# CVEs published 2026-07-15

267 CVEs were published on July 15, 2026: 33 critical, 123 high. Days are UTC.

- [CVE-2026-15907](https://cve.now/CVE-2026-15907.md): H3C SecPath F1000-C8300 g=log\_fw\_nbc\_mail\_jsondata sql injection (CVSS 6.9, H3C SecPath F1000-C8300)
- [CVE-2026-54458](https://cve.now/CVE-2026-54458.md): AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin (CVSS 9.6, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-63175](https://cve.now/CVE-2026-63175.md): Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture (CVSS 7.1, Lookyloo PlaywrightCapture)
- [CVE-2026-48795](https://cve.now/CVE-2026-48795.md): Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser (CVSS 8.6, adonisjs core · @adonisjs/bodyparser)
- [CVE-2026-45313](https://cve.now/CVE-2026-45313.md): Sandboxie-Plus: Sandboxie APC Injection Sandbox Escape (CVSS 7.7, sandboxie-plus Sandboxie)
- [CVE-2026-55445](https://cve.now/CVE-2026-55445.md): Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication (CVSS 9.3, whyour qinglong · @whyour/qinglong)
- [CVE-2026-62314](https://cve.now/CVE-2026-62314.md): Anubis: Policy bypass via client controlled X-Original-URI header (CVSS 5.8, TecharoHQ anubis · github.com/TecharoHQ/anubis)
- [CVE-2026-15921](https://cve.now/CVE-2026-15921.md): nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory (CVSS 2.1, nvm-sh nvm)
- [CVE-2026-55652](https://cve.now/CVE-2026-55652.md): Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin) (CVSS 9.8, wekan)
- [CVE-2026-55234](https://cve.now/CVE-2026-55234.md): Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule) (CVSS 8.5, wekan)
- [CVE-2026-50183](https://cve.now/CVE-2026-50183.md): WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section (CVSS 4.7, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-53447](https://cve.now/CVE-2026-53447.md): Wekan: \`cloneBoard\` Meteor method has no authorization check — any user can clone (read) any private board by ID (CVSS 6.5, wekan)
- [CVE-2026-52893](https://cve.now/CVE-2026-52893.md): Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook (CVSS 9.2, wekan)
- [CVE-2026-53444](https://cve.now/CVE-2026-53444.md): Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin (CVSS 7.6, wekan)
- [CVE-2026-53445](https://cve.now/CVE-2026-53445.md): Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards (CVSS 7.1, wekan)
- [CVE-2026-53446](https://cve.now/CVE-2026-53446.md): Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs (CVSS 6.2, wekan)
- [CVE-2026-52892](https://cve.now/CVE-2026-52892.md): Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops) (CVSS 6.5, wekan)
- [CVE-2026-52891](https://cve.now/CVE-2026-52891.md): Wekan: Shell Injection via Avatar Upload (CVSS 9.9, wekan)
- [CVE-2026-52890](https://cve.now/CVE-2026-52890.md): Wekan: Arbitrary file read and server DoS via attachment versions.original.path (CVSS 7.1, wekan)
- [CVE-2026-50182](https://cve.now/CVE-2026-50182.md): AVideo Has Unauthenticated Reflected XSS via $\_GET\['search'\] in YouTubeAPI Gallery Pagination (CVSS 6.1, WWBN AVideo · WWBN/AVideo)
- [CVE-2026-55576](https://cve.now/CVE-2026-55576.md): MaaAssistantArknights: PR-title expression injection in release-preparation.yml (CVSS 8.8, MaaAssistantArknights)
- [CVE-2026-49279](https://cve.now/CVE-2026-49279.md): WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) (CVSS 7.7, WWBN AVideo · wwbn/avideo)
- [CVE-2026-62361](https://cve.now/CVE-2026-62361.md): listmonk: SQL Injection in \`/api/subscribers/export\` bypasses table access control, leaking admin password hashes and SMTP credentials (CVSS 5.5, knadh listmonk)
- [CVE-2026-62312](https://cve.now/CVE-2026-62312.md): 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments (CVSS 8.8, decolua 9router)
- [CVE-2026-56678](https://cve.now/CVE-2026-56678.md): 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding (CVSS 6.4, decolua 9router · 9router)
- [CVE-2026-56679](https://cve.now/CVE-2026-56679.md): 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade (CVSS 8.7, decolua 9router · 9router)
- [CVE-2026-49353](https://cve.now/CVE-2026-49353.md): 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING (CVSS 7.5, decolua 9router · 9router)
- [CVE-2026-33684](https://cve.now/CVE-2026-33684.md): AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2026-49352](https://cve.now/CVE-2026-49352.md): 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass (CVSS 9.8, decolua 9router · 9router)
- [CVE-2026-46339](https://cve.now/CVE-2026-46339.md): 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes (CVSS 10.0, decolua 9router · 9router)
- [CVE-2026-55608](https://cve.now/CVE-2026-55608.md): n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode (CVSS 4.2, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-54052](https://cve.now/CVE-2026-54052.md): n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments (CVSS 9.9, czlonkowski n8n-mcp · n8n-mcp)
- [CVE-2026-55399](https://cve.now/CVE-2026-55399.md): Resource exhaustion vulnerability in the Secure Access publisher (CVSS 5.1, Absolute Security Secure Access)
- [CVE-2026-55410](https://cve.now/CVE-2026-55410.md): NocoBase backup restore schema name allows command injection (CVSS 6.7, nocobase · @nocobase/plugin-backups)
- [CVE-2026-55398](https://cve.now/CVE-2026-55398.md): Memory management vulnerability in Secure Access clients (CVSS 6.9, Absolute Security Secure Access)
- [CVE-2026-52887](https://cve.now/CVE-2026-52887.md): NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE (CVSS 10.0, nocobase · @nocobase/plugin-notification-in-app-message)
- [CVE-2026-33445](https://cve.now/CVE-2026-33445.md): Memory management vulnerability in Secure Access servers (CVSS 8.7, Absolute Security Secure Access)
- [CVE-2026-52888](https://cve.now/CVE-2026-52888.md): NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass (CVSS 6.8, nocobase · @nocobase/plugin-collection-sql)
- [CVE-2026-33444](https://cve.now/CVE-2026-33444.md): Memory management vulnerability in Secure Access servers (CVSS 6.9, Absolute Secutity Secure Access)
- [CVE-2026-59950](https://cve.now/CVE-2026-59950.md): MCP Python SDK: WebSocket server transport does not support Host/Origin validation (CVSS 7.6, modelcontextprotocol python-sdk · mcp)
- [CVE-2026-52870](https://cve.now/CVE-2026-52870.md): MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks (CVSS 7.6, modelcontextprotocol python-sdk · mcp)
- [CVE-2026-33443](https://cve.now/CVE-2026-33443.md): Memory management error in Secure Access servers prior to 14.55 (CVSS 7.1, Absolute Security Secure Access)
- [CVE-2026-52869](https://cve.now/CVE-2026-52869.md): MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal (CVSS 7.1, modelcontextprotocol python-sdk · mcp)
- [CVE-2026-50144](https://cve.now/CVE-2026-50144.md): ncnn: Out-of-bounds heap write in ParamDict::load\_param via unchecked negative parameter id (CVSS 7.1, Tencent ncnn)
- [CVE-2026-40958](https://cve.now/CVE-2026-40958.md): Input validation error in Secure Access clients prior to 14.55 (CVSS 2.3, Absolute Security Secure Access)
- [CVE-2026-45737](https://cve.now/CVE-2026-45737.md): Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations (CVSS 6.3, argoproj argo-cd · github.com/argoproj/argo-cd +2)
- [CVE-2026-40957](https://cve.now/CVE-2026-40957.md): Frameable content vulnerability in the Secure Access server login page (CVSS 6.1, Absolute Security Secure Access)
- [CVE-2026-40956](https://cve.now/CVE-2026-40956.md): Memory disclosure in Secure Access Clients (CVSS 2.1, Absolute Security Secure Access)
- [CVE-2026-45738](https://cve.now/CVE-2026-45738.md): Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation (CVSS 7.3, argoproj argo-cd · github.com/argoproj/argo-cd/v3 +2)
- [CVE-2026-40955](https://cve.now/CVE-2026-40955.md): Integer underflow vulnerability in Secure Access clients (CVSS 2.1, Absolute Security Secure Access)
- [CVE-2026-40954](https://cve.now/CVE-2026-40954.md): Integer underflow in Secure Access clients prior to 14.55 (CVSS 2.1, Absolute Security Secure Access)
- [CVE-2026-49867](https://cve.now/CVE-2026-49867.md): DataEase: Authenticated Stored XSS in DataEase Template Static Resources (CVSS 6.3, dataease)
- [CVE-2026-46684](https://cve.now/CVE-2026-46684.md): DataEase: Unauthorized Command Execution Vulnerability (CVSS 9.5, dataease)
- [CVE-2026-40953](https://cve.now/CVE-2026-40953.md): Heap overflow in Secure Access clients (CVSS 6.7, Absolute Security Secure Access)
- [CVE-2026-45320](https://cve.now/CVE-2026-45320.md): DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection (CVSS 8.7, dataease)
- [CVE-2026-45535](https://cve.now/CVE-2026-45535.md): DataEase: Stored SQL Injection Vulnerability (CVSS 8.7, dataease)
- [CVE-2026-45533](https://cve.now/CVE-2026-45533.md): DataEase: Path Traversal Vulnerability (CVSS 8.3, dataease)
- [CVE-2026-50124](https://cve.now/CVE-2026-50124.md): DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper (CVSS 7.1, dataease)
- [CVE-2026-40952](https://cve.now/CVE-2026-40952.md): Privilge misconfiguration in Secure Access installers (CVSS 8.5, Absolute Security Secure Access)
- [CVE-2026-50030](https://cve.now/CVE-2026-50030.md): DataEase: Arbitrary SQL execution in preview path (direct data disclosure) (CVSS 7.1, dataease)
- [CVE-2026-45419](https://cve.now/CVE-2026-45419.md): DataEase: Arbitrary File Write Vulnerability (CVSS 8.5, dataease)
- [CVE-2026-45417](https://cve.now/CVE-2026-45417.md): DataEase: SQL injection vulnerability (CVSS 8.7, dataease)
- [CVE-2026-45534](https://cve.now/CVE-2026-45534.md): DataEase: RCE Vulnerability (CVSS 9.0, dataease)
- [CVE-2026-56743](https://cve.now/CVE-2026-56743.md): Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match (CVSS 5.4, cilium · github.com/cilium/cilium)
- [CVE-2026-56742](https://cve.now/CVE-2026-56742.md): Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces (CVSS 5.9, cilium · github.com/cilium/cilium +1)
- [CVE-2026-49445](https://cve.now/CVE-2026-49445.md): Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access (CVSS 9.2, cilium · github.com/cilium/cilium)
- [CVE-2026-62353](https://cve.now/CVE-2026-62353.md): TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken (CVSS 5.4, taosdata TDengine)
- [CVE-2026-62351](https://cve.now/CVE-2026-62351.md): TDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsg (CVSS 7.5, taosdata TDengine)
- [CVE-2026-62348](https://cve.now/CVE-2026-62348.md): TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations (CVSS 5.4, taosdata TDengine)
- [CVE-2026-15895](https://cve.now/CVE-2026-15895.md): OS command injection in jsii-diff in AWS jsii (CVSS 8.4, AWS jsii · jsii-diff)
- [CVE-2026-62349](https://cve.now/CVE-2026-62349.md): TDengine: Off-by-One Buffer Overflow (CVSS 8.3, taosdata TDengine)
- [CVE-2026-62350](https://cve.now/CVE-2026-62350.md): TDengine: UDF lead to RCE (CVSS 7.2, taosdata TDengine)
- [CVE-2026-46421](https://cve.now/CVE-2026-46421.md): Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) (CVSS 9.3, @cap-js/sqlite · @cap-js/postgres +1)
- [CVE-2026-62355](https://cve.now/CVE-2026-62355.md): TDengine: Standard User permission unexpect (CVSS 5.4, taosdata TDengine)
- [CVE-2026-26032](https://cve.now/CVE-2026-26032.md): Apache Ivy: PackagerResolver path traversal vulnerability (CVSS 5.4, Apache Software Foundation Apache Ivy)
- [CVE-2026-15746](https://cve.now/CVE-2026-15746.md): Credential disclosure in Strands Agents Tools elasticsearch\_memory tool (CVSS 6.9, Amazon strands-agents-tools)
- [CVE-2026-12997](https://cve.now/CVE-2026-12997.md): Gravity Forms \<= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform\_uploaded\_files' Parameter (CVSS 7.5, Gravity Forms)
- [CVE-2026-54443](https://cve.now/CVE-2026-54443.md): Dashy: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVSS 5.9, lissy93 dashy)
- [CVE-2026-46485](https://cve.now/CVE-2026-46485.md): Dash: Users can write to config despire permissions (OIDC tested) (CVSS 8.2, lissy93 dashy)
- [CVE-2026-49987](https://cve.now/CVE-2026-49987.md): Repomix: Command Injection (RCE) via \`--remote-branch\` Argument Injection (CVSS 7.5, yamadashy repomix · repomix)
- [CVE-2026-49988](https://cve.now/CVE-2026-49988.md): Repomix: attach\_packed\_output can bypass file-read secret scanning for supported local files (CVSS 6.8, yamadashy repomix · repomix)
- [CVE-2026-62947](https://cve.now/CVE-2026-62947.md): OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download (CVSS 4.9, openwrt)
- [CVE-2026-62948](https://cve.now/CVE-2026-62948.md): OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI (CVSS 9.6, openwrt)
- [CVE-2026-40501](https://cve.now/CVE-2026-40501.md): Cherry Studio RCE via SearchService nodeIntegration Misconfiguration (CVSS 8.6, CherryHQ cherry-studio)
- [CVE-2026-10673](https://cve.now/CVE-2026-10673.md): Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly (CVSS 8.3, zephyrproject zephyr)
- [CVE-2026-53517](https://cve.now/CVE-2026-53517.md): Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking (CVSS 8.1, better-auth · @better-auth oauth-provider +1)
- [CVE-2026-56687](https://cve.now/CVE-2026-56687.md): Dell ThinOS 10, versions prior to 2605\_10.2100, contain an Obsolete Feature in UI vulnerability. (CVSS 7.8, Dell ThinOS)
- [CVE-2026-45337](https://cve.now/CVE-2026-45337.md): Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending (CVSS 7.6, better-auth)
- [CVE-2026-53514](https://cve.now/CVE-2026-53514.md): Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin (CVSS 7.7, better-auth)
- [CVE-2026-56087](https://cve.now/CVE-2026-56087.md): Dell ThinOS 10, versions prior to 2605\_10.2100 contain a Protection Mechanism Failure vulnerability. (CVSS 6.1, Dell ThinOS)
- [CVE-2026-53515](https://cve.now/CVE-2026-53515.md): Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso (CVSS 7.1, better-auth · @better-auth sso +1)
- [CVE-2026-12382](https://cve.now/CVE-2026-12382.md): Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing (CVSS 8.2, Red Hat Ansible Automation Platform 2.5 for RHEL · Red H… +1)
- [CVE-2026-20298](https://cve.now/CVE-2026-20298.md): Sensitive Information Disclosure through the storage/passwords REST Endpoint in Splunk Enterprise (CVSS 5.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20296](https://cve.now/CVE-2026-20296.md): SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise (CVSS 8.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-20297](https://cve.now/CVE-2026-20297.md): Path Traversal through 'explicit\_appname' in the App Install REST Endpoint in Splunk Enterprise (CVSS 7.2, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2026-53512](https://cve.now/CVE-2026-53512.md): Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (CVSS 9.1, better-auth)
- [CVE-2026-53518](https://cve.now/CVE-2026-53518.md): Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption (CVSS 7.6, better-auth · @better-auth/oauth-provider)
- [CVE-2026-53513](https://cve.now/CVE-2026-53513.md): Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration (CVSS 9.6, better-auth · @better-auth sso +1)
- [CVE-2026-53516](https://cve.now/CVE-2026-53516.md): Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email (CVSS 8.3, better-auth)
- [CVE-2026-14961](https://cve.now/CVE-2026-14961.md): CVE-2026-14961 (CVSS 6.2, Pegatron Tdelo64.sys)
- [CVE-2026-14960](https://cve.now/CVE-2026-14960.md): CVE-2026-14960 (CVSS 9.8, Pegatron Tdelo64.sys)
- [CVE-2026-59258](https://cve.now/CVE-2026-59258.md): immich \< 3.0.3 Shared Album Editor Ownership Takeover via updateUser (CVSS 7.2, immich-app immich)
- [CVE-2026-59255](https://cve.now/CVE-2026-59255.md): BloodHound Missing Authorization on Custom Node Management API (CVSS 7.1, SpecterOps BloodHound)
- [CVE-2026-61643](https://cve.now/CVE-2026-61643.md): FastGPT: workflow runtime can execute another user's private HTTP toolset (CVSS 5.9, labring FastGPT)
- [CVE-2026-58660](https://cve.now/CVE-2026-58660.md): Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop (CVSS 7.2, kanboard)
- [CVE-2026-58659](https://cve.now/CVE-2026-58659.md): PyTorch Lightning Arbitrary Code Execution via \_instantiator Hyperparameter (CVSS 8.4, Lightning-AI pytorch-lightning · lightning +1)
- [CVE-2026-58658](https://cve.now/CVE-2026-58658.md): GPUStack Unauthenticated Information Disclosure via Worker Endpoints (CVSS 8.8, gpustack)
- [CVE-2026-50562](https://cve.now/CVE-2026-50562.md): FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows (CVSS 9.3, labring FastGPT)
- [CVE-2026-62378](https://cve.now/CVE-2026-62378.md): RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover (CVSS 9.0, rustfs console)
- [CVE-2026-1563](https://cve.now/CVE-2026-1563.md): Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.8, Pegasystems Pega Infinity)
- [CVE-2026-1562](https://cve.now/CVE-2026-1562.md): Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.6, Pegasystems Pega Infinity)
- [CVE-2025-32781](https://cve.now/CVE-2025-32781.md): Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId (CVSS 6.5, apolloconfig apollo · com.ctrip.framework.apollo:apollo)
- [CVE-2026-59954](https://cve.now/CVE-2026-59954.md): Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching (CVSS 7.5, apolloconfig apollo · com.ctrip.framework.apollo:apollo)
- [CVE-2026-59955](https://cve.now/CVE-2026-59955.md): Apollo ConfigService access key authentication bypass via raw config file appId parsing (CVSS 7.5, apolloconfig apollo · com.ctrip.framework.apollo:apollo)
- [CVE-2026-45793](https://cve.now/CVE-2026-45793.md): Composer: Github Actions issued GITHUB\_TOKEN disclosure in GitHub Actions logs (CVSS 7.5, composer · composer/composer)
- [CVE-2026-20187](https://cve.now/CVE-2026-20187.md): Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities (CVSS 7.5, Cisco RoomOS Software)
- [CVE-2026-20158](https://cve.now/CVE-2026-20158.md): Cisco RoomOS Security Hardening Release - Resource Lifetime Management Vulnerabilities (CVSS 7.5, Cisco RoomOS Software)
- [CVE-2026-52842](https://cve.now/CVE-2026-52842.md): Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass (CVSS 9.3, lightpanda-io browser)
- [CVE-2026-20153](https://cve.now/CVE-2026-20153.md): Cisco RoomOS Security Hardening Release - Input Validation Vulnerabilities (CVSS 7.5, Cisco RoomOS Software)
- [CVE-2026-20157](https://cve.now/CVE-2026-20157.md): Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities (CVSS 7.5, Cisco RoomOS Software)
- [CVE-2026-20156](https://cve.now/CVE-2026-20156.md): Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities (CVSS 8.1, Cisco RoomOS Software)
- [CVE-2026-20146](https://cve.now/CVE-2026-20146.md): Cisco Identity Services Engine Path Traversal Vulnerability (CVSS 5.5, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20150](https://cve.now/CVE-2026-20150.md): Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities (CVSS 8.8, Cisco RoomOS Software)
- [CVE-2026-52843](https://cve.now/CVE-2026-52843.md): Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode (CVSS 9.3, lightpanda-io browser)
- [CVE-2026-49997](https://cve.now/CVE-2026-49997.md): SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted (CVSS 5.4, surrealdb)
- [CVE-2026-48799](https://cve.now/CVE-2026-48799.md): Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook (CVSS 7.7, gitroomhq postiz-app)
- [CVE-2026-45804](https://cve.now/CVE-2026-45804.md): Diffusers: TOCTOU Trust Remote Code Bypass (CVSS 7.5, huggingface diffusers · diffusers)
- [CVE-2026-47703](https://cve.now/CVE-2026-47703.md): AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle (CVSS 6.3, AdguardTeam AdGuardHome · github.com/AdguardTeam/AdGuard… +1)
- [CVE-2026-62685](https://cve.now/CVE-2026-62685.md): File Browser: Colliding username normalization gives two users the same home directory (CVSS 8.1, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-62843](https://cve.now/CVE-2026-62843.md): File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) (CVSS 6.8, filebrowser · github.com/filebrowser/filebrowser +1)
- [CVE-2026-9007](https://cve.now/CVE-2026-9007.md): Reflected XSS in HCL Notes (CVSS 5.5, HCL Software HCL Notes)
- [CVE-2026-62683](https://cve.now/CVE-2026-62683.md): File Browser: Trailing-slash delete leaves a stale public share behind (CVSS 3.1, filebrowser)
- [CVE-2026-55242](https://cve.now/CVE-2026-55242.md): ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming\_series\_prefix (CVSS 8.8, frappe erpnext)
- [CVE-2026-45150](https://cve.now/CVE-2026-45150.md): Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing (CVSS 6.3, zen-browser desktop)
- [CVE-2026-50147](https://cve.now/CVE-2026-50147.md): Metabase: Arbitrary File Read via MySQL Connection Property Injection (CVSS 7.6, metabase)
- [CVE-2026-50148](https://cve.now/CVE-2026-50148.md): Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write (CVSS 10.0, metabase)
- [CVE-2026-45805](https://cve.now/CVE-2026-45805.md): Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE (CVSS 8.8, penpot · @penpot/mcp)
- [CVE-2026-44986](https://cve.now/CVE-2026-44986.md): Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile (CVSS 9.9, penpot)
- [CVE-2026-45806](https://cve.now/CVE-2026-45806.md): Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url (CVSS 7.7, penpot)
- [CVE-2026-60005](https://cve.now/CVE-2026-60005.md): NGINX ngx\_http\_slice\_module vulnerability (CVSS 8.2, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-47160](https://cve.now/CVE-2026-47160.md): Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass (CVSS 5.8, dani-garcia vaultwarden)
- [CVE-2026-47164](https://cve.now/CVE-2026-47164.md): Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity (CVSS 7.7, dani-garcia vaultwarden)
- [CVE-2026-47159](https://cve.now/CVE-2026-47159.md): Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure (CVSS 6.9, dani-garcia vaultwarden)
- [CVE-2026-47158](https://cve.now/CVE-2026-47158.md): Vaultwarden: CSRF in SSO Authorization Flow (CVSS 8.3, dani-garcia vaultwarden)
- [CVE-2026-46709](https://cve.now/CVE-2026-46709.md): Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) (CVSS 7.8, Eugeny tabby)
- [CVE-2026-41580](https://cve.now/CVE-2026-41580.md): Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) (CVSS 6.1, Stirling-Tools Stirling-PDF)
- [CVE-2026-61828](https://cve.now/CVE-2026-61828.md): nixos/mysql : \`services.mysql\` is configured with insecure authentication by default when used with \`mysql\` or \`percona-server\` (CVSS 8.5, NixOS nixpkgs)
- [CVE-2026-54560](https://cve.now/CVE-2026-54560.md): Cloudreve: OAuth access tokens bypass scope enforcement due to missing client\_id claim (CVSS 7.6, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-54563](https://cve.now/CVE-2026-54563.md): Cloudreve: Path Traversal / Broken Access Control in Cloudreve WebDAV (\`/dav\`) — scoped DAV credential escapes its configured account root (CVSS 7.1, cloudreve · github.com/cloudreve/Cloudreve +2)
- [CVE-2026-54562](https://cve.now/CVE-2026-54562.md): Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses (CVSS 6.5, cloudreve · github.com/cloudreve/Cloudreve/v4 +2)
- [CVE-2026-33213](https://cve.now/CVE-2026-33213.md): Redash: Open redirect vulnerability in post-login redirect handling (CVSS 6.1, getredash redash)
- [CVE-2026-60065](https://cve.now/CVE-2026-60065.md): NGINX Plus ngx\_stream\_mqtt\_filter\_module vulnerability (CVSS 3.7, F5 NGINX Plus)
- [CVE-2026-56434](https://cve.now/CVE-2026-56434.md): NGINX ngx\_http\_ssi\_module vulnerability (CVSS 6.5, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-42533](https://cve.now/CVE-2026-42533.md): NGINX Map directive and Regex matching vulnerability (CVSS 8.1, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-60062](https://cve.now/CVE-2026-60062.md): NGINX Agent Vulnerability (CVSS 6.4, F5 NGINX Agent · F5 NGINX Instance Manager)
- [CVE-2026-52865](https://cve.now/CVE-2026-52865.md): NGINX Ingress Controller vulnerability (CVSS 6.5, F5 NGINX Ingress Controller)
- [CVE-2026-55723](https://cve.now/CVE-2026-55723.md): NGINX Ingress Controller vulnerability (CVSS 8.3, F5 NGINX Ingress Controller)
- [CVE-2026-59762](https://cve.now/CVE-2026-59762.md): BIG-IP HTTP/2 vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2026-61646](https://cve.now/CVE-2026-61646.md): FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects (CVSS 6.3, labring FastGPT)
- [CVE-2026-61644](https://cve.now/CVE-2026-61644.md): FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup (CVSS 7.7, labring FastGPT)
- [CVE-2026-61684](https://cve.now/CVE-2026-61684.md): FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE\_TOKEN\_SECRET='token') (CVSS 8.8, labring FastGPT)
- [CVE-2026-62294](https://cve.now/CVE-2026-62294.md): Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With" (CVSS 5.1, flameshot-org flameshot)
- [CVE-2026-61613](https://cve.now/CVE-2026-61613.md): Cursor: Cloud Agent Browser Sandbox Escape (CVSS 7.7, cursor)
- [CVE-2026-61836](https://cve.now/CVE-2026-61836.md): Directus: Authorization-dependent response served from unsegmented cache key (CVSS 8.6, directus)
- [CVE-2026-61835](https://cve.now/CVE-2026-61835.md): Directus: SSRF Protection Bypass via 0.0.0.0 in File Import (CVSS 7.7, directus)
- [CVE-2026-61740](https://cve.now/CVE-2026-61740.md): LightRAG: Authentication bypass: hardcoded DEFAULT\_TOKEN\_SECRET and public /auth-status defeat LIGHTRAG\_API\_KEY protection (CVSS 9.3, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-61736](https://cve.now/CVE-2026-61736.md): LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests (CVSS 9.3, HKUDS LightRAG · lightrag-hku)
- [CVE-2026-43637](https://cve.now/CVE-2026-43637.md): Cornac \< 2.6.0 Path Traversal via \_extract\_archive() in download.py (CVSS 8.8, PreferredAI cornac)
- [CVE-2026-59838](https://cve.now/CVE-2026-59838.md): A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 t (CVSS 5.3, Fortinet FortiSIEM)
- [CVE-2026-46459](https://cve.now/CVE-2026-46459.md): Missing Authorization in ICU Scandinavia Boomerang (CVSS 5.3, ICU Scandinavia Boomerang)
- [CVE-2026-46458](https://cve.now/CVE-2026-46458.md): Credential exposure in ICU Scandinavia Boomerang (CVSS 7.1, ICU Scandinavia Boomerang)
- [CVE-2026-58559](https://cve.now/CVE-2026-58559.md): DoS vulnerability in the vibration service. (CVSS 6.5, Huawei Harmony OS · Huawei EMUI)
- [CVE-2026-58558](https://cve.now/CVE-2026-58558.md): Permission control vulnerability in the file system. (CVSS 7.8, Huawei Harmony OS · Huawei EMUI)
- [CVE-2026-58556](https://cve.now/CVE-2026-58556.md): Permission control vulnerability in the Bluetooth module. (CVSS 5.1, Huawei Harmony OS · Huawei EMUI)
- [CVE-2026-15779](https://cve.now/CVE-2026-15779.md): Samba-winbind: samba: pam\_winbind mkhomedir chowns critical system paths without validation (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-15809](https://cve.now/CVE-2026-15809.md): Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env (CVSS 7.8, Red Hat OpenShift Container Platform · Red Hat Confidential…)
- [CVE-2026-58557](https://cve.now/CVE-2026-58557.md): Design defect vulnerability in Expedition mode. (CVSS 4.8, Huawei HarmonyOS)
- [CVE-2026-58554](https://cve.now/CVE-2026-58554.md): Permission control vulnerability in the Settings module. (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-58555](https://cve.now/CVE-2026-58555.md): Permission bypass vulnerability in the card module. (CVSS 6.6, Huawei HarmonyOS)
- [CVE-2026-58553](https://cve.now/CVE-2026-58553.md): Out-of-bounds read vulnerability in the image codec module. (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2026-58552](https://cve.now/CVE-2026-58552.md): Out-of-bounds read vulnerability in the image codec module. (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2026-58551](https://cve.now/CVE-2026-58551.md): Out-of-bounds read vulnerability in the image codec module. (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2026-58550](https://cve.now/CVE-2026-58550.md): Out-of-bounds read vulnerability in the image codec module. (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2026-58549](https://cve.now/CVE-2026-58549.md): Out-of-bounds read vulnerability in the image codec module. (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2026-61873](https://cve.now/CVE-2026-61873.md): Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename (CVSS 7.2, getgrav grav)
- [CVE-2026-61872](https://cve.now/CVE-2026-61872.md): ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder (CVSS 2.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61871](https://cve.now/CVE-2026-61871.md): ImageMagick before 7.1.2-26 Memory Leak in ICON decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61869](https://cve.now/CVE-2026-61869.md): ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61868](https://cve.now/CVE-2026-61868.md): ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61867](https://cve.now/CVE-2026-61867.md): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61866](https://cve.now/CVE-2026-61866.md): ImageMagick before 7.1.2-26 Memory Leak in JNG encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61865](https://cve.now/CVE-2026-61865.md): ImageMagick before 7.1.2-26 Memory Leak in Hough Lines (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61864](https://cve.now/CVE-2026-61864.md): ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61863](https://cve.now/CVE-2026-61863.md): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61862](https://cve.now/CVE-2026-61862.md): ImageMagick before 7.1.2-26 Information Disclosure via identify (CVSS 2.1, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61860](https://cve.now/CVE-2026-61860.md): ImageMagick before 7.1.2-26 Use-After-Free via freetype (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61859](https://cve.now/CVE-2026-61859.md): ImageMagick before 7.1.2-26 Policy Bypass via script operation (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61464](https://cve.now/CVE-2026-61464.md): ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11 (CVSS 1.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-61457](https://cve.now/CVE-2026-61457.md): Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass (CVSS 5.3, getgrav grav)
- [CVE-2026-61453](https://cve.now/CVE-2026-61453.md): Grav before 2.0.1 XSS via Twig String Concatenation (CVSS 5.1, getgrav grav · getgrav/grav)
- [CVE-2026-61452](https://cve.now/CVE-2026-61452.md): Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens (CVSS 6.9, getgrav grav)
- [CVE-2026-61451](https://cve.now/CVE-2026-61451.md): Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin\_base\_url (CVSS 9.4, getgrav grav-plugin-api)
- [CVE-2026-61449](https://cve.now/CVE-2026-61449.md): Grav before 2.0.2 Decompression Bomb via Forged ZIP Size (CVSS 7.1, getgrav grav · getgrav/grav)
- [CVE-2026-61446](https://cve.now/CVE-2026-61446.md): PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery (CVSS 8.6, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61443](https://cve.now/CVE-2026-61443.md): PraisonAI before 1.6.78 Remote Code Execution via SkillTools (CVSS 8.6, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61440](https://cve.now/CVE-2026-61440.md): PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints (CVSS 7.1, MervinPraison PraisonAI · praisonai-platform)
- [CVE-2026-61438](https://cve.now/CVE-2026-61438.md): PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox (CVSS 7.0, MervinPraison PraisonAI)
- [CVE-2026-61436](https://cve.now/CVE-2026-61436.md): PraisonAI before 4.6.78 Missing Webhook Signature Verification (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61435](https://cve.now/CVE-2026-61435.md): PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61433](https://cve.now/CVE-2026-61433.md): PraisonAI before 4.6.78 Code Injection via API deployment generator (CVSS 8.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-61430](https://cve.now/CVE-2026-61430.md): PraisonAI before 1.6.78 DNS Rebinding SSRF via web\_crawl (CVSS 8.4, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-61427](https://cve.now/CVE-2026-61427.md): PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream (CVSS 6.9, MervinPraison PraisonAI · praisonai)
- [CVE-2026-60087](https://cve.now/CVE-2026-60087.md): PraisonAI before 1.6.78 Tool Approval Cache Bypass (CVSS 6.9, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-60085](https://cve.now/CVE-2026-60085.md): PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox (CVSS 8.7, MervinPraison PraisonAI · praisonai)
- [CVE-2026-59259](https://cve.now/CVE-2026-59259.md): n8n - Permission Bypass via Expression Parser Mismatch in External Secrets (CVSS 6.0, n8n)
- [CVE-2026-59254](https://cve.now/CVE-2026-59254.md): n8n - External Secrets Disclosure via Workflow Node Expressions (CVSS 6.3, n8n)
- [CVE-2026-58655](https://cve.now/CVE-2026-58655.md): Grav Flex Objects - Server-Side Template Injection via Dynamic Titles (CVSS 8.7, getgrav grav)
- [CVE-2026-57996](https://cve.now/CVE-2026-57996.md): phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint (CVSS 8.7, phpMyFAQ)
- [CVE-2026-56764](https://cve.now/CVE-2026-56764.md): Hono - Timing Attack in basicAuth and bearerAuth Middleware (CVSS 6.3, Hono)
- [CVE-2026-56400](https://cve.now/CVE-2026-56400.md): open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation (CVSS 9.0, open-webui)
- [CVE-2026-56398](https://cve.now/CVE-2026-56398.md): Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI (CVSS 8.5, open-webui)
- [CVE-2026-56375](https://cve.now/CVE-2026-56375.md): ImageMagick - Memory Leak in ASHLAR Coder Action Failure (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56353](https://cve.now/CVE-2026-56353.md): n8n - Authentication Bypass in Chat Trigger Node (CVSS 6.3, n8n)
- [CVE-2026-56352](https://cve.now/CVE-2026-56352.md): n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter (CVSS 5.3, n8n)
- [CVE-2026-56349](https://cve.now/CVE-2026-56349.md): n8n - Guardrail Node Bypass via Crafted Input (CVSS 6.3, n8n)
- [CVE-2026-56339](https://cve.now/CVE-2026-56339.md): Capgo - Unauthenticated Organization Existence Enumeration via rescind\_invitation RPC (CVSS 8.7, Cap-go capgo)
- [CVE-2026-59236](https://cve.now/CVE-2026-59236.md): Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection (CVSS 6.9, Roskus Prospero Flow CRM)
- [CVE-2026-59235](https://cve.now/CVE-2026-59235.md): Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts (CVSS 8.7, Roskus Prospero Flow CRM)
- [CVE-2026-40633](https://cve.now/CVE-2026-40633.md): Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information i (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2026-49501](https://cve.now/CVE-2026-49501.md): Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, and versions 9.11.0.0 through 9.13.0.2 contains an Improper Privilege Management vu (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-57821](https://cve.now/CVE-2026-57821.md): Apache Fineract: Office list: SQL Injection via Subquery in orderBy (CVSS 8.1, Apache Software Foundation Apache Fineract)
- [CVE-2026-35152](https://cve.now/CVE-2026-35152.md): Apache Fineract: SQL injection in runreports endpoint (CVSS 8.8, Apache Software Foundation Apache Fineract)
- [CVE-2026-56287](https://cve.now/CVE-2026-56287.md): Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure (CVSS 8.1, Apache Software Foundation Apache Fineract)
- [CVE-2026-58077](https://cve.now/CVE-2026-58077.md): Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics \< 5.0.2 (CVSS 8.7, weeblr.com 4Analytics extension for Joomla)
- [CVE-2026-57833](https://cve.now/CVE-2026-57833.md): Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics \< 5.0.2 (CVSS 8.6, weeblr.com 4Analytics extension for Joomla)
- [CVE-2026-57832](https://cve.now/CVE-2026-57832.md): Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman \< 3.9 (CVSS 8.7, joomdonation.com EDocman extension for Joomla)
- [CVE-2026-57831](https://cve.now/CVE-2026-57831.md): Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 (CVSS 8.7, digital-peak.com DP Calendar extension for Joomla)
- [CVE-2026-15804](https://cve.now/CVE-2026-15804.md): MetaGuru｜HCM - SQL Injection (CVSS 8.7, MetaGuru HCM)
- [CVE-2026-15583](https://cve.now/CVE-2026-15583.md): SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header (CVSS 8.6, Grafana MCP Server)
- [CVE-2026-14251](https://cve.now/CVE-2026-14251.md): Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos (CVSS 7.7, Red Hat OpenShift GitOps)
- [CVE-2026-12512](https://cve.now/CVE-2026-12512.md): Quotes Llama \< 3.1.6 - Unauthenticated SQL Injection via sc Parameter (CVSS 8.6, Quotes llama)
- [CVE-2026-12281](https://cve.now/CVE-2026-12281.md): Shibboleth \< 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing (CVSS 8.1, Shibboleth)
- [CVE-2026-11580](https://cve.now/CVE-2026-11580.md): Kali Forms \< 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR (CVSS 5.5, Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-11579](https://cve.now/CVE-2026-11579.md): Kali Forms \< 2.4.17 - Unauthenticated Media Upload (CVSS 5.3, Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-42936](https://cve.now/CVE-2026-42936.md): The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. (CVSS 7.8, SBI SECURITIES Co. HYPER SBI)
- [CVE-2026-13385](https://cve.now/CVE-2026-13385.md): An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the (CVSS 9.5, ASUS Router)
- [CVE-2026-15029](https://cve.now/CVE-2026-15029.md): Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local a (CVSS 8.4, ASUS System Control Interface · ASUS Business Manager)
- [CVE-2026-15030](https://cve.now/CVE-2026-15030.md): Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrato (CVSS 5.6, ASUS System Control Interface · ASUS Business Manager)
- [CVE-2026-13585](https://cve.now/CVE-2026-13585.md): Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Cont (CVSS 8.2, ASUS System Control Interface · ASUS Business Manager)
- [CVE-2026-8920](https://cve.now/CVE-2026-8920.md): Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allo (CVSS 8.5, ASUS Aura Wallpaper Service)
- [CVE-2026-8919](https://cve.now/CVE-2026-8919.md): Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by co (CVSS 7.2, ASUS GameSDK)
- [CVE-2026-11851](https://cve.now/CVE-2026-11851.md): Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router (CVSS 5.9, ASUS Router)
- [CVE-2026-13230](https://cve.now/CVE-2026-13230.md): Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71 (CVSS 5.3, TP-Link Systems Kasa EC71 · TP-Link Systems Kasa EC70)
- [CVE-2026-9770](https://cve.now/CVE-2026-9770.md): Hardcoded Cryptographic Key Information Disclosure Vulnerability on TP-Link Kasa EC70 and EC71 (CVSS 8.6, TP-Link Systems Kasa EC71 · TP-Link Systems Kasa EC70)
- [CVE-2025-65720](https://cve.now/CVE-2025-65720.md): An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a (CVSS 9.8, gpt-researcher)
- [CVE-2026-26718](https://cve.now/CVE-2026-26718.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform una (CVSS 9.1)
- [CVE-2026-26719](https://cve.now/CVE-2026-26719.md): Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET reques (CVSS 6.1)
- [CVE-2026-30618](https://cve.now/CVE-2026-30618.md): xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. (CVSS 9.8)
- [CVE-2026-30623](https://cve.now/CVE-2026-30623.md): LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. (CVSS 9.8)
- [CVE-2026-36590](https://cve.now/CVE-2026-36590.md): An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni\_qos\_db\_set function in broker\_tcp.c compon (CVSS 7.5)
- [CVE-2026-38752](https://cve.now/CVE-2026-38752.md): A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause a Denial of Service (DoS) via (CVSS 2.9, BusyBox)
- [CVE-2026-38753](https://cve.now/CVE-2026-38753.md): A use-after-free in the awk\_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supply (CVSS 4.9, BusyBox)
- [CVE-2026-38754](https://cve.now/CVE-2026-38754.md): A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via supply (CVSS 5.1, BusyBox)
- [CVE-2026-38755](https://cve.now/CVE-2026-38755.md): A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Denial of Service (DoS) via suppl (CVSS 2.9, BusyBox)
- [CVE-2026-38974](https://cve.now/CVE-2026-38974.md): Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko\_vendor.py. (CVSS 5.3)
- [CVE-2026-51380](https://cve.now/CVE-2026-51380.md): Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or pote (CVSS 9.8)
- [CVE-2026-61371](https://cve.now/CVE-2026-61371.md): Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the sym (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.