# CVEs published 2026-06-01

377 CVEs were published on June 1, 2026: 21 critical, 138 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-10514](https://cve.now/CVE-2026-10514.md): 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting (CVSS 4.8, 1Panel-dev CordysCRM)
- [CVE-2026-10302](https://cve.now/CVE-2026-10302.md): itsourcecode Fees Management System manage\_fee.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-9048](https://cve.now/CVE-2026-9048.md): Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3, Revolution Slider Slider Revolution)
- [CVE-2026-9050](https://cve.now/CVE-2026-9050.md): Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation (CVSS 4.3, Revolution Slider Slider Revolution)
- [CVE-2026-10301](https://cve.now/CVE-2026-10301.md): itsourcecode Fees Management System index.php cross site scripting (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-10300](https://cve.now/CVE-2026-10300.md): SGLang Inference HTTP Endpoint lora\_manager.py assertion (CVSS 6.3, SGLang)
- [CVE-2026-10299](https://cve.now/CVE-2026-10299.md): code-projects Online Hospital Management System viewdoctortimings.php resource injection (CVSS 5.1, code-projects Online Hospital Management System)
- [CVE-2026-10298](https://cve.now/CVE-2026-10298.md): ggml-org whisper.cpp ggml.c whisper\_model\_load null pointer dereference (CVSS 4.8, ggml-org whisper.cpp)
- [CVE-2026-25879](https://cve.now/CVE-2026-25879.md): Langroid has Prompt to SQL Injection, Leading to RCE (CVSS 9.8, langroid)
- [CVE-2026-28511](https://cve.now/CVE-2026-28511.md): elabftw has entry title leakage through autocompletion search (CVSS 4.3, elabftw)
- [CVE-2026-10297](https://cve.now/CVE-2026-10297.md): itsourcecode Fees Management System manage\_course.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-25277](https://cve.now/CVE-2026-25277.md): Buffer Copy Without Checking Size of Input in Secure Processor (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25276](https://cve.now/CVE-2026-25276.md): Improper Validation of Array Index in Secure Processor (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2026-25260](https://cve.now/CVE-2026-25260.md): Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25259](https://cve.now/CVE-2026-25259.md): Out-of-bounds Write in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-25258](https://cve.now/CVE-2026-25258.md): Out-of-bounds Read in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-24092](https://cve.now/CVE-2026-24092.md): Improper Validation of Syntactic Correctness of Input in Display (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24091](https://cve.now/CVE-2026-24091.md): Improper Validation of Syntactic Correctness of Input in Display (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24090](https://cve.now/CVE-2026-24090.md): Missing Authentication for Critical Function in HLOS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2026-24089](https://cve.now/CVE-2026-24089.md): Improper Validation of Syntactic Correctness of Input in Kernel (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24088](https://cve.now/CVE-2026-24088.md): Missing Authentication for Critical Function in Boot (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2026-24087](https://cve.now/CVE-2026-24087.md): Improper Validation of Syntactic Correctness of Input in Kernel (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2026-24085](https://cve.now/CVE-2026-24085.md): Stack-based Buffer Overflow in Display (CVSS 7.2, Qualcomm Snapdragon)
- [CVE-2025-59614](https://cve.now/CVE-2025-59614.md): Out-of-bounds Write in Windows Compute (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59613](https://cve.now/CVE-2025-59613.md): Stack-based Buffer Overflow in Windows Compute (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59612](https://cve.now/CVE-2025-59612.md): Stack-based Buffer Overflow in Windows Compute (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59611](https://cve.now/CVE-2025-59611.md): Out-of-bounds Write in Core Services (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2025-59610](https://cve.now/CVE-2025-59610.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver (CVSS 6.4, Qualcomm Snapdragon)
- [CVE-2025-59609](https://cve.now/CVE-2025-59609.md): Buffer Over-read in WLAN Host Communication (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2025-59606](https://cve.now/CVE-2025-59606.md): NULL Pointer Dereference in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59605](https://cve.now/CVE-2025-59605.md): Out-of-bounds Write in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59604](https://cve.now/CVE-2025-59604.md): NULL Pointer Dereference in SPS Applications (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2025-59601](https://cve.now/CVE-2025-59601.md): Exposure of Sensitive Information Through Metadata in Powerline Communication Firmware (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2026-24782](https://cve.now/CVE-2026-24782.md): Kiteworks Secure Data Forms has a SQL Injection vulnerability (CVSS 7.6, kiteworks Secure Data Forms)
- [CVE-2026-10296](https://cve.now/CVE-2026-10296.md): itsourcecode Fees Management System ajax.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-24761](https://cve.now/CVE-2026-24761.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 3.7, kiteworks Secure Data Forms)
- [CVE-2026-24756](https://cve.now/CVE-2026-24756.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 4.3, kiteworks Secure Data Forms)
- [CVE-2026-24755](https://cve.now/CVE-2026-24755.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 5.4, kiteworks Secure Data Forms)
- [CVE-2026-24754](https://cve.now/CVE-2026-24754.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 5.4, kiteworks security-advisories)
- [CVE-2026-24753](https://cve.now/CVE-2026-24753.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 6.5, kiteworks Secure Data Forms)
- [CVE-2026-10295](https://cve.now/CVE-2026-10295.md): SourceCodester Customer Review App review\_app.py get\_all\_reviews denial of service (CVSS 4.8, SourceCodester Customer Review App)
- [CVE-2026-24752](https://cve.now/CVE-2026-24752.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 8.2, kiteworks Secure Data Forms)
- [CVE-2019-25718](https://cve.now/CVE-2019-25718.md): Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass (CVSS 8.6, Dräger Infinity Explorer C700)
- [CVE-2026-10294](https://cve.now/CVE-2026-10294.md): PackageKit API pk-transaction.c g\_file\_test improper authorization (CVSS 5.3, PackageKit)
- [CVE-2026-40965](https://cve.now/CVE-2026-40965.md): Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. (CVSS 10.0, Cloud Foundry Foundation uaa\_release · Cloud Foundry Founda…)
- [CVE-2026-10293](https://cve.now/CVE-2026-10293.md): UTT HiPER 1200GW formFireWall strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2019-25716](https://cve.now/CVE-2019-25716.md): Dräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network Packet (CVSS 7.1, Dräger Infinity Delta · Dräger Infinity Kappa)
- [CVE-2026-28586](https://cve.now/CVE-2026-28586.md): In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. (CVSS 3.3, Google Android)
- [CVE-2026-28581](https://cve.now/CVE-2026-28581.md): In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the c (CVSS 4.0, Google Android)
- [CVE-2026-28580](https://cve.now/CVE-2026-28580.md): In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-28578](https://cve.now/CVE-2026-28578.md): In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2026-28577](https://cve.now/CVE-2026-28577.md): In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. (CVSS 7.8, Google Android)
- [CVE-2026-0100](https://cve.now/CVE-2026-0100.md): In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2026-0099](https://cve.now/CVE-2026-0099.md): In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the (CVSS 7.8, Google Android)
- [CVE-2026-0098](https://cve.now/CVE-2026-0098.md): In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2026-0097](https://cve.now/CVE-2026-0097.md): In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. (CVSS 8.0, Google Android)
- [CVE-2026-0096](https://cve.now/CVE-2026-0096.md): In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insuffic (CVSS 7.8, Google Android)
- [CVE-2026-0095](https://cve.now/CVE-2026-0095.md): In l2c\_fcr\_clone\_buf of l2c\_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process du (CVSS 8.0, Google Android)
- [CVE-2026-0094](https://cve.now/CVE-2026-0094.md): In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misl (CVSS 7.8, Google Android)
- [CVE-2026-0093](https://cve.now/CVE-2026-0093.md): In multiple locations, there is a possible misleading UI due to obfuscation. (CVSS 7.8, Google Android)
- [CVE-2026-0091](https://cve.now/CVE-2026-0091.md): In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. (CVSS 7.8, Google Android)
- [CVE-2026-0089](https://cve.now/CVE-2026-0089.md): In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2026-0088](https://cve.now/CVE-2026-0088.md): In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient (CVSS 7.8, Google Android)
- [CVE-2026-0087](https://cve.now/CVE-2026-0087.md): In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic (CVSS 7.8, Google Android)
- [CVE-2026-0086](https://cve.now/CVE-2026-0086.md): In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. (CVSS 6.8, Google Android)
- [CVE-2026-0085](https://cve.now/CVE-2026-0085.md): In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2026-0080](https://cve.now/CVE-2026-0080.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0079](https://cve.now/CVE-2026-0079.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. (CVSS 5.5, Google Android)
- [CVE-2026-0078](https://cve.now/CVE-2026-0078.md): In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-0077](https://cve.now/CVE-2026-0077.md): In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the c (CVSS 7.8, Google Android)
- [CVE-2026-0076](https://cve.now/CVE-2026-0076.md): In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-0075](https://cve.now/CVE-2026-0075.md): In multiple functions, there is a possible way to access the contacts database due to a SQL injection. (CVSS 7.8, Google Android)
- [CVE-2026-0074](https://cve.now/CVE-2026-0074.md): In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2026-0070](https://cve.now/CVE-2026-0070.md): In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input va (CVSS 5.5, Google Android)
- [CVE-2026-0069](https://cve.now/CVE-2026-0069.md): In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2026-0067](https://cve.now/CVE-2026-0067.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a permanent denial of service due to a logic error in (CVSS 5.5, Google Android)
- [CVE-2026-0061](https://cve.now/CVE-2026-0061.md): In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay a (CVSS 5.9, Google Android)
- [CVE-2026-0060](https://cve.now/CVE-2026-0060.md): In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root ca (CVSS 5.5, Google Android)
- [CVE-2026-0059](https://cve.now/CVE-2026-0059.md): In multiple functions of sdp\_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. (CVSS 8.0, Google Android)
- [CVE-2026-0056](https://cve.now/CVE-2026-0056.md): In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. (CVSS 3.3, Google Android)
- [CVE-2026-0055](https://cve.now/CVE-2026-0055.md): In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid dir (CVSS 6.2, Google Android)
- [CVE-2026-0052](https://cve.now/CVE-2026-0052.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0051](https://cve.now/CVE-2026-0051.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. (CVSS 6.5, Google Android)
- [CVE-2026-0050](https://cve.now/CVE-2026-0050.md): In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. (CVSS 3.3, Google Android)
- [CVE-2026-0048](https://cve.now/CVE-2026-0048.md): In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. (CVSS 6.8, Google Android)
- [CVE-2026-0046](https://cve.now/CVE-2026-0046.md): In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attac (CVSS 6.2, Google Android)
- [CVE-2026-0045](https://cve.now/CVE-2026-0045.md): In bta\_jv\_rfcomm\_connect of bta\_jv\_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-0044](https://cve.now/CVE-2026-0044.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause the system to crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0043](https://cve.now/CVE-2026-0043.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. (CVSS 5.5, Google Android)
- [CVE-2026-0042](https://cve.now/CVE-2026-0042.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2026-0041](https://cve.now/CVE-2026-0041.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible UBSan failure due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0040](https://cve.now/CVE-2026-0040.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0039](https://cve.now/CVE-2026-0039.md): In multiple functions of ubsan\_throwing\_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. (CVSS 6.5, Google Android)
- [CVE-2026-0036](https://cve.now/CVE-2026-0036.md): In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. (CVSS 7.8, Google Android)
- [CVE-2026-0018](https://cve.now/CVE-2026-0018.md): In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation (CVSS 5.5, Google Android)
- [CVE-2026-0016](https://cve.now/CVE-2026-0016.md): In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a pe (CVSS 3.3, Google Android)
- [CVE-2026-0009](https://cve.now/CVE-2026-0009.md): In multiple locations, there is a possible tapjacking due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48652](https://cve.now/CVE-2025-48652.md): In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-48649](https://cve.now/CVE-2025-48649.md): In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. (CVSS 7.8, Google Android)
- [CVE-2025-48648](https://cve.now/CVE-2025-48648.md): In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. (CVSS 5.5, Google Android)
- [CVE-2025-48616](https://cve.now/CVE-2025-48616.md): In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic erro (CVSS 3.3, Google Android)
- [CVE-2025-48595](https://cve.now/CVE-2025-48595.md): In multiple locations, there is a possible way to achieve code execution due to an integer overflow. (CVSS 8.4, KEV, Google Android)
- [CVE-2025-48570](https://cve.now/CVE-2025-48570.md): In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2025-32348](https://cve.now/CVE-2025-32348.md): In multiple locations, there is a possible background activity launch due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2025-26418](https://cve.now/CVE-2025-26418.md): In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to (CVSS 7.8, Google Android)
- [CVE-2025-22426](https://cve.now/CVE-2025-22426.md): In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2025-22424](https://cve.now/CVE-2025-22424.md): In multiple locations, there is a possible way to reveal images across users due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-40964](https://cve.now/CVE-2026-40964.md): Authentication Bypass in cf-auth-proxy in Cloud Foundry Foundation all installations allows an unauthenticated remote attacker to gain read (CVSS 7.5, Cloud Foundry Foundation log-cache\_release · Cloud Foundry…)
- [CVE-2026-49491](https://cve.now/CVE-2026-49491.md): Pixa Bank 2.0 SQL Injection via agence-ajax.php API (CVSS 8.8, Pixastudio Pixa Bank)
- [CVE-2018-25435](https://cve.now/CVE-2018-25435.md): ZeusCart 4.0 Deactivate Customer Accounts CSRF (CVSS 6.9, ZeusCart)
- [CVE-2018-25434](https://cve.now/CVE-2018-25434.md): WP AutoSuggest 0.24 SQL Injection via autosuggest.php (CVSS 8.8, eliekhoury WP AutoSuggest)
- [CVE-2018-25433](https://cve.now/CVE-2018-25433.md): Joomla JE Photo Gallery 1.1 SQL Injection via categoryid (CVSS 8.8, Joomlaextensions JE Photo Gallery)
- [CVE-2018-25432](https://cve.now/CVE-2018-25432.md): Arm Whois 3.11 Buffer Overflow via ASLR Bypass (CVSS 8.6, Armcode Arm Whois)
- [CVE-2018-25431](https://cve.now/CVE-2018-25431.md): No-Cms 1.0 SQL Injection via order\_by Parameter (CVSS 7.1, goFrendiAsgard No-CMS)
- [CVE-2018-25430](https://cve.now/CVE-2018-25430.md): Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter (CVSS 7.1, Paroiciel)
- [CVE-2018-25429](https://cve.now/CVE-2018-25429.md): Paroiciel 11.20 SQL Injection via zProIdPro Parameter (CVSS 7.1, Paroiciel)
- [CVE-2018-25428](https://cve.now/CVE-2018-25428.md): Paroiciel 11.20 SQL Injection via tRecIdListe Parameter (CVSS 8.8, Paroiciel)
- [CVE-2018-25427](https://cve.now/CVE-2018-25427.md): Arm Whois 3.11 Buffer Overflow via SEH Overwrite (CVSS 9.3, Armcode Arm Whois)
- [CVE-2026-10292](https://cve.now/CVE-2026-10292.md): UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-10291](https://cve.now/CVE-2026-10291.md): Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos (CVSS 5.3, Enderfga claw-orchestrator · @enderfga/claw-orchestrator)
- [CVE-2026-10290](https://cve.now/CVE-2026-10290.md): code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection (CVSS 6.9, code-projects Hotel and Tourism Reservation System)
- [CVE-2026-10289](https://cve.now/CVE-2026-10289.md): code-projects Hotel and Tourism Reservation System tour.php cross site scripting (CVSS 5.3, code-projects Hotel and Tourism Reservation System)
- [CVE-2026-10288](https://cve.now/CVE-2026-10288.md): code-projects Hotel and Tourism Reservation System Admin Login login.php password\_verify improper authentication (CVSS 6.9, code-projects Hotel and Tourism Reservation System)
- [CVE-2026-49433](https://cve.now/CVE-2026-49433.md): DeepAI api.deepai.org/change\_user\_email CSRF (CVSS 2.3, api.deepai.org)
- [CVE-2026-49140](https://cve.now/CVE-2026-49140.md): Nanobot \< 0.2.1 Denial of Service via Matrix Media Download Handler (CVSS 5.3, HKUDS nanobot)
- [CVE-2026-49139](https://cve.now/CVE-2026-49139.md): Nanobot \< 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning (CVSS 7.0, HKUDS nanobot)
- [CVE-2026-10287](https://cve.now/CVE-2026-10287.md): SourceCodester SEO Meta Tag Extractor index.php get\_headers server-side request forgery (CVSS 6.9, SourceCodester SEO Meta Tag Extractor)
- [CVE-2026-49138](https://cve.now/CVE-2026-49138.md): Nanobot \< 0.2.1 SSRF via web\_fetch Tool Redirect Following (CVSS 5.3, HKUDS nanobot · nanobot-ai)
- [CVE-2026-10286](https://cve.now/CVE-2026-10286.md): CodeAstro Payroll System home\_employee.php sql injection (CVSS 5.3, CodeAstro Payroll System)
- [CVE-2026-5419](https://cve.now/CVE-2026-5419.md): Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal (CVSS 3.7, gnutls · Red Hat Enterprise Linux +6)
- [CVE-2026-10285](https://cve.now/CVE-2026-10285.md): DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization (CVSS 5.3, DevaslanPHP project-management)
- [CVE-2026-49136](https://cve.now/CVE-2026-49136.md): Banana Slides 0.4.0 Path Traversal via generate\_image() in ai\_service.py (CVSS 8.7, Anionex banana-slides)
- [CVE-2021-46747](https://cve.now/CVE-2021-46747.md): Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to m (CVSS 7.1, AMD Athlon™ 3000 Series Mobile Processors with Radeon™… +23)
- [CVE-2026-10284](https://cve.now/CVE-2026-10284.md): DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization (CVSS 5.3, DevaslanPHP project-management)
- [CVE-2026-49135](https://cve.now/CVE-2026-49135.md): CodexBar \< 0.32.0 Insecure Temporary File Handling in Notarization Workflow (CVSS 7.2, steipete CodexBar)
- [CVE-2026-49134](https://cve.now/CVE-2026-49134.md): CodexBar \< 0.32.0 Privilege Escalation via CLI Installer Temp File (CVSS 7.5, steipete CodexBar)
- [CVE-2026-24751](https://cve.now/CVE-2026-24751.md): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (CVSS 8.2, kiteworks Secure Data Forms)
- [CVE-2026-43625](https://cve.now/CVE-2026-43625.md): CodexBar \< 0.32.0 Session Cookie Exposure via HTTP Redirect (CVSS 8.2, steipete CodexBar)
- [CVE-2026-10283](https://cve.now/CVE-2026-10283.md): Bottelet DaybydayCRM Setting missing authentication (CVSS 5.3, Bottelet DaybydayCRM)
- [CVE-2026-10282](https://cve.now/CVE-2026-10282.md): Bottelet DaybydayCRM DocumentsController.php view improper authorization (CVSS 5.3, Bottelet DaybydayCRM)
- [CVE-2026-47294](https://cve.now/CVE-2026-47294.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-43624](https://cve.now/CVE-2026-43624.md): F5-TTS 1.1.20 Path Traversal via finetune\_gradio.py create\_data\_project() (CVSS 8.8, SWivid F5-TTS)
- [CVE-2026-10281](https://cve.now/CVE-2026-10281.md): Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication (CVSS 6.9, Enderfga claw-orchestrator · @enderfga/claw-orchestrator)
- [CVE-2026-23638](https://cve.now/CVE-2026-23638.md): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (CVSS 6.5, kiteworks Secure Data Forms)
- [CVE-2026-43623](https://cve.now/CVE-2026-43623.md): microtar 0.1.0 Stack-Based Buffer Overflow via raw\_to\_header() (CVSS 8.7, rxi microtar)
- [CVE-2026-9330](https://cve.now/CVE-2026-9330.md): IBM WebSphere Application Server is affected by remote code execution (CVSS 8.5, IBM WebSphere Application Server)
- [CVE-2026-30963](https://cve.now/CVE-2026-30963.md): Capsule Namespace Hijacking via subresource (CVSS 3.9, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-10280](https://cve.now/CVE-2026-10280.md): horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery (CVSS 6.9, horizon921 mcpilot)
- [CVE-2026-9319](https://cve.now/CVE-2026-9319.md): IBM WebSphere Application Server is affected by a remote code execution vulnerability (CVSS 9.0, IBM WebSphere Application Server)
- [CVE-2026-9614](https://cve.now/CVE-2026-9614.md): An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain a (CVSS 8.8, Ivanti Neurons for ITSM)
- [CVE-2026-9311](https://cve.now/CVE-2026-9311.md): IBM WebSphere Application Server is affected by remote code execution (CVSS 9.0, IBM WebSphere Application Server)
- [CVE-2026-40990](https://cve.now/CVE-2026-40990.md): Unbounded cache for function definitions (CVSS 5.7, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2026-40989](https://cve.now/CVE-2026-40989.md): Self Routing guard bypassed via function composition (CVSS 5.7, Spring Cloud Function · org.springframework.cloud:spring-cl…)
- [CVE-2026-8644](https://cve.now/CVE-2026-8644.md): IBM WebSphere Application Server is affected by an identity spoofing vulnerability (CVSS 9.1, IBM WebSphere Application Server)
- [CVE-2026-10279](https://cve.now/CVE-2026-10279.md): hiraishikentaro wezterm-mcp switch\_pane/write\_to\_specific\_pane wezterm\_executor.ts os command injection (CVSS 5.3, hiraishikentaro wezterm-mcp)
- [CVE-2026-7770](https://cve.now/CVE-2026-7770.md): IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator (CVSS 8.8, IBM i Access Family)
- [CVE-2026-22872](https://cve.now/CVE-2026-22872.md): Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability (CVSS 6.9, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-0072](https://cve.now/CVE-2026-0072.md): In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. (CVSS 10.0, Google Android XR)
- [CVE-2026-41013](https://cve.now/CVE-2026-41013.md): Tenant-controlled comma smuggles arbitrary CIFS mount options (CVSS 8.1, CloudFoundry Foundation smb-volume-release · CloudFoundry F…)
- [CVE-2026-43958](https://cve.now/CVE-2026-43958.md): Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-10278](https://cve.now/CVE-2026-10278.md): ishayoyo excel-mcp read\_file/write\_file index.ts path traversal (CVSS 5.3, ishayoyo excel-mcp)
- [CVE-2026-45727](https://cve.now/CVE-2026-45727.md): CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion (CVSS 8.8, CloakHQ CloakBrowser · cloakbrowser)
- [CVE-2026-45302](https://cve.now/CVE-2026-45302.md): Prototype Pollution in parse-nested-form-data via \`\_\_proto\_\_\` in FormData field names (CVSS 8.2, milamer parse-nested-form-data · parse-nested-form-data)
- [CVE-2026-45729](https://cve.now/CVE-2026-45729.md): ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input (CVSS 4.3, thorvg)
- [CVE-2024-52011](https://cve.now/CVE-2024-52011.md): launch-editor vulnerable to command injection via the crafted request on Windows (CVSS 7.5, vitejs launch-editor · vitejs vite +2)
- [CVE-2026-10277](https://cve.now/CVE-2026-10277.md): j3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control (CVSS 5.3, j3k0 mcp-google-workspace)
- [CVE-2026-45810](https://cve.now/CVE-2026-45810.md): Nextcloud: Propfind requests for file comments allowed to load comments for other files (CVSS 6.8, nextcloud security-advisories)
- [CVE-2026-45722](https://cve.now/CVE-2026-45722.md): Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views (CVSS 7.1, nextcloud security-advisories)
- [CVE-2026-45691](https://cve.now/CVE-2026-45691.md): Nextcloud: Bypass of second factor authentication on DAV endpoints (CVSS 5.9, nextcloud security-advisories)
- [CVE-2026-49121](https://cve.now/CVE-2026-49121.md): AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization (CVSS 9.2, ROCm aiter)
- [CVE-2026-45690](https://cve.now/CVE-2026-45690.md): Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay (CVSS 5.9, nextcloud security-advisories)
- [CVE-2026-45545](https://cve.now/CVE-2026-45545.md): Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution (CVSS 8.2, nextcloud security-advisories)
- [CVE-2026-45544](https://cve.now/CVE-2026-45544.md): Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService (CVSS 4.3, nextcloud security-advisories)
- [CVE-2026-45543](https://cve.now/CVE-2026-45543.md): Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share (CVSS 5.3, nextcloud security-advisories)
- [CVE-2026-10276](https://cve.now/CVE-2026-10276.md): hekmon8 Jenkins-server-mcp get\_build\_status/get\_build\_log/trigger\_build index.ts jobPath server-side request forgery (CVSS 5.3, hekmon8 Jenkins-server-mcp)
- [CVE-2026-45286](https://cve.now/CVE-2026-45286.md): Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint (CVSS 4.3, nextcloud security-advisories)
- [CVE-2026-45284](https://cve.now/CVE-2026-45284.md): Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate (CVSS 4.6, nextcloud security-advisories)
- [CVE-2026-45285](https://cve.now/CVE-2026-45285.md): Nextcloud: Hidden Public Link creation when sharing to a Team External Member (CVSS 6.4, nextcloud security-advisories)
- [CVE-2026-45283](https://cve.now/CVE-2026-45283.md): Nextcloud: Files Lock app allows users to lock and unlock files of other users (CVSS 6.3, nextcloud security-advisories)
- [CVE-2026-45282](https://cve.now/CVE-2026-45282.md): Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access (CVSS 6.5, nextcloud security-advisories)
- [CVE-2026-45281](https://cve.now/CVE-2026-45281.md): Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update (CVSS 8.1, nextcloud security-advisories)
- [CVE-2026-45279](https://cve.now/CVE-2026-45279.md): Nextcloud: Limited path traversal via template API if using \`{lang}\` in config (CVSS 4.4, nextcloud security-advisories)
- [CVE-2026-45278](https://cve.now/CVE-2026-45278.md): Nextcloud: Open Redirect in user\_oidc login flow via protocol-relative URL bypass (CVSS 3.3, nextcloud security-advisories)
- [CVE-2026-45277](https://cve.now/CVE-2026-45277.md): Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations (CVSS 3.3, nextcloud security-advisories)
- [CVE-2026-45275](https://cve.now/CVE-2026-45275.md): Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers (CVSS 6.5, nextcloud security-advisories)
- [CVE-2026-10275](https://cve.now/CVE-2026-10275.md): OpenSC pkcs11-tool Key Generation pkcs11-tool.c test\_kpgen\_certwrite buffer overflow (CVSS 2.3, OpenSC)
- [CVE-2026-45267](https://cve.now/CVE-2026-45267.md): Nextcloud: Missing permission check for from submissions (CVSS 6.5, nextcloud security-advisories)
- [CVE-2026-45266](https://cve.now/CVE-2026-45266.md): Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling (CVSS 3.5, nextcloud security-advisories)
- [CVE-2026-45159](https://cve.now/CVE-2026-45159.md): Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner (CVSS 3.5, nextcloud security-advisories)
- [CVE-2026-45157](https://cve.now/CVE-2026-45157.md): Nextcloud: Valid share tokens allow to access tempory upload files of share owner (CVSS 6.3, nextcloud security-advisories)
- [CVE-2026-45156](https://cve.now/CVE-2026-45156.md): Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC (CVSS 8.1, nextcloud security-advisories)
- [CVE-2026-45155](https://cve.now/CVE-2026-45155.md): Nextcloud: Private circle can be added to another circle via API (CVSS 2.6, nextcloud security-advisories)
- [CVE-2026-45154](https://cve.now/CVE-2026-45154.md): Nextcloud: Improper Access Control in Collectives (CVSS 2.6, nextcloud security-advisories)
- [CVE-2026-45153](https://cve.now/CVE-2026-45153.md): Nextcloud: PIN bypass in PassCodeActivity via back button (CVSS 4.6, nextcloud security-advisories)
- [CVE-2026-45264](https://cve.now/CVE-2026-45264.md): Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames (CVSS 4.3, nextcloud security-advisories)
- [CVE-2026-10274](https://cve.now/CVE-2026-10274.md): indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery (CVSS 5.3, indrasishbanerjee aem-mcp-server)
- [CVE-2026-8501](https://cve.now/CVE-2026-8501.md): CVE-2026-8501 (CVSS 7.8, Symantec PC Tools Internet Security)
- [CVE-2026-46243](https://cve.now/CVE-2026-46243.md): smb: client: reject userspace cifs.spnego descriptions (CVSS 7.1, Linux)
- [CVE-2026-10273](https://cve.now/CVE-2026-10273.md): php-censor Webhook Endpoint GitBuild.php os command injection (CVSS 6.9, php-censor)
- [CVE-2026-45131](https://cve.now/CVE-2026-45131.md): CloudPirates Open Source Helm Charts: GitHub Actions pull\_request\_target workflow allows secret exfiltration via fork pull requests (CVSS 10.0, CloudPirates-io helm-charts)
- [CVE-2026-45132](https://cve.now/CVE-2026-45132.md): CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling (CVSS 10.0, CloudPirates-io helm-charts)
- [CVE-2026-45701](https://cve.now/CVE-2026-45701.md): Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens (CVSS 6.9, sulu · sulu/sulu)
- [CVE-2026-44740](https://cve.now/CVE-2026-44740.md): go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion (CVSS 6.5, go-git go-billy · github.com/go-git/go-billy/v5 +1)
- [CVE-2026-44211](https://cve.now/CVE-2026-44211.md): Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability (CVSS 9.6, cline)
- [CVE-2026-10272](https://cve.now/CVE-2026-10272.md): a4m4 Student-Management-System deleteform.php improper authorization (CVSS 6.9, a4m4 Student-Management-System)
- [CVE-2022-4991](https://cve.now/CVE-2022-4991.md): Tychon is vulnerable to privilege escalation due to OPENSSLDIR location (CVSS 7.4, Tychon)
- [CVE-2026-10271](https://cve.now/CVE-2026-10271.md): a4m4 Student-Management-System Admin Endpoint admin redirect (CVSS 5.3, a4m4 Student-Management-System)
- [CVE-2026-10118](https://cve.now/CVE-2026-10118.md): Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication (CVSS 7.8, Red Hat Enterprise Linux · Red Hat AI Inference Server +2)
- [CVE-2026-10270](https://cve.now/CVE-2026-10270.md): D-Link DI-7001 MINI API httpd\_debug.asp sprintf stack-based overflow (CVSS 8.7, D-Link DI-7001 MINI)
- [CVE-2026-42671](https://cve.now/CVE-2026-42671.md): WordPress GeoDirectory plugin \<= 2.8.157 - Broken Access Control vulnerability (CVSS 6.5, Paolo GeoDirectory)
- [CVE-2026-42672](https://cve.now/CVE-2026-42672.md): WordPress WP Directory Kit plugin \<= 1.5.1 - SQL Injection vulnerability (CVSS 9.3, WP Directory Kit)
- [CVE-2026-42673](https://cve.now/CVE-2026-42673.md): WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin \<= 3.3.6 - Sensitive Data Exposure vulnerability (CVSS 7.5, Logtivity Activity Logs Activity Logs, User Activity Tracki…)
- [CVE-2026-42674](https://cve.now/CVE-2026-42674.md): WordPress Advanced Access Manager plugin \<= 7.1.0 - Bypass Vulnerability vulnerability (CVSS 7.5, AAM Plugin Advanced Access Manager)
- [CVE-2026-42675](https://cve.now/CVE-2026-42675.md): WordPress Hydra Booking plugin \<= 1.1.41 - Broken Access Control vulnerability (CVSS 7.3, Themefic Hydra Booking)
- [CVE-2026-42676](https://cve.now/CVE-2026-42676.md): WordPress myCred plugin \<= 3.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, myCred)
- [CVE-2026-42677](https://cve.now/CVE-2026-42677.md): WordPress WP Document Revisions plugin \<= 3.8.1 - Broken Access Control vulnerability (CVSS 7.5, Ben Balter WP Document Revisions)
- [CVE-2026-10269](https://cve.now/CVE-2026-10269.md): decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization (CVSS 5.3, decolua 9router)
- [CVE-2026-42678](https://cve.now/CVE-2026-42678.md): WordPress GiveWP plugin \<= 4.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Liquid Web / StellarWP GiveWP)
- [CVE-2026-42679](https://cve.now/CVE-2026-42679.md): WordPress Classified Listing plugin \<= 5.3.8 - Arbitrary File Download vulnerability (CVSS 6.5, Mamunur Rashid Classified Listing)
- [CVE-2026-8643](https://cve.now/CVE-2026-8643.md): pip can extract console\_scripts and gui\_scripts outside installation directory (CVSS 4.1, Python Packaging Authority pip · pip)
- [CVE-2026-10268](https://cve.now/CVE-2026-10268.md): janet-lang janet marsh.c unmarshal\_one\_fiber integer overflow (CVSS 4.8, janet-lang janet)
- [CVE-2026-0826](https://cve.now/CVE-2026-0826.md): Poly Voice – Possible Remote Control of Certain Poly Devices (CVSS 9.2, HP poly\_trio\_8300 · HP poly\_trio\_8500 +2)
- [CVE-2026-42680](https://cve.now/CVE-2026-42680.md): WordPress Contest Gallery Pro plugin \<= 29.0.1 - Privilege Escalation vulnerability (CVSS 9.8, Wasiliy Strecker / ContestGallery developer Contest Gallery…)
- [CVE-2026-42681](https://cve.now/CVE-2026-42681.md): WordPress e2pdf plugin \<= 1.32.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, E2Pdf.com e2pdf)
- [CVE-2026-42682](https://cve.now/CVE-2026-42682.md): WordPress wpForo Forum plugin \<= 3.0.6 - Broken Access Control vulnerability (CVSS 9.1, Tomdever wpForo Forum)
- [CVE-2026-10267](https://cve.now/CVE-2026-10267.md): janet-lang janet debug.c doframe out-of-bounds (CVSS 4.8, janet-lang janet)
- [CVE-2026-42683](https://cve.now/CVE-2026-42683.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-48839](https://cve.now/CVE-2026-48839.md): WordPress WP Statistics plugin \<= 14.16.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VeronaLabs WP Statistics)
- [CVE-2026-48865](https://cve.now/CVE-2026-48865.md): WordPress LearnPress plugin \<= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThimPress LearnPress)
- [CVE-2026-48866](https://cve.now/CVE-2026-48866.md): WordPress Gravity Forms plugin \<= 2.10.0.1 - Arbitrary File Deletion vulnerability (CVSS 9.6, Rocketgenius Gravity Forms)
- [CVE-2026-48879](https://cve.now/CVE-2026-48879.md): WordPress AIWU plugin \<= 1.4.17 - Privilege Escalation vulnerability (CVSS 9.8, Sergey AIWU)
- [CVE-2026-8931](https://cve.now/CVE-2026-8931.md): Critical RCE vulnerability in Disig Web Signer (CVSS 9.4, Disig Web Signer)
- [CVE-2026-10265](https://cve.now/CVE-2026-10265.md): itsourcecode Content Management System edit\_topic.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10264](https://cve.now/CVE-2026-10264.md): lharries whatsapp-mcp Send API Endpoint main.go SendMessageRequest path traversal (CVSS 5.1, lharries whatsapp-mcp)
- [CVE-2026-10263](https://cve.now/CVE-2026-10263.md): SourceCodester Computer Repair Shop Management System manage\_product.php sql injection (CVSS 6.9, SourceCodester Computer Repair Shop Management System)
- [CVE-2026-10262](https://cve.now/CVE-2026-10262.md): code-projects Real State Services Login loginuser.php sql injection (CVSS 6.9, code-projects Real State Services)
- [CVE-2026-10261](https://cve.now/CVE-2026-10261.md): CodeAstro Online Job Portal application\_status.php sql injection (CVSS 6.9, CodeAstro Online Job Portal)
- [CVE-2026-42251](https://cve.now/CVE-2026-42251.md): Hard-coded credentials in KS-SOMED (CVSS 8.7, KAMSOFT KS-SOMED)
- [CVE-2026-10533](https://cve.now/CVE-2026-10533.md): Openshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradation (CVSS 5.0, Red Hat OpenShift Container Platform)
- [CVE-2024-40646](https://cve.now/CVE-2024-40646.md): Vertex Vulnerable to Path Traversal (CVSS 8.6, vertex-app vertex)
- [CVE-2026-48559](https://cve.now/CVE-2026-48559.md): Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags (CVSS 5.1, epoupon lms)
- [CVE-2026-10260](https://cve.now/CVE-2026-10260.md): CodeAstro Online Job Portal delete-jobs.php sql injection (CVSS 6.9, CodeAstro Online Job Portal)
- [CVE-2026-10259](https://cve.now/CVE-2026-10259.md): H3C Magic B0 aspForm SetMobileAPInfoById stack-based overflow (CVSS 8.7, H3C Magic B0)
- [CVE-2026-10258](https://cve.now/CVE-2026-10258.md): itsourcecode Content Management System add\_sub\_topic.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10257](https://cve.now/CVE-2026-10257.md): itsourcecode Content Management System update\_ss\_img.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10256](https://cve.now/CVE-2026-10256.md): itsourcecode Content Management System save\_comment.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-10255](https://cve.now/CVE-2026-10255.md): SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell\_statement access control (CVSS 6.9, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-10254](https://cve.now/CVE-2026-10254.md): SourceCodester Pet Grooming Management Software admin file information disclosure (CVSS 6.9, SourceCodester Pet Grooming Management Software)
- [CVE-2026-10532](https://cve.now/CVE-2026-10532.md): Logback deserialization whitelist bypass for Proxy objects (CVSS 2.9, QOS.CH Sarl logback · ch.qos.logback:logback-core)
- [CVE-2026-10253](https://cve.now/CVE-2026-10253.md): itsourcecode Online House Rental System manage\_payment.php sql injection (CVSS 6.9, itsourcecode Online House Rental System)
- [CVE-2026-9309](https://cve.now/CVE-2026-9309.md): Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2026-9308](https://cve.now/CVE-2026-9308.md): Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2026-10252](https://cve.now/CVE-2026-10252.md): itsourcecode Online House Rental System manage\_tenant.php sql injection (CVSS 6.9, itsourcecode Online House Rental System)
- [CVE-2026-34193](https://cve.now/CVE-2026-34193.md): GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw\_to\_ptr() (CVSS 4.3, Imagination Technologies Graphics DDK)
- [CVE-2026-10251](https://cve.now/CVE-2026-10251.md): itsourcecode Online House Rental System ajax.php login sql injection (CVSS 6.9, itsourcecode Online House Rental System)
- [CVE-2026-10250](https://cve.now/CVE-2026-10250.md): itsourcecode Online Blood Bank Management System campsdetails.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2026-10249](https://cve.now/CVE-2026-10249.md): itsourcecode Online Blood Bank Management System viewrequest.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2026-10248](https://cve.now/CVE-2026-10248.md): SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create\_supplier csv injection (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-49328](https://cve.now/CVE-2026-49328.md): Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF (CVSS 5.3, Apache Software Foundation Apache Fesod · org.apache.fesod:…)
- [CVE-2026-10247](https://cve.now/CVE-2026-10247.md): SourceCodester Pharmacy Sales and Inventory System main create\_generic\_name cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-10246](https://cve.now/CVE-2026-10246.md): SourceCodester Pharmacy Sales and Inventory System main create\_medicine\_presentation cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-25600](https://cve.now/CVE-2026-25600.md): Credential Exposure Vulnerability in Trac PDBM (CVSS 6.4, Trac d.o.o. PDBM)
- [CVE-2026-10245](https://cve.now/CVE-2026-10245.md): SourceCodester Pharmacy Sales and Inventory System main create\_supplier cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-25599](https://cve.now/CVE-2026-25599.md): Missing authentication and clear‑text data transmission affecting Orca heat pumps (CVSS 6.3, Orca Energy Orca heat pump · Orca Energy Orca user portal)
- [CVE-2026-10244](https://cve.now/CVE-2026-10244.md): SourceCodester Pharmacy Sales and Inventory System main create\_medicine\_name cross site scripting (CVSS 5.1, SourceCodester Pharmacy Sales and Inventory System)
- [CVE-2026-40549](https://cve.now/CVE-2026-40549.md): Cross-Site Request Forgery in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2026-40548](https://cve.now/CVE-2026-40548.md): Unrestricted Upload of File with Dangerous Type in SOPlanning (CVSS 6.4, SOPlanning)
- [CVE-2026-40547](https://cve.now/CVE-2026-40547.md): Path Traversal in SOPlanning (CVSS 6.4, SOPlanning)
- [CVE-2026-40546](https://cve.now/CVE-2026-40546.md): Multiple SQL Injections in SOPlanning (CVSS 8.7, SOPlanning)
- [CVE-2026-40545](https://cve.now/CVE-2026-40545.md): Reflected XSS in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2026-40544](https://cve.now/CVE-2026-40544.md): Stored XSS in SOPlanning (CVSS 5.1, SOPlanning)
- [CVE-2026-40543](https://cve.now/CVE-2026-40543.md): Missing Authorization in SOPlanning (CVSS 8.8, SOPlanning)
- [CVE-2026-10243](https://cve.now/CVE-2026-10243.md): code-projects Smart Parking System Admin Endpoint missing authentication (CVSS 6.9, code-projects Smart Parking System)
- [CVE-2026-10242](https://cve.now/CVE-2026-10242.md): itsourcecode Content Management System instructions.php sql injection (CVSS 5.3, itsourcecode Content Management System)
- [CVE-2026-48827](https://cve.now/CVE-2026-48827.md): Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git (CVSS 7.1, Apache Software Foundation Apache MINA SSHD · org.apache.ss…)
- [CVE-2026-10241](https://cve.now/CVE-2026-10241.md): jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery (CVSS 5.3, jeecgboot The server processes these URLs)
- [CVE-2026-9024](https://cve.now/CVE-2026-9024.md): Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x (CVSS 8.7, Dassault Systèmes DELMIA Service Process Engineer)
- [CVE-2026-10240](https://cve.now/CVE-2026-10240.md): JeecgBoot test server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-44825](https://cve.now/CVE-2026-44825.md): Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users (CVSS 8.1, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2026-10239](https://cve.now/CVE-2026-10239.md): JeecgBoot edit WordUtil.addImage server-side request forgery (CVSS 5.3, JeecgBoot)
- [CVE-2026-49361](https://cve.now/CVE-2026-49361.md): Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability (CVSS 7.5, Apache Software Foundation Apache Fluss · org.apache.fluss:…)
- [CVE-2026-40861](https://cve.now/CVE-2026-40861.md): Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-40961](https://cve.now/CVE-2026-40961.md): Apache Airflow: Open Redirect Bypass Vulnerability (CVSS 7.2, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-40963](https://cve.now/CVE-2026-40963.md): Apache Airflow: DAG authorization bypass on /ui/structure/structure\_data (CVSS 3.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-41014](https://cve.now/CVE-2026-41014.md): Apache Airflow: per-DAG RBAC bypass on /ui/partitioned\_dag\_runs endpoints (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-49267](https://cve.now/CVE-2026-49267.md): Apache Airflow: No certificate validation on SMTP STARTTLS connections (CVSS 5.9, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-41017](https://cve.now/CVE-2026-41017.md): Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy (CVSS 5.9, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-41084](https://cve.now/CVE-2026-41084.md): Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-42252](https://cve.now/CVE-2026-42252.md): Apache Airflow: BashOperator Jinja2 injection via dag\_run.conf — low-privilege user pattern (CVSS 9.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-42360](https://cve.now/CVE-2026-42360.md): Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-42358](https://cve.now/CVE-2026-42358.md): Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-42359](https://cve.now/CVE-2026-42359.md): Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN\_XCOM\_KEYS validator (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-45360](https://cve.now/CVE-2026-45360.md): Apache Airflow: Arbitrary import in custom deadline-reference deserialization (CVSS 7.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-8474](https://cve.now/CVE-2026-8474.md): Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances. (CVSS 5.3, StormShield Network Security)
- [CVE-2026-45426](https://cve.now/CVE-2026-45426.md): Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access (CVSS 3.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-46764](https://cve.now/CVE-2026-46764.md): Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-7858](https://cve.now/CVE-2026-7858.md): Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x (CVSS 9.8, Dassault Systèmes Teamwork Cloud - Standard Edition · Da… +3)
- [CVE-2026-10237](https://cve.now/CVE-2026-10237.md): SourceCodester Water Billing Management System User Management manage\_user sql injection (CVSS 5.1, SourceCodester Water Billing Management System)
- [CVE-2026-48726](https://cve.now/CVE-2026-48726.md): Apache Airflow: revoke\_token() unreachable in FabAuthManager / KeycloakAuthManager logout path (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-49298](https://cve.now/CVE-2026-49298.md): Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow-…)
- [CVE-2026-10236](https://cve.now/CVE-2026-10236.md): SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization (CVSS 6.9, SourceCodester Water Billing Management System)
- [CVE-2026-42253](https://cve.now/CVE-2026-42253.md): Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties (CVSS 6.1, Apache Software Foundation Apache ActiveMQ · org.apache.… +1)
- [CVE-2026-42588](https://cve.now/CVE-2026-42588.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector (CVSS 8.1, Apache Software Foundation Apache ActiveMQ Broker · Apac… +4)
- [CVE-2026-45505](https://cve.now/CVE-2026-45505.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Jolokia \`addNetworkConnector\` Discovery Wrapper Bypass (CVSS 8.8, Apache Software Foundation Apache ActiveMQ Broker · Apac… +4)
- [CVE-2026-46605](https://cve.now/CVE-2026-46605.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal (CVSS 4.3, Apache Software Foundation Apache ActiveMQ Broker · Apac… +2)
- [CVE-2026-49157](https://cve.now/CVE-2026-49157.md): Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default (CVSS 8.8, Apache Software Foundation Apache ActiveMQ · org.apache.act…)
- [CVE-2026-49270](https://cve.now/CVE-2026-49270.md): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) (CVSS 5.9, Apache Software Foundation Apache ActiveMQ Broker · Apac… +3)
- [CVE-2026-32325](https://cve.now/CVE-2026-32325.md): Privilege chaining issue exists in ServerView Agents for Windows V11.60.04 and earlier. (CVSS 7.8, Fsas Technologies ServerView Agents for Windows)
- [CVE-2026-27788](https://cve.now/CVE-2026-27788.md): Incorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. (CVSS 7.8, Fsas Technologies ServerView Agents for Windows)
- [CVE-2026-10235](https://cve.now/CVE-2026-10235.md): CodeAstro Ingredients Stock Management System stock\_manager.php sql injection (CVSS 5.3, CodeAstro Ingredients Stock Management System)
- [CVE-2026-35563](https://cve.now/CVE-2026-35563.md): Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname (CVSS 8.8, Apache Software Foundation Apache Directory LDAP API · org.…)
- [CVE-2026-10234](https://cve.now/CVE-2026-10234.md): Mettle sendportal Campaign webview cross site scripting (CVSS 5.1, Mettle sendportal)
- [CVE-2026-45192](https://cve.now/CVE-2026-45192.md): Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-10233](https://cve.now/CVE-2026-10233.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read\_sequence\_infos out-of-bounds (CVSS 4.8, Assimp)
- [CVE-2026-10232](https://cve.now/CVE-2026-10232.md): Assimp ASE File scene.cpp ~aiNode use after free (CVSS 4.8, Assimp)
- [CVE-2026-10231](https://cve.now/CVE-2026-10231.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract\_anim\_value heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10230](https://cve.now/CVE-2026-10230.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read\_animations heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10229](https://cve.now/CVE-2026-10229.md): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read\_meshes heap-based overflow (CVSS 4.8, Assimp)
- [CVE-2026-10228](https://cve.now/CVE-2026-10228.md): raisulislamg4 student\_management\_system\_by\_php admission\_form\_check.php cross site scripting (CVSS 5.1, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10227](https://cve.now/CVE-2026-10227.md): raisulislamg4 student\_management\_system\_by\_php User Creation add\_user\_check.php sql injection (CVSS 6.9, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10226](https://cve.now/CVE-2026-10226.md): raisulislamg4 student\_management\_system\_by\_php delete.php sql injection (CVSS 6.9, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10225](https://cve.now/CVE-2026-10225.md): raisulislamg4 student\_management\_system\_by\_php Login login\_check.php sql injection (CVSS 6.9, raisulislamg4 student\_management\_system\_by\_php)
- [CVE-2026-10224](https://cve.now/CVE-2026-10224.md): NousResearch hermes-agent Webhook Endpoint feishu.py \_handle\_webhook\_request resource consumption (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-10223](https://cve.now/CVE-2026-10223.md): NousResearch hermes-agent memory\_tool.py \_scan\_memory\_content injection (CVSS 5.3, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-10222](https://cve.now/CVE-2026-10222.md): NousResearch hermes-agent config.py \_sanitize\_env\_lines injection (CVSS 6.3, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-10221](https://cve.now/CVE-2026-10221.md): NousResearch hermes-agent run\_agent.py \_compress\_context injection (CVSS 6.9, NousResearch hermes-agent · hermes-agent)
- [CVE-2026-48187](https://cve.now/CVE-2026-48187.md): Email with special content can lead to DoS (CVSS 5.7, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-48188](https://cve.now/CVE-2026-48188.md): SQL Injection via MySQL Quote Method (CVSS 9.1, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-48189](https://cve.now/CVE-2026-48189.md): Bypass DedicatedAgentToCustomerGroups Setting (CVSS 5.7, OTRS AG OTRS)
- [CVE-2026-48190](https://cve.now/CVE-2026-48190.md): Incorrect handling of permissions in External Interface Config Item List module (CVSS 3.5, OTRS AG OTRS)
- [CVE-2026-48191](https://cve.now/CVE-2026-48191.md): Wrong Permission Handling in Document Search Article Meta Filters (CVSS 3.5, OTRS AG OTRS)
- [CVE-2026-48208](https://cve.now/CVE-2026-48208.md): Denial-of-Service via SVG Rendering in Ticket (CVSS 6.5, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-48209](https://cve.now/CVE-2026-48209.md): Reflected XSS in authenticated agent context (CVSS 7.1, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2026-10220](https://cve.now/CVE-2026-10220.md): NousResearch hermes-agent skills\_tool.py skill\_view injection (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-20456](https://cve.now/CVE-2026-20456.md): In wlan STA driver, there is a possible system crash due to a missing bounds check. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20455](https://cve.now/CVE-2026-20455.md): In geniezone, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek chipset)
- [CVE-2026-20454](https://cve.now/CVE-2026-20454.md): In geniezone, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek chipset)
- [CVE-2026-20453](https://cve.now/CVE-2026-20453.md): In geniezone, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20452](https://cve.now/CVE-2026-20452.md): In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow. (CVSS 8.0, MediaTek chipset)
- [CVE-2026-10219](https://cve.now/CVE-2026-10219.md): nextlevelbuilder GoClaw write\_file Tool fsbridge.go FsBridge.WriteFile os command injection (CVSS 6.9, nextlevelbuilder GoClaw · github.com/nextlevelbuilder/goclaw)
- [CVE-2026-10218](https://cve.now/CVE-2026-10218.md): nextlevelbuilder GoClaw evolution\_handlers.go auth improper authorization (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-10217](https://cve.now/CVE-2026-10217.md): nextlevelbuilder GoClaw RoleAdmin Gateway tts\_config.go handleSave privileges management (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-10216](https://cve.now/CVE-2026-10216.md): unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication (CVSS 6.3, unitedbyai droidclaw)
- [CVE-2026-10215](https://cve.now/CVE-2026-10215.md): Dolibarr ERP CRM Leave Request REST API api\_holidays.class.php checkUserAccessToObject improper authorization (CVSS 5.3, Dolibarr ERP CRM · dolibarr/dolibarr)
- [CVE-2026-10214](https://cve.now/CVE-2026-10214.md): zhayujie chatgpt-on-wechat Bash Tool bash.py \_get\_safety\_warning os command injection (CVSS 6.9, zhayujie chatgpt-on-wechat)
- [CVE-2026-10213](https://cve.now/CVE-2026-10213.md): AstrBotDevs AstrBot API Endpoint delete path traversal (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-10212](https://cve.now/CVE-2026-10212.md): AstrBotDevs AstrBot astr\_main\_agent.py astr\_main\_agent authorization (CVSS 5.3, AstrBotDevs AstrBot · astrbot)
- [CVE-2026-10211](https://cve.now/CVE-2026-10211.md): AstrBotDevs AstrBot fs.py \_normalize\_rw\_path authorization (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-10210](https://cve.now/CVE-2026-10210.md): AstrBotDevs AstrBot skill\_manager.py \_sanitize\_prompt\_description injection (CVSS 5.3, AstrBotDevs AstrBot)
- [CVE-2026-10209](https://cve.now/CVE-2026-10209.md): code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection (CVSS 5.3, code-projects Online Hospital Management System)
- [CVE-2026-10208](https://cve.now/CVE-2026-10208.md): code-projects Online Hospital Management System login\_1.php login\_user sql injection (CVSS 6.9, code-projects Online Hospital Management System)
- [CVE-2026-10206](https://cve.now/CVE-2026-10206.md): D-Link DI-8400 dbsrv.asp stack-based overflow (CVSS 8.7, D-Link DI-8400)
- [CVE-2026-10205](https://cve.now/CVE-2026-10205.md): Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload (CVSS 5.3, Metasoft 美特软件 MetaCRM)
- [CVE-2025-55664](https://cve.now/CVE-2025-55664.md): A heap buffer overflow in the m2tsdmx\_send\_packet function (filters/dmx\_m2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Se (CVSS 5.5)
- [CVE-2025-60481](https://cve.now/CVE-2025-60481.md): A NULL pointer dereference in the gf\_odf\_ac4\_cfg\_dsi\_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers (CVSS 5.5)
- [CVE-2025-60483](https://cve.now/CVE-2025-60483.md): A NULL pointer dereference in the gf\_ac4\_pres\_b\_4\_back\_channels\_present function (/media\_tools/av\_parsers.c) of GPAC Project/MP4Box before 2 (CVSS 5.5)
- [CVE-2025-60485](https://cve.now/CVE-2025-60485.md): A segmentation violation in the gf\_isom\_apple\_set\_tag\_ex function (/isomedia/isom\_write.c) of GPAC Project/MP4Box before 26.02.0 allows atta (CVSS 5.5)
- [CVE-2025-60486](https://cve.now/CVE-2025-60486.md): A heap use-after-free in the dasher\_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a D (CVSS 5.5)
- [CVE-2025-60495](https://cve.now/CVE-2025-60495.md): A segmentation violation in the gf\_media\_get\_color\_info function (/media\_tools/isom\_tools.c) of GPAC Project/MP4Box before 26.02.0 allows at (CVSS 5.5)
- [CVE-2025-70099](https://cve.now/CVE-2025-70099.md): A NULL pointer dereference in the ext4\_dir\_en\_get\_name\_len function in include/ext4\_dir.h of lwext4 1.0.0 allows attackers to cause a denial (CVSS 7.5)
- [CVE-2026-37220](https://cve.now/CVE-2026-37220.md): FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2\_SETUP\_REQUEST is sent. (CVSS 7.5)
- [CVE-2026-37221](https://cve.now/CVE-2026-37221.md): FlexRIC v2.0.0 crashes when receiving a RIC\_SUBSCRIPTION\_RESPONSE with an unknown ric\_id that has no corresponding pending event. (CVSS 7.5)
- [CVE-2026-37222](https://cve.now/CVE-2026-37222.md): FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. (CVSS 7.5)
- [CVE-2026-37223](https://cve.now/CVE-2026-37223.md): FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. (CVSS 7.5)
- [CVE-2026-37224](https://cve.now/CVE-2026-37224.md): FlexRIC v2.0.0 crashes when receiving a duplicate E2\_SETUP\_REQUEST from the same or spoofed E2 Node. (CVSS 7.5)
- [CVE-2026-37225](https://cve.now/CVE-2026-37225.md): FlexRIC v2.0.0 crashes when the iApp receives an E42\_RIC\_SUBSCRIPTION\_REQUEST with an empty ricEventTriggerDefinition field. (CVSS 7.5)
- [CVE-2026-37226](https://cve.now/CVE-2026-37226.md): FlexRIC v2.0.0 crashes when the iApp receives an E42\_RIC\_SUBSCRIPTION\_REQUEST referencing a non-existent E2 Node. (CVSS 7.5)
- [CVE-2026-37227](https://cve.now/CVE-2026-37227.md): FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near- (CVSS 7.5)
- [CVE-2026-37228](https://cve.now/CVE-2026-37228.md): FlexRIC v2.0.0 contains a reachable assertion in e2ap\_recv\_sctp\_msg() (src/lib/ep/e2ap\_ep.c). (CVSS 7.5)
- [CVE-2026-37229](https://cve.now/CVE-2026-37229.md): FlexRIC v2.0.0 contains a reachable assertion in e2ap\_create\_pdu() triggered when ASN.1 PER decoding fails. (CVSS 7.5)
- [CVE-2026-37230](https://cve.now/CVE-2026-37230.md): FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC\_INDICATION message with a ran\_func\_id that does not exist in its registry. (CVSS 7.5)
- [CVE-2026-37231](https://cve.now/CVE-2026-37231.md): FlexRIC v2.0.0 uses a uint16\_t counter for xapp\_id assignment but stores the value in uint32\_t message fields. (CVSS 7.5)
- [CVE-2026-37232](https://cve.now/CVE-2026-37232.md): An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. (CVSS 8.6)
- [CVE-2026-37233](https://cve.now/CVE-2026-37233.md): FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. (CVSS 7.5)
- [CVE-2026-37234](https://cve.now/CVE-2026-37234.md): FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp\_ids by sending multiple E42\_SETUP\_REQUESTs. (CVSS 8.2)
- [CVE-2026-37235](https://cve.now/CVE-2026-37235.md): FlexRIC v2.0.0 trusts the xapp\_id field from E42 message payloads without binding it to the sender's SCTP association. (CVSS 7.5)
- [CVE-2026-38950](https://cve.now/CVE-2026-38950.md): An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.