# CVEs published 2026-05-29

248 CVEs were published on May 29, 2026: 43 critical, 105 high. Days are UTC.

- [CVE-2026-9831](https://cve.now/CVE-2026-9831.md): ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition (CVSS 6.3, Extreme Networks Extreme Platform ONE)
- [CVE-2026-46385](https://cve.now/CVE-2026-46385.md): iskorotkov/avro: CPU Exhaustion in Avro Decoder (CVSS 8.7, iskorotkov avro · github.com/iskorotkov/avro/v2 +1)
- [CVE-2026-46384](https://cve.now/CVE-2026-46384.md): iskorotkov/avro: Integer Overflow in Avro Decoder (CVSS 8.7, iskorotkov avro · github.com/iskorotkov/avro/v2 +1)
- [CVE-2026-45149](https://cve.now/CVE-2026-45149.md): brace-expansion: Large numeric range defeats documented \`max\` DoS protection (CVSS 6.5, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-45294](https://cve.now/CVE-2026-45294.md): FreeScout: User Account Enumeration via Password Reset Response Differentiation (CVSS 5.3, freescout-help-desk freescout)
- [CVE-2026-47123](https://cve.now/CVE-2026-47123.md): FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path (CVSS 7.5, freescout-help-desk freescout)
- [CVE-2026-48557](https://cve.now/CVE-2026-48557.md): Spatie Laravel Media Library \< 11.23.0 File Upload Restriction Bypass via FileAdder.php (CVSS 8.7, spatie laravel-medialibrary · spatie/laravel-medialibrary)
- [CVE-2026-48810](https://cve.now/CVE-2026-48810.md): FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check (CVSS 4.3, freescout-help-desk freescout)
- [CVE-2026-48811](https://cve.now/CVE-2026-48811.md): FreeScout: Thread Deletion Bypasses Mailbox Access Revocation (CVSS 4.3, freescout-help-desk freescout)
- [CVE-2026-45700](https://cve.now/CVE-2026-45700.md): Heap-buffer-overflow write in planar bitmap decoder (CVSS 7.7, FreeRDP)
- [CVE-2026-44420](https://cve.now/CVE-2026-44420.md): FreeRDP cliprdr server heap-buffer-overflow via undersized capabilitySetLength in CB\_CLIP\_CAPS (CVSS 8.8, FreeRDP)
- [CVE-2026-44422](https://cve.now/CVE-2026-44422.md): FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free and type confusion (CVSS 7.5, FreeRDP)
- [CVE-2026-44421](https://cve.now/CVE-2026-44421.md): FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via clamped-rectangle validation bypass (CVSS 8.8, FreeRDP)
- [CVE-2026-46599](https://cve.now/CVE-2026-46599.md): Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff (CVSS 7.5, golang.org/x/image/tiff · golang.org/x/image)
- [CVE-2026-44287](https://cve.now/CVE-2026-44287.md): FastGPT: sandbox escape to RCE - code-sandbox regex /\\bimport\\s\*\\(/ is bypassable (CVSS 6.3, labring FastGPT)
- [CVE-2026-44285](https://cve.now/CVE-2026-44285.md): FastGPT: SSRF Protection Bypass via \`externalFile\` in Dataset Preview API (CVSS 7.7, labring FastGPT)
- [CVE-2026-45151](https://cve.now/CVE-2026-45151.md): NanoMQ: NULL Pointer Dereference (CVSS 2.9, nanomq)
- [CVE-2026-44640](https://cve.now/CVE-2026-44640.md): NanoMQ: QUIC Dialer Close Type Confusion (CVSS 4.5, nanomq)
- [CVE-2026-45372](https://cve.now/CVE-2026-45372.md): cpp-httplib: HTTP header value percent-decoding in server-side \`parse\_header\` enables CRLF injection (CVSS 9.9, yhirose cpp-httplib)
- [CVE-2026-46527](https://cve.now/CVE-2026-46527.md): cpp-httplib: Malicious \`X-Forwarded-For\` Under Trusted-Proxy Configuration Triggers Empty \`vector::front()\`, Leading to Undefined Behavior and Server Crash (CVSS 8.7, yhirose cpp-httplib)
- [CVE-2026-45352](https://cve.now/CVE-2026-45352.md): cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding (CVSS 5.3, yhirose cpp-httplib)
- [CVE-2026-45324](https://cve.now/CVE-2026-45324.md): Rizin: Double free in cmd\_search.c (CVSS 3.3, rizinorg rizin)
- [CVE-2026-45613](https://cve.now/CVE-2026-45613.md): Rizin: Heap-buffer-overflow in OMF parser (CVSS 3.3, rizinorg rizin)
- [CVE-2026-47266](https://cve.now/CVE-2026-47266.md): Formie: Unauthenticated front-end submission editing can overwrite existing submissions (CVSS 8.7, verbb formie · verbb/formie)
- [CVE-2026-45697](https://cve.now/CVE-2026-45697.md): Formie: Pre-authenticated server-side template injection in Hidden fields (CVSS 9.8, verbb formie · verbb/formie)
- [CVE-2026-34127](https://cve.now/CVE-2026-34127.md): Stored Cross-Site Scripting (XSS) via Configuration File Import on TP-Link's TL-SG108PE (CVSS 5.3, TP-Link Systems TL-SG108PE)
- [CVE-2026-42500](https://cve.now/CVE-2026-42500.md): Panic when reading out of bound palette index in golang.org/x/image/bmp (CVSS 5.3, golang.org/x/image/bmp · golang.org/x/image)
- [CVE-2026-48555](https://cve.now/CVE-2026-48555.md): Spatie Laravel Media Library \< 11.23.0 SSRF via addMediaFromUrl() (CVSS 5.3, spatie laravel-medialibrary · spatie/laravel-medialibrary)
- [CVE-2026-4387](https://cve.now/CVE-2026-4387.md): Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file (CVSS 2.0, StrongDM Desktop Application · StrongDM Desktop Client)
- [CVE-2026-49386](https://cve.now/CVE-2026-49386.md): In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas (CVSS 6.5, JetBrains YouTrack)
- [CVE-2026-49385](https://cve.now/CVE-2026-49385.md): In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts (CVSS 6.5, JetBrains YouTrack)
- [CVE-2026-49384](https://cve.now/CVE-2026-49384.md): In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible (CVSS 6.1, JetBrains PyCharm)
- [CVE-2026-49383](https://cve.now/CVE-2026-49383.md): In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible (CVSS 3.3, JetBrains IntelliJ IDEA)
- [CVE-2026-49382](https://cve.now/CVE-2026-49382.md): In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin (CVSS 4.5, JetBrains IntelliJ IDEA)
- [CVE-2026-49381](https://cve.now/CVE-2026-49381.md): In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible (CVSS 3.4, JetBrains TeamCity)
- [CVE-2026-49380](https://cve.now/CVE-2026-49380.md): In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible (CVSS 3.1, JetBrains TeamCity)
- [CVE-2026-49379](https://cve.now/CVE-2026-49379.md): In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names (CVSS 6.5, JetBrains TeamCity)
- [CVE-2026-49378](https://cve.now/CVE-2026-49378.md): In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion (CVSS 4.3, JetBrains TeamCity)
- [CVE-2026-49377](https://cve.now/CVE-2026-49377.md): In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters (CVSS 4.3, JetBrains TeamCity)
- [CVE-2026-49376](https://cve.now/CVE-2026-49376.md): In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin (CVSS 6.5, JetBrains TeamCity)
- [CVE-2026-49375](https://cve.now/CVE-2026-49375.md): In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page (CVSS 6.1, JetBrains TeamCity)
- [CVE-2026-49374](https://cve.now/CVE-2026-49374.md): In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters (CVSS 7.6, JetBrains TeamCity)
- [CVE-2026-49373](https://cve.now/CVE-2026-49373.md): In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings (CVSS 7.1, JetBrains TeamCity)
- [CVE-2026-49372](https://cve.now/CVE-2026-49372.md): In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible (CVSS 7.5, JetBrains TeamCity)
- [CVE-2026-49371](https://cve.now/CVE-2026-49371.md): In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible (CVSS 7.1, JetBrains TeamCity)
- [CVE-2026-49370](https://cve.now/CVE-2026-49370.md): In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests (CVSS 3.4, JetBrains YouTrack)
- [CVE-2026-49369](https://cve.now/CVE-2026-49369.md): In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages (CVSS 4.3, JetBrains YouTrack)
- [CVE-2026-49368](https://cve.now/CVE-2026-49368.md): In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible (CVSS 8.7, JetBrains YouTrack)
- [CVE-2026-49367](https://cve.now/CVE-2026-49367.md): In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account (CVSS 8.0, JetBrains IntelliJ IDEA)
- [CVE-2026-49366](https://cve.now/CVE-2026-49366.md): In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion (CVSS 7.8, JetBrains IntelliJ IDEA)
- [CVE-2026-46344](https://cve.now/CVE-2026-46344.md): liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss\_commons.c:194) (CVSS 5.3, open-quantum-safe liboqs)
- [CVE-2026-44518](https://cve.now/CVE-2026-44518.md): liboqs: XMSS Buffer Overread Bug (CVSS 5.3, open-quantum-safe liboqs)
- [CVE-2026-9051](https://cve.now/CVE-2026-9051.md): Authentication Bypass Vulnerability in NI SystemLink Enterprise (CVSS 9.1, NI SystemLink Enterprise)
- [CVE-2026-47740](https://cve.now/CVE-2026-47740.md): Shopper: Authorization bypass in multiple Livewire admin components (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-47741](https://cve.now/CVE-2026-47741.md): Shopper: Race condition on Discount.usage\_limit allows silent over-redemption (CVSS 5.9, shopperlabs shopper · shopper/cart)
- [CVE-2026-47742](https://cve.now/CVE-2026-47742.md): Shopper: Missing authorization on Product admin Livewire sub-form components (CVSS 6.5, shopperlabs shopper · shopper/framework)
- [CVE-2026-47744](https://cve.now/CVE-2026-47744.md): Shopper: Authorization bypass and RBAC privilege escalation in team settings (CVSS 9.9, shopperlabs shopper · shopper/framework)
- [CVE-2026-47745](https://cve.now/CVE-2026-47745.md): Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables (CVSS 6.5, shopperlabs shopper · shopper/framework)
- [CVE-2026-44651](https://cve.now/CVE-2026-44651.md): SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware (CVSS 6.9, SillyTavern)
- [CVE-2026-44650](https://cve.now/CVE-2026-44650.md): SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 9.1, SillyTavern)
- [CVE-2026-40425](https://cve.now/CVE-2026-40425.md): MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties (CVSS 5.7, Danelec MacGregor Voyage Data Recorder (VDR) G4e)
- [CVE-2026-44648](https://cve.now/CVE-2026-44648.md): SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover (CVSS 7.5, SillyTavern)
- [CVE-2026-44649](https://cve.now/CVE-2026-44649.md): SillyTavern: Authentication Bypass via SSO Header Injection (CVSS 9.8, SillyTavern)
- [CVE-2026-42929](https://cve.now/CVE-2026-42929.md): MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials (CVSS 8.3, Danelec MacGregor Voyage Data Recorder (VDR) G4e)
- [CVE-2026-44652](https://cve.now/CVE-2026-44652.md): SillyTavern: SSRF vulnerability in the CORS proxy middleware (CVSS 6.9, SillyTavern)
- [CVE-2026-44611](https://cve.now/CVE-2026-44611.md): MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort (CVSS 5.4, Danelec MacGregor Voyage Data Recorder (VDR) G4e)
- [CVE-2026-46372](https://cve.now/CVE-2026-46372.md): SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl (CVSS 8.5, SillyTavern)
- [CVE-2026-42951](https://cve.now/CVE-2026-42951.md): MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials (CVSS 5.4, Danelec MacGregor Voyage Data Recorder (VDR) G4e)
- [CVE-2026-42941](https://cve.now/CVE-2026-42941.md): MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials (CVSS 8.3, Danelec MacGregor Voyage Data Recorder (VDR) G4e)
- [CVE-2026-45668](https://cve.now/CVE-2026-45668.md): Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled) (CVSS 9.3, TriliumNext Trilium)
- [CVE-2026-44697](https://cve.now/CVE-2026-44697.md): Klever-Go MultiDataInterceptor: remote OOM via crafted compressed P2P payload (CVSS 8.6, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-7786](https://cve.now/CVE-2026-7786.md): Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials (CVSS 9.8, Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485…)
- [CVE-2026-45625](https://cve.now/CVE-2026-45625.md): Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs (CVSS 9.9, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-45626](https://cve.now/CVE-2026-45626.md): Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter (CVSS 6.3, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-45627](https://cve.now/CVE-2026-45627.md): Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover (CVSS 8.2, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-47125](https://cve.now/CVE-2026-47125.md): Arcane: Missing admin authorization on global variables endpoint (CVSS 8.8, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-47179](https://cve.now/CVE-2026-47179.md): Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane (CVSS 7.7, getarcaneapp arcane · github.com/getarcaneapp/arcane/backend)
- [CVE-2026-5768](https://cve.now/CVE-2026-5768.md): Fourth Frontier Frontier X Mobile Application, Frontier X2 Missing Authentication for Critical Function (CVSS 8.8, Fourth Frontier Frontier X Android application · Fourth… +1)
- [CVE-2026-45577](https://cve.now/CVE-2026-45577.md): Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass (CVSS 6.9, markmhendrickson neotoma · neotoma)
- [CVE-2026-10108](https://cve.now/CVE-2026-10108.md): xiaomusic 0.5.7 Path Traversal via GET /music endpoint (CVSS 7.5, hanxi xiaomusic · xiaomusic)
- [CVE-2026-45660](https://cve.now/CVE-2026-45660.md): Statamic: Server-Side Request Forgery via Glide (CVSS 5.4, statamic cms · statamic/cms)
- [CVE-2026-10107](https://cve.now/CVE-2026-10107.md): MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint (CVSS 7.7, jxxghp MoviePilot)
- [CVE-2026-6824](https://cve.now/CVE-2026-6824.md): CP Plus 8 Ch. Network Video Recorder Cross-site Scripting (CVSS 8.4, CP Plus CP-UNR-108F1 Hardware · CP Plus CP-UNR-108F1 Web +1)
- [CVE-2026-45629](https://cve.now/CVE-2026-45629.md): Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint (CVSS 9.9, dokploy)
- [CVE-2026-43917](https://cve.now/CVE-2026-43917.md): Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation (CVSS 5.3, dokploy)
- [CVE-2026-45628](https://cve.now/CVE-2026-45628.md): Dokploy: Command Injection via Unescaped Branch Fields in Deployment Pipeline (CVSS 9.6, dokploy)
- [CVE-2026-5386](https://cve.now/CVE-2026-5386.md): KMW CCTV Security Cameras Unverified Password Change (CVSS 9.1, KMW KM-IP521 · KMW KM-IP421)
- [CVE-2026-10105](https://cve.now/CVE-2026-10105.md): agno 2.6.5 SQL Injection via ClickHouse delete\_by\_metadata() (CVSS 8.3, agno-agi agno · agno)
- [CVE-2026-45630](https://cve.now/CVE-2026-45630.md): Dokploy: Authenticated Remote Code Execution via Command Injection in updateTraefikConfig Echo Statement (CVSS 9.0, dokploy)
- [CVE-2026-10070](https://cve.now/CVE-2026-10070.md): macrozheng mall Super Admin Password update improper authorization (CVSS 5.1, macrozheng mall)
- [CVE-2026-45631](https://cve.now/CVE-2026-45631.md): Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret (CVSS 10.0, dokploy)
- [CVE-2026-45632](https://cve.now/CVE-2026-45632.md): Dokploy: Schedule Authorization Bypass Enables Host/Server Command Execution (CVSS 9.9, dokploy)
- [CVE-2026-45633](https://cve.now/CVE-2026-45633.md): Dokploy: Command Injection in /docker-container-logs Endpoint (CVSS 9.9, dokploy)
- [CVE-2026-45661](https://cve.now/CVE-2026-45661.md): Dokploy: Remote Code Execution through Path Traversal (CVSS 9.9, dokploy)
- [CVE-2026-45662](https://cve.now/CVE-2026-45662.md): Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion) (CVSS 8.8, dokploy)
- [CVE-2026-45663](https://cve.now/CVE-2026-45663.md): Dokploy: Remote Code Execution via destinationPath in Container File Upload (CVSS 9.9, dokploy)
- [CVE-2026-10069](https://cve.now/CVE-2026-10069.md): Shibby Tomato miniupnpd resource consumption (CVSS 8.7, Shibby Tomato)
- [CVE-2026-10099](https://cve.now/CVE-2026-10099.md): XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple\_http\_server.py (CVSS 4.0, XX-Net)
- [CVE-2026-10068](https://cve.now/CVE-2026-10068.md): Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery (CVSS 6.9, Shibby Tomato)
- [CVE-2026-44962](https://cve.now/CVE-2026-44962.md): Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolat (CVSS 9.9, WebPros Plesk)
- [CVE-2026-10067](https://cve.now/CVE-2026-10067.md): Shibby Tomato multimon.cgi sub\_90F0 stack-based overflow (CVSS 8.7, Shibby Tomato)
- [CVE-2026-10101](https://cve.now/CVE-2026-10101.md): Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users (CVSS 6.3, Red Hat Multicluster Engine for Kubernetes)
- [CVE-2026-10066](https://cve.now/CVE-2026-10066.md): Shibby Tomato UPS Service tomatoups.cgi sub\_9068 stack-based overflow (CVSS 8.7, Shibby Tomato)
- [CVE-2026-48501](https://cve.now/CVE-2026-48501.md): GitHub CLI tokens leak via \`gh attestation\` commands (CVSS 7.4, cli · github.com/cli/cli +1)
- [CVE-2026-33386](https://cve.now/CVE-2026-33386.md): XSS in QuickCMS (CVSS 2.3, OpenSolution QuickCMS)
- [CVE-2026-33384](https://cve.now/CVE-2026-33384.md): Session Fixation in QuickCMS (CVSS 4.8, OpenSolution QuickCMS)
- [CVE-2026-35674](https://cve.now/CVE-2026-35674.md): OpenClaw \< 2026.5.18 - Scope Bypass via Inherited chat.send Route (CVSS 8.8, OpenClaw)
- [CVE-2026-35673](https://cve.now/CVE-2026-35673.md): OpenClaw \< 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes (CVSS 6.5, OpenClaw)
- [CVE-2026-35630](https://cve.now/CVE-2026-35630.md): OpenClaw \< 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons (CVSS 8.0, OpenClaw)
- [CVE-2026-34507](https://cve.now/CVE-2026-34507.md): OpenClaw \< 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks (CVSS 2.3, OpenClaw)
- [CVE-2026-32906](https://cve.now/CVE-2026-32906.md): OpenClaw \< 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate (CVSS 2.3, OpenClaw)
- [CVE-2026-32905](https://cve.now/CVE-2026-32905.md): OpenClaw \< 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command (CVSS 8.3, OpenClaw)
- [CVE-2026-10065](https://cve.now/CVE-2026-10065.md): Shibby Tomato tomatodata.cgi get\_ups\_field stack-based overflow (CVSS 8.7, Shibby Tomato)
- [CVE-2018-25404](https://cve.now/CVE-2018-25404.md): The Open ISES Project 3.30A SQL Injection via add\_facnote.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25403](https://cve.now/CVE-2018-25403.md): The Open ISES Project 3.30A SQL Injection via city\_graph.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25402](https://cve.now/CVE-2018-25402.md): The Open ISES Project 3.30A SQL Injection via inc\_types\_graph.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25401](https://cve.now/CVE-2018-25401.md): The Open ISES Project 3.30A SQL Injection via sever\_graph.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25400](https://cve.now/CVE-2018-25400.md): The Open ISES Project 3.30A SQL Injection via form\_post.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25399](https://cve.now/CVE-2018-25399.md): The Open ISES Project 3.30A SQL Injection via nearby.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25398](https://cve.now/CVE-2018-25398.md): The Open ISES Project 3.30A SQL Injection via main.php (CVSS 8.8, Open ISES Project)
- [CVE-2018-25397](https://cve.now/CVE-2018-25397.md): PHP-SHOP 1.0 Cross-Site Request Forgery via users.php (CVSS 6.9, joeyrush PHP-SHOP master)
- [CVE-2018-25396](https://cve.now/CVE-2018-25396.md): Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm (CVSS 8.7, Heatmiser Wifi Thermostat)
- [CVE-2018-25395](https://cve.now/CVE-2018-25395.md): Kados R10 GreenBee SQL Injection via update\_feature.php (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2018-25394](https://cve.now/CVE-2018-25394.md): Kados R10 GreenBee SQL Injection via update\_release.php (CVSS 8.8, Kados R10 GreenBee)
- [CVE-2018-25393](https://cve.now/CVE-2018-25393.md): Navigate CMS 2.8.5 Path Traversal via navigate\_download.php (CVSS 7.1, Navigatecms Navigate CMS)
- [CVE-2018-25392](https://cve.now/CVE-2018-25392.md): MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter (CVSS 7.1, Talagasoft MaxOn ERP)
- [CVE-2018-25391](https://cve.now/CVE-2018-25391.md): HaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion (CVSS 8.7, Sitejo HaPe PKH)
- [CVE-2018-25390](https://cve.now/CVE-2018-25390.md): HaPe PKH 1.1 SQL Injection via desa Parameter (CVSS 8.8, Sitejo HaPe PKH)
- [CVE-2018-25389](https://cve.now/CVE-2018-25389.md): HaPe PKH 1.1 SQL Injection via nama\_kelompok Parameter (CVSS 8.8, Sitejo HaPe PKH)
- [CVE-2018-25388](https://cve.now/CVE-2018-25388.md): HaPe PKH 1.1 Arbitrary File Upload via aksi\_foto.php (CVSS 8.7, Sitejo HaPe PKH)
- [CVE-2018-25387](https://cve.now/CVE-2018-25387.md): HaPe PKH 1.1 Cross-Site Request Forgery via aksi\_user.php (CVSS 6.9, Sitejo HaPe PKH)
- [CVE-2018-25386](https://cve.now/CVE-2018-25386.md): HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php (CVSS 8.8, Sitejo HaPe PKH)
- [CVE-2018-25385](https://cve.now/CVE-2018-25385.md): E-Registrasi Pencak Silat 18.10 SQL Injection via id\_partai (CVSS 8.8, eregistrasi-kejuaraan-silat Registrasi Pencak Silat)
- [CVE-2018-25384](https://cve.now/CVE-2018-25384.md): Wikidforum 2.20 Cross-Site Scripting via reply\_text Parameter (CVSS 5.1, Wikidforum)
- [CVE-2018-25383](https://cve.now/CVE-2018-25383.md): Free MP3 CD Ripper 2.8 Buffer Overflow SEH DEP Bypass (CVSS 8.6, Commentcamarche Free MP3 CD Ripper)
- [CVE-2018-25382](https://cve.now/CVE-2018-25382.md): Zechat 1.5 SQL Injection via uname Parameter (CVSS 8.8, Bylancer Zechat)
- [CVE-2026-10064](https://cve.now/CVE-2026-10064.md): TRENDnet TEW-432BRP formSetPortTr stack-based overflow (CVSS 5.3, TRENDnet TEW-432BRP)
- [CVE-2026-10042](https://cve.now/CVE-2026-10042.md): manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model (CVSS 9.8, zyddnys manga-image-translator)
- [CVE-2026-4290](https://cve.now/CVE-2026-4290.md): WP Travel Pro \<= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators (CVSS 9.1, WPTravel WP Travel Pro)
- [CVE-2026-10063](https://cve.now/CVE-2026-10063.md): TRENDnet TEW-432BRP formWPS stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-41150](https://cve.now/CVE-2026-41150.md): Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-41159](https://cve.now/CVE-2026-41159.md): Mermaid: Improper sanitization of configuration leads to CSS injection (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-45609](https://cve.now/CVE-2026-45609.md): mcp-security: Unvalidated URL Fetching (SSRF) (CVSS 7.2, spring-ai-community mcp-security · org.springaicommunity:mc…)
- [CVE-2026-10062](https://cve.now/CVE-2026-10062.md): TRENDnet TEW-432BRP formSetRoute stack-based overflow (CVSS 8.7, TRENDnet TEW-432BRP)
- [CVE-2026-46510](https://cve.now/CVE-2026-46510.md): Prototype pollution in form-data-objectizer via bracket-notation form keys (CVSS 8.2, kaspernj form-data-objectizer · form-data-objectizer)
- [CVE-2026-40528](https://cve.now/CVE-2026-40528.md): OpenSC \< 0.27.0 Buffer Overrun in do\_key\_value() via profile.c (CVSS 1.0, OpenSC)
- [CVE-2026-45582](https://cve.now/CVE-2026-45582.md): n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters (CVSS 6.5, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-45707](https://cve.now/CVE-2026-45707.md): n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete (CVSS 8.1, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-44698](https://cve.now/CVE-2026-44698.md): Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection (CVSS 8.3, home-assistant core · Home Assistant Companion app)
- [CVE-2026-10061](https://cve.now/CVE-2026-10061.md): TRENDnet TEW-432BRP formWPS command injection (CVSS 5.3, TRENDnet TEW-432BRP)
- [CVE-2026-40510](https://cve.now/CVE-2026-40510.md): OpenSC \< 0.27.0-rc1 Stack Buffer Overflow via piv\_process\_history() in card-piv.c (CVSS 1.0, OpenSC)
- [CVE-2026-45615](https://cve.now/CVE-2026-45615.md): mouse07410/asn1c: 1-byte Heap Out-of-Bounds Read in \`INTEGER\_decode\_oer\` via Malformed OER Payload (CVSS 8.2, mouse07410 asn1c)
- [CVE-2026-49318](https://cve.now/CVE-2026-49318.md): Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot (CVSS 2.4, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-10060](https://cve.now/CVE-2026-10060.md): TRENDnet TEW-432BRP formSetRoute command injection (CVSS 5.3, TRENDnet TEW-432BRP)
- [CVE-2026-45580](https://cve.now/CVE-2026-45580.md): WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute (CVSS 5.4, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-45578](https://cve.now/CVE-2026-45578.md): WWBN AVideo Live: OS command injection in on\_publish.php execAsync via unescaped m3u8 URL (CVSS 8.8, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-45610](https://cve.now/CVE-2026-45610.md): WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA (CVSS 5.7, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-45619](https://cve.now/CVE-2026-45619.md): AVideo CVE-2026-43884 incomplete fix - \`isSSRFSafeURL()\` call sites still discard the \`$resolvedIP\` out-param at master HEAD post (CVSS 6.5, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-45620](https://cve.now/CVE-2026-45620.md): AVideo CVE-2026-43881 incomplete fix - \`objects/mention.json.php:17\` is an unauthenticated user enumeration (CVSS 5.3, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-45731](https://cve.now/CVE-2026-45731.md): WWBN AVideo: Authenticated Arbitrary File Read in view/update.php (CVSS 6.9, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-46337](https://cve.now/CVE-2026-46337.md): WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in \`view/img/image404Raw.php\` (CVSS 6.9, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-47694](https://cve.now/CVE-2026-47694.md): WWBN AVideo: Stored XSS via unescaped Gallery category description (CVSS 5.4, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-47696](https://cve.now/CVE-2026-47696.md): WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint (CVSS 7.1, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-45555](https://cve.now/CVE-2026-45555.md): Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get\_diagnostics Leads to Arbitrary Code Execution (CVSS 7.8, MarcelRoozekrans roslyn-codelens-mcp)
- [CVE-2026-10075](https://cve.now/CVE-2026-10075.md): Interinfo｜DreamMaker - Path Traversal (CVSS 6.9, Interinfo DreamMaker)
- [CVE-2026-44237](https://cve.now/CVE-2026-44237.md): FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module (CVSS 7.6, FreePBX security-reporting)
- [CVE-2026-10074](https://cve.now/CVE-2026-10074.md): Interinfo｜DreamMaker - Arbitrary File Read (CVSS 6.9, Interinfo DreamMaker)
- [CVE-2026-44238](https://cve.now/CVE-2026-44238.md): FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports (CVSS 8.5, FreePBX security-reporting)
- [CVE-2026-44239](https://cve.now/CVE-2026-44239.md): FreePBX: Authenticated Local File Inclusion in Dashboard Module (CVSS 7.6, FreePBX security-reporting)
- [CVE-2026-49317](https://cve.now/CVE-2026-49317.md): Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot (CVSS 2.4, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-46376](https://cve.now/CVE-2026-46376.md): FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface (CVSS 9.3, FreePBX security-reporting)
- [CVE-2026-10073](https://cve.now/CVE-2026-10073.md): Interinfo｜DreamMaker - Arbitrary File Read (CVSS 8.7, Interinfo DreamMaker)
- [CVE-2026-49316](https://cve.now/CVE-2026-49316.md): Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown (CVSS 4.6, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-49325](https://cve.now/CVE-2026-49325.md): Indian Scout Bobber 2025 WCM voltage-based shutdown (CVSS 4.6, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-10072](https://cve.now/CVE-2026-10072.md): Interinfo｜DreamMaker - Arbitrary File Upload (CVSS 8.6, Interinfo DreamMaker)
- [CVE-2026-45551](https://cve.now/CVE-2026-45551.md): Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write (CVSS 5.1, Intermesh groupoffice)
- [CVE-2026-49324](https://cve.now/CVE-2026-49324.md): Indian Scout Bobber 2025 WCM brute-force (CVSS 4.6, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-10071](https://cve.now/CVE-2026-10071.md): Interinfo｜DreamMaker - Arbitrary File Upload (CVSS 9.3, Interinfo DreamMaker)
- [CVE-2026-49323](https://cve.now/CVE-2026-49323.md): Indian Scout Bobber 2025 WCM-to-ECM weak authentication (CVSS 4.3, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-48527](https://cve.now/CVE-2026-48527.md): HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint (CVSS 8.7, haxtheweb haxcms-nodejs · haxtheweb haxcms-php +1)
- [CVE-2026-45043](https://cve.now/CVE-2026-45043.md): RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root (CVSS 9.3, rustfs)
- [CVE-2026-45312](https://cve.now/CVE-2026-45312.md): RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution (CVSS 9.9, infiniflow ragflow)
- [CVE-2026-9509](https://cve.now/CVE-2026-9509.md): Uncaught exception vulnerability in Suprema's BioStar (CVSS 8.7, Suprema BioStar)
- [CVE-2026-9508](https://cve.now/CVE-2026-9508.md): Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar (CVSS 10.0, Suprema BioStar)
- [CVE-2026-8326](https://cve.now/CVE-2026-8326.md): Remote Spark SparkView Path Traversal in RDP Drive Redirection leading to RCE (CVSS 10.0, Remote Spark (https://www.remotespark.com/) SparkView)
- [CVE-2025-41281](https://cve.now/CVE-2025-41281.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Wate (CVSS 7.5, Waterfall WF-500)
- [CVE-2025-41280](https://cve.now/CVE-2025-41280.md): Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that (CVSS 7.5, Waterfall WF-500)
- [CVE-2025-41279](https://cve.now/CVE-2025-41279.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 8.6, Waterfall WF-500)
- [CVE-2025-41278](https://cve.now/CVE-2025-41278.md): Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attack (CVSS 7.5, Waterfall WF-500)
- [CVE-2025-41277](https://cve.now/CVE-2025-41277.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41276](https://cve.now/CVE-2025-41276.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41275](https://cve.now/CVE-2025-41275.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41274](https://cve.now/CVE-2025-41274.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41273](https://cve.now/CVE-2025-41273.md): Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41272](https://cve.now/CVE-2025-41272.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41271](https://cve.now/CVE-2025-41271.md): Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1. (CVSS 8.7, Waterfall WF-500)
- [CVE-2025-41270](https://cve.now/CVE-2025-41270.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41269](https://cve.now/CVE-2025-41269.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 9.3, Waterfall WF-500)
- [CVE-2025-41268](https://cve.now/CVE-2025-41268.md): Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version (CVSS 8.8, Waterfall WF-500)
- [CVE-2025-41267](https://cve.now/CVE-2025-41267.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 8.5, Waterfall WF-500)
- [CVE-2025-41266](https://cve.now/CVE-2025-41266.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 8.6, Waterfall WF-500)
- [CVE-2026-9811](https://cve.now/CVE-2026-9811.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. (CVSS 5.4, mautic/core)
- [CVE-2025-41265](https://cve.now/CVE-2025-41265.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the (CVSS 8.6, Waterfall WF-500)
- [CVE-2026-9809](https://cve.now/CVE-2026-9809.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. (CVSS 7.6, mautic/core)
- [CVE-2026-9808](https://cve.now/CVE-2026-9808.md): An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). (CVSS 7.1, mautic/core)
- [CVE-2026-9559](https://cve.now/CVE-2026-9559.md): A path traversal vulnerability exists in the campaign import feature of Mautic 7. (CVSS 9.9, mautic/core)
- [CVE-2026-9558](https://cve.now/CVE-2026-9558.md): A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. (CVSS 9.9, mautic/core)
- [CVE-2026-42965](https://cve.now/CVE-2026-42965.md): Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation (CVSS 7.7, Red Hat OpenShift Container Platform)
- [CVE-2026-46579](https://cve.now/CVE-2026-46579.md): Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend (CVSS 7.4, Red Hat OpenShift Container Platform)
- [CVE-2026-9557](https://cve.now/CVE-2026-9557.md): A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. (CVSS 6.4, mautic/core)
- [CVE-2026-10078](https://cve.now/CVE-2026-10078.md): Quay/config-tool: quay/config-tool: gitlab oauth client\_secret exposed in url querystring (CVSS 2.7, Red Hat Quay)
- [CVE-2025-12714](https://cve.now/CVE-2025-12714.md): Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \<= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification (CVSS 5.3, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2026-49201](https://cve.now/CVE-2026-49201.md): Acer Wave 7 router: Hardcoded Cryptographic Key (CVSS 10.0, Acer Wave 7 router)
- [CVE-2026-49200](https://cve.now/CVE-2026-49200.md): Acer Wave 7 router: Broken Access Control (CVSS 10.0, Acer Wave 7 router)
- [CVE-2026-49199](https://cve.now/CVE-2026-49199.md): Predator Connect W6x: RCE via MQTT (CVSS 10.0, Acer Predator Connect W6x)
- [CVE-2026-10058](https://cve.now/CVE-2026-10058.md): ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting (CVSS 4.8, ITP Technology ITS Intelligent SCADA System)
- [CVE-2026-10057](https://cve.now/CVE-2026-10057.md): ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting (CVSS 4.8, ITP Technology ITS Intelligent SCADA System)
- [CVE-2026-49198](https://cve.now/CVE-2026-49198.md): Predator Connect W6x: MQTT Broker Access Control (CVSS 8.3, Acer Predator Connect W6x)
- [CVE-2026-9189](https://cve.now/CVE-2026-9189.md): Contact Form 7 – PayPal & Stripe Add-on \<= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc\_gross' Verification) (CVSS 5.3, scottpaterson Contact Form 7 – PayPal & Stripe Add-on)
- [CVE-2026-49197](https://cve.now/CVE-2026-49197.md): Predator Connect W6x: Improper Authentication (CVSS 10.0, Acer Predator Connect W6x)
- [CVE-2026-49196](https://cve.now/CVE-2026-49196.md): Predator Connect W6x: Web Interface Command Injection (CVSS 8.6, Acer Predator Connect W6x)
- [CVE-2026-10056](https://cve.now/CVE-2026-10056.md): CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request (CVSS 7.5, Network Optix Nx Witness VMS)
- [CVE-2026-49195](https://cve.now/CVE-2026-49195.md): Predator Connect W6x: unauthenticated Debug Service (CVSS 8.7, Acer Predator Connect W6x)
- [CVE-2026-10052](https://cve.now/CVE-2026-10052.md): Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints (CVSS 4.1, Red Hat Quay)
- [CVE-2026-10039](https://cve.now/CVE-2026-10039.md): Frontend Admin by DynamiApps \<= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter (CVSS 4.9, shabti Frontend Admin by DynamiApps)
- [CVE-2026-6075](https://cve.now/CVE-2026-6075.md): Media Library Assistant \<= 3.35 - Cross-Site Request Forgery via Bulk Action Form (CVSS 8.1, dglingren Media Library Assistant)
- [CVE-2026-49322](https://cve.now/CVE-2026-49322.md): Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange (CVSS 4.3, Indian Motorcycle Scout Bobber + Tech)
- [CVE-2026-4776](https://cve.now/CVE-2026-4776.md): An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. (CVSS 7.1, mautic/core)
- [CVE-2025-11262](https://cve.now/CVE-2025-11262.md): Link Whisper Free \<= 0.9.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, linkwhspr Link Whisper Free)
- [CVE-2026-3655](https://cve.now/CVE-2026-3655.md): OTP Login With Phone Number, OTP Verification \<= 1.8.60 - Unauthenticated Authentication Bypass via Firebase OTP Verification (CVSS 9.8, glboy OTP Login With Phone Number, OTP Verification)
- [CVE-2026-9243](https://cve.now/CVE-2026-9243.md): The Plus Addons for Elementor \<= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel\_direction' Parameter (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2026-9493](https://cve.now/CVE-2026-9493.md): BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference (CVSS 7.1, BankPro E-Service Technology Service Center)
- [CVE-2026-9714](https://cve.now/CVE-2026-9714.md): Simple Divi Shortcode \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (CVSS 6.4, creaweb2b Simple Divi Shortcode)
- [CVE-2025-14042](https://cve.now/CVE-2025-14042.md): Automotive Car Dealership Business WordPress Theme \<= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details (CVSS 6.4, themesuite Automotive Car Dealership Business WordPress The…)
- [CVE-2025-11993](https://cve.now/CVE-2025-11993.md): WooCommerce Infinite Scroll and Ajax Pagination \<= 1.8 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, sbthemes WooCommerce Infinite Scroll and Ajax Pagination)
- [CVE-2026-8732](https://cve.now/CVE-2026-8732.md): WP Maps Pro \<= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp\_temp\_access\_ajax AJAX Action (CVSS 9.8, flippercode WP Maps Pro)
- [CVE-2026-6275](https://cve.now/CVE-2026-6275.md): StatCounter \<= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname (CVSS 6.4, StatCounter – Free Real Time Visitor Stats)
- [CVE-2026-6324](https://cve.now/CVE-2026-6324.md): Libsoup: libsoup: http request smuggling via unsigned to signed conversion error (CVSS 4.8, Red Hat Enterprise Linux)
- [CVE-2026-2128](https://cve.now/CVE-2026-2128.md): Breeze Cache \<= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie (CVSS 5.3, cloudways Breeze Cache)
- [CVE-2026-8995](https://cve.now/CVE-2026-8995.md): Poll Maker by AYS \<= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays\_poll\_get\_user\_information' AJAX Action (CVSS 4.3, ays-pro Poll Maker by AYS – Versus Polls, Anonymous Polls,…)
- [CVE-2026-7430](https://cve.now/CVE-2026-7430.md): Post Snippets \<= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import (CVSS 4.4, saadiqbal Post Snippets – Custom WordPress Code Snippets Cu…)
- [CVE-2026-7480](https://cve.now/CVE-2026-7480.md): An Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate privi (CVSS 7.3, ASUS System Control Interface)
- [CVE-2026-8070](https://cve.now/CVE-2026-8070.md): Incorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, re (CVSS 7.3, ASUS Armoury Crate)
- [CVE-2026-6892](https://cve.now/CVE-2026-6892.md): Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(\*) may allow a local attacker with login privileges to (CVSS 5.0, Canon PIXUS iX6800 Series CUPS Printer Driver for macOS… +1)
- [CVE-2026-36324](https://cve.now/CVE-2026-36324.md): SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in (CVSS 6.1)
- [CVE-2026-39229](https://cve.now/CVE-2026-39229.md): Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. (CVSS 6.5)
- [CVE-2026-39276](https://cve.now/CVE-2026-39276.md): The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitra (CVSS 7.2)
- [CVE-2026-39292](https://cve.now/CVE-2026-39292.md): Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.