# CVEs published 2026-07-09

277 CVEs were published on July 9, 2026: 31 critical, 96 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-54771](https://cve.now/CVE-2026-54771.md): Langroid: handle\_message() executes user-supplied tool JSON without sender verification (CVSS 8.1, langroid)
- [CVE-2026-54769](https://cve.now/CVE-2026-54769.md): Langroid: Sandbox Escape to Remote Code Execution via Incomplete \`eval()\` Mitigation in TableChatAgent (CVSS 10.0, langroid)
- [CVE-2026-54760](https://cve.now/CVE-2026-54760.md): Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg\_read\_file calls (CVSS 9.3, langroid)
- [CVE-2026-15311](https://cve.now/CVE-2026-15311.md): NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter.\_markdown\_to\_html cross site scripting (CVSS 5.1, NousResearch hermes-agent)
- [CVE-2026-50181](https://cve.now/CVE-2026-50181.md): Langroid: Path traversal in the file tools allows read/write outside configured current directory (CVSS 7.1, langroid)
- [CVE-2026-50180](https://cve.now/CVE-2026-50180.md): Langroid: SQLChatAgent \_validate\_query blocklist misses pg\_read\_file family enabling arbitrary file read (CVSS 8.7, langroid)
- [CVE-2026-55615](https://cve.now/CVE-2026-55615.md): Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 (CVSS 9.2, langroid)
- [CVE-2026-12598](https://cve.now/CVE-2026-12598.md): LoginPress Pro \<= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback (CVSS 8.1, LoginPress Pro)
- [CVE-2026-12595](https://cve.now/CVE-2026-12595.md): LoginPress Pro \<= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback (CVSS 8.1, LoginPress Pro)
- [CVE-2026-12597](https://cve.now/CVE-2026-12597.md): LoginPress Pro \<= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback (CVSS 8.1, LoginPress Pro)
- [CVE-2026-59856](https://cve.now/CVE-2026-59856.md): Vim: Arbitrary Code Execution via PHP Omni-Completion (CVSS 8.4, vim)
- [CVE-2026-59858](https://cve.now/CVE-2026-59858.md): Vim: Arbitrary Code Execution via C Omni-Completion (CVSS 8.4, vim)
- [CVE-2026-59857](https://cve.now/CVE-2026-59857.md): Vim: Out-of-bounds Write in SAL Soundfolding (CVSS 5.6, vim)
- [CVE-2026-44342](https://cve.now/CVE-2026-44342.md): New API CSRF in email and WeChat account binding endpoints (CVSS 5.3, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-33655](https://cve.now/CVE-2026-33655.md): New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs (CVSS 7.7, QuantumNous new-api · github.com/QuantumNous/new-api)
- [CVE-2026-57501](https://cve.now/CVE-2026-57501.md): Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction (CVSS 0.0, zen-browser desktop)
- [CVE-2026-59854](https://cve.now/CVE-2026-59854.md): SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace (CVSS 4.9, siyuan-note siyuan)
- [CVE-2026-59853](https://cve.now/CVE-2026-59853.md): SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter) (CVSS 6.5, siyuan-note siyuan)
- [CVE-2026-59855](https://cve.now/CVE-2026-59855.md): SiYuan: Store XSS To Rce via Asset.render (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-59832](https://cve.now/CVE-2026-59832.md): SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db (CVSS 7.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-59833](https://cve.now/CVE-2026-59833.md): SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href) (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-59834](https://cve.now/CVE-2026-59834.md): SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content (CVSS 7.5, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-59831](https://cve.now/CVE-2026-59831.md): GitHub CLI \`gh codespace jupyter\` could allow remote code execution when connecting to a malicious Codespace (CVSS 4.4, cli)
- [CVE-2026-45780](https://cve.now/CVE-2026-45780.md): Discourse: Private event sample invitees are serialized to non-invited event viewers (CVSS 5.3, discourse)
- [CVE-2026-58144](https://cve.now/CVE-2026-58144.md): Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter (CVSS 5.1, Cotonti)
- [CVE-2026-53963](https://cve.now/CVE-2026-53963.md): Discourse: Stored-XSS in 2FA delete confirmation modal (CVSS 7.3, discourse)
- [CVE-2026-59828](https://cve.now/CVE-2026-59828.md): Discourse: Hidden post revisions leak through adjacent visible diffs (CVSS 5.3, discourse)
- [CVE-2026-58143](https://cve.now/CVE-2026-58143.md): Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint (CVSS 8.7, Cotonti)
- [CVE-2026-44787](https://cve.now/CVE-2026-44787.md): Discourse: Signup-time primary\_group\_id assignment grants whisperer access (CVSS 8.2, discourse)
- [CVE-2026-53962](https://cve.now/CVE-2026-53962.md): Discourse: Insufficient SVG sanitization logic (CVSS 5.4, discourse)
- [CVE-2026-55424](https://cve.now/CVE-2026-55424.md): Discourse: Topic featured link susceptible to stored XSS (CVSS 7.4, discourse)
- [CVE-2026-15276](https://cve.now/CVE-2026-15276.md): pdeljanov Symphonia Metadata denial of service (CVSS 4.8, pdeljanov Symphonia)
- [CVE-2026-45788](https://cve.now/CVE-2026-45788.md): Discourse: Secure uploads exposed by hotlinked image copying (CVSS 6.3, discourse)
- [CVE-2026-49256](https://cve.now/CVE-2026-49256.md): Discourse: Hidden tag names leaked via category serializers (CVSS 6.3, discourse)
- [CVE-2026-46413](https://cve.now/CVE-2026-46413.md): Discourse: Regular users can route multipart uploads into the admin backup store (CVSS 6.5, discourse)
- [CVE-2026-53961](https://cve.now/CVE-2026-53961.md): Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding) (CVSS 6.5, discourse)
- [CVE-2026-15274](https://cve.now/CVE-2026-15274.md): lo48576 fbxcel Node Header parser.rs denial of service (CVSS 4.8, lo48576 fbxcel)
- [CVE-2026-58122](https://cve.now/CVE-2026-58122.md): Hermes WebUI \< 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing (CVSS 9.3, nesquena hermes-webui)
- [CVE-2026-15271](https://cve.now/CVE-2026-15271.md): TOTOLINK EX200 Web boa.conf least privilege violation (CVSS 7.7, TOTOLINK A3000RU · TOTOLINK A3100R +5)
- [CVE-2026-57054](https://cve.now/CVE-2026-57054.md): Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2026-57032](https://cve.now/CVE-2026-57032.md): Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-58123](https://cve.now/CVE-2026-58123.md): Hermes WebUI \< 0.51.788 Unauthenticated RCE via Terminal API (CVSS 9.3, nesquena hermes-webui)
- [CVE-2026-57031](https://cve.now/CVE-2026-57031.md): Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effect (CVSS 4.7, Juniper Networks Junos OS)
- [CVE-2026-55604](https://cve.now/CVE-2026-55604.md): @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key (CVSS 8.6, arikusi deepseek-mcp-server · @arikusi/deepseek-mcp-server)
- [CVE-2026-57030](https://cve.now/CVE-2026-57030.md): Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2026-57029](https://cve.now/CVE-2026-57029.md): Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash (CVSS 5.3, Juniper Networks Junos OS Evolved)
- [CVE-2026-55605](https://cve.now/CVE-2026-55605.md): @arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint (CVSS 5.3, arikusi deepseek-mcp-server · @arikusi/deepseek-mcp-server)
- [CVE-2026-57028](https://cve.now/CVE-2026-57028.md): Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (CVSS 7.3, Juniper Networks Junos OS Evolved)
- [CVE-2026-57027](https://cve.now/CVE-2026-57027.md): Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-57026](https://cve.now/CVE-2026-57026.md): Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-57025](https://cve.now/CVE-2026-57025.md): Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2026-57024](https://cve.now/CVE-2026-57024.md): Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuously (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2026-57023](https://cve.now/CVE-2026-57023.md): Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2026-55689](https://cve.now/CVE-2026-55689.md): OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset (CVSS 6.8, openfga · github.com/openfga/openfga)
- [CVE-2026-57022](https://cve.now/CVE-2026-57022.md): Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFE (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2026-57021](https://cve.now/CVE-2026-57021.md): Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2026-57020](https://cve.now/CVE-2026-57020.md): Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast flood (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-57019](https://cve.now/CVE-2026-57019.md): Junos OS: MX Series: Specific traffic causes an FPC to reset (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-55170](https://cve.now/CVE-2026-55170.md): OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions (CVSS 2.1, openfga · github.com/openfga/openfga)
- [CVE-2026-33803](https://cve.now/CVE-2026-33803.md): Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2026-33802](https://cve.now/CVE-2026-33802.md): Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2026-33801](https://cve.now/CVE-2026-33801.md): Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-33800](https://cve.now/CVE-2026-33800.md): Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2026-33799](https://cve.now/CVE-2026-33799.md): Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash (CVSS 4.3, Juniper Networks Junos OS)
- [CVE-2026-33794](https://cve.now/CVE-2026-33794.md): Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash (CVSS 5.9, Juniper Networks Junos OS Evolved)
- [CVE-2026-55207](https://cve.now/CVE-2026-55207.md): Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass (CVSS 8.8, pimcore · pimcore/studio-backend-bundle)
- [CVE-2026-21901](https://cve.now/CVE-2026-21901.md): Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash (CVSS 4.4, Juniper Networks Junos OS)
- [CVE-2026-55208](https://cve.now/CVE-2026-55208.md): Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes (CVSS 7.7, pimcore · pimcore/studio-backend-bundle)
- [CVE-2026-55212](https://cve.now/CVE-2026-55212.md): Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation (CVSS 7.1, pimcore · pimcore/studio-backend-bundle)
- [CVE-2026-60120](https://cve.now/CVE-2026-60120.md): Bagisto \< 2.4.4 Stored XSS via CSTI in create.blade.php (CVSS 5.1, Webkul Bagisto)
- [CVE-2026-55865](https://cve.now/CVE-2026-55865.md): Python Liquid: Infinite loop when parsing malformed \`{% case %}\` tags (CVSS 7.1, jg-rp liquid · python-liquid)
- [CVE-2026-15270](https://cve.now/CVE-2026-15270.md): D-link DIR-823G Web boa.conf least privilege violation (CVSS 7.7, D-link DIR-823G)
- [CVE-2026-0275](https://cve.now/CVE-2026-0275.md): Prisma Browser: Local Privilege Escalation on macOS (CVSS 2.0, Palo Alto Networks Prisma Browser)
- [CVE-2026-0276](https://cve.now/CVE-2026-0276.md): Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability (CVSS 1.1, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2026-0277](https://cve.now/CVE-2026-0277.md): Prisma Access Agent: Improper Certificate Validation on iOS (CVSS 5.7, Palo Alto Networks Prisma Access Agent)
- [CVE-2026-0278](https://cve.now/CVE-2026-0278.md): Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (CVSS 5.8, Palo Alto Networks Prisma Access Agent)
- [CVE-2026-0279](https://cve.now/CVE-2026-0279.md): PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (CVSS 1.3, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0280](https://cve.now/CVE-2026-0280.md): PAN-OS: IPv6 Firewall Policy Bypass (CVSS 1.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +2)
- [CVE-2026-0281](https://cve.now/CVE-2026-0281.md): PAN-OS: Information Disclosure Vulnerability in Management Web Interface (CVSS 2.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0282](https://cve.now/CVE-2026-0282.md): PAN-OS: File Deletion Vulnerability in Management Web Interface (CVSS 2.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0283](https://cve.now/CVE-2026-0283.md): PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) (CVSS 4.5, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0284](https://cve.now/CVE-2026-0284.md): PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) (CVSS 4.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0285](https://cve.now/CVE-2026-0285.md): PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (CVSS 4.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0286](https://cve.now/CVE-2026-0286.md): PAN-OS: Authenticated Command Injection in CLI (CVSS 6.0, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-55590](https://cve.now/CVE-2026-55590.md): CakePHP: Open redirect weakness via backslash bypass (CVSS 5.1, cakephp authentication · cakephp/authentication)
- [CVE-2026-54695](https://cve.now/CVE-2026-54695.md): Pipecat: Telephony WebSocket \`/ws\` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID (CVSS 7.5, pipecat-ai pipecat · pipecat-ai)
- [CVE-2026-0287](https://cve.now/CVE-2026-0287.md): PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing (CVSS 6.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-49276](https://cve.now/CVE-2026-49276.md): Kirby: Self cross-site scripting (self-XSS) in the writer field (CVSS 7.4, getkirby kirby · getkirby/cms)
- [CVE-2026-54005](https://cve.now/CVE-2026-54005.md): Kirby: \`pages.access\` permission is not checked in the \`site/find\` REST API route (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2026-50188](https://cve.now/CVE-2026-50188.md): Kirby: Request header injection in \`Http\\Remote\` (CVSS 6.9, getkirby kirby · getkirby/cms)
- [CVE-2026-54004](https://cve.now/CVE-2026-54004.md): Kirby: Access to files of top-level drafts is not protected by permissions (CVSS 6.3, getkirby kirby · getkirby/cms)
- [CVE-2026-49274](https://cve.now/CVE-2026-49274.md): Kirby: \`pages.access\` permission is not checked in the pages picker for parent pages (CVSS 5.3, getkirby kirby · getkirby/cms)
- [CVE-2026-54003](https://cve.now/CVE-2026-54003.md): Kirby: External Initialization of the Panel on reverse proxy setups with the \`Forwarded\` header (CVSS 9.1, getkirby kirby · getkirby/cms)
- [CVE-2026-54002](https://cve.now/CVE-2026-54002.md): Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in \`Dom::sanitize()\` (CVSS 8.5, getkirby kirby · getkirby/cms)
- [CVE-2026-13492](https://cve.now/CVE-2026-13492.md): UsersWP \<= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field (CVSS 8.8, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-58198](https://cve.now/CVE-2026-58198.md): ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer (CVSS 5.5, gunthercox ChatterBot · chatterbot)
- [CVE-2026-59149](https://cve.now/CVE-2026-59149.md): Mockoon: Path traversal in templated \`filePath\` lets a request escape the served directory (prefix-only base check) (CVSS 6.5, mockoon · @mockoon/commons-server +1)
- [CVE-2026-59148](https://cve.now/CVE-2026-59148.md): Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft (CVSS 8.8, mockoon · @mockoon/commons-server +1)
- [CVE-2026-55420](https://cve.now/CVE-2026-55420.md): Discourse: Remote code execution via pdf uploads (CVSS 7.5, discourse)
- [CVE-2026-59826](https://cve.now/CVE-2026-59826.md): Metabase: Arbitrary Code Execution via Database Connection Detail Bypass (CVSS 9.1, metabase)
- [CVE-2026-61344](https://cve.now/CVE-2026-61344.md): Superior Court of California Hearing Reminder Service unauthenticated information disclosure (CVSS 5.3, Superior Court of California, County of Los Angeles Hearing…)
- [CVE-2026-61343](https://cve.now/CVE-2026-61343.md): LibreBooking path traversal (CVSS 8.6, LibreBooking)
- [CVE-2026-58378](https://cve.now/CVE-2026-58378.md): Allwinner TV Box TV98 ADB exposed on network (CVSS 8.8, Allwinner H616)
- [CVE-2026-15204](https://cve.now/CVE-2026-15204.md): TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal (CVSS 6.9, TOTOLINK X5000R)
- [CVE-2026-59827](https://cve.now/CVE-2026-59827.md): Metabase: Unsafe Deserialization of H2 Query Results (CVSS 9.9, metabase)
- [CVE-2026-59817](https://cve.now/CVE-2026-59817.md): Ghost: Paid gift memberships obtainable at minimal cost via the donations feature (CVSS 5.3, TryGhost Ghost · ghost)
- [CVE-2026-59734](https://cve.now/CVE-2026-59734.md): Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution (CVSS 8.8, coollabsio coolify)
- [CVE-2026-59726](https://cve.now/CVE-2026-59726.md): Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment (CVSS 10.0, ruvnet ruflo)
- [CVE-2026-15202](https://cve.now/CVE-2026-15202.md): YzmCMS Header yzmphp.php get\_url cross site scripting (CVSS 5.3, YzmCMS)
- [CVE-2026-59720](https://cve.now/CVE-2026-59720.md): Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server (CVSS 7.5, hoppscotch)
- [CVE-2026-59721](https://cve.now/CVE-2026-59721.md): Hoppscotch: Admin RCE via MAILER\_SMTP\_URL nodemailer sendmail-transport injection (CVSS 7.2, hoppscotch)
- [CVE-2026-43752](https://cve.now/CVE-2026-43752.md): An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the (CVSS 4.9, Claris FileMaker Server)
- [CVE-2026-15195](https://cve.now/CVE-2026-15195.md): apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution (CVSS 5.3, apidevtools json-schema-ref-parser)
- [CVE-2026-59221](https://cve.now/CVE-2026-59221.md): open-webui terminal proxy path traversal guard bypass via 9x encoded traversal (CVSS 7.7, open-webui)
- [CVE-2026-59225](https://cve.now/CVE-2026-59225.md): Open WebUI: Arena task endpoints can bypass underlying model access controls (CVSS 5.4, open-webui)
- [CVE-2026-15308](https://cve.now/CVE-2026-15308.md): Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations (CVSS 8.7, Python Software Foundation CPython)
- [CVE-2026-13462](https://cve.now/CVE-2026-13462.md): PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability (CVSS 7.5, PayRange)
- [CVE-2026-59224](https://cve.now/CVE-2026-59224.md): Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws\_terminal session\_id query injection) (CVSS 8.0, open-webui)
- [CVE-2026-13461](https://cve.now/CVE-2026-13461.md): PayRange version 7.0.7 contains a JavaScript injection vulnerability (CVSS 9.6, PayRange)
- [CVE-2026-59212](https://cve.now/CVE-2026-59212.md): Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete (CVSS 5.4, open-webui)
- [CVE-2026-59223](https://cve.now/CVE-2026-59223.md): Open WebUI: \`WEB\_FETCH\_FILTER\_LIST\` host allow/block filter bypassable via URL path and non-label-boundary matching (CVSS 4.3, open-webui)
- [CVE-2026-15194](https://cve.now/CVE-2026-15194.md): Open5GS AMF context.c amf\_context\_final use after free (CVSS 4.8, Open5GS)
- [CVE-2026-59222](https://cve.now/CVE-2026-59222.md): Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials (CVSS 6.0, open-webui)
- [CVE-2026-59215](https://cve.now/CVE-2026-59215.md): Open WebUI: Private channel messages can be disclosed through cross-channel thread parent\_id binding (CVSS 3.1, open-webui)
- [CVE-2026-59213](https://cve.now/CVE-2026-59213.md): Open WebUI: Cross-user model-list exposure via static cache key in get\_all\_models (aiocache key= vs key\_builder= misuse) (CVSS 3.5, open-webui)
- [CVE-2026-59217](https://cve.now/CVE-2026-59217.md): Open WebUI: Upload \`metadata.knowledge\_id\` bypasses the knowledge-base write-access check (read-only users can add files to KB) (CVSS 4.3, open-webui)
- [CVE-2026-59216](https://cve.now/CVE-2026-59216.md): Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session\_id (CVSS 7.7, open-webui)
- [CVE-2026-15193](https://cve.now/CVE-2026-15193.md): AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection (CVSS 4.8, AidanPark openclaw-android)
- [CVE-2026-59219](https://cve.now/CVE-2026-59219.md): Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout (CVSS 7.1, open-webui)
- [CVE-2026-15192](https://cve.now/CVE-2026-15192.md): mettle sendportal APIv1 Webhooks mailjet missing authentication (CVSS 6.9, mettle sendportal)
- [CVE-2026-59715](https://cve.now/CVE-2026-59715.md): Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) (CVSS 3.1, open-webui)
- [CVE-2026-58459](https://cve.now/CVE-2026-58459.md): gpsd gpsprof Command Injection via gnuplot plot title subtype field (CVSS 8.4, ntpsec gpsd)
- [CVE-2026-59220](https://cve.now/CVE-2026-59220.md): Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config (CVSS 6.5, open-webui)
- [CVE-2026-59226](https://cve.now/CVE-2026-59226.md): Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation (CVSS 3.1, open-webui)
- [CVE-2026-15191](https://cve.now/CVE-2026-15191.md): mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization (CVSS 5.3, mettle sendportal)
- [CVE-2026-59227](https://cve.now/CVE-2026-59227.md): Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission (CVSS 4.3, open-webui)
- [CVE-2026-59218](https://cve.now/CVE-2026-59218.md): Open WebUI: Account enumeration via observable login timing discrepancy (CVSS 5.3, open-webui)
- [CVE-2026-59214](https://cve.now/CVE-2026-59214.md): Open WebUI: Stored web worker XSS via Pyodide (CVSS 7.3, open-webui)
- [CVE-2026-15190](https://cve.now/CVE-2026-15190.md): SourceCodester Simple and Nice Shopping Cart Script login.php sql injection (CVSS 6.9, SourceCodester Simple and Nice Shopping Cart Script)
- [CVE-2026-53987](https://cve.now/CVE-2026-53987.md): Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering (CVSS 7.3, pluginsGLPI tag)
- [CVE-2026-59209](https://cve.now/CVE-2026-59209.md): n8n: Shared Credential Header Leak via HTTP Request Pagination Expression (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-59206](https://cve.now/CVE-2026-59206.md): n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-15189](https://cve.now/CVE-2026-15189.md): aerostackdev aerostack-mcp mcp-whatsapp upload\_media server-side request forgery (CVSS 5.3, aerostackdev aerostack-mcp)
- [CVE-2026-59208](https://cve.now/CVE-2026-59208.md): n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution (CVSS 7.6, n8n-io n8n · n8n)
- [CVE-2026-59207](https://cve.now/CVE-2026-59207.md): n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-42486](https://cve.now/CVE-2026-42486.md): Multiple RBAC issues in XAPI (CVSS 9.4, Xen XAPI)
- [CVE-2026-23562](https://cve.now/CVE-2026-23562.md): Multiple RBAC issues in XAPI (CVSS 9.4, Xen XAPI)
- [CVE-2026-15188](https://cve.now/CVE-2026-15188.md): manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control (CVSS 5.3, manjurulhoque django-job-portal)
- [CVE-2026-11404](https://cve.now/CVE-2026-11404.md): Cesanta Mongoose Out-of-Bounds Read in MG\_TLS\_BUILTIN ClientHello Session ID Parsing (CVSS 8.7, Cesanta Mongoose)
- [CVE-2026-23561](https://cve.now/CVE-2026-23561.md): Multiple RBAC issues in XAPI (CVSS 9.4, Xen XAPI)
- [CVE-2026-23560](https://cve.now/CVE-2026-23560.md): Multiple RBAC issues in XAPI (CVSS 9.4, Xen XAPI)
- [CVE-2026-23559](https://cve.now/CVE-2026-23559.md): Multiple RBAC issues in XAPI (CVSS 9.4, Xen XAPI)
- [CVE-2026-61474](https://cve.now/CVE-2026-61474.md): MISP: Improper sharing group authorization check when adding attributes (CVSS 5.3, misp)
- [CVE-2026-23556](https://cve.now/CVE-2026-23556.md): oxenstored keeps quota related use counts across domain destruction (CVSS 9.4, oxenstored)
- [CVE-2025-58151](https://cve.now/CVE-2025-58151.md): varstored: TOCTOU issues with mapped guest memory (CVSS 9.4, Xen varstored)
- [CVE-2025-58146](https://cve.now/CVE-2025-58146.md): XAPI UTF-8 string handling (CVSS 9.4, Xen XAPI)
- [CVE-2025-27464](https://cve.now/CVE-2025-27464.md): WinPVDrivers: Excessive permissions on user-exposed devices (CVSS 9.4, Xen Windows PV drivers)
- [CVE-2026-15187](https://cve.now/CVE-2026-15187.md): enquirer Public Package API Enquirer.set prototype pollution (CVSS 5.3, enquirer)
- [CVE-2025-27463](https://cve.now/CVE-2025-27463.md): WinPVDrivers: Excessive permissions on user-exposed devices (CVSS 9.4, Xen Windows PV drivers)
- [CVE-2025-27462](https://cve.now/CVE-2025-27462.md): WinPVDrivers: Excessive permissions on user-exposed devices (CVSS 9.4, Xen Windows PV drivers)
- [CVE-2026-60109](https://cve.now/CVE-2026-60109.md): Zeek \< 8.0.9 Null Pointer Dereference DoS via Kerberos KRB\_ERROR Parsing (CVSS 8.7, zeek)
- [CVE-2026-60108](https://cve.now/CVE-2026-60108.md): Zeek \< 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer (CVSS 8.7, zeek)
- [CVE-2026-54801](https://cve.now/CVE-2026-54801.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V26.20), SICORE Base system (All versions \< V (CVSS 7.2, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2026-54800](https://cve.now/CVE-2026-54800.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V26.20), SICORE Base system (All versions \< V (CVSS 4.8, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2026-54799](https://cve.now/CVE-2026-54799.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V26.20), SICORE Base system (All versions \< V (CVSS 6.7, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2026-54798](https://cve.now/CVE-2026-54798.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V26.20), SICORE Base system (All versions \< V (CVSS 6.5, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2026-5005](https://cve.now/CVE-2026-5005.md): Stored XSS in Twiser's OKRs & Goals (CVSS 5.4, Twiser Informatics Technology Consulting, Trade and Educati…)
- [CVE-2026-56292](https://cve.now/CVE-2026-56292.md): Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension \< 10.11.1 (CVSS 9.2, acymailing.com AcyMailing extension for Joomla)
- [CVE-2026-60095](https://cve.now/CVE-2026-60095.md): Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake (CVSS 6.9, Vinchin Backup & Recovery)
- [CVE-2026-60094](https://cve.now/CVE-2026-60094.md): Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink\_server (CVSS 6.9, Vinchin Backup & Recovery)
- [CVE-2026-4256](https://cve.now/CVE-2026-4256.md): LDAP Injection in PEAKUP's PassGate (CVSS 8.2, PEAKUP Technology PassGate)
- [CVE-2026-15186](https://cve.now/CVE-2026-15186.md): macrozheng mall Portal Endpoint create resource injection (CVSS 5.3, macrozheng mall)
- [CVE-2026-12879](https://cve.now/CVE-2026-12879.md): Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy (CVSS 5.9, Google Cloud Apigee)
- [CVE-2026-14261](https://cve.now/CVE-2026-14261.md): CVE-2026-14261 (CVSS 9.1, Xerte Online Tools)
- [CVE-2026-12116](https://cve.now/CVE-2026-12116.md): CVE-2026-12116 (CVSS 9.8, Xerte Online Tools)
- [CVE-2026-15185](https://cve.now/CVE-2026-15185.md): GPAC MP4Box vobsub.c vobsub\_read\_idx out-of-bounds (CVSS 4.8, GPAC)
- [CVE-2026-12593](https://cve.now/CVE-2026-12593.md): Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem (CVSS 8.7, Qt Axivion)
- [CVE-2026-15184](https://cve.now/CVE-2026-15184.md): GNU LibreDWG DWG File dwg.c dwg\_next\_entity null pointer dereference (CVSS 4.8, GNU LibreDWG)
- [CVE-2026-15182](https://cve.now/CVE-2026-15182.md): GNU LibreDWG BMP Image dwg.c dwg\_bmp heap-based overflow (CVSS 4.8, GNU LibreDWG)
- [CVE-2026-9253](https://cve.now/CVE-2026-9253.md): WP Cost Estimation & Payment Forms Builder (E&P Forms) \<= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter (CVSS 7.2, loopus WP Cost Estimation & Payment Forms Builder)
- [CVE-2026-58307](https://cve.now/CVE-2026-58307.md): Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. (CVSS 6.1, Samsung Open Source Escargot)
- [CVE-2026-12590](https://cve.now/CVE-2026-12590.md): body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement (CVSS 3.7, body-parser)
- [CVE-2026-50644](https://cve.now/CVE-2026-50644.md): SQL Injection in SOPlanning Audit Retention Configuration (CVSS 8.6, SOPlanning)
- [CVE-2026-58306](https://cve.now/CVE-2026-58306.md): Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. (CVSS 6.1, Samsung Open Source Escargot)
- [CVE-2026-58305](https://cve.now/CVE-2026-58305.md): Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. (CVSS 6.1, Samsung Open Source Escargot)
- [CVE-2026-56291](https://cve.now/CVE-2026-56291.md): Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension \< 2.4.1 (CVSS 10.0, KEV, balbooa.com Balbooa Forms extension for Joomla)
- [CVE-2026-58304](https://cve.now/CVE-2026-58304.md): Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. (CVSS 6.1, Samsung Open Source Escargot)
- [CVE-2026-58303](https://cve.now/CVE-2026-58303.md): Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. (CVSS 6.1, Samsung Open Source Escargot)
- [CVE-2026-59692](https://cve.now/CVE-2026-59692.md): Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl\_verify\_callback (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-59691](https://cve.now/CVE-2026-59691.md): Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-12428](https://cve.now/CVE-2026-12428.md): Blocks for ACF Fields \<= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter (CVSS 6.5, gamaup Blocks for ACF Fields — Display Custom Fields in the…)
- [CVE-2026-9021](https://cve.now/CVE-2026-9021.md): Easy Invoice \<= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy\_invoice\_accept\_quote / easy\_invoice\_decline\_quote AJAX Actions (CVSS 5.3, matrixaddons Easy Invoice – Invoice Generator, PDF Quotes &…)
- [CVE-2026-9237](https://cve.now/CVE-2026-9237.md): Employee, Leave and Recruitment Management System \<= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm\_singleJobAction AJAX Action (CVSS 4.3, crewhrm Employee, Leave and Recruitment Management System –…)
- [CVE-2026-9235](https://cve.now/CVE-2026-9235.md): DHL eCommerce (Benelux) for WooCommerce \<= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc\_label\_create and dhlpwc\_label\_delete AJAX Actions (CVSS 4.3, dhlparcel DHL eCommerce (Benelux) for WooCommerce)
- [CVE-2026-14372](https://cve.now/CVE-2026-14372.md): Bit Form \<= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '\_old' Parameter (CVSS 7.1, bitpressadmin Bit Form – Contact Form, Payment Forms, Multi…)
- [CVE-2026-4275](https://cve.now/CVE-2026-4275.md): Divi Torque Lite \<= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install\_plugin' REST Endpoint (CVSS 8.8, badhonrocks Divi Torque Lite – Divi Modules for the Divi Bu…)
- [CVE-2026-4298](https://cve.now/CVE-2026-4298.md): DSGVO All in one for WP \<= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3, mlfactory DSGVO All in one for WP)
- [CVE-2026-9028](https://cve.now/CVE-2026-9028.md): CorvusPay WooCommerce Payment Gateway \<= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order\_number' Parameter (CVSS 5.3, corvusinfo CorvusPay WooCommerce Payment Gateway)
- [CVE-2026-9027](https://cve.now/CVE-2026-9027.md): CorvusPay WooCommerce Payment Gateway \<= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint (CVSS 5.3, corvusinfo CorvusPay WooCommerce Payment Gateway)
- [CVE-2026-13441](https://cve.now/CVE-2026-13441.md): EventPrime \<= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new\_event\_type\_background\_color' Parameter (CVSS 7.2, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2026-9240](https://cve.now/CVE-2026-9240.md): Colissimo Officiel : Méthodes de livraison pour WooCommerce \<= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc\_order\_affect AJAX action (CVSS 4.3, iscpcolissimo Colissimo shipping methods for WooCommerce)
- [CVE-2026-56289](https://cve.now/CVE-2026-56289.md): Loop with Unreachable Exit Condition in GNU patch (CVSS 4.6, GNU patch)
- [CVE-2026-56288](https://cve.now/CVE-2026-56288.md): NULL Pointer Dereference in GNU patch (CVSS 4.6, GNU patch)
- [CVE-2026-56460](https://cve.now/CVE-2026-56460.md): HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability (CVSS 6.5, HCLSoftware HCL DevOps Deploy / HCL Launch)
- [CVE-2026-2342](https://cve.now/CVE-2026-2342.md): XSS in Oceanicsoft's ValeApp (CVSS 9.3, OceanicSoft Informatics Systems ValeApp)
- [CVE-2026-1989](https://cve.now/CVE-2026-1989.md): IDOR in PAVO Inc.'s PAVO Pay (CVSS 7.5, PAVO Financial Technology Solutions PAVO Pay)
- [CVE-2026-56458](https://cve.now/CVE-2026-56458.md): HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains (CVSS 5.4, HCLSoftware HCL DevOps Deploy)
- [CVE-2026-1365](https://cve.now/CVE-2026-1365.md): Information Disclosure in Sayax's OSOS (CVSS 6.5, Sayax Energy Technologies OSOS)
- [CVE-2026-12433](https://cve.now/CVE-2026-12433.md): Hydra Booking \<= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking\_id' Parameter (CVSS 4.3, themefic Hydra Booking — Appointment Scheduling & Booking C…)
- [CVE-2026-15158](https://cve.now/CVE-2026-15158.md): Blocksy Companion \<= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images\[\]' Parameter (CVSS 9.8, creativethemeshq Blocksy Companion)
- [CVE-2026-5955](https://cve.now/CVE-2026-5955.md): SQLi in Inrove Software's BiEticaret (CVSS 9.8, Inrove Software and Internet Services BiEticaret)
- [CVE-2026-56459](https://cve.now/CVE-2026-56459.md): HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure (CVSS 6.2, HCLSoftware HCL DevOps Deploy / HCL Launch)
- [CVE-2026-5793](https://cve.now/CVE-2026-5793.md): XSS in Inrove Software's BiEticaret (CVSS 6.1, Inrove Software and Internet Services BiEticaret)
- [CVE-2026-14342](https://cve.now/CVE-2026-14342.md): Mail Mint \<= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact\_ids' Parameter (CVSS 4.9, getwpfunnels Mail Mint – Email Marketing, Newsletter, Email…)
- [CVE-2026-8848](https://cve.now/CVE-2026-8848.md): Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder \<= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation (CVSS 7.2, danieliser Popup Maker – Boost Sales, Conversions, Optins,…)
- [CVE-2026-14245](https://cve.now/CVE-2026-14245.md): miniOrange OTP Login, Verification and SMS Notifications \<= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username\_b' Parameter (CVSS 9.8, cyberlord92 miniOrange OTP Login, Verification and SMS Noti…)
- [CVE-2026-12418](https://cve.now/CVE-2026-12418.md): User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration \<= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf\_files\_data' Parameter (CVSS 5.3, wedevs User Frontend: AI Powered Frontend Posting, User Dir…)
- [CVE-2026-11359](https://cve.now/CVE-2026-11359.md): Memberships and User Profiles for WooCommerce \<= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation (CVSS 4.3, metagauss Memberships and User Profiles for WooCommerce – P…)
- [CVE-2026-13450](https://cve.now/CVE-2026-13450.md): GamiPress \<= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter (CVSS 5.3, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2026-13011](https://cve.now/CVE-2026-13011.md): ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support \<= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter (CVSS 6.5, wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…)
- [CVE-2026-13334](https://cve.now/CVE-2026-13334.md): Mang Board WP \<= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter (CVSS 6.1, kitae-park Mang Board WP)
- [CVE-2026-12406](https://cve.now/CVE-2026-12406.md): User Frontend \<= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach\_id' Parameter (CVSS 5.3, wedevs User Frontend: AI Powered Frontend Posting, User Dir…)
- [CVE-2026-33390](https://cve.now/CVE-2026-33390.md): Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-31985](https://cve.now/CVE-2026-31985.md): Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0 (CVSS 8.3, Nozomi Networks Remote Collector)
- [CVE-2026-31984](https://cve.now/CVE-2026-31984.md): DoS through oversized audit log entries in Guardian/CMC before 26.2.0 (CVSS 8.7, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-31983](https://cve.now/CVE-2026-31983.md): Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0 (CVSS 6.9, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-31982](https://cve.now/CVE-2026-31982.md): Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 (CVSS 5.3, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-31981](https://cve.now/CVE-2026-31981.md): HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 (CVSS 4.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2026-59269](https://cve.now/CVE-2026-59269.md): Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries (CVSS 3.8, VMware Pinniped)
- [CVE-2026-57111](https://cve.now/CVE-2026-57111.md): Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin (CVSS 7.5, Apache Software Foundation Apache Helix REST)
- [CVE-2026-6910](https://cve.now/CVE-2026-6910.md): Bookero.pl \<= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, safistudio Bookero.pl – system rezerwacji online)
- [CVE-2026-8996](https://cve.now/CVE-2026-8996.md): Backup and Staging by WP Time Capsule \<= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download\_recent\_decrypted\_file\_wptc Function (CVSS 6.5, revmakx Backup and Staging by WP Time Capsule)
- [CVE-2026-13771](https://cve.now/CVE-2026-13771.md): Customer Reviews for WooCommerce \<= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (CVSS 6.4, ivole Customer Reviews for WooCommerce)
- [CVE-2026-13080](https://cve.now/CVE-2026-13080.md): WPFunnels \<= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter (CVSS 6.6, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2026-7558](https://cve.now/CVE-2026-7558.md): Age Verification & Identity Verification by Token of Trust \<= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot\_export\_table' Parameter (CVSS 5.3, tokenoftrust Age Verification & Identity Verification by To…)
- [CVE-2026-15000](https://cve.now/CVE-2026-15000.md): Connect Contact Form 7 and Mailchimp \<= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values (CVSS 7.2, rnzo Connect Contact Form 7 and Mailchimp)
- [CVE-2026-14343](https://cve.now/CVE-2026-14343.md): Download Manager \<= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note\_before' and 'note\_after' Shortcode Attributes (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-12170](https://cve.now/CVE-2026-12170.md): AcyMailing \<= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute (CVSS 6.4, acyba AcyMailing – An Ultimate Newsletter Plugin and Market…)
- [CVE-2026-13253](https://cve.now/CVE-2026-13253.md): Post Grid Gutenberg Blocks for News, Magazines, Blog Websites \<= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute (CVSS 6.4, wpxpo Post Grid Gutenberg Blocks – PostX)
- [CVE-2026-4653](https://cve.now/CVE-2026-4653.md): Block, Suspend, Report for BuddyPress \<= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter (CVSS 6.4, bouncingsprout Block, Suspend, Report for BuddyPress)
- [CVE-2026-47840](https://cve.now/CVE-2026-47840.md): LDAP StartTLS unconditionally disables hostname verification (CVSS 8.3, CloudFoundry Foundation UAA · CloudFoundry Foundation Cf-de…)
- [CVE-2026-47831](https://cve.now/CVE-2026-47831.md): Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks (CVSS 7.7, Cloud Foundry Foundation bosh-windows-stemcell-builder)
- [CVE-2026-47830](https://cve.now/CVE-2026-47830.md): Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite (CVSS 8.5, Cloud Foundry Foundation bosh-windows-stemcell-builder)
- [CVE-2026-47829](https://cve.now/CVE-2026-47829.md): Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director (CVSS 7.7, CloudFoundry Foundation bosh-cli)
- [CVE-2026-47828](https://cve.now/CVE-2026-47828.md): Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay (CVSS 8.9, BOSH-Ecosystem / BOSH (bosh-cli) bosh-cli)
- [CVE-2026-12517](https://cve.now/CVE-2026-12517.md): Fediverse Embeds \< 1.5.8 - Unauthenticated SSRF via Site Info Endpoint (CVSS 5.3, Fediverse Embeds)
- [CVE-2026-12516](https://cve.now/CVE-2026-12516.md): Fediverse Embeds \< 1.5.8 - Unauthenticated SSRF via Media Proxy (CVSS 5.3, Fediverse Embeds)
- [CVE-2026-12270](https://cve.now/CVE-2026-12270.md): Everest Forms \< 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints (CVSS 6.5, Everest Forms)
- [CVE-2026-11875](https://cve.now/CVE-2026-11875.md): WP Support Plus Responsive Ticket System \<= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery (CVSS 5.3, WP Support Plus Responsive Ticket System)
- [CVE-2026-11869](https://cve.now/CVE-2026-11869.md): WP DSGVO Tools (GDPR) \< 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request (CVSS 5.3, WP DSGVO Tools)
- [CVE-2026-11571](https://cve.now/CVE-2026-11571.md): Everest Forms \< 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts (CVSS 7.5, Everest Forms)
- [CVE-2026-47826](https://cve.now/CVE-2026-47826.md): blobs.yaml Path Traversal Allows File Writes (CVSS 8.5, CloudFoundry Foundation BOSH CLI tool)
- [CVE-2026-5523](https://cve.now/CVE-2026-5523.md): Divi Form Builder \<= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form (CVSS 8.8, Divi Engine Divi Form Builder)
- [CVE-2026-41857](https://cve.now/CVE-2026-41857.md): BOSH CLI Shell Injection (CVSS 7.1, CloudFoundry BOSH BOSH CLI)
- [CVE-2026-15138](https://cve.now/CVE-2026-15138.md): tumf mcp-text-editor text\_editor.py \_validate\_file\_path path traversal (CVSS 5.3, tumf mcp-text-editor)
- [CVE-2026-15137](https://cve.now/CVE-2026-15137.md): code-projects Interview Management System View.php sql injection (CVSS 6.9, code-projects Interview Management System)
- [CVE-2025-45422](https://cve.now/CVE-2025-45422.md): Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes (CVSS 8.1)
- [CVE-2025-63579](https://cve.now/CVE-2025-63579.md): Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. (CVSS 7.5)
- [CVE-2026-31267](https://cve.now/CVE-2026-31267.md): Mercusys MW302R MW302R(EU)\_V1\_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the administrative web interface. (CVSS 5.7)
- [CVE-2026-38076](https://cve.now/CVE-2026-38076.md): An integer overflow in the jbig2\_arith\_iaid\_ctx\_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) (CVSS 7.5)
- [CVE-2026-39243](https://cve.now/CVE-2026-39243.md): decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. (CVSS 5.5, decompress)
- [CVE-2026-39245](https://cve.now/CVE-2026-39245.md): decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. (CVSS 6.2)
- [CVE-2026-39246](https://cve.now/CVE-2026-39246.md): decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. (CVSS 7.5)
- [CVE-2026-51597](https://cve.now/CVE-2026-51597.md): MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. (CVSS 9.1)
- [CVE-2026-51598](https://cve.now/CVE-2026-51598.md): An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticate (CVSS 6.5)
- [CVE-2026-51599](https://cve.now/CVE-2026-51599.md): An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthentica (CVSS 9.8)
- [CVE-2026-51600](https://cve.now/CVE-2026-51600.md): Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY m (CVSS 7.5)
- [CVE-2026-51601](https://cve.now/CVE-2026-51601.md): Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. (CVSS 7.5)
- [CVE-2026-51602](https://cve.now/CVE-2026-51602.md): A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote att (CVSS 7.5)
- [CVE-2026-51603](https://cve.now/CVE-2026-51603.md): A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote att (CVSS 7.5)
- [CVE-2026-51604](https://cve.now/CVE-2026-51604.md): A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote att (CVSS 7.5)
- [CVE-2026-51605](https://cve.now/CVE-2026-51605.md): A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote at (CVSS 7.5)
- [CVE-2026-51606](https://cve.now/CVE-2026-51606.md): An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate (CVSS 7.5)
- [CVE-2026-51923](https://cve.now/CVE-2026-51923.md): An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbit (CVSS 8.1)
- [CVE-2026-51924](https://cve.now/CVE-2026-51924.md): An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component (CVSS 8.1)
- [CVE-2026-51925](https://cve.now/CVE-2026-51925.md): A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code v (CVSS 8.1)
- [CVE-2026-51926](https://cve.now/CVE-2026-51926.md): An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.