# CVEs published 2026-06-24

521 CVEs were published on June 24, 2026: 56 critical, 210 high. Days are UTC.

- [CVE-2026-8663](https://cve.now/CVE-2026-8663.md): OS Command Injection in Rapid7 InsightConnect RPM Plugin (CVSS 6.0, Rapid7 InsightConnect RPM Plugin)
- [CVE-2026-40079](https://cve.now/CVE-2026-40079.md): Cacti: Command Injection via escape\_command() no-op in RRDtool execution (CVSS 8.6, cacti)
- [CVE-2026-7569](https://cve.now/CVE-2026-7569.md): Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9787](https://cve.now/CVE-2026-9787.md): Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9786](https://cve.now/CVE-2026-9786.md): Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9785](https://cve.now/CVE-2026-9785.md): Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9784](https://cve.now/CVE-2026-9784.md): Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9783](https://cve.now/CVE-2026-9783.md): Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-39951](https://cve.now/CVE-2026-39951.md): Cacti: Stored SQL Injection via graph\_name\_regexp in Reports feature (CVSS 7.6, cacti)
- [CVE-2026-9782](https://cve.now/CVE-2026-9782.md): Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9781](https://cve.now/CVE-2026-9781.md): Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-9780](https://cve.now/CVE-2026-9780.md): Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-7570](https://cve.now/CVE-2026-7570.md): Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Quest NetVault Backup)
- [CVE-2026-39948](https://cve.now/CVE-2026-39948.md): Cacti has SQL Injection via rfilter parameter in RLIKE clauses (CVSS 9.3, cacti)
- [CVE-2026-39955](https://cve.now/CVE-2026-39955.md): Cacti has Pre-Authentication SQL Injection via unanchored FILTER\_VALIDATE\_REGEXP in graph\_view.php (CVSS 9.8, cacti)
- [CVE-2026-39938](https://cve.now/CVE-2026-39938.md): Cacti: Unauthenticated RCE on Graph Image (CVSS 9.8, cacti)
- [CVE-2026-39900](https://cve.now/CVE-2026-39900.md): Cacti: Reflected XSS via tab parameter in auth\_profile.php JavaScript context (CVSS 5.3, cacti)
- [CVE-2026-39899](https://cve.now/CVE-2026-39899.md): Cacti: Path Traversal via filename parameter in package\_import.php (CVSS 6.9, cacti)
- [CVE-2026-39897](https://cve.now/CVE-2026-39897.md): Cacti has a Reflected XSS Vulnerability via html\_auth\_footer (CVSS 5.3, cacti)
- [CVE-2026-39894](https://cve.now/CVE-2026-39894.md): Cacti: RRDtool metric shift via LC\_NUMERIC locale comma decimal formatting (CVSS 2.9, cacti)
- [CVE-2026-39893](https://cve.now/CVE-2026-39893.md): Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph\_view.php (CVSS 9.8, cacti)
- [CVE-2026-2050](https://cve.now/CVE-2026-2050.md): GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2026-49979](https://cve.now/CVE-2026-49979.md): Appsmith: SSRF via \`POST /api/v1/admin/send-test-email\` — JavaMail Bypasses WebClient IP Filter (CVSS 5.1, appsmithorg appsmith)
- [CVE-2026-55454](https://cve.now/CVE-2026-55454.md): Appsmith: Caddy admin API exposed without authentication (CVSS 9.9, appsmithorg appsmith)
- [CVE-2026-9779](https://cve.now/CVE-2026-9779.md): ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability (CVSS 7.2, ATEN Unizon)
- [CVE-2026-9778](https://cve.now/CVE-2026-9778.md): ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, ATEN Unizon)
- [CVE-2026-9777](https://cve.now/CVE-2026-9777.md): ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, ATEN Unizon)
- [CVE-2026-9776](https://cve.now/CVE-2026-9776.md): ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability (CVSS 7.5, ATEN Unizon)
- [CVE-2026-9775](https://cve.now/CVE-2026-9775.md): ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 5.5, ATEN Unizon)
- [CVE-2026-9774](https://cve.now/CVE-2026-9774.md): ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 5.5, ATEN Unizon)
- [CVE-2026-55455](https://cve.now/CVE-2026-55455.md): Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist (CVSS 5.3, appsmithorg appsmith)
- [CVE-2026-10043](https://cve.now/CVE-2026-10043.md): MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.8, MosaicML Composer)
- [CVE-2026-9773](https://cve.now/CVE-2026-9773.md): Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Unraid)
- [CVE-2026-9772](https://cve.now/CVE-2026-9772.md): Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability (CVSS 8.8, Unraid)
- [CVE-2026-50189](https://cve.now/CVE-2026-50189.md): Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route (CVSS 8.9, appsmithorg appsmith)
- [CVE-2026-10642](https://cve.now/CVE-2026-10642.md): Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-53765](https://cve.now/CVE-2026-53765.md): chrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory (CVSS 6.1, ChromeDevTools chrome-devtools-mcp · chrome-devtools-mcp)
- [CVE-2026-53766](https://cve.now/CVE-2026-53766.md): chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots (CVSS 6.1, ChromeDevTools chrome-devtools-mcp · chrome-devtools-mcp)
- [CVE-2026-52794](https://cve.now/CVE-2026-52794.md): Sentry: Inefficient Regular Expression Complexity in sentry (CVSS 7.5, getsentry sentry)
- [CVE-2026-55570](https://cve.now/CVE-2026-55570.md): SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped \`data-obj\` attribute (Bypass for CVE-2026-45375's patch) (CVSS 9.0, siyuan-note siyuan)
- [CVE-2026-54759](https://cve.now/CVE-2026-54759.md): SiYuan: Lute HTML sanitizer allows \`\<iframe\>\` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron client (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-47110](https://cve.now/CVE-2026-47110.md): Tiptap for PHP \< 2.1.1 DoS via Malformed href Attribute (CVSS 7.1, ueberdosis tiptap-php · ueberdosis/tiptap-php)
- [CVE-2026-50551](https://cve.now/CVE-2026-50551.md): SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54158](https://cve.now/CVE-2026-54158.md): SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54070](https://cve.now/CVE-2026-54070.md): SiYuan: Stored XSS in Bazaar marketplace via package README event handlers (CVSS 7.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54069](https://cve.now/CVE-2026-54069.md): SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54068](https://cve.now/CVE-2026-54068.md): SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon (CVSS 5.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54067](https://cve.now/CVE-2026-54067.md): SiYuan: Stored XSS to RCE via CSS-snippet \<style\> breakout in renderSnippet() (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-54066](https://cve.now/CVE-2026-54066.md): SiYuan: Path Traversal via Double URL Encoding in /assets/\*path (publish mode arbitrary file─read) (CVSS 7.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-55762](https://cve.now/CVE-2026-55762.md): Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected \`/api/v1/fingerprint\` Endpoint (CVSS 8.1, RocketChat Rocket.Chat)
- [CVE-2026-55759](https://cve.now/CVE-2026-55759.md): Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay (CVSS 7.4, RocketChat Rocket.Chat)
- [CVE-2026-55666](https://cve.now/CVE-2026-55666.md): Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth (CVSS 9.3, RocketChat Rocket.Chat)
- [CVE-2026-49278](https://cve.now/CVE-2026-49278.md): Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation (CVSS 6.7, RocketChat Rocket.Chat)
- [CVE-2026-49277](https://cve.now/CVE-2026-49277.md): Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation (CVSS 2.3, RocketChat Rocket.Chat)
- [CVE-2026-45757](https://cve.now/CVE-2026-45757.md): Rocket.Chat: users.deactivateIdle\` deactivates accounts without revoking existing login tokens (CVSS 2.3, RocketChat Rocket.Chat)
- [CVE-2026-33543](https://cve.now/CVE-2026-33543.md): FOSSBilling: Authentication bypass allows unauthenticated administrator creation (CVSS 9.3, FOSSBilling)
- [CVE-2026-46423](https://cve.now/CVE-2026-46423.md): Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty (CVSS 9.3, RocketChat Rocket.Chat)
- [CVE-2026-45689](https://cve.now/CVE-2026-45689.md): Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO (CVSS 9.1, RocketChat Rocket.Chat)
- [CVE-2026-45688](https://cve.now/CVE-2026-45688.md): Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack (CVSS 9.1, RocketChat Rocket.Chat)
- [CVE-2026-45687](https://cve.now/CVE-2026-45687.md): Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage (CVSS 8.5, RocketChat Rocket.Chat)
- [CVE-2026-45677](https://cve.now/CVE-2026-45677.md): Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS (CVSS 8.7, RocketChat Rocket.Chat)
- [CVE-2026-33235](https://cve.now/CVE-2026-33235.md): AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features (CVSS 7.7, Significant-Gravitas AutoGPT)
- [CVE-2026-47733](https://cve.now/CVE-2026-47733.md): Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images (CVSS 4.4, RocketChat Rocket.Chat)
- [CVE-2026-32315](https://cve.now/CVE-2026-32315.md): motionEye: World-Readable Configuration File Exposes Admin Password Hash (CVSS 5.5, motioneye-project motioneye · motioneye)
- [CVE-2026-13208](https://cve.now/CVE-2026-13208.md): Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body (CVSS 6.5, Red Hat OpenShift Virtualization)
- [CVE-2026-13201](https://cve.now/CVE-2026-13201.md): Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption (CVSS 7.3, Red Hat Container Native Virtualization)
- [CVE-2026-52797](https://cve.now/CVE-2026-52797.md): Gogs: Overwriting critical files results in a denial of service (CVSS 8.5, gogs · gogs.io/gogs)
- [CVE-2026-52813](https://cve.now/CVE-2026-52813.md): Gogs: Path Traversal in organization name results in RCE through Git hooks (CVSS 10.0, gogs · gogs.io/gogs)
- [CVE-2026-52812](https://cve.now/CVE-2026-52812.md): Gogs: LFS dedupe path leaks private repo content across tenants (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-52811](https://cve.now/CVE-2026-52811.md): Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym (CVSS 9.0, gogs · gogs.io/gogs)
- [CVE-2026-52810](https://cve.now/CVE-2026-52810.md): Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-11998](https://cve.now/CVE-2026-11998.md): AngularJS XSS via SCE resource URL sanitization bypass (CVSS 7.6, Google AngularJS · angular)
- [CVE-2026-52809](https://cve.now/CVE-2026-52809.md): Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET\_PASSWORD\_CODE\_LIVES (CVSS 6.8, gogs · gogs.io/gogs)
- [CVE-2026-31978](https://cve.now/CVE-2026-31978.md): motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint (CVSS 6.5, motioneye-project motioneye · motioneye)
- [CVE-2026-52808](https://cve.now/CVE-2026-52808.md): Gogs: Write-level collaborators can mutate admin-only repository settings via API (CVSS 7.1, gogs · gogs.io/gogs)
- [CVE-2026-52816](https://cve.now/CVE-2026-52816.md): Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS (CVSS 5.4, gogs · gogs.io/gogs)
- [CVE-2026-52807](https://cve.now/CVE-2026-52807.md): Gogs: DOM-based XSS via Milestone Name on New Issue Page (CVSS 4.8, gogs · gogs.io/gogs)
- [CVE-2026-52805](https://cve.now/CVE-2026-52805.md): Gogs: Migration Redirect Bypass Leads to Internal Repository Theft (CVSS 8.7, gogs · gogs.io/gogs)
- [CVE-2026-52806](https://cve.now/CVE-2026-52806.md): Gogs: RCE via git rebase --exec argument injection in pull request merge (CVSS 9.9, gogs · gogs.io/gogs)
- [CVE-2026-52804](https://cve.now/CVE-2026-52804.md): Gogs: Privilege Escalation via Collaboration Access Mode Validation (CVSS 5.5, gogs · gogs.io/gogs)
- [CVE-2026-52799](https://cve.now/CVE-2026-52799.md): Gogs: Missing Authorization in Attachment Download (CVSS 7.5, gogs · gogs.io/gogs)
- [CVE-2026-52801](https://cve.now/CVE-2026-52801.md): Gogs: Ability to import local repositories via Mirror Settings (CVSS 8.1, gogs · gogs.io/gogs)
- [CVE-2026-52800](https://cve.now/CVE-2026-52800.md): Gogs: CSRF Leading to Organization Owner Takeover (CVSS 8.8, gogs · gogs.io/gogs)
- [CVE-2026-52802](https://cve.now/CVE-2026-52802.md): Gogs: Open Redirect via redirect\_to in Gogs (CVSS 5.4, gogs · gogs.io/gogs)
- [CVE-2026-52814](https://cve.now/CVE-2026-52814.md): Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) (CVSS 5.5, gogs · gogs.io/gogs)
- [CVE-2026-52798](https://cve.now/CVE-2026-52798.md): Gogs: Stored XSS in \`.ipynb\` Preview (CVSS 8.9, gogs · gogs.io/gogs)
- [CVE-2026-52796](https://cve.now/CVE-2026-52796.md): Gogs: DoS in rendering issue index pattern (CVSS 3.5, gogs · gogs.io/gogs)
- [CVE-2026-47267](https://cve.now/CVE-2026-47267.md): Gogs: SSRF in webhook deliveries (CVSS 8.3, gogs · gogs.io/gogs)
- [CVE-2026-25119](https://cve.now/CVE-2026-25119.md): Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers (CVSS 7.7, gogs · gogs.io/gogs)
- [CVE-2026-52795](https://cve.now/CVE-2026-52795.md): Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity (CVSS 4.3, gogs)
- [CVE-2025-64719](https://cve.now/CVE-2025-64719.md): Gogs: Denial of Service in repository/wiki file listing web pages (CVSS 4.9, gogs · gogs.io/gogs)
- [CVE-2026-52815](https://cve.now/CVE-2026-52815.md): Gogs: Unauthenticated Organization Teams Information Disclosure via API (CVSS 5.5, gogs · gogs.io/gogs)
- [CVE-2026-50129](https://cve.now/CVE-2026-50129.md): Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH\_TRANSFORMER (CVSS 7.5, mastodon)
- [CVE-2026-50128](https://cve.now/CVE-2026-50128.md): Mastodon: Spoofing of attribution domains (CVSS 5.3, mastodon)
- [CVE-2026-1840](https://cve.now/CVE-2026-1840.md): Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface (CVSS 8.7, Hubbell Aclara Metrum Cellular Web Interface)
- [CVE-2026-7539](https://cve.now/CVE-2026-7539.md): HP Dock Accessory WMI Provider Installer Security Update (CVSS 7.3, HP Dock Accessory)
- [CVE-2026-48028](https://cve.now/CVE-2026-48028.md): Mastodon: Removal of integrity-protected JSON entries from signed activities (CVSS 6.5, mastodon)
- [CVE-2026-47389](https://cve.now/CVE-2026-47389.md): Mastodon: SSRF protection bypass on older Ruby versions (CVSS 8.6, mastodon)
- [CVE-2026-46349](https://cve.now/CVE-2026-46349.md): Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring (CVSS 5.3, mastodon)
- [CVE-2026-46348](https://cve.now/CVE-2026-46348.md): Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) (CVSS 8.7, mastodon)
- [CVE-2026-27708](https://cve.now/CVE-2026-27708.md): FOSSBilling: IDOR in Servicecustom Client API allows cross-client data access (CVSS 7.1, FOSSBilling)
- [CVE-2026-55583](https://cve.now/CVE-2026-55583.md): Twenty: Cross-workspace IDOR in AgentTurnResolver (CVSS 7.6, twentyhq twenty)
- [CVE-2026-23879](https://cve.now/CVE-2026-23879.md): py7zr: Arbitrary File Write Vulnerability (CVSS 8.0, miurahr py7zr · py7zr)
- [CVE-2026-13037](https://cve.now/CVE-2026-13037.md): Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sa (CVSS 7.8, Google Chrome)
- [CVE-2026-13036](https://cve.now/CVE-2026-13036.md): Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-13035](https://cve.now/CVE-2026-13035.md): Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malici (CVSS 8.8, Google Chrome)
- [CVE-2026-13034](https://cve.now/CVE-2026-13034.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the rendere (CVSS 4.7, Google Chrome)
- [CVE-2026-13031](https://cve.now/CVE-2026-13031.md): Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-13030](https://cve.now/CVE-2026-13030.md): Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive infor (CVSS 5.3, Google Chrome)
- [CVE-2026-13029](https://cve.now/CVE-2026-13029.md): Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a maliciou (CVSS 7.5, Google Chrome)
- [CVE-2026-13027](https://cve.now/CVE-2026-13027.md): Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2026-13026](https://cve.now/CVE-2026-13026.md): Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap (CVSS 8.8, Google Chrome)
- [CVE-2026-13025](https://cve.now/CVE-2026-13025.md): Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially (CVSS 8.3, Google Chrome)
- [CVE-2026-13024](https://cve.now/CVE-2026-13024.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromi (CVSS 4.2, Google Chrome)
- [CVE-2026-13023](https://cve.now/CVE-2026-13023.md): Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obta (CVSS 5.3, Google Chrome)
- [CVE-2026-13022](https://cve.now/CVE-2026-13022.md): Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer (CVSS 3.1, Google Chrome)
- [CVE-2026-13021](https://cve.now/CVE-2026-13021.md): Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass s (CVSS 4.3, Google Chrome)
- [CVE-2026-13038](https://cve.now/CVE-2026-13038.md): Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-13033](https://cve.now/CVE-2026-13033.md): Out of bounds read and write in Blink\>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary (CVSS 8.8, Google Chrome)
- [CVE-2026-13032](https://cve.now/CVE-2026-13032.md): Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escap (CVSS 9.6, Google Chrome)
- [CVE-2026-13028](https://cve.now/CVE-2026-13028.md): Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escap (CVSS 9.6, Google Chrome)
- [CVE-2026-49220](https://cve.now/CVE-2026-49220.md): Jellyfin: Potential XSS in user management (CVSS 5.7, jellyfin)
- [CVE-2026-48793](https://cve.now/CVE-2026-48793.md): Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path (CVSS 8.8, jellyfin)
- [CVE-2026-49246](https://cve.now/CVE-2026-49246.md): Jellyfin: Potential MKV attachment filename path traversal to RCE (CVSS 1.7, jellyfin)
- [CVE-2026-49247](https://cve.now/CVE-2026-49247.md): Jellyfin: Potential Authenticated path traversal in /ClientLog/Document (CVSS 8.8, jellyfin)
- [CVE-2026-53943](https://cve.now/CVE-2026-53943.md): Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header (CVSS 9.6, TryGhost Ghost · ghost)
- [CVE-2026-12760](https://cve.now/CVE-2026-12760.md): Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200 (CVSS 7.1, TP-Link Systems Tapo C200)
- [CVE-2026-53944](https://cve.now/CVE-2026-53944.md): Ghost: Private IP filtering bypass to make server-side requests to internal services (CVSS 5.8, TryGhost Ghost · ghost)
- [CVE-2026-53945](https://cve.now/CVE-2026-53945.md): Ghost: Server-side request forgery via DNS rebinding in external request handling (CVSS 4.0, TryGhost Ghost · ghost)
- [CVE-2026-53946](https://cve.now/CVE-2026-53946.md): Ghost: Mobiledoc image-size fetch SSRF (CVSS 5.4, TryGhost Ghost · ghost)
- [CVE-2026-53947](https://cve.now/CVE-2026-53947.md): Ghost: Member existence leak via magic link sign-in response (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-53948](https://cve.now/CVE-2026-53948.md): Ghost: File Upload Content-Type Spoofing (CVSS 5.4, TryGhost Ghost · ghost)
- [CVE-2026-53949](https://cve.now/CVE-2026-53949.md): Ghost Content API filter bypass reveals private fields (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-53950](https://cve.now/CVE-2026-53950.md): @tryghost/activitypub: XSS in Ghost's ActivityPub client (CVSS 7.5, TryGhost Ghost · @tryghost/activitypub)
- [CVE-2026-49980](https://cve.now/CVE-2026-49980.md): Rclone: Unauthenticated command execution in \`rclone rcd --rc-serve\` via inline remote instantiation, bypassing CVE-2026-41179 fix (CVSS 9.8, rclone · github.com/rclone/rclone +1)
- [CVE-2026-44017](https://cve.now/CVE-2026-44017.md): Docling: Unsafe Zip Extraction in EasyOCR Model Download (CVSS 7.5, docling-project docling · docling)
- [CVE-2026-44022](https://cve.now/CVE-2026-44022.md): Docling: Potential Path Traversal via LaTeX \\includegraphics and \\input Commands (CVSS 5.5, docling-project docling · docling)
- [CVE-2026-44020](https://cve.now/CVE-2026-44020.md): Docling: Unsafe XML Entity Expansion in USPTO Patent Backend (CVSS 7.5, docling-project docling · docling)
- [CVE-2026-44016](https://cve.now/CVE-2026-44016.md): Docling: Unsafe Playwright-based HTML Rendering (CVSS 8.2, docling-project docling · docling)
- [CVE-2026-48704](https://cve.now/CVE-2026-48704.md): Warp Markdown notebook links may open executable local files (CVSS 8.8, warpdotdev warp)
- [CVE-2026-48719](https://cve.now/CVE-2026-48719.md): Warp branch selector command injection via Git branch names (CVSS 8.0, warpdotdev warp)
- [CVE-2026-48720](https://cve.now/CVE-2026-48720.md): Warp: SSH remote output can lead to local file overwrite and persistence (CVSS 8.8, warpdotdev warp)
- [CVE-2026-48721](https://cve.now/CVE-2026-48721.md): Warp: Env-var prefixes can lead to denylisted command autoexecution (CVSS 8.6, warpdotdev warp)
- [CVE-2026-48731](https://cve.now/CVE-2026-48731.md): Warp: Linux external editor command injection (CVSS 7.8, warpdotdev warp)
- [CVE-2026-48732](https://cve.now/CVE-2026-48732.md): Warp: Remote SSH cwd can lead to unauthorized remote command execution (CVSS 8.8, warpdotdev warp)
- [CVE-2026-54686](https://cve.now/CVE-2026-54686.md): Warp: DCS lifecycle hook spoofing can alter terminal session metadata (CVSS 4.3, warpdotdev warp)
- [CVE-2026-54699](https://cve.now/CVE-2026-54699.md): Warp: OS command injection when opening terminal links from WSL (CVSS 7.7, warpdotdev warp)
- [CVE-2026-48703](https://cve.now/CVE-2026-48703.md): Warp: Command Injection via Warp code search tool arguments (CVSS 7.8, warpdotdev warp)
- [CVE-2026-48725](https://cve.now/CVE-2026-48725.md): Warp may allow terminal output to access the local clipboard through OSC 52 (CVSS 8.1, warpdotdev warp)
- [CVE-2026-55611](https://cve.now/CVE-2026-55611.md): AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) (CVSS 0.0, Mintplex-Labs anything-llm)
- [CVE-2026-48789](https://cve.now/CVE-2026-48789.md): AnythingLLM: Windows path containment bypass in document folder route (CVSS 4.3, Mintplex-Labs anything-llm)
- [CVE-2026-49851](https://cve.now/CVE-2026-49851.md): Mistune: Potential DoS via quadratic-time parsing in parse\_link\_text (CVSS 8.7, lepture mistune · mistune)
- [CVE-2026-53130](https://cve.now/CVE-2026-53130.md): fs/omfs: reject s\_sys\_blocksize smaller than OMFS\_DIR\_START (CVSS 7.8, Linux)
- [CVE-2026-53129](https://cve.now/CVE-2026-53129.md): fs/mbcache: cancel shrink work before destroying the cache (no CVSS, Linux)
- [CVE-2026-53128](https://cve.now/CVE-2026-53128.md): drbd: Balance RCU calls in drbd\_adm\_dump\_devices() (no CVSS, Linux)
- [CVE-2026-53127](https://cve.now/CVE-2026-53127.md): block: fix zones\_cond memory leak on zone revalidation error paths (no CVSS, Linux)
- [CVE-2026-53126](https://cve.now/CVE-2026-53126.md): blk-cgroup: fix disk reference leak in blkcg\_maybe\_throttle\_current() (no CVSS, Linux)
- [CVE-2026-53125](https://cve.now/CVE-2026-53125.md): md: fix array\_state=clear sysfs deadlock (no CVSS, Linux)
- [CVE-2026-53124](https://cve.now/CVE-2026-53124.md): ublk: reset per-IO canceled flag on each fetch (no CVSS, Linux)
- [CVE-2026-53123](https://cve.now/CVE-2026-53123.md): md: wake raid456 reshape waiters before suspend (no CVSS, Linux)
- [CVE-2026-53122](https://cve.now/CVE-2026-53122.md): btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (no CVSS, Linux)
- [CVE-2026-53121](https://cve.now/CVE-2026-53121.md): amd-pstate: Fix memory leak in amd\_pstate\_epp\_cpu\_init() (no CVSS, Linux)
- [CVE-2026-53120](https://cve.now/CVE-2026-53120.md): PCI: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53119](https://cve.now/CVE-2026-53119.md): platform/wmi: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53118](https://cve.now/CVE-2026-53118.md): vdpa: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53117](https://cve.now/CVE-2026-53117.md): s390/cio: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53116](https://cve.now/CVE-2026-53116.md): s390/ap: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53115](https://cve.now/CVE-2026-53115.md): bus: fsl-mc: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-53114](https://cve.now/CVE-2026-53114.md): perf/amd/ibs: Avoid calling perf\_allow\_kernel() from the IBS NMI handler (no CVSS, Linux)
- [CVE-2026-53113](https://cve.now/CVE-2026-53113.md): wifi: ath11k: fix memory leaks in beacon template setup (no CVSS, Linux)
- [CVE-2026-53112](https://cve.now/CVE-2026-53112.md): wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq\_prepare\_bcn\_tasklet (no CVSS, Linux)
- [CVE-2026-53111](https://cve.now/CVE-2026-53111.md): bpf: test\_run: Fix the null pointer dereference issue in bpf\_lwt\_xmit\_push\_encap (no CVSS, Linux)
- [CVE-2026-53110](https://cve.now/CVE-2026-53110.md): s390/bpf: Zero-extend bpf prog return values and kfunc arguments (CVSS 7.8, Linux)
- [CVE-2026-53109](https://cve.now/CVE-2026-53109.md): powerpc/pgtable-frag: Fix bad page state in pte\_frag\_destroy (no CVSS, Linux)
- [CVE-2026-53108](https://cve.now/CVE-2026-53108.md): powerpc/64s: Fix unmap race with PMD migration entries (no CVSS, Linux)
- [CVE-2026-53107](https://cve.now/CVE-2026-53107.md): wifi: libertas: don't kill URBs in interrupt context (no CVSS, Linux)
- [CVE-2026-53106](https://cve.now/CVE-2026-53106.md): bpf: Do not allow deleting local storage in NMI (no CVSS, Linux)
- [CVE-2026-53105](https://cve.now/CVE-2026-53105.md): wifi: mt76: mt7925: prevent NULL vif dereference in mt7925\_mac\_write\_txwi (no CVSS, Linux)
- [CVE-2026-53104](https://cve.now/CVE-2026-53104.md): wifi: mt76: Fix memory leak destroying device (no CVSS, Linux)
- [CVE-2026-53103](https://cve.now/CVE-2026-53103.md): wifi: mt76: mt7925: fix potential deadlock in mt7925\_roc\_abort\_sync (no CVSS, Linux)
- [CVE-2026-53102](https://cve.now/CVE-2026-53102.md): wifi: mt76: Fix memory leak after mt76\_connac\_mcu\_alloc\_sta\_req() (no CVSS, Linux)
- [CVE-2026-53101](https://cve.now/CVE-2026-53101.md): wifi: mt76: mt7921: fix potential deadlock in mt7921\_roc\_abort\_sync (no CVSS, Linux)
- [CVE-2026-53100](https://cve.now/CVE-2026-53100.md): wifi: mt76: fix deadlock in remain-on-channel (no CVSS, Linux)
- [CVE-2026-53099](https://cve.now/CVE-2026-53099.md): bpf: Switch CONFIG\_CFI\_CLANG to CONFIG\_CFI (no CVSS, Linux)
- [CVE-2026-53098](https://cve.now/CVE-2026-53098.md): wifi: mt76: mt7915: fix use-after-free bugs in mt7915\_mac\_dump\_work() (no CVSS, Linux)
- [CVE-2026-53097](https://cve.now/CVE-2026-53097.md): wifi: mt76: mt7996: fix use-after-free bugs in mt7996\_mac\_dump\_work() (no CVSS, Linux)
- [CVE-2026-53096](https://cve.now/CVE-2026-53096.md): bpf: Use RCU-safe iteration in dev\_map\_redirect\_multi() SKB path (CVSS 7.8, Linux)
- [CVE-2026-53095](https://cve.now/CVE-2026-53095.md): bpf: Fix abuse of kprobe\_write\_ctx via freplace (no CVSS, Linux)
- [CVE-2026-53094](https://cve.now/CVE-2026-53094.md): bpf: Fix stale offload-\>prog pointer after constant blinding (CVSS 7.8, Linux)
- [CVE-2026-53093](https://cve.now/CVE-2026-53093.md): wifi: brcmfmac: Fix error pointer dereference (no CVSS, Linux)
- [CVE-2026-53092](https://cve.now/CVE-2026-53092.md): bpf: Fix linked reg delta tracking when src\_reg == dst\_reg (CVSS 7.8, Linux)
- [CVE-2026-53091](https://cve.now/CVE-2026-53091.md): net: pull headers in qdisc\_pkt\_len\_segs\_init() (CVSS 8.4, Linux)
- [CVE-2026-53090](https://cve.now/CVE-2026-53090.md): bpf: Fix ld\_{abs,ind} failure path analysis in subprogs (CVSS 7.8, Linux)
- [CVE-2026-53089](https://cve.now/CVE-2026-53089.md): bpf: Fix use-after-free in offloaded map/prog info fill (no CVSS, Linux)
- [CVE-2026-53088](https://cve.now/CVE-2026-53088.md): net: bcmgenet: fix off-by-one in bcmgenet\_put\_txcb (CVSS 9.8, Linux)
- [CVE-2026-53087](https://cve.now/CVE-2026-53087.md): net: bcmgenet: fix leaking free\_bds (CVSS 7.5, Linux)
- [CVE-2026-53086](https://cve.now/CVE-2026-53086.md): net: bcmgenet: fix racing timeout handler (CVSS 9.8, Linux)
- [CVE-2026-53085](https://cve.now/CVE-2026-53085.md): bpf: fix mm lifecycle in open-coded task\_vma iterator (CVSS 7.8, Linux)
- [CVE-2026-53084](https://cve.now/CVE-2026-53084.md): bpf: return VMA snapshot from task\_vma iterator (no CVSS, Linux)
- [CVE-2026-53083](https://cve.now/CVE-2026-53083.md): bpf: Fix RCU stall in bpf\_fd\_array\_map\_clear() (no CVSS, Linux)
- [CVE-2026-53082](https://cve.now/CVE-2026-53082.md): net: hamradio: 6pack: fix uninit-value in sixpack\_receive\_buf (no CVSS, Linux)
- [CVE-2026-53081](https://cve.now/CVE-2026-53081.md): bpf: Enforce regsafe base id consistency for BPF\_ADD\_CONST scalars (CVSS 7.8, Linux)
- [CVE-2026-53080](https://cve.now/CVE-2026-53080.md): net/sched: cls\_fw: fix NULL dereference of "old" filters before change() (no CVSS, Linux)
- [CVE-2026-53079](https://cve.now/CVE-2026-53079.md): net\_sched: fix skb memory leak in deferred qdisc drops (no CVSS, Linux)
- [CVE-2026-53078](https://cve.now/CVE-2026-53078.md): bpf: Fix same-register dst/src OOB read and pointer leak in sock\_ops (CVSS 7.8, Linux)
- [CVE-2026-53077](https://cve.now/CVE-2026-53077.md): net/rds: Restrict use of RDS/IB to the initial network namespace (CVSS 7.8, Linux)
- [CVE-2026-53076](https://cve.now/CVE-2026-53076.md): bpf: Fix OOB in pcpu\_init\_value (CVSS 7.1, Linux)
- [CVE-2026-53075](https://cve.now/CVE-2026-53075.md): ppp: require CAP\_NET\_ADMIN in target netns for unattached ioctls (CVSS 8.8, Linux)
- [CVE-2026-53074](https://cve.now/CVE-2026-53074.md): bpf: reject short IPv4/IPv6 inputs in bpf\_prog\_test\_run\_skb (no CVSS, Linux)
- [CVE-2026-53073](https://cve.now/CVE-2026-53073.md): Bluetooth: hci\_ldisc: Clear HCI\_UART\_PROTO\_INIT on error (no CVSS, Linux)
- [CVE-2026-53072](https://cve.now/CVE-2026-53072.md): Bluetooth: fix locking in hci\_conn\_request\_evt() with HCI\_PROTO\_DEFER (CVSS 8.8, Linux)
- [CVE-2026-53071](https://cve.now/CVE-2026-53071.md): Bluetooth: l2cap: Add missing chan lock in l2cap\_ecred\_reconf\_rsp (CVSS 8.8, Linux)
- [CVE-2026-53070](https://cve.now/CVE-2026-53070.md): sctp: disable BH before calling udp\_tunnel\_xmit\_skb() (CVSS 7.5, Linux)
- [CVE-2026-53069](https://cve.now/CVE-2026-53069.md): net, bpf: fix null-ptr-deref in xdp\_master\_redirect() for down master (CVSS 7.5, Linux)
- [CVE-2026-53068](https://cve.now/CVE-2026-53068.md): drm/komeda: fix integer overflow in AFBC framebuffer size check (CVSS 7.1, Linux)
- [CVE-2026-53067](https://cve.now/CVE-2026-53067.md): PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc (no CVSS, Linux)
- [CVE-2026-53066](https://cve.now/CVE-2026-53066.md): drm/sun4i: backend: fix error pointer dereference (no CVSS, Linux)
- [CVE-2026-53065](https://cve.now/CVE-2026-53065.md): ASoC: sti: use managed regmap\_field allocations (no CVSS, Linux)
- [CVE-2026-53064](https://cve.now/CVE-2026-53064.md): dm cache: fix null-deref with concurrent writes in passthrough mode (no CVSS, Linux)
- [CVE-2026-53063](https://cve.now/CVE-2026-53063.md): dm cache: fix write hang in passthrough mode (no CVSS, Linux)
- [CVE-2026-53062](https://cve.now/CVE-2026-53062.md): dm cache policy smq: fix missing locks in invalidating cache blocks (CVSS 7.8, Linux)
- [CVE-2026-53061](https://cve.now/CVE-2026-53061.md): dm cache: fix dirty mapping checking in passthrough mode switching (no CVSS, Linux)
- [CVE-2026-53060](https://cve.now/CVE-2026-53060.md): dm cache metadata: fix memory leak on metadata abort retry (no CVSS, Linux)
- [CVE-2026-53059](https://cve.now/CVE-2026-53059.md): dm log: fix out-of-bounds write due to region\_count overflow (CVSS 6.3, Linux)
- [CVE-2026-53058](https://cve.now/CVE-2026-53058.md): drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic\_enable() (no CVSS, Linux)
- [CVE-2026-53057](https://cve.now/CVE-2026-53057.md): iommu/riscv: Add IOTINVAL after updating DDT/PDT entries (CVSS 8.8, Linux)
- [CVE-2026-53056](https://cve.now/CVE-2026-53056.md): drm/msm/dpu: fix mismatch between power and frequency (no CVSS, Linux)
- [CVE-2026-53055](https://cve.now/CVE-2026-53055.md): crypto: hisilicon/sec2 - prevent req used-after-free for sec (CVSS 9.8, Linux)
- [CVE-2026-53054](https://cve.now/CVE-2026-53054.md): drm/msm: Fix VM\_BIND UNMAP locking (CVSS 7.8, Linux)
- [CVE-2026-53053](https://cve.now/CVE-2026-53053.md): iommu/amd: Fix clone\_alias() to use the original device's devid (CVSS 8.8, Linux)
- [CVE-2026-53052](https://cve.now/CVE-2026-53052.md): ASoC: qcom: qdsp6: topology: check widget type before accessing data (no CVSS, Linux)
- [CVE-2026-53051](https://cve.now/CVE-2026-53051.md): PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (no CVSS, Linux)
- [CVE-2026-53050](https://cve.now/CVE-2026-53050.md): quota: Fix race of dquot\_scan\_active() with quota deactivation (CVSS 7.8, Linux)
- [CVE-2026-53049](https://cve.now/CVE-2026-53049.md): gfs2: add some missing log locking (CVSS 9.8, Linux)
- [CVE-2026-53048](https://cve.now/CVE-2026-53048.md): gfs2: prevent NULL pointer dereference during unmount (no CVSS, Linux)
- [CVE-2026-53047](https://cve.now/CVE-2026-53047.md): efi/capsule-loader: fix incorrect sizeof in phys array reallocation (no CVSS, Linux)
- [CVE-2026-53046](https://cve.now/CVE-2026-53046.md): ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine (CVSS 9.8, Linux)
- [CVE-2026-53045](https://cve.now/CVE-2026-53045.md): memory: tegra124-emc: Fix dll\_change check (CVSS 9.8, Linux)
- [CVE-2026-53044](https://cve.now/CVE-2026-53044.md): soc/tegra: cbb: Fix incorrect ARRAY\_SIZE in fabric lookup tables (CVSS 7.1, Linux)
- [CVE-2026-53043](https://cve.now/CVE-2026-53043.md): ocfs2/dlm: validate qr\_numregions in dlm\_match\_regions() (CVSS 9.1, Linux)
- [CVE-2026-53042](https://cve.now/CVE-2026-53042.md): fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal (no CVSS, Linux)
- [CVE-2026-53041](https://cve.now/CVE-2026-53041.md): ocfs2: fix listxattr handling when the buffer is full (CVSS 7.1, Linux)
- [CVE-2026-53040](https://cve.now/CVE-2026-53040.md): ocfs2: validate bg\_bits during freefrag scan (CVSS 7.1, Linux)
- [CVE-2026-53039](https://cve.now/CVE-2026-53039.md): ocfs2: validate group add input before caching (no CVSS, Linux)
- [CVE-2026-53038](https://cve.now/CVE-2026-53038.md): ima\_fs: Correctly create securityfs files for unsupported hash algos (no CVSS, Linux)
- [CVE-2026-53037](https://cve.now/CVE-2026-53037.md): HID: usbhid: fix deadlock in hid\_post\_reset() (no CVSS, Linux)
- [CVE-2026-53036](https://cve.now/CVE-2026-53036.md): bpf, arm64: Fix off-by-one in check\_imm signed range check (CVSS 7.8, Linux)
- [CVE-2026-53035](https://cve.now/CVE-2026-53035.md): bpf, sockmap: Fix af\_unix iter deadlock (no CVSS, Linux)
- [CVE-2026-53034](https://cve.now/CVE-2026-53034.md): bpf, sockmap: Fix af\_unix null-ptr-deref in proto update (no CVSS, Linux)
- [CVE-2026-53033](https://cve.now/CVE-2026-53033.md): bpf, sockmap: Take state lock for af\_unix iter (CVSS 7.8, Linux)
- [CVE-2026-53032](https://cve.now/CVE-2026-53032.md): bpf: Fix NULL deref in map\_kptr\_match\_type for scalar regs (no CVSS, Linux)
- [CVE-2026-53031](https://cve.now/CVE-2026-53031.md): bpf: Validate node\_id in arena\_alloc\_pages() (CVSS 7.8, Linux)
- [CVE-2026-53030](https://cve.now/CVE-2026-53030.md): i3c: master: renesas: Fix memory leak in renesas\_i3c\_i3c\_xfers() (no CVSS, Linux)
- [CVE-2026-53029](https://cve.now/CVE-2026-53029.md): fs/ntfs3: prevent uninitialized lcn caused by zero len (no CVSS, Linux)
- [CVE-2026-53028](https://cve.now/CVE-2026-53028.md): usb: typec: Fix error pointer dereference (no CVSS, Linux)
- [CVE-2026-53027](https://cve.now/CVE-2026-53027.md): fs/ntfs3: fix missing run load for vcn0 in attr\_data\_get\_block\_locked() (no CVSS, Linux)
- [CVE-2026-53026](https://cve.now/CVE-2026-53026.md): NFSD: fix nfs4\_file access extra count in nfsd4\_add\_rdaccess\_to\_wrdeleg (CVSS 7.5, Linux)
- [CVE-2026-53025](https://cve.now/CVE-2026-53025.md): greybus: raw: fix use-after-free on cdev close (CVSS 7.8, Linux)
- [CVE-2026-53024](https://cve.now/CVE-2026-53024.md): greybus: raw: fix use-after-free if write is called after disconnect (CVSS 7.8, Linux)
- [CVE-2026-53023](https://cve.now/CVE-2026-53023.md): fs/ntfs3: terminate the cached volume label after UTF-8 conversion (no CVSS, Linux)
- [CVE-2026-53022](https://cve.now/CVE-2026-53022.md): platform/x86: dell-wmi-sysman: bound enumeration string aggregation (no CVSS, Linux)
- [CVE-2026-53021](https://cve.now/CVE-2026-53021.md): scsi: target: core: Fix integer overflow in UNMAP bounds check (no CVSS, Linux)
- [CVE-2026-53020](https://cve.now/CVE-2026-53020.md): um: Fix potential race condition in TLB sync (CVSS 7.8, Linux)
- [CVE-2026-53019](https://cve.now/CVE-2026-53019.md): clk: spacemit: ccu\_mix: fix inverted condition in ccu\_mix\_trigger\_fc() (no CVSS, Linux)
- [CVE-2026-53018](https://cve.now/CVE-2026-53018.md): f2fs: avoid reading already updated pages during GC (no CVSS, Linux)
- [CVE-2026-53017](https://cve.now/CVE-2026-53017.md): f2fs: fix data loss caused by incorrect use of nat\_entry flag (no CVSS, Linux)
- [CVE-2026-53016](https://cve.now/CVE-2026-53016.md): crypto: ccp - copy IV using skcipher ivsize (CVSS 7.8, Linux)
- [CVE-2026-53015](https://cve.now/CVE-2026-53015.md): erofs: unify lcn as u64 for 32-bit platforms (no CVSS, Linux)
- [CVE-2026-53014](https://cve.now/CVE-2026-53014.md): net/sched: act\_mirred: fix wrong device for mac\_header\_xmit check in tcf\_blockcast\_redir (no CVSS, Linux)
- [CVE-2026-53013](https://cve.now/CVE-2026-53013.md): macvlan: fix macvlan\_get\_size() not reserving space for IFLA\_MACVLAN\_BC\_CUTOFF (no CVSS, Linux)
- [CVE-2026-53012](https://cve.now/CVE-2026-53012.md): nexthop: fix IPv6 route referencing IPv4 nexthop (no CVSS, Linux)
- [CVE-2026-53011](https://cve.now/CVE-2026-53011.md): net/sched: taprio: fix use-after-free in advance\_sched() on schedule switch (CVSS 7.8, Linux)
- [CVE-2026-53010](https://cve.now/CVE-2026-53010.md): ksmbd: fix use-after-free in smb2\_open during durable reconnect (CVSS 9.8, Linux)
- [CVE-2026-53009](https://cve.now/CVE-2026-53009.md): ice: fix double-free of tx\_buf skb (CVSS 7.8, Linux)
- [CVE-2026-53008](https://cve.now/CVE-2026-53008.md): ice: fix race condition in TX timestamp ring cleanup (no CVSS, Linux)
- [CVE-2026-53007](https://cve.now/CVE-2026-53007.md): ice: fix potential NULL pointer deref in error path of ice\_set\_ringparam() (no CVSS, Linux)
- [CVE-2026-53006](https://cve.now/CVE-2026-53006.md): ipv6: fix possible UAF in icmpv6\_rcv() (CVSS 9.8, Linux)
- [CVE-2026-53005](https://cve.now/CVE-2026-53005.md): af\_unix: Drop all SCM attributes for SOCKMAP. (CVSS 7.8, Linux)
- [CVE-2026-53004](https://cve.now/CVE-2026-53004.md): sctp: fix OOB write to userspace in sctp\_getsockopt\_peer\_auth\_chunks (no CVSS, Linux)
- [CVE-2026-53003](https://cve.now/CVE-2026-53003.md): pppoe: drop PFC frames (CVSS 7.5, Linux)
- [CVE-2026-53002](https://cve.now/CVE-2026-53002.md): netfilter: conntrack: remove sprintf usage (CVSS 9.8, Linux)
- [CVE-2026-53001](https://cve.now/CVE-2026-53001.md): netfilter: xtables: restrict several matches to inet family (no CVSS, Linux)
- [CVE-2026-53000](https://cve.now/CVE-2026-53000.md): netfilter: nat: use kfree\_rcu to release ops (CVSS 7.8, Linux)
- [CVE-2026-52999](https://cve.now/CVE-2026-52999.md): netfilter: nfnetlink\_osf: fix out-of-bounds read on option matching (CVSS 9.1, Linux)
- [CVE-2026-52998](https://cve.now/CVE-2026-52998.md): netfilter: nfnetlink\_osf: fix potential NULL dereference in ttl check (CVSS 7.5, Linux)
- [CVE-2026-52997](https://cve.now/CVE-2026-52997.md): net/sched: sch\_dualpi2: drain both C-queue and L-queue in dualpi2\_change() (no CVSS, Linux)
- [CVE-2026-52996](https://cve.now/CVE-2026-52996.md): ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open (no CVSS, Linux)
- [CVE-2026-52995](https://cve.now/CVE-2026-52995.md): net/rds: zero per-item info buffer before handing it to visitors (no CVSS, Linux)
- [CVE-2026-52994](https://cve.now/CVE-2026-52994.md): vsock/virtio: fix MSG\_ZEROCOPY pinned-pages accounting (no CVSS, Linux)
- [CVE-2026-52993](https://cve.now/CVE-2026-52993.md): tipc: fix double-free in tipc\_buf\_append() (CVSS 9.8, Linux · :linux\_kernel:)
- [CVE-2026-52992](https://cve.now/CVE-2026-52992.md): fs/adfs: validate nzones in adfs\_validate\_bblk() (no CVSS, Linux)
- [CVE-2026-52991](https://cve.now/CVE-2026-52991.md): sched/psi: fix race between file release and pressure write (CVSS 7.8, Linux)
- [CVE-2026-52990](https://cve.now/CVE-2026-52990.md): fsnotify: fix inode reference leak in fsnotify\_recalc\_mask() (no CVSS, Linux)
- [CVE-2026-52989](https://cve.now/CVE-2026-52989.md): nvmet-tcp: propagate nvmet\_tcp\_build\_pdu\_iovec() errors to its callers (CVSS 9.8, Linux)
- [CVE-2026-52988](https://cve.now/CVE-2026-52988.md): netfilter: nf\_tables: join hook list via splice\_list\_rcu() in commit phase (CVSS 7.1, Linux)
- [CVE-2026-52987](https://cve.now/CVE-2026-52987.md): drm/amdgpu: avoid double drm\_exec\_fini() in userq validate (CVSS 7.8, Linux)
- [CVE-2026-52986](https://cve.now/CVE-2026-52986.md): netfilter: nf\_conntrack\_sip: don't use simple\_strtoul (CVSS 9.8, Linux)
- [CVE-2026-52985](https://cve.now/CVE-2026-52985.md): netdevsim: zero initialize struct iphdr in dummy sk\_buff (no CVSS, Linux)
- [CVE-2026-52984](https://cve.now/CVE-2026-52984.md): net/sched: netem: fix queue limit check to include reordered packets (no CVSS, Linux)
- [CVE-2026-52983](https://cve.now/CVE-2026-52983.md): net: airoha: fix BQL imbalance in TX path (CVSS 7.5, Linux)
- [CVE-2026-52982](https://cve.now/CVE-2026-52982.md): net: usb: rtl8150: fix use-after-free in rtl8150\_start\_xmit() (CVSS 9.8, Linux)
- [CVE-2026-52981](https://cve.now/CVE-2026-52981.md): neigh: let neigh\_xmit take skb ownership (CVSS 7.5, Linux)
- [CVE-2026-52980](https://cve.now/CVE-2026-52980.md): sched/fair: Clear rel\_deadline when initializing forked entities (no CVSS, Linux)
- [CVE-2026-52979](https://cve.now/CVE-2026-52979.md): net: psp: check for device unregister when creating assoc (no CVSS, Linux)
- [CVE-2026-52978](https://cve.now/CVE-2026-52978.md): net: psp: require admin permission for dev-set and key-rotate (no CVSS, Linux)
- [CVE-2026-52977](https://cve.now/CVE-2026-52977.md): futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (no CVSS, Linux)
- [CVE-2026-52976](https://cve.now/CVE-2026-52976.md): drm/xe: Fix error cleanup in xe\_exec\_queue\_create\_ioctl() (CVSS 7.8, Linux)
- [CVE-2026-52975](https://cve.now/CVE-2026-52975.md): bonding: 3ad: implement proper RCU rules for port-\>aggregator (CVSS 7.8, Linux)
- [CVE-2026-52974](https://cve.now/CVE-2026-52974.md): net: tls: fix strparser anchor skb leak on offload RX setup failure (CVSS 7.5, Linux)
- [CVE-2026-52973](https://cve.now/CVE-2026-52973.md): futex: Drop CLONE\_THREAD requirement for private default hash alloc (CVSS 7.8, Linux)
- [CVE-2026-52972](https://cve.now/CVE-2026-52972.md): crypto: af\_alg - Cap AEAD AD length to 0x80000000 (CVSS 7.0, Linux)
- [CVE-2026-52971](https://cve.now/CVE-2026-52971.md): net: ena: PHC: Fix potential use-after-free in get\_timestamp (CVSS 7.8, Linux)
- [CVE-2026-52970](https://cve.now/CVE-2026-52970.md): netfilter: nft\_ct: fix missing expect put in obj eval (no CVSS, Linux)
- [CVE-2026-52969](https://cve.now/CVE-2026-52969.md): KVM: Reject wrapped offset in kvm\_reset\_dirty\_gfn() (CVSS 7.0, Linux)
- [CVE-2026-52968](https://cve.now/CVE-2026-52968.md): KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic (CVSS 8.8, Linux)
- [CVE-2026-52967](https://cve.now/CVE-2026-52967.md): smb/client: fix possible infinite loop and oob read in symlink\_data() (CVSS 8.1, Linux)
- [CVE-2026-52966](https://cve.now/CVE-2026-52966.md): drm: Replace old pointer to new idr (no CVSS, Linux)
- [CVE-2026-52965](https://cve.now/CVE-2026-52965.md): drm/ttm: Fix ttm\_bo\_swapout() infinite LRU walk on swapout failure (no CVSS, Linux)
- [CVE-2026-52964](https://cve.now/CVE-2026-52964.md): ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans (no CVSS, Linux)
- [CVE-2026-52963](https://cve.now/CVE-2026-52963.md): ALSA: usb-audio: Bound MIDI endpoint descriptor scans (no CVSS, Linux)
- [CVE-2026-52962](https://cve.now/CVE-2026-52962.md): ceph: fix a buffer leak in \_\_ceph\_setxattr() (no CVSS, Linux)
- [CVE-2026-52961](https://cve.now/CVE-2026-52961.md): ceph: fix BUG\_ON in \_\_ceph\_build\_xattrs\_blob() due to stale blob size (no CVSS, Linux)
- [CVE-2026-52960](https://cve.now/CVE-2026-52960.md): ceph: put folios not suitable for writeback (CVSS 7.5, Linux)
- [CVE-2026-52959](https://cve.now/CVE-2026-52959.md): virt: sev-guest: Do not use host-controlled page order in cleanup path (CVSS 7.8, Linux)
- [CVE-2026-52958](https://cve.now/CVE-2026-52958.md): libceph: Fix potential out-of-bounds access in osdmap\_decode() (CVSS 9.1, Linux)
- [CVE-2026-52957](https://cve.now/CVE-2026-52957.md): libceph: Fix potential null-ptr-deref in decode\_choose\_args() (CVSS 7.5, Linux)
- [CVE-2026-52956](https://cve.now/CVE-2026-52956.md): libceph: Fix potential out-of-bounds access in \_\_ceph\_x\_decrypt() (CVSS 7.5, Linux)
- [CVE-2026-52955](https://cve.now/CVE-2026-52955.md): libceph: Fix potential out-of-bounds access in crush\_decode() (CVSS 9.8, Linux)
- [CVE-2026-52954](https://cve.now/CVE-2026-52954.md): libceph: handle rbtree insertion error in decode\_choose\_args() (CVSS 7.5, Linux)
- [CVE-2026-52953](https://cve.now/CVE-2026-52953.md): iommu/vt-d: Fix oops due to out of scope access (CVSS 7.1, Linux)
- [CVE-2026-52952](https://cve.now/CVE-2026-52952.md): iommu: Fix WARN\_ON in \_\_iommu\_group\_set\_domain\_nofail() due to reset (CVSS 8.8, Linux)
- [CVE-2026-52951](https://cve.now/CVE-2026-52951.md): drm/xe/dma-buf: handle empty bo and UAF races (CVSS 7.8, Linux)
- [CVE-2026-52950](https://cve.now/CVE-2026-52950.md): drm/xe/dma-buf: fix UAF with retry loop (CVSS 7.8, Linux)
- [CVE-2026-52949](https://cve.now/CVE-2026-52949.md): drm/ttm: Fix ttm\_bo\_shrink() infinite LRU walk on backup failure (no CVSS, Linux)
- [CVE-2026-52948](https://cve.now/CVE-2026-52948.md): i2c: dev: prevent integer overflow in I2C\_TIMEOUT ioctl (no CVSS, Linux)
- [CVE-2026-52947](https://cve.now/CVE-2026-52947.md): net: qrtr: fix refcount saturation and potential UAF in qrtr\_port\_remove (CVSS 7.8, Linux)
- [CVE-2026-52946](https://cve.now/CVE-2026-52946.md): fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (CVSS 7.5, Linux)
- [CVE-2026-52945](https://cve.now/CVE-2026-52945.md): Revert "wireguard: device: enable threaded NAPI" (CVSS 7.5, Linux)
- [CVE-2026-54297](https://cve.now/CVE-2026-54297.md): Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters (CVSS 7.5, lostisland faraday · faraday)
- [CVE-2026-54906](https://cve.now/CVE-2026-54906.md): concurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption (CVSS 2.1, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54904](https://cve.now/CVE-2026-54904.md): concurrent-ruby: \`AtomicReference#update\` livelocks when the stored value is \`Float::NAN\` (CVSS 8.2, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-54905](https://cve.now/CVE-2026-54905.md): concurrent-ruby: \`ReentrantReadWriteLock\` read-count overflow grants a write lock without exclusivity (CVSS 2.0, ruby-concurrency concurrent-ruby · concurrent-ruby)
- [CVE-2026-13164](https://cve.now/CVE-2026-13164.md): Unauthenticated self-registration in MailerUp allows access to stored email data (CVSS 8.8, Mailerup)
- [CVE-2026-50712](https://cve.now/CVE-2026-50712.md): Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-50711](https://cve.now/CVE-2026-50711.md): Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50710](https://cve.now/CVE-2026-50710.md): Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters\_config (CVSS 4.6, Frappe Framework)
- [CVE-2026-50709](https://cve.now/CVE-2026-50709.md): Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-55488](https://cve.now/CVE-2026-55488.md): motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read (CVSS 7.7, motioneye-project motioneye · motioneye)
- [CVE-2026-50708](https://cve.now/CVE-2026-50708.md): Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-50705](https://cve.now/CVE-2026-50705.md): Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-56121](https://cve.now/CVE-2026-56121.md): Feast \< 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization (CVSS 9.3, feast-dev feast)
- [CVE-2026-50704](https://cve.now/CVE-2026-50704.md): Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50703](https://cve.now/CVE-2026-50703.md): Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering (CVSS 4.8, Frappe Framework)
- [CVE-2026-50701](https://cve.now/CVE-2026-50701.md): Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering (CVSS 5.1, Frappe Framework)
- [CVE-2026-56111](https://cve.now/CVE-2026-56111.md): Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler (CVSS 8.3, MarlinFirmware Marlin)
- [CVE-2026-50700](https://cve.now/CVE-2026-50700.md): Frappe Framework 17.0.0-dev - Stored XSS in frappe.get\_avatar image rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50699](https://cve.now/CVE-2026-50699.md): Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-50698](https://cve.now/CVE-2026-50698.md): Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering (CVSS 4.6, Frappe Framework)
- [CVE-2026-12986](https://cve.now/CVE-2026-12986.md): A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows th (CVSS 7.3, Payara Server · fish.payara.distributions:payara)
- [CVE-2026-11877](https://cve.now/CVE-2026-11877.md): Missing Authorization Vulnerability in OpenText Access Manager (CVSS 6.3, OpenText Access Manager)
- [CVE-2026-11878](https://cve.now/CVE-2026-11878.md): Reflected Cross-Site Scripting vulnerability in OpenText Access Manager (CVSS 8.2, OpenText Access Manager)
- [CVE-2026-12537](https://cve.now/CVE-2026-12537.md): Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows (CVSS 10.0, Google Cloud Gemini CLI · Google Cloud run-gemini-cli Gi… +2)
- [CVE-2026-35025](https://cve.now/CVE-2026-35025.md): ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR (CVSS 8.6, ProFTPD Project ProFTPD)
- [CVE-2026-57307](https://cve.now/CVE-2026-57307.md): A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers with Overall/Read permission (CVSS 4.2, Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…)
- [CVE-2026-57306](https://cve.now/CVE-2026-57306.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b\_450b\_1 and earlier allows attackers to co (CVSS 4.2, Jenkins Project Jenkins Zowe zDevOps Plugin · io.jenkins.pl…)
- [CVE-2026-57305](https://cve.now/CVE-2026-57305.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-spec (CVSS 5.4, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57304](https://cve.now/CVE-2026-57304.md): A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacke (CVSS 5.4, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57303](https://cve.now/CVE-2026-57303.md): Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers a (CVSS 7.1, Jenkins Project Jenkins Assembla Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57302](https://cve.now/CVE-2026-57302.md): Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be v (CVSS 4.3, Jenkins Project Jenkins FitNesse Plugin · org.jenkins-ci.pl…)
- [CVE-2026-57301](https://cve.now/CVE-2026-57301.md): Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing atta (CVSS 8.8, Jenkins Project Jenkins OWASP ZAP Plugin · org.jenkins-ci.p…)
- [CVE-2026-57300](https://cve.now/CVE-2026-57300.md): A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb\_2557fe and earlier allows attackers with Item/Read permission to read (CVSS 4.3, Jenkins Project Jenkins MCP Server Plugin · io.jenkins.plug…)
- [CVE-2026-57299](https://cve.now/CVE-2026-57299.md): Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read perm (CVSS 4.3, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57298](https://cve.now/CVE-2026-57298.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attacke (CVSS 5.4, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57297](https://cve.now/CVE-2026-57297.md): A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read pe (CVSS 5.4, Jenkins Project Jenkins Contrast Continuous Application Sec…)
- [CVE-2026-57296](https://cve.now/CVE-2026-57296.md): Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided t (CVSS 8.8, Jenkins Project Jenkins External Workspace Manager Plugin ·…)
- [CVE-2026-57295](https://cve.now/CVE-2026-57295.md): A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers to conne (CVSS 5.4, Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…)
- [CVE-2026-57294](https://cve.now/CVE-2026-57294.md): A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a\_81c3 and earlier allows attackers with Overall/Read permission to (CVSS 5.4, Jenkins Project Jenkins EC2 Fleet Plugin · com.amazon.jenki…)
- [CVE-2026-57293](https://cve.now/CVE-2026-57293.md): An incorrect permission check in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers with global Item/Configure permissi (CVSS 4.3, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57292](https://cve.now/CVE-2026-57292.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allows attackers to connect to a (CVSS 5.4, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57291](https://cve.now/CVE-2026-57291.md): Missing permission checks in Jenkins Gitee Plugin 1288.v18b\_deb\_c9069b\_ and earlier allow attackers with Overall/Read permission to connect (CVSS 5.4, Jenkins Project Jenkins Gitee Plugin · org.jenkins-ci.plugi…)
- [CVE-2026-57290](https://cve.now/CVE-2026-57290.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b\_84449 and earlier allows attackers to overw (CVSS 4.3, Jenkins Project Jenkins Priority Sorter Plugin · org.jenkin…)
- [CVE-2026-57289](https://cve.now/CVE-2026-57289.md): Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for co (CVSS 4.8, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2026-42450](https://cve.now/CVE-2026-42450.md): OpenColorIO vulnerable to stack buffer overflow via unbounded \`sscanf %s\` in Spi3D (.spi3d) LUT parser (CVSS 8.4, AcademySoftwareFoundation OpenColorIO)
- [CVE-2026-57288](https://cve.now/CVE-2026-57288.md): Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows nativ (CVSS 3.7, Jenkins Project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2026-57287](https://cve.now/CVE-2026-57287.md): Jenkins Job Configuration History Plugin 1356.ve360da\_6c523a\_ and earlier does not redact the encrypted values of secrets when displaying hi (CVSS 4.3, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2026-57286](https://cve.now/CVE-2026-57286.md): A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca\_ and earlier allows attackers with Item/Read permission to obta (CVSS 4.3, Jenkins Project Jenkins Git Parameter Plugin · org.jenkins-…)
- [CVE-2026-57285](https://cve.now/CVE-2026-57285.md): A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read per (CVSS 4.3, Jenkins Project Jenkins GitHub Branch Source Plugin · org.j…)
- [CVE-2026-57284](https://cve.now/CVE-2026-57284.md): Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Sni (CVSS 4.3, Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…)
- [CVE-2026-57283](https://cve.now/CVE-2026-57283.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to inst (CVSS 4.3, Jenkins Project Jenkins Pipeline: Groovy Plugin · io.jenkin…)
- [CVE-2026-57282](https://cve.now/CVE-2026-57282.md): Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace directory name when it is embedded into a generated SSH (CVSS 5.0, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2026-57281](https://cve.now/CVE-2026-57281.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions m (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-57280](https://cve.now/CVE-2026-57280.md): Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed fo (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2026-13163](https://cve.now/CVE-2026-13163.md): Lack of input validation in Mailerup input parameter leads to Open Redirect (CVSS 5.3, Mailerup)
- [CVE-2026-12242](https://cve.now/CVE-2026-12242.md): AdRotate Banner Manager \<= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute (CVSS 8.8, adegans AdRotate Banner Manager)
- [CVE-2026-56761](https://cve.now/CVE-2026-56761.md): hono - HTML Injection via Improper JSX Attribute Name Handling in SSR (CVSS 5.3, hono)
- [CVE-2026-56370](https://cve.now/CVE-2026-56370.md): ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56368](https://cve.now/CVE-2026-56368.md): ImageMagick - Memory Leak in Raw Pixel Data Coders (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56358](https://cve.now/CVE-2026-56358.md): n8n - Stored Cross-Site Scripting in Form Trigger Node (CVSS 5.1, n8n)
- [CVE-2026-56351](https://cve.now/CVE-2026-56351.md): n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes (CVSS 5.3, n8n)
- [CVE-2026-56338](https://cve.now/CVE-2026-56338.md): Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56337](https://cve.now/CVE-2026-56337.md): Capgo - Information Disclosure via Unauthenticated RPC Function exist\_app\_v2 (CVSS 6.9, Capgo)
- [CVE-2026-56310](https://cve.now/CVE-2026-56310.md): Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass (CVSS 5.3, Cap-go capgo)
- [CVE-2026-56302](https://cve.now/CVE-2026-56302.md): Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security (CVSS 6.9, Capgo)
- [CVE-2026-56272](https://cve.now/CVE-2026-56272.md): Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing (CVSS 5.6, Flowise)
- [CVE-2026-56270](https://cve.now/CVE-2026-56270.md): Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint (CVSS 8.7, Flowise)
- [CVE-2026-56269](https://cve.now/CVE-2026-56269.md): Flowise - Weak Default Token Hash Secret in JWT Token Encryption (CVSS 4.3, Flowise)
- [CVE-2026-56262](https://cve.now/CVE-2026-56262.md): Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server (CVSS 6.9, Crawl4AI)
- [CVE-2026-56257](https://cve.now/CVE-2026-56257.md): Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update (CVSS 7.1, Capgo)
- [CVE-2026-56256](https://cve.now/CVE-2026-56256.md): Capgo - Two-Factor Authentication Bypass via Organization Management API (CVSS 7.1, Capgo)
- [CVE-2026-56245](https://cve.now/CVE-2026-56245.md): Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record\_build\_time RPC (CVSS 8.8, Cap-go capgo)
- [CVE-2026-56244](https://cve.now/CVE-2026-56244.md): Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key (CVSS 7.1, Capgo)
- [CVE-2026-56237](https://cve.now/CVE-2026-56237.md): Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation (CVSS 9.3, Capgo)
- [CVE-2026-56232](https://cve.now/CVE-2026-56232.md): Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header (CVSS 8.7, Capgo)
- [CVE-2026-56231](https://cve.now/CVE-2026-56231.md): Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter (CVSS 7.2, Capgo)
- [CVE-2026-56223](https://cve.now/CVE-2026-56223.md): Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user (CVSS 9.3, Capgo)
- [CVE-2025-71361](https://cve.now/CVE-2025-71361.md): picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch\_tip (CVSS 7.6, picklescan)
- [CVE-2025-71354](https://cve.now/CVE-2025-71354.md): picklescan - Remote Code Execution via idlelib.debugobj.ObjectTreeItem.SetText (CVSS 7.6, picklescan)
- [CVE-2025-71332](https://cve.now/CVE-2025-71332.md): Flowise - SQL Injection in importChatflows API via chatflow.id Parameter (CVSS 8.5, Flowise)
- [CVE-2026-13140](https://cve.now/CVE-2026-13140.md): Stored Cross-Site Scripting in Canarytokens.org (CVSS 1.1, Thinkst Applied Research Canarytokens)
- [CVE-2026-13150](https://cve.now/CVE-2026-13150.md): SSRF in Pentestify PDF generation endpoint via Host header (CVSS 6.9, Pentestify)
- [CVE-2026-52944](https://cve.now/CVE-2026-52944.md): ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL\_SET\_SPARSE (no CVSS, Linux)
- [CVE-2026-11968](https://cve.now/CVE-2026-11968.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in TortoiseGit (CVSS 5.5, TortoiseGit team TortoiseGit)
- [CVE-2026-52943](https://cve.now/CVE-2026-52943.md): net: skbuff: fix missing zerocopy reference in pskb\_carve helpers (CVSS 7.8, Linux)
- [CVE-2026-10745](https://cve.now/CVE-2026-10745.md): Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injectio (CVSS 7.9, upKeeper Solutions upKeeper Instant Privilege Access)
- [CVE-2026-56052](https://cve.now/CVE-2026-56052.md): WordPress Funnel Builder by FunnelKit plugin \<= 3.15.0.5 - SQL Injection vulnerability (CVSS 7.6, Funnel Builder by FunnelKit)
- [CVE-2026-52942](https://cve.now/CVE-2026-52942.md): netfilter: nf\_log: validate MAC header was set before dumping it (CVSS 7.1, Linux)
- [CVE-2026-52941](https://cve.now/CVE-2026-52941.md): net/smc: avoid NULL deref of conn-\>lnk in smc\_msg\_event tracepoint (no CVSS, Linux)
- [CVE-2026-52940](https://cve.now/CVE-2026-52940.md): tun: zero the whole vnet header in tun\_put\_user() (no CVSS, Linux)
- [CVE-2026-52939](https://cve.now/CVE-2026-52939.md): net/rds: fix NULL deref in rds\_ib\_send\_cqe\_handler() on masked atomic completion (no CVSS, Linux)
- [CVE-2026-52938](https://cve.now/CVE-2026-52938.md): bpf: Fix NULL pointer dereference in bpf\_sk\_storage\_clone and diag paths (no CVSS, Linux)
- [CVE-2026-52937](https://cve.now/CVE-2026-52937.md): tap: fix stack info leak in tap\_ioctl() SIOCGIFHWADDR (no CVSS, Linux)
- [CVE-2026-52936](https://cve.now/CVE-2026-52936.md): crypto: jitterentropy - replace long-held spinlock with mutex (no CVSS, Linux)
- [CVE-2026-52935](https://cve.now/CVE-2026-52935.md): xfrm: espintcp: do not reuse an in-progress partial send (CVSS 7.8, Linux)
- [CVE-2026-52934](https://cve.now/CVE-2026-52934.md): batman-adv: tvlv: reject oversized TVLV packets (CVSS 8.8, Linux)
- [CVE-2026-52933](https://cve.now/CVE-2026-52933.md): io\_uring/poll: fix signed comparison in io\_poll\_get\_ownership() (CVSS 7.8, Linux)
- [CVE-2026-52932](https://cve.now/CVE-2026-52932.md): xfrm: ipcomp: Free destination pages on acomp errors (CVSS 7.5, Linux)
- [CVE-2026-52931](https://cve.now/CVE-2026-52931.md): batman-adv: tp\_meter: avoid use of uninit sender vars (CVSS 9.8, Linux)
- [CVE-2026-52930](https://cve.now/CVE-2026-52930.md): ipc/shm: serialize orphan cleanup with shm\_nattch updates (no CVSS, Linux)
- [CVE-2026-52929](https://cve.now/CVE-2026-52929.md): sctp: stream: fully roll back denied add-stream state (CVSS 7.5, Linux)
- [CVE-2026-52928](https://cve.now/CVE-2026-52928.md): af\_unix: Reject SIOCATMARK on non-stream sockets (no CVSS, Linux)
- [CVE-2026-52927](https://cve.now/CVE-2026-52927.md): netfilter: ebtables: fix OOB read in compat\_mtw\_from\_user (CVSS 7.8, Linux)
- [CVE-2026-52926](https://cve.now/CVE-2026-52926.md): batman-adv: clear current gateway during teardown (no CVSS, Linux)
- [CVE-2026-52925](https://cve.now/CVE-2026-52925.md): vrf: Fix a potential NPD when removing a port from a VRF (no CVSS, Linux)
- [CVE-2026-52924](https://cve.now/CVE-2026-52924.md): sctp: purge outqueue on stale COOKIE-ECHO handling (CVSS 9.8, Linux)
- [CVE-2026-52923](https://cve.now/CVE-2026-52923.md): ipc: limit next\_id allocation to the valid ID range (CVSS 7.8, Linux)
- [CVE-2026-52922](https://cve.now/CVE-2026-52922.md): batman-adv: dat: handle forward allocation error (CVSS 7.5, Linux)
- [CVE-2026-52921](https://cve.now/CVE-2026-52921.md): netfilter: ipset: stop hash:\* range iteration at end (no CVSS, Linux)
- [CVE-2026-52920](https://cve.now/CVE-2026-52920.md): netfilter: xt\_policy: fix strict mode inbound policy matching (CVSS 8.3, Linux)
- [CVE-2026-52919](https://cve.now/CVE-2026-52919.md): batman-adv: fix tp\_meter counter underflow during shutdown (CVSS 7.8, Linux)
- [CVE-2026-52918](https://cve.now/CVE-2026-52918.md): Bluetooth: serialize accept\_q access (CVSS 8.8, Linux)
- [CVE-2026-52917](https://cve.now/CVE-2026-52917.md): sctp: diag: reject stale associations in dump\_one path (CVSS 7.1, Linux)
- [CVE-2026-52916](https://cve.now/CVE-2026-52916.md): batman-adv: frag: disallow unicast fragment in fragment (no CVSS, Linux)
- [CVE-2026-52915](https://cve.now/CVE-2026-52915.md): netfilter: ip6t\_hbh: reject oversized option lists (CVSS 7.1, Linux)
- [CVE-2026-52914](https://cve.now/CVE-2026-52914.md): batman-adv: fix fragment reassembly length accounting (CVSS 9.8, Linux)
- [CVE-2026-52913](https://cve.now/CVE-2026-52913.md): batman-adv: v: stop OGMv2 on disabled interface (no CVSS, Linux)
- [CVE-2026-52912](https://cve.now/CVE-2026-52912.md): netfilter: nf\_queue: hold bridge skb-\>dev while queued (CVSS 7.8, Linux)
- [CVE-2026-7761](https://cve.now/CVE-2026-7761.md): Ultimate Member \<= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure (CVSS 8.8, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-9710](https://cve.now/CVE-2026-9710.md): Themeco Cornerstone \< 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure (CVSS 7.7, Cornerstone)
- [CVE-2026-9709](https://cve.now/CVE-2026-9709.md): Themeco Cornerstone \< 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure (CVSS 7.7, Cornerstone)
- [CVE-2026-10753](https://cve.now/CVE-2026-10753.md): Site Kit by Google \< 1.176.0 - Editor+ Email Reporting Settings Update (CVSS 2.7, Site Kit by Google)
- [CVE-2026-10749](https://cve.now/CVE-2026-10749.md): Post Duplicator \< 3.0.15 - Contributor+ PHP Object Injection via customMetaData (CVSS 7.2, Post Duplicator)
- [CVE-2026-10735](https://cve.now/CVE-2026-10735.md): ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server (CVSS 7.5, smart-post-show-pro · Real Testimonials Pro +1)
- [CVE-2026-10531](https://cve.now/CVE-2026-10531.md): AI Share & Summarize \< 2.0.4 - Contributor+ Stored XSS via title\_style Shortcode Attribute (CVSS 5.4, AI Share & Summarize)
- [CVE-2026-13006](https://cve.now/CVE-2026-13006.md): Incomplete protection against CVE-2025-11226 (CVSS 7.0, QOS.CH Sarl Logback-core)
- [CVE-2026-8690](https://cve.now/CVE-2026-8690.md): RentMy Real-Time Rental Management Plugin \<= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy\_cdn\_request AJAX Action (CVSS 5.3, RentMy Real-Time Rental Management Plugin)
- [CVE-2026-9178](https://cve.now/CVE-2026-9178.md): WP Forms Connector \<= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint (CVSS 7.5, hancock11 WP Forms Connector)
- [CVE-2026-11997](https://cve.now/CVE-2026-11997.md): Bulk SEO Image \<= 1.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, seo\_tools Bulk SEO Image)
- [CVE-2026-8622](https://cve.now/CVE-2026-8622.md): Image Sizes on Demand \<= 1.3 - Reflected Cross-Site Scripting via PHP\_SELF Server Variable (CVSS 6.1, pixelwelt Image Sizes on Demand)
- [CVE-2026-9612](https://cve.now/CVE-2026-9612.md): WhatsOrder \<= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs (CVSS 5.3, yapacdev WhatsOrder – Instant Checkout for WooCommerce)
- [CVE-2026-8688](https://cve.now/CVE-2026-8688.md): Advance Nav Menu Manager \<= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm\_save\_menu\_data AJAX Action (CVSS 4.3, krishaweb Advance Nav Menu Manager)
- [CVE-2026-9620](https://cve.now/CVE-2026-9620.md): WP Latest Posts \<= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute (CVSS 6.4, joomunited WP Latest Posts)
- [CVE-2026-8865](https://cve.now/CVE-2026-8865.md): Avalon23 Products Filter for WooCommerce \<= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, paradigmatools Avalon23 Products Filter for WooCommerce)
- [CVE-2026-8896](https://cve.now/CVE-2026-8896.md): MIR blocks and shortcodes \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, mirsoftware MIR blocks and shortcodes)
- [CVE-2026-9183](https://cve.now/CVE-2026-9183.md): 24liveblog \<= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization (CVSS 4.3, 24liveblog – live blog tool)
- [CVE-2026-12416](https://cve.now/CVE-2026-12416.md): Invoice Generator \<= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset\_user\_id' Parameter (CVSS 9.8, pravel Invoice Generator)
- [CVE-2026-12417](https://cve.now/CVE-2026-12417.md): SignUp & SignIn \<= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset\_activation\_code' Leading to Account Takeover (CVSS 9.8, pravel SignUp & SignIn)
- [CVE-2026-9643](https://cve.now/CVE-2026-9643.md): WP Meta SEO \<= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST\_URI in 404 Logging (CVSS 7.2, joomunited WP Meta SEO)
- [CVE-2026-9172](https://cve.now/CVE-2026-9172.md): Devs Accounting \<= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint (CVSS 5.3, ajitdas Devs Accounting – Simple Accounting and Invoicing S…)
- [CVE-2026-6292](https://cve.now/CVE-2026-6292.md): MP Customize Login Page \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, manuelpadillac MP Customize Login Page)
- [CVE-2026-9616](https://cve.now/CVE-2026-9616.md): Generate Security.txt \<= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete\_securitytxt AJAX Action (CVSS 4.3, verenigingvanregistrars Generate Security.txt)
- [CVE-2026-8617](https://cve.now/CVE-2026-8617.md): SearchPlus \<= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus\_save\_token & searchplus\_reset\_token AJAX Actions (CVSS 5.3, ailchev SearchPlus)
- [CVE-2026-9184](https://cve.now/CVE-2026-9184.md): 24liveblog \<= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update\_lb24\_token AJAX action (CVSS 4.3, 24liveblog – live blog tool)
- [CVE-2026-8705](https://cve.now/CVE-2026-8705.md): ClearSale Total \<= 3.4.2 - Unauthenticated SQL Injection (CVSS 7.5, ClearSale Total)
- [CVE-2026-8628](https://cve.now/CVE-2026-8628.md): EntreDroppers \<= 1.1.2 - Reflected Cross-Site Scripting via PHP\_SELF Parameter (CVSS 6.1, owencutajar EntreDroppers)
- [CVE-2026-12095](https://cve.now/CVE-2026-12095.md): Kargo Takip \<= 1.2 - Unauthenticated Server-Side Request Forgery via 'api\_url' Parameter (CVSS 7.2, bytuncay Kargo Takip)
- [CVE-2026-10552](https://cve.now/CVE-2026-10552.md): Blue Captcha \<= 2.0.1 - Cross-Site Request Forgery via 'blcap\_action' Parameter (CVSS 4.3, jotis Blue Captcha)
- [CVE-2026-8614](https://cve.now/CVE-2026-8614.md): Assistio \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio\_plugin\_delete\_assistio\_settings AJAX Action (CVSS 4.3, assistioai Assistio)
- [CVE-2026-7617](https://cve.now/CVE-2026-7617.md): Secufor\_OAuth \<= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth\_unregister\_action' AJAX Action (CVSS 5.3, Secufor\_OAuth)
- [CVE-2026-9619](https://cve.now/CVE-2026-9619.md): Reviews and Rating \<= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync\_reviews AJAX Action (CVSS 4.3, berfect Reviews and Rating – Docplanner)
- [CVE-2026-9724](https://cve.now/CVE-2026-9724.md): MotorDesk \<= 1.1.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, MotorDesk)
- [CVE-2026-4297](https://cve.now/CVE-2026-4297.md): Welcome Software Publishing \<= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method (CVSS 8.8, newscred Welcome Software Publishing)
- [CVE-2026-12094](https://cve.now/CVE-2026-12094.md): Advanced Contact Form 7 \<= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form\_id' Parameter (CVSS 5.3, iamranit Advanced Contact Form 7 – Compact DB)
- [CVE-2026-10092](https://cve.now/CVE-2026-10092.md): Cincopa video and media plug-in \<= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments (CVSS 7.2, nicashmu Cincopa video and media plug-in)
- [CVE-2026-9179](https://cve.now/CVE-2026-9179.md): WP Forms Connector \<= 1.8 - Unauthenticated SQL Injection via 'order' Parameter (CVSS 7.5, hancock11 WP Forms Connector)
- [CVE-2026-11370](https://cve.now/CVE-2026-11370.md): WP Meta SEO \<= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new\_link' Parameter (CVSS 6.4, joomunited WP Meta SEO)
- [CVE-2026-9175](https://cve.now/CVE-2026-9175.md): Devs Accounting \<= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter (CVSS 5.3, ajitdas Devs Accounting – Simple Accounting and Invoicing S…)
- [CVE-2026-9721](https://cve.now/CVE-2026-9721.md): Book a Room Event Calendar \<= 1.9 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, chuhpl Book a Room Event Calendar)
- [CVE-2026-10091](https://cve.now/CVE-2026-10091.md): Email JavaScript Cloak \<= 1.03 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, cgarvey Email JavaScript Cloak)
- [CVE-2026-12100](https://cve.now/CVE-2026-12100.md): URL Preview \<= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (CVSS 7.2, abhisheksaha11 URL Preview)
- [CVE-2026-8905](https://cve.now/CVE-2026-8905.md): Osiris Signature Banner \<= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend\_text' Parameter (CVSS 6.1, osiris8 Osiris Signature Banner)
- [CVE-2026-9539](https://cve.now/CVE-2026-9539.md): libslirp TCP URG OOB Read Information Leak (CVSS 6.5, freedesktop.org libslirp)
- [CVE-2026-12851](https://cve.now/CVE-2026-12851.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12850](https://cve.now/CVE-2026-12850.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12849](https://cve.now/CVE-2026-12849.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12486](https://cve.now/CVE-2026-12486.md): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (CVSS 9.1, GeoVision GV-I/O Box)
- [CVE-2026-12848](https://cve.now/CVE-2026-12848.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12847](https://cve.now/CVE-2026-12847.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12846](https://cve.now/CVE-2026-12846.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12485](https://cve.now/CVE-2026-12485.md): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD\_IP\_SET command (CVSS 10.0, GeoVision GV-I/O Box)
- [CVE-2026-12488](https://cve.now/CVE-2026-12488.md): GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability (CVSS 6.2, GeoVision)
- [CVE-2026-3652](https://cve.now/CVE-2026-3652.md): ARForms \<= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter (CVSS 7.2, ARforms)
- [CVE-2026-11614](https://cve.now/CVE-2026-11614.md): Xpro Addons \<= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom\_attributes' Parameter of Multiple Widgets (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-12681](https://cve.now/CVE-2026-12681.md): Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. (CVSS 8.9, Google go-attestation · github.com/google/go-attestation)
- [CVE-2026-54639](https://cve.now/CVE-2026-54639.md): Style Dictionary - Prototype Pollution in convertTokenData utility function (CVSS 8.8, style-dictionary)
- [CVE-2025-60466](https://cve.now/CVE-2025-60466.md): A use-after-free in the gf\_filter\_pid\_get\_packet function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers (CVSS 5.0)
- [CVE-2025-60467](https://cve.now/CVE-2025-60467.md): A use-after-free in the gf\_filter\_pid\_inst\_swap\_delete\_task function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 allow (CVSS 7.5)
- [CVE-2025-60468](https://cve.now/CVE-2025-60468.md): GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. (CVSS 5.5)
- [CVE-2025-60471](https://cve.now/CVE-2025-60471.md): A use-after-free in the gf\_filter\_pid\_reconfigure\_task\_discard function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 al (CVSS 5.5)
- [CVE-2025-60473](https://cve.now/CVE-2025-60473.md): A NULL pointer dereference in the gf\_filter\_in\_parent\_chain function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 allow (CVSS 5.5)
- [CVE-2025-60474](https://cve.now/CVE-2025-60474.md): A buffer overflow in the gf\_media\_import function (/media\_tools/av\_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus (CVSS 7.5)
- [CVE-2026-49269](https://cve.now/CVE-2026-49269.md): Apple M1 GPUs retain register file data between compute shader dispatches from different processes. (CVSS 8.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.