# CVEs published 2026-07-01

364 CVEs were published on July 1, 2026: 52 critical, 122 high. Days are UTC.

- [CVE-2026-50280](https://cve.now/CVE-2026-50280.md): Craft CMS: Authorization bypass in \`entries/move-to-section\` via missing target-section save check (CVSS 6.0, craftcms cms · craftcms/cms)
- [CVE-2026-50279](https://cve.now/CVE-2026-50279.md): Craft CMS: Authorship spoofing in \`entries/save-entry\` via pre-check/post-mutation authorization gap (CVSS 7.6, craftcms cms · craftcms/cms)
- [CVE-2026-55794](https://cve.now/CVE-2026-55794.md): Craft CMS: Potential authenticated Remote Code Execution via referrer redirect (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-55792](https://cve.now/CVE-2026-55792.md): Craft CMS: Sensitive File Disclosure / Server-Side File Read (CVSS 6.0, craftcms cms · craftcms/cms)
- [CVE-2026-55791](https://cve.now/CVE-2026-55791.md): Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-14439](https://cve.now/CVE-2026-14439.md): Path Traversal in Altium Git Service Allows Remote Code Execution (CVSS 9.4, Altium Enterprise Server · Altium)
- [CVE-2026-55790](https://cve.now/CVE-2026-55790.md): Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget (CVSS 7.4, craftcms cms · craftcms/cms)
- [CVE-2026-50284](https://cve.now/CVE-2026-50284.md): Craft CMS: Missing peer-permission check in \`AssetsController::actionDeleteFolder\` allows deletion of other users' assets (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-14440](https://cve.now/CVE-2026-14440.md): Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records (CVSS 7.6, Cloudflare Universal SSL)
- [CVE-2026-14426](https://cve.now/CVE-2026-14426.md): Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gesture (CVSS 7.5, Google Chrome)
- [CVE-2026-14394](https://cve.now/CVE-2026-14394.md): Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-14432](https://cve.now/CVE-2026-14432.md): Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-14393](https://cve.now/CVE-2026-14393.md): Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-14403](https://cve.now/CVE-2026-14403.md): Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-14419](https://cve.now/CVE-2026-14419.md): Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craft (CVSS 9.6, Google Chrome)
- [CVE-2026-14417](https://cve.now/CVE-2026-14417.md): Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craft (CVSS 9.6, Google Chrome)
- [CVE-2026-14424](https://cve.now/CVE-2026-14424.md): Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via (CVSS 9.6, Google Chrome)
- [CVE-2026-14425](https://cve.now/CVE-2026-14425.md): Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-14390](https://cve.now/CVE-2026-14390.md): Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-14398](https://cve.now/CVE-2026-14398.md): Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-14405](https://cve.now/CVE-2026-14405.md): Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 9.6, Google Chrome)
- [CVE-2026-14399](https://cve.now/CVE-2026-14399.md): Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-14408](https://cve.now/CVE-2026-14408.md): Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-14421](https://cve.now/CVE-2026-14421.md): Uninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-14413](https://cve.now/CVE-2026-14413.md): Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-14418](https://cve.now/CVE-2026-14418.md): Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-14402](https://cve.now/CVE-2026-14402.md): Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-14431](https://cve.now/CVE-2026-14431.md): Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-14423](https://cve.now/CVE-2026-14423.md): Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a craft (CVSS 9.6, Google Chrome)
- [CVE-2026-14395](https://cve.now/CVE-2026-14395.md): Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-14392](https://cve.now/CVE-2026-14392.md): Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-14400](https://cve.now/CVE-2026-14400.md): Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-14397](https://cve.now/CVE-2026-14397.md): Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escap (CVSS 9.6, Google Chrome)
- [CVE-2026-14406](https://cve.now/CVE-2026-14406.md): Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an attacker who convinced a user to install a malicious extension t (CVSS 5.9, Google Chrome)
- [CVE-2026-14416](https://cve.now/CVE-2026-14416.md): Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a c (CVSS 9.6, Google Chrome)
- [CVE-2026-14388](https://cve.now/CVE-2026-14388.md): Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information fr (CVSS 6.5, Google Chrome)
- [CVE-2026-14386](https://cve.now/CVE-2026-14386.md): Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information fr (CVSS 6.5, Google Chrome)
- [CVE-2026-14396](https://cve.now/CVE-2026-14396.md): Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML p (CVSS 6.5, Google Chrome)
- [CVE-2026-14384](https://cve.now/CVE-2026-14384.md): Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-14422](https://cve.now/CVE-2026-14422.md): Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform out of bounds (CVSS 8.8, Google Chrome)
- [CVE-2026-14420](https://cve.now/CVE-2026-14420.md): Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox esca (CVSS 9.6, Google Chrome)
- [CVE-2026-14430](https://cve.now/CVE-2026-14430.md): Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-14389](https://cve.now/CVE-2026-14389.md): Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-14387](https://cve.now/CVE-2026-14387.md): Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a cra (CVSS 9.6, Google Chrome)
- [CVE-2026-14391](https://cve.now/CVE-2026-14391.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer proc (CVSS 5.3, Google Chrome)
- [CVE-2026-14429](https://cve.now/CVE-2026-14429.md): Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the (CVSS 8.3, Google Chrome)
- [CVE-2026-14414](https://cve.now/CVE-2026-14414.md): Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the (CVSS 5.3, Google Chrome)
- [CVE-2026-14428](https://cve.now/CVE-2026-14428.md): Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had comp (CVSS 8.3, Google Chrome)
- [CVE-2026-14412](https://cve.now/CVE-2026-14412.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised th (CVSS 8.3, Google Chrome)
- [CVE-2026-14411](https://cve.now/CVE-2026-14411.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-14382](https://cve.now/CVE-2026-14382.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-14401](https://cve.now/CVE-2026-14401.md): Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had com (CVSS 8.3, Google Chrome)
- [CVE-2026-14381](https://cve.now/CVE-2026-14381.md): Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-14415](https://cve.now/CVE-2026-14415.md): Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in speci (CVSS 8.8, Google Chrome)
- [CVE-2026-14409](https://cve.now/CVE-2026-14409.md): Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in speci (CVSS 7.5, Google Chrome)
- [CVE-2026-14407](https://cve.now/CVE-2026-14407.md): Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-14383](https://cve.now/CVE-2026-14383.md): Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-14410](https://cve.now/CVE-2026-14410.md): Inappropriate implementation in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer proc (CVSS 4.3, Google Chrome)
- [CVE-2026-14404](https://cve.now/CVE-2026-14404.md): Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-14427](https://cve.now/CVE-2026-14427.md): Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-14385](https://cve.now/CVE-2026-14385.md): Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remote attacker to perform out of bounds memory acces (CVSS 8.8, Google Chrome)
- [CVE-2026-50283](https://cve.now/CVE-2026-50283.md): Craft CMS: Unauthorized Deletion of Source Assets During File Replacement (CVSS 5.3, craftcms cms · craftcms/cms)
- [CVE-2026-55793](https://cve.now/CVE-2026-55793.md): Craft CMS: Stored XSS via Structure entry title in table view (CVSS 5.9, craftcms cms · craftcms/cms)
- [CVE-2026-54712](https://cve.now/CVE-2026-54712.md): OpenTelemetry Javaagent RMI context propagation allows resource exhaustion (CVSS 5.3, open-telemetry opentelemetry-java-instrumentation · io.open…)
- [CVE-2026-54704](https://cve.now/CVE-2026-54704.md): OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords (CVSS 6.5, open-telemetry opentelemetry-java-instrumentation · io.open…)
- [CVE-2026-54263](https://cve.now/CVE-2026-54263.md): Wagtail: Reflected XSS in dynamic image URL generator view (CVSS 7.3, wagtail)
- [CVE-2026-54262](https://cve.now/CVE-2026-54262.md): Wagtail: Pages translations can be created without page permissions when using simple\_translation (CVSS 4.3, wagtail)
- [CVE-2026-54261](https://cve.now/CVE-2026-54261.md): Wagtail: Improper permission handling in image preview (CVSS 6.5, wagtail)
- [CVE-2026-54259](https://cve.now/CVE-2026-54259.md): Wagtail: Improper restriction handling on Documents and Images chosen endpoints (CVSS 4.3, wagtail)
- [CVE-2026-54260](https://cve.now/CVE-2026-54260.md): Wagtail: Denial of service via unbounded filter specs in the image preview (CVSS 4.3, wagtail)
- [CVE-2026-14340](https://cve.now/CVE-2026-14340.md): An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositories (CVSS 5.3, GitHub Enterprise Server)
- [CVE-2026-54720](https://cve.now/CVE-2026-54720.md): Silverstripe Framework: Possible XSS attack through media embed (CVSS 5.4, silverstripe-framework · silverstripe/framework)
- [CVE-2026-55660](https://cve.now/CVE-2026-55660.md): TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover (CVSS 7.6, tinacms · @tinacms/app)
- [CVE-2026-54074](https://cve.now/CVE-2026-54074.md): @tinacms/cli: Remote Code Execution via Forestry migration — unsanitised \_\_TINA\_INTERNAL\_\_ marker in user-controlled YAML labels (CVSS 7.8, tinacms · @tinacms/cli)
- [CVE-2026-55661](https://cve.now/CVE-2026-55661.md): TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes (CVSS 4.8, tinacms · @tinacms/mdx)
- [CVE-2026-58263](https://cve.now/CVE-2026-58263.md): Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier (CVSS 7.2, xdan jodit · jodit)
- [CVE-2026-54756](https://cve.now/CVE-2026-54756.md): Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge (CVSS 6.3, xdan jodit · jodit)
- [CVE-2026-55886](https://cve.now/CVE-2026-55886.md): Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() (CVSS 6.3, xdan jodit · jodit)
- [CVE-2026-50521](https://cve.now/CVE-2026-50521.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2026-54786](https://cve.now/CVE-2026-54786.md): Wasmtime: Leak in WASIp1 \`fd\_renumber\` implementation (CVSS 2.3, bytecodealliance wasmtime · wasmtime-wasi)
- [CVE-2026-55153](https://cve.now/CVE-2026-55153.md): mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets" (CVSS 7.1, swaldman mchange-commons-java · com.mchange:mchange-commons…)
- [CVE-2026-55688](https://cve.now/CVE-2026-55688.md): AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore (CVSS 4.0, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2026-54908](https://cve.now/CVE-2026-54908.md): Pion DTLS: Denial of service via panic while parsing a crafted ECDHE\_PSK ServerKeyExchange message (CVSS 6.3, pion dtls · github.com/pion/dtls/v3)
- [CVE-2026-14265](https://cve.now/CVE-2026-14265.md): RCE via Deserialization in AWS Advanced JDBC Wrapper (CVSS 7.5, AWS Advanced JDBC Wrapper)
- [CVE-2026-58593](https://cve.now/CVE-2026-58593.md): NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User (CVSS 7.5, NodeBB)
- [CVE-2026-58592](https://cve.now/CVE-2026-58592.md): Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration (CVSS 8.3, LadybirdBrowser Ladybird)
- [CVE-2026-49858](https://cve.now/CVE-2026-49858.md): API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate (CVSS 5.9, api-platform core · api-platform/hal +2)
- [CVE-2026-58457](https://cve.now/CVE-2026-58457.md): Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp (CVSS 9.3, Shenzhen Aitemi E Commerce Co. M300 Wi-Fi Repeater)
- [CVE-2026-14363](https://cve.now/CVE-2026-14363.md): Cargo Extension: SQLi in Special:Drilldown (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-54164](https://cve.now/CVE-2026-54164.md): API Platform Core: Missing IRI type check enables resource type confusion (CVSS 6.5, api-platform core · api-platform/core)
- [CVE-2026-13760](https://cve.now/CVE-2026-13760.md): OS Command Injection in aws-cdk-lib Docker Bundling (CVSS 7.3, AWS CDK · aws-cdk-lib)
- [CVE-2026-55597](https://cve.now/CVE-2026-55597.md): ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55595](https://cve.now/CVE-2026-55595.md): ImageMagick: Infinite Loop in connected-components when providing invalid arguments (CVSS 4.7, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55594](https://cve.now/CVE-2026-55594.md): ImageMagick: Stack Overflow in MVG decoder due to missing depth check. (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55577](https://cve.now/CVE-2026-55577.md): ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder (CVSS 5.9, ImageMagick)
- [CVE-2026-55510](https://cve.now/CVE-2026-55510.md): ImageMagick: Use-After-Free in crafted 8BIM when identifying an image (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-53467](https://cve.now/CVE-2026-53467.md): ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged (CVSS 5.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-14358](https://cve.now/CVE-2026-14358.md): Stored XSS in Wikimedia Chart pie tooltip via Data:\*.tab field title (CVSS 6.9, The Wikimedia Foundation Mediawiki - Charts Extension)
- [CVE-2026-41121](https://cve.now/CVE-2026-41121.md): Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulner (CVSS 7.3, Dell Device Management Agent)
- [CVE-2026-13769](https://cve.now/CVE-2026-13769.md): Overly permissive File Permissions in AWS CLI (CVSS 5.5, AWS CLI · awscli)
- [CVE-2026-49119](https://cve.now/CVE-2026-49119.md): Gradio \< 6.16.0 Path Traversal via FileExplorer.preprocess() (CVSS 8.7, gradio-app gradio · gradio)
- [CVE-2026-58517](https://cve.now/CVE-2026-58517.md): Blocked users can create and edit WikiLambda objects (CVSS 6.9, The Wikimedia Foundation Mediawiki - WikiLambda Extension)
- [CVE-2026-53466](https://cve.now/CVE-2026-53466.md): ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow (CVSS 6.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-55628](https://cve.now/CVE-2026-55628.md): ImageMagick: Policy Bypass in concatenate operation due to missing checks (CVSS 5.5, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-58451](https://cve.now/CVE-2026-58451.md): Horde IMP \< 7.0.1 Path Traversal via Compose.php img src (CVSS 7.1, horde imp)
- [CVE-2026-53489](https://cve.now/CVE-2026-53489.md): containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore (CVSS 8.2, containerd · github.com/containerd/containerd +1)
- [CVE-2026-53492](https://cve.now/CVE-2026-53492.md): containerd CRI checkpoint restore CDI annotation smuggling (CVSS 8.4, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-50195](https://cve.now/CVE-2026-50195.md): containerd: CRI checkpoint import allows local image tag poisoning (CVSS 5.6, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-50160](https://cve.now/CVE-2026-50160.md): Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT\_SECRET Overwrite (CVSS 10.0, hoppscotch)
- [CVE-2026-47262](https://cve.now/CVE-2026-47262.md): containerd image-triggered runtime DoS via unbounded group parsing (CVSS 5.3, containerd · github.com/containerd/containerd +1)
- [CVE-2026-57737](https://cve.now/CVE-2026-57737.md): WordPress Shortcodes and extra features for Phlox theme plugin \<= 2.17.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Averta Shortcodes and extra features for Phlox theme)
- [CVE-2026-57736](https://cve.now/CVE-2026-57736.md): WordPress HubSpot plugin \<= 11.3.51 - Sensitive Data Exposure vulnerability (CVSS 7.4, HubSpot)
- [CVE-2026-46680](https://cve.now/CVE-2026-46680.md): containerd user ID handling bypass allows runAsNonRoot evasion (CVSS 7.3, containerd · github.com/containerd/containerd +1)
- [CVE-2026-58521](https://cve.now/CVE-2026-58521.md): SQLi in Cargo extension via year range filter (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-49091](https://cve.now/CVE-2026-49091.md): Improper Output Neutralization for Logs in Kibana Leading to Log Injection (CVSS 8.0, Elastic Kibana)
- [CVE-2026-49090](https://cve.now/CVE-2026-49090.md): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5, Elasticsearch)
- [CVE-2026-58520](https://cve.now/CVE-2026-58520.md): UrlShortener defaults to ineffective validation open to third-party redirects (CVSS 6.9, The Wikimedia Foundation Mediawiki - UrlShortener Extension)
- [CVE-2026-5051](https://cve.now/CVE-2026-5051.md): Audit Log Plugin Directory Guard Bypass via Legacy path Option (CVSS 4.4, HashiCorp Vault)
- [CVE-2026-57723](https://cve.now/CVE-2026-57723.md): WordPress VikBooking Hotel Booking Engine & PMS plugin \<= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability (CVSS 7.4, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-57722](https://cve.now/CVE-2026-57722.md): WordPress Enable Media Replace plugin \<= 4.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ShortPixel Enable Media Replace)
- [CVE-2026-54428](https://cve.now/CVE-2026-54428.md): Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK (CVSS 7.5, Apache Software Foundation Apache HttpComponents Core · org…)
- [CVE-2026-54399](https://cve.now/CVE-2026-54399.md): Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration (CVSS 7.5, Apache Software Foundation Apache HttpComponents Core · org…)
- [CVE-2026-49088](https://cve.now/CVE-2026-49088.md): Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure (CVSS 4.4, Elastic Kibana)
- [CVE-2026-57721](https://cve.now/CVE-2026-57721.md): WordPress ApplyOnline plugin \<= 2.6.7.6 - Broken Access Control vulnerability (CVSS 5.3, WP Reloaded ApplyOnline)
- [CVE-2026-57720](https://cve.now/CVE-2026-57720.md): WordPress ThumbPress plugin \<= 6.3.2 - Broken Access Control vulnerability (CVSS 4.3, Codexpert ThumbPress)
- [CVE-2026-12480](https://cve.now/CVE-2026-12480.md): Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras (CVSS 5.5, keras-team/keras · keras)
- [CVE-2026-57516](https://cve.now/CVE-2026-57516.md): Ray \< 2.56.0 Unsafe Deserialization RCE via WebDataset Reader (CVSS 8.6, Anyscale Ray · ray)
- [CVE-2026-49087](https://cve.now/CVE-2026-49087.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-56152](https://cve.now/CVE-2026-56152.md): Incorrect Authorization in Kibana Leading to Information Disclosure (CVSS 5.3, Elastic Kibana)
- [CVE-2026-20243](https://cve.now/CVE-2026-20243.md): ClamAV ALZ Archive Processing Denial of Service Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-56151](https://cve.now/CVE-2026-56151.md): Improper Input Validation in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-20244](https://cve.now/CVE-2026-20244.md): ClamAV DMG File Processing Denial of Service Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-20215](https://cve.now/CVE-2026-20215.md): ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-20217](https://cve.now/CVE-2026-20217.md): ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-20216](https://cve.now/CVE-2026-20216.md): ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-20213](https://cve.now/CVE-2026-20213.md): ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-20214](https://cve.now/CVE-2026-20214.md): ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2026-20191](https://cve.now/CVE-2026-20191.md): Cisco Catalyst Center Arbitrary File Read Vulnerability (CVSS 7.5, Cisco Catalyst Center)
- [CVE-2026-56150](https://cve.now/CVE-2026-56150.md): Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service (CVSS 6.5, Elastic Fleet Server)
- [CVE-2026-34117](https://cve.now/CVE-2026-34117.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text\_to\_subtitles.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34116](https://cve.now/CVE-2026-34116.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34115](https://cve.now/CVE-2026-34115.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe\_amazon.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34114](https://cve.now/CVE-2026-34114.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate\_text.php (CVSS 9.3, guardian language-system)
- [CVE-2026-56149](https://cve.now/CVE-2026-56149.md): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 4.9, Elasticsearch)
- [CVE-2026-34113](https://cve.now/CVE-2026-34113.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech\_text.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34112](https://cve.now/CVE-2026-34112.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34111](https://cve.now/CVE-2026-34111.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac\_text.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34110](https://cve.now/CVE-2026-34110.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex\_start.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34109](https://cve.now/CVE-2026-34109.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34108](https://cve.now/CVE-2026-34108.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php (CVSS 9.3, guardian language-system)
- [CVE-2026-56148](https://cve.now/CVE-2026-56148.md): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5, Elasticsearch)
- [CVE-2026-34107](https://cve.now/CVE-2026-34107.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34106](https://cve.now/CVE-2026-34106.md): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php (CVSS 9.3, guardian language-system)
- [CVE-2026-34105](https://cve.now/CVE-2026-34105.md): Guardian Language-System SQL Injection via id Parameter in translate\_text.php (CVSS 8.7, guardian language-system)
- [CVE-2026-34104](https://cve.now/CVE-2026-34104.md): Guardian Language-System SQL Injection via name Parameter in designer.php (CVSS 8.7, guardian language-system)
- [CVE-2026-34103](https://cve.now/CVE-2026-34103.md): Guardian Language-System SQL Injection via id Parameter in subtitles.php (CVSS 8.7, guardian language-system)
- [CVE-2026-34102](https://cve.now/CVE-2026-34102.md): Guardian Language-System SQL Injection via id Parameter in job\_info\_get.php (CVSS 8.7, guardian language-system)
- [CVE-2026-34101](https://cve.now/CVE-2026-34101.md): Guardian Language-System SQL Injection via id Parameter in text\_file.php (CVSS 8.7, guardian language-system)
- [CVE-2026-34100](https://cve.now/CVE-2026-34100.md): Guardian Language-System SQL Injection via id Parameter in media.php (CVSS 8.7, guardian language-system)
- [CVE-2026-34099](https://cve.now/CVE-2026-34099.md): Guardian Language-System Unauthenticated SQL Injection via id Parameter in job\_info.php (CVSS 9.3, guardian language-system)
- [CVE-2026-27409](https://cve.now/CVE-2026-27409.md): WordPress Webba Booking plugin \<= 6.4.13 - Broken Access Control vulnerability (CVSS 5.3, Webba Plugins Webba Booking)
- [CVE-2026-34098](https://cve.now/CVE-2026-34098.md): Guardian Language-System XSS via id Parameter in media.php (CVSS 4.8, guardian language-system)
- [CVE-2026-34097](https://cve.now/CVE-2026-34097.md): Guardian Language-System XSS via id Parameter in text\_file.php (CVSS 4.8, guardian language-system)
- [CVE-2026-34096](https://cve.now/CVE-2026-34096.md): Guardian Language-System XSS via name Parameter in designer.php (CVSS 4.8, guardian language-system)
- [CVE-2026-13211](https://cve.now/CVE-2026-13211.md): Genucenter Disclosure of SNMP Credentials (CVSS 4.3, genua genucenter)
- [CVE-2026-58454](https://cve.now/CVE-2026-58454.md): JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint (CVSS 7.7, JAIOTlink C492A-W6 Wi-Fi IP Camera)
- [CVE-2026-58453](https://cve.now/CVE-2026-58453.md): JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka\_ipc (CVSS 9.3, JAIOTlink C492A-W6 Wi-Fi IP Camera)
- [CVE-2026-58452](https://cve.now/CVE-2026-58452.md): JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint (CVSS 8.7, JAIOTlink C492A-W6 Wi-Fi IP Camera)
- [CVE-2026-58025](https://cve.now/CVE-2026-58025.md): Remote Code Execution via Unsafe Deserialization in LogItem Import (CVSS 5.9, Wikimedia Foundation MediaWiki)
- [CVE-2026-58029](https://cve.now/CVE-2026-58029.md): Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata (CVSS 5.3, Wikimedia Foundation MediaWiki)
- [CVE-2026-58028](https://cve.now/CVE-2026-58028.md): Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets (CVSS 0.0, Wikimedia Foundation MediaWiki · Wikimedia Foundation Centr…)
- [CVE-2026-24270](https://cve.now/CVE-2026-24270.md): NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. (CVSS 9.8, NVIDIA AIStore framework)
- [CVE-2026-57517](https://cve.now/CVE-2026-57517.md): Control Web Panel \< 0.9.8.1225 Blind SQL Injection via userRes Parameter (CVSS 9.3, Control Web Panel)
- [CVE-2026-24266](https://cve.now/CVE-2026-24266.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. (CVSS 5.9, NVIDIA Triton Inference Server)
- [CVE-2026-24264](https://cve.now/CVE-2026-24264.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. (CVSS 7.5, NVIDIA Triton Inference Server)
- [CVE-2026-58026](https://cve.now/CVE-2026-58026.md): $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2026-8857](https://cve.now/CVE-2026-8857.md): Full RCE using EasyTimeline Extension (CVSS 0.0, Wikimedia Foundation timeline)
- [CVE-2026-58038](https://cve.now/CVE-2026-58038.md): Stored XSS through javascript URLs in SVGs generated by EasyTimeline (CVSS 0.0, Wikimedia Foundation timeline)
- [CVE-2026-58027](https://cve.now/CVE-2026-58027.md): QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI (CVSS 5.3, Wikimedia Foundation AbuseFilter)
- [CVE-2026-24251](https://cve.now/CVE-2026-24251.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourc (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-24250](https://cve.now/CVE-2026-24250.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-58030](https://cve.now/CVE-2026-58030.md): SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute (CVSS 5.3, Wikimedia Foundation SyntaxHighlight\_GeSHi)
- [CVE-2026-24249](https://cve.now/CVE-2026-24249.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-24248](https://cve.now/CVE-2026-24248.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of code generation. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-24247](https://cve.now/CVE-2026-24247.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-58032](https://cve.now/CVE-2026-58032.md): mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html (CVSS 5.3, Wikimedia Foundation MediaWiki)
- [CVE-2026-24246](https://cve.now/CVE-2026-24246.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resourc (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-24245](https://cve.now/CVE-2026-24245.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-58033](https://cve.now/CVE-2026-58033.md): "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted (CVSS 5.3, Wikimedia Foundation MediaWiki)
- [CVE-2026-24244](https://cve.now/CVE-2026-24244.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-8480](https://cve.now/CVE-2026-8480.md): Connection possible to the Administration portal with a revoked certificate (CVSS 4.3, Stormshield Network Security)
- [CVE-2026-58037](https://cve.now/CVE-2026-58037.md): Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2026-24243](https://cve.now/CVE-2026-24243.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-24242](https://cve.now/CVE-2026-24242.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-58036](https://cve.now/CVE-2026-58036.md): Users API leaks whether privileged users have their user groups disabled for lack of 2FA (CVSS 2.1, Wikimedia Foundation MediaWiki)
- [CVE-2026-24240](https://cve.now/CVE-2026-24240.md): NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 7.8, NVIDIA Megatron-Bridge)
- [CVE-2026-58127](https://cve.now/CVE-2026-58127.md): PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service (CVSS 9.3, Hyland PACSgear MediaWriter)
- [CVE-2025-23351](https://cve.now/CVE-2025-23351.md): NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may caus (CVSS 9.0, NVIDIA BlueField GA · NVIDIA BlueField LTS22 +7)
- [CVE-2026-58126](https://cve.now/CVE-2026-58126.md): PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service (CVSS 9.3, Hyland PACSgear PACS Scan)
- [CVE-2025-15646](https://cve.now/CVE-2025-15646.md): HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion (CVSS 9.8, BPS HTML::Gumbo)
- [CVE-2025-23350](https://cve.now/CVE-2025-23350.md): NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may caus (CVSS 9.0, NVIDIA BlueField GA · NVIDIA BlueField LTS22 +6)
- [CVE-2026-24260](https://cve.now/CVE-2026-24260.md): NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. (CVSS 8.5, NVIDIA Container Toolkit · NVIDIA GPU Operator)
- [CVE-2026-58024](https://cve.now/CVE-2026-58024.md): API identification of users on private wikis (CVSS 5.1, Wikimedia Foundation MediaWiki)
- [CVE-2026-13707](https://cve.now/CVE-2026-13707.md): Session fixation attacks on improperly configured OAuth 1.0a tools (CVSS 0.0, Wikimedia Foundation OAuth)
- [CVE-2026-13706](https://cve.now/CVE-2026-13706.md): UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG (CVSS 0.0, Wikimedia Foundation UrlShortener)
- [CVE-2026-58399](https://cve.now/CVE-2026-58399.md): @acastellon/auth has an authentication bypass via spoofable headers in validateToken() (CVSS 8.7, antonio-castellon module-auth · @acastellon/auth)
- [CVE-2026-58031](https://cve.now/CVE-2026-58031.md): Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2026-58034](https://cve.now/CVE-2026-58034.md): Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts (CVSS 0.0, Wikimedia Foundation CheckUser)
- [CVE-2026-6283](https://cve.now/CVE-2026-6283.md): Stored XSS in DivvyDrive Information Technologies' DivvyDrive (CVSS 5.4, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-58035](https://cve.now/CVE-2026-58035.md): Stored XSS through a system message in the codex version of Special:Block (CVSS 0.0, Wikimedia Foundation MediaWiki)
- [CVE-2026-5220](https://cve.now/CVE-2026-5220.md): Stored XSS in DivvyDrive Information Technologies' DivvyDrive (CVSS 6.4, DivvyDrive Information Technologies DivvyDrive)
- [CVE-2026-14330](https://cve.now/CVE-2026-14330.md): Pipewire: pulse server alloca stack overflow (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-14324](https://cve.now/CVE-2026-14324.md): Pipewire: raop rtsp null deref (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-2891](https://cve.now/CVE-2026-2891.md): Poly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service (CVSS 8.2, HP CCX · HP Trio C60 +1)
- [CVE-2026-5138](https://cve.now/CVE-2026-5138.md): Foreman: foreman: information disclosure via improper validation of nested request parameters (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-5135](https://cve.now/CVE-2026-5135.md): Foreman: foreman: unauthorized modification of host configurations via broken access control (CVSS 6.5, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-5142](https://cve.now/CVE-2026-5142.md): Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass (CVSS 6.5, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-12374](https://cve.now/CVE-2026-12374.md): Improper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperTool (CVSS 6.4, Cato Networks SDP Client)
- [CVE-2026-6688](https://cve.now/CVE-2026-6688.md): FatFs Buffer Overflow via Unbounded LFN Filename Copy (CVSS 7.6, ChaN FatFs)
- [CVE-2026-6687](https://cve.now/CVE-2026-6687.md): FatFs Stack Buffer Overflow via Uncapped exFAT Label Length (CVSS 7.6, ChaN FatFs)
- [CVE-2026-6686](https://cve.now/CVE-2026-6686.md): FatFs Use of Uninitialized Clusters After Seek Past EOF (CVSS 4.6, ChaN FatFs)
- [CVE-2026-23537](https://cve.now/CVE-2026-23537.md): Feast: unauthenticated arbitrary file write (CVSS 9.1, Feast Feature Server · Red Hat OpenShift AI)
- [CVE-2026-13602](https://cve.now/CVE-2026-13602.md): Session takeover vulnerability (CVSS 7.7, pretix · pretix-mollie +6)
- [CVE-2026-6684](https://cve.now/CVE-2026-6684.md): FatFs Infinite Loop in GPT Partition Scan (CVSS 4.6, ChaN FatFs)
- [CVE-2026-6683](https://cve.now/CVE-2026-6683.md): FatFs Divide-by-Zero in exFAT Sync (CVSS 4.6, ChaN FatFs)
- [CVE-2026-6682](https://cve.now/CVE-2026-6682.md): FatFs Integer Overflow in FAT32 Volume Mount (CVSS 7.6, ChaN FatFs)
- [CVE-2026-57692](https://cve.now/CVE-2026-57692.md): WordPress PrivateContent plugin \<= 9.9.2 - Privilege Escalation vulnerability (CVSS 9.8, LCweb PrivateContent)
- [CVE-2026-53356](https://cve.now/CVE-2026-53356.md): drm/i915/gem: Fix phys BO pread/pwrite with offset (CVSS 7.8, Linux)
- [CVE-2026-53355](https://cve.now/CVE-2026-53355.md): net: rds: clear i\_sends on setup unwind (CVSS 9.8, Linux)
- [CVE-2026-53354](https://cve.now/CVE-2026-53354.md): arm64: errata: Mitigate TLBI errata on various Arm CPUs (CVSS 8.8, Linux)
- [CVE-2026-53353](https://cve.now/CVE-2026-53353.md): hsr: Remove WARN\_ONCE() in hsr\_addr\_is\_self(). (no CVSS, Linux)
- [CVE-2026-53352](https://cve.now/CVE-2026-53352.md): signal: clear JOBCTL\_PENDING\_MASK for caller in zap\_other\_threads() (no CVSS, Linux)
- [CVE-2026-53351](https://cve.now/CVE-2026-53351.md): riscv/ptrace: Use USER\_REGSET\_NOTE\_TYPE for REGSET\_CFI (no CVSS, Linux)
- [CVE-2026-53350](https://cve.now/CVE-2026-53350.md): ASoC: wm\_adsp: Fix NULL dereference when removing firmware controls (no CVSS, Linux)
- [CVE-2026-53349](https://cve.now/CVE-2026-53349.md): netfilter: nf\_conntrack: destroy stale expectfn expectations on unregister (no CVSS, Linux)
- [CVE-2026-53348](https://cve.now/CVE-2026-53348.md): ASoC: SDCA: fix NULL pointer dereference in sdca\_dev\_unregister\_functions (no CVSS, Linux)
- [CVE-2026-53347](https://cve.now/CVE-2026-53347.md): drm/virtio: Fix driver removal with disabled KMS (no CVSS, Linux)
- [CVE-2026-53346](https://cve.now/CVE-2026-53346.md): rust: arm64: set uwtable llvm module flag for CONFIG\_UNWIND\_TABLES (no CVSS, Linux)
- [CVE-2026-53345](https://cve.now/CVE-2026-53345.md): KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying (no CVSS, Linux)
- [CVE-2026-53344](https://cve.now/CVE-2026-53344.md): pinctrl: mcp23s08: Initialize mcp-\>dev and mcp-\>addr before regmap init (no CVSS, Linux)
- [CVE-2026-53343](https://cve.now/CVE-2026-53343.md): ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow (no CVSS, Linux)
- [CVE-2026-53342](https://cve.now/CVE-2026-53342.md): arm64: mm: call pagetable dtor when freeing hot-removed page tables (no CVSS, Linux)
- [CVE-2026-53341](https://cve.now/CVE-2026-53341.md): fhandle: fix UAF due to unlocked -\>mnt\_ns read in may\_decode\_fh() (CVSS 7.8, Linux)
- [CVE-2026-53340](https://cve.now/CVE-2026-53340.md): i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (no CVSS, Linux)
- [CVE-2026-53339](https://cve.now/CVE-2026-53339.md): i2c: qcom-cci: Fix NULL pointer dereference in cci\_remove() (no CVSS, Linux)
- [CVE-2026-53338](https://cve.now/CVE-2026-53338.md): net: airoha: Add NULL check for of\_reserved\_mem\_lookup() in airoha\_qdma\_init\_hfwd\_queues() (no CVSS, Linux)
- [CVE-2026-53337](https://cve.now/CVE-2026-53337.md): net: bonding: fix NULL pointer dereference in bond\_do\_ioctl() (no CVSS, Linux)
- [CVE-2026-53336](https://cve.now/CVE-2026-53336.md): nvmem: layouts: onie-tlv: fix hang on unknown types (no CVSS, Linux)
- [CVE-2026-53335](https://cve.now/CVE-2026-53335.md): mm/damon/lru\_sort: handle ctx allocation failure (no CVSS, Linux)
- [CVE-2026-53334](https://cve.now/CVE-2026-53334.md): mm/damon/reclaim: handle ctx allocation failure (no CVSS, Linux)
- [CVE-2026-53333](https://cve.now/CVE-2026-53333.md): mm/mincore: handle non-swap entries before !CONFIG\_SWAP guard (no CVSS, Linux)
- [CVE-2026-53332](https://cve.now/CVE-2026-53332.md): slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (no CVSS, Linux)
- [CVE-2026-53331](https://cve.now/CVE-2026-53331.md): slimbus: qcom-ngd-ctrl: Avoid ABBA on tx\_lock/ctrl-\>lock (no CVSS, Linux)
- [CVE-2026-53330](https://cve.now/CVE-2026-53330.md): drm/amd/display: Fix out-of-bounds read in dp\_get\_eq\_aux\_rd\_interval() (no CVSS, Linux)
- [CVE-2026-53329](https://cve.now/CVE-2026-53329.md): drm/amd/display: Use krealloc\_array() in dal\_vector\_reserve() (CVSS 7.0, Linux)
- [CVE-2026-53328](https://cve.now/CVE-2026-53328.md): sched\_ext: Don't warn on NULL cgrp\_moving\_from in scx\_cgroup\_move\_task() (no CVSS, Linux)
- [CVE-2026-53327](https://cve.now/CVE-2026-53327.md): debugobjects: Do not fill\_pool() if pi\_blocked\_on (no CVSS, Linux)
- [CVE-2026-53326](https://cve.now/CVE-2026-53326.md): debugobjects: Don't call fill\_pool() in early boot hardirq context (no CVSS, Linux)
- [CVE-2026-5136](https://cve.now/CVE-2026-5136.md): Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation (CVSS 8.8, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-13603](https://cve.now/CVE-2026-13603.md): SSRF with API key leak in pretix-oppwa (CVSS 9.0, pretix-oppwa)
- [CVE-2026-8387](https://cve.now/CVE-2026-8387.md): Relative Path Traversal in allegroai/clearml (CVSS 2.4, allegroai/clearml)
- [CVE-2026-5120](https://cve.now/CVE-2026-5120.md): Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 (CVSS 8.1, Dassault Systèmes BIOVIA Workbook)
- [CVE-2026-53909](https://cve.now/CVE-2026-53909.md): Arbitrary File Upload in MCO (CVSS 5.3, MyComplianceOffice MCO)
- [CVE-2026-53908](https://cve.now/CVE-2026-53908.md): User Enumeration in MCO (CVSS 6.9, MyComplianceOffice MCO)
- [CVE-2026-53907](https://cve.now/CVE-2026-53907.md): Stored Cross‑Site Scripting in MCO (CVSS 4.8, MyComplianceOffice MCO)
- [CVE-2026-53906](https://cve.now/CVE-2026-53906.md): Path Disclosure and Path Traversal in MCO (CVSS 5.1, MyComplianceOffice MCO)
- [CVE-2026-53905](https://cve.now/CVE-2026-53905.md): Unauthorized Access to Administrator ACL View in MCO (CVSS 5.3, MyComplianceOffice MCO)
- [CVE-2026-53904](https://cve.now/CVE-2026-53904.md): Account Denial of Service in MCO (CVSS 6.3, MyComplianceOffice MCO)
- [CVE-2026-53903](https://cve.now/CVE-2026-53903.md): Insecure Direct Object Reference in MCO (CVSS 5.3, MyComplianceOffice MCO)
- [CVE-2026-53902](https://cve.now/CVE-2026-53902.md): Privilege Escalation in MCO (CVSS 7.1, MyComplianceOffice MCO)
- [CVE-2026-14181](https://cve.now/CVE-2026-14181.md): @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths (CVSS 7.5, @fastify/middie)
- [CVE-2026-14198](https://cve.now/CVE-2026-14198.md): @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values (CVSS 9.1, @fastify/middie)
- [CVE-2026-13323](https://cve.now/CVE-2026-13323.md): In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Co (CVSS 4.1, Eclipse Foundation Eclipse Open VSX)
- [CVE-2026-12142](https://cve.now/CVE-2026-12142.md): NEX-Forms \<= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '\_name\[\]' Array Parameter (CVSS 7.2, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2026-13228](https://cve.now/CVE-2026-13228.md): LatePoint \<= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order\[customer\_id\]' Parameter (CVSS 8.8, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-10095](https://cve.now/CVE-2026-10095.md): WP Photo Album Plus \<= 9.1.13.005 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'subtext' Shortcode Attribute (CVSS 6.4, opajaap WP Photo Album Plus)
- [CVE-2026-14258](https://cve.now/CVE-2026-14258.md): Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-27435](https://cve.now/CVE-2026-27435.md): WordPress Woffice theme \< 5.4.33 - Broken Access Control vulnerability (CVSS 5.3, WofficeIO Woffice)
- [CVE-2026-12754](https://cve.now/CVE-2026-12754.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.12 - Reflected Cross-Site Scripting via 'layoutstyle' Parameter (CVSS 6.1, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-13454](https://cve.now/CVE-2026-13454.md): MotoPress Appointment Booking \<= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter (CVSS 6.5, jetmonsters MotoPress Appointment Booking)
- [CVE-2026-10538](https://cve.now/CVE-2026-10538.md): Improper deserialization handling in Control-M Components (CVSS 8.9, BMC Control-M/Enterprise Manager · BMC Control-M/Server)
- [CVE-2026-10539](https://cve.now/CVE-2026-10539.md): Unauthenticated command injection in Control-M/Server communication command (CVSS 9.5, BMC Control-M/Server)
- [CVE-2026-12158](https://cve.now/CVE-2026-12158.md): RegistrationMagic \<= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc\_assign\_user\_role\_action' Parameter (CVSS 8.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2026-13733](https://cve.now/CVE-2026-13733.md): Download Manager \<= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no\_data\_msg' Shortcode Attribute (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-11387](https://cve.now/CVE-2026-11387.md): SMS Alert \<= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset (CVSS 9.8, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2026-12408](https://cve.now/CVE-2026-12408.md): Slim SEO \<= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' Parameter (CVSS 4.3, rilwis Slim SEO – A Fast & Automated SEO Plugin For WordPre…)
- [CVE-2026-10096](https://cve.now/CVE-2026-10096.md): Qi Blocks \<= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page\_id' Parameter (CVSS 4.3, qodeinteractive Qi Blocks)
- [CVE-2026-12435](https://cve.now/CVE-2026-12435.md): Motors \<= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm\_mark\_as\_sold\_car' Parameter (CVSS 4.3, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-12732](https://cve.now/CVE-2026-12732.md): LearnPress \<= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class\_wrapper\_form' Shortcode Attribute (CVSS 6.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-10540](https://cve.now/CVE-2026-10540.md): Weak password hash protection in Control-M/Entreprise Manager (CVSS 5.6, BMC Control-M/Enterprise Manager)
- [CVE-2026-12577](https://cve.now/CVE-2026-12577.md): DVP80ES3 Improperly Implemented Security Check for Standard vulnerability (CVSS 8.7, deltaww DVP80ES3)
- [CVE-2026-12576](https://cve.now/CVE-2026-12576.md): DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability (CVSS 7.5, deltaww DVP80ES3)
- [CVE-2026-12575](https://cve.now/CVE-2026-12575.md): DVP80ES3 Improper Resource Shutdown or Release Vulnerability (CVSS 7.5, deltaww DVP80ES3)
- [CVE-2026-50043](https://cve.now/CVE-2026-50043.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110. (CVSS 7.2, Seiko Solutions SkyBridge MB-A100/MB-A110)
- [CVE-2026-12224](https://cve.now/CVE-2026-12224.md): Dokan Pro \<= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update\_capabilities REST Endpoint (CVSS 8.8, wedevs Dokan Pro)
- [CVE-2026-56016](https://cve.now/CVE-2026-56016.md): CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources (CVSS 5.9, MARKSTOS CGI::Session::ID::md5)
- [CVE-2026-11887](https://cve.now/CVE-2026-11887.md): Salon Booking System \< 10.30.20 - Subscriber+ Booking Approval Bypass (CVSS 4.3, Salon Booking System)
- [CVE-2026-11883](https://cve.now/CVE-2026-11883.md): WebAuthn Provider for Two Factor \< 2.5.6 - 2FA Bypass (CVSS 7.2, WebAuthn Provider for Two Factor)
- [CVE-2026-11880](https://cve.now/CVE-2026-11880.md): Fluent Forms \< 6.2.1 - Subscriber+ Subscription Cancellation via IDOR (CVSS 3.1, Fluent Forms)
- [CVE-2026-11794](https://cve.now/CVE-2026-11794.md): Advanced Form Integration \< 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping (CVSS 8.1, Advanced Form Integration — Connect Forms to 200+ Apps)
- [CVE-2026-11570](https://cve.now/CVE-2026-11570.md): User Submitted Posts \< 20260608 - Unauthenticated Stored XSS via Author Name (CVSS 4.2, User Submitted Posts)
- [CVE-2026-11568](https://cve.now/CVE-2026-11568.md): Product Configurator for WooCommerce \< 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc\_get\_data (CVSS 7.5, Product Configurator for WooCommerce)
- [CVE-2026-11562](https://cve.now/CVE-2026-11562.md): WS Form LITE \< 1.11.8 - Subscriber+ Arbitrary Settings Update (CVSS 4.3, WS Form LITE)
- [CVE-2026-10750](https://cve.now/CVE-2026-10750.md): Royal MCP \< 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools (CVSS 8.1, Royal MCP)
- [CVE-2025-15666](https://cve.now/CVE-2025-15666.md): Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp)
- [CVE-2026-1239](https://cve.now/CVE-2026-1239.md): Ninja Forms \<= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint (CVSS 7.5, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2026-11823](https://cve.now/CVE-2026-11823.md): BookingPress Appointment Booking Pro \<= 5.7.1 - Unauthenticated SQL Injection via 'store\_service\_date' Parameter (CVSS 7.5, Repute Infosystems BookingPress Appointment Booking Pro)
- [CVE-2026-14193](https://cve.now/CVE-2026-14193.md): DVP80ES300T - Improper Validation of Array Index Vulnerability (CVSS 7.5, deltaww DVP80ES300T)
- [CVE-2026-12579](https://cve.now/CVE-2026-12579.md): AS228T - Authentication Bypass Vulnerability (CVSS 7.4, deltaww AS228T)
- [CVE-2026-11380](https://cve.now/CVE-2026-11380.md): JetWidgets For Elementor \<= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation\_effect' Setting (CVSS 6.4, jetmonsters JetWidgets For Elementor)
- [CVE-2026-6070](https://cve.now/CVE-2026-6070.md): WP-BusinessDirectory \<= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '\_filename' Parameter (CVSS 9.1, cmsjunkie WP-BusinessDirectory – Business directory plugin…)
- [CVE-2026-12127](https://cve.now/CVE-2026-12127.md): WPForms \<= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name (CVSS 5.3, smub WPForms – AI Form Builder for WordPress – Contact Form…)
- [CVE-2026-11988](https://cve.now/CVE-2026-11988.md): LearnPress \<= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter (CVSS 6.5, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-11981](https://cve.now/CVE-2026-11981.md): GiveWP \<= 4.15.3 - Cross-Site Request Forgery (CVSS 4.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2026-2387](https://cve.now/CVE-2026-2387.md): Event Organiser \<= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo\_events Shortcode (CVSS 6.4, stephenharris Event Organiser)
- [CVE-2026-12113](https://cve.now/CVE-2026-12113.md): Appointment Booking Calendar \<= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure (CVSS 4.3, codepeople Appointment Booking Calendar)
- [CVE-2026-7517](https://cve.now/CVE-2026-7517.md): Custom Payment Gateways for WooCommerce \<= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'alg\_wc\_cpg\_input\_fields' Parameter (CVSS 7.2, dhruvin Custom Payment Gateways for WooCommerce)
- [CVE-2026-58519](https://cve.now/CVE-2026-58519.md): Stored XSS through Cargo's map format (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo Extension)
- [CVE-2026-58518](https://cve.now/CVE-2026-58518.md): Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request (CVSS 6.9, The Wikimedia Foundation Mediawiki - RedirectManager Extens…)
- [CVE-2026-12135](https://cve.now/CVE-2026-12135.md): FV Flowplayer Video Player \<= 7.5.51.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'video\_player' Shortcode (CVSS 6.4, foliovision FV Flowplayer Video Player)
- [CVE-2026-12090](https://cve.now/CVE-2026-12090.md): Taskbuilder \<= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm\_proj\_filter' Parameter (CVSS 6.5, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-12923](https://cve.now/CVE-2026-12923.md): Video Gallery \<= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter (CVSS 7.5, emarket-design Video Gallery – YouTube Gallery, Playlist &…)
- [CVE-2026-13015](https://cve.now/CVE-2026-13015.md): WP Google Review Slider \<= 18.1 - Reflected Cross-Site Scripting via 'place' Parameter (CVSS 6.1, jgwhite33 WP Google Review Slider)
- [CVE-2026-12902](https://cve.now/CVE-2026-12902.md): Kadence Blocks \<= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence\_import\_process\_pattern/kadence\_import\_process\_data AJAX Actions (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-12110](https://cve.now/CVE-2026-12110.md): Taskbuilder \<= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task\_search' Parameter (CVSS 6.5, Taskbuilder – Project Management & Task Management Tool Wit…)
- [CVE-2026-13443](https://cve.now/CVE-2026-13443.md): Tutor LMS \<= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title (CVSS 6.4, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-13468](https://cve.now/CVE-2026-13468.md): Visualizer \<= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint (CVSS 7.5, themeisle Visualizer – Tables & Charts Manager with Built-i…)
- [CVE-2026-9107](https://cve.now/CVE-2026-9107.md): Kali Forms \<= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms\_field\_components' Parameter (CVSS 6.4, wpchill Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-12904](https://cve.now/CVE-2026-12904.md): Kadence Blocks \<= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post\_path' Parameter (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-13731](https://cve.now/CVE-2026-13731.md): WPBot \<= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (CVSS 7.2, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2026-13246](https://cve.now/CVE-2026-13246.md): GiveWP \<= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block\_id' Shortcode Attribute (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2026-12133](https://cve.now/CVE-2026-12133.md): JoomSport \<= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season\_groupdel AJAX action (CVSS 4.3, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2026-7840](https://cve.now/CVE-2026-7840.md): UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE) (CVSS 9.3, uvnc UltraVNC)
- [CVE-2026-7839](https://cve.now/CVE-2026-7839.md): UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access (CVSS 9.1, uvnc UltraVNC)
- [CVE-2026-7838](https://cve.now/CVE-2026-7838.md): UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length (CVSS 8.7, uvnc UltraVNC)
- [CVE-2026-7831](https://cve.now/CVE-2026-7831.md): UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing (CVSS 7.5, uvnc UltraVNC)
- [CVE-2026-7830](https://cve.now/CVE-2026-7830.md): UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception (CVSS 7.4, uvnc UltraVNC)
- [CVE-2026-7829](https://cve.now/CVE-2026-7829.md): UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token (CVSS 7.2, uvnc UltraVNC)
- [CVE-2026-7828](https://cve.now/CVE-2026-7828.md): UltraVNC repeater integer overflow in win\_log malloc leading to heap overflow (CVSS 5.3, uvnc UltraVNC)
- [CVE-2026-44040](https://cve.now/CVE-2026-44040.md): UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authentication challenge bytes (CVSS 4.8, uvnc UltraVNC)
- [CVE-2026-44041](https://cve.now/CVE-2026-44041.md): UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NUL-terminated (CVSS 4.3, uvnc UltraVNC)
- [CVE-2026-44042](https://cve.now/CVE-2026-44042.md): UltraVNC repeater wi\_uudecode off-by-one in base64 decode boundary check (CVSS 3.7, uvnc UltraVNC)
- [CVE-2026-20463](https://cve.now/CVE-2026-20463.md): In Modem, there is a possible escalation of privilege due to a permissions bypass. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20462](https://cve.now/CVE-2026-20462.md): In Telephony, there is a possible memory corruption due to a heap buffer overflow. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20461](https://cve.now/CVE-2026-20461.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20460](https://cve.now/CVE-2026-20460.md): In Modem, there is a possible information disclosure due to improper input validation. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20459](https://cve.now/CVE-2026-20459.md): In Modem, there is a possible system crash due to improper input validation. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-20458](https://cve.now/CVE-2026-20458.md): In Modem, there is a possible memory corruption due to a missing bounds check. (CVSS 7.5, MediaTek chipset)
- [CVE-2026-20457](https://cve.now/CVE-2026-20457.md): In Modem, there is a possible system crash due to improper input validation. (CVSS 5.3, MediaTek chipset)
- [CVE-2026-14191](https://cve.now/CVE-2026-14191.md): WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader (CVSS 7.8, RARLAB WinRAR · RARLAB RAR +2)
- [CVE-2026-57963](https://cve.now/CVE-2026-57963.md): Chat UI manipulation by injection (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2026-57962](https://cve.now/CVE-2026-57962.md): Denial-of-service via malicious LDAP address-book server (CVSS 5.3, Mozilla Thunderbird)
- [CVE-2026-53488](https://cve.now/CVE-2026-53488.md): containerd CRI plugin: — image-config \`LABEL\` flows to restart-monitor \`binary://\` logger: host-root command execution from an image pull (CVSS 9.4, containerd · github.com/containerd/containerd +1)
- [CVE-2026-41579](https://cve.now/CVE-2026-41579.md): runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations (CVSS 3.3, opencontainers runc · github.com/opencontainers/runc)
- [CVE-2026-36909](https://cve.now/CVE-2026-36909.md): A NULL pointer dereference in the AP4\_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause (CVSS 6.2)
- [CVE-2026-36910](https://cve.now/CVE-2026-36910.md): An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial o (CVSS 5.5)
- [CVE-2026-36911](https://cve.now/CVE-2026-36911.md): A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 all (CVSS 5.5)
- [CVE-2026-36912](https://cve.now/CVE-2026-36912.md): A NULL pointer dereference in the AP4\_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to (CVSS 7.5)
- [CVE-2026-38142](https://cve.now/CVE-2026-38142.md): An unauthenticated command injection vulnerability in the /goform/fast\_setting\_internet\_set endpoint of Tenda AC18 v15.03.05.05 allows attac (CVSS 6.5)
- [CVE-2026-38891](https://cve.now/CVE-2026-38891.md): An improper input validation in the gazebo\_ros\_diff\_drive.cpp component of gazebo\_plugins v3.9.0 allows attackers to cause a Denial of Servi (CVSS 7.5)
- [CVE-2026-51946](https://cve.now/CVE-2026-51946.md): SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sen (CVSS 6.5)
- [CVE-2026-51947](https://cve.now/CVE-2026-51947.md): An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch\_CWE502\_2026 (CVSS 9.8)
- [CVE-2026-52186](https://cve.now/CVE-2026-52186.md): SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub (CVSS 9.8)
- [CVE-2026-52190](https://cve.now/CVE-2026-52190.md): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.