# CVEs published 2026-06-25

466 CVEs were published on June 25, 2026: 36 critical, 207 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-9222](https://cve.now/CVE-2026-9222.md): Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication (CVSS 9.2, Shenzhen i365-Tech Co. Setracker2 Parental Control App (And…)
- [CVE-2026-9221](https://cve.now/CVE-2026-9221.md): Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm (CVSS 8.7, Shenzhen i365-Tech Co. Setracker2 Parental Control App (And…)
- [CVE-2026-13083](https://cve.now/CVE-2026-13083.md): Pen-drive: pen-drive: stored xss via unescaped cluster data in html report (CVSS 6.9, Pen Drive Powered by Red Hat Lightspeed)
- [CVE-2026-13318](https://cve.now/CVE-2026-13318.md): Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip (CVSS 6.4, Red Hat OpenShift Virtualization)
- [CVE-2026-13218](https://cve.now/CVE-2026-13218.md): Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher (CVSS 4.2, Red Hat OpenShift Virtualization)
- [CVE-2026-12993](https://cve.now/CVE-2026-12993.md): Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset (CVSS 6.5, Red Hat build of Apicurio Registry)
- [CVE-2026-9220](https://cve.now/CVE-2026-9220.md): Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key (CVSS 8.7, Shenzhen i365-Tech Co. Setracker2 Parental Control App (And…)
- [CVE-2026-9219](https://cve.now/CVE-2026-9219.md): Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers (CVSS 8.3, Shenzhen i365-Tech Co. Setracker2 Parental Control App (And…)
- [CVE-2026-43920](https://cve.now/CVE-2026-43920.md): FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution (CVSS 6.9, FOSSBilling)
- [CVE-2026-40941](https://cve.now/CVE-2026-40941.md): Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages (CVSS 7.1, cacti)
- [CVE-2026-40084](https://cve.now/CVE-2026-40084.md): Cacti: Arbitrary File Read via Path Traversal in Report \`format\_file\` Parameter (CVSS 6.5, cacti)
- [CVE-2026-40083](https://cve.now/CVE-2026-40083.md): Cacti: SQL Injection in managers.php (CVSS 7.2, cacti)
- [CVE-2026-40082](https://cve.now/CVE-2026-40082.md): Cacti: Session Fixation via missing session\_regenerate\_id() after login (CVSS 5.4, cacti)
- [CVE-2026-40080](https://cve.now/CVE-2026-40080.md): Cacti: Open Redirect via HTTP\_REFERER substring check in auth\_login\_redirect (CVSS 6.1, cacti)
- [CVE-2026-13283](https://cve.now/CVE-2026-13283.md): Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in s (CVSS 7.5, Google Chrome)
- [CVE-2026-13282](https://cve.now/CVE-2026-13282.md): Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corrupti (CVSS 6.8, Google Chrome)
- [CVE-2026-13281](https://cve.now/CVE-2026-13281.md): Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to pote (CVSS 8.3, Google Chrome)
- [CVE-2026-22879](https://cve.now/CVE-2026-22879.md): A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2 (CVSS 8.1, vtk)
- [CVE-2025-71340](https://cve.now/CVE-2025-71340.md): picklescan - Remote Code Execution via idlelib.pyshell.ModifiedInterpreter.runcode (CVSS 7.6, picklescan)
- [CVE-2025-71338](https://cve.now/CVE-2025-71338.md): Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API (CVSS 10.0, Flowise)
- [CVE-2025-71336](https://cve.now/CVE-2025-71336.md): Flowise - Unsandboxed Remote Code Execution via Custom MCP (CVSS 9.3, Flowise)
- [CVE-2025-71335](https://cve.now/CVE-2025-71335.md): Flowise - Session Invalidation Failure After Password Change (CVSS 8.6, Flowise)
- [CVE-2025-71334](https://cve.now/CVE-2025-71334.md): Flowise - Arbitrary File Access via Missing Chat Flow ID Validation (CVSS 9.3, Flowise)
- [CVE-2025-71333](https://cve.now/CVE-2025-71333.md): Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint (CVSS 9.3, Flowise)
- [CVE-2025-71328](https://cve.now/CVE-2025-71328.md): Flowise - Unverified Password Change via Account Settings (CVSS 8.7, Flowise · flowise-ui)
- [CVE-2025-71327](https://cve.now/CVE-2025-71327.md): Flowise - Authentication Bypass via Unprotected Registration Endpoint (CVSS 9.3, Flowise)
- [CVE-2025-71324](https://cve.now/CVE-2025-71324.md): Flowise - Arbitrary File Read via chatId Parameter (CVSS 8.7, Flowise)
- [CVE-2021-47987](https://cve.now/CVE-2021-47987.md): Parse Server - Arbitrary Code Execution via Malicious Version Tags (CVSS 7.7, parse-community parse-server · parse-server)
- [CVE-2021-47986](https://cve.now/CVE-2021-47986.md): Parse Server - Unreviewed Code Execution via Malicious Version Tags (CVSS 7.7, parse-community parse-server · parse-server)
- [CVE-2020-37256](https://cve.now/CVE-2020-37256.md): Grav - Cross-Site Scripting in Admin Plugin Page Editor (CVSS 5.1, Grav · getgrav/grav)
- [CVE-2026-7511](https://cve.now/CVE-2026-7511.md): PKCS7\_verify signer confusion allows forged signatures to be accepted (CVSS 5.9, wolfSSL)
- [CVE-2026-7532](https://cve.now/CVE-2026-7532.md): iPAddress name constraints not enforced when WOLFSSL\_IP\_ALT\_NAME is undefined (CVSS 5.7, wolfSSL)
- [CVE-2026-8720](https://cve.now/CVE-2026-8720.md): HMAC-BLAKE2 final discards message when key length exceeds block size (CVSS 5.9, wolfSSL)
- [CVE-2026-10098](https://cve.now/CVE-2026-10098.md): OCSP CertID serial-number length-confusion in wolfSSL\_OCSP\_resp\_find\_status (CVSS 6.3, wolfSSL)
- [CVE-2026-12992](https://cve.now/CVE-2026-12992.md): Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation (CVSS 7.4, Red Hat build of Apicurio Registry)
- [CVE-2026-11703](https://cve.now/CVE-2026-11703.md): Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption (CVSS 6.0, wolfSSL)
- [CVE-2026-55962](https://cve.now/CVE-2026-55962.md): TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify (CVSS 6.0, wolfSSL)
- [CVE-2026-12975](https://cve.now/CVE-2026-12975.md): Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos (CVSS 8.5, Red Hat build of Apicurio Registry)
- [CVE-2026-6092](https://cve.now/CVE-2026-6092.md): Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE\_ENCRYPT\_THEN\_MAC is configured (CVSS 2.1, wolfSSL)
- [CVE-2026-6325](https://cve.now/CVE-2026-6325.md): Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list (CVSS 2.0, wolfSSL)
- [CVE-2026-6329](https://cve.now/CVE-2026-6329.md): PKCS#12 MAC verification uses attacker-controlled comparison length (CVSS 6.0, wolfSSL)
- [CVE-2026-6330](https://cve.now/CVE-2026-6330.md): ML-KEM ARM64 NEON ciphertext comparison only compares half of the input (CVSS 6.3, wolfSSL)
- [CVE-2026-40702](https://cve.now/CVE-2026-40702.md): EVoke Systems EVoke CSMS Missing Authentication for Critical Function (CVSS 9.4, EVoke CSMS)
- [CVE-2026-50176](https://cve.now/CVE-2026-50176.md): EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, EVoke CSMS)
- [CVE-2026-11800](https://cve.now/CVE-2026-11800.md): Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion (CVSS 8.1, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-54479](https://cve.now/CVE-2026-54479.md): EVoke Systems EVoke CSMS Insufficient Session Expiration (CVSS 7.3, EVoke CSMS)
- [CVE-2026-6331](https://cve.now/CVE-2026-6331.md): HMAC zero-length tag forgery in EVP\_DigestVerifyFinal (CVSS 2.1, wolfSSL)
- [CVE-2026-44622](https://cve.now/CVE-2026-44622.md): EVoke Systems EVoke CSMS Insufficiently Protected Credentials (CVSS 6.5, EVoke CSMS)
- [CVE-2026-56445](https://cve.now/CVE-2026-56445.md): pydicom pynetdicom Library Path Traversal (CVSS 8.8, pydicom pynetdicom Library)
- [CVE-2026-12473](https://cve.now/CVE-2026-12473.md): OHIF Viewers DICOM Server-Side request forgery (CVSS 8.3, Open Health Imaging Foundation (OHIF) DICOM Web Viewer Fram…)
- [CVE-2026-6412](https://cve.now/CVE-2026-6412.md): Continued acceptance of SHA-1/MD5 digests in certificate processing (CVSS 2.3, wolfSSL)
- [CVE-2026-6450](https://cve.now/CVE-2026-6450.md): CRL critical extension bypass in ParseCRL\_Extensions (CVSS 1.0, wolfSSL)
- [CVE-2026-6678](https://cve.now/CVE-2026-6678.md): Integer underflow in wc\_PKCS7\_DecryptOri handling crafted Other Recipient Info (CVSS 1.0, wolfSSL)
- [CVE-2026-6679](https://cve.now/CVE-2026-6679.md): DTLS 1.3 ACK serialization heap buffer overflow via integer truncation (CVSS 8.8, wolfSSL)
- [CVE-2026-6681](https://cve.now/CVE-2026-6681.md): PKCS#7 decode ignores caller output buffer size, writing past buffer bounds (CVSS 1.0, wolfSSL)
- [CVE-2026-6731](https://cve.now/CVE-2026-6731.md): X.509 name constraint bypass via Subject CN treated as a DNS name (CVSS 6.0, wolfSSL)
- [CVE-2026-7531](https://cve.now/CVE-2026-7531.md): Use-after-free in PQC hybrid key-share handling (CVSS 2.3, wolfSSL)
- [CVE-2026-10097](https://cve.now/CVE-2026-10097.md): ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery (CVSS 8.3, wolfSSL)
- [CVE-2026-10512](https://cve.now/CVE-2026-10512.md): X25519 x86\_64 assembly final reduction leaves non-canonical field element (CVSS 2.3, wolfSSL)
- [CVE-2026-46602](https://cve.now/CVE-2026-46602.md): Lack of limit on tile sizes in x/image/tiff in golang.org/x/image (CVSS 7.5, golang.org/x/image/tiff · golang.org/x/image)
- [CVE-2026-46601](https://cve.now/CVE-2026-46601.md): Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image (CVSS 7.5, golang.org/x/image/webp · golang.org/x/image)
- [CVE-2026-10592](https://cve.now/CVE-2026-10592.md): Wildcard DNS SAN bypasses CA name-constraint checks (CVSS 6.3, wolfSSL)
- [CVE-2026-11310](https://cve.now/CVE-2026-11310.md): X.509 trust-chain bypass in wolfSSL\_X509\_verify\_cert() via untrusted intermediate anchoring (CVSS 8.7, wolfSSL)
- [CVE-2026-12340](https://cve.now/CVE-2026-12340.md): Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation (CVSS 6.3, wolfSSL)
- [CVE-2026-55958](https://cve.now/CVE-2026-55958.md): Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip\_StoreMessage (CVSS 8.3, wolfSSL)
- [CVE-2026-55960](https://cve.now/CVE-2026-55960.md): Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation (CVSS 8.2, wolfSSL)
- [CVE-2026-55964](https://cve.now/CVE-2026-55964.md): Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption) (CVSS 6.3, wolfSSL)
- [CVE-2026-57522](https://cve.now/CVE-2026-57522.md): Bitwarden Server \< 2026.5.0 JSON Injection via Webhook Templates (CVSS 2.3, bitwarden server)
- [CVE-2026-57521](https://cve.now/CVE-2026-57521.md): Bitwarden Server \< 2026.5.0 Broken Access Control via PreviewInvoiceController (CVSS 5.3, bitwarden server)
- [CVE-2026-57520](https://cve.now/CVE-2026-57520.md): Bitwarden Server \< 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint (CVSS 7.1, bitwarden server)
- [CVE-2026-2299](https://cve.now/CVE-2026-2299.md): Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint (CVSS 4.2, Mattermost Google Drive Plugin)
- [CVE-2026-50548](https://cve.now/CVE-2026-50548.md): Cursor Desktop sandbox escape via agent-controlled working directory (CVSS 9.3, cursor)
- [CVE-2026-50549](https://cve.now/CVE-2026-50549.md): Cursor Desktop sandbox escape via symlink and failed path canonicalization (CVSS 9.3, cursor)
- [CVE-2026-54917](https://cve.now/CVE-2026-54917.md): SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access (CVSS 7.8, seaweedfs · github.com/seaweedfs/seaweedfs)
- [CVE-2026-4930](https://cve.now/CVE-2026-4930.md): DPA Countermeasures weakening on Series 3 devices (CVSS 7.1, silabs.com Simplicity SDK)
- [CVE-2026-28898](https://cve.now/CVE-2026-28898.md): swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the transla (CVSS 5.3, Apple swift-nio-http2)
- [CVE-2026-56790](https://cve.now/CVE-2026-56790.md): CANBoat - Off-by-One Global Buffer Overflow in searchForPgn() (CVSS 7.0, canboat)
- [CVE-2026-56789](https://cve.now/CVE-2026-56789.md): RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count (CVSS 7.1, tomojitakasu RTKLIB)
- [CVE-2026-56788](https://cve.now/CVE-2026-56788.md): RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri (CVSS 4.8, tomojitakasu RTKLIB)
- [CVE-2026-56787](https://cve.now/CVE-2026-56787.md): RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode\_ssr3 via RTCM3 SSR Message (CVSS 6.9, tomojitakasu RTKLIB)
- [CVE-2026-56786](https://cve.now/CVE-2026-56786.md): RTKLIB 2.4.3 - Out-of-bounds Write in decode\_type1033 via Crafted RTCM3 Message (CVSS 9.3, tomojitakasu RTKLIB)
- [CVE-2026-56779](https://cve.now/CVE-2026-56779.md): MaxKB \< 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download\_url Parameters (CVSS 5.3, 1Panel-dev MaxKB)
- [CVE-2026-56774](https://cve.now/CVE-2026-56774.md): Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID (CVSS 5.3, kanboard)
- [CVE-2026-56772](https://cve.now/CVE-2026-56772.md): NewsBlur \< 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint (CVSS 5.3, samuelclay NewsBlur)
- [CVE-2026-56771](https://cve.now/CVE-2026-56771.md): NewsBlur \< 14.5.0 - Server-Side Request Forgery via add\_url Endpoint (CVSS 6.3, samuelclay NewsBlur)
- [CVE-2026-56770](https://cve.now/CVE-2026-56770.md): libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID (CVSS 8.7, schwehr libais)
- [CVE-2026-46608](https://cve.now/CVE-2026-46608.md): Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) (CVSS 7.4, nicolargo glances · glances)
- [CVE-2026-56769](https://cve.now/CVE-2026-56769.md): Huly Platform - Server-Side Request Forgery via /import Endpoint (CVSS 6.3, hcengineering platform)
- [CVE-2026-56768](https://cve.now/CVE-2026-56768.md): Seahub \< 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method (CVSS 8.7, haiwen seahub)
- [CVE-2026-46607](https://cve.now/CVE-2026-46607.md): Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution (CVSS 7.8, nicolargo glances · glances)
- [CVE-2026-53925](https://cve.now/CVE-2026-53925.md): Glances: Arbitrary file write and command execution via \`secure\_popen\` redirection and chaining operators in AMP command configuration (CVSS 7.8, nicolargo glances · glances)
- [CVE-2026-56767](https://cve.now/CVE-2026-56767.md): Maxun \< 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers (CVSS 8.7, getmaxun maxun)
- [CVE-2026-46606](https://cve.now/CVE-2026-46606.md): Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py (CVSS 7.8, nicolargo glances · glances)
- [CVE-2026-56766](https://cve.now/CVE-2026-56766.md): Hydra - Stack Buffer Overflow in NTLM Authentication Handler (CVSS 8.6, vanhauser-thc thc-hydra)
- [CVE-2026-46611](https://cve.now/CVE-2026-46611.md): Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack (CVSS 5.3, nicolargo glances · glances)
- [CVE-2026-12921](https://cve.now/CVE-2026-12921.md): Use after free in AzeoTech DAQFactory (CVSS 8.4, AzeoTech DAQFactory)
- [CVE-2026-54250](https://cve.now/CVE-2026-54250.md): K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression (CVSS 5.8, k3s-io k3s · github.com/k3s-io/k3s)
- [CVE-2026-54090](https://cve.now/CVE-2026-54090.md): File Browser: Command Allowlist Bypass via Shell Metacharacter Injection (CVSS 8.7, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-54088](https://cve.now/CVE-2026-54088.md): File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) (CVSS 9.3, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-12897](https://cve.now/CVE-2026-12897.md): Out-of-bounds read in Horner Automation Cscape (CVSS 8.4, Horner Automation Cscape)
- [CVE-2026-54089](https://cve.now/CVE-2026-54089.md): File Browser: Authentication Bypass via Proxy Auth Header Forgery (CVSS 9.1, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-54091](https://cve.now/CVE-2026-54091.md): File Browser: Incorrect access control in public directory shares via rule path rebasing (CVSS 7.5, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-54092](https://cve.now/CVE-2026-54092.md): File Browser: DoS Vulnerability on Public Login API (CVSS 6.5, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-54097](https://cve.now/CVE-2026-54097.md): File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix (CVSS 7.2, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-54093](https://cve.now/CVE-2026-54093.md): File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames (CVSS 6.8, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-54094](https://cve.now/CVE-2026-54094.md): File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope (CVSS 7.5, filebrowser · github.com/filebrowser/filebrowser/v2 +1)
- [CVE-2026-54096](https://cve.now/CVE-2026-54096.md): File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path (CVSS 8.4, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-55667](https://cve.now/CVE-2026-55667.md): File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup (CVSS 8.2, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-57700](https://cve.now/CVE-2026-57700.md): WordPress OMGF Pro plugin \<= 5.2.6 - Arbitrary File Upload vulnerability (CVSS 10.0, Daan.dev OMGF Pro)
- [CVE-2026-47770](https://cve.now/CVE-2026-47770.md): jq: stack overflow in deep structural equality (CVSS 6.8, jqlang jq)
- [CVE-2026-49839](https://cve.now/CVE-2026-49839.md): jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow (CVSS 7.1, jqlang jq)
- [CVE-2026-54679](https://cve.now/CVE-2026-54679.md): jq: potential integer overflow in jvp\_string\_append (CVSS 6.9, jqlang jq)
- [CVE-2026-55180](https://cve.now/CVE-2026-55180.md): pnpm: Repository config can expand victim environment secrets into registry requests before scripts run (CVSS 6.5, pnpm)
- [CVE-2026-48995](https://cve.now/CVE-2026-48995.md): pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile (CVSS 4.8, pnpm)
- [CVE-2026-11999](https://cve.now/CVE-2026-11999.md): X.509 trust-chain bypass via path-depth exhaustion in wolfSSL\_X509\_verify\_cert() (CVSS 8.2, wolfSSL)
- [CVE-2026-50017](https://cve.now/CVE-2026-50017.md): pnpm binds unscoped user-level npm auth credentials to a repository-selected registry (CVSS 6.9, pnpm)
- [CVE-2026-50016](https://cve.now/CVE-2026-50016.md): pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement (CVSS 8.8, pnpm)
- [CVE-2026-55967](https://cve.now/CVE-2026-55967.md): AES-GCM streaming APIs do not reject \>64 GiB cumulative single messages, enabling counter wrap and keystream reuse (CVSS 2.0, wolfSSL)
- [CVE-2026-50015](https://cve.now/CVE-2026-50015.md): pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) (CVSS 7.3, pnpm)
- [CVE-2026-55961](https://cve.now/CVE-2026-55961.md): wolfSSL\_PKCS7\_verify() reports success for degenerate (certs-only) PKCS#7 with no signer (CVSS 8.2, wolfSSL)
- [CVE-2026-50014](https://cve.now/CVE-2026-50014.md): pnpm: Git Fetch Argument Injection via Lockfile resolution.commit (CVSS 6.4, pnpm)
- [CVE-2026-50573](https://cve.now/CVE-2026-50573.md): pnpm: Unsafe default behavior breaks integrity check (CVSS 6.8, pnpm)
- [CVE-2026-50021](https://cve.now/CVE-2026-50021.md): pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field (CVSS 6.8, pnpm)
- [CVE-2026-55700](https://cve.now/CVE-2026-55700.md): pnpm: stage download writes outside destination via manifest version traversal (CVSS 7.1, pnpm)
- [CVE-2026-6091](https://cve.now/CVE-2026-6091.md): Partial-chain verification accepts untrusted intermediate as trust anchor (CVSS 6.0, wolfSSL)
- [CVE-2026-55699](https://cve.now/CVE-2026-55699.md): pnpm: reserved bin name deletes PNPM\_HOME during global remove (CVSS 6.5, pnpm)
- [CVE-2026-55698](https://cve.now/CVE-2026-55698.md): pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes (CVSS 8.8, pnpm)
- [CVE-2026-55697](https://cve.now/CVE-2026-55697.md): pnpm: Repository-controlled configDependencies can select a pacquet native install engine (CVSS 7.5, pnpm)
- [CVE-2026-6291](https://cve.now/CVE-2026-6291.md): Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption (CVSS 6.0, wolfSSL)
- [CVE-2026-55487](https://cve.now/CVE-2026-55487.md): pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle (CVSS 7.5, pnpm)
- [CVE-2026-6094](https://cve.now/CVE-2026-6094.md): Heap buffer overread in wc\_PKCS7\_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData (CVSS 6.3, wolfSSL)
- [CVE-2026-54448](https://cve.now/CVE-2026-54448.md): Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser (CVSS 6.9, aquasecurity trivy · github.com/aquasecurity/trivy)
- [CVE-2026-13351](https://cve.now/CVE-2026-13351.md): net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets (CVSS 7.5, zephyrproject-rtos Zephyr)
- [CVE-2026-55092](https://cve.now/CVE-2026-55092.md): Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts (CVSS 7.0, aquasecurity trivy · github.com/aquasecurity/trivy)
- [CVE-2026-9083](https://cve.now/CVE-2026-9083.md): Keycloak: keycloak: information disclosure through arbitrary filesystem path probing (CVSS 4.9, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9799](https://cve.now/CVE-2026-9799.md): Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass (CVSS 4.6, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9705](https://cve.now/CVE-2026-9705.md): Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token (CVSS 6.5, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9086](https://cve.now/CVE-2026-9086.md): Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass (CVSS 7.3, Red Hat build of Keycloak · org.keycloak:keycloak-services)
- [CVE-2026-9099](https://cve.now/CVE-2026-9099.md): Keycloak: group-admin escalation to realm-admin (CVSS 7.7, Red Hat build of Keycloak)
- [CVE-2026-9800](https://cve.now/CVE-2026-9800.md): Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison (CVSS 8.1, Red Hat build of Keycloak · Red Hat build of Quarkus 3.2… +6)
- [CVE-2026-55411](https://cve.now/CVE-2026-55411.md): ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets (CVSS 6.8, ToolJet)
- [CVE-2026-55412](https://cve.now/CVE-2026-55412.md): ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise (CVSS 8.3, ToolJet)
- [CVE-2026-13350](https://cve.now/CVE-2026-13350.md): Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. (CVSS 2.3, pretix Venueless)
- [CVE-2026-55413](https://cve.now/CVE-2026-55413.md): ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution (CVSS 9.4, ToolJet)
- [CVE-2026-54573](https://cve.now/CVE-2026-54573.md): Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy (CVSS 5.3, outline)
- [CVE-2026-55439](https://cve.now/CVE-2026-55439.md): Halo: Path Traversal in Backup Download Leads to Arbitrary File Read (CVSS 5.5, halo-dev halo)
- [CVE-2026-54024](https://cve.now/CVE-2026-54024.md): LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits (CVSS 6.5, danny-avila LibreChat)
- [CVE-2026-54025](https://cve.now/CVE-2026-54025.md): LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview (CVSS 5.4, danny-avila LibreChat)
- [CVE-2026-54027](https://cve.now/CVE-2026-54027.md): LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization (CVSS 6.5, danny-avila LibreChat)
- [CVE-2026-54029](https://cve.now/CVE-2026-54029.md): LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter (CVSS 5.3, danny-avila LibreChat)
- [CVE-2026-54033](https://cve.now/CVE-2026-54033.md): LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs (CVSS 7.7, danny-avila LibreChat)
- [CVE-2026-45233](https://cve.now/CVE-2026-45233.md): HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave (CVSS 7.2, danpros htmly)
- [CVE-2026-54037](https://cve.now/CVE-2026-54037.md): LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork (CVSS 6.5, danny-avila LibreChat)
- [CVE-2026-54030](https://cve.now/CVE-2026-54030.md): LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow (CVSS 8.0, danny-avila LibreChat)
- [CVE-2026-54040](https://cve.now/CVE-2026-54040.md): LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass (CVSS 5.9, danny-avila LibreChat)
- [CVE-2026-56123](https://cve.now/CVE-2026-56123.md): socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser (CVSS 9.2, socat)
- [CVE-2026-54036](https://cve.now/CVE-2026-54036.md): LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification (CVSS 5.3, danny-avila LibreChat)
- [CVE-2026-4522](https://cve.now/CVE-2026-4522.md): Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception. (CVSS 6.7, HYPR Passwordless)
- [CVE-2026-55693](https://cve.now/CVE-2026-55693.md): Vim: Out-of-bounds Write in Spell File Word Count (CVSS 5.7, vim)
- [CVE-2026-55892](https://cve.now/CVE-2026-55892.md): Vim: Out-of-bounds Write in Spell File Prefix Dump (CVSS 5.5, vim)
- [CVE-2026-55895](https://cve.now/CVE-2026-55895.md): Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename (CVSS 5.7, vim)
- [CVE-2026-57451](https://cve.now/CVE-2026-57451.md): Vim: Out-of-bounds Read in Text Property Count (CVSS 5.3, vim)
- [CVE-2026-57452](https://cve.now/CVE-2026-57452.md): Vim: Out-of-bounds Read with libsodium-encrypted Files (CVSS 5.5, vim)
- [CVE-2026-48945](https://cve.now/CVE-2026-48945.md): Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla \< 2.26 (CVSS 5.3, getk2.org K2 extension for Joomla)
- [CVE-2026-57453](https://cve.now/CVE-2026-57453.md): Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction (CVSS 6.5, vim)
- [CVE-2026-48940](https://cve.now/CVE-2026-48940.md): Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla \< 2.26 (CVSS 3.4, getk2.org K2 extension for Joomla)
- [CVE-2026-12844](https://cve.now/CVE-2026-12844.md): List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function (CVSS 7.5, DROLSKY List::SomeUtils::XS)
- [CVE-2026-48941](https://cve.now/CVE-2026-48941.md): Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla \< 2.26 (CVSS 6.5, getk2.org K2 extension for Joomla)
- [CVE-2026-48946](https://cve.now/CVE-2026-48946.md): Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla \< 2.26 (CVSS 6.3, getk2.org K2 extension for Joomla)
- [CVE-2026-57454](https://cve.now/CVE-2026-57454.md): Vim: Out-of-bounds Read with Text Properties (CVSS 6.8, vim)
- [CVE-2026-48944](https://cve.now/CVE-2026-48944.md): Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla \< 2.26 (CVSS 6.5, getk2.org K2 extension for Joomla)
- [CVE-2026-48942](https://cve.now/CVE-2026-48942.md): Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla \< 2.26 (CVSS 6.1, getk2.org K2 extension for Joomla)
- [CVE-2026-48943](https://cve.now/CVE-2026-48943.md): Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla \< 2.26 (CVSS 6.5, getk2.org K2 extension for Joomla)
- [CVE-2026-57455](https://cve.now/CVE-2026-57455.md): Vim: Stack out-of-bounds write in \`spell\_soundfold\_sofo()\` via an over-length \`soundfold()\` argument (CVSS 4.0, vim)
- [CVE-2026-57456](https://cve.now/CVE-2026-57456.md): Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings (CVSS 8.4, vim)
- [CVE-2026-9718](https://cve.now/CVE-2026-9718.md): CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impact (CVSS 6.9, Schneider Electric PowerLogic™ P7)
- [CVE-2026-9717](https://cve.now/CVE-2026-9717.md): CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized (CVSS 8.6, Schneider Electric PowerLogic™ P7)
- [CVE-2026-9716](https://cve.now/CVE-2026-9716.md): CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configu (CVSS 8.7, Schneider Electric PowerLogic™ P7)
- [CVE-2026-55477](https://cve.now/CVE-2026-55477.md): Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation (CVSS 7.2, MHSanaei 3x-ui · github.com/mhsanaei/3x-ui +2)
- [CVE-2026-9651](https://cve.now/CVE-2026-9651.md): CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and (CVSS 6.7, Schneider Electric EasyLogic T150 (formerly Saitel DR) Remo…)
- [CVE-2026-9650](https://cve.now/CVE-2026-9650.md): CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when u (CVSS 8.7, Schneider Electric EasyLogic T150 (formerly Saitel DR) Remo…)
- [CVE-2026-57438](https://cve.now/CVE-2026-57438.md): Nokogiri: Possible Use-After-Free in XInclude Processing (CVSS 2.2, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57437](https://cve.now/CVE-2026-57437.md): Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57436](https://cve.now/CVE-2026-57436.md): Nokogiri: Possible Use-After-Free when setting \`Document#root=\` to an invalid node type (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57435](https://cve.now/CVE-2026-57435.md): Nokogiri: Possible Use-After-Free when setting an attribute value via \`Nokogiri::XML::Attr#value=\` or \`#content=\` (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57532](https://cve.now/CVE-2026-57532.md): Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in (CVSS 8.8, pretix)
- [CVE-2026-57434](https://cve.now/CVE-2026-57434.md): Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57533](https://cve.now/CVE-2026-57533.md): Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. (CVSS 2.1, pretix)
- [CVE-2026-57235](https://cve.now/CVE-2026-57235.md): Nokogiri: Possible Out-of-Bounds Read in \`Nokogiri::XML::NodeSet#\[\]\` (CVSS 6.3, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57234](https://cve.now/CVE-2026-57234.md): Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (CVSS 2.6, sparklemotion nokogiri · nokogiri)
- [CVE-2026-57535](https://cve.now/CVE-2026-57535.md): Content injected to PDF rendering contexts could, in many places, include HTML content including \<img\> tags. (CVSS 2.1, pretix)
- [CVE-2026-57236](https://cve.now/CVE-2026-57236.md): Nokogiri: Possible Use-After-Free when \`Nokogiri::XML::Document#encoding=\` raises an exception (CVSS 1.7, sparklemotion nokogiri · nokogiri)
- [CVE-2026-13225](https://cve.now/CVE-2026-13225.md): Stored XSS in ticket confirmation page (CVSS 5.3, pretix)
- [CVE-2026-49319](https://cve.now/CVE-2026-49319.md): Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack (CVSS 6.5, Alps Electric Co. Remote Keyless Entry System (RKES) R53R0)
- [CVE-2026-57534](https://cve.now/CVE-2026-57534.md): Stored XSS in pretix-pages (CVSS 2.1, pretix-pages)
- [CVE-2026-57536](https://cve.now/CVE-2026-57536.md): Insufficient validation of payment status in pretix-mollie (CVSS 6.3, pretix-mollie)
- [CVE-2026-13222](https://cve.now/CVE-2026-13222.md): Insufficient validation of payment status in pretix-oppwa (CVSS 6.3, pretix-oppwa)
- [CVE-2026-13223](https://cve.now/CVE-2026-13223.md): Insufficient validation of payment status in pretix-computop (CVSS 6.3, pretix-computop)
- [CVE-2026-13314](https://cve.now/CVE-2026-13314.md): Stored XSS in pretix-digital (CVSS 2.0, pretix-digital)
- [CVE-2026-6432](https://cve.now/CVE-2026-6432.md): Improper bounds validation in EmberZNet SDK (CVSS 5.3, Silicon Labs EmberZNet)
- [CVE-2026-46735](https://cve.now/CVE-2026-46735.md): Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-57588](https://cve.now/CVE-2026-57588.md): SQL Injection in Nessus via Malicious Scan Result File Import (CVSS 3.3, tenable Nessus)
- [CVE-2026-57587](https://cve.now/CVE-2026-57587.md): SQL Injection in Nessus via Reverse DNS Lookup (CVSS 5.3, tenable Nessus)
- [CVE-2026-46734](https://cve.now/CVE-2026-46734.md): Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. (CVSS 7.3, Dell Display and Peripheral Manager)
- [CVE-2026-47154](https://cve.now/CVE-2026-47154.md): Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47153](https://cve.now/CVE-2026-47153.md): Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47152](https://cve.now/CVE-2026-47152.md): Level Control Move divide-by-zero in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47151](https://cve.now/CVE-2026-47151.md): Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47150](https://cve.now/CVE-2026-47150.md): IAS Zone enroll invalid table index and write in EmberZNet 9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47149](https://cve.now/CVE-2026-47149.md): Door Lock GetUserType invalid table index in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47148](https://cve.now/CVE-2026-47148.md): Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-46732](https://cve.now/CVE-2026-46732.md): Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper Sy (CVSS 6.7, Dell Display and Peripheral Manager)
- [CVE-2026-47147](https://cve.now/CVE-2026-47147.md): OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47146](https://cve.now/CVE-2026-47146.md): Color Control color-temperature assertion abort in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-47145](https://cve.now/CVE-2026-47145.md): Color Control hue/saturation assertion abort in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-56050](https://cve.now/CVE-2026-56050.md): WordPress PPOM for WooCommerce plugin \<= 33.0.18 - Broken Access Control vulnerability (CVSS 6.5, Themeisle PPOM for WooCommerce)
- [CVE-2026-56122](https://cve.now/CVE-2026-56122.md): Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths (CVSS 8.7, rickknowles Winstone Servlet Container)
- [CVE-2026-4526](https://cve.now/CVE-2026-4526.md): Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2 (CVSS 7.1, Silicon Labs EmberZNet)
- [CVE-2026-41120](https://cve.now/CVE-2026-41120.md): Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerabilit (CVSS 9.8, Dell Wyse Management Suite)
- [CVE-2026-2815](https://cve.now/CVE-2026-2815.md): Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys (CVSS 8.4, Silicon Labs SiSDK)
- [CVE-2026-54848](https://cve.now/CVE-2026-54848.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.7.3 - Sensitive Data Exposure vulnerability (CVSS 8.3, Saad Iqbal APIExperts Square for WooCommerce)
- [CVE-2026-54829](https://cve.now/CVE-2026-54829.md): WordPress WP Photo Album Plus plugin \<= 9.1.13.005 - SQL Injection vulnerability (CVSS 7.5, Jacob N. Breetvelt WP Photo Album Plus)
- [CVE-2026-49506](https://cve.now/CVE-2026-49506.md): Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Tra (CVSS 7.2, Dell Wyse Management Suite)
- [CVE-2026-46733](https://cve.now/CVE-2026-46733.md): Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability. (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-54836](https://cve.now/CVE-2026-54836.md): WordPress Filter & Grids plugin \<= 3.11.5 - SQL Injection vulnerability (CVSS 9.3, YMC Filter)
- [CVE-2026-42389](https://cve.now/CVE-2026-42389.md): Reject more queries with invalid header values (CVSS 5.3, PowerDNS Recursor)
- [CVE-2026-54842](https://cve.now/CVE-2026-54842.md): WordPress Royal MCP plugin \<= 1.4.25 - Broken Access Control vulnerability (CVSS 8.1, Royal Plugins Royal MCP)
- [CVE-2026-12755](https://cve.now/CVE-2026-12755.md): Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated us (CVSS 2.7, Devolutions Server)
- [CVE-2026-57429](https://cve.now/CVE-2026-57429.md): WordPress Slim SEO plugin \<= 4.6.2 - Broken Access Control vulnerability (CVSS 6.5, eLightUp Slim SEO)
- [CVE-2026-56071](https://cve.now/CVE-2026-56071.md): WordPress Forminator plugin \<= 1.53.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPMU DEV Forminator)
- [CVE-2026-56054](https://cve.now/CVE-2026-56054.md): WordPress JS Help Desk plugin \<= 3.1.1 - Arbitrary File Deletion vulnerability (CVSS 7.7, Ahmad JS Help Desk)
- [CVE-2026-56053](https://cve.now/CVE-2026-56053.md): WordPress EventPrime plugin \<= 4.3.4.1 - PHP Object Injection vulnerability (CVSS 8.8, EventPrime)
- [CVE-2026-56051](https://cve.now/CVE-2026-56051.md): WordPress TablePress plugin \<= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TablePress)
- [CVE-2026-56049](https://cve.now/CVE-2026-56049.md): WordPress Post Snippets plugin \<= 4.0.19 - Remote Code Execution (RCE) vulnerability (CVSS 8.5, Post Snippets)
- [CVE-2026-56042](https://cve.now/CVE-2026-56042.md): WordPress Advanced Order Export For WooCommerce plugin \<= 4.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Algolplus Advanced Order Export For WooCommerce)
- [CVE-2026-56023](https://cve.now/CVE-2026-56023.md): WordPress UPI QR Code Payment Gateway for WooCommerce plugin \<= 1.6.2 - Broken Access Control vulnerability (CVSS 5.4, Knit Pay UPI QR Code Payment Gateway for WooCommerce)
- [CVE-2026-56014](https://cve.now/CVE-2026-56014.md): WordPress Master Slider plugin \<= 3.11.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Averta Master Slider)
- [CVE-2026-56013](https://cve.now/CVE-2026-56013.md): WordPress License Manager for WooCommerce plugin \<= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, myCred License Manager for WooCommerce)
- [CVE-2026-56006](https://cve.now/CVE-2026-56006.md): WordPress H5P plugin \<= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, H5P)
- [CVE-2026-56005](https://cve.now/CVE-2026-56005.md): WordPress WP Activity Log plugin \<= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Melapress WP Activity Log)
- [CVE-2026-54849](https://cve.now/CVE-2026-54849.md): WordPress Premmerce Wishlist for WooCommerce plugin \<= 1.1.11 - SQL Injection vulnerability (CVSS 9.3, Premmerce Wishlist for WooCommerce)
- [CVE-2026-54845](https://cve.now/CVE-2026-54845.md): WordPress MDTF plugin \<= 1.3.8 - Local File Inclusion vulnerability (CVSS 8.1, PluginUs.Net MDTF)
- [CVE-2026-54844](https://cve.now/CVE-2026-54844.md): WordPress CheckView Automated Testing plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 7.5, CheckView Automated Testing)
- [CVE-2026-54843](https://cve.now/CVE-2026-54843.md): WordPress MDTF plugin \<= 1.3.7 - SQL Injection vulnerability (CVSS 9.3, PluginUs.Net MDTF)
- [CVE-2026-54841](https://cve.now/CVE-2026-54841.md): WordPress Vitepos plugin \<= 3.4.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, Appsbd Vitepos)
- [CVE-2026-54838](https://cve.now/CVE-2026-54838.md): WordPress WC Vendors Marketplace plugin \<= 2.6.8 - SQL Injection vulnerability (CVSS 8.5, Rymera Web WC Vendors Marketplace)
- [CVE-2026-54830](https://cve.now/CVE-2026-54830.md): WordPress Five Star Restaurant Reservations plugin \<= 2.7.19 - Broken Access Control vulnerability (CVSS 7.5, Etoile Web Design Incorporated Five Star Restaurant Reserva…)
- [CVE-2026-54828](https://cve.now/CVE-2026-54828.md): WordPress Motors plugin \<= 1.4.109 - Broken Access Control vulnerability (CVSS 7.5, StylemixThemes Motors)
- [CVE-2026-54823](https://cve.now/CVE-2026-54823.md): WordPress Widget Options plugin \<= 4.2.3 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, MarketingFire Widget Options)
- [CVE-2026-54822](https://cve.now/CVE-2026-54822.md): WordPress SALESmanago & Leadoo plugin \<= 3.11.2 - SQL Injection vulnerability (CVSS 8.5, SALESmanago & Leadoo)
- [CVE-2026-54821](https://cve.now/CVE-2026-54821.md): WordPress Visual Link Preview plugin \<= 2.3.1 - Sensitive Data Exposure vulnerability (CVSS 7.4, Bootstrapped Ventures Visual Link Preview)
- [CVE-2026-27366](https://cve.now/CVE-2026-27366.md): WordPress MainWP Child plugin \<= 6.1.1 - Broken Access Control vulnerability (CVSS 7.5, MainWP Child)
- [CVE-2026-57619](https://cve.now/CVE-2026-57619.md): WordPress Elementor Website Builder plugin \<= 4.1.3 - Sensitive Data Exposure vulnerability (CVSS 6.5, Elementor Website Builder)
- [CVE-2026-52690](https://cve.now/CVE-2026-52690.md): Spoofed answers can mark an authoritative non-EDNS capable (CVSS 5.9, PowerDNS Recursor)
- [CVE-2026-42390](https://cve.now/CVE-2026-42390.md): ZONEMD validation can be bypassed (CVSS 5.3, PowerDNS Recursor)
- [CVE-2026-42388](https://cve.now/CVE-2026-42388.md): Missing input validation for catalog zones (CVSS 5.9, PowerDNS Recursor)
- [CVE-2026-42387](https://cve.now/CVE-2026-42387.md): Insufficient input validation in ZoneToCache (CVSS 5.9, PowerDNS Recursor)
- [CVE-2026-40012](https://cve.now/CVE-2026-40012.md): Information about ECS zero scoped answers might leak to clients that use a specific ECS (CVSS 5.3, PowerDNS Recursor)
- [CVE-2026-33612](https://cve.now/CVE-2026-33612.md): ZoneToCache can poison the cache (CVSS 7.5, PowerDNS Recursor)
- [CVE-2026-42004](https://cve.now/CVE-2026-42004.md): EDNS options smuggling (CVSS 3.7, PowerDNS DNSdist)
- [CVE-2026-40211](https://cve.now/CVE-2026-40211.md): Denial of service via crafted DoH3 queries (CVSS 5.3, PowerDNS DNSdist)
- [CVE-2026-40210](https://cve.now/CVE-2026-40210.md): Out-of-bounds read in SetMacAddrAction (CVSS 4.8, PowerDNS DNSdist)
- [CVE-2026-40209](https://cve.now/CVE-2026-40209.md): Denial of service via IXFR queries (CVSS 5.3, PowerDNS DNSdist)
- [CVE-2026-40208](https://cve.now/CVE-2026-40208.md): Denial of service via DoH3 queries (CVSS 3.7, PowerDNS DNSdist)
- [CVE-2026-40011](https://cve.now/CVE-2026-40011.md): Prometheus denial of service via crafted DNS queries (CVSS 3.7, PowerDNS DNSdist)
- [CVE-2026-42005](https://cve.now/CVE-2026-42005.md): Insufficient input validation of internal web server (CVSS 4.3, PowerDNS Authoritative)
- [CVE-2026-56091](https://cve.now/CVE-2026-56091.md): Apache Shiro: Authentication bypass in Guice-Web integration (CVSS 8.2, Apache Software Foundation Apache Shiro)
- [CVE-2026-56130](https://cve.now/CVE-2026-56130.md): Apache Shiro: Remember-me cookie isn't checked for expiry on the server (CVSS 2.0, Apache Software Foundation Apache Shiro)
- [CVE-2026-53277](https://cve.now/CVE-2026-53277.md): KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVSS 8.8, Linux)
- [CVE-2026-53276](https://cve.now/CVE-2026-53276.md): Bluetooth: ISO: Fix a use-after-free of the hci\_conn pointer (CVSS 7.8, Linux)
- [CVE-2026-53275](https://cve.now/CVE-2026-53275.md): ipv6: mcast: Fix use-after-free when processing MLD queries (CVSS 8.8, Linux)
- [CVE-2026-53274](https://cve.now/CVE-2026-53274.md): net/smc: fix sleep-inside-lock in \_\_smc\_setsockopt() causing local DoS (no CVSS, Linux)
- [CVE-2026-53273](https://cve.now/CVE-2026-53273.md): tee: optee: prevent use-after-free when the client exits before the supplicant (CVSS 7.8, Linux)
- [CVE-2026-53272](https://cve.now/CVE-2026-53272.md): erofs: fix use-after-free on sbi-\>sync\_decompress (no CVSS, Linux)
- [CVE-2026-53271](https://cve.now/CVE-2026-53271.md): ksmbd: fix NULL-deref of opinfo-\>conn in oplock/lease break notifiers (no CVSS, Linux)
- [CVE-2026-53270](https://cve.now/CVE-2026-53270.md): ipvs: clear the svc scheduler ptr early on edit (CVSS 7.8, Linux)
- [CVE-2026-53269](https://cve.now/CVE-2026-53269.md): netfilter: synproxy: add mutex to guard hook reference counting (no CVSS, Linux)
- [CVE-2026-53268](https://cve.now/CVE-2026-53268.md): netfilter: conntrack\_irc: fix possible out-of-bounds read (CVSS 8.2, Linux)
- [CVE-2026-53267](https://cve.now/CVE-2026-53267.md): netfilter: nft\_ct: bail out on template ct in get eval (CVSS 7.8, Linux)
- [CVE-2026-53266](https://cve.now/CVE-2026-53266.md): netfilter: bridge: make ebt\_snat ARP rewrite writable (CVSS 8.8, KEV, Linux)
- [CVE-2026-53265](https://cve.now/CVE-2026-53265.md): dm cache policy smq: check allocation under invalidate lock (CVSS 7.8, Linux)
- [CVE-2026-53264](https://cve.now/CVE-2026-53264.md): net/sched: act\_api: use RCU with deferred freeing for action lifecycle (CVSS 7.8, Linux)
- [CVE-2026-53263](https://cve.now/CVE-2026-53263.md): 6lowpan: fix off-by-one in multicast context address compression (no CVSS, Linux)
- [CVE-2026-53262](https://cve.now/CVE-2026-53262.md): l2tp: pppol2tp: hold reference to session in pppol2tp\_ioctl() (CVSS 7.8, Linux)
- [CVE-2026-53261](https://cve.now/CVE-2026-53261.md): devlink: Release nested relation on devlink free (no CVSS, Linux)
- [CVE-2026-53260](https://cve.now/CVE-2026-53260.md): tcp: Add preempt\_{disable,enable}\_nested() in reqsk\_queue\_hash\_req(). (CVSS 9.8, Linux)
- [CVE-2026-53259](https://cve.now/CVE-2026-53259.md): ipv6: anycast: insert aca into global hash under idev-\>lock (CVSS 7.8, Linux)
- [CVE-2026-53258](https://cve.now/CVE-2026-53258.md): wifi: fix leak if split 6 GHz scanning fails (no CVSS, Linux)
- [CVE-2026-53257](https://cve.now/CVE-2026-53257.md): wifi: cfg80211: enforce HE/EHT cap/oper consistency (no CVSS, Linux)
- [CVE-2026-53256](https://cve.now/CVE-2026-53256.md): Bluetooth: RFCOMM: hold listener socket in rfcomm\_connect\_ind() (CVSS 8.0, Linux)
- [CVE-2026-53255](https://cve.now/CVE-2026-53255.md): Bluetooth: MGMT: validate advertising TLV before type checks (no CVSS, Linux)
- [CVE-2026-53254](https://cve.now/CVE-2026-53254.md): Bluetooth: RFCOMM: validate skb length in MCC handlers (CVSS 8.1, Linux)
- [CVE-2026-53253](https://cve.now/CVE-2026-53253.md): Bluetooth: bnep: reject short frames before parsing (CVSS 7.1, Linux)
- [CVE-2026-53252](https://cve.now/CVE-2026-53252.md): Bluetooth: fix memory leak in error path of hci\_alloc\_dev() (no CVSS, Linux)
- [CVE-2026-53251](https://cve.now/CVE-2026-53251.md): Bluetooth: ISO: Fix not releasing hdev reference on iso\_conn\_big\_sync (no CVSS, Linux)
- [CVE-2026-53250](https://cve.now/CVE-2026-53250.md): xsk: cache csum\_start/csum\_offset to fix TOCTOU in xsk\_skb\_metadata() (CVSS 7.8, Linux)
- [CVE-2026-53249](https://cve.now/CVE-2026-53249.md): ipv4: restrict IPOPT\_SSRR and IPOPT\_LSRR options (no CVSS, Linux)
- [CVE-2026-53248](https://cve.now/CVE-2026-53248.md): net: airoha: Fix use-after-free in metadata dst teardown (CVSS 8.8, Linux)
- [CVE-2026-53247](https://cve.now/CVE-2026-53247.md): net: ethernet: mtk\_eth\_soc: Fix use-after-free in metadata dst teardown (CVSS 9.8, Linux)
- [CVE-2026-53246](https://cve.now/CVE-2026-53246.md): sctp: validate cached peer INIT chunk length in COOKIE\_ECHO processing (CVSS 9.8, Linux)
- [CVE-2026-53245](https://cve.now/CVE-2026-53245.md): net/802/mrp: fix vector attribute parsing in mrp\_pdu\_parse\_vecattr (no CVSS, Linux)
- [CVE-2026-53244](https://cve.now/CVE-2026-53244.md): VFS: fix possible failure to unlock in nfsd4\_create\_file() (CVSS 7.5, Linux)
- [CVE-2026-53243](https://cve.now/CVE-2026-53243.md): rseq: Fix using an uninitialized stack variable in rseq\_exit\_user\_update() (no CVSS, Linux)
- [CVE-2026-53242](https://cve.now/CVE-2026-53242.md): ALSA: PCM: Fix wait queue list corruption in snd\_pcm\_drain() on linked streams (CVSS 7.8, Linux)
- [CVE-2026-53241](https://cve.now/CVE-2026-53241.md): ALSA: seq: dummy: fix UMP event stack overread (no CVSS, Linux)
- [CVE-2026-53240](https://cve.now/CVE-2026-53240.md): xfrm: iptfs: fix use-after-free on first\_skb in \_\_input\_process\_payload (CVSS 8.8, Linux)
- [CVE-2026-53239](https://cve.now/CVE-2026-53239.md): xfrm: policy: fix use-after-free on inexact bin in xfrm\_policy\_bysel\_ctx() (CVSS 7.8, Linux)
- [CVE-2026-53238](https://cve.now/CVE-2026-53238.md): netlabel: validate unlabeled address and mask attribute lengths (no CVSS, Linux)
- [CVE-2026-53237](https://cve.now/CVE-2026-53237.md): gpio: mvebu: fix NULL pointer dereference in suspend/resume (no CVSS, Linux)
- [CVE-2026-53236](https://cve.now/CVE-2026-53236.md): tcp: restrict SO\_ATTACH\_FILTER to priv users (no CVSS, Linux)
- [CVE-2026-53235](https://cve.now/CVE-2026-53235.md): net: add pskb\_may\_pull() to skb\_gro\_receive\_list() (CVSS 7.5, Linux)
- [CVE-2026-53234](https://cve.now/CVE-2026-53234.md): net: ibm: emac: Fix use-after-free during device removal (no CVSS, Linux)
- [CVE-2026-53233](https://cve.now/CVE-2026-53233.md): netdev: fix double-free in netdev\_nl\_bind\_rx\_doit() (no CVSS, Linux)
- [CVE-2026-53232](https://cve.now/CVE-2026-53232.md): net: phy: clean the sfp upstream if phy probing fails (CVSS 8.8, Linux)
- [CVE-2026-53231](https://cve.now/CVE-2026-53231.md): net: phy: don't try to setup PHY-driven SFP cages when using genphy (no CVSS, Linux)
- [CVE-2026-53230](https://cve.now/CVE-2026-53230.md): net/mlx5: Fix slab-out-of-bounds in mlx5\_query\_nic\_vport\_mac\_list (CVSS 8.7, Linux)
- [CVE-2026-53229](https://cve.now/CVE-2026-53229.md): net/mlx5e: xsk: Fix DMA and xdp\_frame leak on XDP\_TX xmit failure (CVSS 7.5, Linux)
- [CVE-2026-53228](https://cve.now/CVE-2026-53228.md): ipv6: sit: reload inner IPv6 header after GSO offloads (CVSS 9.8, Linux)
- [CVE-2026-53227](https://cve.now/CVE-2026-53227.md): net: openvswitch: fix possible kfree\_skb of ERR\_PTR (no CVSS, Linux)
- [CVE-2026-53226](https://cve.now/CVE-2026-53226.md): gpio: rockchip: fix generic IRQ chip leak on remove (no CVSS, Linux)
- [CVE-2026-53225](https://cve.now/CVE-2026-53225.md): sctp: fix uninit-value in \_\_sctp\_rcv\_asconf\_lookup() (CVSS 9.1, Linux)
- [CVE-2026-53224](https://cve.now/CVE-2026-53224.md): sctp: validate embedded INIT chunk and address list lengths in cookie (CVSS 9.1, Linux)
- [CVE-2026-53223](https://cve.now/CVE-2026-53223.md): net: guard timestamp cmsgs to real error queue skbs (CVSS 7.1, Linux)
- [CVE-2026-53222](https://cve.now/CVE-2026-53222.md): ptp: ocp: fix resource freeing order (no CVSS, Linux)
- [CVE-2026-53221](https://cve.now/CVE-2026-53221.md): ip6\_vti: fix incorrect tunnel matching in vti6\_tnl\_lookup() (CVSS 9.8, Linux)
- [CVE-2026-53220](https://cve.now/CVE-2026-53220.md): netfilter: revalidate bridge ports (no CVSS, Linux)
- [CVE-2026-53219](https://cve.now/CVE-2026-53219.md): netfilter: x\_tables: avoid leaking percpu counter pointers (no CVSS, Linux)
- [CVE-2026-53218](https://cve.now/CVE-2026-53218.md): netfilter: nft\_exthdr: fix register tracking for F\_PRESENT flag (no CVSS, Linux)
- [CVE-2026-53217](https://cve.now/CVE-2026-53217.md): net: mvpp2: sync RX data at the hardware packet offset (CVSS 8.6, Linux)
- [CVE-2026-53216](https://cve.now/CVE-2026-53216.md): net: mvpp2: limit XDP frame size to the RX buffer (CVSS 9.8, Linux)
- [CVE-2026-53215](https://cve.now/CVE-2026-53215.md): net: mvpp2: refill RX buffers before XDP or skb use (CVSS 9.8, Linux)
- [CVE-2026-53214](https://cve.now/CVE-2026-53214.md): ipv6: Fix a potential NPD in cleanup\_prefix\_route() (no CVSS, Linux)
- [CVE-2026-53213](https://cve.now/CVE-2026-53213.md): drm/vc4: fix krealloc() memory leak (no CVSS, Linux)
- [CVE-2026-53212](https://cve.now/CVE-2026-53212.md): netfilter: nft\_tunnel: fix use-after-free on object destroy (CVSS 7.8, Linux)
- [CVE-2026-53211](https://cve.now/CVE-2026-53211.md): netfilter: nft\_meta\_bridge: fix stale stack leak via IIFHWADDR register (no CVSS, Linux)
- [CVE-2026-53210](https://cve.now/CVE-2026-53210.md): tee: shm: fix shm leak in register\_shm\_helper() (no CVSS, Linux)
- [CVE-2026-53209](https://cve.now/CVE-2026-53209.md): Bluetooth: hci\_sync: reject oversized Broadcast Announcement prepend (CVSS 7.8, Linux)
- [CVE-2026-53208](https://cve.now/CVE-2026-53208.md): Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (no CVSS, Linux)
- [CVE-2026-53207](https://cve.now/CVE-2026-53207.md): mm/memory-failure: fix hugetlb\_lock AA deadlock in get\_huge\_page\_for\_hwpoison (no CVSS, Linux)
- [CVE-2026-53206](https://cve.now/CVE-2026-53206.md): accel/ivpu: Add bounds check for firmware runtime memory (no CVSS, Linux)
- [CVE-2026-53205](https://cve.now/CVE-2026-53205.md): accel/ivpu: Add bounds checks for firmware log indices (CVSS 7.1, Linux)
- [CVE-2026-53204](https://cve.now/CVE-2026-53204.md): firmware: stratix10-rsu: Fix NULL deref on rsu\_send\_msg() timeout in probe (no CVSS, Linux)
- [CVE-2026-53203](https://cve.now/CVE-2026-53203.md): accel/ivpu: Add buffer overflow check in MS get\_info\_ioctl (CVSS 7.1, Linux)
- [CVE-2026-53202](https://cve.now/CVE-2026-53202.md): accel/ivpu: Fix signed integer truncation in IPC receive (CVSS 7.8, Linux)
- [CVE-2026-53201](https://cve.now/CVE-2026-53201.md): Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" (CVSS 7.8, Linux)
- [CVE-2026-53200](https://cve.now/CVE-2026-53200.md): KVM: arm64: nv: Fix handling of XN\[0\] when !FEAT\_XNX (CVSS 8.8, Linux)
- [CVE-2026-53199](https://cve.now/CVE-2026-53199.md): hv\_netvsc: use kmap\_local\_page in netvsc\_copy\_to\_send\_buf (CVSS 7.5, Linux)
- [CVE-2026-53198](https://cve.now/CVE-2026-53198.md): ksmbd: fix use-after-free of a deferred file\_lock on double SMB2\_CANCEL (CVSS 8.8, Linux)
- [CVE-2026-53197](https://cve.now/CVE-2026-53197.md): xfrm: iptfs: fix ABBA deadlock in iptfs\_destroy\_state() (no CVSS, Linux)
- [CVE-2026-53196](https://cve.now/CVE-2026-53196.md): USB: serial: io\_ti: fix heap overflow in get\_manuf\_info() (CVSS 6.8, Linux)
- [CVE-2026-53195](https://cve.now/CVE-2026-53195.md): USB: serial: io\_ti: fix heap overflow in build\_i2c\_fw\_hdr() (no CVSS, Linux)
- [CVE-2026-53194](https://cve.now/CVE-2026-53194.md): USB: serial: kl5kusb105: fix bulk-out buffer overflow (CVSS 7.8, Linux)
- [CVE-2026-53193](https://cve.now/CVE-2026-53193.md): ALSA: timer: Forcibly close timer instances at closing (CVSS 7.8, Linux)
- [CVE-2026-53192](https://cve.now/CVE-2026-53192.md): ALSA: timer: Fix UAF at snd\_timer\_user\_params() (CVSS 7.8, Linux)
- [CVE-2026-53191](https://cve.now/CVE-2026-53191.md): io\_uring/net: inherit IORING\_CQE\_F\_BUF\_MORE across bundle recv retries (CVSS 7.8, Linux)
- [CVE-2026-53190](https://cve.now/CVE-2026-53190.md): drm/virtio: fix dma\_fence refcount leak on error in virtio\_gpu\_dma\_fence\_wait() (no CVSS, Linux)
- [CVE-2026-53189](https://cve.now/CVE-2026-53189.md): mm/huge\_memory: update file PMD counter before folio\_put() (CVSS 7.8, Linux)
- [CVE-2026-53188](https://cve.now/CVE-2026-53188.md): RDMA/core: Validate the passed in fops for ib\_get\_ucaps() (CVSS 8.8, Linux)
- [CVE-2026-53187](https://cve.now/CVE-2026-53187.md): RDMA/core: Validate cpu\_id against nr\_cpu\_ids in DMAH alloc (CVSS 7.1, Linux)
- [CVE-2026-53186](https://cve.now/CVE-2026-53186.md): RDMA/srp: bound SRP\_RSP sense copy by the received length (CVSS 9.1, Linux)
- [CVE-2026-53185](https://cve.now/CVE-2026-53185.md): zram: fix use-after-free in zram\_bvec\_write\_partial() (CVSS 7.8, Linux)
- [CVE-2026-53184](https://cve.now/CVE-2026-53184.md): udp: clear skb-\>dev before running a sockmap verdict (CVSS 7.5, Linux)
- [CVE-2026-53183](https://cve.now/CVE-2026-53183.md): mptcp: allow subflow rcv wnd to shrink (CVSS 7.5, Linux)
- [CVE-2026-53182](https://cve.now/CVE-2026-53182.md): wifi: nl80211: reject oversized EMA RNR lists (CVSS 7.8, Linux)
- [CVE-2026-53181](https://cve.now/CVE-2026-53181.md): vsock/vmci: fix sk\_ack\_backlog leak on failed handshake (no CVSS, Linux)
- [CVE-2026-53180](https://cve.now/CVE-2026-53180.md): timers/migration: Fix livelock in tmigr\_handle\_remote\_up() (CVSS 7.5, Linux)
- [CVE-2026-53179](https://cve.now/CVE-2026-53179.md): staging: rtl8723bs: fix buffer over-read in rtw\_update\_protection (no CVSS, Linux)
- [CVE-2026-53178](https://cve.now/CVE-2026-53178.md): staging: rtl8723bs: rtw\_mlme: add bounds checks before ie\_length subtraction (CVSS 8.1, Linux)
- [CVE-2026-53177](https://cve.now/CVE-2026-53177.md): bnxt\_en: Fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-53176](https://cve.now/CVE-2026-53176.md): IB/isert: Reject login PDUs shorter than ISER\_HEADERS\_LEN (CVSS 9.8, Linux)
- [CVE-2026-53175](https://cve.now/CVE-2026-53175.md): inet: frags: fix use-after-free caused by the fqdir\_pre\_exit() flush (CVSS 9.8, Linux)
- [CVE-2026-53174](https://cve.now/CVE-2026-53174.md): ovl: keep err zero after successful ovl\_cache\_get() (CVSS 7.8, Linux)
- [CVE-2026-53173](https://cve.now/CVE-2026-53173.md): accel/ethosu: fix OOB write in ethosu\_gem\_cmdstream\_copy\_and\_validate() (CVSS 7.8, Linux)
- [CVE-2026-53172](https://cve.now/CVE-2026-53172.md): accel/ethosu: fix IFM region index out-of-bounds in command stream parser (CVSS 7.8, Linux)
- [CVE-2026-53171](https://cve.now/CVE-2026-53171.md): accel/ethosu: fix arithmetic issues in dma\_length() (CVSS 8.8, Linux)
- [CVE-2026-53170](https://cve.now/CVE-2026-53170.md): accel/ethosu: reject DMA commands with uninitialized length (CVSS 8.8, Linux)
- [CVE-2026-53169](https://cve.now/CVE-2026-53169.md): accel/ethosu: reject NPU\_OP\_RESIZE commands from userspace (no CVSS, Linux)
- [CVE-2026-53168](https://cve.now/CVE-2026-53168.md): fuse: reject fuse\_notify() pagecache ops on directories (no CVSS, Linux)
- [CVE-2026-53167](https://cve.now/CVE-2026-53167.md): fuse: limit FUSE\_NOTIFY\_RETRIEVE to uptodate folios (no CVSS, Linux)
- [CVE-2026-53165](https://cve.now/CVE-2026-53165.md): iomap: avoid potential null folio-\>mapping deref during error reporting (CVSS 7.5, Linux)
- [CVE-2026-53164](https://cve.now/CVE-2026-53164.md): iommu/dma: Do not try to iommu\_map a 0 length region in swiotlb (no CVSS, Linux)
- [CVE-2026-53163](https://cve.now/CVE-2026-53163.md): locking/rtmutex: Skip remove\_waiter() when waiter is not enqueued (no CVSS, Linux)
- [CVE-2026-53162](https://cve.now/CVE-2026-53162.md): memcg: use round-robin victim selection in refill\_stock (CVSS 7.8, Linux)
- [CVE-2026-53161](https://cve.now/CVE-2026-53161.md): misc: fastrpc: fix use-after-free of fastrpc\_user in workqueue context (CVSS 7.8, Linux)
- [CVE-2026-53160](https://cve.now/CVE-2026-53160.md): misc: fastrpc: fix use-after-free race in fastrpc\_map\_create (CVSS 7.8, Linux)
- [CVE-2026-53159](https://cve.now/CVE-2026-53159.md): misc: fastrpc: fix DMA address corruption due to find\_vma misuse (CVSS 8.8, Linux)
- [CVE-2026-53158](https://cve.now/CVE-2026-53158.md): misc: fastrpc: Fix NULL pointer dereference in rpmsg callback (no CVSS, Linux)
- [CVE-2026-53157](https://cve.now/CVE-2026-53157.md): net: phonet: free phonet\_device after RCU grace period (no CVSS, Linux)
- [CVE-2026-53156](https://cve.now/CVE-2026-53156.md): nvmem: core: fix use-after-free bugs in error paths (no CVSS, Linux)
- [CVE-2026-53155](https://cve.now/CVE-2026-53155.md): mm/huge\_memory: use correct flags for device private PMD entry (no CVSS, Linux)
- [CVE-2026-53154](https://cve.now/CVE-2026-53154.md): mm/hugetlb: restore reservation on error in hugetlb folio copy paths (no CVSS, Linux)
- [CVE-2026-53153](https://cve.now/CVE-2026-53153.md): mm/list\_lru: drain before clearing xarray entry on reparent (CVSS 7.8, Linux)
- [CVE-2026-53152](https://cve.now/CVE-2026-53152.md): mmc: dw\_mmc-rockchip: Add missing private data for very old controllers (no CVSS, Linux)
- [CVE-2026-53151](https://cve.now/CVE-2026-53151.md): rxrpc: Fix the ACK parser to extract the SACK table for parsing (CVSS 9.8, Linux)
- [CVE-2026-53150](https://cve.now/CVE-2026-53150.md): thunderbolt: Reject zero-length property entries in validator (no CVSS, Linux)
- [CVE-2026-53149](https://cve.now/CVE-2026-53149.md): thunderbolt: Bound root directory content to block size (no CVSS, Linux)
- [CVE-2026-53148](https://cve.now/CVE-2026-53148.md): thunderbolt: Clamp XDomain response data copy to allocation size (CVSS 7.0, Linux)
- [CVE-2026-53147](https://cve.now/CVE-2026-53147.md): thunderbolt: Validate XDomain request packet size before type cast (CVSS 8.1, Linux)
- [CVE-2026-53146](https://cve.now/CVE-2026-53146.md): thunderbolt: Limit XDomain response copy to actual frame size (CVSS 7.1, Linux)
- [CVE-2026-53145](https://cve.now/CVE-2026-53145.md): drm/gem: Try to fix change\_handle ioctl, attempt 4 (CVSS 7.8, Linux)
- [CVE-2026-53144](https://cve.now/CVE-2026-53144.md): drm/amdkfd: fix NULL dereference in get\_queue\_ids() (no CVSS, Linux)
- [CVE-2026-53143](https://cve.now/CVE-2026-53143.md): drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVSS 7.0, Linux)
- [CVE-2026-53142](https://cve.now/CVE-2026-53142.md): drm/xe/display: fix oops in suspend/shutdown without display (no CVSS, Linux)
- [CVE-2026-53141](https://cve.now/CVE-2026-53141.md): drm/v3d: Fix global performance monitor reference counting (no CVSS, Linux)
- [CVE-2026-53140](https://cve.now/CVE-2026-53140.md): drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (no CVSS, Linux)
- [CVE-2026-53139](https://cve.now/CVE-2026-53139.md): drm/v3d: Skip CSD when it has zeroed workgroups (no CVSS, Linux)
- [CVE-2026-53138](https://cve.now/CVE-2026-53138.md): drm/amd/display: Bound VBIOS record-chain walk loops (no CVSS, Linux)
- [CVE-2026-53137](https://cve.now/CVE-2026-53137.md): drm/amd/display: Clamp HDMI HDCP2 rx\_id\_list read to buffer size (no CVSS, Linux)
- [CVE-2026-53136](https://cve.now/CVE-2026-53136.md): drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (no CVSS, Linux)
- [CVE-2026-53135](https://cve.now/CVE-2026-53135.md): drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (no CVSS, Linux)
- [CVE-2026-53134](https://cve.now/CVE-2026-53134.md): netfilter: nft\_fib: fix stale stack leak via the OIFNAME register (no CVSS, Linux)
- [CVE-2026-53133](https://cve.now/CVE-2026-53133.md): RDMA/umem: Fix truncation for block sizes \>= 4G (CVSS 7.8, Linux)
- [CVE-2026-53132](https://cve.now/CVE-2026-53132.md): vsock/virtio: fix potential unbounded skb queue (CVSS 7.1, Linux)
- [CVE-2026-53131](https://cve.now/CVE-2026-53131.md): netfilter: require Ethernet MAC header before using eth\_hdr() (CVSS 9.4, Linux)
- [CVE-2026-41566](https://cve.now/CVE-2026-41566.md): Apache Kvrocks: Improper permission for the APPLYBATCH command (CVSS 9.4, Apache Software Foundation Apache Kvrocks)
- [CVE-2026-45188](https://cve.now/CVE-2026-45188.md): Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling (CVSS 2.4, Apache Software Foundation Apache Kvrocks)
- [CVE-2026-46751](https://cve.now/CVE-2026-46751.md): Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service. (CVSS 5.5, Apache Software Foundation Apache Kvrocks)
- [CVE-2026-46752](https://cve.now/CVE-2026-46752.md): Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() (CVSS 10.0, Apache Software Foundation Apache Kvrocks)
- [CVE-2026-54226](https://cve.now/CVE-2026-54226.md): Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS (CVSS 6.4, Apache Software Foundation Apache Kvrocks)
- [CVE-2026-56129](https://cve.now/CVE-2026-56129.md): Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. (CVSS 5.5, Dynabook Generic IO & Memory Access driver · TOSHIBA Generi…)
- [CVE-2026-12937](https://cve.now/CVE-2026-12937.md): Tourfic \<= 2.22.7 - Unauthenticated SQL Injection via 'post\_id' Parameter (CVSS 7.5, themefic Tourfic – AI Powered Travel Booking, Hotel Booking…)
- [CVE-2026-9702](https://cve.now/CVE-2026-9702.md): InPost PL \< 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking (CVSS 7.5, InPost PL)
- [CVE-2026-5305](https://cve.now/CVE-2026-5305.md): Email Address Encoder (Free \< 1.0.25, Premium \< 0.3.12) - Unauthenticated Stored XSS (CVSS 8.8, Email Address Encoder · email-encoder-premium)
- [CVE-2026-10824](https://cve.now/CVE-2026-10824.md): Masteriyo LMS \< 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion (CVSS 6.5, Masteriyo LMS)
- [CVE-2026-12490](https://cve.now/CVE-2026-12490.md): Bypass of client certificate verification with transfer over TLS (CVSS 8.2, NLnet Labs NSD)
- [CVE-2026-12246](https://cve.now/CVE-2026-12246.md): Out of bounds stack write with crafted APL RR (CVSS 7.2, NLnet Labs NSD)
- [CVE-2026-12245](https://cve.now/CVE-2026-12245.md): Denial of DNS over TLS service by any DoT client (CVSS 8.7, NLnet Labs NSD)
- [CVE-2026-12244](https://cve.now/CVE-2026-12244.md): Heap overflow and crash with crafted SVCB RR (CVSS 8.7, NLnet Labs NSD)
- [CVE-2026-10086](https://cve.now/CVE-2026-10086.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-13311](https://cve.now/CVE-2026-13311.md): shell-quote parse() is quadratic in token count, enabling denial of service (CVSS 8.7, ljharb shell-quote · shell-quote)
- [CVE-2026-0934](https://cve.now/CVE-2026-0934.md): Incorrect Authorization in GitLab (CVSS 3.8, GitLab)
- [CVE-2026-1606](https://cve.now/CVE-2026-1606.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-2238](https://cve.now/CVE-2026-2238.md): Missing Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-3176](https://cve.now/CVE-2026-3176.md): Missing Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2026-5309](https://cve.now/CVE-2026-5309.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-5796](https://cve.now/CVE-2026-5796.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-5952](https://cve.now/CVE-2026-5952.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-8330](https://cve.now/CVE-2026-8330.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 4.4, GitLab)
- [CVE-2026-10712](https://cve.now/CVE-2026-10712.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab)
- [CVE-2026-11379](https://cve.now/CVE-2026-11379.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-12053](https://cve.now/CVE-2026-12053.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 8.6, GitLab)
- [CVE-2026-12635](https://cve.now/CVE-2026-12635.md): Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab (CVSS 0.0, GitLab)
- [CVE-2026-2508](https://cve.now/CVE-2026-2508.md): Gravity Forms Booking \<= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff\_id' (CVSS 6.5, GravityMore Gravity Bookings)
- [CVE-2026-12077](https://cve.now/CVE-2026-12077.md): Dokan Pro \<= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters (CVSS 7.5, wedevs Dokan Pro)
- [CVE-2026-12079](https://cve.now/CVE-2026-12079.md): Dokan Pro \<= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter (CVSS 6.5, wedevs Dokan Pro)
- [CVE-2026-10833](https://cve.now/CVE-2026-10833.md): Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns \<= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2026-8658](https://cve.now/CVE-2026-8658.md): OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin (CVSS 6.0, Rapid7 InsightConnect Tcpdump Plugin)
- [CVE-2026-8662](https://cve.now/CVE-2026-8662.md): Path Traversal in Rapid7 InsightConnect Compression Plugin (CVSS 3.3, Rapid7 InsightConnect Compression Plugin)
- [CVE-2026-8666](https://cve.now/CVE-2026-8666.md): OS Command Injection in Rapid7 InsightConnect Traceroute Plugin (CVSS 7.7, Rapid7 InsightConnect Traceroute Plugin)
- [CVE-2026-8592](https://cve.now/CVE-2026-8592.md): OS Command Injection in Rapid7 InsightConnect AWK Plugin (CVSS 7.7, Rapid7 InsightConnect AWK Plugin)
- [CVE-2026-8664](https://cve.now/CVE-2026-8664.md): OS Command Injection in Rapid7 InsightConnect Finger Plugin (CVSS 6.0, Rapid7 InsightConnect Finger Plugin)
- [CVE-2026-8665](https://cve.now/CVE-2026-8665.md): OS Command Injection in Rapid7 InsightConnect Translate Plugin (CVSS 7.7, Rapid7 InsightConnect TR Plugin)
- [CVE-2026-8660](https://cve.now/CVE-2026-8660.md): OS Command Injection in Rapid7 InsightConnect Ping Plugin (CVSS 7.7, Rapid7 InsightConnect Ping Plugin)
- [CVE-2026-57589](https://cve.now/CVE-2026-57589.md): sys/kern/sysv\_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. (CVSS 7.4, OpenBSD)
- [CVE-2026-9153](https://cve.now/CVE-2026-9153.md): Arbitrary File Read in Rapid7 InsightConnect Sed Plugin (CVSS 6.5, Rapid7 InsightConnect Sed Plugin)
- [CVE-2026-9154](https://cve.now/CVE-2026-9154.md): Arbitrary File Write in Rapid7 InsightConnect Sed Plugin (CVSS 7.1, Rapid7 InsightConnect Sed Plugin)
- [CVE-2026-9155](https://cve.now/CVE-2026-9155.md): OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter. (CVSS 8.8, Rapid7 InsightConnect Sed Plugin)
- [CVE-2026-8659](https://cve.now/CVE-2026-8659.md): OS Command Injection in Rapid7 InsightConnect SQLmap Plugin (CVSS 6.0, Rapid7 InsightConnect SQLmap Plugin)
- [CVE-2025-60464](https://cve.now/CVE-2025-60464.md): A use-after-free in the gf\_sei\_load\_from\_state\_internal function (/filters/sei\_load.c) of GPAC Project/MP4Box before 26.02.0 allows attacker (CVSS 7.8)
- [CVE-2025-60465](https://cve.now/CVE-2025-60465.md): A use-after-free in the gf\_filter\_pid\_inst\_swap function (/filter\_core/filter\_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers (CVSS 6.1)
- [CVE-2026-37149](https://cve.now/CVE-2026-37149.md): GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost par (CVSS 7.7)
- [CVE-2026-37452](https://cve.now/CVE-2026-37452.md): Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via (CVSS 7.5)
- [CVE-2026-37453](https://cve.now/CVE-2026-37453.md): Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via (CVSS 7.5)
- [CVE-2026-37454](https://cve.now/CVE-2026-37454.md): Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via (CVSS 7.5)
- [CVE-2026-38637](https://cve.now/CVE-2026-38637.md): An issue in the pthread\_rwlockattr\_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a c (CVSS 7.5)
- [CVE-2026-38640](https://cve.now/CVE-2026-38640.md): A reachable unwrap in the \_\_assert\_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.