# CVEs published 2026-05-28

543 CVEs were published on May 28, 2026: 57 critical, 260 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-6891](https://cve.now/CVE-2026-6891.md): Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with l (CVSS 5.0, Canon My Image Garden for macOS)
- [CVE-2026-6816](https://cve.now/CVE-2026-6816.md): TFA Basic Plugins - Access Bypass (CVSS 5.1, Drupal TFA Basic Plugins)
- [CVE-2026-5343](https://cve.now/CVE-2026-5343.md): SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 (CVSS 7.4, Drupal SAML SSO - Service Provider · drupal/miniorange\_saml)
- [CVE-2026-10028](https://cve.now/CVE-2026-10028.md): Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-8809](https://cve.now/CVE-2026-8809.md): Advanced Custom Fields: Extended \<= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '\_acf\_post\_id' Parameter (CVSS 9.8, hwk-fr Advanced Custom Fields: Extended)
- [CVE-2026-10022](https://cve.now/CVE-2026-10022.md): Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to e (CVSS 7.5, Google Chrome)
- [CVE-2026-10021](https://cve.now/CVE-2026-10021.md): Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary co (CVSS 8.8, Google Chrome)
- [CVE-2026-10020](https://cve.now/CVE-2026-10020.md): Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had com (CVSS 8.3, Google Chrome)
- [CVE-2026-10019](https://cve.now/CVE-2026-10019.md): Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-10018](https://cve.now/CVE-2026-10018.md): Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome)
- [CVE-2026-10017](https://cve.now/CVE-2026-10017.md): Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process t (CVSS 8.3, Google Chrome)
- [CVE-2026-10016](https://cve.now/CVE-2026-10016.md): Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10015](https://cve.now/CVE-2026-10015.md): Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10014](https://cve.now/CVE-2026-10014.md): Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-10013](https://cve.now/CVE-2026-10013.md): Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-10012](https://cve.now/CVE-2026-10012.md): Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-10011](https://cve.now/CVE-2026-10011.md): Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro (CVSS 3.1, Google Chrome)
- [CVE-2026-10010](https://cve.now/CVE-2026-10010.md): Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the (CVSS 5.0, Google Chrome)
- [CVE-2026-10009](https://cve.now/CVE-2026-10009.md): Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to exec (CVSS 7.5, Google Chrome)
- [CVE-2026-10008](https://cve.now/CVE-2026-10008.md): Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infor (CVSS 6.5, Google Chrome)
- [CVE-2026-10007](https://cve.now/CVE-2026-10007.md): Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10006](https://cve.now/CVE-2026-10006.md): Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted (CVSS 7.5, Google Chrome)
- [CVE-2026-10005](https://cve.now/CVE-2026-10005.md): Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in (CVSS 7.5, Google Chrome)
- [CVE-2026-10004](https://cve.now/CVE-2026-10004.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spo (CVSS 5.4, Google Chrome)
- [CVE-2026-10003](https://cve.now/CVE-2026-10003.md): Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI ges (CVSS 7.5, Google Chrome)
- [CVE-2026-10002](https://cve.now/CVE-2026-10002.md): Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-10001](https://cve.now/CVE-2026-10001.md): Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-10000](https://cve.now/CVE-2026-10000.md): Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer p (CVSS 8.3, Google Chrome)
- [CVE-2026-9999](https://cve.now/CVE-2026-9999.md): Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code in (CVSS 8.8, Google Chrome)
- [CVE-2026-9998](https://cve.now/CVE-2026-9998.md): Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to pote (CVSS 8.3, Google Chrome)
- [CVE-2026-9997](https://cve.now/CVE-2026-9997.md): Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9996](https://cve.now/CVE-2026-9996.md): Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive infor (CVSS 6.5, Google Chrome)
- [CVE-2026-9995](https://cve.now/CVE-2026-9995.md): Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9994](https://cve.now/CVE-2026-9994.md): Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-9993](https://cve.now/CVE-2026-9993.md): Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9992](https://cve.now/CVE-2026-9992.md): Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-9991](https://cve.now/CVE-2026-9991.md): Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the (CVSS 3.1, Google Chrome)
- [CVE-2026-9990](https://cve.now/CVE-2026-9990.md): Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in (CVSS 7.5, Google Chrome)
- [CVE-2026-9989](https://cve.now/CVE-2026-9989.md): Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same origin policy via a (CVSS 6.3, Google Chrome)
- [CVE-2026-9988](https://cve.now/CVE-2026-9988.md): Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape (CVSS 8.3, Google Chrome)
- [CVE-2026-9987](https://cve.now/CVE-2026-9987.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 148.0.7778.216 allowed a local attacker to (CVSS 7.8, Google Chrome)
- [CVE-2026-9986](https://cve.now/CVE-2026-9986.md): Insufficient validation of untrusted input in OptimizationGuide in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had c (CVSS 4.2, Google Chrome)
- [CVE-2026-9985](https://cve.now/CVE-2026-9985.md): Insufficient validation of untrusted input in Media in Google Chrome on ChromeOS prior to 148.0.7778.216 allowed a remote attacker who had c (CVSS 5.3, Google Chrome)
- [CVE-2026-9984](https://cve.now/CVE-2026-9984.md): Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted H (CVSS 8.8, Google Chrome)
- [CVE-2026-9983](https://cve.now/CVE-2026-9983.md): Type Confusion in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-9982](https://cve.now/CVE-2026-9982.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised t (CVSS 8.3, Google Chrome)
- [CVE-2026-9981](https://cve.now/CVE-2026-9981.md): Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-9980](https://cve.now/CVE-2026-9980.md): Insufficient validation of untrusted input in Printing in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromise (CVSS 5.0, Google Chrome)
- [CVE-2026-9979](https://cve.now/CVE-2026-9979.md): Insufficient validation of untrusted input in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised t (CVSS 5.0, Google Chrome)
- [CVE-2026-9978](https://cve.now/CVE-2026-9978.md): Use after free in Glic in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-9977](https://cve.now/CVE-2026-9977.md): Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had (CVSS 8.3, Google Chrome)
- [CVE-2026-9976](https://cve.now/CVE-2026-9976.md): Inappropriate implementation in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-9975](https://cve.now/CVE-2026-9975.md): Out of bounds read and write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pr (CVSS 8.3, Google Chrome)
- [CVE-2026-9974](https://cve.now/CVE-2026-9974.md): Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-9973](https://cve.now/CVE-2026-9973.md): Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-9972](https://cve.now/CVE-2026-9972.md): Uninitialized Use in Gamepad in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proc (CVSS 8.3, Google Chrome)
- [CVE-2026-9971](https://cve.now/CVE-2026-9971.md): Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage (CVSS 5.4, Google Chrome)
- [CVE-2026-9970](https://cve.now/CVE-2026-9970.md): Use after free in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9969](https://cve.now/CVE-2026-9969.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary (CVSS 8.8, Google Chrome)
- [CVE-2026-9968](https://cve.now/CVE-2026-9968.md): Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-9967](https://cve.now/CVE-2026-9967.md): Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-9966](https://cve.now/CVE-2026-9966.md): Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-9965](https://cve.now/CVE-2026-9965.md): Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9964](https://cve.now/CVE-2026-9964.md): Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious (CVSS 8.1, Google Chrome)
- [CVE-2026-9963](https://cve.now/CVE-2026-9963.md): Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specifi (CVSS 7.5, Google Chrome)
- [CVE-2026-9962](https://cve.now/CVE-2026-9962.md): Use after free in WebRTC in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9961](https://cve.now/CVE-2026-9961.md): Use after free in SurfaceCapture in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption v (CVSS 8.8, Google Chrome)
- [CVE-2026-9960](https://cve.now/CVE-2026-9960.md): Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to ex (CVSS 7.5, Google Chrome)
- [CVE-2026-9959](https://cve.now/CVE-2026-9959.md): Race in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 3.1, Google Chrome)
- [CVE-2026-9958](https://cve.now/CVE-2026-9958.md): Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-9957](https://cve.now/CVE-2026-9957.md): Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-9956](https://cve.now/CVE-2026-9956.md): Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific U (CVSS 7.5, Google Chrome)
- [CVE-2026-9955](https://cve.now/CVE-2026-9955.md): Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-9954](https://cve.now/CVE-2026-9954.md): Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 7.5, Google Chrome)
- [CVE-2026-9953](https://cve.now/CVE-2026-9953.md): Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-9952](https://cve.now/CVE-2026-9952.md): Use after free in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-9951](https://cve.now/CVE-2026-9951.md): Use after free in UI in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafte (CVSS 8.3, Google Chrome)
- [CVE-2026-9950](https://cve.now/CVE-2026-9950.md): Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromi (CVSS 3.1, Google Chrome)
- [CVE-2026-9949](https://cve.now/CVE-2026-9949.md): Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-9948](https://cve.now/CVE-2026-9948.md): Use after free in Views in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process t (CVSS 8.3, Google Chrome)
- [CVE-2026-9947](https://cve.now/CVE-2026-9947.md): Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-9946](https://cve.now/CVE-2026-9946.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9945](https://cve.now/CVE-2026-9945.md): Use after free in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-9944](https://cve.now/CVE-2026-9944.md): Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to le (CVSS 3.1, Google Chrome)
- [CVE-2026-9943](https://cve.now/CVE-2026-9943.md): Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-9942](https://cve.now/CVE-2026-9942.md): Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to by (CVSS 5.0, Google Chrome)
- [CVE-2026-9941](https://cve.now/CVE-2026-9941.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9940](https://cve.now/CVE-2026-9940.md): Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-9939](https://cve.now/CVE-2026-9939.md): Heap buffer overflow in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-9938](https://cve.now/CVE-2026-9938.md): Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-9937](https://cve.now/CVE-2026-9937.md): Use after free in UI in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-9936](https://cve.now/CVE-2026-9936.md): Use after free in GFX in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-9935](https://cve.now/CVE-2026-9935.md): Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML p (CVSS 4.3, Google Chrome)
- [CVE-2026-9934](https://cve.now/CVE-2026-9934.md): Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 7.5, Google Chrome)
- [CVE-2026-9933](https://cve.now/CVE-2026-9933.md): Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI ges (CVSS 7.5, Google Chrome)
- [CVE-2026-9932](https://cve.now/CVE-2026-9932.md): Use after free in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-9931](https://cve.now/CVE-2026-9931.md): Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-9930](https://cve.now/CVE-2026-9930.md): Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory wri (CVSS 4.3, Google Chrome)
- [CVE-2026-9929](https://cve.now/CVE-2026-9929.md): Inappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin dat (CVSS 4.3, Google Chrome)
- [CVE-2026-9928](https://cve.now/CVE-2026-9928.md): Out of bounds read in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-9927](https://cve.now/CVE-2026-9927.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9926](https://cve.now/CVE-2026-9926.md): Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-9925](https://cve.now/CVE-2026-9925.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9924](https://cve.now/CVE-2026-9924.md): Heap buffer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer (CVSS 8.3, Google Chrome)
- [CVE-2026-9923](https://cve.now/CVE-2026-9923.md): Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-9922](https://cve.now/CVE-2026-9922.md): Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 7.5, Google Chrome)
- [CVE-2026-9921](https://cve.now/CVE-2026-9921.md): Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin information vi (CVSS 4.3, Google Chrome)
- [CVE-2026-9920](https://cve.now/CVE-2026-9920.md): Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proc (CVSS 3.1, Google Chrome)
- [CVE-2026-9919](https://cve.now/CVE-2026-9919.md): Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-9918](https://cve.now/CVE-2026-9918.md): Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-9917](https://cve.now/CVE-2026-9917.md): Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive inf (CVSS 6.5, Google Chrome)
- [CVE-2026-9916](https://cve.now/CVE-2026-9916.md): Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-9915](https://cve.now/CVE-2026-9915.md): Heap buffer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-9914](https://cve.now/CVE-2026-9914.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised t (CVSS 8.3, Google Chrome)
- [CVE-2026-9913](https://cve.now/CVE-2026-9913.md): Inappropriate implementation in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform out of bound (CVSS 4.3, Google Chrome)
- [CVE-2026-9912](https://cve.now/CVE-2026-9912.md): Inappropriate implementation in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sens (CVSS 6.5, Google Chrome)
- [CVE-2026-9911](https://cve.now/CVE-2026-9911.md): Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-9910](https://cve.now/CVE-2026-9910.md): Out of bounds memory access in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a s (CVSS 8.8, Google Chrome)
- [CVE-2026-9909](https://cve.now/CVE-2026-9909.md): Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to exec (CVSS 7.5, Google Chrome)
- [CVE-2026-9908](https://cve.now/CVE-2026-9908.md): Out of bounds read in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-9907](https://cve.now/CVE-2026-9907.md): Out of bounds read in Dawn in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-9906](https://cve.now/CVE-2026-9906.md): Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-9905](https://cve.now/CVE-2026-9905.md): Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the render (CVSS 8.3, Google Chrome)
- [CVE-2026-9904](https://cve.now/CVE-2026-9904.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a cra (CVSS 8.3, Google Chrome)
- [CVE-2026-9903](https://cve.now/CVE-2026-9903.md): Insufficient validation of untrusted input in Site Isolation in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had comp (CVSS 5.0, Google Chrome)
- [CVE-2026-9902](https://cve.now/CVE-2026-9902.md): Use after free in Accessibility in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-9901](https://cve.now/CVE-2026-9901.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execu (CVSS 7.5, Google Chrome)
- [CVE-2026-9900](https://cve.now/CVE-2026-9900.md): Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-9899](https://cve.now/CVE-2026-9899.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9898](https://cve.now/CVE-2026-9898.md): Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had comp (CVSS 8.3, Google Chrome)
- [CVE-2026-9897](https://cve.now/CVE-2026-9897.md): Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-9896](https://cve.now/CVE-2026-9896.md): Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-9895](https://cve.now/CVE-2026-9895.md): Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-9894](https://cve.now/CVE-2026-9894.md): Use after free in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-9893](https://cve.now/CVE-2026-9893.md): Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-9892](https://cve.now/CVE-2026-9892.md): Inappropriate implementation in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the r (CVSS 8.3, Google Chrome)
- [CVE-2026-9891](https://cve.now/CVE-2026-9891.md): Use after free in Extensions in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to (CVSS 9.0, Google Chrome)
- [CVE-2026-9890](https://cve.now/CVE-2026-9890.md): Use after free in XR in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-9889](https://cve.now/CVE-2026-9889.md): Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a (CVSS 8.3, Google Chrome)
- [CVE-2026-9888](https://cve.now/CVE-2026-9888.md): Use after free in WebView in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-9887](https://cve.now/CVE-2026-9887.md): Use after free in Proxy in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted PAC scrip (CVSS 7.8, Google Chrome)
- [CVE-2026-9886](https://cve.now/CVE-2026-9886.md): Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via (CVSS 9.6, Google Chrome)
- [CVE-2026-9885](https://cve.now/CVE-2026-9885.md): Insufficient validation of untrusted input in UI in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromis (CVSS 8.3, Google Chrome)
- [CVE-2026-9884](https://cve.now/CVE-2026-9884.md): Use after free in Browser in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-9883](https://cve.now/CVE-2026-9883.md): Use after free in Base in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-9882](https://cve.now/CVE-2026-9882.md): Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-9881](https://cve.now/CVE-2026-9881.md): Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious (CVSS 9.0, Google Chrome)
- [CVE-2026-9880](https://cve.now/CVE-2026-9880.md): Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised t (CVSS 8.3, Google Chrome)
- [CVE-2026-9879](https://cve.now/CVE-2026-9879.md): Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-9878](https://cve.now/CVE-2026-9878.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-9877](https://cve.now/CVE-2026-9877.md): Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-9876](https://cve.now/CVE-2026-9876.md): Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escap (CVSS 9.6, Google Chrome)
- [CVE-2026-9875](https://cve.now/CVE-2026-9875.md): Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox e (CVSS 9.6, Google Chrome)
- [CVE-2026-9874](https://cve.now/CVE-2026-9874.md): Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-9873](https://cve.now/CVE-2026-9873.md): Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-9872](https://cve.now/CVE-2026-9872.md): Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox es (CVSS 9.6, Google Chrome)
- [CVE-2026-49299](https://cve.now/CVE-2026-49299.md): In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defi (CVSS 5.3, OpenStack Neutron · neutron)
- [CVE-2026-45364](https://cve.now/CVE-2026-45364.md): Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation (CVSS 7.3, better-auth)
- [CVE-2026-45023](https://cve.now/CVE-2026-45023.md): AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block\_id}/execute (CVSS 5.4, Significant-Gravitas AutoGPT)
- [CVE-2026-44973](https://cve.now/CVE-2026-44973.md): Billy: Path traversal vulnerabilities (CVSS 8.1, go-git go-billy · github.com/go-git/go-billy/v5 +1)
- [CVE-2026-45410](https://cve.now/CVE-2026-45410.md): Time-based user enumeration in TREK authentication endpoint (CVSS 5.3, mauriceboe TREK)
- [CVE-2026-47713](https://cve.now/CVE-2026-47713.md): AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration (CVSS 2.0, Mintplex-Labs anything-llm)
- [CVE-2026-48116](https://cve.now/CVE-2026-48116.md): AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill (CVSS 7.5, Mintplex-Labs anything-llm)
- [CVE-2026-45403](https://cve.now/CVE-2026-45403.md): AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory (CVSS 2.0, Mintplex-Labs anything-llm)
- [CVE-2026-39929](https://cve.now/CVE-2026-39929.md): Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP (CVSS 8.7, Lakeside Software, LLC. SysTrack Agent)
- [CVE-2026-44881](https://cve.now/CVE-2026-44881.md): Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update (CVSS 8.5, portainer · github.com/portainer/portainer)
- [CVE-2026-44848](https://cve.now/CVE-2026-44848.md): Portainer: Missing authorization on Docker plugin endpoints allows host RCE (CVSS 9.4, portainer · github.com/portainer/portainer)
- [CVE-2026-44849](https://cve.now/CVE-2026-44849.md): Portainer: Endpoint security bypass via Swarm service create/update (CVSS 9.4, portainer · github.com/portainer/portainer)
- [CVE-2026-44850](https://cve.now/CVE-2026-44850.md): Portainer: Bind-mount restriction bypass via HostConfig.Mounts (CVSS 8.5, portainer · github.com/portainer/portainer)
- [CVE-2026-10044](https://cve.now/CVE-2026-10044.md): ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/ (CVSS 7.5, Usagi-org ai-goofish-monitor)
- [CVE-2026-44882](https://cve.now/CVE-2026-44882.md): Portainer: Kubernetes middleware continues after token validation failure, bypassing endpoint authorization (CVSS 8.1, portainer · github.com/portainer/portainer)
- [CVE-2026-44883](https://cve.now/CVE-2026-44883.md): Portainer: JWT accepted in URL query leaks tokens to logs and referers (CVSS 7.7, portainer · github.com/portainer/portainer)
- [CVE-2026-44884](https://cve.now/CVE-2026-44884.md): Portainer: Missing authorization on custom template file endpoint exposes template content (CVSS 6.0, portainer · github.com/portainer/portainer)
- [CVE-2026-44885](https://cve.now/CVE-2026-44885.md): Portainer: Path traversal in backup archive extraction allows arbitrary file write (CVSS 5.5, portainer · github.com/portainer/portainer)
- [CVE-2026-45342](https://cve.now/CVE-2026-45342.md): LinkAce: IDOR in Update Policies Allows Any Authenticated User to Overwrite Other Users' Links, Lists, Tags, and Notes (CVSS 7.1, Kovah LinkAce)
- [CVE-2026-45343](https://cve.now/CVE-2026-45343.md): LinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session Hijacking (CVSS 8.5, Kovah LinkAce)
- [CVE-2026-45344](https://cve.now/CVE-2026-45344.md): LinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instances (CVSS 8.1, Kovah LinkAce)
- [CVE-2026-45366](https://cve.now/CVE-2026-45366.md): typescript-utcp: SSRF via attacker-controlled OpenAPI servers\[0\].url in HTTP communication protocol (CVSS 4.7, universal-tool-calling-protocol typescript-utcp · @utcp/http)
- [CVE-2026-9646](https://cve.now/CVE-2026-9646.md): ScadaBR Unauthenticated Reflected Cross-Site Scripting (CVSS 6.1, ScadaBR)
- [CVE-2026-9645](https://cve.now/CVE-2026-9645.md): ScadaBR Authenticated Remote Code Execution (CVSS 9.9, ScadaBR)
- [CVE-2026-42071](https://cve.now/CVE-2026-42071.md): MantisBT: Private Bugnote Attachment Content Leak via REST API (CVSS 7.2, mantisbt · mantisbt/mantisbt)
- [CVE-2026-42070](https://cve.now/CVE-2026-42070.md): MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-44655](https://cve.now/CVE-2026-44655.md): MantisBT: Stored XSS on Move Attachments Admin Page (CVSS 8.6, mantisbt · mantisbt/mantisbt)
- [CVE-2026-41897](https://cve.now/CVE-2026-41897.md): MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-44657](https://cve.now/CVE-2026-44657.md): MantisBT: Stored XSS in File Download (CVSS 7.5, mantisbt · mantisbt/mantisbt)
- [CVE-2026-45288](https://cve.now/CVE-2026-45288.md): Marten has an SQL injection vulnerability in its full-text search regConfig parameter (CVSS 9.8, JasperFx marten · Marten)
- [CVE-2026-46843](https://cve.now/CVE-2026-46843.md): Vulnerability in Oracle REST Data Services (component: Core). (CVSS 5.3, Oracle REST Data Services)
- [CVE-2026-46842](https://cve.now/CVE-2026-46842.md): Vulnerability in Oracle REST Data Services (component: Core). (CVSS 5.3, Oracle REST Data Services)
- [CVE-2026-46841](https://cve.now/CVE-2026-46841.md): Vulnerability in Oracle REST Data Services (component: General). (CVSS 5.3, Oracle REST Data Services)
- [CVE-2026-46840](https://cve.now/CVE-2026-46840.md): Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). (CVSS 10.0, Oracle REST Data Services)
- [CVE-2026-46839](https://cve.now/CVE-2026-46839.md): Vulnerability in Oracle REST Data Services (component: Core). (CVSS 9.9, Oracle REST Data Services)
- [CVE-2026-46837](https://cve.now/CVE-2026-46837.md): Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). (CVSS 8.8, Oracle Flow Manufacturing)
- [CVE-2026-46835](https://cve.now/CVE-2026-46835.md): Vulnerability in the Net Service component of Oracle Database Server. (CVSS 7.5, Oracle Database Server)
- [CVE-2026-46834](https://cve.now/CVE-2026-46834.md): Vulnerability in the Net Service component of Oracle Database Server. (CVSS 7.5, Oracle Database Server)
- [CVE-2026-46833](https://cve.now/CVE-2026-46833.md): Vulnerability in the Net Service component of Oracle Database Server. (CVSS 9.0, Oracle Database Server)
- [CVE-2026-46830](https://cve.now/CVE-2026-46830.md): Vulnerability in Oracle REST Data Services (component: Mongoapi). (CVSS 5.3, Oracle REST Data Services)
- [CVE-2026-46829](https://cve.now/CVE-2026-46829.md): Vulnerability in Oracle REST Data Services (component: Mongoapi). (CVSS 7.5, Oracle REST Data Services)
- [CVE-2026-46828](https://cve.now/CVE-2026-46828.md): Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Payroll)
- [CVE-2026-46827](https://cve.now/CVE-2026-46827.md): Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). (CVSS 8.8, Oracle Payroll)
- [CVE-2026-46826](https://cve.now/CVE-2026-46826.md): Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Payroll)
- [CVE-2026-46824](https://cve.now/CVE-2026-46824.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). (CVSS 9.9, Oracle Universal Work Queue)
- [CVE-2026-46823](https://cve.now/CVE-2026-46823.md): Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). (CVSS 7.7, Oracle Public Sector Financials)
- [CVE-2026-46822](https://cve.now/CVE-2026-46822.md): Vulnerability in the Oracle iAssets product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.9, Oracle iAssets)
- [CVE-2026-46821](https://cve.now/CVE-2026-46821.md): Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). (CVSS 7.7, Oracle Financials Common Modules)
- [CVE-2026-46820](https://cve.now/CVE-2026-46820.md): Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). (CVSS 8.5, Oracle Financials Common Modules)
- [CVE-2026-46819](https://cve.now/CVE-2026-46819.md): Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.1, Oracle Internet Procurement Connector)
- [CVE-2026-46818](https://cve.now/CVE-2026-46818.md): Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). (CVSS 7.4, Oracle Payments)
- [CVE-2026-46817](https://cve.now/CVE-2026-46817.md): Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). (CVSS 9.8, KEV, Oracle Payments)
- [CVE-2026-46775](https://cve.now/CVE-2026-46775.md): Vulnerability in Oracle REST Data Services (component: Core). (CVSS 9.9, Oracle REST Data Services)
- [CVE-2026-35277](https://cve.now/CVE-2026-35277.md): Vulnerability in Oracle REST Data Services (component: Core). (CVSS 8.1, Oracle REST Data Services)
- [CVE-2026-35266](https://cve.now/CVE-2026-35266.md): Vulnerability in Oracle REST Data Services (component: Core). (CVSS 7.9, Oracle REST Data Services)
- [CVE-2026-34311](https://cve.now/CVE-2026-34311.md): Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). (CVSS 9.8, Oracle Hospitality OPERA 5 Property Services)
- [CVE-2026-49093](https://cve.now/CVE-2026-49093.md): Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access (CVSS 6.3, Elastic Kibana)
- [CVE-2026-49094](https://cve.now/CVE-2026-49094.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-49095](https://cve.now/CVE-2026-49095.md): Improper Input Validation in Kibana Fleet Leading to Privilege Escalation (CVSS 7.2, Elastic Kibana)
- [CVE-2026-42398](https://cve.now/CVE-2026-42398.md): Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access (CVSS 7.7, Elastic Kibana)
- [CVE-2026-42399](https://cve.now/CVE-2026-42399.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-42400](https://cve.now/CVE-2026-42400.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-42401](https://cve.now/CVE-2026-42401.md): Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection (CVSS 4.1, Elastic Kibana)
- [CVE-2026-33463](https://cve.now/CVE-2026-33463.md): Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access (CVSS 5.3, Elastic Kibana)
- [CVE-2026-33464](https://cve.now/CVE-2026-33464.md): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-33462](https://cve.now/CVE-2026-33462.md): Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts (CVSS 4.6, Elastic Kibana)
- [CVE-2026-32847](https://cve.now/CVE-2026-32847.md): DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py (CVSS 8.7, HKUDS DeepCode)
- [CVE-2026-33590](https://cve.now/CVE-2026-33590.md): Insecure default permissions in Portainer CE (CVSS 8.5, Portainer Community Edition)
- [CVE-2026-49130](https://cve.now/CVE-2026-49130.md): Music Player Daemon \< 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx (CVSS 6.9, MusicPlayerDaemon MPD)
- [CVE-2026-49129](https://cve.now/CVE-2026-49129.md): Music Player Daemon \< 0.24.11 SSRF via CurlInputPlugin (CVSS 6.9, MusicPlayerDaemon MPD)
- [CVE-2026-9039](https://cve.now/CVE-2026-9039.md): Initialization of a resource with an insecure default in XCharge C6 (CVSS 8.6, XCharge C6)
- [CVE-2026-9038](https://cve.now/CVE-2026-9038.md): Stack-based buffer overflow in XCharge C6 (CVSS 8.6, XCharge C6)
- [CVE-2026-9037](https://cve.now/CVE-2026-9037.md): Download of code without integrity check in XCharge C6 (CVSS 9.3, XCharge C6)
- [CVE-2026-49128](https://cve.now/CVE-2026-49128.md): Music Player Daemon \< 0.24.11 Path Traversal via LocalStorage URI Handling (CVSS 8.7, MusicPlayerDaemon MPD)
- [CVE-2026-49127](https://cve.now/CVE-2026-49127.md): Music Player Daemon \< 0.24.11 Stack Buffer Overflow via pcm\_unpack\_24be (CVSS 8.8, MusicPlayerDaemon MPD)
- [CVE-2026-46685](https://cve.now/CVE-2026-46685.md): RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console (CVSS 6.0, rustfs)
- [CVE-2026-45039](https://cve.now/CVE-2026-45039.md): RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation (CVSS 9.8, rustfs)
- [CVE-2026-45040](https://cve.now/CVE-2026-45040.md): RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs \[Debug Mode\] (CVSS 5.3, rustfs)
- [CVE-2026-45041](https://cve.now/CVE-2026-45041.md): RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery (CVSS 8.7, rustfs)
- [CVE-2026-45042](https://cve.now/CVE-2026-45042.md): RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Source (CVSS 7.1, rustfs)
- [CVE-2026-45044](https://cve.now/CVE-2026-45044.md): RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers (CVSS 8.8, rustfs)
- [CVE-2026-47136](https://cve.now/CVE-2026-47136.md): RustFS: Unauthenticated RustFS console license endpoint exposes license metadata (CVSS 6.9, rustfs)
- [CVE-2026-47337](https://cve.now/CVE-2026-47337.md): NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation (CVSS 3.3, Canonical Ubuntu Linux)
- [CVE-2026-47336](https://cve.now/CVE-2026-47336.md): Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules (CVSS 3.3, Canonical Ubuntu Linux)
- [CVE-2026-47335](https://cve.now/CVE-2026-47335.md): NULL pointer dereference in Ubuntu Linux AppArmor notification handling (CVSS 5.5, Canonical Ubuntu Linux)
- [CVE-2026-47334](https://cve.now/CVE-2026-47334.md): Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling (CVSS 5.5, Canonical Ubuntu Linux)
- [CVE-2026-47333](https://cve.now/CVE-2026-47333.md): Out-of-bounds read in Ubuntu Linux AppArmor notification handling (CVSS 7.8, Canonical Ubuntu Linux)
- [CVE-2026-47332](https://cve.now/CVE-2026-47332.md): Out-of-bounds read in Ubuntu Linux AppArmor notification handling (CVSS 5.5, Canonical Ubuntu Linux)
- [CVE-2026-47331](https://cve.now/CVE-2026-47331.md): Use-after-free in Ubuntu Linux AppArmor notification handling (CVSS 7.8, Canonical Ubuntu Linux)
- [CVE-2026-47330](https://cve.now/CVE-2026-47330.md): Use of uninitialized value in Ubuntu Linux AppArmor notification handling (CVSS 3.3, Canonical Ubuntu Linux)
- [CVE-2026-47329](https://cve.now/CVE-2026-47329.md): Incorrect validation of field size in Ubuntu Linux AppArmor notification responses (CVSS 3.3, Canonical Ubuntu Linux)
- [CVE-2026-47328](https://cve.now/CVE-2026-47328.md): Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling (CVSS 6.1, Canonical Ubuntu Linux)
- [CVE-2026-47327](https://cve.now/CVE-2026-47327.md): NULL pointer dereference in Ubuntu Linux AppArmor notification handling (CVSS 3.3, Canonical Ubuntu Linux)
- [CVE-2026-47326](https://cve.now/CVE-2026-47326.md): Memory leak in Ubuntu Linux AppArmor large notification response allocation (CVSS 5.5, Canonical Ubuntu Linux)
- [CVE-2026-45332](https://cve.now/CVE-2026-45332.md): Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint (CVSS 7.5, marcantondahmen automad · automad/automad)
- [CVE-2026-4944](https://cve.now/CVE-2026-4944.md): Hardcoded trust\_remote\_code=True in vllm-project/vllm Bypasses User Security Control (CVSS 8.8, vllm-project/vllm)
- [CVE-2026-43979](https://cve.now/CVE-2026-43979.md): Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (\`pdf\_service.py:\_markdown\_to\_html\`) (CVSS 5.0, LearningCircuit local-deep-research · local-deep-research)
- [CVE-2026-46526](https://cve.now/CVE-2026-46526.md): Local Deep Research: SSRF bypass in \`safe\_get\` (CVSS 5.0, LearningCircuit local-deep-research · local-deep-research)
- [CVE-2026-46509](https://cve.now/CVE-2026-46509.md): deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CVSS 8.2, ranfdev deepobj · @ranfdev/deepobj)
- [CVE-2026-43898](https://cve.now/CVE-2026-43898.md): SandboxJS: Sandbox escape via Function.caller leakage of internal call op (CVSS 10.0, nyariv SandboxJS · @nyariv/sandboxjs)
- [CVE-2026-45307](https://cve.now/CVE-2026-45307.md): Speakr: Open redirect in is\_safe\_url via parser mismatch on next parameter (CVSS 6.1, murtaza-nasir speakr)
- [CVE-2026-45021](https://cve.now/CVE-2026-45021.md): Kuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin (CVSS 5.1, kumahq kuma · github.com/kumahq/kuma +1)
- [CVE-2026-45311](https://cve.now/CVE-2026-45311.md): CodeWhale: run\_tests Tool Enables RCE via Malicious Repository Without Approval (CVSS 9.6, Hmbown CodeWhale · deepseek-tui +1)
- [CVE-2026-45310](https://cve.now/CVE-2026-45310.md): CodeWhale: SSRF via HTTP Redirect Bypass in fetch\_url Tool (CVSS 7.4, Hmbown CodeWhale · deepseek-tui +1)
- [CVE-2026-45373](https://cve.now/CVE-2026-45373.md): CodeWhale: SSRF‌ IPV6 bypass (CVSS 7.4, Hmbown CodeWhale · deepseek-tui)
- [CVE-2026-45374](https://cve.now/CVE-2026-45374.md): CodeWhale: task\_create Insecure Defaults Enable RCE via Prompt Injection in Project Files (CVSS 9.6, Hmbown CodeWhale · deepseek-tui)
- [CVE-2026-45058](https://cve.now/CVE-2026-45058.md): electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark (CVSS 9.4, electerm)
- [CVE-2026-45353](https://cve.now/CVE-2026-45353.md): electerm: Local code through electerm's single-instance socket (CVSS 9.3, electerm)
- [CVE-2026-45787](https://cve.now/CVE-2026-45787.md): electerm's encrypt method not safe enough (CVSS 6.0, electerm)
- [CVE-2026-45306](https://cve.now/CVE-2026-45306.md): pyLoad: Incomplete Fix for CVE-2026-33509 -storage\_folder Bypass via Session Directory (CVSS 6.5, pyload · pyload-ng)
- [CVE-2026-45348](https://cve.now/CVE-2026-45348.md): pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal (CVSS 8.7, pyload · pyload-ng)
- [CVE-2026-46561](https://cve.now/CVE-2026-46561.md): pyLoad: SSRF via HTTP Redirect Bypass in parse\_urls API (CVSS 5.0, pyload · pyload-ng)
- [CVE-2026-44794](https://cve.now/CVE-2026-44794.md): Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference (CVSS 5.4, nautobot)
- [CVE-2026-44796](https://cve.now/CVE-2026-44796.md): Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) (CVSS 6.5, nautobot)
- [CVE-2026-44797](https://cve.now/CVE-2026-44797.md): Nautobot: Webhook definitions could be used for server-side request forgery (SSRF) (CVSS 8.5, nautobot)
- [CVE-2026-44798](https://cve.now/CVE-2026-44798.md): Nautobot: GitRepository.current\_head field should not be writable through REST API (CVSS 7.1, nautobot)
- [CVE-2026-45323](https://cve.now/CVE-2026-45323.md): MeshCore Card: XSS vulnerability through meshcore node name (CVSS 9.6, jpettitt meshcore-card)
- [CVE-2026-45296](https://cve.now/CVE-2026-45296.md): OpenReplay: Cross-tenant information disclosure in app\_apikey projectKey routes via missing tenant binding (CVSS 7.7, openreplay)
- [CVE-2026-45297](https://cve.now/CVE-2026-45297.md): Cross-tenant IDOR on feature-flag and assist-stats routes via {project\_id} case mismatch (CVSS 5.3, openreplay)
- [CVE-2026-34126](https://cve.now/CVE-2026-34126.md): Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C (CVSS 7.3, TP-Link Systems Tapo L535E v1.0, · TP-Link Systems Tapo… +1)
- [CVE-2026-44543](https://cve.now/CVE-2026-44543.md): Local Path Provisioner: HelperPod Template Injection (CVSS 8.7, rancher local-path-provisioner · github.com/rancher/local-p…)
- [CVE-2026-45292](https://cve.now/CVE-2026-45292.md): opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation (CVSS 5.3, open-telemetry opentelemetry-java · io.opentelemetry ope… +3)
- [CVE-2026-9098](https://cve.now/CVE-2026-9098.md): CVE-2026-9098 (CVSS 9.1, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-9097](https://cve.now/CVE-2026-9097.md): CVE-2026-9097 (CVSS 9.8, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-9096](https://cve.now/CVE-2026-9096.md): CVE-2026-9096 (CVSS 7.5, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-9095](https://cve.now/CVE-2026-9095.md): CVE-2026-9095 (CVSS 8.1, Casdoor)
- [CVE-2026-9094](https://cve.now/CVE-2026-9094.md): CVE-2026-9094 (CVSS 9.8, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-41141](https://cve.now/CVE-2026-41141.md): EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup (CVSS 6.5, espocrm)
- [CVE-2026-41160](https://cve.now/CVE-2026-41160.md): EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes (CVSS 4.3, espocrm)
- [CVE-2026-9093](https://cve.now/CVE-2026-9093.md): CVE-2026-9093 (CVSS 9.8, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-45261](https://cve.now/CVE-2026-45261.md): GitButler: Link injection via forge integration enables arbitrary script execution (CVSS 9.3, gitbutlerapp gitbutler)
- [CVE-2026-9092](https://cve.now/CVE-2026-9092.md): CVE-2026-9092 (CVSS 9.1, Casdoor)
- [CVE-2026-9091](https://cve.now/CVE-2026-9091.md): CVE-2026-9091 (CVSS 5.3, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-9090](https://cve.now/CVE-2026-9090.md): CVE-2026-9090 (CVSS 9.1, Casdoor · github.com/casdoor/casdoor)
- [CVE-2026-44466](https://cve.now/CVE-2026-44466.md): Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions (CVSS 8.6, zed-industries zed)
- [CVE-2026-44463](https://cve.now/CVE-2026-44463.md): Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions (CVSS 8.6, zed-industries zed)
- [CVE-2026-44462](https://cve.now/CVE-2026-44462.md): Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions (CVSS 6.4, zed-industries zed)
- [CVE-2026-44465](https://cve.now/CVE-2026-44465.md): Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config (CVSS 8.6, zed-industries zed)
- [CVE-2026-44461](https://cve.now/CVE-2026-44461.md): Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote) (CVSS 8.6, zed-industries zed)
- [CVE-2026-45078](https://cve.now/CVE-2026-45078.md): Synapse CPU starvation (Denial of Service) (CVSS 6.8, element-hq synapse · matrix-synapse)
- [CVE-2026-45076](https://cve.now/CVE-2026-45076.md): Synapse pagination denial of service (CVSS 5.1, element-hq synapse · matrix-synapse)
- [CVE-2026-41185](https://cve.now/CVE-2026-41185.md): ServiceAccount token disclosure via Azure IPAM CNI plugin logs (CVSS 6.0, Tigera Calico · github.com/projectcalico/calico +1)
- [CVE-2026-6720](https://cve.now/CVE-2026-6720.md): Calicoctl leaks cluster credentials to stderr when verbose logging is enabled (CVSS 7.2, Tigera Calico · github.com/projectcalico/calicoctl/v3 +1)
- [CVE-2026-41184](https://cve.now/CVE-2026-41184.md): ServiceAccount token disclosure via install-cni container logs (CVSS 6.0, Tigera Calico · github.com/projectcalico/calico +1)
- [CVE-2026-44477](https://cve.now/CVE-2026-44477.md): CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE (CVSS 9.4, cloudnative-pg · github.com/cloudnative-pg/cloudnative-pg)
- [CVE-2026-8697](https://cve.now/CVE-2026-8697.md): Improper Authentication Rate Limiting on TP-Link's Archer C64 (CVSS 8.7, TP-Link Systems Archer C64)
- [CVE-2026-24444](https://cve.now/CVE-2026-24444.md): SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php (CVSS 9.3, SDMC Technology Co. NE6037)
- [CVE-2026-47673](https://cve.now/CVE-2026-47673.md): Hono: JWT middleware accepts any Authorization scheme, not only Bearer (CVSS 4.8, honojs hono · hono)
- [CVE-2026-47674](https://cve.now/CVE-2026-47674.md): Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 (CVSS 5.3, honojs hono · hono)
- [CVE-2026-47675](https://cve.now/CVE-2026-47675.md): Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection (CVSS 4.3, honojs hono · hono)
- [CVE-2026-47676](https://cve.now/CVE-2026-47676.md): Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths (CVSS 5.3, honojs hono · hono)
- [CVE-2026-47762](https://cve.now/CVE-2026-47762.md): TinyMCE Cross-Site Scripting (XSS) vulnerability through \`mce:protected\` comments (CVSS 8.7, tinymce · tinymce/tinymce)
- [CVE-2026-47761](https://cve.now/CVE-2026-47761.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin \`data-mce-object\` injection (CVSS 8.7, tinymce · tinymce/tinymce)
- [CVE-2026-47759](https://cve.now/CVE-2026-47759.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes (CVSS 8.7, tinymce · tinymce/tinymce)
- [CVE-2026-47760](https://cve.now/CVE-2026-47760.md): TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs (CVSS 8.7, tinymce · tinymce/tinymce)
- [CVE-2026-48525](https://cve.now/CVE-2026-48525.md): PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS (CVSS 5.3, jpadilla pyjwt · pyjwt)
- [CVE-2026-48523](https://cve.now/CVE-2026-48523.md): PyJWT: Algorithm allow-list bypass when decoding with \`PyJWK\` / \`PyJWKClient\` keys (CVSS 5.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-48526](https://cve.now/CVE-2026-48526.md): PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed (CVSS 7.4, jpadilla pyjwt · pyjwt)
- [CVE-2026-48524](https://cve.now/CVE-2026-48524.md): PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) (CVSS 3.7, jpadilla pyjwt · pyjwt)
- [CVE-2026-48522](https://cve.now/CVE-2026-48522.md): PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes (CVSS 4.2, jpadilla pyjwt · pyjwt)
- [CVE-2026-48155](https://cve.now/CVE-2026-48155.md): pypdf: Possible large memory usage for large offsets for layout mode text (CVSS 4.8, py-pdf pypdf · pypdf)
- [CVE-2026-48156](https://cve.now/CVE-2026-48156.md): pypdf: Possible long runtimes for zero-only width values in cross-reference streams (CVSS 5.1, py-pdf pypdf · pypdf)
- [CVE-2026-48735](https://cve.now/CVE-2026-48735.md): pypdf: Manipulated XMP metadata streams can exhaust RAM (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-44594](https://cve.now/CVE-2026-44594.md): esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files (CVSS 7.5, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2026-44593](https://cve.now/CVE-2026-44593.md): esm.sh: Legacy Route Path Traversal Can Lead to RCE (CVSS 8.7, esm-dev esm.sh · github.com/esm-dev/esm.sh)
- [CVE-2026-44672](https://cve.now/CVE-2026-44672.md): mapfish-print: Remote Code Injection (RCE) in Dynamic table (CVSS 9.3, mapfish-print · camptocamp mapfish\_print +4)
- [CVE-2026-44358](https://cve.now/CVE-2026-44358.md): Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint (CVSS 8.2, espressif shared-github-dangerjs)
- [CVE-2026-45017](https://cve.now/CVE-2026-45017.md): Python Liquid: Absolute paths escape filesystem loader search path (CVSS 8.2, jg-rp liquid · python-liquid)
- [CVE-2026-41565](https://cve.now/CVE-2026-41565.md): CryptX versions before 0.088\_001 for Perl have a stack buffer overflow in four AEAD decrypt\_verify helpers (CVSS 7.5, MIK CryptX)
- [CVE-2026-35676](https://cve.now/CVE-2026-35676.md): phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint (CVSS 8.2, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-35675](https://cve.now/CVE-2026-35675.md): phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update (CVSS 8.2, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-35672](https://cve.now/CVE-2026-35672.md): phpMyFAQ - Authentication Bypass via Empty API Token (CVSS 7.5, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-35671](https://cve.now/CVE-2026-35671.md): phpMyFAQ - Insecure Direct Object Reference in User Password API (CVSS 8.8, thorsten phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-8990](https://cve.now/CVE-2026-8990.md): Authentication Bypass in Kidsview (CVSS 5.3, View Concept Kidsview)
- [CVE-2026-49237](https://cve.now/CVE-2026-49237.md): Local Privilege Escalation in Canonical Multipass (CVSS 7.8, Canonical Multipass)
- [CVE-2026-49238](https://cve.now/CVE-2026-49238.md): SFTP Server VM Escape in Canonical Multipass (CVSS 8.4, Canonical Multipass)
- [CVE-2026-42250](https://cve.now/CVE-2026-42250.md): Off-by-One Leading to Out-of-Bounds Write in bzip2 (CVSS 4.8, bzip2)
- [CVE-2026-8980](https://cve.now/CVE-2026-8980.md): Privilege Escalation (CVSS 9.3, Mennekes Amtron)
- [CVE-2026-8979](https://cve.now/CVE-2026-8979.md): Authentication Bypass (CVSS 9.3, Mennekes Amtron)
- [CVE-2026-9828](https://cve.now/CVE-2026-9828.md): Logback deserialization whitelist bypass for java.lang and java.util (CVSS 2.9, QOS.CH Sarl logback · ch.qos.logback:logback-core)
- [CVE-2026-40914](https://cve.now/CVE-2026-40914.md): Apache Artemis Stomp Protocol, Apache ActiveMQ Artemis Stomp Protocol: Address routing-type can be updated by STOMP protocol user without the createAddress permission (CVSS 4.3, Apache Software Foundation Apache Artemis Stomp Protocol… +1)
- [CVE-2026-9658](https://cve.now/CVE-2026-9658.md): Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths (CVSS 7.3, RRWO Plack::Middleware::Security::Common)
- [CVE-2026-46241](https://cve.now/CVE-2026-46241.md): spi: mpc52xx: fix use-after-free on registration failure (no CVSS, Linux)
- [CVE-2026-46240](https://cve.now/CVE-2026-46240.md): media: iris: Fix use-after-free in iris\_release\_internal\_buffers() (CVSS 7.8, Linux)
- [CVE-2026-46239](https://cve.now/CVE-2026-46239.md): media: i2c: ov5647: Fix runtime PM refcount leak in s\_ctrl (no CVSS, Linux)
- [CVE-2026-46238](https://cve.now/CVE-2026-46238.md): batman-adv: stop caching unowned originator pointers in BAT IV (CVSS 8.8, Linux)
- [CVE-2026-46236](https://cve.now/CVE-2026-46236.md): media: rc: xbox\_remote: heed DMA restrictions (no CVSS, Linux)
- [CVE-2026-46235](https://cve.now/CVE-2026-46235.md): media: saa7164: add ioremap return checks and cleanups (no CVSS, Linux)
- [CVE-2026-46234](https://cve.now/CVE-2026-46234.md): vsock: fix buffer size clamping order (no CVSS, Linux)
- [CVE-2026-46233](https://cve.now/CVE-2026-46233.md): batman-adv: bla: only purge non-released claims (no CVSS, Linux)
- [CVE-2026-46232](https://cve.now/CVE-2026-46232.md): HID: playstation: Clamp num\_touch\_reports (CVSS 8.1, Linux)
- [CVE-2026-46231](https://cve.now/CVE-2026-46231.md): batman-adv: bla: put backbone reference on failed claim hash insert (no CVSS, Linux)
- [CVE-2026-46230](https://cve.now/CVE-2026-46230.md): drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVSS 7.1, Linux)
- [CVE-2026-46229](https://cve.now/CVE-2026-46229.md): drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (no CVSS, Linux)
- [CVE-2026-46228](https://cve.now/CVE-2026-46228.md): spi: ch341: fix devres lifetime (no CVSS, Linux)
- [CVE-2026-46227](https://cve.now/CVE-2026-46227.md): sctp: revalidate list cursor after sctp\_sendmsg\_to\_asoc() in SCTP\_SENDALL (CVSS 7.8, Linux)
- [CVE-2026-46226](https://cve.now/CVE-2026-46226.md): spi: fsl: fix controller deregistration (no CVSS, Linux)
- [CVE-2026-46225](https://cve.now/CVE-2026-46225.md): spi: rspi: fix controller deregistration (no CVSS, Linux)
- [CVE-2026-46224](https://cve.now/CVE-2026-46224.md): drm/xe: Fix bo leak in xe\_dma\_buf\_init\_obj() on allocation failure (no CVSS, Linux)
- [CVE-2026-46223](https://cve.now/CVE-2026-46223.md): cgroup: Defer css percpu\_ref kill on rmdir until cgroup is depopulated (no CVSS, Linux)
- [CVE-2026-46222](https://cve.now/CVE-2026-46222.md): media: rockchip: rkcif: Add missing MUST\_CONNECT flag to pads (no CVSS, Linux)
- [CVE-2026-46221](https://cve.now/CVE-2026-46221.md): EDAC/versalnet: Fix device name memory leak (no CVSS, Linux)
- [CVE-2026-46220](https://cve.now/CVE-2026-46220.md): drm/amdgpu/sdma4: replace BUG\_ON with WARN\_ON in fence emission (no CVSS, Linux)
- [CVE-2026-46219](https://cve.now/CVE-2026-46219.md): spi: mpc52xx: fix use-after-free on unbind (no CVSS, Linux)
- [CVE-2026-46218](https://cve.now/CVE-2026-46218.md): drm/amdgpu: Add bounds checking to ib\_{get,set}\_value (CVSS 7.1, Linux)
- [CVE-2026-46216](https://cve.now/CVE-2026-46216.md): drm/xe/hdcp: Add NULL check for media\_gt in intel\_hdcp\_gsc\_check\_status() (no CVSS, Linux)
- [CVE-2026-46215](https://cve.now/CVE-2026-46215.md): drm: Set old handle to NULL before prime swap in change\_handle (CVSS 7.8, Linux)
- [CVE-2026-46214](https://cve.now/CVE-2026-46214.md): vsock/virtio: fix accept queue count leak on transport mismatch (no CVSS, Linux)
- [CVE-2026-46213](https://cve.now/CVE-2026-46213.md): HID: appletb-kbd: fix UAF in inactivity-timer cleanup path (no CVSS, Linux)
- [CVE-2026-46212](https://cve.now/CVE-2026-46212.md): batman-adv: bla: prevent use-after-free when deleting claims (CVSS 8.8, Linux)
- [CVE-2026-46211](https://cve.now/CVE-2026-46211.md): drm/msm/gem: fix error handling in msm\_ioctl\_gem\_info\_get\_metadata() (no CVSS, Linux)
- [CVE-2026-46210](https://cve.now/CVE-2026-46210.md): media: iris: fix use-after-free of fmt\_src during MBPF check (CVSS 7.8, Linux)
- [CVE-2026-46209](https://cve.now/CVE-2026-46209.md): drm/gem: Fix inconsistent plane dimension calculation in drm\_gem\_fb\_init\_with\_funcs() (CVSS 7.8, Linux)
- [CVE-2026-46208](https://cve.now/CVE-2026-46208.md): batman-adv: stop tp\_meter sessions during mesh teardown (CVSS 7.8, Linux)
- [CVE-2026-46207](https://cve.now/CVE-2026-46207.md): vsock/virtio: fix empty payload in tap skb for non-linear buffers (no CVSS, Linux)
- [CVE-2026-46206](https://cve.now/CVE-2026-46206.md): batman-adv: reject new tp\_meter sessions during teardown (CVSS 7.8, Linux)
- [CVE-2026-46205](https://cve.now/CVE-2026-46205.md): staging: media: atomisp: Disallow all private IOCTLs (CVSS 7.8, Linux)
- [CVE-2026-46204](https://cve.now/CVE-2026-46204.md): drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVSS 7.1, Linux)
- [CVE-2026-46203](https://cve.now/CVE-2026-46203.md): spi: cadence-quadspi: fix unclocked access on unbind (no CVSS, Linux)
- [CVE-2026-46202](https://cve.now/CVE-2026-46202.md): HID: appletb-kbd: run inactivity autodim from workqueues (no CVSS, Linux)
- [CVE-2026-46201](https://cve.now/CVE-2026-46201.md): drm/xe: Fix dma-buf attachment leak in xe\_gem\_prime\_import() (CVSS 7.8, Linux)
- [CVE-2026-46200](https://cve.now/CVE-2026-46200.md): spi: mpc52xx: fix controller deregistration (no CVSS, Linux)
- [CVE-2026-46199](https://cve.now/CVE-2026-46199.md): drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVSS 7.1, Linux)
- [CVE-2026-46198](https://cve.now/CVE-2026-46198.md): batman-adv: fix integer overflow on buff\_pos (CVSS 8.8, Linux)
- [CVE-2026-46197](https://cve.now/CVE-2026-46197.md): drm/amdkfd: validate SVM ioctl nattr against buffer size (CVSS 7.8, Linux)
- [CVE-2026-46196](https://cve.now/CVE-2026-46196.md): tracepoint: balance regfunc() on func\_add() failure in tracepoint\_add\_func() (no CVSS, Linux)
- [CVE-2026-46195](https://cve.now/CVE-2026-46195.md): smb: client: validate dacloffset before building DACL pointers (CVSS 9.8, Linux)
- [CVE-2026-46193](https://cve.now/CVE-2026-46193.md): xfrm: ah: account for ESN high bits in async callbacks (no CVSS, Linux)
- [CVE-2026-46192](https://cve.now/CVE-2026-46192.md): spi: microchip-core-qspi: don't attempt to transmit during emulated read-only dual/quad operations (no CVSS, Linux)
- [CVE-2026-46191](https://cve.now/CVE-2026-46191.md): fbcon: Avoid OOB font access if console rotation fails (no CVSS, Linux)
- [CVE-2026-46190](https://cve.now/CVE-2026-46190.md): mtd: spi-nor: debugfs: fix out-of-bounds read in spi\_nor\_params\_show() (CVSS 7.1, Linux)
- [CVE-2026-46189](https://cve.now/CVE-2026-46189.md): RDMA/vmw\_pvrdma: Fix double free on pvrdma\_alloc\_ucontext() error path (CVSS 7.0, Linux)
- [CVE-2026-46188](https://cve.now/CVE-2026-46188.md): octeon\_ep\_vf: add NULL check for napi\_build\_skb() (no CVSS, Linux)
- [CVE-2026-46187](https://cve.now/CVE-2026-46187.md): wifi: rsi: fix kthread lifetime race between self-exit and external-stop (no CVSS, Linux)
- [CVE-2026-46186](https://cve.now/CVE-2026-46186.md): Bluetooth: virtio\_bt: validate rx pkt\_type header length (no CVSS, Linux)
- [CVE-2026-46185](https://cve.now/CVE-2026-46185.md): smb/client: fix out-of-bounds read in symlink\_data() (CVSS 9.1, Linux)
- [CVE-2026-46184](https://cve.now/CVE-2026-46184.md): sound: ua101: fix division by zero at probe (no CVSS, Linux)
- [CVE-2026-46183](https://cve.now/CVE-2026-46183.md): mm/damon/sysfs-schemes: protect path kfree() with damon\_sysfs\_lock (no CVSS, Linux)
- [CVE-2026-46182](https://cve.now/CVE-2026-46182.md): pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace (no CVSS, Linux)
- [CVE-2026-46181](https://cve.now/CVE-2026-46181.md): RDMA/mlx4: Fix mis-use of RCU in mlx4\_srq\_event() (CVSS 7.8, Linux)
- [CVE-2026-46180](https://cve.now/CVE-2026-46180.md): wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (no CVSS, Linux)
- [CVE-2026-46179](https://cve.now/CVE-2026-46179.md): ASoC: SOF: Don't allow pointer operations on unconfigured streams (no CVSS, Linux)
- [CVE-2026-46178](https://cve.now/CVE-2026-46178.md): RDMA/mlx4: Fix resource leak on error in mlx4\_ib\_create\_srq() (CVSS 7.8, Linux)
- [CVE-2026-46177](https://cve.now/CVE-2026-46177.md): ipmi: Add limits to event and receive message requests (CVSS 7.5, Linux)
- [CVE-2026-46176](https://cve.now/CVE-2026-46176.md): RDMA/mlx5: Fix error path fall-through in mlx5\_ib\_dev\_res\_srq\_init() (CVSS 7.8, Linux)
- [CVE-2026-46175](https://cve.now/CVE-2026-46175.md): f2fs: fix fsck inconsistency caused by FGGC of node block (CVSS 7.1, Linux)
- [CVE-2026-46174](https://cve.now/CVE-2026-46174.md): x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVSS 8.8, Linux)
- [CVE-2026-46173](https://cve.now/CVE-2026-46173.md): exit: prevent preemption of oopsing TASK\_DEAD task (CVSS 7.8, Linux)
- [CVE-2026-46172](https://cve.now/CVE-2026-46172.md): ipv6: xfrm6: release dst on error in xfrm6\_rcv\_encap() (no CVSS, Linux)
- [CVE-2026-46171](https://cve.now/CVE-2026-46171.md): riscv: kvm: fix vector context allocation leak (no CVSS, Linux)
- [CVE-2026-46170](https://cve.now/CVE-2026-46170.md): mptcp: pm: ADD\_ADDR rtx: free sk if last (no CVSS, Linux)
- [CVE-2026-46169](https://cve.now/CVE-2026-46169.md): hfsplus: fix uninit-value by validating catalog record size (no CVSS, Linux)
- [CVE-2026-46168](https://cve.now/CVE-2026-46168.md): mptcp: fix scheduling with atomic in timestamp sockopt (no CVSS, Linux)
- [CVE-2026-46167](https://cve.now/CVE-2026-46167.md): usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl (no CVSS, Linux)
- [CVE-2026-46166](https://cve.now/CVE-2026-46166.md): wifi: mac80211: use safe list iteration in radar detect work (CVSS 8.8, Linux)
- [CVE-2026-46165](https://cve.now/CVE-2026-46165.md): openvswitch: vport: fix self-deadlock on release of tunnel ports (no CVSS, Linux)
- [CVE-2026-46164](https://cve.now/CVE-2026-46164.md): btrfs: fix double free in create\_space\_info\_sub\_group() error path (CVSS 7.0, Linux)
- [CVE-2026-46163](https://cve.now/CVE-2026-46163.md): wifi: b43legacy: enforce bounds check on firmware key index in RX path (no CVSS, Linux)
- [CVE-2026-46162](https://cve.now/CVE-2026-46162.md): ice: fix double free in ice\_sf\_eth\_activate() error path (no CVSS, Linux)
- [CVE-2026-46161](https://cve.now/CVE-2026-46161.md): md/raid10: fix divide-by-zero in setup\_geo() with zero far\_copies (no CVSS, Linux)
- [CVE-2026-46160](https://cve.now/CVE-2026-46160.md): btrfs: fix missing last\_unlink\_trans update when removing a directory (no CVSS, Linux)
- [CVE-2026-46159](https://cve.now/CVE-2026-46159.md): btrfs: fix btrfs\_ioctl\_space\_info() slot\_count TOCTOU which can lead to info-leak (no CVSS, Linux)
- [CVE-2026-46158](https://cve.now/CVE-2026-46158.md): mptcp: pm: ADD\_ADDR rtx: always decrease sk refcount (no CVSS, Linux)
- [CVE-2026-46157](https://cve.now/CVE-2026-46157.md): ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger (CVSS 7.8, Linux)
- [CVE-2026-46156](https://cve.now/CVE-2026-46156.md): LoongArch: Fix potential ADE in loongson\_gpu\_fixup\_dma\_hang() (no CVSS, Linux)
- [CVE-2026-46155](https://cve.now/CVE-2026-46155.md): smb/client: fix out-of-bounds read in smb2\_compound\_op() (CVSS 9.1, Linux)
- [CVE-2026-46154](https://cve.now/CVE-2026-46154.md): sched\_ext: Read scx\_root under scx\_cgroup\_ops\_rwsem in cgroup setters (CVSS 7.0, Linux)
- [CVE-2026-46153](https://cve.now/CVE-2026-46153.md): 8021q: delete cleared egress QoS mappings (no CVSS, Linux)
- [CVE-2026-46152](https://cve.now/CVE-2026-46152.md): wifi: mac80211: drop stray 'static' from fast-RX rx\_result (CVSS 8.8, Linux)
- [CVE-2026-46151](https://cve.now/CVE-2026-46151.md): usb: usblp: fix heap leak in IEEE 1284 device ID via short response (no CVSS, Linux)
- [CVE-2026-46150](https://cve.now/CVE-2026-46150.md): fanotify: fix false positive on permission events (CVSS 7.1, Linux)
- [CVE-2026-46149](https://cve.now/CVE-2026-46149.md): scsi: target: configfs: Bound snprintf() return in tg\_pt\_gp\_members\_show() (CVSS 7.1, Linux)
- [CVE-2026-46148](https://cve.now/CVE-2026-46148.md): spi: microchip-core-qspi: control built-in cs manually (no CVSS, Linux)
- [CVE-2026-46147](https://cve.now/CVE-2026-46147.md): KVM: arm64: Fix pin leak and publication ordering in \_\_pkvm\_init\_vcpu() (no CVSS, Linux)
- [CVE-2026-46146](https://cve.now/CVE-2026-46146.md): ALSA: usb-audio: Avoid potential endless loop in convert\_chmap\_v3() (no CVSS, Linux)
- [CVE-2026-46145](https://cve.now/CVE-2026-46145.md): RDMA/mana: Validate rx\_hash\_key\_len (CVSS 7.8, Linux)
- [CVE-2026-46144](https://cve.now/CVE-2026-46144.md): RDMA/mana: Fix error unwind in mana\_ib\_create\_qp\_rss() (no CVSS, Linux)
- [CVE-2026-46143](https://cve.now/CVE-2026-46143.md): ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (no CVSS, Linux)
- [CVE-2026-46142](https://cve.now/CVE-2026-46142.md): net: libwx: fix VF illegal register access (no CVSS, Linux)
- [CVE-2026-46141](https://cve.now/CVE-2026-46141.md): powerpc/xive: fix kmemleak caused by incorrect chip\_data lookup (no CVSS, Linux)
- [CVE-2026-46140](https://cve.now/CVE-2026-46140.md): Bluetooth: btmtk: validate WMT event SKB length before struct access (no CVSS, Linux)
- [CVE-2026-46139](https://cve.now/CVE-2026-46139.md): smb: client: use kzalloc to zero-initialize security descriptor buffer (no CVSS, Linux)
- [CVE-2026-46138](https://cve.now/CVE-2026-46138.md): Bluetooth: hci\_event: Fix OOB read and infinite loop in hci\_le\_create\_big\_complete\_evt (CVSS 8.1, Linux)
- [CVE-2026-46137](https://cve.now/CVE-2026-46137.md): mptcp: pm: ADD\_ADDR rtx: fix potential data-race (CVSS 9.8, Linux)
- [CVE-2026-46136](https://cve.now/CVE-2026-46136.md): wifi: mt76: mt7921: fix a potential clc buffer length underflow (no CVSS, Linux)
- [CVE-2026-46135](https://cve.now/CVE-2026-46135.md): nvmet-tcp: fix race between ICReq handling and queue teardown (CVSS 9.8, Linux)
- [CVE-2026-46134](https://cve.now/CVE-2026-46134.md): platform/chrome: cros\_ec\_typec: Init mutex in Thunderbolt registration (no CVSS, Linux)
- [CVE-2026-46133](https://cve.now/CVE-2026-46133.md): RDMA/rxe: Reject unknown opcodes before ICRC processing (CVSS 7.5, Linux)
- [CVE-2026-46132](https://cve.now/CVE-2026-46132.md): net: rtnetlink: zero ifla\_vf\_broadcast to avoid stack infoleak in rtnl\_fill\_vfinfo (no CVSS, Linux)
- [CVE-2026-46131](https://cve.now/CVE-2026-46131.md): KVM: x86: check for nEPT/nNPT in slow flush hypercalls (no CVSS, Linux)
- [CVE-2026-46130](https://cve.now/CVE-2026-46130.md): dm-verity-fec: fix reading parity bytes split across blocks (take 3) (no CVSS, Linux)
- [CVE-2026-46129](https://cve.now/CVE-2026-46129.md): btrfs: fix double free in create\_space\_info() error path (CVSS 7.8, Linux)
- [CVE-2026-46128](https://cve.now/CVE-2026-46128.md): ipmi: Check event message buffer response for bad data (no CVSS, Linux)
- [CVE-2026-46127](https://cve.now/CVE-2026-46127.md): RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma\_copy\_pd\_uresp() (no CVSS, Linux)
- [CVE-2026-46126](https://cve.now/CVE-2026-46126.md): RDMA/mana: Fix mana\_destroy\_wq\_obj() cleanup in mana\_ib\_create\_qp\_rss() (no CVSS, Linux)
- [CVE-2026-46125](https://cve.now/CVE-2026-46125.md): wifi: mac80211: remove station if connection prep fails (CVSS 8.8, Linux)
- [CVE-2026-46124](https://cve.now/CVE-2026-46124.md): isofs: validate block number from NFS file handle in isofs\_export\_iget (CVSS 7.5, Linux)
- [CVE-2026-46123](https://cve.now/CVE-2026-46123.md): Bluetooth: virtio\_bt: clamp rx length before skb\_put (CVSS 7.7, Linux)
- [CVE-2026-46122](https://cve.now/CVE-2026-46122.md): wifi: b43: enforce bounds check on firmware key index in b43\_rx() (no CVSS, Linux)
- [CVE-2026-46121](https://cve.now/CVE-2026-46121.md): mm/damon/sysfs-schemes: protect memcg\_path kfree() with damon\_sysfs\_lock (no CVSS, Linux)
- [CVE-2026-46120](https://cve.now/CVE-2026-46120.md): ip6\_gre: Use cached t-\>net in ip6erspan\_changelink(). (CVSS 7.8, Linux)
- [CVE-2026-46119](https://cve.now/CVE-2026-46119.md): libceph: Fix slab-out-of-bounds access in auth message processing (CVSS 9.1, Linux)
- [CVE-2026-46118](https://cve.now/CVE-2026-46118.md): pseries/papr-hvpipe: Fix null ptr deref in papr\_hvpipe\_dev\_create\_handle() (no CVSS, Linux)
- [CVE-2026-46117](https://cve.now/CVE-2026-46117.md): RDMA/mana: Remove user triggerable WARN\_ON() in mana\_ib\_create\_qp\_rss() (CVSS 7.8, Linux)
- [CVE-2026-46116](https://cve.now/CVE-2026-46116.md): xfrm: defensively unhash xfrm\_state lists in \_\_xfrm\_state\_delete (CVSS 7.8, Linux)
- [CVE-2026-46115](https://cve.now/CVE-2026-46115.md): block: add pgmap check to biovec\_phys\_mergeable (CVSS 9.8, Linux)
- [CVE-2026-46114](https://cve.now/CVE-2026-46114.md): RDMA/rxe: Reject non-8-byte ATOMIC\_WRITE payloads (CVSS 7.5, Linux)
- [CVE-2026-46113](https://cve.now/CVE-2026-46113.md): KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVSS 8.8, Linux)
- [CVE-2026-46112](https://cve.now/CVE-2026-46112.md): RDMA/hns: Fix unlocked call to hns\_roce\_qp\_remove() (CVSS 7.8, Linux)
- [CVE-2026-46111](https://cve.now/CVE-2026-46111.md): Bluetooth: hci\_conn: fix potential UAF in create\_big\_sync (CVSS 7.8, Linux)
- [CVE-2026-46110](https://cve.now/CVE-2026-46110.md): net: stmmac: Prevent NULL deref when RX memory exhausted (CVSS 7.5, Linux)
- [CVE-2026-46109](https://cve.now/CVE-2026-46109.md): usb: ulpi: fix memory leak on ulpi\_register() error paths (no CVSS, Linux)
- [CVE-2026-46108](https://cve.now/CVE-2026-46108.md): ipmi:si: Return state to normal if message allocation fails (no CVSS, Linux)
- [CVE-2026-46107](https://cve.now/CVE-2026-46107.md): dm-thin: fix metadata refcount underflow (CVSS 7.8, Linux)
- [CVE-2026-46106](https://cve.now/CVE-2026-46106.md): eventfs: Hold eventfs\_mutex and SRCU when remount walks events (no CVSS, Linux)
- [CVE-2026-46105](https://cve.now/CVE-2026-46105.md): scsi: mpt3sas: Limit NVMe request size to 2 MiB (CVSS 7.8, Linux)
- [CVE-2026-46104](https://cve.now/CVE-2026-46104.md): selinux: use sk blob accessor in socket permission helpers (no CVSS, Linux)
- [CVE-2026-9813](https://cve.now/CVE-2026-9813.md): FlowIntel external reference URL probe allows server-side request forgery (CVSS 6.2, flowintel)
- [CVE-2026-47074](https://cve.now/CVE-2026-47074.md): ex\_aws\_sns SigningCertURL not validated in verify\_message/1 (CVSS 8.7, ex-aws ex\_aws\_sns)
- [CVE-2026-4377](https://cve.now/CVE-2026-4377.md): Use of Weak Credentials in D-Link DWR-X1820 router (CVSS 6.0, D-Link DWR-X1820)
- [CVE-2025-48977](https://cve.now/CVE-2025-48977.md): Apache Ignite: REST HTTP arbitrary file read vulnerability (CVSS 8.5, Apache Software Foundation Apache Ignite · org.apache.ignit…)
- [CVE-2026-4334](https://cve.now/CVE-2026-4334.md): Shariff Wrapper \<= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4, 3uu Shariff Wrapper)
- [CVE-2026-6226](https://cve.now/CVE-2026-6226.md): Frontend Admin by DynamiApps \<= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection (CVSS 8.8, shabti Frontend Admin by DynamiApps)
- [CVE-2024-47097](https://cve.now/CVE-2024-47097.md): Reflected Cross-Site Scripting in Follet School Solutions Destiny (CVSS 5.1, Follet School Solutions Destiny)
- [CVE-2024-47096](https://cve.now/CVE-2024-47096.md): Reflected Cross-Site Scripting in Follet School Solutions Destiny (CVSS 5.1, Follet School Solutions Destiny)
- [CVE-2026-9804](https://cve.now/CVE-2026-9804.md): Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read (CVSS 7.7, Red Hat Container Native Virtualization · Red Hat OpenSh… +1)
- [CVE-2026-6937](https://cve.now/CVE-2026-6937.md): Appointment Booking Calendar \<= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint (CVSS 5.3, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-8689](https://cve.now/CVE-2026-8689.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions (CVSS 4.3, themeisle Visualizer: Tables and Charts Manager for WordPre…)
- [CVE-2026-9015](https://cve.now/CVE-2026-9015.md): Equalize Digital Accessibility Checker \<= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac\_insert\_ignore\_data AJAX Action (CVSS 4.3, equalizedigital Equalize Digital Accessibility Checker – WC…)
- [CVE-2026-7048](https://cve.now/CVE-2026-7048.md): Photo Gallery by 10Web \<= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order\_by' Shortcode Attribute (CVSS 6.5, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2026-7526](https://cve.now/CVE-2026-7526.md): PDF Embedder \<= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page (CVSS 4.3, smub PDF Embedder – PDF Viewer & Embed PDF Files for WordPr…)
- [CVE-2026-9807](https://cve.now/CVE-2026-9807.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-4408](https://cve.now/CVE-2026-4408.md): Samba: remote code execution in samr (CVSS 9.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-7052](https://cve.now/CVE-2026-7052.md): HT Contact Form \<= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field (CVSS 7.2, htplugins HT Contact Form – Drag & Drop Form Builder for Wo…)
- [CVE-2026-7797](https://cve.now/CVE-2026-7797.md): Appointment Booking Calendar \<= 1.6.11.8 - Unauthenticated SQL Injection via 'append\_where\_sql' Parameter (CVSS 7.5, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2026-8682](https://cve.now/CVE-2026-8682.md): 3D Viewer \<= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint (CVSS 4.3, hasanazizul 3D Viewer – 3D Model Viewer – Augmented Reality…)
- [CVE-2026-7660](https://cve.now/CVE-2026-7660.md): Easy Updates Manager \<= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter (CVSS 6.1, davidanderson Easy Updates Manager)
- [CVE-2026-6455](https://cve.now/CVE-2026-6455.md): WP Contact Form 7 DB Handler \<= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact\_form' Parameter (CVSS 8.1, yudiz WP Contact Form 7 DB Handler)
- [CVE-2026-7621](https://cve.now/CVE-2026-7621.md): SMTP2GO for WordPress \<= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate (CVSS 4.3, SMTP2GO for WordPress – Email Made Easy)
- [CVE-2026-7552](https://cve.now/CVE-2026-7552.md): Geo Mashup \<= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo\_mashup\_content' Parameter (CVSS 5.3, cyberhobo Geo Mashup)
- [CVE-2026-6427](https://cve.now/CVE-2026-6427.md): a3 Lazy Load \<= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element (CVSS 6.4, a3rev a3 Lazy Load)
- [CVE-2026-9227](https://cve.now/CVE-2026-9227.md): GutenBee \<= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp\_check\_filetype\_and\_ext Filter (CVSS 8.8, cssigniterteam GutenBee – Gutenberg Blocks)
- [CVE-2026-9618](https://cve.now/CVE-2026-9618.md): PeachPay \<= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink (CVSS 4.3, PeachPay — Payments & Express Checkout for WooCommerce)
- [CVE-2026-7651](https://cve.now/CVE-2026-7651.md): User Registration & Membership \<= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter (CVSS 5.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-7634](https://cve.now/CVE-2026-7634.md): SlimStat Analytics \<= 5.4.11 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2026-9806](https://cve.now/CVE-2026-9806.md): Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names (CVSS 6.3, misp cti-transmute)
- [CVE-2026-7862](https://cve.now/CVE-2026-7862.md): Eupago Gateway For Woocommerce \< 4.7.2 - Unauthenticated Arbitrary Refund Initiation (CVSS 8.6, Eupago Gateway For Woocommerce)
- [CVE-2026-44604](https://cve.now/CVE-2026-44604.md): Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command (CVSS 7.0, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-7533](https://cve.now/CVE-2026-7533.md): Easy Digital Downloads \<= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square\_tokens' Parameter (CVSS 4.3, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2026-9644](https://cve.now/CVE-2026-9644.md): LiveSmart Video Chat \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nhadjidimitrov LiveSmart Video Chat Live Video Chat)
- [CVE-2026-9009](https://cve.now/CVE-2026-9009.md): Crawlomatic Multipage Scraper Post Generator \<= 2.7.2 - Authenticated (Author+) Remote Code Execution via 'callback\_raw' Shortcode Attribute (CVSS 8.8, CodeRevolution Crawlomatic Multipage Scraper Post Generator)
- [CVE-2026-3173](https://cve.now/CVE-2026-3173.md): Meta Field Block \<= 1.5.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary User Meta Exposure (CVSS 6.5, mr2p Meta Field Block – Display custom fields in the Block…)
- [CVE-2026-9673](https://cve.now/CVE-2026-9673.md): Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which ca (CVSS 7.0, json-2-csv · org.webjars.npm:json-2-csv)
- [CVE-2026-9802](https://cve.now/CVE-2026-9802.md): Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart (CVSS 6.8, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9803](https://cve.now/CVE-2026-9803.md): Keycloak: keycloak: denial of service via malformed authorization header (CVSS 5.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9801](https://cve.now/CVE-2026-9801.md): Keycloak: keycloak: denial of service via malformed ldap password policy response (CVSS 4.9, Red Hat build of Keycloak · org.keycloak:keycloak-ldap-fede…)
- [CVE-2026-9798](https://cve.now/CVE-2026-9798.md): Keycloak: keycloak: brute-force protection bypass in ciba flow (CVSS 4.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9796](https://cve.now/CVE-2026-9796.md): Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability (CVSS 6.5, Red Hat build of Keycloak · org.keycloak:keycloak-server)
- [CVE-2026-32999](https://cve.now/CVE-2026-32999.md): Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute (CVSS 9.1, WebPros Comet Backup)
- [CVE-2026-32998](https://cve.now/CVE-2026-32998.md): This vulnerability in Veeam Service Provider Console allows for remote code execution. (CVSS 9.4, Veeam Service Provider Console)
- [CVE-2026-32997](https://cve.now/CVE-2026-32997.md): A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep (CVSS 8.6, Veeam Backup and Replication)
- [CVE-2026-32996](https://cve.now/CVE-2026-32996.md): This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. (CVSS 7.3, Veeam Backup and Replication)
- [CVE-2026-32995](https://cve.now/CVE-2026-32995.md): The Rocket.Chat DDP method autoTranslate.translateMessage in versions \<8.5.0, \<8.4.2, \<8.3.4, \<8.2.4, \<8.1.5, \<8.0.5, \<7.13.8, and \<7.10.12 (CVSS 7.5, Rocket.Chat)
- [CVE-2026-9795](https://cve.now/CVE-2026-9795.md): Keycloak: keycloak: privilege escalation via improper scope mapping enforcement (CVSS 7.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9794](https://cve.now/CVE-2026-9794.md): Keycloak: keycloak: information disclosure via saml ecp endpoint (CVSS 5.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9792](https://cve.now/CVE-2026-9792.md): Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition (CVSS 6.5, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9793](https://cve.now/CVE-2026-9793.md): Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing (CVSS 5.9, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-7802](https://cve.now/CVE-2026-7802.md): Frontend Admin by DynamiApps \<= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user\_id' URL Query Parameter (CVSS 8.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-9228](https://cve.now/CVE-2026-9228.md): Timetable and Event Schedule by MotoPress \<= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action\_get\_event\_data Function (CVSS 4.3, jetmonsters Timetable and Event Schedule by MotoPress)
- [CVE-2026-2374](https://cve.now/CVE-2026-2374.md): Login No Captcha reCAPTCHA \<= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP\_SELF (CVSS 7.2, robertpeake Login No Captcha reCAPTCHA)
- [CVE-2026-9241](https://cve.now/CVE-2026-9241.md): FOX – Currency Switcher Professional for WooCommerce \<= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc\_order\_user\_roles' Parameter (CVSS 4.3, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2026-5737](https://cve.now/CVE-2026-5737.md): Independent Analytics \<= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route (CVSS 6.5, bensibley Independent Analytics – WordPress Analytics Plugin)
- [CVE-2026-9791](https://cve.now/CVE-2026-9791.md): Keycloak-rhel9: organization data leak after feature disabled in keycloak (CVSS 4.3, Red Hat build of Keycloak · org.keycloak:keycloak-server… +1)
- [CVE-2026-9789](https://cve.now/CVE-2026-9789.md): NitroSense V3: Security Vulnerability Information (CVSS 8.5, Acer NitrorSense)
- [CVE-2026-8915](https://cve.now/CVE-2026-8915.md): Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. (CVSS 8.8, Samsung Open Source Escargot)
- [CVE-2026-30760](https://cve.now/CVE-2026-30760.md): An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a craft (CVSS 7.3)
- [CVE-2026-30761](https://cve.now/CVE-2026-30761.md): An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to (CVSS 7.3)
- [CVE-2026-37266](https://cve.now/CVE-2026-37266.md): An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force\_d (CVSS 8.0)
- [CVE-2026-37579](https://cve.now/CVE-2026-37579.md): An issue in SMSGate sms-core\<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java comp (CVSS 7.3)
- [CVE-2026-38702](https://cve.now/CVE-2026-38702.md): A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR (CVSS 9.8)
- [CVE-2026-38703](https://cve.now/CVE-2026-38703.md): A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR (CVSS 9.8)
- [CVE-2026-38704](https://cve.now/CVE-2026-38704.md): A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, I (CVSS 9.8)
- [CVE-2026-38707](https://cve.now/CVE-2026-38707.md): A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 (CVSS 9.8)
- [CVE-2026-42998](https://cve.now/CVE-2026-42998.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0, OpenStack Keystone · keystone)
- [CVE-2026-42999](https://cve.now/CVE-2026-42999.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0, OpenStack Keystone · keystone)
- [CVE-2026-43000](https://cve.now/CVE-2026-43000.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0, OpenStack Keystone · keystone)
- [CVE-2026-44394](https://cve.now/CVE-2026-44394.md): An issue was discovered in OpenStack Keystone before 29.0.2. (CVSS 6.0, OpenStack Keystone · keystone)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.