS 2.9, uriparser)
- [CVE-2026-44927](https://cve.now/CVE-2026-44927.md): In uriparser before 1.0.2, there is pointer difference truncation to int in various places. (CVSS 2.9, uriparser)
- [CVE-2026-44916](https://cve.now/CVE-2026-44916.md): In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance\_info\['ks\_template'\] is rendered without sandboxing. (CVSS 3.0, OpenStack Ironic)
- [CVE-2026-8149](https://cve.now/CVE-2026-8149.md): GCM chunking can lead to bad tag exception on decryption (CVSS 5.1, Legion of the Bouncy Castle BC-LTS · Legion of the Bounc… +1)
- [CVE-2026-4935](https://cve.now/CVE-2026-4935.md): SureTriggers \< 1.1.23 – Unauthenticated SQLi (CVSS 8.6, OttoKit: All-in-One Automation Platform)
- [CVE-2026-8069](https://cve.now/CVE-2026-8069.md): PredatorSense V3: Local Privilege Escalation (LPE) vulnerability (CVSS 8.5, Acer PredatorSense)
- [CVE-2026-8148](https://cve.now/CVE-2026-8148.md): NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\\SYSTEM via registry manipu (CVSS 7.8, NAVER MYBOX Explorer)
- [CVE-2026-8138](https://cve.now/CVE-2026-8138.md): Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflow (CVSS 8.7, Tenda CX12L)
- [CVE-2026-8137](https://cve.now/CVE-2026-8137.md): Totolink X5000R formDdns sub\_458E40 buffer overflow (CVSS 8.7, Totolink X5000R)
- [CVE-2026-42279](https://cve.now/CVE-2026-42279.md): solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID (CVSS 5.8, solidtime-io solidtime)
- [CVE-2026-42278](https://cve.now/CVE-2026-42278.md): UltraDAG: Smart Account Spending Policy Bypass via Pockets (CVSS 8.8, UltraDAGcom core)
- [CVE-2026-42277](https://cve.now/CVE-2026-42277.md): Onyx: IDOR in /chat/file/{file\_id} allows any authenticated user to download other users files (CVSS 6.5, onyx-dot-app onyx)
- [CVE-2026-42276](https://cve.now/CVE-2026-42276.md): Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions (CVSS 4.3, onyx-dot-app onyx)
- [CVE-2026-42275](https://cve.now/CVE-2026-42275.md): zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write (CVSS 8.7, openziti zrok · github.com/openziti/zrok +1)
- [CVE-2026-8136](https://cve.now/CVE-2026-8136.md): SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting (CVSS 4.8, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-42274](https://cve.now/CVE-2026-42274.md): Heimdall: Authorization bypass via path normalization mismatch (CVSS 7.8, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2026-42273](https://cve.now/CVE-2026-42273.md): Heimdall: Case-sensitive host matching may lead to policy bypass (CVSS 7.8, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2026-42272](https://cve.now/CVE-2026-42272.md): Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation (CVSS 7.8, dadrus heimdall · github.com/dadrus/heimdall)
- [CVE-2026-42208](https://cve.now/CVE-2026-42208.md): LiteLLM: SQL injection in Proxy API key verification (CVSS 9.3, KEV, BerriAI litellm · litellm)
- [CVE-2026-42203](https://cve.now/CVE-2026-42203.md): LiteLLM: Server-Side Template Injection in /prompts/test endpoint (CVSS 8.6, BerriAI litellm · litellm)
- [CVE-2026-42271](https://cve.now/CVE-2026-42271.md): LiteLLM: Authenticated command execution via MCP stdio test endpoints (CVSS 8.7, KEV, BerriAI litellm · litellm)
- [CVE-2026-44298](https://cve.now/CVE-2026-44298.md): Kimai: Arbitrary file read in invoice PDF renderer (admin) (CVSS 4.1, kimai · kimai/kimai)
- [CVE-2026-41498](https://cve.now/CVE-2026-41498.md): Kimai: Team API Missing Object-Level Authorization (CVSS 3.3, kimai · kimai/kimai)
- [CVE-2026-8133](https://cve.now/CVE-2026-8133.md): zyx0814 FilePress Shares Filelist API admin.php sql injection (CVSS 6.9, zyx0814 FilePress)
- [CVE-2026-42267](https://cve.now/CVE-2026-42267.md): Kimai: Formula Injection via tag names in XLSX export (CVSS 5.4, kimai · kimai/kimai)
- [CVE-2026-41900](https://cve.now/CVE-2026-41900.md): OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment (CVSS 8.8, th30d4y OpenLearnX · openlearnx)
- [CVE-2026-42150](https://cve.now/CVE-2026-42150.md): wlc: print\_html outputs API data without HTML escaping, enabling stored XSS (CVSS 5.1, WeblateOrg wlc · wlc)
- [CVE-2026-42264](https://cve.now/CVE-2026-42264.md): Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking (CVSS 7.4, axios)
- [CVE-2026-41645](https://cve.now/CVE-2026-41645.md): Nuclei: Environment variable disclosure via Response-Derived DSL Expressions (CVSS 5.3, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-8132](https://cve.now/CVE-2026-8132.md): CodeAstro Leave Management System login.php sql injection (CVSS 6.9, CodeAstro Leave Management System)
- [CVE-2026-41646](https://cve.now/CVE-2026-41646.md): Nuclei: Local File Read via require() Module Loader Bypass (CVSS 5.5, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2026-42261](https://cve.now/CVE-2026-42261.md): PromptHub: Authenticated SSRF via IPv6 filter bypass in \`POST /api/skills/fetch-remote\` (CVSS 7.1, legeling PromptHub)
- [CVE-2026-43944](https://cve.now/CVE-2026-43944.md): electerm: dangerous code can be run through links or command line (CVSS 9.4, electerm)
- [CVE-2026-43942](https://cve.now/CVE-2026-43942.md): electerm: Full process.env exposed to renderer via window.pre.env in electerm (CVSS 5.5, electerm)
- [CVE-2026-43941](https://cve.now/CVE-2026-43941.md): Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click (CVSS 9.6, electerm)
- [CVE-2026-8131](https://cve.now/CVE-2026-8131.md): SourceCodester SUP Online Shopping replymsg.php sql injection (CVSS 6.9, SourceCodester SUP Online Shopping)
- [CVE-2026-43940](https://cve.now/CVE-2026-43940.md): electerm: Path traversal in electerm runWidget leads to arbitrary code execution (CVSS 8.4, electerm)
- [CVE-2026-43943](https://cve.now/CVE-2026-43943.md): electerm: RCE via malicious SSH server filename in openFileWithEditor (CVSS 7.8, electerm)
- [CVE-2026-41500](https://cve.now/CVE-2026-41500.md): electerm has Command Injection Vulnerability via runMac function (CVSS 9.8, electerm)
- [CVE-2026-41501](https://cve.now/CVE-2026-41501.md): electerm has Command Injection Vulnerability via runLinux function (CVSS 9.8, electerm)
- [CVE-2026-8130](https://cve.now/CVE-2026-8130.md): SourceCodester SUP Online Shopping message.php sql injection (CVSS 6.9, SourceCodester SUP Online Shopping)
- [CVE-2026-8129](https://cve.now/CVE-2026-8129.md): SourceCodester SUP Online Shopping wishlist.php sql injection (CVSS 6.9, SourceCodester SUP Online Shopping)
- [CVE-2026-8128](https://cve.now/CVE-2026-8128.md): SourceCodester SUP Online Shopping viewmsg.php sql injection (CVSS 6.9, SourceCodester SUP Online Shopping)
- [CVE-2026-3508](https://cve.now/CVE-2026-3508.md): An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) v (CVSS 6.8, ASUS System Control Interface)
- [CVE-2026-6737](https://cve.now/CVE-2026-6737.md): An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms an (CVSS 2.0, AsusPTPFilter)
- [CVE-2026-8127](https://cve.now/CVE-2026-8127.md): eladmin Users API Endpoint UserController.java checkLevel access control (CVSS 5.3, eladmin)
- [CVE-2026-8126](https://cve.now/CVE-2026-8126.md): SourceCodester Comment System post\_comment.php sql injection (CVSS 6.9, SourceCodester Comment System)
- [CVE-2026-8125](https://cve.now/CVE-2026-8125.md): code-projects Simple Chat System sendMessage.php sql injection (CVSS 5.3, code-projects Simple Chat System)
- [CVE-2026-8124](https://cve.now/CVE-2026-8124.md): GPAC box\_code\_base.c sidx\_box\_read allocation of resources (CVSS 4.8, GPAC)
- [CVE-2026-8123](https://cve.now/CVE-2026-8123.md): Open5GS NSSF message.c ogs\_sbi\_discovery\_option\_add\_snssais denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8122](https://cve.now/CVE-2026-8122.md): Open5GS NSSF message.c ogs\_sbi\_discovery\_option\_add\_service\_names denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8121](https://cve.now/CVE-2026-8121.md): Open5GS NSSF conv.c ogs\_sbi\_parse\_plmn\_list denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8120](https://cve.now/CVE-2026-8120.md): Open5GS NSSF nnssf-handler.c denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-8119](https://cve.now/CVE-2026-8119.md): Open5GS NSSF nghttp2-server.c ogs\_sbi\_stream\_find\_by\_id denial of service (CVSS 4.8, Open5GS)
- [CVE-2022-23961](https://cve.now/CVE-2022-23961.md): In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. (CVSS 6.1)
- [CVE-2022-26522](https://cve.now/CVE-2022-26522.md): The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute (CVSS 7.8)
- [CVE-2022-26523](https://cve.now/CVE-2022-26523.md): The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute (CVSS 5.3)
- [CVE-2022-45899](https://cve.now/CVE-2022-45899.md): Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell meta (CVSS 6.5)
- [CVE-2023-42343](https://cve.now/CVE-2023-42343.md): A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. (CVSS 6.1, org.opencms:opencms-core)
- [CVE-2023-42344](https://cve.now/CVE-2023-42344.md): Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on (CVSS 7.3, org.opencms:opencms-core)
- [CVE-2023-42345](https://cve.now/CVE-2023-42345.md): A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. (CVSS 6.1, org.opencms:opencms-core)
- [CVE-2023-42346](https://cve.now/CVE-2023-42346.md): Alkacon OpenCms before 16 allows XXE when the \<!DOCTYPE\> refers to an external host. (CVSS 7.5, org.opencms:opencms-core)
- [CVE-2023-46453](https://cve.now/CVE-2023-46453.md): Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username tha (CVSS 9.8)
- [CVE-2023-47268](https://cve.now/CVE-2023-47268.md): In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host whe (CVSS 5.3)
- [CVE-2024-27686](https://cve.now/CVE-2024-27686.md): Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted (CVSS 7.5)
- [CVE-2024-30167](https://cve.now/CVE-2024-30167.md): /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P (CVSS 6.3)
- [CVE-2024-33288](https://cve.now/CVE-2024-33288.md): Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. (CVSS 7.3)
- [CVE-2024-33722](https://cve.now/CVE-2024-33722.md): SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut\[\]. (CVSS 6.3)
- [CVE-2024-33724](https://cve.now/CVE-2024-33724.md): SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe\_id parameter to process/groupe\_save.php. (CVSS 5.4)
- [CVE-2024-45257](https://cve.now/CVE-2024-45257.md): A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on th (CVSS 7.3)
- [CVE-2024-46507](https://cve.now/CVE-2024-46507.md): A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows atta (CVSS 7.3)
- [CVE-2024-46508](https://cve.now/CVE-2024-46508.md): yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI\_AUTH\_SECRET\_KEY (CVSS 7.5)
- [CVE-2024-51092](https://cve.now/CVE-2024-51092.md): LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), (CVSS 9.1, librenms/librenms)
- [CVE-2024-53326](https://cve.now/CVE-2024-53326.md): LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code e (CVSS 7.3)
- [CVE-2025-55449](https://cve.now/CVE-2025-55449.md): AstrBotDevs AstrBot 3.5.15 has Advanced\_System\_for\_Text\_Response\_and\_Bot\_Operations\_Tool as the hardcoded private key used to sign a JWT. (CVSS 7.3, astrbot)
- [CVE-2025-67886](https://cve.now/CVE-2025-67886.md): Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload (CVSS 6.3)
- [CVE-2025-67887](https://cve.now/CVE-2025-67887.md): 1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload (CVSS 9.8)
- [CVE-2025-67888](https://cve.now/CVE-2025-67888.md): An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209. (CVSS 7.3)
- [CVE-2025-69599](https://cve.now/CVE-2025-69599.md): RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. (CVSS 9.8)
- [CVE-2025-69690](https://cve.now/CVE-2025-69690.md): Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the (CVSS 9.1)
- [CVE-2025-69691](https://cve.now/CVE-2025-69691.md): Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec\_php. (CVSS 9.9)
- [CVE-2026-29972](https://cve.now/CVE-2026-29972.md): nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv\_read\_registers\_res() in nanomodbus.c. (CVSS 8.2)
- [CVE-2026-29974](https://cve.now/CVE-2026-29974.md): An issue was discovered in kosma minmea 0.3.0. (CVSS 7.5)
- [CVE-2026-29975](https://cve.now/CVE-2026-29975.md): lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson\_stream.c). (CVSS 7.5)
- [CVE-2026-34354](https://cve.now/CVE-2026-34354.md): Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. (CVSS 7.4, Akamai Guardicore Platform Agent · Akamai Zero Trust Client)
- [CVE-2026-37431](https://cve.now/CVE-2026-37431.md): Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointmen (CVSS 9.8)
- [CVE-2026-38360](https://cve.now/CVE-2026-38360.md): Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via (CVSS 9.8, dash-uploader)
- [CVE-2026-38361](https://cve.now/CVE-2026-38361.md): Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. (CVSS 7.5, dash-uploader)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.