# CVEs published 2026-07-10

348 CVEs were published on July 10, 2026: 33 critical, 122 high. Days are UTC.

- [CVE-2026-14480](https://cve.now/CVE-2026-14480.md): OpenPLC v3 External Control of File Name or Path (CVSS 9.9, OpenPLC)
- [CVE-2026-44383](https://cve.now/CVE-2026-44383.md): Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration (CVSS 7.5, Hydro-Québec Le Circuit Electrique charging station backend)
- [CVE-2026-42952](https://cve.now/CVE-2026-42952.md): Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, Hydro-Québec Le Circuit Electrique charging station backend)
- [CVE-2026-20744](https://cve.now/CVE-2026-20744.md): Hydro-Québec Le Circuit Electrique charging station backend Improper Access Control (CVSS 9.8, Hydro-Québec Le Circuit Electrique charging station backend)
- [CVE-2026-11913](https://cve.now/CVE-2026-11913.md): Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045 (CVSS 9.8, Drupal Mother May I · drupal/mothermayi)
- [CVE-2026-11914](https://cve.now/CVE-2026-11914.md): Composer - Critical - Unsupported - SA-CONTRIB-2026-046 (CVSS 5.9, Drupal Composer · drupal/composer)
- [CVE-2026-11915](https://cve.now/CVE-2026-11915.md): Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047 (CVSS 5.9, Drupal Brute force attack protection · drupal/bfap\_sb)
- [CVE-2026-15087](https://cve.now/CVE-2026-15087.md): Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 (CVSS 5.9, Drupal Clean RESTful · drupal/clean\_node\_api)
- [CVE-2026-15086](https://cve.now/CVE-2026-15086.md): Raw Formatter \[Meta Tag Formatter\] - Critical - Unsupported - SA-CONTRIB-2026-077 (CVSS 5.9, Drupal Raw Formatter \[Meta Tag Formatter\] · drupal/raw\_form…)
- [CVE-2026-15089](https://cve.now/CVE-2026-15089.md): Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079 (CVSS 9.1, Drupal Commerce guest registration · drupal/commerce\_guest\_…)
- [CVE-2026-55175](https://cve.now/CVE-2026-55175.md): Spinnaker: Improper yaml processing on kustomize bake operations (CVSS 7.5, spinnaker · io.spinnaker.rosco:rosco-manifests)
- [CVE-2026-44795](https://cve.now/CVE-2026-44795.md): Spinnaker: Non-safe yaml deserialization allowing RCE when using specific types (CVSS 8.8, spinnaker · io.spinnaker.rosco:rosco-core +1)
- [CVE-2026-55808](https://cve.now/CVE-2026-55808.md): Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 (CVSS 5.4, Drupal core · drupal/core)
- [CVE-2026-55807](https://cve.now/CVE-2026-55807.md): Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 (CVSS 3.1, Drupal core · drupal/core)
- [CVE-2026-55806](https://cve.now/CVE-2026-55806.md): Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 (CVSS 5.9, Drupal core · drupal/core)
- [CVE-2026-55804](https://cve.now/CVE-2026-55804.md): Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 (CVSS 5.9, Drupal core · drupal/core)
- [CVE-2026-55803](https://cve.now/CVE-2026-55803.md): Drupal core - Critical - PHP object injection - SA-CORE-2026-005 (CVSS 5.9, Drupal core · drupal/core)
- [CVE-2026-15085](https://cve.now/CVE-2026-15085.md): AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076 (CVSS 5.4, Drupal AI SEO/GEO Analyzer · drupal/ai\_seo)
- [CVE-2026-15084](https://cve.now/CVE-2026-15084.md): UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075 (CVSS 5.4, UI Patterns · drupal/ui\_patterns)
- [CVE-2026-15083](https://cve.now/CVE-2026-15083.md): ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 (CVSS 4.2, Drupal ECA: Event - Condition - Action · drupal/eca)
- [CVE-2026-15082](https://cve.now/CVE-2026-15082.md): Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073 (CVSS 5.4, Drupal Siteimprove Analytics · drupal/siteimprove\_analytics)
- [CVE-2026-15081](https://cve.now/CVE-2026-15081.md): Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 (CVSS 7.4, Drupal Location Selector · drupal/location\_selector)
- [CVE-2026-15080](https://cve.now/CVE-2026-15080.md): Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 (CVSS 4.3, Drupal Ray Enterprise Translation · drupal/lingotek)
- [CVE-2026-15079](https://cve.now/CVE-2026-15079.md): Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 (CVSS 5.4, Drupal Login Disable · drupal/login\_disable)
- [CVE-2026-58591](https://cve.now/CVE-2026-58591.md): Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069 (CVSS 5.4, Drupal Colorbox · drupal/colorbox)
- [CVE-2026-58590](https://cve.now/CVE-2026-58590.md): FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 (CVSS 5.4, Drupal FlowDrop · drupal/flowdrop)
- [CVE-2026-58589](https://cve.now/CVE-2026-58589.md): FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 (CVSS 5.4, Drupal FlowDrop · drupal/flowdrop)
- [CVE-2026-58588](https://cve.now/CVE-2026-58588.md): Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 (CVSS 6.1, Drupal Canvas · drupal/canvas)
- [CVE-2026-58587](https://cve.now/CVE-2026-58587.md): Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065 (CVSS 6.1, Drupal Canvas · drupal/canvas)
- [CVE-2026-13244](https://cve.now/CVE-2026-13244.md): Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064 (CVSS 8.1, Drupal Tealium iQ Tag Management · drupal/tealiumiq)
- [CVE-2026-13243](https://cve.now/CVE-2026-13243.md): Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 (CVSS 4.8, Drupal Salesforce Suite · drupal/salesforce)
- [CVE-2026-13242](https://cve.now/CVE-2026-13242.md): Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 (CVSS 6.5, Drupal Geolocation Field · drupal/geolocation)
- [CVE-2026-13241](https://cve.now/CVE-2026-13241.md): Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061 (CVSS 6.5, Drupal Paragraphs · drupal/paragraphs)
- [CVE-2026-13240](https://cve.now/CVE-2026-13240.md): Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060 (CVSS 6.5, Drupal Paragraphs · drupal/paragraphs)
- [CVE-2026-13239](https://cve.now/CVE-2026-13239.md): WissKI - Critical - Access bypass - SA-CONTRIB-2026-059 (CVSS 6.5, Drupal WissKI · drupal/wisski)
- [CVE-2026-13238](https://cve.now/CVE-2026-13238.md): Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058 (CVSS 4.8, Drupal Commerce Realex / Global Payments · drupal/commerce\_…)
- [CVE-2026-13237](https://cve.now/CVE-2026-13237.md): AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057 (CVSS 4.8, Drupal AI Agents · drupal/ai\_agents)
- [CVE-2026-13236](https://cve.now/CVE-2026-13236.md): AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056 (CVSS 4.2, Drupal AI Agents · drupal/ai\_agents)
- [CVE-2026-13235](https://cve.now/CVE-2026-13235.md): AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055 (CVSS 3.3, Drupal AI · drupal/ai)
- [CVE-2026-13234](https://cve.now/CVE-2026-13234.md): AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054 (CVSS 6.1, Drupal AI · drupal/ai)
- [CVE-2026-13233](https://cve.now/CVE-2026-13233.md): OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053 (CVSS 3.3, Drupal OpenAI Provider · drupal/ai\_provider\_openai)
- [CVE-2026-13232](https://cve.now/CVE-2026-13232.md): Advanced Content Feedback (aka admin\_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052 (CVSS 3.1, Drupal Advanced Content Feedback · drupal/admin\_feedback)
- [CVE-2026-13231](https://cve.now/CVE-2026-13231.md): Advanced Content Feedback (aka admin\_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051 (CVSS 6.1, Drupal Advanced Content Feedback · drupal/admin\_feedback)
- [CVE-2026-55810](https://cve.now/CVE-2026-55810.md): Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 (CVSS 8.1, Drupal Plotly.js Graphing · drupal/plotly\_js)
- [CVE-2026-55809](https://cve.now/CVE-2026-55809.md): Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 (CVSS 8.1, Drupal Flag attendance field · drupal/flag\_attendance\_field)
- [CVE-2026-55187](https://cve.now/CVE-2026-55187.md): Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) (CVSS 5.8, axllent mailpit · github.com/axllent/mailpit)
- [CVE-2026-12535](https://cve.now/CVE-2026-12535.md): Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048 (CVSS 9.8, Drupal Formatter Field · drupal/formatter\_field)
- [CVE-2026-11909](https://cve.now/CVE-2026-11909.md): Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044 (CVSS 3.3, Drupal Examples for Developers · drupal/examples)
- [CVE-2026-11908](https://cve.now/CVE-2026-11908.md): Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043 (CVSS 5.4, Drupal Tagify · drupal/tagify)
- [CVE-2026-10770](https://cve.now/CVE-2026-10770.md): Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 (CVSS 6.1, Drupal Anti-Spam by CleanTalk · drupal/cleantalk)
- [CVE-2026-52747](https://cve.now/CVE-2026-52747.md): ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass (CVSS 8.6, owasp-modsecurity ModSecurity)
- [CVE-2026-10769](https://cve.now/CVE-2026-10769.md): Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 (CVSS 5.4, Drupal Commerce Core · drupal/commerce)
- [CVE-2026-10768](https://cve.now/CVE-2026-10768.md): LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 (CVSS 9.8, Drupal LocalGov Workflows · drupal/localgov\_workflows)
- [CVE-2026-52761](https://cve.now/CVE-2026-52761.md): ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture (CVSS 5.8, owasp-modsecurity ModSecurity)
- [CVE-2026-55883](https://cve.now/CVE-2026-55883.md): Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream (CVSS 8.3, tilt-dev tilt · github.com/tilt-dev/tilt)
- [CVE-2026-55882](https://cve.now/CVE-2026-55882.md): Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server (CVSS 8.3, tilt-dev tilt · github.com/tilt-dev/tilt)
- [CVE-2026-55884](https://cve.now/CVE-2026-55884.md): Tilt: Missing authentication on the network-exposed Tilt HUD server (CVSS 9.2, tilt-dev tilt · github.com/tilt-dev/tilt)
- [CVE-2026-49213](https://cve.now/CVE-2026-49213.md): TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution (CVSS 8.1, baptisteArno typebot.io)
- [CVE-2026-59155](https://cve.now/CVE-2026-59155.md): Nezha Monitoring: DDNS and Notification credential exposure via unredacted list API (CVSS 6.9, nezhahq nezha · github.com/nezhahq/nezha)
- [CVE-2026-55852](https://cve.now/CVE-2026-55852.md): Frappe: TarSlip RCE in Package Import (CVSS 8.6, frappe)
- [CVE-2026-42219](https://cve.now/CVE-2026-42219.md): Frappe: Path Traversal via /backups Route (CVSS 6.9, frappe)
- [CVE-2026-49394](https://cve.now/CVE-2026-49394.md): Frappe: Auth. bypass via update\_page (CVSS 7.1, frappe)
- [CVE-2026-48127](https://cve.now/CVE-2026-48127.md): Frappe: Arbitrary Attachment Injection via add\_attachments and upload\_file (CVSS 5.3, frappe)
- [CVE-2026-41482](https://cve.now/CVE-2026-41482.md): Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator (CVSS 7.1, frappe)
- [CVE-2026-49844](https://cve.now/CVE-2026-49844.md): Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() (CVSS 6.3, Apache Software Foundation Apache Log4j API · org.apache.lo…)
- [CVE-2026-47199](https://cve.now/CVE-2026-47199.md): Frappe: check\_safe\_sql\_query Permits SELECT INTO OUTFILE (CVSS 2.3, frappe)
- [CVE-2026-58503](https://cve.now/CVE-2026-58503.md): Frappe: Unauthenticated User Enumeration via reset\_password (CVSS 6.9, frappe)
- [CVE-2026-47422](https://cve.now/CVE-2026-47422.md): Frappe: Unrestricted API access to save\_report (CVSS 5.3, frappe)
- [CVE-2026-57584](https://cve.now/CVE-2026-57584.md): Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS (CVSS 8.7, cphalcon · phalcon/cphalcon)
- [CVE-2026-54736](https://cve.now/CVE-2026-54736.md): Phalcon: Non-constant-time HMAC verification in \`Encryption\\Crypt::decrypt\` (timing side-channel) (CVSS 8.2, cphalcon · phalcon/cphalcon)
- [CVE-2026-55664](https://cve.now/CVE-2026-55664.md): Grist: Insufficient access control in the /forms endpoint exposes table metadata (CVSS 4.3, gristlabs grist-core)
- [CVE-2026-55665](https://cve.now/CVE-2026-55665.md): DOM-based XSS in Grist via unsanitized links, enabling privilege escalation (CVSS 8.5, gristlabs grist-core)
- [CVE-2026-55659](https://cve.now/CVE-2026-55659.md): Grist: XSS through unsafe value interpolation in server-rendered pages (CVSS 7.7, gristlabs grist-core)
- [CVE-2026-45203](https://cve.now/CVE-2026-45203.md): GPU DDK - rgxfw\_hwperf\_ufo() re-reads psCmdHeader-\>ui32CmdSize after initial check, TOCTOU (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-9726](https://cve.now/CVE-2026-9726.md): Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038 (CVSS 9.8, Drupal AlternativeCommerce · drupal/basket)
- [CVE-2026-57574](https://cve.now/CVE-2026-57574.md): Misskey: TOTP tokens can be reused (CVSS 7.4, misskey-dev misskey)
- [CVE-2026-57575](https://cve.now/CVE-2026-57575.md): Misskey: SSRF bypass in URL Preview (CVSS 6.9, misskey-dev misskey)
- [CVE-2026-45196](https://cve.now/CVE-2026-45196.md): GPU DDK - Arbitrary GPU register write in rgxfw\_hwperf\_hw due to unsanitized pointers from host kernel (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-58499](https://cve.now/CVE-2026-58499.md): Path traversal in EverOS /api/v1/memory/add via unvalidated sender\_id (CVSS 8.2, EverMind-AI EverOS · everos)
- [CVE-2026-7639](https://cve.now/CVE-2026-7639.md): GPU DDK - Page UAF read in PMMETA\_PROTECT heap memory (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-55213](https://cve.now/CVE-2026-55213.md): h2o: musl libc stack overflow (QPACK) (CVSS 7.5, h2o)
- [CVE-2026-57230](https://cve.now/CVE-2026-57230.md): OpenReplay: Authenticated ClickHouse SQL injection via session search (CVSS 5.4, openreplay)
- [CVE-2026-41154](https://cve.now/CVE-2026-41154.md): GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages\_Sparse (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-55881](https://cve.now/CVE-2026-55881.md): OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint (CVSS 7.1, openreplay)
- [CVE-2026-34196](https://cve.now/CVE-2026-34196.md): GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-55880](https://cve.now/CVE-2026-55880.md): OpenReplay: Cross-user IDOR in notes and dashboard widgets (CVSS 7.1, openreplay)
- [CVE-2026-55879](https://cve.now/CVE-2026-55879.md): OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover (CVSS 9.3, openreplay)
- [CVE-2026-55229](https://cve.now/CVE-2026-55229.md): Gotenberg: SSRF via LibreOffice document processing (CVSS 7.5, gotenberg · github.com/gotenberg/gotenberg/v8 +1)
- [CVE-2026-57807](https://cve.now/CVE-2026-57807.md): WordPress OAuth Single Sign On - SSO (OAuth Client) plugin \<= 38.5.8 - Broken Authentication vulnerability (CVSS 9.8, miniOrange Security Software Pvt OAuth Single Sign On - SSO)
- [CVE-2026-55405](https://cve.now/CVE-2026-55405.md): LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector (CVSS 7.6, langchain4j · dev.langchain4j:langchain4j-mariadb +1)
- [CVE-2026-12761](https://cve.now/CVE-2026-12761.md): miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) \<= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow (CVSS 9.8, cyberlord92 miniOrange Social Login and Register)
- [CVE-2026-13039](https://cve.now/CVE-2026-13039.md): Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API (CVSS 5.3, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2026-57217](https://cve.now/CVE-2026-57217.md): RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass (CVSS 7.0, rabbitmq-server)
- [CVE-2026-57221](https://cve.now/CVE-2026-57221.md): RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users (CVSS 5.3, rabbitmq-server)
- [CVE-2026-57215](https://cve.now/CVE-2026-57215.md): RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom (CVSS 7.0, rabbitmq-server)
- [CVE-2026-57219](https://cve.now/CVE-2026-57219.md): RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations (CVSS 8.7, rabbitmq-server)
- [CVE-2026-57218](https://cve.now/CVE-2026-57218.md): RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure (CVSS 4.9, rabbitmq-server)
- [CVE-2026-57216](https://cve.now/CVE-2026-57216.md): RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks (CVSS 6.8, rabbitmq-server)
- [CVE-2026-57220](https://cve.now/CVE-2026-57220.md): RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS (CVSS 7.5, rabbitmq-server)
- [CVE-2026-57214](https://cve.now/CVE-2026-57214.md): RabbitMQ: Stored XSS in RabbitMQ management UI (CVSS 7.1, rabbitmq-server)
- [CVE-2026-57211](https://cve.now/CVE-2026-57211.md): RabbitMQ: UNC SSRF affecting the management UI on Windows (CVSS 6.5, rabbitmq-server)
- [CVE-2026-57212](https://cve.now/CVE-2026-57212.md): RabbitMQ management HTTP API accepts request bodies larger than configured max\_http\_body\_size (CVSS 7.1, rabbitmq-server)
- [CVE-2026-57213](https://cve.now/CVE-2026-57213.md): RabbitMQ: Stored XSS federation management plugin via unsanitized consumer\_tag rendering (CVSS 5.7, rabbitmq-server)
- [CVE-2026-55233](https://cve.now/CVE-2026-55233.md): OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream (CVSS 7.5, openresty)
- [CVE-2026-55377](https://cve.now/CVE-2026-55377.md): Logto: Account Center MFA management step-up bypass via WebAuthn registration verification (CVSS 8.1, logto-io logto)
- [CVE-2026-55370](https://cve.now/CVE-2026-55370.md): Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation) (CVSS 6.4, logto-io logto)
- [CVE-2026-55789](https://cve.now/CVE-2026-55789.md): Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers (CVSS 8.5, logto-io logto)
- [CVE-2026-54714](https://cve.now/CVE-2026-54714.md): Logto: XSS via unescaped RelayState in SAML auto-submit form (CVSS 6.1, logto-io logto)
- [CVE-2026-57850](https://cve.now/CVE-2026-57850.md): RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection (CVSS 8.7, RustDesk)
- [CVE-2026-57156](https://cve.now/CVE-2026-57156.md): FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing (CVSS 8.6, FreeRDP)
- [CVE-2026-57157](https://cve.now/CVE-2026-57157.md): Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName (CVSS 6.5, FreeRDP)
- [CVE-2026-57158](https://cve.now/CVE-2026-57158.md): FreeRDP planar\_decompress\_plane\_rle\_only: heap OOB read — incomplete fix for CVE-2026-23530 (CVSS 5.1, FreeRDP)
- [CVE-2026-55827](https://cve.now/CVE-2026-55827.md): FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode (CVSS 7.5, FreeRDP)
- [CVE-2026-55481](https://cve.now/CVE-2026-55481.md): Snipe-IT: CSS Injection via \`header\_color\` Setting (CVSS 6.2, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-15295](https://cve.now/CVE-2026-15295.md): Ajax Load More \<= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…)
- [CVE-2026-55475](https://cve.now/CVE-2026-55475.md): Snipe-IT: Import created\_by can be overwritten (CVSS 5.7, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55469](https://cve.now/CVE-2026-55469.md): Snipe-IT: Path traversal vulnerability via CSV import \`image\` field (CVSS 6.5, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55461](https://cve.now/CVE-2026-55461.md): Snipe-IT: Open Redirect After User Edit (CVSS 6.1, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55479](https://cve.now/CVE-2026-55479.md): Snipe-IT: Incorrect permission for legacy license checkin API (CVSS 5.3, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55452](https://cve.now/CVE-2026-55452.md): Snipe-IT: CSV formula injection in Activity Report export (CVSS 4.8, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55466](https://cve.now/CVE-2026-55466.md): Snipe-IT: Stored XSS via inline-served attachment (CVSS 6.2, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55515](https://cve.now/CVE-2026-55515.md): Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint (CVSS 5.0, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55462](https://cve.now/CVE-2026-55462.md): Snipe-IT: Authorization bypass on print inventory page (CVSS 4.3, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-11321](https://cve.now/CVE-2026-11321.md): GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import (CVSS 7.1, pluginsGLPI datainjection)
- [CVE-2026-55464](https://cve.now/CVE-2026-55464.md): Snipe-IT: Stored XSS via Markdown custom field (CVSS 4.8, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55460](https://cve.now/CVE-2026-55460.md): Snipe-IT: Authorization bypass on bulk editing users (CVSS 7.1, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55472](https://cve.now/CVE-2026-55472.md): Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation (CVSS 4.3, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55476](https://cve.now/CVE-2026-55476.md): Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel\_by\_admin Parameter (CVSS 5.3, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-6212](https://cve.now/CVE-2026-6212.md): IDOR in Teracity's TeraMIS (CVSS 8.8, Teracity Software Technologies TeraMIS)
- [CVE-2026-61459](https://cve.now/CVE-2026-61459.md): MCP Server Kubernetes \< 3.9.0 Argument Injection via kubectl Structured Tools (CVSS 9.3, Flux159 mcp-server-kubernetes · mcp-server-kubernetes)
- [CVE-2026-55478](https://cve.now/CVE-2026-55478.md): Snipe-IT: Missing object-level authorization in Kits API (CVSS 5.3, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55843](https://cve.now/CVE-2026-55843.md): Snipe-IT: Improper Privilege Management (CVSS 7.0, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55516](https://cve.now/CVE-2026-55516.md): Snipe-IT: Cross-company asset maintenance re-parenting via API update (CVSS 7.7, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-55474](https://cve.now/CVE-2026-55474.md): Snipe-IT: Directory traversal in displaySig (CVSS 7.1, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-54329](https://cve.now/CVE-2026-54329.md): Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API (CVSS 8.5, grokability snipe-it · snipe/snipe-it)
- [CVE-2026-61460](https://cve.now/CVE-2026-61460.md): Krayin CRM Insecure Direct Object Reference via Controllers (CVSS 8.7, krayin laravel-crm)
- [CVE-2026-15146](https://cve.now/CVE-2026-15146.md): CVE-2026-15146 (CVSS 5.9, GNU wget Wget)
- [CVE-2026-61461](https://cve.now/CVE-2026-61461.md): Dify \< 1.16.0-rc1 SQL Injection via MyScale Vector Store search\_by\_full\_text (CVSS 8.7, langgenius dify)
- [CVE-2026-5801](https://cve.now/CVE-2026-5801.md): SQLi in Semtek Informatics' SEM-PMP (CVSS 9.8, Semtek Informatics Software Consulting Trade Ltd. SEM-PMP)
- [CVE-2026-53450](https://cve.now/CVE-2026-53450.md): Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection (CVSS 7.4, coturn)
- [CVE-2026-53449](https://cve.now/CVE-2026-53449.md): Coturn: Arbitrary File Write via CLI psd Command (CVSS 6.0, coturn)
- [CVE-2026-53448](https://cve.now/CVE-2026-53448.md): Coturn: SQL Injection in HTTPS Admin Panel Delete Operations (CVSS 7.2, coturn)
- [CVE-2025-30008](https://cve.now/CVE-2025-30008.md): HestiaCP \< 1.9.5 Stored XSS via DNS Record Management Interface (CVSS 5.1, hestiacp)
- [CVE-2025-30007](https://cve.now/CVE-2025-30007.md): HestiaCP \< 1.9.5 Authenticated OS Command Injection via DNS Record Management (CVSS 8.7, hestiacp)
- [CVE-2026-59151](https://cve.now/CVE-2026-59151.md): Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover (CVSS 9.6, prowler-cloud prowler · prowler-cloud)
- [CVE-2026-56668](https://cve.now/CVE-2026-56668.md): ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange (CVSS 8.1, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-56666](https://cve.now/CVE-2026-56666.md): ZITADEL: Auto-linking by email: IdP-side email verification is not checked (CVSS 4.8, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-2397](https://cve.now/CVE-2026-2397.md): SQLi in AdamPOS' MobilMen 20T (CVSS 9.8, Adam Retail Automation MobilMen)
- [CVE-2026-56667](https://cve.now/CVE-2026-56667.md): ZITADEL: Stored XSS via Default URI Redirect in Login V2 (CVSS 7.3, zitadel)
- [CVE-2026-56665](https://cve.now/CVE-2026-56665.md): ZITADEL: Missing Token Expiration (\`exp\`) Validation in JWT IdP Provider (CVSS 4.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-56664](https://cve.now/CVE-2026-56664.md): ZITADEL: Missing Token Lifecyle Validation (\`exp\` and \`iat\`) in JWT IdP Provider (CVSS 4.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-55672](https://cve.now/CVE-2026-55672.md): ZITADEL: Missing client\_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) (CVSS 7.4, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-55671](https://cve.now/CVE-2026-55671.md): ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components (CVSS 2.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-55670](https://cve.now/CVE-2026-55670.md): ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers (CVSS 2.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-57476](https://cve.now/CVE-2026-57476.md): Deloitte AI Assist for Customer unauthenticated RAG corpus read and write (CVSS 4.8, Deloitte AI Assist for Customer)
- [CVE-2026-57475](https://cve.now/CVE-2026-57475.md): Deloitte AI Assist for Customer unauthenticated configuration write (CVSS 5.3, Deloitte AI Assist for Customer)
- [CVE-2026-57474](https://cve.now/CVE-2026-57474.md): Deloitte AI Assist for Customer information disclosure (CVSS 5.3, Deloitte AI Assist for Customer)
- [CVE-2026-2398](https://cve.now/CVE-2026-2398.md): IDOR in AdamPOS' MobilMen 20T (CVSS 8.8, Adam Retail Automation MobilMen)
- [CVE-2026-55669](https://cve.now/CVE-2026-55669.md): ZITADEL: Missing Token Audience Validation (\`aud\`) in JWT IdP Provider (CVSS 4.2, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-55781](https://cve.now/CVE-2026-55781.md): NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs\_bsize/fs\_fsize superblock fields (CVSS 2.4, M2Team NanaZip)
- [CVE-2026-55780](https://cve.now/CVE-2026-55780.md): NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size (CVSS 2.4, M2Team NanaZip)
- [CVE-2026-55783](https://cve.now/CVE-2026-55783.md): NanaZip: NULL pointer dereference in Extract() of all seven NanaZip custom archive handlers when extracting/testing the whole archive (CVSS 2.4, M2Team NanaZip)
- [CVE-2026-55782](https://cve.now/CVE-2026-55782.md): NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields (CVSS 2.4, M2Team NanaZip)
- [CVE-2026-3251](https://cve.now/CVE-2026-3251.md): XSS in Webremium's Mezunum Satiyorum (CVSS 6.4, Webremium Istanbul Web Design Mezunum Satiyorum)
- [CVE-2026-57167](https://cve.now/CVE-2026-57167.md): PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVSS 5.1, Chocobozzz PeerTube)
- [CVE-2026-59193](https://cve.now/CVE-2026-59193.md): Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() (CVSS 6.9, getgrav grav · getgrav/grav)
- [CVE-2026-59190](https://cve.now/CVE-2026-59190.md): Grav Admin Plugin — IDOR Privilege Escalation via saveUser() (CVSS 8.7, getgrav grav)
- [CVE-2026-1667](https://cve.now/CVE-2026-1667.md): SEO Plugin by Squirrly SEO \<= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost() (CVSS 7.2, cifi GEO Plugin by Squirrly SEO)
- [CVE-2026-58493](https://cve.now/CVE-2026-58493.md): grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction (CVSS 5.1, getgrav grav)
- [CVE-2026-58492](https://cve.now/CVE-2026-58492.md): grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation (CVSS 9.2, getgrav grav)
- [CVE-2026-55890](https://cve.now/CVE-2026-55890.md): Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() (CVSS 4.8, getgrav grav · getgrav/grav)
- [CVE-2026-15377](https://cve.now/CVE-2026-15377.md): Eleveo Call Recording Software sendlogfile improper authorization (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-55885](https://cve.now/CVE-2026-55885.md): Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets (CVSS 6.8, getgrav grav · getgrav/grav)
- [CVE-2026-53653](https://cve.now/CVE-2026-53653.md): Grav: Unauthenticated denial of service via unbounded image derivative dimensions (CVSS 8.7, getgrav grav · getgrav/grav)
- [CVE-2026-54919](https://cve.now/CVE-2026-54919.md): cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends (CVSS 7.4, yhirose cpp-httplib)
- [CVE-2026-39903](https://cve.now/CVE-2026-39903.md): Simple Machines Forum Authorization Bypass via AttachmentApprove.php (CVSS 7.1, SimpleMachines SMF)
- [CVE-2026-59180](https://cve.now/CVE-2026-59180.md): Apprise forwards configured auth headers across cross-origin HTTP redirects (CVSS 3.1, caronc apprise · apprise)
- [CVE-2026-55687](https://cve.now/CVE-2026-55687.md): ESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker Parsing (CVSS 7.5, espressif esp-idf)
- [CVE-2026-54063](https://cve.now/CVE-2026-54063.md): Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) (CVSS 7.5, qax-os excelize · github.com/xuri/excelize/v2)
- [CVE-2026-59162](https://cve.now/CVE-2026-59162.md): Excelize: Negative shared-string index causes panic in GetCellValue and GetRows (CVSS 6.9, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-59161](https://cve.now/CVE-2026-59161.md): Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation (CVSS 8.7, qax-os excelize · github.com/xuri/excelize/v2 +1)
- [CVE-2026-59154](https://cve.now/CVE-2026-59154.md): Wekan: Checklist direct DDP updates can write checklist data into private boards (CVSS 4.3, wekan)
- [CVE-2026-15376](https://cve.now/CVE-2026-15376.md): Eleveo Call Recording Software statisticReportAction.do improper authorization (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-53657](https://cve.now/CVE-2026-53657.md): Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket (CVSS 8.2, lima-vm lima · github.com/lima-vm/lima/v2 +1)
- [CVE-2026-56675](https://cve.now/CVE-2026-56675.md): 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs (CVSS 8.3, decolua 9router · 9router)
- [CVE-2026-55638](https://cve.now/CVE-2026-55638.md): 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass (CVSS 8.6, decolua 9router · 9router)
- [CVE-2026-55641](https://cve.now/CVE-2026-55641.md): 9router: Unauthenticated \`/v1\` proxy access via \`Host\`-header spoofing → open AI relay + SSRF (CVSS 8.2, decolua 9router · 9router)
- [CVE-2026-56676](https://cve.now/CVE-2026-56676.md): 9router: Image prefetch DNS rebinding allows SSRF to internal services (CVSS 7.4, decolua 9router · 9router)
- [CVE-2026-55500](https://cve.now/CVE-2026-55500.md): 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover (CVSS 9.9, decolua 9router · 9router)
- [CVE-2026-15143](https://cve.now/CVE-2026-15143.md): Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:) (CVSS 9.3, guardrails-detectors · Red Hat OpenShift AI)
- [CVE-2026-55501](https://cve.now/CVE-2026-55501.md): 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header (CVSS 7.3, decolua 9router · 9router)
- [CVE-2026-15375](https://cve.now/CVE-2026-15375.md): Eleveo Call Recording Software LDAP User users\_ldap.jsp improper authorization (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-54149](https://cve.now/CVE-2026-54149.md): MaxKB MCP tool import validation bypass allows post-authentication remote code execution (CVSS 8.8, 1Panel-dev MaxKB)
- [CVE-2026-15374](https://cve.now/CVE-2026-15374.md): Eleveo Call Recording Software Group roleAddAction.do improper authorization (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-8595](https://cve.now/CVE-2026-8595.md): Stored XSS in the table panel (TableNG) (CVSS 6.8, Grafana OSS)
- [CVE-2026-8609](https://cve.now/CVE-2026-8609.md): Pre-authentication denial of service via the OAuth login route (CVSS 5.3, Grafana OSS)
- [CVE-2026-33382](https://cve.now/CVE-2026-33382.md): Denial of service via unbounded request body size (CVSS 7.5, Grafana OSS)
- [CVE-2026-54000](https://cve.now/CVE-2026-54000.md): osquery: Heap buffer overflow in \`getProcessCurrentDirectory()\` via \`processes\` table (Windows) (CVSS 7.0, osquery)
- [CVE-2026-54001](https://cve.now/CVE-2026-54001.md): osquery: Heap buffer overflow via \`authenticode\` table (Windows) (CVSS 7.0, osquery)
- [CVE-2026-15373](https://cve.now/CVE-2026-15373.md): Eleveo Call Recording Software userAddAction.do improper authorization (CVSS 5.3, Eleveo Call Recording Software)
- [CVE-2026-46388](https://cve.now/CVE-2026-46388.md): osquery: Unprivileged users can temporarily read file carve contents (CVSS 4.4, osquery)
- [CVE-2026-61492](https://cve.now/CVE-2026-61492.md): In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible (CVSS 3.5, JetBrains YouTrack)
- [CVE-2026-59796](https://cve.now/CVE-2026-59796.md): In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks (CVSS 8.1, JetBrains TeamCity)
- [CVE-2026-59795](https://cve.now/CVE-2026-59795.md): In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible (CVSS 8.1, JetBrains TeamCity)
- [CVE-2026-59794](https://cve.now/CVE-2026-59794.md): In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data (CVSS 7.3, JetBrains TeamCity)
- [CVE-2026-59793](https://cve.now/CVE-2026-59793.md): In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration (CVSS 8.8, JetBrains TeamCity)
- [CVE-2026-59792](https://cve.now/CVE-2026-59792.md): In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible (CVSS 9.6, JetBrains IntelliJ IDEA)
- [CVE-2026-59791](https://cve.now/CVE-2026-59791.md): In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible (CVSS 3.5, JetBrains YouTrack)
- [CVE-2026-38059](https://cve.now/CVE-2026-38059.md): ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function (CVSS 8.7, ST Engineering iDirect Evolution iQ‑Series terminals · S… +1)
- [CVE-2026-38057](https://cve.now/CVE-2026-38057.md): ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery (CVSS 7.0, ST Engineering iDirect Evolution iQ‑Series terminals · S… +1)
- [CVE-2026-29519](https://cve.now/CVE-2026-29519.md): Lucee CFML Server Reflected XSS via URL Path Parsing (CVSS 6.2, Lucee)
- [CVE-2026-61456](https://cve.now/CVE-2026-61456.md): Grav before 1.0.3 Stored XSS via SVG Upload API (CVSS 5.1, getgrav grav)
- [CVE-2026-61455](https://cve.now/CVE-2026-61455.md): Grav before 2.0.1 Decompression Bomb via ZipArchiver (CVSS 7.1, getgrav grav · getgrav/grav)
- [CVE-2026-61450](https://cve.now/CVE-2026-61450.md): Grav before 2.0.2 Config Exfiltration via offsetGet Filter (CVSS 7.1, getgrav grav · getgrav/grav)
- [CVE-2026-61444](https://cve.now/CVE-2026-61444.md): PraisonAI before 4.6.78 Code Injection via f-string (CVSS 9.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61441](https://cve.now/CVE-2026-61441.md): PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies (CVSS 7.1, MervinPraison PraisonAI · praisonai-platform)
- [CVE-2026-61437](https://cve.now/CVE-2026-61437.md): PraisonAI before 1.6.78 Remote Code Execution via tools.py (CVSS 8.5, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61434](https://cve.now/CVE-2026-61434.md): PraisonAI before 4.6.78 Allowlist Bypass via find -exec (CVSS 8.7, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61432](https://cve.now/CVE-2026-61432.md): PraisonAI FastContext before 1.6.78 Path Traversal (CVSS 6.9, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61431](https://cve.now/CVE-2026-61431.md): PraisonAI before 4.6.78 Path Traversal via ContextGatherer (CVSS 6.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-60091](https://cve.now/CVE-2026-60091.md): PraisonAI before 4.6.78 Unauthenticated SSRF via webhook\_url (CVSS 6.9, MervinPraison PraisonAI · praisonai)
- [CVE-2026-60089](https://cve.now/CVE-2026-60089.md): PraisonAI before 1.6.78 Path Traversal via config.toml (CVSS 6.9, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-60086](https://cve.now/CVE-2026-60086.md): PraisonAI before 4.6.78 Prompt Injection Defense Bypass (CVSS 6.9, MervinPraison PraisonAI · praisonai)
- [CVE-2026-58661](https://cve.now/CVE-2026-58661.md): n8n - Disk Space Exhaustion via Data-Table File Upload Endpoint (CVSS 5.3, n8n)
- [CVE-2026-57994](https://cve.now/CVE-2026-57994.md): phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints (CVSS 6.9, phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-57961](https://cve.now/CVE-2026-57961.md): phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function (CVSS 5.1, phpMyFAQ · thorsten/phpmyfaq +1)
- [CVE-2026-56765](https://cve.now/CVE-2026-56765.md): Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR (CVSS 9.3, Vikunja · code.vikunja.io/api)
- [CVE-2026-56373](https://cve.now/CVE-2026-56373.md): ImageMagick - Use-After-Free Write in PDB Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2026-56366](https://cve.now/CVE-2026-56366.md): ImageMagick - Memory Leak in META Reader APP1JPEG Error Path (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56354](https://cve.now/CVE-2026-56354.md): n8n - Cross-Site Scripting and Open Redirect in Form Node (CVSS 5.1, n8n)
- [CVE-2026-56335](https://cve.now/CVE-2026-56335.md): Capgo - Channel Configuration Mutation via Write-Scoped API Keys (CVSS 7.1, Capgo)
- [CVE-2026-56329](https://cve.now/CVE-2026-56329.md): Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding (CVSS 5.3, Capgo)
- [CVE-2026-56312](https://cve.now/CVE-2026-56312.md): Capgo - Account Creation Before CAPTCHA Validation in accept\_invitation Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56309](https://cve.now/CVE-2026-56309.md): Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint (CVSS 5.3, Capgo)
- [CVE-2026-56305](https://cve.now/CVE-2026-56305.md): Capgo - Authentication Bypass in Password Change via Missing Current Password Validation (CVSS 8.7, Capgo)
- [CVE-2026-56279](https://cve.now/CVE-2026-56279.md): Capgo - Information Disclosure via get\_orgs\_v7 RPC Endpoint (CVSS 8.7, Capgo)
- [CVE-2026-56261](https://cve.now/CVE-2026-56261.md): Crawl4AI - Server-Side Request Forgery via Webhook URLs (CVSS 9.2, Crawl4AI)
- [CVE-2026-56254](https://cve.now/CVE-2026-56254.md): capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution (CVSS 8.3, capacitor-updater)
- [CVE-2026-22659](https://cve.now/CVE-2026-22659.md): FlaskBB Authorization Bypass via Topic ID Manipulation (CVSS 7.2, flaskbb)
- [CVE-2026-22660](https://cve.now/CVE-2026-22660.md): FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint (CVSS 8.6, flaskbb)
- [CVE-2026-56813](https://cve.now/CVE-2026-56813.md): Cookie attribute injection in Plug.Conn.Cookies.encode/2 (CVSS 2.1, elixir-plug plug · plug)
- [CVE-2026-54470](https://cve.now/CVE-2026-54470.md): Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerability (CVSS 5.3, Dell Unisphere for PowerMax)
- [CVE-2026-54469](https://cve.now/CVE-2026-54469.md): Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. (CVSS 8.8, Dell Unisphere for PowerMax)
- [CVE-2026-54468](https://cve.now/CVE-2026-54468.md): Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. (CVSS 6.5, Dell Unisphere for PowerMax)
- [CVE-2026-56688](https://cve.now/CVE-2026-56688.md): Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Comma (CVSS 9.1, Dell PowerFlex Manager)
- [CVE-2026-53363](https://cve.now/CVE-2026-53363.md): xfrm: iptfs: preserve shared-frag marker in iptfs\_consume\_frags() (CVSS 9.8, Linux)
- [CVE-2026-56689](https://cve.now/CVE-2026-56689.md): Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Inj (CVSS 7.7, Dell PowerFlex Manager)
- [CVE-2026-56690](https://cve.now/CVE-2026-56690.md): Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Inj (CVSS 8.5, Dell PowerFlex Manager)
- [CVE-2026-56814](https://cve.now/CVE-2026-56814.md): Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) (CVSS 6.9, elixir-plug plug · plug)
- [CVE-2026-58225](https://cve.now/CVE-2026-58225.md): SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service (CVSS 2.1, elixir-ecto postgrex)
- [CVE-2026-14461](https://cve.now/CVE-2026-14461.md): Out-of-bound read in mtr (CVSS 5.1, BitWizard mtr)
- [CVE-2026-15028](https://cve.now/CVE-2026-15028.md): Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header (CVSS 3.9, Red Hat Enterprise Linux · Red Hat Cost Management On-Pr… +2)
- [CVE-2026-11990](https://cve.now/CVE-2026-11990.md): KiviCare \<= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint (CVSS 5.3, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2026-13247](https://cve.now/CVE-2026-13247.md): Logo Slider \<= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx\_tooltip\_position' Parameter (CVSS 6.4, logichunt Logo Slider WP – Responsive Logo Carousel, Logo G…)
- [CVE-2026-12918](https://cve.now/CVE-2026-12918.md): Mail Mint \<= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter (CVSS 4.9, getwpfunnels Mail Mint – Email Marketing, Newsletter, Email…)
- [CVE-2026-13710](https://cve.now/CVE-2026-13710.md): Jeg Kit for Elementor \<= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg\_body\_description' Parameter via 'jkit\_image\_box' Shortcode/Widget (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2026-13010](https://cve.now/CVE-2026-13010.md): JoomSport \<= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute (CVSS 6.5, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2026-9857](https://cve.now/CVE-2026-9857.md): Invoice123 \<= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123\_submit\_api\_key & s123\_submit\_invoice\_settings AJAX actions (CVSS 4.3, saskaita123 Invoice123)
- [CVE-2026-15378](https://cve.now/CVE-2026-15378.md): Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:) (CVSS 9.3, Red Hat OpenShift AI)
- [CVE-2026-41879](https://cve.now/CVE-2026-41879.md): Weak password hashing in R-SOFT DMS (CVSS 8.2, R-SOFT SERWIS DMS)
- [CVE-2026-41878](https://cve.now/CVE-2026-41878.md): Insecure Direct Object Reference in R-SOFT DMS (CVSS 7.1, R-SOFT SERWIS DMS)
- [CVE-2026-41880](https://cve.now/CVE-2026-41880.md): OS Command Injection in R-SOFT DMS (CVSS 9.0, R-SOFT SERWIS DMS)
- [CVE-2026-41877](https://cve.now/CVE-2026-41877.md): Stored XSS in R-SOFT DMS (CVSS 5.1, R-SOFT SERWIS DMS)
- [CVE-2026-41876](https://cve.now/CVE-2026-41876.md): OS Command Injection in R-SOFT DMS (CVSS 8.7, R-SOFT SERWIS DMS)
- [CVE-2026-9838](https://cve.now/CVE-2026-9838.md): ICS Calendar \<= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter (CVSS 6.1, room34 ICS Calendar)
- [CVE-2026-15026](https://cve.now/CVE-2026-15026.md): Import and export users and customers \<= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email\_template\_selected AJAX Action (CVSS 4.3, carazo Import and export users and customers)
- [CVE-2026-11992](https://cve.now/CVE-2026-11992.md): Easy Appointments \<= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation (CVSS 4.3, easyappointments Easy Appointments)
- [CVE-2025-11977](https://cve.now/CVE-2025-11977.md): HappyForms \<= 1.26.12 - Authenticated (Admin+) Local File Inclusion (CVSS 6.6, Happyforms – Form Builder for WordPress: Drag & Drop Contac…)
- [CVE-2026-12955](https://cve.now/CVE-2026-12955.md): Cookie Banner for GDPR / CCPA \<= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc\_save\_schedule\_scan AJAX Action (CVSS 4.3, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2026-6440](https://cve.now/CVE-2026-6440.md): GoodMeet \<= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet\_reset\_google\_meet\_credential' (CVSS 4.3, sovlix GoodMeet – Google Meet Integration for Webinar, Meet…)
- [CVE-2026-12400](https://cve.now/CVE-2026-12400.md): FlowForms \<= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints (CVSS 4.3, priyanshuchaudhary FlowForms – Conversational Form Builder)
- [CVE-2026-6802](https://cve.now/CVE-2026-6802.md): Easy Upload Files During Checkout \<= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter (CVSS 5.3, fahadmahmood Easy Upload Files During Checkout)
- [CVE-2026-1946](https://cve.now/CVE-2026-1946.md): GW AI Website Builder \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion (CVSS 4.3, nandhiniwp GW AI Website Builder)
- [CVE-2026-14475](https://cve.now/CVE-2026-14475.md): Cookie Banner for GDPR / CCPA \<= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan\_id' Parameter (CVSS 4.9, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2026-12924](https://cve.now/CVE-2026-12924.md): Eventin \<= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn\_faq\_content' Parameter (CVSS 6.4, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2026-3907](https://cve.now/CVE-2026-3907.md): Hostel \<= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode (CVSS 6.4, prasunsen Hostel)
- [CVE-2026-12108](https://cve.now/CVE-2026-12108.md): Highlighting Code Block \<= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font\_family' Setting (CVSS 4.4, looswebstudio Highlighting Code Block)
- [CVE-2026-15104](https://cve.now/CVE-2026-15104.md): BetterDocs \<= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter (CVSS 6.5, wpdevteam BetterDocs – AI Documentation, Knowledge Base, D…)
- [CVE-2026-40454](https://cve.now/CVE-2026-40454.md): Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data (CVSS 7.5, Apache Software Foundation Apache IoTDB C++ client)
- [CVE-2026-40452](https://cve.now/CVE-2026-40452.md): Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users (CVSS 7.5, Apache Software Foundation Apache IoTDB)
- [CVE-2026-40009](https://cve.now/CVE-2026-40009.md): Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to \_\_internal\_auditor (CVSS 6.5, Apache Software Foundation Apache IoTDB)
- [CVE-2026-40008](https://cve.now/CVE-2026-40008.md): Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC (CVSS 9.8, Apache Software Foundation Apache IoTDB)
- [CVE-2026-40007](https://cve.now/CVE-2026-40007.md): Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError (CVSS 7.5, Apache Software Foundation Apache IoTDB)
- [CVE-2026-40006](https://cve.now/CVE-2026-40006.md): Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver (CVSS 7.5, Apache Software Foundation Apache IoTDB)
- [CVE-2026-40005](https://cve.now/CVE-2026-40005.md): Apache IoTDB: Path Traversal in Pipe File Transfer Receiver (CVSS 9.1, Apache Software Foundation Apache IoTDB)
- [CVE-2026-28564](https://cve.now/CVE-2026-28564.md): Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials (CVSS 9.8, Apache Software Foundation Apache IoTDB)
- [CVE-2026-13347](https://cve.now/CVE-2026-13347.md): Hide My WP Lite \<= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he\_wrapper\_js' Parameter (CVSS 7.5, templatic1 Hide My WP Lite)
- [CVE-2026-12685](https://cve.now/CVE-2026-12685.md): EscortWP \<= 3.6.2 - Content Deletion via Vendor-Authored Backdoor (CVSS 7.5, escortwp)
- [CVE-2026-12276](https://cve.now/CVE-2026-12276.md): LA-Studio Element Kit for Elementor \< 1.6.1 - Unauthenticated Open Registration (CVSS 5.3, LA-Studio Element Kit for Elementor)
- [CVE-2026-12123](https://cve.now/CVE-2026-12123.md): All-in-One Video Gallery \<= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter (CVSS 6.4, plugins360 All-in-One Video Gallery)
- [CVE-2026-21057](https://cve.now/CVE-2026-21057.md): Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory. (CVSS 6.8, Samsung Mobile Samsung Pass)
- [CVE-2026-21056](https://cve.now/CVE-2026-21056.md): Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information. (CVSS 4.8, Samsung Mobile Samsung Health)
- [CVE-2026-21055](https://cve.now/CVE-2026-21055.md): Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands wi (CVSS 8.5, Samsung Mobile Bixby)
- [CVE-2026-21054](https://cve.now/CVE-2026-21054.md): Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data. (CVSS 6.9, Samsung Mobile InputSharing)
- [CVE-2026-21053](https://cve.now/CVE-2026-21053.md): Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application (CVSS 5.1, Samsung Mobile Samsung Email)
- [CVE-2026-21052](https://cve.now/CVE-2026-21052.md): Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privileg (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2026-21051](https://cve.now/CVE-2026-21051.md): Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity setti (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21050](https://cve.now/CVE-2026-21050.md): Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21049](https://cve.now/CVE-2026-21049.md): Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-21048](https://cve.now/CVE-2026-21048.md): Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write o (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-21046](https://cve.now/CVE-2026-21046.md): Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to ex (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-21045](https://cve.now/CVE-2026-21045.md): Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-21044](https://cve.now/CVE-2026-21044.md): Improper authorization in KnoxGuardManager prior to SMR Jul-2026 Release 1 allows local attackers to bypass the persistence configuration of (CVSS 5.8, Samsung Mobile Devices)
- [CVE-2026-21043](https://cve.now/CVE-2026-21043.md): Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server pri (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2026-21042](https://cve.now/CVE-2026-21042.md): Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code. (CVSS 8.7, Samsung Mobile Devices)
- [CVE-2026-21041](https://cve.now/CVE-2026-21041.md): Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21040](https://cve.now/CVE-2026-21040.md): Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21039](https://cve.now/CVE-2026-21039.md): Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-15332](https://cve.now/CVE-2026-15332.md): zhayujie CowAgent Message Endpoint channel.py authorization (CVSS 5.3, zhayujie CowAgent)
- [CVE-2026-15301](https://cve.now/CVE-2026-15301.md): BuddyHolis TableSearch \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, digiblogger BuddyHolis TableSearch)
- [CVE-2026-15300](https://cve.now/CVE-2026-15300.md): GEO my WP \<= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters (CVSS 9.1, ninjew GEO my WP)
- [CVE-2026-15299](https://cve.now/CVE-2026-15299.md): Animation Addons for Elementor \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget (CVSS 6.4, wealcoder Animation Addons for Elementor – GSAP Motion Elem…)
- [CVE-2026-15298](https://cve.now/CVE-2026-15298.md): TelSender \<= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title (CVSS 7.2, pechenki TelSender – Сontact form 7, Events, Wpforms, ninja…)
- [CVE-2026-15297](https://cve.now/CVE-2026-15297.md): Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) \<= 3.1.77 - Reflected Cross-Site Scripting (CVSS 6.1, neeraj\_slit Brevo – Email, SMS, Web Push, Chat, and more.)
- [CVE-2026-15296](https://cve.now/CVE-2026-15296.md): affiliate-toolkit – WP Affiliate Plugin with Amazon \<= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2026-15293](https://cve.now/CVE-2026-15293.md): WP Business Intelligence Lite \<= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification (CVSS 8.0, joeyoungblood WP Business Intelligence Lite)
- [CVE-2026-15292](https://cve.now/CVE-2026-15292.md): Sudoku Shortcode \<= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute (CVSS 6.4, tibouille Sudoku Shortcode)
- [CVE-2026-15291](https://cve.now/CVE-2026-15291.md): Chat Help – Click to Chat Button & Form \<= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 7.5, themeatelier ChatHelp – Click to Chat Button, WooCommerce C…)
- [CVE-2026-15290](https://cve.now/CVE-2026-15290.md): Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin \<= 2.10.1 - Unauthenticated Blind SQL Injection (CVSS 7.5, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-15289](https://cve.now/CVE-2026-15289.md): Booking calendar, Appointment Booking System \<= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart\_id' (CVSS 5.9, wpdevart Booking calendar, Appointment Booking System)
- [CVE-2026-15288](https://cve.now/CVE-2026-15288.md): SureForms – Drag and Drop Form Builder for WordPress \<= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation (CVSS 7.5, brainstormforce SureForms – Drag & Drop Contact Form & Form…)
- [CVE-2026-15287](https://cve.now/CVE-2026-15287.md): rtMedia for WordPress, BuddyPress and bbPress \<= 4.6.18 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, rtcamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-15286](https://cve.now/CVE-2026-15286.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-15285](https://cve.now/CVE-2026-15285.md): The Plus Addons for Elementor \<= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2026-15284](https://cve.now/CVE-2026-15284.md): King Addons for Elementor \<= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form\_page\_id' Parameter (CVSS 6.4, kingaddons King Addons for Elementor – 80+ Elementor Widget…)
- [CVE-2026-15302](https://cve.now/CVE-2026-15302.md): ARMember \<= 4.0.27 - Directory Traversal via X-FILENAME (CVSS 5.3, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2026-15283](https://cve.now/CVE-2026-15283.md): WPvivid Backup for MainWP \<= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wpvividplugins WPvivid Backup for MainWP)
- [CVE-2026-15282](https://cve.now/CVE-2026-15282.md): Instant Appointment \<= 1.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, tenteeglobal Instant Appointment)
- [CVE-2026-15331](https://cve.now/CVE-2026-15331.md): zhayujie CowAgent Skill Installation service.py \_add\_package path traversal (CVSS 5.3, zhayujie CowAgent)
- [CVE-2026-15330](https://cve.now/CVE-2026-15330.md): zhayujie CowAgent Vision Tool vision.py \_download\_to\_data\_url server-side request forgery (CVSS 6.9, zhayujie CowAgent)
- [CVE-2026-11818](https://cve.now/CVE-2026-11818.md): WPCafe \<= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API (CVSS 5.4, arraytics WPCafe – Restaurant Menu, Online Food Ordering &…)
- [CVE-2026-11392](https://cve.now/CVE-2026-11392.md): WP Hotel Booking \<= 2.3.1 - Reflected Cross-Site Scripting via 'check\_in\_date' and 'check\_out\_date' Parameters (CVSS 6.1, thimpress WP Hotel Booking)
- [CVE-2026-13430](https://cve.now/CVE-2026-13430.md): Post Export Import with Media \<= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import (CVSS 7.2, wpazleen Post Export Import with Media)
- [CVE-2026-15070](https://cve.now/CVE-2026-15070.md): Salon Booking System \<= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter (CVSS 8.8, wordpresschef Salon Booking System – Free Version)
- [CVE-2026-15329](https://cve.now/CVE-2026-15329.md): zhayujie CowAgent Browser Tool browser\_tool.py BrowserTool.\_do\_navigate information disclosure (CVSS 5.3, zhayujie CowAgent)
- [CVE-2026-15326](https://cve.now/CVE-2026-15326.md): halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal (CVSS 5.1, halo-dev halo)
- [CVE-2026-54423](https://cve.now/CVE-2026-54423.md): In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use t (CVSS 8.2, OpenStack Ironic)
- [CVE-2026-15321](https://cve.now/CVE-2026-15321.md): MyEMS Admin Backend svg.py on\_post cross site scripting (CVSS 4.8, MyEMS)
- [CVE-2026-14894](https://cve.now/CVE-2026-14894.md): Super Forms \<= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) (CVSS 9.8, WebRehab Super Forms – Drag & Drop Form Builder)
- [CVE-2026-5069](https://cve.now/CVE-2026-5069.md): Fluent Forms \<= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription\_id' (CVSS 5.4, wpmanageninja Fluent Forms – Customizable Contact Forms, Su…)
- [CVE-2026-15320](https://cve.now/CVE-2026-15320.md): Sipeed PicoClaw pico.go rt.ReloadConfig authorization (CVSS 5.3, Sipeed PicoClaw)
- [CVE-2026-15319](https://cve.now/CVE-2026-15319.md): Sipeed PicoClaw Launcher access\_control.go IPAllowlist access control (CVSS 6.9, Sipeed PicoClaw)
- [CVE-2026-15318](https://cve.now/CVE-2026-15318.md): Sipeed PicoClaw MQTT Channel mqtt.go authorization (CVSS 5.3, Sipeed PicoClaw)
- [CVE-2026-15317](https://cve.now/CVE-2026-15317.md): Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery (CVSS 5.3, Sipeed PicoClaw)
- [CVE-2025-70796](https://cve.now/CVE-2025-70796.md): An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 20 (CVSS 7.5)
- [CVE-2026-39244](https://cve.now/CVE-2026-39244.md): adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. (CVSS 7.5, adm-zip)
- [CVE-2026-44918](https://cve.now/CVE-2026-44918.md): OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. (CVSS 5.5, OpenStack Ironic)
- [CVE-2026-51119](https://cve.now/CVE-2026-51119.md): An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.