# CVEs published 2026-07-16

247 CVEs were published on July 16, 2026: 35 critical, 89 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-40106](https://cve.now/CVE-2026-40106.md): Wazuh: Heap-based Buffer Overflow in syscheck Registry Wildcard Expansion (LPE / DoS) (CVSS 4.7, wazuh)
- [CVE-2026-39359](https://cve.now/CVE-2026-39359.md): Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name (CVSS 7.5, wazuh)
- [CVE-2026-34150](https://cve.now/CVE-2026-34150.md): Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing (CVSS 7.5, wazuh)
- [CVE-2026-33754](https://cve.now/CVE-2026-33754.md): Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS) (CVSS 6.5, wazuh)
- [CVE-2026-33434](https://cve.now/CVE-2026-33434.md): Wazuh: Rate Limit Bypass via /events Endpoint (CVSS 4.3, wazuh)
- [CVE-2026-54340](https://cve.now/CVE-2026-54340.md): h2o has HTTP/2 state amplification (CVSS 7.5, h2o)
- [CVE-2026-44453](https://cve.now/CVE-2026-44453.md): h2o is vulnerable to musl libc stack overflow (CVSS 7.5, h2o)
- [CVE-2026-44452](https://cve.now/CVE-2026-44452.md): h2o is vulnerable to heap overrun (CVSS 5.9, h2o)
- [CVE-2026-44436](https://cve.now/CVE-2026-44436.md): Quicly is vulnerable to connection state corruption (CVSS 7.5, h2o quicly)
- [CVE-2026-44435](https://cve.now/CVE-2026-44435.md): Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB (CVSS 7.5, h2o quicly)
- [CVE-2026-44434](https://cve.now/CVE-2026-44434.md): Quicly is vulnerable to stateless reset injection (CVSS 5.3, h2o quicly)
- [CVE-2026-44433](https://cve.now/CVE-2026-44433.md): Quicly is vulnerable to memory exhaustion (CVSS 5.3, h2o quicly)
- [CVE-2026-15997](https://cve.now/CVE-2026-15997.md): Native ARM SHA3 / SHAKE \`restoreFullState\` fails to detect size\_t underflow in a crafted encoded state (CVSS 1.7, Legion of the Bouncy Castle BC-LTS)
- [CVE-2026-43977](https://cve.now/CVE-2026-43977.md): wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API (CVSS 7.5, wger-project wger · wger)
- [CVE-2026-43978](https://cve.now/CVE-2026-43978.md): wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers (CVSS 8.1, wger-project wger · wger)
- [CVE-2026-44182](https://cve.now/CVE-2026-44182.md): Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering (CVSS 10.0, jupyter-server enterprise\_gateway · jupyter-enterprise-gate…)
- [CVE-2026-44181](https://cve.now/CVE-2026-44181.md): Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution (CVSS 10.0, jupyter-server enterprise\_gateway · jupyter-enterprise-gate…)
- [CVE-2026-62826](https://cve.now/CVE-2026-62826.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-44180](https://cve.now/CVE-2026-44180.md): Jupyter Enterprise Gateway: ContainerProcessProxy.\_enforce\_prohibited\_ids can be Bypassed (CVSS 9.8, jupyter-server enterprise\_gateway · jupyter-enterprise-gate…)
- [CVE-2026-58598](https://cve.now/CVE-2026-58598.md): Windows Backup Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-58643](https://cve.now/CVE-2026-58643.md): Windows Admin Center Spoofing Vulnerability (CVSS 6.1, Microsoft Windows Admin Center)
- [CVE-2026-59117](https://cve.now/CVE-2026-59117.md): Windows Terminal Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Terminal App)
- [CVE-2026-45368](https://cve.now/CVE-2026-45368.md): Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend (CVSS 8.4, getkirby kirby · getkirby/cms)
- [CVE-2026-45334](https://cve.now/CVE-2026-45334.md): Kirby: Content locks disclose IDs and emails of inaccessible users from \`users.access/list\` permissions (CVSS 5.3, getkirby kirby · getkirby/cms)
- [CVE-2026-57077](https://cve.now/CVE-2026-57077.md): YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline\_len (CVSS 7.7, TODDR YAML::Syck)
- [CVE-2026-57076](https://cve.now/CVE-2026-57076.md): YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck\_hdlr\_add\_anchor (CVSS 7.8, TODDR YAML::Syck)
- [CVE-2026-57075](https://cve.now/CVE-2026-57075.md): YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck\_base64dec (CVSS 9.1, TODDR YAML::Syck)
- [CVE-2026-44175](https://cve.now/CVE-2026-44175.md): Kirby: Cross-site scripting (XSS) from list field content in the site frontend (CVSS 8.5, getkirby kirby · getkirby/cms)
- [CVE-2026-13713](https://cve.now/CVE-2026-13713.md): YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack (CVSS 6.2, TODDR YAML::Syck)
- [CVE-2026-14782](https://cve.now/CVE-2026-14782.md): Booking for Appointments and Events Calendar – Amelia \<= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import (CVSS 4.9, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-44176](https://cve.now/CVE-2026-44176.md): Kirby: \`pages.access\` permission is not checked during rendering of page drafts (CVSS 6.0, getkirby kirby · getkirby/cms)
- [CVE-2026-44177](https://cve.now/CVE-2026-44177.md): Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup (CVSS 8.8, getkirby kirby · getkirby/cms)
- [CVE-2026-53412](https://cve.now/CVE-2026-53412.md): Zoom Workplace VDI Plugin for Windows - Improper Input Validation (CVSS 9.8, Zoom Communications Zoom Workplace for Windows)
- [CVE-2026-44174](https://cve.now/CVE-2026-44174.md): Kirby: Arbitrary Method Call via REST API search and collection query endpoints (CVSS 8.7, getkirby kirby · getkirby/cms)
- [CVE-2026-53411](https://cve.now/CVE-2026-53411.md): Zoom Workplace VDI Plugin for Windows - Improper Input Validation (CVSS 7.8, Zoom Communications Zoom Workplace VDI Plugin)
- [CVE-2026-53410](https://cve.now/CVE-2026-53410.md): Zoom Clients for Windows - Race Condition (CVSS 7.0, Zoom Communications Zoom Clients)
- [CVE-2026-53409](https://cve.now/CVE-2026-53409.md): Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of pri (CVSS 7.8, Zoom Communications Zoom Rooms)
- [CVE-2026-44023](https://cve.now/CVE-2026-44023.md): Docling Core has unsafe remote filename resolution (CVSS 8.6, docling-project docling-core · docling-core)
- [CVE-2026-44019](https://cve.now/CVE-2026-44019.md): Docling Core has insufficient validation of image reference URIs (CVSS 8.1, docling-project docling-core · docling-core)
- [CVE-2026-33731](https://cve.now/CVE-2026-33731.md): AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data (CVSS 6.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-55173](https://cve.now/CVE-2026-55173.md): AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink (CVSS 8.1, WWBN AVideo · wwbn/avideo)
- [CVE-2026-11889](https://cve.now/CVE-2026-11889.md): SALTO ProAccess Space Authorization Bypass Through User-Controlled Key (CVSS 6.5, SALTO ProAccess Space)
- [CVE-2026-61378](https://cve.now/CVE-2026-61378.md): AutomationDirect Productivity Suite Divide By Zero (CVSS 5.5, AutomationDirect Productivity Suite)
- [CVE-2026-33692](https://cve.now/CVE-2026-33692.md): AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration (CVSS 7.5, WWBN AVideo · wwbn/avideo)
- [CVE-2026-60073](https://cve.now/CVE-2026-60073.md): AutomationDirect Productivity Suite Out-of-bounds Read (CVSS 5.9, AutomationDirect Productivity Suite)
- [CVE-2026-57896](https://cve.now/CVE-2026-57896.md): AutomationDirect Productivity Suite Out-of-bounds Read (CVSS 6.1, AutomationDirect Productivity Suite)
- [CVE-2026-60140](https://cve.now/CVE-2026-60140.md): AutomationDirect Productivity Suite Out-of-bounds Read (CVSS 6.1, AutomationDirect Productivity Suite)
- [CVE-2026-61389](https://cve.now/CVE-2026-61389.md): AutomationDirect Productivity Suite Out-of-bounds Write (CVSS 7.0, AutomationDirect Productivity Suite)
- [CVE-2026-60063](https://cve.now/CVE-2026-60063.md): AutomationDirect Productivity Suite Out-of-bounds Write (CVSS 7.0, AutomationDirect Productivity Suite)
- [CVE-2026-44982](https://cve.now/CVE-2026-44982.md): CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests (CVSS 7.2, crowdsecurity crowdsec · github.com/crowdsecurity/crowdsec)
- [CVE-2026-15352](https://cve.now/CVE-2026-15352.md): NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference (CVSS 7.5, NASA Core Flight System (cFS) Health & Safety (HS) Applicat…)
- [CVE-2026-44981](https://cve.now/CVE-2026-44981.md): CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression (CVSS 8.2, crowdsecurity crowdsec · github.com/crowdsecurity/crowdsec)
- [CVE-2026-62299](https://cve.now/CVE-2026-62299.md): CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record (CVSS 5.3, coredns)
- [CVE-2026-62309](https://cve.now/CVE-2026-62309.md): CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS (CVSS 7.5, coredns)
- [CVE-2026-62994](https://cve.now/CVE-2026-62994.md): CoreDNS \`k8s\_external\` headless AXFR can emit an empty transfer batch that panics the \`transfer\` plugin (CVSS 3.7, coredns · github.com/coredns/coredns)
- [CVE-2026-62290](https://cve.now/CVE-2026-62290.md): cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials (CVSS 7.3, cert-manager · github.com/cert-manager/cert-manager)
- [CVE-2026-62963](https://cve.now/CVE-2026-62963.md): Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport (CVSS 8.7, centrifugal centrifugo)
- [CVE-2026-49998](https://cve.now/CVE-2026-49998.md): Centrifugo: Dynamic JWKS key cache keyed only by \`kid\` allows cross-issuer JWT authentication bypass (CVSS 8.2, centrifugal centrifugo · github.com/centrifugal/centrifu… +4)
- [CVE-2026-15422](https://cve.now/CVE-2026-15422.md): SCTP needs to better-check INIT ACK chunk parameters (CVSS 9.1, illumos-gate · OmniOS +1)
- [CVE-2026-63089](https://cve.now/CVE-2026-63089.md): WireGuard Easy Weak Token Generation Information Disclosure via OTL Route (CVSS 9.0, wg-easy)
- [CVE-2026-15449](https://cve.now/CVE-2026-15449.md): TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption (CVSS 5.8, illumos-gate · OmniOS +1)
- [CVE-2026-54728](https://cve.now/CVE-2026-54728.md): bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb (CVSS 6.1, bunkerity bunkerweb)
- [CVE-2026-61718](https://cve.now/CVE-2026-61718.md): bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes (CVSS 5.4, bunkerity bunkerweb)
- [CVE-2026-63397](https://cve.now/CVE-2026-63397.md): remorses/genql code injection (CVSS 7.1, remorses genql · @genql/cli)
- [CVE-2026-55629](https://cve.now/CVE-2026-55629.md): Whistle: Path traversal (CVSS 8.7, avwo whistle · whistle)
- [CVE-2026-54526](https://cve.now/CVE-2026-54526.md): Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing (CVSS 8.9, argoproj argo-workflows · github.com/argoproj/argo-workf… +3)
- [CVE-2026-53535](https://cve.now/CVE-2026-53535.md): Activepieces: Arbitrary file write in git-sync via path traversal and symlinks (CVSS 5.9, activepieces)
- [CVE-2026-53536](https://cve.now/CVE-2026-53536.md): Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL (CVSS 5.3, activepieces)
- [CVE-2026-46338](https://cve.now/CVE-2026-46338.md): PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict\_base\_path (CVSS 4.3, facelessuser pymdown-extensions · pymdown-extensions)
- [CVE-2026-46515](https://cve.now/CVE-2026-46515.md): Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution (CVSS 9.3, mwtcmi frogman)
- [CVE-2026-46512](https://cve.now/CVE-2026-46512.md): Frogman: Dialplan template parameters interpolated into extensions\_custom.conf without escaping (CVSS 9.9, mwtcmi frogman)
- [CVE-2026-46513](https://cve.now/CVE-2026-46513.md): Frogman: API tokens stored in plaintext (CVSS 7.4, mwtcmi frogman)
- [CVE-2026-46514](https://cve.now/CVE-2026-46514.md): Frogman: Plaintext passwords and secrets persisted to audit log (CVSS 6.5, mwtcmi frogman)
- [CVE-2026-46353](https://cve.now/CVE-2026-46353.md): BigBlueButton API checksum bypass via presentationUploadExternalUrl (CVSS 8.1, bigbluebutton)
- [CVE-2026-46404](https://cve.now/CVE-2026-46404.md): BigBlueButton: Presentation URL Security Hardening (CVSS 6.8, bigbluebutton)
- [CVE-2026-46351](https://cve.now/CVE-2026-46351.md): BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them (CVSS 8.1, bigbluebutton)
- [CVE-2026-46377](https://cve.now/CVE-2026-46377.md): Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string (CVSS 6.2, TomWright dasel · github.com/tomwright/dasel/v3 +2)
- [CVE-2026-46378](https://cve.now/CVE-2026-46378.md): Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal (CVSS 6.2, TomWright dasel · github.com/tomwright/dasel +2)
- [CVE-2026-44969](https://cve.now/CVE-2026-44969.md): dbt-mcp: Tool Arguments Including SQL Queries and Credentials Logged in Plaintext Without Redaction When File Logging Is Enabled (CVSS 2.5, dbt-labs dbt-mcp · dbt-mcp)
- [CVE-2026-44970](https://cve.now/CVE-2026-44970.md): dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction (CVSS 3.1, dbt-labs dbt-mcp · dbt-mcp)
- [CVE-2026-44968](https://cve.now/CVE-2026-44968.md): dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node\_selection and resource\_type Parameters (CVSS 6.3, dbt-labs dbt-mcp · dbt-mcp)
- [CVE-2026-15945](https://cve.now/CVE-2026-15945.md): Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 (CVSS 4.3, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-46336](https://cve.now/CVE-2026-46336.md): Manyfold: Authenticated Path Traversal via File Rename (CVSS 7.1, manyfold3d manyfold)
- [CVE-2026-15737](https://cve.now/CVE-2026-15737.md): Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK (CVSS 5.7, AWS bedrock-agentcore)
- [CVE-2026-45336](https://cve.now/CVE-2026-45336.md): HireFlow: Use of Hard-coded Credentials (CVSS 10.0, StratonWebDesigners HireFlow)
- [CVE-2026-46687](https://cve.now/CVE-2026-46687.md): Emlog Local File Inclusion (LFI) (CVSS 7.7, emlog)
- [CVE-2026-46686](https://cve.now/CVE-2026-46686.md): Emlog Reflected Cross-Site Scripting (CVSS 8.5, emlog)
- [CVE-2026-46341](https://cve.now/CVE-2026-46341.md): Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching (CVSS 6.1, apify-mcp-server · @apify/actors-mcp-server)
- [CVE-2026-45367](https://cve.now/CVE-2026-45367.md): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +7)
- [CVE-2026-10590](https://cve.now/CVE-2026-10590.md): A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System (CVSS 6.7, Lenovo Yoga Pro 7 15IPH11 BIOS · Lenovo IdeaPad Pro 5 1… +55)
- [CVE-2026-10589](https://cve.now/CVE-2026-10589.md): A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. (CVSS 6.8, Lenovo Yoga Pro 7 15IPH11 BIOS · Lenovo IdeaPad Pro 5 1… +55)
- [CVE-2026-10588](https://cve.now/CVE-2026-10588.md): A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory. (CVSS 6.7, Lenovo Yoga Pro 7 15IPH11 BIOS · Lenovo IdeaPad Pro 5 1… +55)
- [CVE-2026-10587](https://cve.now/CVE-2026-10587.md): A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Manageme (CVSS 6.8, Lenovo Yoga Pro 7 15IPH11 BIOS · Lenovo IdeaPad Pro 5 1… +55)
- [CVE-2026-14371](https://cve.now/CVE-2026-14371.md): The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershel (CVSS 8.8, Lenovo XClarity Integrator for Microsoft Windows Admin Cent…)
- [CVE-2026-13104](https://cve.now/CVE-2026-13104.md): A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenti (CVSS 7.0, Lenovo App Store)
- [CVE-2026-13103](https://cve.now/CVE-2026-13103.md): A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a (CVSS 7.0, Lenovo App Store)
- [CVE-2026-9046](https://cve.now/CVE-2026-9046.md): A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclus (CVSS 7.3, Lenovo Legion Zone · Lenovo App Store)
- [CVE-2026-6511](https://cve.now/CVE-2026-6511.md): During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows (CVSS 6.8, Lenovo Smart Connect)
- [CVE-2026-45576](https://cve.now/CVE-2026-45576.md): zrok copy writes attacker-controlled WebDAV paths outside the destination root (CVSS 8.3, openziti zrok · github.com/openziti/zrok +1)
- [CVE-2026-45568](https://cve.now/CVE-2026-45568.md): zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths (CVSS 9.9, openziti zrok · zrok)
- [CVE-2026-45325](https://cve.now/CVE-2026-45325.md): Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath (CVSS 8.2, tmlmobilidade go · @tmlmobilidade/utils)
- [CVE-2026-63088](https://cve.now/CVE-2026-63088.md): stoatchat \< 0.14.0 SSRF via DNS-based IP Blocklist Bypass (CVSS 7.7, stoatchat)
- [CVE-2026-45795](https://cve.now/CVE-2026-45795.md): Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server (CVSS 5.3, JanssenProject jans)
- [CVE-2026-45612](https://cve.now/CVE-2026-45612.md): rz-libdemangle: Out of bound read in rust demangler (CVSS 5.5, rizinorg rz-libdemangle)
- [CVE-2026-3031](https://cve.now/CVE-2026-3031.md): Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library (CVSS 9.8, TOKUHIROM Image::EPEG)
- [CVE-2026-57074](https://cve.now/CVE-2026-57074.md): XML::Bare versions through 0.53 for Perl have an unbounded character lookahead (CVSS 9.1, CODECHILD XML::Bare)
- [CVE-2026-57073](https://cve.now/CVE-2026-57073.md): HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead (CVSS 9.1, CODECHILD HTML::Bare)
- [CVE-2026-13401](https://cve.now/CVE-2026-13401.md): XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes (CVSS 7.5, CODECHILD XML::Bare)
- [CVE-2026-13397](https://cve.now/CVE-2026-13397.md): HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes (CVSS 7.5, CODECHILD HTML::Bare)
- [CVE-2026-47729](https://cve.now/CVE-2026-47729.md): Squid: Memory disclosure in FTP gateway (CVSS 6.5, squid-cache squid)
- [CVE-2026-50012](https://cve.now/CVE-2026-50012.md): Squid: Memory corruption in cache\_digest reply handling (CVSS 5.5, squid-cache squid)
- [CVE-2026-55548](https://cve.now/CVE-2026-55548.md): Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-46621](https://cve.now/CVE-2026-46621.md): Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection (CVSS 9.1, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-46562](https://cve.now/CVE-2026-46562.md): Yamcs: Remote Code Execution via Mission Database algorithm override (CVSS 9.8, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-44632](https://cve.now/CVE-2026-44632.md): Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in \`JavaExprAlgorithmExecutionFactory\` (CVSS 9.1, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-44596](https://cve.now/CVE-2026-44596.md): Yamcs: No Rate Limiting on Authentication Endpoint (CVSS 6.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-63087](https://cve.now/CVE-2026-63087.md): Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint (CVSS 9.3, grafana-cold-storage oncall)
- [CVE-2026-44595](https://cve.now/CVE-2026-44595.md): Yamcs: Unauthorized user enumeration via IAM API endpoints (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-63086](https://cve.now/CVE-2026-63086.md): text-generation-inference 3.3.7 SSRF via fetch\_image in multimodal chat completions (CVSS 6.9, huggingface text-generation-inference)
- [CVE-2026-47751](https://cve.now/CVE-2026-47751.md): Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration (CVSS 5.3, anthropics claude-code-action)
- [CVE-2026-55407](https://cve.now/CVE-2026-55407.md): Buffa: Memory Exhaustion Denial of Service in decode\_unknown\_field via Unbounded Allocation (CVSS 6.3, anthropics buffa · buffa)
- [CVE-2026-63085](https://cve.now/CVE-2026-63085.md): Axelor Open Platform 8.x \< 8.2.2 Authorization Bypass via Nested Relational Record Persistence (CVSS 8.7, axelor-open-platform)
- [CVE-2026-55406](https://cve.now/CVE-2026-55406.md): Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref (CVSS 5.9, anthropics buffa · buffa)
- [CVE-2026-45695](https://cve.now/CVE-2026-45695.md): Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used (CVSS 9.8, kopia · github.com/kopia/kopia)
- [CVE-2026-55440](https://cve.now/CVE-2026-55440.md): Microsoft UFO: COMMAND\_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service (CVSS 6.5, microsoft UFO)
- [CVE-2026-63082](https://cve.now/CVE-2026-63082.md): Perfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment (CVSS 5.3, Ultimate Fosters Perfect Support Ticketing & Document Manag…)
- [CVE-2026-63081](https://cve.now/CVE-2026-63081.md): Perfect Support Ticketing System 1.7 Stored XSS via Ticket Notes Field (CVSS 5.1, Ultimate Fosters Perfect Support Ticketing & Document Manag…)
- [CVE-2026-12379](https://cve.now/CVE-2026-12379.md): URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of Axivion (CVSS 6.8, Qt Axivion)
- [CVE-2026-54568](https://cve.now/CVE-2026-54568.md): Microsoft UFO: Missing Authorization in DEVICE\_INFO\_REQUEST Allows a DEVICE Client to Read Another Device's system\_info (CVSS 4.3, microsoft UFO)
- [CVE-2026-57206](https://cve.now/CVE-2026-57206.md): SimpleChat plugin validation endpoints missing authentication and authorization (CVSS 8.6, microsoft simplechat)
- [CVE-2026-57205](https://cve.now/CVE-2026-57205.md): SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints (CVSS 4.3, microsoft simplechat)
- [CVE-2026-53598](https://cve.now/CVE-2026-53598.md): Prompty: Arbitrary File Read via ${file:path} Reference Expansion (CVSS 7.5, microsoft prompty · prompty +2)
- [CVE-2026-53597](https://cve.now/CVE-2026-53597.md): Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader (CVSS 8.7, microsoft prompty · @prompty/core)
- [CVE-2026-54733](https://cve.now/CVE-2026-54733.md): moodle-local\_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint (CVSS 9.3, microsoft o365-moodle)
- [CVE-2026-59867](https://cve.now/CVE-2026-59867.md): Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (CVSS 7.1, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59866](https://cve.now/CVE-2026-59866.md): Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59864](https://cve.now/CVE-2026-59864.md): Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-\* extensions (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-14890](https://cve.now/CVE-2026-14890.md): CVE-2026-14890 (CVSS 9.1, SGLang)
- [CVE-2026-59865](https://cve.now/CVE-2026-59865.md): Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by \`kiota info\` (CVSS 9.3, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59863](https://cve.now/CVE-2026-59863.md): Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF (CVSS 7.0, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59859](https://cve.now/CVE-2026-59859.md): Kiota: Code Generation Literal Injection in the PHP Generator (CVSS 8.7, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-59862](https://cve.now/CVE-2026-59862.md): Kiota: Code Generation Literal Injection in the Python Generator (CVSS 7.5, microsoft kiota · Microsoft.OpenAPI.Kiota +1)
- [CVE-2026-59861](https://cve.now/CVE-2026-59861.md): Kiota: Code Generation Literal Injection in Kiota Ruby Generator (CVSS 7.5, microsoft kiota · Microsoft.OpenAPI.Kiota +1)
- [CVE-2026-59237](https://cve.now/CVE-2026-59237.md): IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders (CVSS 6.9, Roskus Prospero Flow CRM)
- [CVE-2026-59860](https://cve.now/CVE-2026-59860.md): Kiota: XML Doc-Comment Newline Breakout Code Injection (CVSS 8.7, microsoft kiota · Microsoft.OpenApi.Kiota +1)
- [CVE-2026-14254](https://cve.now/CVE-2026-14254.md): Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data (CVSS 8.3, Perforce Delphix Continuous Data)
- [CVE-2026-5674](https://cve.now/CVE-2026-5674.md): Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading (CVSS 8.8, pipewire · Red Hat Enterprise Linux)
- [CVE-2026-56456](https://cve.now/CVE-2026-56456.md): HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. (CVSS 5.3, HCL Software DFXAnalytics)
- [CVE-2026-56455](https://cve.now/CVE-2026-56455.md): HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). (CVSS 5.3, HCL Software DFXAnalytics)
- [CVE-2026-56454](https://cve.now/CVE-2026-56454.md): HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. (CVSS 5.9, HCL Software DFXAnalytics)
- [CVE-2026-56453](https://cve.now/CVE-2026-56453.md): HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. (CVSS 5.5, HCL Software DFXAnalytics)
- [CVE-2026-35145](https://cve.now/CVE-2026-35145.md): HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. (CVSS 3.1, HCL Software DFXAnalytics)
- [CVE-2026-35143](https://cve.now/CVE-2026-35143.md): HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. (CVSS 3.0, HCL Software DFXAnalytics)
- [CVE-2026-35142](https://cve.now/CVE-2026-35142.md): HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. (CVSS 2.6, HCL Software DFXAnalytics)
- [CVE-2026-35141](https://cve.now/CVE-2026-35141.md): HCL DFXAnalytics is affected by a Login Replay Attack vulnerability (CVSS 2.6, HCL Software DFXAnalytics)
- [CVE-2026-35140](https://cve.now/CVE-2026-35140.md): HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability (CVSS 3.0, HCL Software DFXAnalytics)
- [CVE-2024-58360](https://cve.now/CVE-2024-58360.md): stoatchat before 0.7.8 Unrestricted Account Creation (CVSS 6.9, stoatchat)
- [CVE-2026-63306](https://cve.now/CVE-2026-63306.md): stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints (CVSS 9.2, stoatchat)
- [CVE-2026-63305](https://cve.now/CVE-2026-63305.md): AVideo through 29.0 OS Command Injection via ffmpeg.json.php (CVSS 9.2, WWBN AVideo)
- [CVE-2026-63304](https://cve.now/CVE-2026-63304.md): AVideo through 29.0 OS Command Injection via listFFmpegProcesses (CVSS 9.2, WWBN AVideo)
- [CVE-2025-71388](https://cve.now/CVE-2025-71388.md): stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions (CVSS 7.6, stoatchat)
- [CVE-2025-71377](https://cve.now/CVE-2025-71377.md): stoatchat before 20250210-1 Unrestricted Message History Fetch (CVSS 8.7, stoatchat)
- [CVE-2026-12391](https://cve.now/CVE-2026-12391.md): ubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs (CVSS 5.0, Canonical ubuntu-pro-client · Canonical Ubuntu 26.04 LTS +5)
- [CVE-2026-11386](https://cve.now/CVE-2026-11386.md): ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution (CVSS 9.0, Canonical ubuntu-pro-client · Canonical Ubuntu 26.04 LTS +6)
- [CVE-2026-9494](https://cve.now/CVE-2026-9494.md): ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line (CVSS 5.5, Canonical ubuntu-pro-client · Canonical Ubuntu 26.04 LTS +6)
- [CVE-2026-59249](https://cve.now/CVE-2026-59249.md): Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections (CVSS 6.3, elixir-mint mint)
- [CVE-2026-35147](https://cve.now/CVE-2026-35147.md): HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. (CVSS 8.2, HCL Software DFXServer)
- [CVE-2026-35149](https://cve.now/CVE-2026-35149.md): HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. (CVSS 8.2, HCL Software DFXServer)
- [CVE-2026-35148](https://cve.now/CVE-2026-35148.md): HCL DFXServer is affected by a Missing Access Control vulnerability (CVSS 6.3, HCL Software DFXServer)
- [CVE-2026-35146](https://cve.now/CVE-2026-35146.md): HCL DFXServer is affected by an Unencrypted Communication vulnerability. (CVSS 6.3, HCLSoftware DFXServer)
- [CVE-2023-49899](https://cve.now/CVE-2023-49899.md): Origin Validation Error in X-Rite MA-T6 (CVSS 9.8, X-Rite MA-T6)
- [CVE-2023-49900](https://cve.now/CVE-2023-49900.md): Origin Validation Error in X-Rite MA-T6 (CVSS 9.8, X-Rite MA-T6)
- [CVE-2026-22752](https://cve.now/CVE-2026-22752.md): Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata (CVSS 9.6, Spring Security Spring Authorization Server)
- [CVE-2026-6424](https://cve.now/CVE-2026-6424.md): Use-after-free vulnerability in ESET security products for Linux (CVSS 6.7, ESET, spol. s.r.o. ESET Endpoint Antivirus for Linux · ESET…)
- [CVE-2026-15324](https://cve.now/CVE-2026-15324.md): SysBasics Customize My Account for WooCommerce \<= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row\_type' Parameter (CVSS 4.4, phppoet SysBasics Customize My Account for WooCommerce – Li…)
- [CVE-2026-15103](https://cve.now/CVE-2026-15103.md): WPFunnels \<= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group\_id' Path Parameter (CVSS 8.8, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2026-15727](https://cve.now/CVE-2026-15727.md): WP Bulk Delete \<= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete\_user\_roles' Parameter (CVSS 4.9, xylus WP Bulk Delete)
- [CVE-2026-15021](https://cve.now/CVE-2026-15021.md): wpForo Forum \<= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field (CVSS 6.4, tomdever wpForo Forum)
- [CVE-2026-15005](https://cve.now/CVE-2026-15005.md): Loco Translate \<= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter (CVSS 8.8, timwhitlock Loco Translate)
- [CVE-2026-13741](https://cve.now/CVE-2026-13741.md): Digits: WordPress Mobile Number Signup and Login \<= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits\_reg\_userrole' Parameter (CVSS 8.8, UnitedOver Digits: WordPress Mobile Number Signup and Login)
- [CVE-2026-58078](https://cve.now/CVE-2026-58078.md): Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro \< 6.2.1 (CVSS 8.7, themexpert.com Quix Page Builder Pro extension for Joomla)
- [CVE-2026-6423](https://cve.now/CVE-2026-6423.md): Local privilege escalation via unauthenticated ALPC in ESET Inspect Connector (CVSS 8.5, ESET, spol. s.r.o. ESET Inspect Connector)
- [CVE-2026-13755](https://cve.now/CVE-2026-13755.md): Tickera \<= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price\_wrapper' Shortcode Attribute (CVSS 6.4, Tickera – Sell Tickets & Manage Events)
- [CVE-2026-15610](https://cve.now/CVE-2026-15610.md): WPBot \<= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax\_rag\_manual\_sync() Function (CVSS 4.3, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2026-15106](https://cve.now/CVE-2026-15106.md): WPBot \<= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter (CVSS 5.3, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2026-15407](https://cve.now/CVE-2026-15407.md): Themify Builder \<= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb\_generate\_on\_fly AJAX Action (CVSS 4.3, themifyme Themify Builder)
- [CVE-2026-15651](https://cve.now/CVE-2026-15651.md): WP TripAdvisor Review Slider \<= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter (CVSS 4.9, jgwhite33 WP TripAdvisor Review Slider)
- [CVE-2026-15008](https://cve.now/CVE-2026-15008.md): Uncanny Automator \<= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token (CVSS 8.1, uncannyowl Uncanny Automator – Easy Automation, Integration…)
- [CVE-2026-15022](https://cve.now/CVE-2026-15022.md): Tutor LMS \<= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-13754](https://cve.now/CVE-2026-13754.md): Tickera \<= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter (CVSS 6.5, Tickera – Sell Tickets & Manage Events)
- [CVE-2026-7543](https://cve.now/CVE-2026-7543.md): Breakdance \<= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details (CVSS 7.2, Breakdance)
- [CVE-2026-13767](https://cve.now/CVE-2026-13767.md): Quiz and Survey Master (QSM) \<= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter (CVSS 6.5, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2026-15350](https://cve.now/CVE-2026-15350.md): The Cache Purger \<= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the\_log\_purge' Parameter (CVSS 4.3, kevp75 The Cache Purger)
- [CVE-2026-15099](https://cve.now/CVE-2026-15099.md): WP Delicious \<= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute (CVSS 6.4, wpdelicious WP Delicious – Recipe Plugin for Food Bloggers)
- [CVE-2026-12979](https://cve.now/CVE-2026-12979.md): FunnelKit \< 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Importer (CVSS 5.5, FunnelKit)
- [CVE-2026-12978](https://cve.now/CVE-2026-12978.md): FunnelKit \< 3.15.0.6 - Reflected XSS via Divi Optin Form (CVSS 7.1, FunnelKit)
- [CVE-2026-12907](https://cve.now/CVE-2026-12907.md): RTMKit Addons for Elementor \< 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation (CVSS 2.7, RTMKit)
- [CVE-2026-12906](https://cve.now/CVE-2026-12906.md): RTMKit Addons for Elementor \< 2.0.9 - Contributor+ Private Post Title Disclosure (CVSS 2.7, RTMKit)
- [CVE-2026-12869](https://cve.now/CVE-2026-12869.md): Header Footer Builder for Elementor \< 1.2.1 - Contributor+ Stored XSS via Template Import (CVSS 6.1, Header Footer Builder for Elementor)
- [CVE-2026-12684](https://cve.now/CVE-2026-12684.md): Customer Reviews for WooCommerce \< 5.113.0 - Unauthenticated Arbitrary Media Upload via cr\_upload\_media (CVSS 6.5, Customer Reviews for WooCommerce)
- [CVE-2026-12585](https://cve.now/CVE-2026-12585.md): Abandoned Cart Lite for WooCommerce \< 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token (CVSS 8.1, Abandoned Cart Lite for WooCommerce)
- [CVE-2026-12525](https://cve.now/CVE-2026-12525.md): Redux Framework \< 4.5.13 - Subscriber+ Privilege Escalation to Administrator (CVSS 8.8, Redux Framework)
- [CVE-2026-12510](https://cve.now/CVE-2026-12510.md): AI Engine \< 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR (CVSS 5.9, AI Engine)
- [CVE-2026-12492](https://cve.now/CVE-2026-12492.md): Happy Coders OTP Login for WooCommerce \< 2.8 - Unauthenticated Account Takeover via hcotp\_auto\_login\_user (CVSS 9.8, Happy Coders OTP Login for WooCommerce)
- [CVE-2026-12395](https://cve.now/CVE-2026-12395.md): WP Job Portal \< 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter (CVSS 6.5, WP Job Portal)
- [CVE-2026-11866](https://cve.now/CVE-2026-11866.md): LatePoint \< 5.6.3 - Multiple Privileged Actions via CSRF (CVSS 5.4, Appointment Booking Plugin)
- [CVE-2026-11371](https://cve.now/CVE-2026-11371.md): BetterDocs \< 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection (CVSS 6.1, BetterDocs)
- [CVE-2026-15925](https://cve.now/CVE-2026-15925.md): Improper TLS Hostname Verification in Snowflake Connector for Python (CVSS 9.2, Snowflake Connector for Python · snowflake-connector-python)
- [CVE-2026-53366](https://cve.now/CVE-2026-53366.md): ipv4: account for fraggap on the paged allocation path (CVSS 7.8, Linux)
- [CVE-2026-15458](https://cve.now/CVE-2026-15458.md): SEO Booster \<= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort\_field' Parameter (CVSS 4.9, cleverplugins SEO Booster)
- [CVE-2026-15013](https://cve.now/CVE-2026-15013.md): SAML Single Sign On \<= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion (CVSS 9.8, cyberlord92 SAML Single Sign On – SSO Login)
- [CVE-2026-13042](https://cve.now/CVE-2026-13042.md): RPB Chessboard \<= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, yo35 RPB Chessboard)
- [CVE-2026-15445](https://cve.now/CVE-2026-15445.md): SEO Booster \<= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, cleverplugins SEO Booster)
- [CVE-2026-15306](https://cve.now/CVE-2026-15306.md): Product Feed Manager For WooCommerce \<= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter (CVSS 6.1, rextheme Product Feed Manager For WooCommerce – Sell on 200…)
- [CVE-2026-21729](https://cve.now/CVE-2026-21729.md): Loki detected\_fields query limits results in unbounded memory allocation (CVSS 7.5, Grafana Loki)
- [CVE-2026-15652](https://cve.now/CVE-2026-15652.md): Easy Accordion \<= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute (CVSS 6.4, shapedplugin Easy Accordion – AI-Powered FAQ & Accordion Bl…)
- [CVE-2026-12941](https://cve.now/CVE-2026-12941.md): MultiVendorX \<= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order\_by' Parameter (CVSS 6.5, wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI…)
- [CVE-2026-14987](https://cve.now/CVE-2026-14987.md): GiveWP \<= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter\_message' Sequoia Template Setting (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2026-12409](https://cve.now/CVE-2026-12409.md): Landing Page Builder \<= 1.5.3.6 - Cross-Site Request Forgery to ulpb\_admin\_data AJAX Action (CVSS 4.3, umarbajwa Landing Page Builder – Coming Soon page, Maintena…)
- [CVE-2026-12753](https://cve.now/CVE-2026-12753.md): Advance Product Search- Voice & Ajax Search for WooCommerce \<= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter (CVSS 7.5, themehunk Advance Product Search- Voice & Ajax Search for W…)
- [CVE-2026-12434](https://cve.now/CVE-2026-12434.md): List category posts \<= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post\_status' Shortcode Attribute (CVSS 4.3, fernandobt List category posts)
- [CVE-2026-15336](https://cve.now/CVE-2026-15336.md): Catch Themes Demo Import \<= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate\_plugin' Parameter (CVSS 4.3, catchplugins Catch Themes Demo Import)
- [CVE-2026-13005](https://cve.now/CVE-2026-13005.md): MxChat \<= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro\_message' Setting (CVSS 4.4, MxChat – AI Chatbot & Content Generation for WordPress)
- [CVE-2026-48863](https://cve.now/CVE-2026-48863.md): Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service (CVSS 7.5, OpenSUSE libsolv · Red Hat Enterprise Linux +4)
- [CVE-2026-1609](https://cve.now/CVE-2026-1609.md): Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users (CVSS 8.1, Keycloak · Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-3842](https://cve.now/CVE-2026-3842.md): Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu\_physical\_memory\_map causes host oob write (CVSS 7.8, qemu · Red Hat Enterprise Linux +1)
- [CVE-2026-15909](https://cve.now/CVE-2026-15909.md): RafyMrX TOKO-ONLINE-ROTI add.php authorization (CVSS 5.3, RafyMrX TOKO-ONLINE-ROTI)
- [CVE-2026-23538](https://cve.now/CVE-2026-23538.md): Feast: resource exhaustion via websocket endpoint (CVSS 7.5, Feast Feature Server · Red Hat OpenShift AI)
- [CVE-2021-27137](https://cve.now/CVE-2021-27137.md): An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. (CVSS 8.1, KEV, DD-WRT)
- [CVE-2024-32385](https://cve.now/CVE-2024-32385.md): An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3\_20200803132042 allows a remote attacker to obtain sensitive information via a (CVSS 4.3)
- [CVE-2024-32386](https://cve.now/CVE-2024-32386.md): Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3\_20200803132042 allows a remote attacker to obtain sen (CVSS 7.3)
- [CVE-2024-32387](https://cve.now/CVE-2024-32387.md): An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3\_20200803132042 allows a remote attacker to obtain sensitive information via th (CVSS 5.7)
- [CVE-2024-32389](https://cve.now/CVE-2024-32389.md): Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3\_20200803132042 allows a remote attacker to obtain sensiti (CVSS 3.5)
- [CVE-2024-34268](https://cve.now/CVE-2024-34268.md): EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth (CVSS 7.1)
- [CVE-2025-45868](https://cve.now/CVE-2025-45868.md): LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated u (CVSS 8.8)
- [CVE-2025-45870](https://cve.now/CVE-2025-45870.md): LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authe (CVSS 6.5)
- [CVE-2026-36425](https://cve.now/CVE-2026-36425.md): An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. (CVSS 6.5)
- [CVE-2026-38158](https://cve.now/CVE-2026-38158.md): A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive databa (CVSS 9.8)
- [CVE-2026-47081](https://cve.now/CVE-2026-47081.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 3.1, cyrusimap Cyrus IMAP)
- [CVE-2026-47082](https://cve.now/CVE-2026-47082.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 5.4, cyrusimap Cyrus IMAP)
- [CVE-2026-47083](https://cve.now/CVE-2026-47083.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 4.3, cyrusimap Cyrus IMAP)
- [CVE-2026-47084](https://cve.now/CVE-2026-47084.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 6.5, cyrusimap Cyrus IMAP)
- [CVE-2026-47085](https://cve.now/CVE-2026-47085.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 4.0, cyrusimap Cyrus IMAP)
- [CVE-2026-47086](https://cve.now/CVE-2026-47086.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 3.5, cyrusimap Cyrus IMAP)
- [CVE-2026-47087](https://cve.now/CVE-2026-47087.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 3.5, cyrusimap Cyrus IMAP)
- [CVE-2026-47088](https://cve.now/CVE-2026-47088.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 3.1, cyrusimap Cyrus IMAP)
- [CVE-2026-47089](https://cve.now/CVE-2026-47089.md): An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVSS 4.3, cyrusimap Cyrus IMAP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.