# CVEs published 2026-06-02

224 CVEs were published on June 2, 2026: 14 critical, 82 high. Days are UTC.

- [CVE-2026-10692](https://cve.now/CVE-2026-10692.md): johnhuang316 code-index-mcp search\_code\_advanced is\_safe\_regex\_pattern redos (CVSS 5.3, johnhuang316 code-index-mcp · code-index-mcp)
- [CVE-2026-10691](https://cve.now/CVE-2026-10691.md): wonderwhy-er DesktopCommanderMCP start\_search search-manager.ts redos (CVSS 5.3, wonderwhy-er DesktopCommanderMCP · @wonderwhy-er/desktop-co…)
- [CVE-2026-9732](https://cve.now/CVE-2026-9732.md): EmergencyWP \<= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, planetshaker EmergencyWP – Dead Man's switch & legacy deliv…)
- [CVE-2026-7421](https://cve.now/CVE-2026-7421.md): Passeum Ticketing \<= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop\_name' Setting (CVSS 4.4, Passeum Ticketing)
- [CVE-2026-10690](https://cve.now/CVE-2026-10690.md): wonderwhy-er DesktopCommanderMCP read\_file filesystem.ts readFileFromUrl server-side request forgery (CVSS 5.3, wonderwhy-er DesktopCommanderMCP · @wonderwhy-er/desktop-co…)
- [CVE-2026-40108](https://cve.now/CVE-2026-40108.md): GLPI Vulnerable to Stored XSS in ITIL Costs (CVSS 7.1, glpi-project glpi)
- [CVE-2026-41412](https://cve.now/CVE-2026-41412.md): alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script (CVSS 4.9, alfio-event alf.io)
- [CVE-2026-35482](https://cve.now/CVE-2026-35482.md): alf.io has an Authenticated RCE via Extension Script Sandbox Escape (CVSS 8.0, alfio-event alf.io)
- [CVE-2026-44654](https://cve.now/CVE-2026-44654.md): LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents (CVSS 5.7, danny-avila LibreChat)
- [CVE-2026-10688](https://cve.now/CVE-2026-10688.md): ahujasid blender-mcp server.py execute\_blender\_code code injection (CVSS 5.1, ahujasid blender-mcp)
- [CVE-2026-44653](https://cve.now/CVE-2026-44653.md): LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets (CVSS 6.5, danny-avila LibreChat)
- [CVE-2026-32625](https://cve.now/CVE-2026-32625.md): LibreChat Exfiltrates Server Secrets via MCP Server URL Injection (CVSS 9.6, danny-avila LibreChat)
- [CVE-2026-10719](https://cve.now/CVE-2026-10719.md): Open Seachest/Seachest NVMe show Format Descriptors Vulnerability (CVSS 1.8, openSeaChest)
- [CVE-2026-31942](https://cve.now/CVE-2026-31942.md): LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys (CVSS 7.1, danny-avila LibreChat)
- [CVE-2026-10718](https://cve.now/CVE-2026-10718.md): Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability (CVSS 4.6, openSeaChest)
- [CVE-2026-25861](https://cve.now/CVE-2026-25861.md): QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php (CVSS 8.2, QloApps)
- [CVE-2026-10717](https://cve.now/CVE-2026-10717.md): Open-Seachest/Seachest show SCSI Defect List Vulnerability (CVSS 1.8, openSeaChest)
- [CVE-2026-42507](https://cve.now/CVE-2026-42507.md): Arbitrary inputs are included in errors without any escaping in net/textproto (CVSS 5.3, Go standard library net/textproto · stdlib)
- [CVE-2026-42504](https://cve.now/CVE-2026-42504.md): Quadratic complexity in WordDecoder.DecodeHeader in mime (CVSS 7.5, Go standard library mime)
- [CVE-2026-27145](https://cve.now/CVE-2026-27145.md): Inefficient candidate hostname parsing in crypto/x509 (CVSS 6.5, Go standard library crypto/x509 · stdlib)
- [CVE-2026-10662](https://cve.now/CVE-2026-10662.md): ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery (CVSS 5.3, ahujasid blender-mcp)
- [CVE-2021-4481](https://cve.now/CVE-2021-4481.md): Dräger Protector Software Local Privilege Escalation via Insecure File Permissions (CVSS 8.3, Dräger Protector Software)
- [CVE-2021-4480](https://cve.now/CVE-2021-4480.md): Dräger Protector Software Local Privilege Escalation via Insecure File Permissions (CVSS 8.3, Dräger Protector Software)
- [CVE-2026-10661](https://cve.now/CVE-2026-10661.md): ahujasid blender-mcp server.py open injection (CVSS 5.3, ahujasid blender-mcp)
- [CVE-2026-35212](https://cve.now/CVE-2026-35212.md): OpenCTI has XSS in the rendering of email-message observable body data (CVSS 5.3, OpenCTI-Platform opencti · pycti)
- [CVE-2025-15653](https://cve.now/CVE-2025-15653.md): Dräger Zeus IE Anesthesia Workstation USB Interface Privilege Escalation (CVSS 7.0, Dräger Zeus IE · Dräger Zeus RS C500)
- [CVE-2024-14036](https://cve.now/CVE-2024-14036.md): Dräger Core 1.0.5 Denial of Service via Malformed SDC Message (CVSS 8.7, Dräger Core · Dräger M540 Converter Service)
- [CVE-2026-10650](https://cve.now/CVE-2026-10650.md): warmcat libwebsockets SSH Protocol sshd.c lws\_ssh\_parse\_plaintext resource consumption (CVSS 6.9, warmcat libwebsockets)
- [CVE-2026-8936](https://cve.now/CVE-2026-8936.md): Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM (CVSS 8.2, Docker Desktop)
- [CVE-2022-4992](https://cve.now/CVE-2022-4992.md): Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering (CVSS 8.8, Dräger Infinity Acute Care System · Dräger Standalone Infin…)
- [CVE-2026-45289](https://cve.now/CVE-2026-45289.md): CloudburstMC Protocol: Partially missing validation for FULL type authentication tokens (CVSS 5.3, CloudburstMC Protocol)
- [CVE-2026-49144](https://cve.now/CVE-2026-49144.md): BrowserStack Runner 0.9.5 Path Traversal via \_default HTTP Handler (CVSS 7.1, browserstack-runner)
- [CVE-2026-49448](https://cve.now/CVE-2026-49448.md): authentik: SourceStage bypass via empty POST (CVSS 9.8, goauthentik authentik)
- [CVE-2026-49143](https://cve.now/CVE-2026-49143.md): BrowserStack Runner 0.9.5 Unauthenticated RCE via /\_log HTTP Handler (CVSS 8.7, browserstack-runner)
- [CVE-2026-49443](https://cve.now/CVE-2026-49443.md): authentik: \`UserSourceConnection.user\` and \`GroupSourceConnection.group\` are changeable through the API (CVSS 8.8, goauthentik authentik)
- [CVE-2026-47201](https://cve.now/CVE-2026-47201.md): authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user (CVSS 8.5, goauthentik authentik · goauthentik.io)
- [CVE-2026-42849](https://cve.now/CVE-2026-42849.md): authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover (CVSS 9.3, goauthentik authentik)
- [CVE-2026-41569](https://cve.now/CVE-2026-41569.md): authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints (CVSS 6.9, goauthentik authentik)
- [CVE-2026-10624](https://cve.now/CVE-2026-10624.md): SourceCodester Human Resource Management Employee View detailview.php resource injection (CVSS 5.3, SourceCodester Human Resource Management)
- [CVE-2026-10620](https://cve.now/CVE-2026-10620.md): code-projects Student Admission System index.php sql injection (CVSS 6.9, code-projects Student Admission System)
- [CVE-2026-10619](https://cve.now/CVE-2026-10619.md): sayan365 student-management-system improper authentication (CVSS 6.9, sayan365 student-management-system)
- [CVE-2026-28299](https://cve.now/CVE-2026-28299.md): SolarWinds Web Help Desk Denial-of-Service Vulnerability (CVSS 8.2, SolarWinds Web Help Desk)
- [CVE-2021-4479](https://cve.now/CVE-2021-4479.md): Dräger Atlan A350 1.00 \<= 1.01 DoS via Medibus Interface (CVSS 6.3, Dräger Atlan A350)
- [CVE-2021-4478](https://cve.now/CVE-2021-4478.md): Dräger CC-Vision Basic and CC-Vision E-Cal Out-of-Bounds Write via Malicious GDT File (CVSS 8.3, Dräger CC-Vision Basic · Dräger CC-Vision E-Cal)
- [CVE-2019-25724](https://cve.now/CVE-2019-25724.md): Dräger Infinity M300 VG2.x Network-Based Denial of Service (CVSS 7.1, Dräger Infinity M300)
- [CVE-2026-48596](https://cve.now/CVE-2026-48596.md): CRLF injection in Tesla.Multipart.add\_content\_type\_param/2 allows HTTP header injection (CVSS 2.1, elixir-tesla tesla · tesla)
- [CVE-2026-48594](https://cve.now/CVE-2026-48594.md): Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression (CVSS 8.2, elixir-tesla tesla · tesla)
- [CVE-2026-48595](https://cve.now/CVE-2026-48595.md): Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects (CVSS 8.2, elixir-tesla tesla · tesla)
- [CVE-2026-48597](https://cve.now/CVE-2026-48597.md): Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint (CVSS 8.2, elixir-tesla tesla · tesla)
- [CVE-2026-48598](https://cve.now/CVE-2026-48598.md): CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection (CVSS 2.1, elixir-tesla tesla · tesla)
- [CVE-2026-10584](https://cve.now/CVE-2026-10584.md): HTTPS Fallback to HTTP in Graph Explorer (CVSS 5.9, AWS Graph Explorer)
- [CVE-2026-35202](https://cve.now/CVE-2026-35202.md): Pterodactyl has a database resource limit bypass via race condition in Client API (CVSS 2.3, pterodactyl panel · pterodactyl/panel)
- [CVE-2019-25723](https://cve.now/CVE-2019-25723.md): Dräger Perseus A500 2.00-2.02 DoS via Medibus Interface (CVSS 6.3, Dräger Perseus A500)
- [CVE-2026-10617](https://cve.now/CVE-2026-10617.md): nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication (CVSS 6.9, nextlevelbuilder GoClaw)
- [CVE-2019-25722](https://cve.now/CVE-2019-25722.md): Dräger SC Monitoring Devices Hard-coded Credentials and DoS (CVSS 7.2, Dräger SC 6002XL · Dräger SC6802XL +3)
- [CVE-2026-35049](https://cve.now/CVE-2026-35049.md): wire-ios has Persistent Remote DoS via Integer Underflow (CVSS 6.5, wireapp wire-ios)
- [CVE-2026-47265](https://cve.now/CVE-2026-47265.md): AIOHTTP vulnerable to cross-origin redirect with per-request cookies (CVSS 6.6, aio-libs aiohttp · aiohttp)
- [CVE-2026-5385](https://cve.now/CVE-2026-5385.md): GLPI 11.0.0 - Stored XSS in knowledge base (CVSS 8.4, glpi-project glpi)
- [CVE-2026-5073](https://cve.now/CVE-2026-5073.md): ARMember Premium \<= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter (CVSS 7.5, ARMember Premium – Membership Plugin, Content Restriction,…)
- [CVE-2026-5074](https://cve.now/CVE-2026-5074.md): ARMember Premium \<= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir\_0' Parameter (CVSS 6.5, ARMember Premium – Membership Plugin, Content Restriction,…)
- [CVE-2026-5076](https://cve.now/CVE-2026-5076.md): ARMember Premium \<= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation (CVSS 9.8, ARMember Premium – Membership Plugin, Content Restriction,…)
- [CVE-2026-10616](https://cve.now/CVE-2026-10616.md): nextlevelbuilder GoClaw Team Task Completion team\_tasks\_lifecycle.go TeamTasksTool.executeComplete authorization (CVSS 5.3, nextlevelbuilder GoClaw)
- [CVE-2026-34993](https://cve.now/CVE-2026-34993.md): AIOHTTP Vulnerable to Deserialization of Untrusted Data (CVSS 6.4, aio-libs aiohttp · aiohttp)
- [CVE-2026-42342](https://cve.now/CVE-2026-42342.md): React Router vulnerable to DoS via unbounded path expansion in \_\_manifest endpoint (CVSS 7.5, remix-run react-router · @remix-run/server-runtime +1)
- [CVE-2025-64390](https://cve.now/CVE-2025-64390.md): A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. (CVSS 7.4, Sony PS4)
- [CVE-2026-42211](https://cve.now/CVE-2026-42211.md): React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE\_ERROR deserialization leading to Unauth RCE (CVSS 8.1, remix-run react-router · react-router)
- [CVE-2026-49120](https://cve.now/CVE-2026-49120.md): Medplum \< 5.1.14 SSRF via FHIR Subscription Endpoint (CVSS 6.3, medplum)
- [CVE-2026-10608](https://cve.now/CVE-2026-10608.md): DedeCMS carbuyaction.php RemoveXSS sql injection (CVSS 6.9, DedeCMS)
- [CVE-2026-40181](https://cve.now/CVE-2026-40181.md): React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation (CVSS 6.6, remix-run react-router · @remix-run/router +1)
- [CVE-2026-10607](https://cve.now/CVE-2026-10607.md): DedeCMS flink.php dede\_htmlspecialchars sql injection (CVSS 6.9, DedeCMS)
- [CVE-2026-34077](https://cve.now/CVE-2026-34077.md): React Router vulnerable to Denial of Service via reflected user input in single-fetch (CVSS 7.5, remix-run react-router · remix-run turbo-stream +2)
- [CVE-2019-25721](https://cve.now/CVE-2019-25721.md): Dräger Infinity M300 VG2.3.1 Network-Based Denial of Service (CVSS 7.1, Dräger Infinity M300)
- [CVE-2026-1829](https://cve.now/CVE-2026-1829.md): Content Visibility for Divi Builder \<= 4.02 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, jhorowitz Content Visibility for Divi Builder)
- [CVE-2026-8036](https://cve.now/CVE-2026-8036.md): Local privilege escalation in NI-PAL (CVSS 8.4, NI-PAL)
- [CVE-2026-8035](https://cve.now/CVE-2026-8035.md): NULL pointer dereference in NI-PAL (CVSS 6.9, NI-PAL)
- [CVE-2026-10702](https://cve.now/CVE-2026-10702.md): JIT miscompilation in the JavaScript Engine: JIT component (CVSS 4.3, Mozilla Firefox)
- [CVE-2026-10701](https://cve.now/CVE-2026-10701.md): Incorrect boundary conditions in the Graphics: Text component (CVSS 7.5, Mozilla Firefox)
- [CVE-2026-33245](https://cve.now/CVE-2026-33245.md): React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets (CVSS 8.0, remix-run react-router · react-router)
- [CVE-2026-41577](https://cve.now/CVE-2026-41577.md): authentik: SAML source does not validate Conditions, timing, or audience on assertions (CVSS 6.9, goauthentik authentik)
- [CVE-2026-33244](https://cve.now/CVE-2026-33244.md): React Router has stored XSS via unescaped Location header in prerendered redirect HTML (CVSS 5.4, remix-run react-router · react-router)
- [CVE-2026-24237](https://cve.now/CVE-2026-24237.md): NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. (CVSS 7.8, NVIDIA NVTabular)
- [CVE-2026-24221](https://cve.now/CVE-2026-24221.md): NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. (CVSS 7.8, NVIDIA NVTabular)
- [CVE-2026-40571](https://cve.now/CVE-2026-40571.md): NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization (CVSS 5.3, NamelessMC Nameless)
- [CVE-2026-35447](https://cve.now/CVE-2026-35447.md): NamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes (CVSS 5.3, NamelessMC Nameless)
- [CVE-2026-10606](https://cve.now/CVE-2026-10606.md): DedeCMS Feedback feedback.php TrimMsg sql injection (CVSS 6.9, DedeCMS)
- [CVE-2026-49943](https://cve.now/CVE-2026-49943.md): CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS\_PATH mask matching implementation in (CVSS 6.3, NIC BIRD)
- [CVE-2026-40715](https://cve.now/CVE-2026-40715.md): Dell ThinOS 10, versions prior to ThinOS10 2602\_10.0765, contain an Improper Access Control vulnerability. (CVSS 7.8, Dell ThinOS)
- [CVE-2026-1871](https://cve.now/CVE-2026-1871.md): Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200 (CVSS 7.1, TP-Link Systems Tapo C200)
- [CVE-2026-40713](https://cve.now/CVE-2026-40713.md): Dell ThinOS 10, versions prior to ThinOS10 2602\_10.0765, contain an Improper Access control vulnerability. (CVSS 6.1, Dell ThinOS)
- [CVE-2026-40314](https://cve.now/CVE-2026-40314.md): NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization (CVSS 6.9, NamelessMC Nameless)
- [CVE-2024-42206](https://cve.now/CVE-2024-42206.md): HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application. (CVSS 3.1, HCL iReflection)
- [CVE-2026-35443](https://cve.now/CVE-2026-35443.md): NamelessMC: Forum reactions bypass the "view own topics only" restriction (CVSS 5.3, NamelessMC Nameless)
- [CVE-2026-0611](https://cve.now/CVE-2026-0611.md): Spacelabs Healthcare Sentinel 10.5.x \< 11.6.0 Unauthenticated RCE via .NET Remoting (CVSS 9.2, Spacelabs Healthcare Sentinel)
- [CVE-2026-42073](https://cve.now/CVE-2026-42073.md): OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS (CVSS 6.5, Gitlawb openclaude · @gitlawb/openclaude)
- [CVE-2026-42074](https://cve.now/CVE-2026-42074.md): OpenClaude: Sandbox Bypass via Model-Controlled \`dangerouslyDisableSandbox\` Input (CVSS 9.3, Gitlawb openclaude · openclaude)
- [CVE-2026-45554](https://cve.now/CVE-2026-45554.md): NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes (CVSS 5.3, zauberzeug nicegui · nicegui)
- [CVE-2026-10591](https://cve.now/CVE-2026-10591.md): Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths (CVSS 8.8, AWS Kiro IDE)
- [CVE-2026-45553](https://cve.now/CVE-2026-45553.md): NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured\_text() (CVSS 7.5, zauberzeug nicegui · nicegui)
- [CVE-2026-45080](https://cve.now/CVE-2026-45080.md): Klaw: Improper Access Control Allows Disclosure of Password Hash (CVSS 6.9, Aiven-Open klaw)
- [CVE-2026-44367](https://cve.now/CVE-2026-44367.md): Klaw: user lockout due to case sensitivity inconsistency (CVSS 2.7, Aiven-Open klaw)
- [CVE-2026-34460](https://cve.now/CVE-2026-34460.md): NamelessMC: OAuth callback \`state\` is not validated, allowing login CSRF / session swapping (CVSS 5.4, NamelessMC Nameless)
- [CVE-2026-45686](https://cve.now/CVE-2026-45686.md): OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI (CVSS 7.5, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45685](https://cve.now/CVE-2026-45685.md): OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages (CVSS 7.5, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45684](https://cve.now/CVE-2026-45684.md): OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers (CVSS 4.9, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45683](https://cve.now/CVE-2026-45683.md): OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure (CVSS 3.8, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45681](https://cve.now/CVE-2026-45681.md): OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size (CVSS 5.9, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45680](https://cve.now/CVE-2026-45680.md): OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU (CVSS 5.9, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45679](https://cve.now/CVE-2026-45679.md): OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages (CVSS 6.5, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45678](https://cve.now/CVE-2026-45678.md): OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads (CVSS 7.5, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45676](https://cve.now/CVE-2026-45676.md): OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent (CVSS 5.5, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-45682](https://cve.now/CVE-2026-45682.md): OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals (CVSS 5.1, open-telemetry opentelemetry-ebpf-instrumentation · go.open…)
- [CVE-2026-33398](https://cve.now/CVE-2026-33398.md): Authenticated users can read hidden forum posts through \`/forum/get\_quotes\` (CVSS 7.1, NamelessMC Nameless)
- [CVE-2026-40780](https://cve.now/CVE-2026-40780.md): WordPress BookIt plugin \< 2.5.4.1 - Broken Authentication vulnerability (CVSS 7.5, Liquid Web / StellarWP BookIt)
- [CVE-2026-42654](https://cve.now/CVE-2026-42654.md): WordPress Wallet System for WooCommerce plugin \<= 2.7.5 - Broken Authentication vulnerability (CVSS 7.1, WP Swings Wallet System for WooCommerce)
- [CVE-2026-40619](https://cve.now/CVE-2026-40619.md): A high security vulnerability affecting Security Center main server installations has been identified. (CVSS 7.8, Genetec Security Center)
- [CVE-2026-10629](https://cve.now/CVE-2026-10629.md): CVE-2026-10629 (CVSS 7.4, Verizon VoLTE)
- [CVE-2026-10047](https://cve.now/CVE-2026-10047.md): Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905) (CVSS 8.5, Bitdefender Napoca bare-metal hypervisor)
- [CVE-2026-10046](https://cve.now/CVE-2026-10046.md): Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905) (CVSS 8.5, Bitdefender Napoca bare-metal hypervisor)
- [CVE-2026-47117](https://cve.now/CVE-2026-47117.md): OpenMed \< 1.5.2 Remote Code Execution via PII Model Loading (CVSS 9.3, maziyarpanahi openmed · openmed)
- [CVE-2026-49753](https://cve.now/CVE-2026-49753.md): HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing (CVSS 6.3, elixir-mint mint)
- [CVE-2026-49754](https://cve.now/CVE-2026-49754.md): HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation (CVSS 8.2, elixir-mint mint)
- [CVE-2026-48862](https://cve.now/CVE-2026-48862.md): Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH\_PROMISE concurrency (CVSS 8.2, elixir-mint mint)
- [CVE-2026-48861](https://cve.now/CVE-2026-48861.md): CRLF injection in HTTP/1 request line via unvalidated method in Mint (CVSS 2.1, elixir-mint mint)
- [CVE-2026-9522](https://cve.now/CVE-2026-9522.md): Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user withou (CVSS 5.4, Devolutions Server)
- [CVE-2026-7299](https://cve.now/CVE-2026-7299.md): CVE-2026-7299 (CVSS 6.3, Appsmith)
- [CVE-2026-9590](https://cve.now/CVE-2026-9590.md): Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with (CVSS 5.3, Devolutions Server)
- [CVE-2026-49782](https://cve.now/CVE-2026-49782.md): WordPress Elementor Website Builder plugin \<= 4.1.0 - Broken Access Control vulnerability (CVSS 5.4, Elementor Website Builder)
- [CVE-2026-10621](https://cve.now/CVE-2026-10621.md): CVE-2026-10621 (CVSS 7.5, Collibra Platform)
- [CVE-2026-27351](https://cve.now/CVE-2026-27351.md): WordPress Crew HRM plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 5.4, Sekander Badsha Crew HRM)
- [CVE-2026-10622](https://cve.now/CVE-2026-10622.md): CVE-2026-10622 (CVSS 8.2, Collibra Platform)
- [CVE-2019-25719](https://cve.now/CVE-2019-25719.md): Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling (CVSS 8.8, Dräger Infinity Acute Care System · Dräger Standalone Infin…)
- [CVE-2026-28116](https://cve.now/CVE-2026-28116.md): WordPress Progress Planner plugin \<= 1.9.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Emilia Projects Progress Planner)
- [CVE-2025-68886](https://cve.now/CVE-2025-68886.md): WordPress Cookiteer theme \<= 1.4.8 - Local File Inclusion vulnerability (CVSS 8.1, androThemes Cookiteer)
- [CVE-2025-69369](https://cve.now/CVE-2025-69369.md): WordPress Racquet theme \<= 1.12.0 - Local File Inclusion vulnerability (CVSS 8.1, Axiomthemes Racquet)
- [CVE-2025-58897](https://cve.now/CVE-2025-58897.md): WordPress Fermentio theme \<= 1.5.0 - Local File Inclusion vulnerability (CVSS 8.1, Axiomthemes Fermentio)
- [CVE-2025-58707](https://cve.now/CVE-2025-58707.md): WordPress Spin theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, Axiomthemes Spin)
- [CVE-2019-25717](https://cve.now/CVE-2019-25717.md): Dräger Infinity Delta/Kappa Patient Monitors Unauthenticated Log File Disclosure (CVSS 5.3, Dräger Infinity Delta · Dräger Infinity Kappa)
- [CVE-2026-42795](https://cve.now/CVE-2026-42795.md): Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root (CVSS 5.1, Gleam)
- [CVE-2026-32685](https://cve.now/CVE-2026-32685.md): Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write (CVSS 4.6, Gleam)
- [CVE-2026-43965](https://cve.now/CVE-2026-43965.md): Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion (CVSS 5.6, Gleam)
- [CVE-2026-32250](https://cve.now/CVE-2026-32250.md): NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ (CVSS 4.3, NamelessMC Nameless)
- [CVE-2026-39555](https://cve.now/CVE-2026-39555.md): WordPress Askka theme \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Askka)
- [CVE-2026-9844](https://cve.now/CVE-2026-9844.md): Vulnerability in navify® Digital Pathology (CVSS 8.8, Roche Diagnostics navify Digital Pathology)
- [CVE-2026-7313](https://cve.now/CVE-2026-7313.md): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity (CVSS 8.7, Progress Software Sitefinity)
- [CVE-2026-7312](https://cve.now/CVE-2026-7312.md): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity (CVSS 10.0, Progress Software Sitefinity)
- [CVE-2026-7201](https://cve.now/CVE-2026-7201.md): CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity (CVSS 8.8, Progress Software Sitefinity)
- [CVE-2026-7198](https://cve.now/CVE-2026-7198.md): CWE-284: Improper Access Control in web services in Progress Sitefinity (CVSS 9.8, Progress Software Sitefinity)
- [CVE-2026-7195](https://cve.now/CVE-2026-7195.md): CWE-20: Improper Input Validation in web services in Progress Sitefinity (CVSS 8.8, Progress Software Sitefinity)
- [CVE-2026-10611](https://cve.now/CVE-2026-10611.md): OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled (CVSS 8.2, misp)
- [CVE-2026-39553](https://cve.now/CVE-2026-39553.md): WordPress WaveRide theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, Select-Themes WaveRide)
- [CVE-2026-39552](https://cve.now/CVE-2026-39552.md): WordPress Blueprint theme \< 1.1.5 - Local File Inclusion vulnerability (CVSS 8.1, Code Supply Blueprint)
- [CVE-2026-41918](https://cve.now/CVE-2026-41918.md): A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions \< V4.0). (CVSS 5.7, Siemens RUGGEDCOM RST2428P)
- [CVE-2026-8993](https://cve.now/CVE-2026-8993.md): Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks (CVSS 6.5, Ditec a.s. D.Launcher)
- [CVE-2026-39551](https://cve.now/CVE-2026-39551.md): WordPress Töbel theme \<= 1.8.1 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Töbel)
- [CVE-2026-39550](https://cve.now/CVE-2026-39550.md): WordPress Aperitif theme \<= 1.6 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Aperitif)
- [CVE-2026-42685](https://cve.now/CVE-2026-42685.md): WordPress WP Job Portal plugin \<= 2.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ahmad WP Job Portal)
- [CVE-2026-42684](https://cve.now/CVE-2026-42684.md): WordPress WP Job Portal plugin \<= 2.5.1 - SQL Injection vulnerability (CVSS 9.3, Ahmad WP Job Portal)
- [CVE-2026-42670](https://cve.now/CVE-2026-42670.md): WordPress Five Star Restaurant Reservations plugin \<= 2.7.14 - Payment Bypass vulnerability (CVSS 7.5, Etoile Web Design Incorporated Five Star Restaurant Reserva…)
- [CVE-2026-42669](https://cve.now/CVE-2026-42669.md): WordPress EventPrime plugin \<= 4.3.2.0 - Broken Access Control vulnerability (CVSS 7.5, EventPrime)
- [CVE-2025-58705](https://cve.now/CVE-2025-58705.md): WordPress Crafti theme \<= 1.12 - Local File Inclusion vulnerability (CVSS 8.1, Axiomthemes Crafti)
- [CVE-2025-58024](https://cve.now/CVE-2025-58024.md): WordPress Accordion FAQ Plugin \<= 2.2.1 - Local File Inclusion Vulnerability (CVSS 7.5, UnboundStudio Accordion FAQ)
- [CVE-2025-53440](https://cve.now/CVE-2025-53440.md): WordPress Confidant theme \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, Axiomthemes Confidant)
- [CVE-2025-53346](https://cve.now/CVE-2025-53346.md): WordPress Thim Core Plugin \<= 2.3.3 - Broken Access Control Vulnerability (CVSS 4.3, ThimPress Thim Core)
- [CVE-2025-53345](https://cve.now/CVE-2025-53345.md): WordPress Thim Core plugin \<= 2.3.3 - Arbitrary plugin Installation vulnerability (CVSS 8.8, ThimPress Thim Core)
- [CVE-2025-53302](https://cve.now/CVE-2025-53302.md): WordPress Constructor theme \<= 1.6.5 - Broken Access Control Vulnerability (CVSS 5.3, Anton Shevchuk Constructor)
- [CVE-2025-53209](https://cve.now/CVE-2025-53209.md): WordPress Masteriyo LMS PRO plugin \<= 2.20.0 - Privilege Escalation Vulnerability (CVSS 9.8, Themeisle Masteriyo LMS PRO)
- [CVE-2025-52766](https://cve.now/CVE-2025-52766.md): WordPress Printeers Print & Ship plugin \<= 1.17.0 - Broken Access Control vulnerability (CVSS 6.5, Printeers Print & Ship)
- [CVE-2025-52759](https://cve.now/CVE-2025-52759.md): WordPress Accordion FAQ plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, UnboundStudio Accordion FAQ)
- [CVE-2026-46718](https://cve.now/CVE-2026-46718.md): Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution (CVSS 6.5, Apache Software Foundation Apache Calcite · org.apache.calc…)
- [CVE-2026-5422](https://cve.now/CVE-2026-5422.md): Path Traversal in jupyter/jupyter (CVSS 6.8, jupyter/jupyter · jupyter-server)
- [CVE-2026-41115](https://cve.now/CVE-2026-41115.md): Apache Kafka: Improper Authorization in CONSUMER\_GROUP\_DESCRIBE API (CVSS 4.3, Apache Software Foundation Apache Kafka)
- [CVE-2026-34907](https://cve.now/CVE-2026-34907.md): Reflected Cross-Site Scripting (XSS) in Wirtualna Uczelnia (CVSS 5.1, Simple SA Wirtualna Uczelnia)
- [CVE-2026-34906](https://cve.now/CVE-2026-34906.md): Server-Side Template Injection (SSTI) in Wirtualna Uczelnia (CVSS 9.3, Simple SA Wirtualna Uczelnia)
- [CVE-2026-5191](https://cve.now/CVE-2026-5191.md): Tiled Gallery Carousel Without JetPack \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title' (CVSS 5.4, raja3c Tiled Gallery Carousel Without JetPack)
- [CVE-2026-10549](https://cve.now/CVE-2026-10549.md): Privilege escalation in Yandex Database (CVSS 5.3, Yandex Database)
- [CVE-2026-9722](https://cve.now/CVE-2026-9722.md): Laiser Tag \<= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form (CVSS 4.3, pcis Laiser Tag)
- [CVE-2026-8422](https://cve.now/CVE-2026-8422.md): Remove meta boxes per user role \<= 1.01 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, mr\_mat Remove meta boxes per user role)
- [CVE-2026-1451](https://cve.now/CVE-2026-1451.md): rognone \<= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter (CVSS 6.1, federicocarrara rognone)
- [CVE-2026-9730](https://cve.now/CVE-2026-9730.md): Remove NoFollow Commenter URL \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, jamesmuga Remove NoFollow Commenter URL)
- [CVE-2026-3620](https://cve.now/CVE-2026-3620.md): Word Replacer \<= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter (CVSS 4.4, takien Word Replacer)
- [CVE-2026-9599](https://cve.now/CVE-2026-9599.md): Tectite Forms \<= 1.3 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, russellr Tectite Forms)
- [CVE-2026-8885](https://cve.now/CVE-2026-8885.md): DeMomentSomTres Shortcodes \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, marcqueralt DeMomentSomTres Shortcodes)
- [CVE-2026-4080](https://cve.now/CVE-2026-4080.md): Easy Cart \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, zeshanb Easy Cart)
- [CVE-2026-2425](https://cve.now/CVE-2026-2425.md): hiWeb Migration Simple \<= 2.0.0.1 - Reflected Cross-Site Scripting via 'new\_domain' Parameter (CVSS 6.1, den-media hiWeb Migration Simple)
- [CVE-2026-9723](https://cve.now/CVE-2026-9723.md): Google Plus One Bottom \<= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page (CVSS 4.3, ddd2500 Google Plus One Bottom)
- [CVE-2025-5085](https://cve.now/CVE-2025-5085.md): wp-nano-ad \<= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole\_link Parameter (CVSS 5.5, ariyes WP Nano AD)
- [CVE-2026-1450](https://cve.now/CVE-2026-1450.md): rognone \<= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter (CVSS 6.1, federicocarrara rognone)
- [CVE-2026-4071](https://cve.now/CVE-2026-4071.md): BirdSeed \<= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change (CVSS 4.3, birdseedapp BirdSeed)
- [CVE-2026-2382](https://cve.now/CVE-2026-2382.md): FPW Category Thumbnails \<= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter (CVSS 6.4, frankpw FPW Category Thumbnails)
- [CVE-2026-9234](https://cve.now/CVE-2026-9234.md): JTL-Connector for WooCommerce \<= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions (CVSS 4.3, ntbyk JTL-Connector for WooCommerce)
- [CVE-2026-4081](https://cve.now/CVE-2026-4081.md): ZeM STL \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, jhdscript ZeM STL)
- [CVE-2026-3514](https://cve.now/CVE-2026-3514.md): Authentication Bypass in prefecthq/prefect (CVSS 7.5, prefecthq/prefect · prefect)
- [CVE-2026-1784](https://cve.now/CVE-2026-1784.md): Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection (CVSS 8.8, Red Hat OpenShift Container Platform)
- [CVE-2026-8293](https://cve.now/CVE-2026-8293.md): Really Simple Security \< 9.5.10.1 - Authentication Bypass via Two-Factor OTP Skip (CVSS 7.5, Really Simple Security)
- [CVE-2026-8206](https://cve.now/CVE-2026-8206.md): Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle\_forgot\_password' (CVSS 9.8, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-3198](https://cve.now/CVE-2026-3198.md): Improper Access Control in mlflow/mlflow (CVSS 6.5, mlflow/mlflow · mlflow)
- [CVE-2026-10583](https://cve.now/CVE-2026-10583.md): nextlevelbuilder GoClaw TTS Configuration Endpoint tts\_config.go import server-side request forgery (CVSS 5.1, nextlevelbuilder GoClaw)
- [CVE-2026-10581](https://cve.now/CVE-2026-10581.md): DedeCMS download.php base64\_decode server-side request forgery (CVSS 5.3, DedeCMS)
- [CVE-2026-10568](https://cve.now/CVE-2026-10568.md): itsourcecode Fees Management System manage\_payment.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-3871](https://cve.now/CVE-2026-3871.md): A buffer overflow vulnerability in the UPnP DeletePortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 cou (CVSS 6.5, Zyxel VMG4005-B50B firmware)
- [CVE-2026-10567](https://cve.now/CVE-2026-10567.md): 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting (CVSS 5.1, 1Panel-dev CordysCRM)
- [CVE-2026-10510](https://cve.now/CVE-2026-10510.md): GeniexWebView XSS in com.transsion.aiassistantlifestyle (CVSS 6.1, TECNO Mobile com.transsion.aiassistantlifestyle)
- [CVE-2026-3870](https://cve.now/CVE-2026-3870.md): A buffer overflow vulnerability in the UPnP AddPortMapping() command in Zyxel VMG4005-B50B firmware versions through 5.13(ABRL.5.4)C0 could (CVSS 6.5, Zyxel VMG4005-B50B firmware)
- [CVE-2026-10566](https://cve.now/CVE-2026-10566.md): FoundationAgents MetaGPT schema.py Message.check\_instruct\_content deserialization (CVSS 4.8, FoundationAgents MetaGPT · metagpt)
- [CVE-2026-10565](https://cve.now/CVE-2026-10565.md): Open5GS NGAP Handover gmm-sm.c gmm\_state\_security\_mode race condition (CVSS 2.3, Open5GS)
- [CVE-2026-10100](https://cve.now/CVE-2026-10100.md): Simple Custom Login Page \<= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, pattihis Simple Custom Login Page)
- [CVE-2026-3722](https://cve.now/CVE-2026-3722.md): Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) \<= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute (CVSS 6.4, arunbasillal Auto Image Attributes From Filename With Bulk…)
- [CVE-2026-10559](https://cve.now/CVE-2026-10559.md): SourceCodester Pizzafy Ecommerce System index.php file inclusion (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-10558](https://cve.now/CVE-2026-10558.md): SourceCodester Pizzafy Ecommerce System index.php file inclusion (CVSS 5.3, SourceCodester Pizzafy Ecommerce System)
- [CVE-2026-10550](https://cve.now/CVE-2026-10550.md): elunez eladmin Application Deployment App.java command injection (CVSS 5.3, elunez eladmin)
- [CVE-2026-10548](https://cve.now/CVE-2026-10548.md): NousResearch hermes-agent Credential Pool Synchronization credential\_pool.py \_sync\_anthropic\_entry\_from\_credentials\_file improper authentication (CVSS 4.8, NousResearch hermes-agent)
- [CVE-2026-10529](https://cve.now/CVE-2026-10529.md): westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting (CVSS 4.8, westboy CicadasCMS)
- [CVE-2026-10528](https://cve.now/CVE-2026-10528.md): Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow (CVSS 4.8, Orthanc DICOM Server)
- [CVE-2026-30586](https://cve.now/CVE-2026-30586.md): Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE\_SCHE (CVSS 6.1)
- [CVE-2026-30649](https://cve.now/CVE-2026-30649.md): Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set\_getparam.cgi c (CVSS 7.3)
- [CVE-2026-30650](https://cve.now/CVE-2026-30650.md): A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Viv (CVSS 8.8)
- [CVE-2026-30652](https://cve.now/CVE-2026-30652.md): A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras runni (CVSS 8.8)
- [CVE-2026-33553](https://cve.now/CVE-2026-33553.md): Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS. (CVSS 6.1)
- [CVE-2026-35716](https://cve.now/CVE-2026-35716.md): A stack-based buffer overflow in the motion\_privacy.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote atta (CVSS 6.3)
- [CVE-2026-35717](https://cve.now/CVE-2026-35717.md): A stack-based buffer overflow in the export\_language.cgi binary in VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote att (CVSS 6.3)
- [CVE-2026-35718](https://cve.now/CVE-2026-35718.md): A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a allows authenticated atta (CVSS 6.5)
- [CVE-2026-38967](https://cve.now/CVE-2026-38967.md): CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values. (CVSS 9.8)
- [CVE-2026-38978](https://cve.now/CVE-2026-38978.md): transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. (CVSS 5.3)
- [CVE-2026-48682](https://cve.now/CVE-2026-48682.md): FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.