# CVEs published 2026-05-27

714 CVEs were published on May 27, 2026: 46 critical, 250 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-4888](https://cve.now/CVE-2026-4888.md): Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder \<= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending (CVSS 4.3, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2026-46538](https://cve.now/CVE-2026-46538.md): Microsoft UFO accepts cross-device TASK\_END messages by session\_id only, allowing peer task-result injection (CVSS 5.9, microsoft UFO)
- [CVE-2026-46416](https://cve.now/CVE-2026-46416.md): Microsoft UFO shared WebSocket handler state causes cross-client response hijacking (CVSS 6.3, microsoft UFO)
- [CVE-2026-46414](https://cve.now/CVE-2026-46414.md): Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking (CVSS 8.8, microsoft UFO)
- [CVE-2026-46402](https://cve.now/CVE-2026-46402.md): Microsoft UFO uses untrusted task\_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory (CVSS 8.1, microsoft UFO)
- [CVE-2026-46544](https://cve.now/CVE-2026-46544.md): Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale task results to new authenticated requesters (CVSS 5.3, microsoft UFO)
- [CVE-2026-9739](https://cve.now/CVE-2026-9739.md): Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). (CVSS 9.4, Google MCP Toolbox for Databases · github.com/googleapis/mc…)
- [CVE-2026-45322](https://cve.now/CVE-2026-45322.md): OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON (CVSS 7.8, microsoft UFO)
- [CVE-2026-45152](https://cve.now/CVE-2026-45152.md): uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution (CVSS 7.8, uniget-org cli · gitlab.com/uniget-org/cli)
- [CVE-2026-44720](https://cve.now/CVE-2026-44720.md): OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover (CVSS 6.9, th30d4y OpenLearnX · openlearnx)
- [CVE-2026-45083](https://cve.now/CVE-2026-45083.md): Goobi viewer: Unauthenticated Solr Streaming Expression Proxy (CVSS 9.8, intranda goobi-viewer-core · io.goobi.viewer:viewer-core)
- [CVE-2026-9208](https://cve.now/CVE-2026-9208.md): Tanium addressed an unauthorized code execution vulnerability in Connect. (CVSS 8.8, Tanium Connect)
- [CVE-2026-44247](https://cve.now/CVE-2026-44247.md): Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size (CVSS 6.8, volcano-sh volcano · volcano.sh/volcano)
- [CVE-2026-45137](https://cve.now/CVE-2026-45137.md): Anchor: Program\<'info, System\> is not properly validated (CVSS 8.2, solana-foundation anchor · anchor-lang)
- [CVE-2026-45136](https://cve.now/CVE-2026-45136.md): claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh (CVSS 8.6, cnighswonger claude-code-cache-fix · claude-code-cache-fix)
- [CVE-2026-44660](https://cve.now/CVE-2026-44660.md): UltraJSON: Memory Leak in ujson.dump() on Write Failure (CVSS 8.7, ultrajson · ujson)
- [CVE-2026-44712](https://cve.now/CVE-2026-44712.md): pam\_usb: Shell injection via device UUID and username in pamusb-conf and pamusb-agent (CVSS 8.2, mcdope pam\_usb)
- [CVE-2026-44709](https://cve.now/CVE-2026-44709.md): pam\_usb: PINENTRY\_FALLBACK\_APP environment variable allows arbitrary command execution (CVSS 7.8, mcdope pam\_usb)
- [CVE-2026-44710](https://cve.now/CVE-2026-44710.md): pam\_usb: NULL pointer dereference from UDisks device fields causes PAM crash and login denial-of-service (CVSS 4.6, mcdope pam\_usb)
- [CVE-2026-44711](https://cve.now/CVE-2026-44711.md): pam\_usb: Symlink attacks on pad directory and pad files enable authentication bypass and root file corruption (CVSS 7.9, mcdope pam\_usb)
- [CVE-2026-21785](https://cve.now/CVE-2026-21785.md): HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy (CVSS 4.0, HCLSoftware BigFix Remote Control Server)
- [CVE-2026-44713](https://cve.now/CVE-2026-44713.md): pam\_usb: Command injection via $TMUX environment variable leads to RCE as root (CVSS 8.8, mcdope pam\_usb)
- [CVE-2026-47269](https://cve.now/CVE-2026-47269.md): pam\_usb: deny\_remote feature incorrectly classifies IPv4-mapped IPv6 remote connections as local (CVSS 7.4, mcdope pam\_usb)
- [CVE-2026-47270](https://cve.now/CVE-2026-47270.md): pam\_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny\_remote result (CVSS 6.3, mcdope pam\_usb)
- [CVE-2026-47271](https://cve.now/CVE-2026-47271.md): pam\_usb: OOM guards removed by -DNDEBUG cause NULL dereference and authentication process crash (CVSS 5.1, mcdope pam\_usb)
- [CVE-2026-47272](https://cve.now/CVE-2026-47272.md): pam\_usb: OTP pad authentication bypass via missing system pad check and uninitialized RNG buffer (CVSS 7.1, mcdope pam\_usb)
- [CVE-2026-47273](https://cve.now/CVE-2026-47273.md): pam\_usb: XPath injection via PAM-supplied identifiers in pam\_usb configuration queries (CVSS 6.5, mcdope pam\_usb)
- [CVE-2026-47274](https://cve.now/CVE-2026-47274.md): pam\_usb: Uncontrolled search path in pam\_usb tools allows privilege escalation via PATH manipulation (CVSS 6.3, mcdope pam\_usb)
- [CVE-2026-48064](https://cve.now/CVE-2026-48064.md): pam\_usb: PAM\_RHOST check skipped when deny\_remote=false allows XDMCP authentication bypass (CVSS 8.1, mcdope pam\_usb)
- [CVE-2026-48065](https://cve.now/CVE-2026-48065.md): pam\_usb: Unchecked integer multiplication before xmalloc() in conf.c allows heap-based buffer overflow on 32-bit targets (CVSS 6.7, mcdope pam\_usb)
- [CVE-2026-48066](https://cve.now/CVE-2026-48066.md): pam\_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authentication (CVSS 5.7, mcdope pam\_usb)
- [CVE-2026-48792](https://cve.now/CVE-2026-48792.md): pam\_usb: pusb\_has\_virtual\_input\_device() silently discards EACCES, disabling remote desktop detection under non-root execution (CVSS 4.4, mcdope pam\_usb)
- [CVE-2026-8359](https://cve.now/CVE-2026-8359.md): Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS (CVSS 7.5, Gladinet Triofox)
- [CVE-2026-8360](https://cve.now/CVE-2026-8360.md): Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS (CVSS 7.5, Gladinet Triofox)
- [CVE-2026-8361](https://cve.now/CVE-2026-8361.md): Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll (CVSS 7.5, Gladinet Triofox)
- [CVE-2026-8362](https://cve.now/CVE-2026-8362.md): Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll (CVSS 9.8, Gladinet Triofox)
- [CVE-2026-8363](https://cve.now/CVE-2026-8363.md): Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll (CVSS 9.8, Gladinet Triofox)
- [CVE-2026-8364](https://cve.now/CVE-2026-8364.md): Gladinet Triofox Missing Authentication for Critical Functions (CVSS 9.8, Gladinet Triofox)
- [CVE-2026-45134](https://cve.now/CVE-2026-45134.md): LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning (CVSS 7.1, langchain-ai langsmith-sdk · langsmith +2)
- [CVE-2026-44724](https://cve.now/CVE-2026-44724.md): systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name (CVSS 7.8, sebhildebrandt systeminformation · systeminformation)
- [CVE-2026-44590](https://cve.now/CVE-2026-44590.md): Sherlock: Command Injection via pull\_request\_target in validate\_modified\_targets.yml (CVSS 9.3, sherlock-project sherlock)
- [CVE-2026-44681](https://cve.now/CVE-2026-44681.md): Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization (CVSS 6.1, authlib)
- [CVE-2026-44886](https://cve.now/CVE-2026-44886.md): Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection (CVSS 8.7, leiweibau Pi.Alert)
- [CVE-2026-44887](https://cve.now/CVE-2026-44887.md): Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path) (CVSS 9.8, leiweibau Pi.Alert)
- [CVE-2026-44888](https://cve.now/CVE-2026-44888.md): Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger) (CVSS 9.8, leiweibau Pi.Alert)
- [CVE-2026-45108](https://cve.now/CVE-2026-45108.md): Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow (CVSS 8.4, himmelblau-idm himmelblau)
- [CVE-2026-45102](https://cve.now/CVE-2026-45102.md): OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion (CVSS 9.9, oneuptime)
- [CVE-2026-45104](https://cve.now/CVE-2026-45104.md): MapServer: NULL pointer dereference in SLD \`\<ElseFilter\>\` rule parsing reachable via WMS \`SLD\_BODY\` (CVSS 7.5, MapServer)
- [CVE-2026-42877](https://cve.now/CVE-2026-42877.md): FacturaScripts: Stored XSS via product reference in sales/purchases (CVSS 5.4, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-9759](https://cve.now/CVE-2026-9759.md): NULL Pointer Dereference in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2026-47161](https://cve.now/CVE-2026-47161.md): RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization (CVSS 8.7, inducer relate)
- [CVE-2026-42197](https://cve.now/CVE-2026-42197.md): RELATE Vulnerable to Stored XSS via Unprivileged User Profile (CVSS 8.7, inducer relate)
- [CVE-2026-42879](https://cve.now/CVE-2026-42879.md): FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images (CVSS 6.3, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-42878](https://cve.now/CVE-2026-42878.md): FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts (CVSS 5.3, NeoRazorX facturascripts · facturascripts/facturascripts)
- [CVE-2026-45046](https://cve.now/CVE-2026-45046.md): Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content (CVSS 5.5, safedep gryph · github.com/safedep/gryph)
- [CVE-2026-44635](https://cve.now/CVE-2026-44635.md): Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in \`JSONPathBuilder.key()\` / \`.at()\` (CVSS 7.5, kysely-org kysely · kysely)
- [CVE-2026-1402](https://cve.now/CVE-2026-1402.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-2601](https://cve.now/CVE-2026-2601.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-4868](https://cve.now/CVE-2026-4868.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 8.2, GitLab)
- [CVE-2026-5296](https://cve.now/CVE-2026-5296.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-6713](https://cve.now/CVE-2026-6713.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-8716](https://cve.now/CVE-2026-8716.md): Use of Incorrectly-Resolved Name or Reference in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-45088](https://cve.now/CVE-2026-45088.md): Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via \`custom-payload-file\` in Dalfox Server Mode (CVSS 7.5, hahwul dalfox · github.com/hahwul/dalfox +1)
- [CVE-2026-45087](https://cve.now/CVE-2026-45087.md): Dalfox: Unauthenticated Remote Code Execution via \`found-action\` in Dalfox Server Mode (CVSS 10.0, hahwul dalfox · github.com/hahwul/dalfox/v2 +1)
- [CVE-2026-45089](https://cve.now/CVE-2026-45089.md): Dalfox: Unauthenticated Arbitrary File Create/Append via \`output\` Option in Dalfox Server Mode (CVSS 8.2, hahwul dalfox · github.com/hahwul/dalfox +1)
- [CVE-2026-45090](https://cve.now/CVE-2026-45090.md): Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in \`ParameterAnalysis\` (server mode) (CVSS 7.5, hahwul dalfox · github.com/hahwul/dalfox +1)
- [CVE-2026-42553](https://cve.now/CVE-2026-42553.md): Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker (CVSS 7.1, cinnyapp cinny · cinny)
- [CVE-2026-5509](https://cve.now/CVE-2026-5509.md): Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200 (CVSS 8.5, TP-Link Systems Archer BE7200 · TP-Link Systems Archer BE450)
- [CVE-2026-44345](https://cve.now/CVE-2026-44345.md): BentoML: Dockerfile command injection via docker.base\_image (CVSS 8.8, BentoML)
- [CVE-2026-44346](https://cve.now/CVE-2026-44346.md): BentoML: Dockerfile command injection via envs\[\*\].name in bentofile.yaml (CVSS 8.8, BentoML)
- [CVE-2026-45081](https://cve.now/CVE-2026-45081.md): Frappe HR: Permission Bypass in HRMS Leave Details API (CVSS 6.5, frappe hrms)
- [CVE-2026-44521](https://cve.now/CVE-2026-44521.md): elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) (CVSS 8.8, Studio-42 elFinder · studio-42/elfinder)
- [CVE-2026-48147](https://cve.now/CVE-2026-48147.md): Budibase: Unanchored Regex in \`matchers.ts\` Allows CSRF Bypass via Query String Injection in Budibase Worker (CVSS 6.5, budibase · @budibase/backend-core)
- [CVE-2026-48148](https://cve.now/CVE-2026-48148.md): Budibase: Unvalidated VectorDB Host Parameter Enables SSRF (CVSS 5.3, budibase · @budibase/server)
- [CVE-2026-45548](https://cve.now/CVE-2026-45548.md): Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation (CVSS 7.7, budibase · @budibase/server)
- [CVE-2026-45715](https://cve.now/CVE-2026-45715.md): Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration (CVSS 7.7, budibase · @budibase/server)
- [CVE-2026-45716](https://cve.now/CVE-2026-45716.md): Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration (CVSS 8.8, budibase · @budibase/worker)
- [CVE-2026-45717](https://cve.now/CVE-2026-45717.md): Budibase: \`PUT /api/datasources/:datasourceId\` is protected only by \`TABLE/READ\` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL. (CVSS 8.8, budibase · @budibase/server)
- [CVE-2026-45718](https://cve.now/CVE-2026-45718.md): Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows (CVSS 5.4, budibase)
- [CVE-2026-45719](https://cve.now/CVE-2026-45719.md): Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API (CVSS 6.5, budibase · @budibase/server)
- [CVE-2026-46425](https://cve.now/CVE-2026-46425.md): Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users (CVSS 9.9, budibase)
- [CVE-2026-46424](https://cve.now/CVE-2026-46424.md): Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour (CVSS 4.2, budibase · @budibase/backend-core)
- [CVE-2026-46426](https://cve.now/CVE-2026-46426.md): Budibase: Unrestricted Upload of File with Dangerous Type (CVSS 7.6, budibase)
- [CVE-2026-46427](https://cve.now/CVE-2026-46427.md): Budibase: Snowflake private key returned unmasked from datasource API to BASIC users (CVSS 7.7, budibase)
- [CVE-2026-48128](https://cve.now/CVE-2026-48128.md): Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step (CVSS 5.1, budibase)
- [CVE-2026-48146](https://cve.now/CVE-2026-48146.md): Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection (CVSS 7.7, budibase · @budibase/server)
- [CVE-2026-4392](https://cve.now/CVE-2026-4392.md): TeamSpeak 3 Server clientek Handshake assertion (CVSS 6.9, TeamSpeak 3 Server)
- [CVE-2026-48149](https://cve.now/CVE-2026-48149.md): Budibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypass (CVSS 8.1, budibase)
- [CVE-2026-48150](https://cve.now/CVE-2026-48150.md): Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign (CVSS 9.0, budibase · @budibase/server)
- [CVE-2026-48151](https://cve.now/CVE-2026-48151.md): Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema (CVSS 7.5, budibase · @budibase/server)
- [CVE-2026-48152](https://cve.now/CVE-2026-48152.md): Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL (CVSS 8.1, budibase · @budibase/server)
- [CVE-2026-48153](https://cve.now/CVE-2026-48153.md): Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata (CVSS 8.5, budibase · @budibase/server)
- [CVE-2026-45061](https://cve.now/CVE-2026-45061.md): Budibase: SSRF via trivial \`.tar.gz\` substring bypass in Plugin URL upload (\`/api/plugin\`) (CVSS 7.7, budibase)
- [CVE-2026-4391](https://cve.now/CVE-2026-4391.md): TeamSpeak 3 Server ECC Key heap-based overflow (CVSS 6.9, TeamSpeak 3 Server)
- [CVE-2026-44460](https://cve.now/CVE-2026-44460.md): FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret (CVSS 7.4, error311 FileRise)
- [CVE-2026-45047](https://cve.now/CVE-2026-45047.md): bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding (CVSS 7.5, xddxdd bird-lg-go · github.com/xddxdd/bird-lg-go)
- [CVE-2026-44378](https://cve.now/CVE-2026-44378.md): Botan: Quadratic complexity decoding BER indefinite length encodings (CVSS 6.9, randombit botan)
- [CVE-2026-42328](https://cve.now/CVE-2026-42328.md): go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth (CVSS 6.2, go-ipld-prime · github.com/ipld/go-ipld-prime)
- [CVE-2026-4390](https://cve.now/CVE-2026-4390.md): TeamSpeak 3 Server Connection State Management process\_resend\_queue use after free (CVSS 5.3, TeamSpeak 3 Server)
- [CVE-2026-42081](https://cve.now/CVE-2026-42081.md): free5GC: UE Security Capability bypass on NGAP PathSwitchRequest (CVSS 6.1, free5gc · github.com/free5gc/amf)
- [CVE-2026-42082](https://cve.now/CVE-2026-42082.md): free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover (CVSS 3.7, free5gc · github.com/free5gc/amf)
- [CVE-2026-42083](https://cve.now/CVE-2026-42083.md): free5GC: PCF Npcf\_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI (CVSS 8.2, free5gc · github.com/free5gc/pcf)
- [CVE-2026-42459](https://cve.now/CVE-2026-42459.md): free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm (CVSS 7.7, free5gc · github.com/free5gc/udm)
- [CVE-2026-44315](https://cve.now/CVE-2026-44315.md): free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions (CVSS 9.4, free5gc · github.com/free5gc/nef)
- [CVE-2026-44316](https://cve.now/CVE-2026-44316.md): free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference (CVSS 7.5, free5gc · github.com/free5gc/pcf)
- [CVE-2026-44317](https://cve.now/CVE-2026-44317.md): free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference (CVSS 6.5, free5gc · github.com/free5gc/pcf)
- [CVE-2026-48027](https://cve.now/CVE-2026-48027.md): Compromised Nx Console version 18.95.0 (CVSS 9.3, KEV, nrwl nx-console)
- [CVE-2026-44319](https://cve.now/CVE-2026-44319.md): free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) (CVSS 7.5, free5gc · github.com/free5gc/nef)
- [CVE-2026-44320](https://cve.now/CVE-2026-44320.md): free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path (CVSS 7.3, free5gc · github.com/free5gc/nef)
- [CVE-2026-44321](https://cve.now/CVE-2026-44321.md): free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) (CVSS 7.5, free5gc · github.com/free5gc/smf)
- [CVE-2026-44322](https://cve.now/CVE-2026-44322.md): free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference (CVSS 7.5, free5gc · github.com/free5gc/nef)
- [CVE-2026-44323](https://cve.now/CVE-2026-44323.md): free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) (CVSS 4.3, free5gc · github.com/free5gc/udr)
- [CVE-2026-44324](https://cve.now/CVE-2026-44324.md): free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) (CVSS 6.5, free5gc · github.com/free5gc/udr)
- [CVE-2026-44325](https://cve.now/CVE-2026-44325.md): free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) (CVSS 7.5, free5gc · github.com/free5gc/nrf)
- [CVE-2026-44326](https://cve.now/CVE-2026-44326.md): free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions (CVSS 9.4, free5gc · github.com/free5gc/nef)
- [CVE-2026-44327](https://cve.now/CVE-2026-44327.md): free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler (CVSS 10.0, free5gc · github.com/free5gc/nef)
- [CVE-2026-44328](https://cve.now/CVE-2026-44328.md): free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating (CVSS 8.2, free5gc · github.com/free5gc/smf)
- [CVE-2026-44329](https://cve.now/CVE-2026-44329.md): free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers (CVSS 10.0, free5gc · github.com/free5gc/smf)
- [CVE-2026-44330](https://cve.now/CVE-2026-44330.md): free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions (CVSS 10.0, free5gc · github.com/free5gc/nef)
- [CVE-2026-44318](https://cve.now/CVE-2026-44318.md): free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions (CVSS 6.5, free5gc · github.com/free5gc/bsf)
- [CVE-2022-41656](https://cve.now/CVE-2022-41656.md): WordPress Account Manager for WooCommerce plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 4.3, Bizswoop Account Manager for WooCommerce)
- [CVE-2026-45335](https://cve.now/CVE-2026-45335.md): WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage (CVSS 5.4, LabRedesCefetRJ WeGIA)
- [CVE-2026-45027](https://cve.now/CVE-2026-45027.md): WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php (CVSS 5.9, LabRedesCefetRJ WeGIA)
- [CVE-2026-44483](https://cve.now/CVE-2026-44483.md): RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data) (CVSS 8.2, airjp73 rvf · @rvf set-get +1)
- [CVE-2026-44473](https://cve.now/CVE-2026-44473.md): Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse (CVSS 7.1, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-44475](https://cve.now/CVE-2026-44475.md): Ella Core: UE Security Capability bypass on NGAP PathSwitchRequest (CVSS 6.1, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-44474](https://cve.now/CVE-2026-44474.md): Ella Core: Handover failures during concurrent Security Mode Command (CVSS 3.7, ellanetworks core · github.com/ellanetworks/core)
- [CVE-2026-49054](https://cve.now/CVE-2026-49054.md): WordPress The Post Grid plugin \<= 7.9.2 - Broken Access Control vulnerability (CVSS 4.3, Mamunur Rashid The Post Grid)
- [CVE-2026-44353](https://cve.now/CVE-2026-44353.md): Streamlink: Arbitrary local file read via file:// URI in HLS and DASH (CVSS 6.5, streamlink)
- [CVE-2026-42790](https://cve.now/CVE-2026-42790.md): nameConstraints DNS bypass via subject CommonName fallback in public\_key hostname verification (CVSS 7.6, Erlang OTP)
- [CVE-2026-44839](https://cve.now/CVE-2026-44839.md): RabbitMQ: Unsanitized vhost names allow for XSS in management UI (CVSS 5.6, rabbitmq-server)
- [CVE-2026-44838](https://cve.now/CVE-2026-44838.md): RabbitMQ MQTT Topic Permission Authorization Bypass (CVSS 5.3, rabbitmq-server)
- [CVE-2026-48545](https://cve.now/CVE-2026-48545.md): Gradio \< 6.15.0 Cookie Injection via Shared Proxy Client (CVSS 7.6, gradio-app gradio · gradio)
- [CVE-2026-45570](https://cve.now/CVE-2026-45570.md): go-git: Improper single-quote escaping in go-git SSH transport (CVSS 2.3, go-git · github.com/go-git/go-git +2)
- [CVE-2026-49053](https://cve.now/CVE-2026-49053.md): WordPress ElementsKit Elementor addons Lite plugin \<= 3.9.6 - Broken Access Control vulnerability (CVSS 5.3, Wpmet ElementsKit Elementor addons Lite)
- [CVE-2026-45571](https://cve.now/CVE-2026-45571.md): go-git: Crafted repositories may modify main and submodule .git directories (CVSS 5.4, go-git · github.com/go-git/go-git/v5 +2)
- [CVE-2026-49052](https://cve.now/CVE-2026-49052.md): WordPress ElementsKit Elementor addons Lite plugin \<= 3.9.6 - Broken Access Control vulnerability (CVSS 4.3, Wpmet ElementsKit Elementor addons Lite)
- [CVE-2026-45022](https://cve.now/CVE-2026-45022.md): go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git (CVSS 7.0, go-git · github.com/go-git/go-git/v5 +1)
- [CVE-2026-49051](https://cve.now/CVE-2026-49051.md): WordPress WP Meta and Date Remover plugin \<= 2.3.6 - Broken Access Control vulnerability (CVSS 4.3, Prasad Kirpekar WP Meta and Date Remover)
- [CVE-2026-49047](https://cve.now/CVE-2026-49047.md): WordPress DearFlip plugin \<= 2.4.27 - Broken Access Control vulnerability (CVSS 4.3, DearHive DearFlip)
- [CVE-2026-49046](https://cve.now/CVE-2026-49046.md): WordPress Duplicate Page and Post plugin \<= 2.9.5 - SQL Injection vulnerability (CVSS 8.5, Arjun Thakur Duplicate Page and Post)
- [CVE-2026-44902](https://cve.now/CVE-2026-44902.md): opentelemetry-js: Prometheus exporter process crash via malformed HTTP request (CVSS 7.5, open-telemetry opentelemetry-js · @opentelemetry exporte… +5)
- [CVE-2026-49044](https://cve.now/CVE-2026-49044.md): WordPress Advanced Custom Fields: Font Awesome Field plugin \<= 5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Justin Kruit Advanced Custom Fields: Font Awesome Field)
- [CVE-2026-49045](https://cve.now/CVE-2026-49045.md): WordPress Adminimize plugin \<= 1.11.11 - Broken Access Control vulnerability (CVSS 4.3, WP Media Adminimize)
- [CVE-2026-44971](https://cve.now/CVE-2026-44971.md): GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and \`GH\_TOKEN\` exfiltration (CVSS 8.2, DataDog guarddog · guarddog)
- [CVE-2026-44972](https://cve.now/CVE-2026-44972.md): GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content (CVSS 5.0, DataDog guarddog · guarddog)
- [CVE-2026-42280](https://cve.now/CVE-2026-42280.md): Improper Permission Checking in Auth.js SDK (CVSS 7.1, auth0.js · auth0-js)
- [CVE-2026-49103](https://cve.now/CVE-2026-49103.md): Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. (CVSS 9.4, Webmin)
- [CVE-2026-48544](https://cve.now/CVE-2026-48544.md): Taipy 4.1.1 Path Traversal via ElementLibrary.get\_resource() (CVSS 8.7, Avaiga taipy · taipy)
- [CVE-2026-9712](https://cve.now/CVE-2026-9712.md): Insecure direct object reference (CVSS 3.8, pretix)
- [CVE-2026-49059](https://cve.now/CVE-2026-49059.md): WordPress Facebook for WooCommerce plugin \<= 3.7.0 - Open Redirection vulnerability (CVSS 4.7, Facebook for WooCommerce)
- [CVE-2026-49102](https://cve.now/CVE-2026-49102.md): Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/ (CVSS 6.1, Webmin)
- [CVE-2026-42184](https://cve.now/CVE-2026-42184.md): Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands (CVSS 6.1, tauri-apps tauri · tauri)
- [CVE-2026-48973](https://cve.now/CVE-2026-48973.md): WordPress SVG Support plugin \<= 2.5.14 - Broken Access Control vulnerability (CVSS 4.3, Benbodhi SVG Support)
- [CVE-2026-44988](https://cve.now/CVE-2026-44988.md): LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/stack OOB writes (CVSS 8.8, libvncserver)
- [CVE-2026-47119](https://cve.now/CVE-2026-47119.md): Agent Zero \< 1.15 Stored XSS via image\_get API Endpoint (CVSS 5.3, agent0ai agent-zero)
- [CVE-2026-6957](https://cve.now/CVE-2026-6957.md): Path traversal in Mattermost Legal Hold plugin via unsanitized file name from federated peer allows arbitrary file write. (CVSS 8.0, Mattermost)
- [CVE-2026-47118](https://cve.now/CVE-2026-47118.md): Agent Zero \< 1.15 Path Traversal File Read via image\_get API (CVSS 7.1, 3clyp50 agent-zero)
- [CVE-2026-1248](https://cve.now/CVE-2026-1248.md): IBM Business Automation Workflow information leak (CVSS 4.3, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-44830](https://cve.now/CVE-2026-44830.md): Empty API\_TOKEN disables authentication on network-reachable HTTP/SSE transport (CVSS 8.7, Dataojitori nocturne\_memory)
- [CVE-2026-9674](https://cve.now/CVE-2026-9674.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 662.vd2e0001f6b\_b\_d and earlier allows attackers to resume fail (CVSS 4.3, Jenkins Project Jenkins Multijob Plugin · org.jenkins-ci.pl…)
- [CVE-2026-48927](https://cve.now/CVE-2026-48927.md): Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL, resulting in a stored cross-site scripting (XSS) vulnerability (CVSS 5.5, Jenkins Project Jenkins buildgraph-view Plugin · org.jenkin…)
- [CVE-2026-48926](https://cve.now/CVE-2026-48926.md): Jenkins Job Import Plugin 143.v044a\_2e819b\_27 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with O (CVSS 4.3, Jenkins Project Jenkins Job Import Plugin · org.jenkins-ci.…)
- [CVE-2026-48925](https://cve.now/CVE-2026-48925.md): A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Integration Plugin 0.7.3 and earlier allows attackers to attackers to tr (CVSS 4.3, Jenkins Project Jenkins GitHub Integration Plugin · org.jen…)
- [CVE-2026-48924](https://cve.now/CVE-2026-48924.md): Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attac (CVSS 4.3, Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…)
- [CVE-2026-48923](https://cve.now/CVE-2026-48923.md): Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers (CVSS 4.3, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2026-48922](https://cve.now/CVE-2026-48922.md): Jenkins Credentials Binding Plugin 720.v3f6decef43ea\_ and earlier does not properly sanitize file names for file and zip file credentials, a (CVSS 7.5, Jenkins Project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2026-48921](https://cve.now/CVE-2026-48921.md): Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea\_a\_9b\_e45a\_0 and earlier does not prohibit symbolic links in shared libraries, allowing a (CVSS 7.5, Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin ·…)
- [CVE-2026-48920](https://cve.now/CVE-2026-48920.md): Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as \`base64\` in email content by setting the \`data-inlin (CVSS 8.8, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2026-48919](https://cve.now/CVE-2026-48919.md): Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. (CVSS 6.6, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-48918](https://cve.now/CVE-2026-48918.md): Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. (CVSS 6.6, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-48917](https://cve.now/CVE-2026-48917.md): Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation. (CVSS 6.6, Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…)
- [CVE-2026-48916](https://cve.now/CVE-2026-48916.md): Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. (CVSS 6.6, Jenkins Project Jenkins LDAP Plugin · org.jenkins-ci.plugin…)
- [CVE-2026-7876](https://cve.now/CVE-2026-7876.md): Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration (CVSS 9.1, IBM Aspera HSTS for CP4I)
- [CVE-2026-7365](https://cve.now/CVE-2026-7365.md): IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation (CVSS 8.4, IBM Operations Analytics - Log Analysis)
- [CVE-2026-9617](https://cve.now/CVE-2026-9617.md): PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k\_anonymity() function (CVSS 6.8, DALIBO PostgreSQL Anonymizer)
- [CVE-2024-56462](https://cve.now/CVE-2024-56462.md): IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVSS 7.2, IBM QRadar)
- [CVE-2024-40684](https://cve.now/CVE-2024-40684.md): IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism (CVSS 5.9, IBM Operations Analytics - Log Analysis)
- [CVE-2024-28765](https://cve.now/CVE-2024-28765.md): Security vulnerability was found in IBM Security Directory Integrator (CVSS 5.3, IBM SDI · IBM Security Directory Integrator)
- [CVE-2026-9035](https://cve.now/CVE-2026-9035.md): Multiple vulnerabilities in Aspera applications. (CVSS 6.5, IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…)
- [CVE-2026-23679](https://cve.now/CVE-2026-23679.md): libusb \< 1.0.30 NULL Pointer Dereference in parse\_interface() (CVSS 6.9, libusb)
- [CVE-2026-8405](https://cve.now/CVE-2026-8405.md): IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability (CVSS 6.5, IBM Guardium Data Protection)
- [CVE-2026-47104](https://cve.now/CVE-2026-47104.md): libusb \< 1.0.30 Out-of-Bounds Read in parse\_iad\_array() (CVSS 5.1, libusb)
- [CVE-2026-8180](https://cve.now/CVE-2026-8180.md): Multiple vulnerabilities in Aspera applications. (CVSS 7.5, IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…)
- [CVE-2026-48972](https://cve.now/CVE-2026-48972.md): WordPress SeedProd Pro plugin \< 6.19.5 - Local File Inclusion vulnerability (CVSS 7.5, SeedProd Pro)
- [CVE-2026-8179](https://cve.now/CVE-2026-8179.md): Multiple vulnerabilities in Aspera applications. (CVSS 8.8, IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…)
- [CVE-2026-8175](https://cve.now/CVE-2026-8175.md): Multiple vulnerabilities in Aspera applications. (CVSS 9.8, IBM Aspera High-Speed Transfer Endpoint · IBM Aspera High-S…)
- [CVE-2026-7528](https://cve.now/CVE-2026-7528.md): Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-7524](https://cve.now/CVE-2026-7524.md): Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-7254](https://cve.now/CVE-2026-7254.md): Open BMC Denial of Service (CVSS 5.3, IBM OPENBMC)
- [CVE-2026-6938](https://cve.now/CVE-2026-6938.md): IBM® Db2® is vulnerable to authorization bypass when uploading to a remote object storage path with a special query (CVSS 6.5, IBM Db2)
- [CVE-2026-6936](https://cve.now/CVE-2026-6936.md): IBM i is Affected by a Denial of Service Vulnerability \[\] (CVSS 6.5, IBM i)
- [CVE-2026-6053](https://cve.now/CVE-2026-6053.md): IBM® Db2® is vulnerable to a denial of service when a specially crafted query is run with range partitioned tables (CVSS 5.5, IBM Db2)
- [CVE-2026-6052](https://cve.now/CVE-2026-6052.md): IBM® Db2® is vulnerable to running out of memory when executing certain queries with MDC tables (CVSS 6.5, IBM Db2)
- [CVE-2026-6051](https://cve.now/CVE-2026-6051.md): IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a small statement heap (CVSS 5.5, IBM Db2)
- [CVE-2026-5516](https://cve.now/CVE-2026-5516.md): IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability (CVSS 4.4, IBM WebSphere Application Server - Liberty)
- [CVE-2026-46103](https://cve.now/CVE-2026-46103.md): can: ucan: fix devres lifetime (no CVSS, Linux)
- [CVE-2026-46102](https://cve.now/CVE-2026-46102.md): net: strparser: fix skb\_head leak in strp\_abort\_strp() (CVSS 7.5, Linux)
- [CVE-2026-46101](https://cve.now/CVE-2026-46101.md): netfilter: reject zero shift in nft\_bitwise (no CVSS, Linux)
- [CVE-2026-46100](https://cve.now/CVE-2026-46100.md): fs: afs: revert mmap\_prepare() change (CVSS 7.8, Linux)
- [CVE-2026-46099](https://cve.now/CVE-2026-46099.md): net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVSS 8.1, Linux)
- [CVE-2026-46098](https://cve.now/CVE-2026-46098.md): net: caif: clear client service pointer on teardown (no CVSS, Linux)
- [CVE-2026-46097](https://cve.now/CVE-2026-46097.md): Input: edt-ft5x06 - fix use-after-free in debugfs teardown (no CVSS, Linux)
- [CVE-2026-46096](https://cve.now/CVE-2026-46096.md): tpm2-sessions: Fix missing tpm\_buf\_destroy() in tpm2\_read\_public() (no CVSS, Linux)
- [CVE-2026-46095](https://cve.now/CVE-2026-46095.md): md/md-llbitmap: raise barrier before state machine transition (no CVSS, Linux)
- [CVE-2026-46094](https://cve.now/CVE-2026-46094.md): ext4: fix bounds check in check\_xattrs() to prevent out-of-bounds access (no CVSS, Linux)
- [CVE-2026-46093](https://cve.now/CVE-2026-46093.md): mm/vmalloc: take vmap\_purge\_lock in shrinker (CVSS 7.8, Linux)
- [CVE-2026-46092](https://cve.now/CVE-2026-46092.md): wifi: rtw88: check for PCI upstream bridge existence (no CVSS, Linux)
- [CVE-2026-46091](https://cve.now/CVE-2026-46091.md): media: rc: igorplugusb: heed coherency rules (no CVSS, Linux)
- [CVE-2026-46090](https://cve.now/CVE-2026-46090.md): ALSA: aloop: Fix peer runtime UAF during format-change stop (CVSS 7.8, Linux)
- [CVE-2026-46089](https://cve.now/CVE-2026-46089.md): zram: do not forget to endio for partial discard requests (no CVSS, Linux)
- [CVE-2026-46088](https://cve.now/CVE-2026-46088.md): ALSA: control: Validate buf\_len before strnlen() in snd\_ctl\_elem\_init\_enum\_names() (no CVSS, Linux)
- [CVE-2026-46087](https://cve.now/CVE-2026-46087.md): mm/damon/stat: fix memory leak on damon\_start() failure in damon\_stat\_start() (no CVSS, Linux)
- [CVE-2026-46086](https://cve.now/CVE-2026-46086.md): net: bridge: use a stable FDB dst snapshot in RCU readers (no CVSS, Linux)
- [CVE-2026-46085](https://cve.now/CVE-2026-46085.md): rxrpc: Fix rxkad crypto unalignment handling (CVSS 7.5, Linux)
- [CVE-2026-46084](https://cve.now/CVE-2026-46084.md): RDMA/mana\_ib: Disable RX steering on RSS QP destroy (no CVSS, Linux)
- [CVE-2026-46083](https://cve.now/CVE-2026-46083.md): spi: fix resource leaks on device setup failure (no CVSS, Linux)
- [CVE-2026-46082](https://cve.now/CVE-2026-46082.md): KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (no CVSS, Linux)
- [CVE-2026-46081](https://cve.now/CVE-2026-46081.md): crypto: acomp - fix wrong pointer stored by acomp\_save\_req() (CVSS 7.8, Linux)
- [CVE-2026-46080](https://cve.now/CVE-2026-46080.md): ocfs2: split transactions in dio completion to avoid credit exhaustion (no CVSS, Linux)
- [CVE-2026-46079](https://cve.now/CVE-2026-46079.md): rbd: fix null-ptr-deref when device\_add\_disk() fails (no CVSS, Linux)
- [CVE-2026-5515](https://cve.now/CVE-2026-5515.md): IBM App Connect Enterprise is vulnerable to a confidential disclosure (CVSS 5.5, IBM App Connect Enterprise)
- [CVE-2026-46078](https://cve.now/CVE-2026-46078.md): erofs: fix the out-of-bounds nameoff handling for trailing dirents (CVSS 7.1, Linux)
- [CVE-2026-46077](https://cve.now/CVE-2026-46077.md): crypto: atmel-tdes - fix DMA sync direction (no CVSS, Linux)
- [CVE-2026-46076](https://cve.now/CVE-2026-46076.md): KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVSS 7.9, Linux)
- [CVE-2026-46075](https://cve.now/CVE-2026-46075.md): crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (no CVSS, Linux)
- [CVE-2026-46074](https://cve.now/CVE-2026-46074.md): spi: ch341: fix memory leaks on probe failures (no CVSS, Linux)
- [CVE-2026-46073](https://cve.now/CVE-2026-46073.md): hwmon: (powerz) Fix missing usb\_kill\_urb() on signal interrupt (no CVSS, Linux)
- [CVE-2026-46072](https://cve.now/CVE-2026-46072.md): ntfs3: add buffer boundary checks to run\_unpack() (no CVSS, Linux)
- [CVE-2026-46071](https://cve.now/CVE-2026-46071.md): KVM: nSVM: Avoid clearing VMCB\_LBR in vmcb12 (no CVSS, Linux)
- [CVE-2026-46070](https://cve.now/CVE-2026-46070.md): md/raid5: validate payload size before accessing journal metadata (CVSS 7.1, Linux)
- [CVE-2026-46069](https://cve.now/CVE-2026-46069.md): wifi: mwifiex: fix use-after-free in mwifiex\_adapter\_cleanup() (no CVSS, Linux)
- [CVE-2026-46068](https://cve.now/CVE-2026-46068.md): crypto: nx - fix bounce buffer leaks in nx842\_crypto\_{alloc,free}\_ctx (no CVSS, Linux)
- [CVE-2026-46067](https://cve.now/CVE-2026-46067.md): mm/damon/core: validate damos\_quota\_goal-\>nid for node\_memcg\_{used,free}\_bp (no CVSS, Linux)
- [CVE-2026-46066](https://cve.now/CVE-2026-46066.md): ceph: fix num\_ops off-by-one when crypto allocation fails (no CVSS, Linux)
- [CVE-2026-46065](https://cve.now/CVE-2026-46065.md): fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb\_info (CVSS 7.8, Linux)
- [CVE-2026-46064](https://cve.now/CVE-2026-46064.md): ibmasm: fix heap over-read in ibmasm\_send\_i2o\_message() (no CVSS, Linux)
- [CVE-2026-46063](https://cve.now/CVE-2026-46063.md): x86/shstk: Prevent deadlock during shstk sigreturn (no CVSS, Linux)
- [CVE-2026-46062](https://cve.now/CVE-2026-46062.md): ntfs3: fix integer overflow in run\_unpack() volume boundary check (CVSS 7.8, Linux)
- [CVE-2026-46061](https://cve.now/CVE-2026-46061.md): jbd2: fix deadlock in jbd2\_journal\_cancel\_revoke() (no CVSS, Linux)
- [CVE-2026-46060](https://cve.now/CVE-2026-46060.md): crypto: qat - fix IRQ cleanup on 6xxx probe failure (no CVSS, Linux)
- [CVE-2026-46059](https://cve.now/CVE-2026-46059.md): KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (no CVSS, Linux)
- [CVE-2026-46058](https://cve.now/CVE-2026-46058.md): media: amphion: Fix race between m2m job\_abort and device\_run (CVSS 7.8, Linux)
- [CVE-2026-46057](https://cve.now/CVE-2026-46057.md): landlock: Fix LOG\_SUBDOMAINS\_OFF inheritance across fork() (no CVSS, Linux)
- [CVE-2026-46056](https://cve.now/CVE-2026-46056.md): Bluetooth: hci\_event: fix potential UAF in SSP passkey handlers (CVSS 8.8, Linux)
- [CVE-2026-46055](https://cve.now/CVE-2026-46055.md): apparmor: Fix string overrun due to missing termination (CVSS 7.1, Linux)
- [CVE-2026-46054](https://cve.now/CVE-2026-46054.md): selinux: fix overlayfs mmap() and mprotect() access checks (CVSS 7.1, Linux)
- [CVE-2026-46053](https://cve.now/CVE-2026-46053.md): net: rds: fix MR cleanup on copy error (CVSS 7.8, Linux)
- [CVE-2026-46052](https://cve.now/CVE-2026-46052.md): ceph: only d\_add() negative dentries when they are unhashed (CVSS 7.5, Linux)
- [CVE-2026-46051](https://cve.now/CVE-2026-46051.md): md/raid5: fix soft lockup in retry\_aligned\_read() (no CVSS, Linux)
- [CVE-2026-46050](https://cve.now/CVE-2026-46050.md): md/raid10: fix deadlock with check operation and nowait requests (no CVSS, Linux)
- [CVE-2026-46049](https://cve.now/CVE-2026-46049.md): ALSA: ctxfi: Add fallback to default RSR for S/PDIF (no CVSS, Linux)
- [CVE-2026-46048](https://cve.now/CVE-2026-46048.md): ALSA: caiaq: fix usb\_dev refcount leak on probe failure (no CVSS, Linux)
- [CVE-2026-46047](https://cve.now/CVE-2026-46047.md): net: qrtr: ns: Fix use-after-free in driver remove() (no CVSS, Linux)
- [CVE-2026-46046](https://cve.now/CVE-2026-46046.md): ext4: fix missing brelse() in ext4\_xattr\_inode\_dec\_ref\_all() (no CVSS, Linux)
- [CVE-2026-46045](https://cve.now/CVE-2026-46045.md): md/md-llbitmap: skip reading rdevs that are not in\_sync (no CVSS, Linux)
- [CVE-2026-46044](https://cve.now/CVE-2026-46044.md): ipmi:ssif: Clean up kthread on errors (no CVSS, Linux)
- [CVE-2026-46043](https://cve.now/CVE-2026-46043.md): RDMA/rxe: Validate pad and ICRC before payload\_size() in rxe\_rcv (CVSS 9.1, Linux)
- [CVE-2026-46042](https://cve.now/CVE-2026-46042.md): mm/mempolicy: fix memory leaks in weighted\_interleave\_auto\_store() (no CVSS, Linux)
- [CVE-2026-5065](https://cve.now/CVE-2026-5065.md): IBM Controller is affected by vulnerabilities (CVSS 8.8, IBM Controller)
- [CVE-2026-46041](https://cve.now/CVE-2026-46041.md): greybus: gb-beagleplay: fix sleep in atomic context in hdlc\_tx\_frames() (no CVSS, Linux)
- [CVE-2026-46040](https://cve.now/CVE-2026-46040.md): inotify: fix watch count leak when fsnotify\_add\_inode\_mark\_locked() fails (no CVSS, Linux)
- [CVE-2026-46039](https://cve.now/CVE-2026-46039.md): rxgk: Fix potential integer overflow in length check (CVSS 9.8, Linux)
- [CVE-2026-46038](https://cve.now/CVE-2026-46038.md): net: qrtr: ns: Free the node during ctrl\_cmd\_bye() (no CVSS, Linux)
- [CVE-2026-46037](https://cve.now/CVE-2026-46037.md): ipv4: icmp: validate reply type before using icmp\_pointers (CVSS 8.2, Linux)
- [CVE-2026-46036](https://cve.now/CVE-2026-46036.md): vfio/cdx: Serialize VFIO\_DEVICE\_SET\_IRQS with a per-device mutex (CVSS 7.8, Linux)
- [CVE-2026-46035](https://cve.now/CVE-2026-46035.md): mm/page\_alloc: return NULL early from alloc\_frozen\_pages\_nolock() in NMI on UP (no CVSS, Linux)
- [CVE-2026-46034](https://cve.now/CVE-2026-46034.md): vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (no CVSS, Linux)
- [CVE-2026-46033](https://cve.now/CVE-2026-46033.md): crypto: authencesn - reject short ahash digests during instance creation (CVSS 7.1, Linux)
- [CVE-2026-46032](https://cve.now/CVE-2026-46032.md): KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT (no CVSS, Linux)
- [CVE-2026-46031](https://cve.now/CVE-2026-46031.md): net: ks8851: Reinstate disabling of BHs around IRQ handler (CVSS 7.5, Linux)
- [CVE-2026-46030](https://cve.now/CVE-2026-46030.md): EDAC/versalnet: Fix device\_node leak in mc\_probe() (no CVSS, Linux)
- [CVE-2026-46029](https://cve.now/CVE-2026-46029.md): mm/slab: return NULL early from kmalloc\_nolock() in NMI on UP (CVSS 7.0, Linux)
- [CVE-2026-46028](https://cve.now/CVE-2026-46028.md): crypto: algif\_aead - snapshot IV for async AEAD requests (no CVSS, Linux)
- [CVE-2026-46027](https://cve.now/CVE-2026-46027.md): net/smc: avoid early lgr access in smc\_clc\_wait\_msg (CVSS 7.5, Linux)
- [CVE-2026-46026](https://cve.now/CVE-2026-46026.md): net: qrtr: ns: Limit the maximum number of lookups (no CVSS, Linux)
- [CVE-2026-46025](https://cve.now/CVE-2026-46025.md): mm/damon/core: fix damon\_call() vs kdamond\_fn() exit race (no CVSS, Linux)
- [CVE-2026-46024](https://cve.now/CVE-2026-46024.md): libceph: Prevent potential null-ptr-deref in ceph\_handle\_auth\_reply() (CVSS 7.5, Linux)
- [CVE-2026-46023](https://cve.now/CVE-2026-46023.md): dm mirror: fix integer overflow in create\_dirty\_log() (no CVSS, Linux)
- [CVE-2026-46022](https://cve.now/CVE-2026-46022.md): misc: ibmasm: fix OOB MMIO read in ibmasm\_handle\_mouse\_interrupt() (no CVSS, Linux)
- [CVE-2026-46021](https://cve.now/CVE-2026-46021.md): thermal: core: Fix thermal zone governor cleanup issues (no CVSS, Linux)
- [CVE-2026-46020](https://cve.now/CVE-2026-46020.md): mm/damon/core: validate damos\_quota\_goal-\>nid for node\_mem\_{used,free}\_bp (no CVSS, Linux)
- [CVE-2026-46019](https://cve.now/CVE-2026-46019.md): crypto: atmel-aes - Fix 3-page memory leak in atmel\_aes\_buff\_cleanup (no CVSS, Linux)
- [CVE-2026-46018](https://cve.now/CVE-2026-46018.md): ALSA: usb-audio: stop parsing UAC2 rates at MAX\_NR\_RATES (no CVSS, Linux)
- [CVE-2026-46017](https://cve.now/CVE-2026-46017.md): mm: fix deferred split queue races during migration (no CVSS, Linux)
- [CVE-2026-46016](https://cve.now/CVE-2026-46016.md): remoteproc: xlnx: Only access buffer information if IPI is buffered (no CVSS, Linux)
- [CVE-2026-46015](https://cve.now/CVE-2026-46015.md): tcp: call sk\_data\_ready() after listener migration (CVSS 7.8, Linux)
- [CVE-2026-46014](https://cve.now/CVE-2026-46014.md): KVM: SVM: Add missing save/restore handling of LBR MSRs (no CVSS, Linux)
- [CVE-2026-46013](https://cve.now/CVE-2026-46013.md): mm/memfd\_luo: fix physical address conversion in put\_folios cleanup (no CVSS, Linux)
- [CVE-2026-46012](https://cve.now/CVE-2026-46012.md): rxrpc: Fix memory leaks in rxkad\_verify\_response() (no CVSS, Linux)
- [CVE-2026-46011](https://cve.now/CVE-2026-46011.md): media: mtk-jpeg: fix use-after-free in release path due to uncancelled work (CVSS 7.8, Linux)
- [CVE-2026-46010](https://cve.now/CVE-2026-46010.md): rxrpc: Fix error handling in rxgk\_extract\_token() (CVSS 8.1, Linux)
- [CVE-2026-46009](https://cve.now/CVE-2026-46009.md): PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown (no CVSS, Linux)
- [CVE-2026-46008](https://cve.now/CVE-2026-46008.md): mm/damon/core: fix damos\_walk() vs kdamond\_fn() exit race (no CVSS, Linux)
- [CVE-2026-46007](https://cve.now/CVE-2026-46007.md): hwmon: (powerz) Avoid cacheline sharing for DMA buffer (no CVSS, Linux)
- [CVE-2026-46006](https://cve.now/CVE-2026-46006.md): drm/nouveau: fix u32 overflow in pushbuf reloc bounds check (CVSS 7.8, Linux)
- [CVE-2026-46005](https://cve.now/CVE-2026-46005.md): xfs: fix a resource leak in xfs\_alloc\_buftarg() (no CVSS, Linux)
- [CVE-2026-46004](https://cve.now/CVE-2026-46004.md): ALSA: caiaq: Handle probe errors properly (no CVSS, Linux)
- [CVE-2026-9704](https://cve.now/CVE-2026-9704.md): Keycloak: keycloak: privilege escalation due to oversized subject\_token jwt (CVSS 6.8, Red Hat build of Keycloak · org.keycloak:keycloak-server… +1)
- [CVE-2026-46003](https://cve.now/CVE-2026-46003.md): net: qrtr: ns: Limit the total number of nodes (no CVSS, Linux)
- [CVE-2026-46002](https://cve.now/CVE-2026-46002.md): ext2: reject inodes with zero i\_nlink and valid mode in ext2\_iget() (no CVSS, Linux)
- [CVE-2026-46001](https://cve.now/CVE-2026-46001.md): hwmon: (pt5161l) Fix bugs in pt5161l\_read\_block\_data() (no CVSS, Linux)
- [CVE-2026-46000](https://cve.now/CVE-2026-46000.md): rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (no CVSS, Linux)
- [CVE-2026-45999](https://cve.now/CVE-2026-45999.md): erofs: fix unsigned underflow in z\_erofs\_lz4\_handle\_overlap() (CVSS 7.1, Linux)
- [CVE-2026-45998](https://cve.now/CVE-2026-45998.md): rxrpc: Fix potential UAF after skb\_unshare() failure (CVSS 7.0, Linux)
- [CVE-2026-45997](https://cve.now/CVE-2026-45997.md): scsi: sd: fix missing put\_disk() when device\_add(&disk\_dev) fails (no CVSS, Linux)
- [CVE-2026-45996](https://cve.now/CVE-2026-45996.md): spi: imx: fix use-after-free on unbind (no CVSS, Linux)
- [CVE-2026-45995](https://cve.now/CVE-2026-45995.md): io\_uring/zcrx: fix user\_struct uaf (no CVSS, Linux)
- [CVE-2026-45994](https://cve.now/CVE-2026-45994.md): ibmasm: fix OOB reads in command\_file\_write due to missing size checks (no CVSS, Linux)
- [CVE-2026-45993](https://cve.now/CVE-2026-45993.md): LoongArch: Add spectre boundry for syscall dispatch table (no CVSS, Linux)
- [CVE-2026-45991](https://cve.now/CVE-2026-45991.md): udf: fix partition descriptor append bookkeeping (CVSS 7.8, Linux)
- [CVE-2026-45990](https://cve.now/CVE-2026-45990.md): slub: fix data loss and overflow in krealloc() (no CVSS, Linux)
- [CVE-2026-45989](https://cve.now/CVE-2026-45989.md): of: unittest: fix use-after-free in testdrv\_probe() (no CVSS, Linux)
- [CVE-2026-45988](https://cve.now/CVE-2026-45988.md): rxrpc: Fix re-decryption of RESPONSE packets (CVSS 9.8, Linux)
- [CVE-2026-45987](https://cve.now/CVE-2026-45987.md): KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (no CVSS, Linux)
- [CVE-2026-45986](https://cve.now/CVE-2026-45986.md): crypto: ccree - fix a memory leak in cc\_mac\_digest() (no CVSS, Linux)
- [CVE-2026-4410](https://cve.now/CVE-2026-4410.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVSS 4.8, IBM WebSphere Application Server - Liberty · IBM WebSphere…)
- [CVE-2026-3676](https://cve.now/CVE-2026-3676.md): There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products. (CVSS 6.5, IBM Cloud APM, Base Private · IBM Cloud APM, Advanced Priva…)
- [CVE-2026-3623](https://cve.now/CVE-2026-3623.md): Vulnerabilities exists in IBM Netezza Performance Server Replication Services (CVSS 7.8, IBM Netezza Performance Server Replication Services)
- [CVE-2026-35090](https://cve.now/CVE-2026-35090.md): Authentication Bypass in Slican telephone exchanges (CVSS 9.3, Slican CCT-1668 · Slican MAC-6400 +3)
- [CVE-2026-35089](https://cve.now/CVE-2026-35089.md): Use of Weak Credentials in Slican telephone exchanges (CVSS 8.7, Slican IPx · Slican CCT-1668 +2)
- [CVE-2026-35087](https://cve.now/CVE-2026-35087.md): Authentication Bypass in Slican telephone exchanges (CVSS 9.3, Slican IPx · Slican CCT-1668 +3)
- [CVE-2026-1933](https://cve.now/CVE-2026-1933.md): Samba: missing access check on reparse point operations (CVSS 7.1, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-3366](https://cve.now/CVE-2026-3366.md): InfoSphere Optim Test Data Fabrication is affected by Arbitrary File Read (CVSS 7.5, IBM InfoSphere Optim Test Data Fabrication)
- [CVE-2025-71312](https://cve.now/CVE-2025-71312.md): fs/ntfs3: fix ntfs\_mount\_options leak in ntfs\_fill\_super() (no CVSS, Linux)
- [CVE-2025-71311](https://cve.now/CVE-2025-71311.md): fs/ntfs3: Initialize new folios before use (CVSS 8.2, Linux)
- [CVE-2026-42791](https://cve.now/CVE-2026-42791.md): OCSP responder certificate validity period not checked in public\_key (CVSS 6.3, Erlang OTP)
- [CVE-2026-42789](https://cve.now/CVE-2026-42789.md): Non-CA certificate accepted as intermediate issuer in public\_key path validation (CVSS 7.0, Erlang OTP)
- [CVE-2026-2607](https://cve.now/CVE-2026-2607.md): Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (CVSS 5.1, IBM MQ Operator · IBM supplied MQ Advanced container images)
- [CVE-2026-45985](https://cve.now/CVE-2026-45985.md): ext4: don't set EXT4\_GET\_BLOCKS\_CONVERT when splitting before submitting I/O (no CVSS, Linux)
- [CVE-2026-45984](https://cve.now/CVE-2026-45984.md): gfs2: Fix use-after-free in iomap inline data write path (CVSS 7.8, Linux)
- [CVE-2026-45983](https://cve.now/CVE-2026-45983.md): nfsd: never defer requests during idmap lookup (no CVSS, Linux)
- [CVE-2026-45982](https://cve.now/CVE-2026-45982.md): ACPICA: Fix NULL pointer dereference in acpi\_ev\_address\_space\_dispatch() (no CVSS, Linux)
- [CVE-2026-1718](https://cve.now/CVE-2026-1718.md): IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure (CVSS 7.1, IBM Db2)
- [CVE-2026-45981](https://cve.now/CVE-2026-45981.md): s390/cio: Fix device lifecycle handling in css\_alloc\_subchannel() (no CVSS, Linux)
- [CVE-2026-45980](https://cve.now/CVE-2026-45980.md): accel/amdxdna: Stop job scheduling across aie2\_release\_resource() (CVSS 7.8, Linux)
- [CVE-2026-45979](https://cve.now/CVE-2026-45979.md): drm/amdgpu: clean up the amdgpu\_cs\_parser\_bos (no CVSS, Linux)
- [CVE-2026-45978](https://cve.now/CVE-2026-45978.md): staging: greybus: lights: avoid NULL deref (no CVSS, Linux)
- [CVE-2026-45977](https://cve.now/CVE-2026-45977.md): fbnic: close fw\_log race between users and teardown (no CVSS, Linux)
- [CVE-2026-45976](https://cve.now/CVE-2026-45976.md): drm/amdgpu: Fix memory leak in amdgpu\_ras\_init() (no CVSS, Linux)
- [CVE-2026-45975](https://cve.now/CVE-2026-45975.md): ublk: use READ\_ONCE() to read struct ublksrv\_ctrl\_cmd (no CVSS, Linux)
- [CVE-2026-45974](https://cve.now/CVE-2026-45974.md): btrfs: fix invalid leaf access in btrfs\_quota\_enable() if ref key not found (no CVSS, Linux)
- [CVE-2026-45973](https://cve.now/CVE-2026-45973.md): RDMA/mlx5: Fix UMR hang in LAG error state unload (no CVSS, Linux)
- [CVE-2026-45972](https://cve.now/CVE-2026-45972.md): smb: client: fix potential UAF and double free in smb2\_open\_file() (CVSS 9.8, Linux)
- [CVE-2026-45971](https://cve.now/CVE-2026-45971.md): bpf: Limit bpf program signature size (no CVSS, Linux)
- [CVE-2026-45970](https://cve.now/CVE-2026-45970.md): bonding: alb: fix UAF in rlb\_arp\_recv during bond up/down (CVSS 7.8, Linux)
- [CVE-2026-45969](https://cve.now/CVE-2026-45969.md): HID: playstation: Add missing check for input\_ff\_create\_memless (no CVSS, Linux)
- [CVE-2026-45968](https://cve.now/CVE-2026-45968.md): cpuidle: Skip governor when only one idle state is available (no CVSS, Linux)
- [CVE-2026-45967](https://cve.now/CVE-2026-45967.md): bpf: Return proper address for non-zero offsets in insn array (no CVSS, Linux)
- [CVE-2026-45966](https://cve.now/CVE-2026-45966.md): apparmor: fix NULL pointer dereference in \_\_unix\_needs\_revalidation (no CVSS, Linux)
- [CVE-2026-45965](https://cve.now/CVE-2026-45965.md): apparmor: fix invalid deref of rawdata when export\_binary is unset (no CVSS, Linux)
- [CVE-2026-45964](https://cve.now/CVE-2026-45964.md): SUNRPC: fix gss\_auth kref leak in gss\_alloc\_msg error path (no CVSS, Linux)
- [CVE-2026-45963](https://cve.now/CVE-2026-45963.md): ASoC: nau8821: Cancel delayed work on component remove (no CVSS, Linux)
- [CVE-2026-45962](https://cve.now/CVE-2026-45962.md): ublk: Validate SQE128 flag before accessing the cmd (no CVSS, Linux)
- [CVE-2026-45961](https://cve.now/CVE-2026-45961.md): gfs2: fix memory leaks in gfs2\_fill\_super error path (no CVSS, Linux)
- [CVE-2026-45960](https://cve.now/CVE-2026-45960.md): hfsplus: return error when node already exists in hfs\_bnode\_create (no CVSS, Linux)
- [CVE-2026-45959](https://cve.now/CVE-2026-45959.md): crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVSS 7.8, Linux)
- [CVE-2026-45958](https://cve.now/CVE-2026-45958.md): drm/exynos: vidi: fix to avoid directly dereferencing user pointer (CVSS 7.1, Linux)
- [CVE-2026-45957](https://cve.now/CVE-2026-45957.md): rcu: Fix rcu\_read\_unlock() deadloop due to softirq (no CVSS, Linux)
- [CVE-2026-45956](https://cve.now/CVE-2026-45956.md): drm/exynos: vidi: use priv-\>vidi\_dev for ctx lookup in vidi\_connection\_ioctl() (CVSS 7.8, Linux)
- [CVE-2026-45955](https://cve.now/CVE-2026-45955.md): md/md-llbitmap: fix percpu\_ref not resurrected on suspend timeout (CVSS 7.1, Linux)
- [CVE-2026-45954](https://cve.now/CVE-2026-45954.md): fbdev: au1200fb: Fix a memory leak in au1200fb\_drv\_probe() (no CVSS, Linux)
- [CVE-2026-45953](https://cve.now/CVE-2026-45953.md): md/raid5: fix IO hang with degraded array with llbitmap (no CVSS, Linux)
- [CVE-2026-45952](https://cve.now/CVE-2026-45952.md): eth: fbnic: Add validation for MTU changes (no CVSS, Linux)
- [CVE-2026-45951](https://cve.now/CVE-2026-45951.md): bpf: Fix a potential use-after-free of BTF object (CVSS 7.8, Linux)
- [CVE-2026-45950](https://cve.now/CVE-2026-45950.md): crypto: starfive - Fix memory leak in starfive\_aes\_aead\_do\_one\_req() (no CVSS, Linux)
- [CVE-2026-45949](https://cve.now/CVE-2026-45949.md): hwrng: core - use RCU and work\_struct to fix race condition (no CVSS, Linux)
- [CVE-2026-45948](https://cve.now/CVE-2026-45948.md): ext4: fix memory leak in ext4\_ext\_shift\_extents() (no CVSS, Linux)
- [CVE-2026-45947](https://cve.now/CVE-2026-45947.md): drm/amdgpu: Fix memory leak in amdgpu\_acpi\_enumerate\_xcc() (no CVSS, Linux)
- [CVE-2026-45946](https://cve.now/CVE-2026-45946.md): power: supply: ab8500: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45945](https://cve.now/CVE-2026-45945.md): iommu/vt-d: Fix race condition during PASID entry replacement (CVSS 8.8, Linux)
- [CVE-2026-45944](https://cve.now/CVE-2026-45944.md): iommu/vt-d: Clear Present bit before tearing down context entry (CVSS 7.5, Linux)
- [CVE-2026-45943](https://cve.now/CVE-2026-45943.md): erofs: fix inline data read failure for ztailpacking pclusters (no CVSS, Linux)
- [CVE-2026-45942](https://cve.now/CVE-2026-45942.md): ext4: fix e4b bitmap inconsistency reports (CVSS 7.8, Linux)
- [CVE-2026-45941](https://cve.now/CVE-2026-45941.md): tpm: tpm\_i2c\_infineon: Fix locality leak on get\_burstcount() failure (no CVSS, Linux)
- [CVE-2026-45940](https://cve.now/CVE-2026-45940.md): net: stmmac: fix oops when split header is enabled (no CVSS, Linux)
- [CVE-2026-45939](https://cve.now/CVE-2026-45939.md): gpib: Fix memory leak in ni\_usb\_init() (no CVSS, Linux)
- [CVE-2026-45938](https://cve.now/CVE-2026-45938.md): power: supply: pm8916\_lbc: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45937](https://cve.now/CVE-2026-45937.md): crypto: inside-secure/eip93 - fix kernel panic in driver detach (no CVSS, Linux)
- [CVE-2026-45936](https://cve.now/CVE-2026-45936.md): power: supply: goldfish: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45935](https://cve.now/CVE-2026-45935.md): fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot (CVSS 7.8, Linux)
- [CVE-2026-45934](https://cve.now/CVE-2026-45934.md): btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation (no CVSS, Linux)
- [CVE-2026-45933](https://cve.now/CVE-2026-45933.md): bpf: Preserve id of register in sync\_linked\_regs() (CVSS 7.8, Linux)
- [CVE-2026-45932](https://cve.now/CVE-2026-45932.md): bpf: Fix tcx/netkit detach permissions when prog fd isn't given (CVSS 7.3, Linux)
- [CVE-2026-45931](https://cve.now/CVE-2026-45931.md): accel/amdxdna: Hold mm structure across iommu\_sva\_unbind\_device() (CVSS 7.8, Linux)
- [CVE-2026-45930](https://cve.now/CVE-2026-45930.md): net: mctp: ensure our nlmsg responses are initialised (no CVSS, Linux)
- [CVE-2026-45929](https://cve.now/CVE-2026-45929.md): ovpn: fix possible use-after-free in ovpn\_net\_xmit (CVSS 7.8, Linux)
- [CVE-2026-45928](https://cve.now/CVE-2026-45928.md): media: chips-media: wave5: Fix memory leak on codec\_info allocation failure (no CVSS, Linux)
- [CVE-2026-45927](https://cve.now/CVE-2026-45927.md): bpf: Require frozen map for calculating map hash (no CVSS, Linux)
- [CVE-2026-45926](https://cve.now/CVE-2026-45926.md): rust: pwm: Fix potential memory leak on init error (no CVSS, Linux)
- [CVE-2026-45925](https://cve.now/CVE-2026-45925.md): thermal/of: Fix reference leak in thermal\_of\_cm\_lookup() (no CVSS, Linux)
- [CVE-2026-45924](https://cve.now/CVE-2026-45924.md): ksmbd: call ksmbd\_vfs\_kern\_path\_end\_removing() on some error paths (no CVSS, Linux)
- [CVE-2026-45923](https://cve.now/CVE-2026-45923.md): net: usb: catc: enable basic endpoint checking (no CVSS, Linux)
- [CVE-2026-45922](https://cve.now/CVE-2026-45922.md): RDMA/mlx5: Fix memory leak in GET\_DATA\_DIRECT\_SYSFS\_PATH handler (no CVSS, Linux)
- [CVE-2026-45921](https://cve.now/CVE-2026-45921.md): mtd: parsers: Fix memory leak in mtd\_parser\_tplink\_safeloader\_parse() (no CVSS, Linux)
- [CVE-2026-45920](https://cve.now/CVE-2026-45920.md): ext4: fix dirtyclusters double decrement on fs shutdown (no CVSS, Linux)
- [CVE-2026-45919](https://cve.now/CVE-2026-45919.md): sched/rt: Skip currently executing CPU in rto\_next\_cpu() (no CVSS, Linux)
- [CVE-2026-45918](https://cve.now/CVE-2026-45918.md): ovpn: tcp - don't deref NULL sk\_socket member after tcp\_close() (no CVSS, Linux)
- [CVE-2026-45917](https://cve.now/CVE-2026-45917.md): ipvs: do not keep dest\_dst if dev is going down (no CVSS, Linux)
- [CVE-2026-45916](https://cve.now/CVE-2026-45916.md): power: supply: sbs-battery: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45915](https://cve.now/CVE-2026-45915.md): fat: avoid parent link count underflow in rmdir (no CVSS, Linux)
- [CVE-2026-45914](https://cve.now/CVE-2026-45914.md): Revert "hwmon: (ibmpex) fix use-after-free in high/low store" (no CVSS, Linux)
- [CVE-2026-45913](https://cve.now/CVE-2026-45913.md): net: bridge: mcast: always update mdb\_n\_entries for vlan contexts (no CVSS, Linux)
- [CVE-2026-45912](https://cve.now/CVE-2026-45912.md): ext4: don't cache extent during splitting extent (no CVSS, Linux)
- [CVE-2026-45911](https://cve.now/CVE-2026-45911.md): usb: cdns3: fix role switching during resume (no CVSS, Linux)
- [CVE-2026-45910](https://cve.now/CVE-2026-45910.md): RDMA/rxe: Fix race condition in QP timer handlers (CVSS 7.8, Linux)
- [CVE-2026-45909](https://cve.now/CVE-2026-45909.md): clk: mediatek: Drop \_\_initconst from gates (CVSS 7.8, Linux)
- [CVE-2026-45908](https://cve.now/CVE-2026-45908.md): accel/amdxdna: Fix memory leak in amdxdna\_ubuf\_map (no CVSS, Linux)
- [CVE-2026-45907](https://cve.now/CVE-2026-45907.md): net/mlx5e: Fix deadlocks between devlink and netdev instance locks (no CVSS, Linux)
- [CVE-2026-45906](https://cve.now/CVE-2026-45906.md): power: supply: pf1550: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45905](https://cve.now/CVE-2026-45905.md): xfrm: fix ip\_rt\_bug race in icmp\_route\_lookup reverse path (no CVSS, Linux)
- [CVE-2026-45904](https://cve.now/CVE-2026-45904.md): powerpc/eeh: fix recursive pci\_lock\_rescan\_remove locking in EEH event handling (no CVSS, Linux)
- [CVE-2025-3633](https://cve.now/CVE-2025-3633.md): IBM Cognos Analytics is affected by multiple security vulnerabilities (CVSS 5.4, IBM Cognos Analytics · IBM Cognos Transformer)
- [CVE-2026-45903](https://cve.now/CVE-2026-45903.md): bpf: Fix memory access flags in helper prototypes (no CVSS, Linux)
- [CVE-2026-45902](https://cve.now/CVE-2026-45902.md): power: supply: bq256xx: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45901](https://cve.now/CVE-2026-45901.md): netfilter: nf\_tables: revert commit\_mutex usage in reset path (no CVSS, Linux)
- [CVE-2026-45900](https://cve.now/CVE-2026-45900.md): crypto: caam - fix netdev memory leak in dpaa2\_caam\_probe (no CVSS, Linux)
- [CVE-2026-45899](https://cve.now/CVE-2026-45899.md): ext4: drop extent cache when splitting extent fails (no CVSS, Linux)
- [CVE-2026-45898](https://cve.now/CVE-2026-45898.md): RDMA/iwcm: Fix workqueue list corruption by removing work\_list (CVSS 9.8, Linux)
- [CVE-2026-45897](https://cve.now/CVE-2026-45897.md): netfilter: nft\_counter: serialize reset with spinlock (no CVSS, Linux)
- [CVE-2026-45896](https://cve.now/CVE-2026-45896.md): mtd: intel-dg: Fix accessing regions before setting nregions (no CVSS, Linux)
- [CVE-2026-45895](https://cve.now/CVE-2026-45895.md): quota: fix livelock between quotactl and freeze\_super (no CVSS, Linux)
- [CVE-2026-45894](https://cve.now/CVE-2026-45894.md): iommu/vt-d: Clear Present bit before tearing down PASID entry (CVSS 7.8, Linux)
- [CVE-2026-45893](https://cve.now/CVE-2026-45893.md): apparmor: Fix & Optimize table creation from possibly unaligned memory (no CVSS, Linux)
- [CVE-2026-45892](https://cve.now/CVE-2026-45892.md): ext4: drop extent cache after doing PARTIAL\_VALID1 zeroout (no CVSS, Linux)
- [CVE-2026-45891](https://cve.now/CVE-2026-45891.md): net: hns3: fix double free issue for tx spare buffer (no CVSS, Linux)
- [CVE-2026-45890](https://cve.now/CVE-2026-45890.md): xen-netback: reject zero-queue configuration from guest (no CVSS, Linux)
- [CVE-2026-45889](https://cve.now/CVE-2026-45889.md): mptcp: do not account for OoO in mptcp\_rcvbuf\_grow() (no CVSS, Linux)
- [CVE-2026-45888](https://cve.now/CVE-2026-45888.md): md/raid1: fix memory leak in raid1\_run() (no CVSS, Linux)
- [CVE-2026-45887](https://cve.now/CVE-2026-45887.md): af\_unix: Fix memleak of newsk in unix\_stream\_connect(). (no CVSS, Linux)
- [CVE-2026-45886](https://cve.now/CVE-2026-45886.md): bpf: Fix bpf\_xdp\_store\_bytes proto for read-only arg (no CVSS, Linux)
- [CVE-2026-45885](https://cve.now/CVE-2026-45885.md): power: supply: cpcap-battery: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45884](https://cve.now/CVE-2026-45884.md): apparmor: avoid per-cpu hold underflow in aa\_get\_buffer (no CVSS, Linux)
- [CVE-2026-45883](https://cve.now/CVE-2026-45883.md): iio: sca3000: Fix a resource leak in sca3000\_probe() (no CVSS, Linux)
- [CVE-2026-45882](https://cve.now/CVE-2026-45882.md): power: supply: pm8916\_bms\_vm: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45881](https://cve.now/CVE-2026-45881.md): soc: mediatek: svs: Fix memory leak in svs\_enable\_debug\_write() (no CVSS, Linux)
- [CVE-2026-45880](https://cve.now/CVE-2026-45880.md): PCI/P2PDMA: Release per-CPU pgmap ref when vm\_insert\_page() fails (no CVSS, Linux)
- [CVE-2026-45879](https://cve.now/CVE-2026-45879.md): power: supply: bq25980: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45878](https://cve.now/CVE-2026-45878.md): drm/amdkfd: Fix watch\_id bounds checking in debug address watch v2 (CVSS 7.8, Linux)
- [CVE-2026-45877](https://cve.now/CVE-2026-45877.md): HID: intel-ish-hid: fix NULL-ptr-deref in ishtp\_bus\_remove\_all\_clients (no CVSS, Linux)
- [CVE-2026-45876](https://cve.now/CVE-2026-45876.md): arm64/gcs: Fix error handling in arch\_set\_shadow\_stack\_status() (no CVSS, Linux)
- [CVE-2026-45875](https://cve.now/CVE-2026-45875.md): mfd: arizona: Fix regulator resource leak on wm5102\_clear\_write\_sequencer() failure (no CVSS, Linux)
- [CVE-2026-45874](https://cve.now/CVE-2026-45874.md): phy: freescale: imx8qm-hsio: fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-45873](https://cve.now/CVE-2026-45873.md): netfilter: nft\_set\_rbtree: check for partial overlaps in anonymous sets (no CVSS, Linux)
- [CVE-2026-45872](https://cve.now/CVE-2026-45872.md): scsi: smartpqi: Fix memory leak in pqi\_report\_phys\_luns() (no CVSS, Linux)
- [CVE-2026-45871](https://cve.now/CVE-2026-45871.md): tpm: st33zp24: Fix missing cleanup on get\_burstcount() error (no CVSS, Linux)
- [CVE-2026-45870](https://cve.now/CVE-2026-45870.md): SUNRPC: auth\_gss: fix memory leaks in XDR decoding error paths (no CVSS, Linux)
- [CVE-2026-45869](https://cve.now/CVE-2026-45869.md): power: supply: wm97xx: Fix NULL pointer dereference in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45868](https://cve.now/CVE-2026-45868.md): pinctrl: single: fix refcount leak in pcs\_add\_gpio\_func() (no CVSS, Linux)
- [CVE-2026-45867](https://cve.now/CVE-2026-45867.md): power: supply: act8945a: Fix use-after-free in power\_supply\_changed() (no CVSS, Linux)
- [CVE-2026-45866](https://cve.now/CVE-2026-45866.md): serial: caif: fix use-after-free in caif\_serial ldisc\_close() (no CVSS, Linux)
- [CVE-2026-45865](https://cve.now/CVE-2026-45865.md): mctp i2c: initialise event handler read bytes (no CVSS, Linux)
- [CVE-2026-45864](https://cve.now/CVE-2026-45864.md): fs/ntfs3: prevent infinite loops caused by the next valid being the same (no CVSS, Linux)
- [CVE-2026-45863](https://cve.now/CVE-2026-45863.md): i3c: dw: Fix memory leak in dw\_i3c\_master\_i2c\_xfers() (no CVSS, Linux)
- [CVE-2026-45862](https://cve.now/CVE-2026-45862.md): iommu/vt-d: Flush cache for PASID table before using it (CVSS 7.8, Linux)
- [CVE-2026-45861](https://cve.now/CVE-2026-45861.md): gfs2: Fix slab-use-after-free in qd\_put (CVSS 7.8, Linux)
- [CVE-2026-45860](https://cve.now/CVE-2026-45860.md): netfilter: nf\_conncount: increase the connection clean up limit to 64 (CVSS 7.5, Linux)
- [CVE-2026-45859](https://cve.now/CVE-2026-45859.md): netfilter: nfnetlink\_queue: do shared-unconfirmed check before segmentation (CVSS 7.5, Linux)
- [CVE-2026-45858](https://cve.now/CVE-2026-45858.md): ext4: don't zero the entire extent if EXT4\_EXT\_DATA\_PARTIAL\_VALID1 (no CVSS, Linux)
- [CVE-2026-45857](https://cve.now/CVE-2026-45857.md): scsi: csiostor: Fix dereference of null pointer rn (no CVSS, Linux)
- [CVE-2026-45856](https://cve.now/CVE-2026-45856.md): RDMA/uverbs: Validate wqe\_size before using it in ib\_uverbs\_post\_send (CVSS 7.1, Linux)
- [CVE-2026-45855](https://cve.now/CVE-2026-45855.md): ata: libata-scsi: avoid Non-NCQ command starvation (no CVSS, Linux)
- [CVE-2026-45854](https://cve.now/CVE-2026-45854.md): crypto: inside-secure/eip93 - unregister only available algorithm (no CVSS, Linux)
- [CVE-2026-45853](https://cve.now/CVE-2026-45853.md): drm/amdgpu: Use kvfree instead of kfree in amdgpu\_gmc\_get\_nps\_memranges() (no CVSS, Linux)
- [CVE-2026-45852](https://cve.now/CVE-2026-45852.md): RDMA/rxe: Fix double free in rxe\_srq\_from\_init (CVSS 7.8, Linux)
- [CVE-2026-45851](https://cve.now/CVE-2026-45851.md): efi: Fix reservation of unaccepted memory table (no CVSS, Linux)
- [CVE-2026-45850](https://cve.now/CVE-2026-45850.md): ipvs: skip ipv6 extension headers for csum checks (no CVSS, Linux)
- [CVE-2026-45849](https://cve.now/CVE-2026-45849.md): net: mscc: ocelot: add missing lock protection in ocelot\_port\_xmit\_inj() (no CVSS, Linux)
- [CVE-2026-45848](https://cve.now/CVE-2026-45848.md): apparmor: fix NULL sock in aa\_sock\_file\_perm (no CVSS, Linux)
- [CVE-2026-45847](https://cve.now/CVE-2026-45847.md): net: remove WARN\_ON\_ONCE when accessing forward path array (no CVSS, Linux)
- [CVE-2025-71309](https://cve.now/CVE-2025-71309.md): fs/ntfs3: fix deadlock in ni\_read\_folio\_cmpr (no CVSS, Linux)
- [CVE-2025-71308](https://cve.now/CVE-2025-71308.md): accel/amdxdna: Fix potential NULL pointer dereference in context cleanup (no CVSS, Linux)
- [CVE-2025-71307](https://cve.now/CVE-2025-71307.md): drm/panthor: Fix NULL pointer dereference on panthor\_fw\_unplug (no CVSS, Linux)
- [CVE-2025-71306](https://cve.now/CVE-2025-71306.md): ima: Fix stack-out-of-bounds in is\_bprm\_creds\_for\_exec() (no CVSS, Linux)
- [CVE-2025-71305](https://cve.now/CVE-2025-71305.md): drm/display/dp\_mst: Add protection against 0 vcpi (no CVSS, Linux)
- [CVE-2025-71304](https://cve.now/CVE-2025-71304.md): smack: /smack/doi: accept previously used values (no CVSS, Linux)
- [CVE-2025-71303](https://cve.now/CVE-2025-71303.md): accel/amdxdna: Fix race condition when checking rpm\_on (no CVSS, Linux)
- [CVE-2026-2340](https://cve.now/CVE-2026-2340.md): Samba: vfs\_worm does not block directory modification (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-48971](https://cve.now/CVE-2026-48971.md): WordPress Product Import Export for WooCommerce plugin \<= 2.5.6 - Broken Access Control vulnerability (CVSS 4.3, WebToffee Product Import Export for WooCommerce)
- [CVE-2026-9689](https://cve.now/CVE-2026-9689.md): Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 (CVSS 4.2, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-3012](https://cve.now/CVE-2026-3012.md): Samba: group policy certificate enrollment uses http:// without validation (CVSS 8.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-42761](https://cve.now/CVE-2026-42761.md): WordPress Active Products Tables for WooCommerce plugin \<= 1.0.9 - SQL Injection vulnerability (CVSS 9.3, RealMag777 Active Products Tables for WooCommerce)
- [CVE-2026-42762](https://cve.now/CVE-2026-42762.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-42760](https://cve.now/CVE-2026-42760.md): WordPress Backup and Staging by WP Time Capsule plugin \<= 1.22.25 - Broken Authentication vulnerability (CVSS 7.5, revmakx Backup and Staging by WP Time Capsule)
- [CVE-2026-42758](https://cve.now/CVE-2026-42758.md): WordPress WebinarIgnition plugin \< 4.08.253 - Privilege Escalation vulnerability (CVSS 9.8, Saleswonder Team: Tobias WebinarIgnition)
- [CVE-2026-42759](https://cve.now/CVE-2026-42759.md): WordPress Affiliate Super Assistent plugin \<= 1.10.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Timo Affiliate Super Assistent)
- [CVE-2026-42757](https://cve.now/CVE-2026-42757.md): WordPress WebinarIgnition plugin \< 4.08.253 - Arbitrary File Deletion vulnerability (CVSS 9.9, Saleswonder Team: Tobias WebinarIgnition)
- [CVE-2026-42756](https://cve.now/CVE-2026-42756.md): WordPress QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly plugin \<= 3.2.7 - Arbitrary File Deletion vulnerability (CVSS 9.9, Ludwig You QuickWebP &#8211; Compress / Optimize Images &am…)
- [CVE-2026-42755](https://cve.now/CVE-2026-42755.md): WordPress TableOn plugin \<= 1.0.5.1 - SQL Injection vulnerability (CVSS 9.3, RealMag777 TableOn)
- [CVE-2026-42754](https://cve.now/CVE-2026-42754.md): WordPress Favicon plugin \<= 1.3.46 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, phbernard Favicon)
- [CVE-2026-42751](https://cve.now/CVE-2026-42751.md): WordPress Booking Manager plugin \<= 2.1.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdevelop Booking Manager)
- [CVE-2026-42753](https://cve.now/CVE-2026-42753.md): WordPress WCFM Membership plugin \<= 2.11.10 - Broken Access Control vulnerability (CVSS 7.3, WC Lovers WCFM Membership)
- [CVE-2026-42750](https://cve.now/CVE-2026-42750.md): WordPress WPComplete plugin \<= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nexcess WPComplete)
- [CVE-2026-42749](https://cve.now/CVE-2026-42749.md): WordPress Disable Comments for Any Post Types (Remove comments) plugin \<= 1.3.0 - Broken Authentication vulnerability (CVSS 7.1, Themeisle Disable Comments for Any Post Types)
- [CVE-2026-42748](https://cve.now/CVE-2026-42748.md): WordPress WPify Woo Czech plugin \<= 5.4.1 - Arbitrary File Upload vulnerability (CVSS 9.9, WPify Woo Czech)
- [CVE-2026-42747](https://cve.now/CVE-2026-42747.md): WordPress Easy Form Builder plugin \<= 4.0.6 - SQL Injection vulnerability (CVSS 9.3, hassantafreshi Easy Form Builder)
- [CVE-2026-42746](https://cve.now/CVE-2026-42746.md): WordPress Smart Online Order for Clover plugin \<= 1.6.0 - Sensitive Data Exposure vulnerability (CVSS 7.3, ZAYTECH Smart Online Order for Clover)
- [CVE-2026-42745](https://cve.now/CVE-2026-42745.md): WordPress Smart Online Order for Clover plugin \<= 1.6.0 - Broken Authentication vulnerability (CVSS 7.3, ZAYTECH Smart Online Order for Clover)
- [CVE-2026-42744](https://cve.now/CVE-2026-42744.md): WordPress Ads by WPQuads plugin \<= 3.0.2 - Bypass Vulnerability vulnerability (CVSS 6.5, Ads by WPQuads)
- [CVE-2026-42740](https://cve.now/CVE-2026-42740.md): WordPress Tainacan plugin \<= 1.0.3 - SQL Injection vulnerability (CVSS 9.3, Tainacan)
- [CVE-2026-42739](https://cve.now/CVE-2026-42739.md): WordPress Advanced IP Blocker plugin \<= 8.10.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IniLerm Advanced IP Blocker)
- [CVE-2026-42738](https://cve.now/CVE-2026-42738.md): WordPress Smart Online Order for Clover plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ZAYTECH Smart Online Order for Clover)
- [CVE-2026-42737](https://cve.now/CVE-2026-42737.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.9 - Arbitrary File Deletion vulnerability (CVSS 8.6, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-42736](https://cve.now/CVE-2026-42736.md): WordPress BP Better Messages plugin \<= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, wordplus BP Better Messages)
- [CVE-2026-42735](https://cve.now/CVE-2026-42735.md): WordPress KiviCare plugin \<= 4.3.0 - Broken Authentication vulnerability (CVSS 8.2, Iqonic Design KiviCare)
- [CVE-2026-42728](https://cve.now/CVE-2026-42728.md): WordPress HT Contact Form 7 plugin \<= 2.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, HT Plugins HT Contact Form)
- [CVE-2026-42730](https://cve.now/CVE-2026-42730.md): WordPress MasterStudy LMS plugin \<= 3.7.29 - SQL Injection vulnerability (CVSS 8.5, Stylemix MasterStudy LMS)
- [CVE-2026-42733](https://cve.now/CVE-2026-42733.md): WordPress WPCS plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RealMag777 WPCS)
- [CVE-2026-42732](https://cve.now/CVE-2026-42732.md): WordPress Ads by WPQuads plugin \<= 3.0.2 - Broken Authentication vulnerability (CVSS 6.5, Ads by WPQuads)
- [CVE-2026-42725](https://cve.now/CVE-2026-42725.md): WordPress Checkout Files Upload for WooCommerce plugin \<= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, WP Wham Checkout Files Upload for WooCommerce)
- [CVE-2026-42727](https://cve.now/CVE-2026-42727.md): WordPress Active Products Tables for WooCommerce plugin \<= 1.0.8 - SQL Injection vulnerability (CVSS 9.3, RealMag777 Active Products Tables for WooCommerce)
- [CVE-2026-42729](https://cve.now/CVE-2026-42729.md): WordPress PropertyHive plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Property Hive PropertyHive)
- [CVE-2026-42734](https://cve.now/CVE-2026-42734.md): WordPress Geo Mashup plugin \<= 1.13.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dylan Kuhn Geo Mashup)
- [CVE-2026-42726](https://cve.now/CVE-2026-42726.md): WordPress AWP Classifieds plugin \<= 4.4.5 - Broken Access Control vulnerability (CVSS 6.5, Strategy11 Team AWP Classifieds)
- [CVE-2026-42731](https://cve.now/CVE-2026-42731.md): WordPress miniorange otp verification plugin \<= 5.4.9 - Privilege Escalation vulnerability (CVSS 9.8, miniorange otp verification)
- [CVE-2026-2288](https://cve.now/CVE-2026-2288.md): myLinksDump \<= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link\_title' Parameter (CVSS 4.8, silvercover myLinksDump)
- [CVE-2026-3349](https://cve.now/CVE-2026-3349.md): MinhNhut Link Gateway \<= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter (CVSS 6.1, MinhNhut Link Gateway)
- [CVE-2026-3348](https://cve.now/CVE-2026-3348.md): MinhNhut Link Gateway \<= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, MinhNhut Link Gateway)
- [CVE-2026-2280](https://cve.now/CVE-2026-2280.md): rexCrawler \<= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (CVSS 4.8, larsdrasmussen rexCrawler)
- [CVE-2025-0898](https://cve.now/CVE-2025-0898.md): Xpro Elementor Addons - Pro \<= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG (CVSS 6.5, WPXpro Xpro Elementor Addons - Pro)
- [CVE-2026-45846](https://cve.now/CVE-2026-45846.md): bareudp: fix NULL pointer dereference in bareudp\_fill\_metadata\_dst() (no CVSS, Linux)
- [CVE-2026-45845](https://cve.now/CVE-2026-45845.md): net/sched: taprio: fix NULL pointer dereference in class dump (no CVSS, Linux)
- [CVE-2026-45844](https://cve.now/CVE-2026-45844.md): netfilter: arp\_tables: fix IEEE1394 ARP payload parsing (no CVSS, Linux)
- [CVE-2026-45843](https://cve.now/CVE-2026-45843.md): slip: bound decode() reads against the compressed packet length (CVSS 8.2, Linux)
- [CVE-2026-45842](https://cve.now/CVE-2026-45842.md): slip: reject VJ receive packets on instances with no rstate array (no CVSS, Linux)
- [CVE-2026-45841](https://cve.now/CVE-2026-45841.md): netfilter: nfnetlink\_osf: fix divide-by-zero in OSF\_WSS\_MODULO (no CVSS, Linux)
- [CVE-2026-45840](https://cve.now/CVE-2026-45840.md): openvswitch: cap upcall PID array size and pre-size vport replies (no CVSS, Linux)
- [CVE-2026-45839](https://cve.now/CVE-2026-45839.md): bpf: reject negative CO-RE accessor indices in bpf\_core\_parse\_spec() (no CVSS, Linux)
- [CVE-2026-45838](https://cve.now/CVE-2026-45838.md): bpf: fix end-of-list detection in cgroup\_storage\_get\_next\_key() (no CVSS, Linux)
- [CVE-2026-45837](https://cve.now/CVE-2026-45837.md): bpf: Fix use-after-free in arena\_vm\_close on fork (no CVSS, Linux)
- [CVE-2026-48906](https://cve.now/CVE-2026-48906.md): Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework \< 6.1.0 for Joomla (CVSS 9.3, tassos.gr Novarain/Tassos Framework · tassos.gr Convert… +6)
- [CVE-2026-48968](https://cve.now/CVE-2026-48968.md): WordPress Master Slider plugin \<= 3.10.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Averta Master Slider)
- [CVE-2026-48877](https://cve.now/CVE-2026-48877.md): WordPress GenerateBlocks plugin \<= 2.1.0 - Sensitive Data Exposure vulnerability (CVSS 6.5, Tom GenerateBlocks)
- [CVE-2026-2237](https://cve.now/CVE-2026-2237.md): A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1 (CVSS 6.2, Synology Storage Manager)
- [CVE-2025-66593](https://cve.now/CVE-2025-66593.md): An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricte (CVSS 6.1, Synology Assistant)
- [CVE-2025-66592](https://cve.now/CVE-2025-66592.md): An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrar (CVSS 6.1, Synology Active Backup for Business Agent)
- [CVE-2025-30028](https://cve.now/CVE-2025-30028.md): A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. (CVSS 8.6, Synology Active Backup for Business)
- [CVE-2025-52747](https://cve.now/CVE-2025-52747.md): WordPress Themebox - Digital Products Ecommerce theme \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jthemes Themebox - Digital Products Ecommerce)
- [CVE-2025-14713](https://cve.now/CVE-2025-14713.md): An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote at (CVSS 7.5, Synology C2 Identity Edge Server)
- [CVE-2025-13593](https://cve.now/CVE-2025-13593.md): Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with res (CVSS 6.1, Synology ActiveProtect Agent)
- [CVE-2025-12686](https://cve.now/CVE-2025-12686.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-6 (CVSS 9.8, Synology BeeStation OS)
- [CVE-2025-13392](https://cve.now/CVE-2025-13392.md): Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3 (CVSS 8.1, Synology DiskStation Manager)
- [CVE-2025-22741](https://cve.now/CVE-2025-22741.md): WordPress Felan Framework plugin \<= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RiceTheme Felan Framework)
- [CVE-2025-13167](https://cve.now/CVE-2025-13167.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Cont (CVSS 5.4, Synology Contacts)
- [CVE-2025-10466](https://cve.now/CVE-2025-10466.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access be (CVSS 5.9, Synology Safe Access)
- [CVE-2024-47272](https://cve.now/CVE-2024-47272.md): Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows r (CVSS 2.7, Synology Surveillance Station)
- [CVE-2024-47271](https://cve.now/CVE-2024-47271.md): Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 (CVSS 4.9, Synology Surveillance Station)
- [CVE-2024-47270](https://cve.now/CVE-2024-47270.md): Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9 (CVSS 2.7, Synology Surveillance Station)
- [CVE-2024-47269](https://cve.now/CVE-2024-47269.md): Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-1157 (CVSS 4.9, Synology Surveillance Station)
- [CVE-2024-47268](https://cve.now/CVE-2024-47268.md): Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote (CVSS 4.9, Synology Surveillance Station)
- [CVE-2024-47267](https://cve.now/CVE-2024-47267.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Sur (CVSS 2.7, Synology Surveillance Station)
- [CVE-2024-11399](https://cve.now/CVE-2024-11399.md): Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13 (CVSS 6.8, Synology BeeDrive for desktop)
- [CVE-2023-52945](https://cve.now/CVE-2023-52945.md): Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local use (CVSS 7.8, Synology BeeDrive for desktop)
- [CVE-2026-49002](https://cve.now/CVE-2026-49002.md): Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product (CVSS 9.1, ZTE ZXUniPOS NDS-LTE)
- [CVE-2026-40852](https://cve.now/CVE-2026-40852.md): Command injection via malicious configuration (CVSS 7.2, MB connect line mbNET/mbNET.rokey · MB connect line mbNE… +2)
- [CVE-2026-40851](https://cve.now/CVE-2026-40851.md): Command injection via USB (CVSS 8.4, MB connect line mbNET/mbNET.rokey · MB connect line mbNE… +2)
- [CVE-2026-40850](https://cve.now/CVE-2026-40850.md): Unauthenticated SQLi in getAccountData function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40849](https://cve.now/CVE-2026-40849.md): Authenticated SQLi in user\_alarmprofile view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40848](https://cve.now/CVE-2026-40848.md): Authenticated SQLi in tag view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40847](https://cve.now/CVE-2026-40847.md): Authenticated SQLi in system\_tag view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40846](https://cve.now/CVE-2026-40846.md): Authenticated SQLi in system view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40845](https://cve.now/CVE-2026-40845.md): Authenticated SQLi in devices\_configuration view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40844](https://cve.now/CVE-2026-40844.md): Authenticated SQLi in dashboard view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40843](https://cve.now/CVE-2026-40843.md): Authenticated SQLi in alarming view (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40842](https://cve.now/CVE-2026-40842.md): Authenticated SQLi in getWidgetTags function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40841](https://cve.now/CVE-2026-40841.md): Authenticated SQLi in getProjectTags function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40840](https://cve.now/CVE-2026-40840.md): Authenticated SQLi in VerifyCreateLicences function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40839](https://cve.now/CVE-2026-40839.md): Authenticated SQLi in getComponentScalings function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40838](https://cve.now/CVE-2026-40838.md): Authenticated SQLi in getDeviceScalings function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40837](https://cve.now/CVE-2026-40837.md): Authenticated SQLi in getProjectScalings function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40836](https://cve.now/CVE-2026-40836.md): Authenticated SQLi in inmessage model (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40835](https://cve.now/CVE-2026-40835.md): Authenticated SQLi in saveObjectFromData function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40834](https://cve.now/CVE-2026-40834.md): Authenticated SQLi in saveDashboardLayout function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40833](https://cve.now/CVE-2026-40833.md): Authenticated SQLi in saveDashboardLayout function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-8054](https://cve.now/CVE-2026-8054.md): Unauthenticated SQL Injection in dotCMS Publish Audit API (CVSS 10.0, dotCMS Core)
- [CVE-2026-40832](https://cve.now/CVE-2026-40832.md): Authenticated SQLi in getDevicegroups function (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40831](https://cve.now/CVE-2026-40831.md): Authenticated SQLi in Easy View (CVSS 7.1, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40830](https://cve.now/CVE-2026-40830.md): Authenticated SQLi in UpdateParam function (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40829](https://cve.now/CVE-2026-40829.md): Authenticated SQLi in UpdateParam function (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40828](https://cve.now/CVE-2026-40828.md): Authenticated SQLi in DeleteSysLogEntry function (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40827](https://cve.now/CVE-2026-40827.md): Authenticated SQLi in \_RemoveRequest function (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40826](https://cve.now/CVE-2026-40826.md): Authenticated SQLi in dsgvo\_contracts view (CVSS 6.9, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40825](https://cve.now/CVE-2026-40825.md): Authenticated SQLi in accountstatus view (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40824](https://cve.now/CVE-2026-40824.md): Authenticated SQLi in accountstatus view (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40823](https://cve.now/CVE-2026-40823.md): Authenticated SQLi in DevSerialReset function (CVSS 7.0, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40822](https://cve.now/CVE-2026-40822.md): Authenticated SQLi in DevSerialReset function (CVSS 6.9, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40821](https://cve.now/CVE-2026-40821.md): Authenticated SQLi in getAccountByID function (CVSS 6.9, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40819](https://cve.now/CVE-2026-40819.md): Unauthenticated SQLi in sync\_data24 task (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40818](https://cve.now/CVE-2026-40818.md): Unauthenticated SQLi in \_mb24confi\_getDevice function function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40817](https://cve.now/CVE-2026-40817.md): Unauthenticated SQLi in getAlarmProfiles function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40816](https://cve.now/CVE-2026-40816.md): Unauthenticated SQLi in \_mb24confi\_getTagAlarm function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40815](https://cve.now/CVE-2026-40815.md): Unauthenticated SQLi in \_mb24api\_getUserAccount function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40814](https://cve.now/CVE-2026-40814.md): Unauthenticated SQLi in \_mb24confi\_getTagAlarm function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-8042](https://cve.now/CVE-2026-8042.md): Github Shortcode \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, octalmage Github Shortcode)
- [CVE-2026-8942](https://cve.now/CVE-2026-8942.md): MetaMagic SEO Plugin \<= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page (CVSS 4.3, lhughes33472 MetaMagic SEO Plugin)
- [CVE-2026-8906](https://cve.now/CVE-2026-8906.md): WP Promoter \<= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup\_width' Parameter (CVSS 6.1, rahulbhangale WP Promoter)
- [CVE-2026-3375](https://cve.now/CVE-2026-3375.md): LiteSpeed Cache \<= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints (CVSS 7.2, litespeedtech LiteSpeed Cache)
- [CVE-2026-3001](https://cve.now/CVE-2026-3001.md): Gutenverse \<= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter (CVSS 6.1, jegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…)
- [CVE-2026-40813](https://cve.now/CVE-2026-40813.md): Unauthenticated SQLi in getLiveValues (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40812](https://cve.now/CVE-2026-40812.md): Unauthenticated SQLi in getLiveValues function (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40811](https://cve.now/CVE-2026-40811.md): Unauthenticated SQLi in ssoabstractservice (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-40810](https://cve.now/CVE-2026-40810.md): Unauthenticated SQLi in userinfo Endpoint (CVSS 8.7, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2026-49001](https://cve.now/CVE-2026-49001.md): Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product (CVSS 5.3, ZTE ZXUniPOS NDS-LTE)
- [CVE-2025-41669](https://cve.now/CVE-2025-41669.md): Insufficient Verification of Data Authenticity (CVSS 8.7, Phoenix Contact AXC F · Phoenix Contact BPC +4)
- [CVE-2025-41670](https://cve.now/CVE-2025-41670.md): Untrusted Search Path (CVSS 8.7, Phoenix Contact AXC F · Phoenix Contact BPC +4)
- [CVE-2026-41704](https://cve.now/CVE-2026-41704.md): Compromised VM can make arbitrary blobstore deletes (CVSS 6.8, Cloud Foundry Foundation BOSH Director)
- [CVE-2026-3895](https://cve.now/CVE-2026-3895.md): WPBakery Page Builder Addons by Livemesh \<= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, WPBakery Page Builder Addons by Livemesh)
- [CVE-2026-8143](https://cve.now/CVE-2026-8143.md): Booking Calendar – Event Calendar \<= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters (CVSS 7.2, omnivo Booking Calendar – Event Calendar)
- [CVE-2026-6169](https://cve.now/CVE-2026-6169.md): affiliate-toolkit \<= 3.8.5 - Authenticated (Editor+) Remote Code Execution (CVSS 7.2, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2026-2030](https://cve.now/CVE-2026-2030.md): WPBakery Page Builder Addons by Livemesh \<= 3.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, WPBakery Page Builder Addons by Livemesh)
- [CVE-2026-7618](https://cve.now/CVE-2026-7618.md): EnvíaloSimple: Email Marketing y Newsletters \<= 2.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, dattateccom EnvíaloSimple: Email Marketing y Newsletters)
- [CVE-2026-3896](https://cve.now/CVE-2026-3896.md): Livemesh SiteOrigin Widgets \<= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, Livemesh SiteOrigin Widgets)
- [CVE-2026-3897](https://cve.now/CVE-2026-3897.md): Livemesh Addons for Beaver Builder \<= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization (CVSS 6.4, Livemesh Addons for Beaver Builder)
- [CVE-2026-8832](https://cve.now/CVE-2026-8832.md): WPCode \<= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost (CVSS 8.8, smub WPCode – Insert Headers and Footers + Custom Code Snip…)
- [CVE-2026-3279](https://cve.now/CVE-2026-3279.md): Enable jQuery Migrate Helper \<= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade (CVSS 6.5, clorith Enable jQuery Migrate Helper)
- [CVE-2026-41009](https://cve.now/CVE-2026-41009.md): Local Blobstore may allow arbitrary reads/deletes (CVSS 4.3, Cloud Foundry Foundation BOSH Director)
- [CVE-2026-6268](https://cve.now/CVE-2026-6268.md): EventPress \< 22.2 – Reflected Cross-Site Scripting (CVSS 7.1, EventPress)
- [CVE-2026-8884](https://cve.now/CVE-2026-8884.md): Instant-Quote.co Quotation Page \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, neilmccutcheon Instant-Quote.co Quotation Page)
- [CVE-2026-8867](https://cve.now/CVE-2026-8867.md): Post Categories Gallery \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, fides-it Post Categories Gallery)
- [CVE-2026-8994](https://cve.now/CVE-2026-8994.md): Login with NEAR \<= 0.3.3 - Authentication Bypass via 'account' Parameter (CVSS 8.1, learnnearclub Login with NEAR)
- [CVE-2026-8899](https://cve.now/CVE-2026-8899.md): Auto Thumbnails \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, gapgag55 Auto Thumbnails)
- [CVE-2026-8040](https://cve.now/CVE-2026-8040.md): faq shortocde \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (CVSS 6.4, yehudah faq shortocde)
- [CVE-2026-8886](https://cve.now/CVE-2026-8886.md): hk\_shortcode \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, huankong hk\_shortcode)
- [CVE-2026-8708](https://cve.now/CVE-2026-8708.md): Genzel breadcrumbs \<= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page (CVSS 4.3, shra Genzel breadcrumbs)
- [CVE-2026-8847](https://cve.now/CVE-2026-8847.md): Dideo \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, mshomali Dideo)
- [CVE-2026-8844](https://cve.now/CVE-2026-8844.md): Responsive Check \<= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, kevin1804 Responsive Check)
- [CVE-2026-8707](https://cve.now/CVE-2026-8707.md): NS Product icon badge \<= 1.2.4 - Reflected Cross-Site Scripting via PHP\_SELF (CVSS 6.1, nsthemes NS Product icon badge)
- [CVE-2026-9014](https://cve.now/CVE-2026-9014.md): WP Promoter \<= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset\_stats AJAX Action (CVSS 5.3, rahulbhangale WP Promoter)
- [CVE-2026-7614](https://cve.now/CVE-2026-7614.md): Old Posts Highlighter \<= 1.0.3 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, mkhfr Old Posts Highlighter)
- [CVE-2026-8760](https://cve.now/CVE-2026-8760.md): Login with OTP \<= 1.6 - Unauthenticated Authentication Bypass via OTP Brute Force (CVSS 9.8, india-web-developer Login with OTP)
- [CVE-2026-8875](https://cve.now/CVE-2026-8875.md): Easy Prism Syntax Highlighter \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, cuamckuy Easy Prism Syntax Highlighter)
- [CVE-2026-8894](https://cve.now/CVE-2026-8894.md): iWR Tooltip \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, vinaysankhyan iWR Tooltip)
- [CVE-2026-8845](https://cve.now/CVE-2026-8845.md): Islamic Database \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, samiullah-kaifi Islamic Database)
- [CVE-2026-8873](https://cve.now/CVE-2026-8873.md): Content Slideshow \<= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, celloexpressions Content Slideshow)
- [CVE-2026-8787](https://cve.now/CVE-2026-8787.md): Firebase Support & Chat Management \<= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, devsabbirahmed Firebase Support & Chat Management)
- [CVE-2026-8846](https://cve.now/CVE-2026-8846.md): Tuxquote \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, eldougo Tuxquote)
- [CVE-2026-8891](https://cve.now/CVE-2026-8891.md): BitForm \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, BitForm – Data management solution for WordPress)
- [CVE-2026-8871](https://cve.now/CVE-2026-8871.md): Formidable Kinetic \<= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, thomstark Formidable Kinetic)
- [CVE-2026-8048](https://cve.now/CVE-2026-8048.md): My Email Shortcode \<= 0.91 - \[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\] (CVSS 6.4, paulpela My Email Shortcode)
- [CVE-2026-8872](https://cve.now/CVE-2026-8872.md): Animate Your Content \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, fides-it Animate Your Content)
- [CVE-2026-8903](https://cve.now/CVE-2026-8903.md): Two-factor authentication (formerly IP Vault) \<= 2.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, youtag Two-factor authentication)
- [CVE-2026-8869](https://cve.now/CVE-2026-8869.md): Mutual Funds Data \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (CVSS 6.4, mutualfunddata Mutual Funds Data)
- [CVE-2026-8911](https://cve.now/CVE-2026-8911.md): WP AutoBuzz \<= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter (CVSS 6.1, godlessons WP AutoBuzz)
- [CVE-2026-8898](https://cve.now/CVE-2026-8898.md): Events In City \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, ruchit47 Events In City)
- [CVE-2026-8866](https://cve.now/CVE-2026-8866.md): jQuery googleslides \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, bradyholt jQuery googleslides)
- [CVE-2026-8943](https://cve.now/CVE-2026-8943.md): GoStats for WordPress \<= 1.4 - Cross-Site Request Forgery via gostats\_manage() Function (CVSS 4.3, rchmura GoStats for WordPress)
- [CVE-2026-8941](https://cve.now/CVE-2026-8941.md): CDN Linker lite \<= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, wmark CDN Linker lite)
- [CVE-2026-8701](https://cve.now/CVE-2026-8701.md): GNTT Post Title Ticker \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, golzarrahman GNTT Post Title Ticker)
- [CVE-2026-8887](https://cve.now/CVE-2026-8887.md): Listen Shortcode \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, konforti Listen Shortcode)
- [CVE-2026-8897](https://cve.now/CVE-2026-8897.md): Shortcode Buddy \<= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, vincentastolfi Shortcode Buddy)
- [CVE-2026-8870](https://cve.now/CVE-2026-8870.md): Team Master \<= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, adnanmoqsood Team Master – A Modern WordPress Team Showcase)
- [CVE-2026-9200](https://cve.now/CVE-2026-9200.md): Query Shortcode \<= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute (CVSS 7.5, shazdeh Query Shortcode)
- [CVE-2026-8702](https://cve.now/CVE-2026-8702.md): GBI To Print \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute (CVSS 6.4, garber GBI To Print)
- [CVE-2026-8938](https://cve.now/CVE-2026-8938.md): auto making JSON-LD \<= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass (CVSS 4.3, nakamura1458 auto making JSON-LD)
- [CVE-2026-8939](https://cve.now/CVE-2026-8939.md): Search Simple Fields \<= 0.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, simonailie Search Simple Fields)
- [CVE-2026-8842](https://cve.now/CVE-2026-8842.md): Google+ Link Name \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, morettolss Google+ Link Name)
- [CVE-2026-8703](https://cve.now/CVE-2026-8703.md): Endless Scroll \<= 1.0.0 - \[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\] (CVSS 6.4, codycave Endless Scroll)
- [CVE-2026-8868](https://cve.now/CVE-2026-8868.md): Single Mailchimp \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, jonathan-robrecht Single Mailchimp)
- [CVE-2026-8698](https://cve.now/CVE-2026-8698.md): Cryptocurrency Prijsvergelijking Widget \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute (CVSS 6.4, cryptoprijzen Cryptocurrency Prijsvergelijking Widget)
- [CVE-2026-8837](https://cve.now/CVE-2026-8837.md): WP Iframe Geo Style for Amazon affiliates \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute (CVSS 6.4, ektorcaba WP Iframe Geo Style for Amazon affiliates)
- [CVE-2026-8877](https://cve.now/CVE-2026-8877.md): Responsive Video Embedder \<= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, esiteq Responsive Video Embedder)
- [CVE-2026-6287](https://cve.now/CVE-2026-6287.md): ShopLentor - WooCommerce Builder for Elementor & Gutenberg \<= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute (CVSS 5.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-9236](https://cve.now/CVE-2026-9236.md): CM Ad Changer \<= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management (CVSS 4.3, creativemindssolutions CM Ad Changer – A simple tool to con…)
- [CVE-2025-14481](https://cve.now/CVE-2025-14481.md): Yoast SEO \<= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post\_id' Parameter (CVSS 4.3, Yoast SEO – Advanced SEO with real-time guidance and built-…)
- [CVE-2026-8450](https://cve.now/CVE-2026-8450.md): HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send\_file() (CVSS 9.1, OALDERS HTTP::Daemon)
- [CVE-2026-49000](https://cve.now/CVE-2026-49000.md): Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product (CVSS 7.0, ZTE ZXUniPOS NDS-LTE)
- [CVE-2026-48962](https://cve.now/CVE-2026-48962.md): IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob (CVSS 7.3, PMQS IO::Compress)
- [CVE-2026-2253](https://cve.now/CVE-2026-2253.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference (CVSS 7.7, Hitachi Vantara Pentaho Data Integration and Analytics)
- [CVE-2026-2255](https://cve.now/CVE-2026-2255.md): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (CVSS 4.3, Hitachi Vantara Pentaho Data Integration and Analytics)
- [CVE-2026-2254](https://cve.now/CVE-2026-2254.md): Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource (CVSS 6.3, Hitachi Vantara Pentaho Data Integration and Analytics)
- [CVE-2026-48961](https://cve.now/CVE-2026-48961.md): IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID (CVSS 7.3, PMQS IO::Compress)
- [CVE-2026-48959](https://cve.now/CVE-2026-48959.md): IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward (CVSS 7.5, PMQS IO::Uncompress::Unzip)
- [CVE-2026-9022](https://cve.now/CVE-2026-9022.md): Splide Carousel Block \<= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute (CVSS 6.4, dkjensen Splide Carousel Block)
- [CVE-2025-15649](https://cve.now/CVE-2025-15649.md): IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date (CVSS 5.5, PMQS IO::Uncompress::Unzip)
- [CVE-2026-48999](https://cve.now/CVE-2026-48999.md): Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product (CVSS 5.7, ZTE ZXUniPOS NDS-LTE)
- [CVE-2026-49017](https://cve.now/CVE-2026-49017.md): In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bo (CVSS 7.1, OpenStack Swift · swift)
- [CVE-2026-49014](https://cve.now/CVE-2026-49014.md): In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. (CVSS 7.4, GDAL)
- [CVE-2026-9632](https://cve.now/CVE-2026-9632.md): UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-6565](https://cve.now/CVE-2026-6565.md): Style Kits – Advanced Theme Styles for Elementor \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Kit Title (CVSS 6.4, analogwp Style Kits for Elementor)
- [CVE-2026-7493](https://cve.now/CVE-2026-7493.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.11.5 - Unauthenticated Denial of Service (CVSS 5.3, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-9207](https://cve.now/CVE-2026-9207.md): Tanium addressed an unauthorized code execution vulnerability in Connect. (CVSS 8.8, Tanium Connect)
- [CVE-2026-9156](https://cve.now/CVE-2026-9156.md): Tanium addressed a denial of service vulnerability in Tanium Server. (CVSS 6.5, Tanium Server)
- [CVE-2026-9631](https://cve.now/CVE-2026-9631.md): UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-9628](https://cve.now/CVE-2026-9628.md): UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-9627](https://cve.now/CVE-2026-9627.md): UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-9609](https://cve.now/CVE-2026-9609.md): QianFox FoxCMS Admin.php edit password recovery (CVSS 5.1, QianFox FoxCMS)
- [CVE-2026-9608](https://cve.now/CVE-2026-9608.md): QianFox FoxCMS Administrator Backend edit cross site scripting (CVSS 4.8, QianFox FoxCMS)
- [CVE-2026-9312](https://cve.now/CVE-2026-9312.md): Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint (CVSS 9.2, GitHub Enterprise Server)
- [CVE-2026-9607](https://cve.now/CVE-2026-9607.md): itsourcecode Courier Management System parcel\_list.php sql injection (CVSS 5.3, itsourcecode Courier Management System)
- [CVE-2025-67903](https://cve.now/CVE-2025-67903.md): Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass. (CVSS 5.3)
- [CVE-2025-68712](https://cve.now/CVE-2025-68712.md): SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authenti (CVSS 5.5)
- [CVE-2025-69600](https://cve.now/CVE-2025-69600.md): Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getco (CVSS 7.8)
- [CVE-2025-70103](https://cve.now/CVE-2025-70103.md): Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/de (CVSS 7.3)
- [CVE-2025-70116](https://cve.now/CVE-2025-70116.md): A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing des (CVSS 4.3)
- [CVE-2026-30498](https://cve.now/CVE-2026-30498.md): A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0. (CVSS 6.3)
- [CVE-2026-31266](https://cve.now/CVE-2026-31266.md): Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate). (CVSS 7.3)
- [CVE-2026-33552](https://cve.now/CVE-2026-33552.md): Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control. (CVSS 3.7)
- [CVE-2026-36044](https://cve.now/CVE-2026-36044.md): @pensar/apex \<= 0.0.58 is vulnerable to OS command injection via the smart\_enumerate tool. (CVSS 8.8)
- [CVE-2026-36045](https://cve.now/CVE-2026-36045.md): picoclaw \<=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). (CVSS 7.3, github.com/sipeed/picoclaw)
- [CVE-2026-36538](https://cve.now/CVE-2026-36538.md): Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. (CVSS 7.3)
- [CVE-2026-36539](https://cve.now/CVE-2026-36539.md): Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk\_get.cgi that returns the entire router configuration as a JSON resp (CVSS 7.3)
- [CVE-2026-36540](https://cve.now/CVE-2026-36540.md): Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk\_set.cgi endpoint. (CVSS 7.3)
- [CVE-2026-37711](https://cve.now/CVE-2026-37711.md): An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/ (CVSS 7.3)
- [CVE-2026-37712](https://cve.now/CVE-2026-37712.md): An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/ (CVSS 7.3)
- [CVE-2026-37713](https://cve.now/CVE-2026-37713.md): An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/ (CVSS 7.3)
- [CVE-2026-38422](https://cve.now/CVE-2026-38422.md): Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the tasmota/ta (CVSS 7.3)
- [CVE-2026-38426](https://cve.now/CVE-2026-38426.md): Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv\_10\_sc (CVSS 7.3)
- [CVE-2026-38427](https://cve.now/CVE-2026-38427.md): An issue in fetch\_jpg() in xdrv\_10\_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. (CVSS 7.3)
- [CVE-2026-38807](https://cve.now/CVE-2026-38807.md): Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component (CVSS 8.8)
- [CVE-2026-38808](https://cve.now/CVE-2026-38808.md): SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /O (CVSS 5.3)
- [CVE-2026-38930](https://cve.now/CVE-2026-38930.md): OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. (CVSS 6.5)
- [CVE-2026-38931](https://cve.now/CVE-2026-38931.md): A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cf (CVSS 5.4)
- [CVE-2026-38945](https://cve.now/CVE-2026-38945.md): Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path (CVSS 7.8)
- [CVE-2026-49009](https://cve.now/CVE-2026-49009.md): Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal. (CVSS 3.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.