# CVEs published 2026-08-03

309 CVEs were published on August 3, 2026: 56 critical, 117 high. Days are UTC.

- [CVE-2026-18685](https://cve.now/CVE-2026-18685.md): GL.iNet GL-MT3000 modem.so glc set\_upgrade command injection (CVSS 9.3, GL.iNet GL-MT3000)
- [CVE-2026-62870](https://cve.now/CVE-2026-62870.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-66326](https://cve.now/CVE-2026-66326.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-66325](https://cve.now/CVE-2026-66325.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2026-66322](https://cve.now/CVE-2026-66322.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2026-66317](https://cve.now/CVE-2026-66317.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-66311](https://cve.now/CVE-2026-66311.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 6.2, Microsoft Edge)
- [CVE-2026-65804](https://cve.now/CVE-2026-65804.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2026-65802](https://cve.now/CVE-2026-65802.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2026-66316](https://cve.now/CVE-2026-66316.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-66315](https://cve.now/CVE-2026-66315.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Edge)
- [CVE-2026-66314](https://cve.now/CVE-2026-66314.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-66313](https://cve.now/CVE-2026-66313.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 6.8, Microsoft Edge)
- [CVE-2026-66312](https://cve.now/CVE-2026-66312.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-66310](https://cve.now/CVE-2026-66310.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 7.7, Microsoft Edge for Android)
- [CVE-2026-66321](https://cve.now/CVE-2026-66321.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2026-66318](https://cve.now/CVE-2026-66318.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 8.1, Microsoft Edge)
- [CVE-2026-18684](https://cve.now/CVE-2026-18684.md): GL.iNet GL-MT3000 modem.so glc remove\_profile command injection (CVSS 9.3, GL.iNet GL-MT3000)
- [CVE-2026-48323](https://cve.now/CVE-2026-48323.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-48333](https://cve.now/CVE-2026-48333.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 9.8, Adobe Campaign Classic)
- [CVE-2026-48317](https://cve.now/CVE-2026-48317.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) (CVSS 9.6, Adobe Campaign Classic)
- [CVE-2026-48331](https://cve.now/CVE-2026-48331.md): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-48330](https://cve.now/CVE-2026-48330.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-48399](https://cve.now/CVE-2026-48399.md): Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657) (CVSS 7.5, Adobe Campaign Classic)
- [CVE-2026-48326](https://cve.now/CVE-2026-48326.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.9, Adobe Campaign Classic)
- [CVE-2026-18667](https://cve.now/CVE-2026-18667.md): Sensor Proxy Version 1.4.2 Fixes One Vulnerability (CVSS 9.6, Tenable Sensor Proxy)
- [CVE-2026-46714](https://cve.now/CVE-2026-46714.md): Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation (CVSS 5.1, misskey-dev misskey)
- [CVE-2026-47746](https://cve.now/CVE-2026-47746.md): Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks (CVSS 8.9, misskey-dev misskey)
- [CVE-2026-67617](https://cve.now/CVE-2026-67617.md): Microweber CMS 2.0.20 Stored XSS via tag\_names Parameter (CVSS 4.8, microweber)
- [CVE-2026-67616](https://cve.now/CVE-2026-67616.md): Camaleon CMS 2.9.2 Missing Authorization via /admin/post\_type drafts endpoint (CVSS 5.3, owen2345 camaleon-cms)
- [CVE-2026-46713](https://cve.now/CVE-2026-46713.md): Misskey: JSON-LD signature validation + compaction may lead to improper activity handling (CVSS 9.2, misskey-dev misskey)
- [CVE-2026-18682](https://cve.now/CVE-2026-18682.md): OpenAkita File Upload API upload cross site scripting (CVSS 2.3, OpenAkita)
- [CVE-2026-46712](https://cve.now/CVE-2026-46712.md): Misskey: Lack of proper permission checks in Direct Messaging feature (CVSS 2.3, misskey-dev misskey)
- [CVE-2026-69249](https://cve.now/CVE-2026-69249.md): python-cryptography: Duplicate self-signed intermediates can cause exponential path-building (CVSS 8.7, pyca cryptography · cryptography)
- [CVE-2026-48115](https://cve.now/CVE-2026-48115.md): Misskey: Improper Authorization in the Announcements API (CVSS 6.3, misskey-dev misskey)
- [CVE-2026-69248](https://cve.now/CVE-2026-69248.md): python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees (CVSS 6.9, pyca cryptography · cryptography)
- [CVE-2026-10849](https://cve.now/CVE-2026-10849.md): Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body (CVSS 8.2, zephyrproject zephyr)
- [CVE-2026-69247](https://cve.now/CVE-2026-69247.md): cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing (CVSS 8.2, pyca cryptography · cryptography)
- [CVE-2026-69246](https://cve.now/CVE-2026-69246.md): Guzzle: Noncanonical host can bypass host-based checks (CVSS 7.2, guzzle · guzzlehttp/guzzle)
- [CVE-2026-48113](https://cve.now/CVE-2026-48113.md): Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection (CVSS 8.5, jpillora chisel · github.com/jpillora/chisel)
- [CVE-2026-69245](https://cve.now/CVE-2026-69245.md): Guzzle: Noncanonical cookie domain keeps subdomain scope (CVSS 6.5, guzzle · guzzlehttp/guzzle)
- [CVE-2026-18648](https://cve.now/CVE-2026-18648.md): Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal (CVSS 4.8, Blix Email Blue Mail Calendar App)
- [CVE-2026-41447](https://cve.now/CVE-2026-41447.md): FirmaCheck \< 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path (CVSS 8.5, Zucchetti S.p.a. FirmaCheck)
- [CVE-2026-48063](https://cve.now/CVE-2026-48063.md): Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload (CVSS 9.3, WhiskeySockets Baileys · @whiskeysockets/baileys +1)
- [CVE-2026-18738](https://cve.now/CVE-2026-18738.md): Shlink CSV Formula Injection via Visit Export CLI (CVSS 5.1, shlinkio Shlink)
- [CVE-2026-69244](https://cve.now/CVE-2026-69244.md): AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) (CVSS 7.1, aio-libs aiohttp · aiohttp)
- [CVE-2026-48061](https://cve.now/CVE-2026-48061.md): Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header (CVSS 5.9, litestar-org litestar · litestar)
- [CVE-2026-69243](https://cve.now/CVE-2026-69243.md): AIOHTTP: HTTP request smuggling via WebSocket upgrade (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2026-18647](https://cve.now/CVE-2026-18647.md): jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery (CVSS 6.9, jina-ai reader)
- [CVE-2026-18737](https://cve.now/CVE-2026-18737.md): Shlink Blind SQL Injection via tags/stats orderBy Parameter (CVSS 7.1, shlinkio Shlink)
- [CVE-2026-49132](https://cve.now/CVE-2026-49132.md): OPNsense \< 26.1.9 Stored XSS via Certificate Description Field (CVSS 5.1, Deciso B.V. OPNsense)
- [CVE-2026-18733](https://cve.now/CVE-2026-18733.md): Prompt injection bypasses shell tool consent gate in Strands Agents Tools (CVSS 8.8, AWS strands-agents-tools)
- [CVE-2026-18646](https://cve.now/CVE-2026-18646.md): danpros HTMLy Author Name htmly.php path traversal (CVSS 6.9, danpros HTMLy)
- [CVE-2026-49131](https://cve.now/CVE-2026-49131.md): OPNsense \< 26.1.9 Stored XSS via Firewall Rule Description Field (CVSS 5.1, Deciso B.V. OPNsense)
- [CVE-2026-69240](https://cve.now/CVE-2026-69240.md): Sequelize: SQL Injection (Oracle DB) (CVSS 9.8, sequelize)
- [CVE-2026-66065](https://cve.now/CVE-2026-66065.md): Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211) (CVSS 8.4, Q00 ouroboros · ouroboros-ai)
- [CVE-2026-18736](https://cve.now/CVE-2026-18736.md): Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution (CVSS 5.3, shlinkio Shlink)
- [CVE-2026-18645](https://cve.now/CVE-2026-18645.md): danpros HTMLy Admin Content Endpoint admin.php add\_content path traversal (CVSS 5.3, danpros HTMLy)
- [CVE-2026-47211](https://cve.now/CVE-2026-47211.md): Ouroboros: Remote Code Execution via Untrusted Project-Directory .env (CVSS 8.4, Q00 ouroboros · ouroboros-ai)
- [CVE-2026-18644](https://cve.now/CVE-2026-18644.md): danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal (CVSS 5.3, danpros HTMLy)
- [CVE-2026-68981](https://cve.now/CVE-2026-68981.md): Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests (CVSS 8.8, Apache Software Foundation Apache NiFi)
- [CVE-2026-69198](https://cve.now/CVE-2026-69198.md): ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks (CVSS 6.9, beaugunderson ip-address · ip-address)
- [CVE-2026-68980](https://cve.now/CVE-2026-68980.md): Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion (CVSS 2.3, Apache Software Foundation Apache NiFi)
- [CVE-2026-62354](https://cve.now/CVE-2026-62354.md): Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests (CVSS 7.7, Apache Software Foundation Apache NiFi)
- [CVE-2026-69192](https://cve.now/CVE-2026-69192.md): ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass (CVSS 7.7, beaugunderson ip-address · ip-address)
- [CVE-2026-68979](https://cve.now/CVE-2026-68979.md): Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates (CVSS 5.9, Apache Software Foundation Apache NiFi)
- [CVE-2026-58139](https://cve.now/CVE-2026-58139.md): DuckDB AWS Extension Security Policy Bypass via load\_aws\_credentials Procedure (CVSS 6.0, duckdb-aws)
- [CVE-2026-18641](https://cve.now/CVE-2026-18641.md): Sangfor Operation and Maintenance Security Management System Login Endpoint portal\_login com.sbr.fort.foreignDP.DpLoginController os command injection (CVSS 6.9, Sangfor Operation and Maintenance Security Management System)
- [CVE-2026-18654](https://cve.now/CVE-2026-18654.md): Disabled SSH host key verification in Amazon AWS CLI EMR helper commands (CVSS 6.9, aws-cli · awscli)
- [CVE-2026-18632](https://cve.now/CVE-2026-18632.md): langgenius dify Jinja2 jinja2\_transformer.py jinja2.Template special elements used in a template engine (CVSS 5.3, langgenius dify)
- [CVE-2026-18631](https://cve.now/CVE-2026-18631.md): jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization (CVSS 5.3, jeequan jeepay)
- [CVE-2026-69185](https://cve.now/CVE-2026-69185.md): Socket.IO: Zero-attachment Memory Exhaustion (CVSS 7.5, socketio socket.io · socket.io-parser)
- [CVE-2026-67599](https://cve.now/CVE-2026-67599.md): ClearOS 7.9 OS Command Injection via Log Viewer filter parameter (CVSS 8.6, ClearFoundation ClearOS)
- [CVE-2026-48031](https://cve.now/CVE-2026-48031.md): Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery (CVSS 9.1, dhax go-base · github.com/dhax/go-base)
- [CVE-2026-66296](https://cve.now/CVE-2026-66296.md): Reflected XSS in oaskit's default HTML error handler (CVSS 5.1, lud oaskit)
- [CVE-2026-18655](https://cve.now/CVE-2026-18655.md): Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection (CVSS 6.5, AWS amazon-mq-mcp-server)
- [CVE-2026-67598](https://cve.now/CVE-2026-67598.md): Emlog Pro 2.6.23 TLS Certificate Validation Disabled in ai.php (CVSS 9.1, emlog)
- [CVE-2026-18616](https://cve.now/CVE-2026-18616.md): GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set\_peer command injection (CVSS 9.3, GL-iNet GL-MT3000)
- [CVE-2026-18615](https://cve.now/CVE-2026-18615.md): GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate\_publickey command injection (CVSS 9.3, GL-iNet GL-MT3000)
- [CVE-2026-18614](https://cve.now/CVE-2026-18614.md): GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable\_echo\_server command injection (CVSS 9.3, GL-iNet GL-MT3000)
- [CVE-2026-59913](https://cve.now/CVE-2026-59913.md): Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnera (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-59912](https://cve.now/CVE-2026-59912.md): Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2025-15631](https://cve.now/CVE-2025-15631.md): Weak Credential Storage in TP-Link Omada Devices (CVSS 5.7, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2)
- [CVE-2025-15630](https://cve.now/CVE-2025-15630.md): Device Provisioning Race Condition in TP-Link Omada Adoption Workflow (CVSS 5.8, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2)
- [CVE-2025-15629](https://cve.now/CVE-2025-15629.md): Weak Session Key Generation in TP-Link Omada Adoption Protocol (CVSS 6.9, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2)
- [CVE-2025-15628](https://cve.now/CVE-2025-15628.md): Hardcoded Certificates in TP-Link Omada Device Communications (CVSS 8.2, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +3)
- [CVE-2025-15627](https://cve.now/CVE-2025-15627.md): Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication (CVSS 6.9, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +2)
- [CVE-2025-15544](https://cve.now/CVE-2025-15544.md): Weak Credential Protection During TP-Link Omada Device Adoption (CVSS 6.9, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +4)
- [CVE-2025-9291](https://cve.now/CVE-2025-9291.md): Improper Certificate Validation in TP-Link Omada Cloud Communications (CVSS 7.7, TP-Link Systems Omada Gateways · TP-Link Systems Omada S… +1)
- [CVE-2026-18613](https://cve.now/CVE-2026-18613.md): GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set\_config injection (CVSS 9.3, GL-iNet GL-MT3000)
- [CVE-2026-40717](https://cve.now/CVE-2026-40717.md): Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. (CVSS 6.6, Dell Monitor driver)
- [CVE-2026-18612](https://cve.now/CVE-2026-18612.md): GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install\_package command injection (CVSS 9.3, GL-iNet GL-MT3000)
- [CVE-2026-61524](https://cve.now/CVE-2026-61524.md): WebsiteBaker CMS \< 2.13.10 File Upload RCE via Module Installation (CVSS 8.6, WebsiteBaker Org e.V. WebsiteBaker CMS)
- [CVE-2026-61523](https://cve.now/CVE-2026-61523.md): WebsiteBaker CMS \< 2.13.10 Code Injection via Droplets Editor (CVSS 8.6, WebsiteBaker Org e.V. WebsiteBaker CMS)
- [CVE-2026-18610](https://cve.now/CVE-2026-18610.md): NewType WebEIP EIP\_Com\_FileList.aspx improper authentication (CVSS 6.9, NewType WebEIP)
- [CVE-2026-69153](https://cve.now/CVE-2026-69153.md): PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when \`from\` is unset (CVSS 6.3, postcss)
- [CVE-2026-18718](https://cve.now/CVE-2026-18718.md): Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State (CVSS 7.1, National Security Agency Ghidra)
- [CVE-2026-18607](https://cve.now/CVE-2026-18607.md): Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow (CVSS 8.7, Wavlink WN572 · Wavlink WN570H +10)
- [CVE-2026-69152](https://cve.now/CVE-2026-69152.md): brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVSS 7.5, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-69151](https://cve.now/CVE-2026-69151.md): Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (CVSS 7.6, angular · @angular compiler +3)
- [CVE-2026-18606](https://cve.now/CVE-2026-18606.md): Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management (CVSS 8.5, Razer RzUpdateService)
- [CVE-2026-69149](https://cve.now/CVE-2026-69149.md): Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (CVSS 8.6, angular · @angular platform-server +1)
- [CVE-2026-67612](https://cve.now/CVE-2026-67612.md): OpenEMR 8.2.0 Stored XSS via import\_template.php Template Management (CVSS 4.8, openemr)
- [CVE-2026-67611](https://cve.now/CVE-2026-67611.md): OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration (CVSS 8.6, openemr)
- [CVE-2026-67610](https://cve.now/CVE-2026-67610.md): OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access (CVSS 8.6, openemr)
- [CVE-2026-18605](https://cve.now/CVE-2026-18605.md): CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search path (CVSS 7.3, CheckMAL AppCheck Pro)
- [CVE-2026-39932](https://cve.now/CVE-2026-39932.md): OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection (CVSS 9.4, openemr)
- [CVE-2026-18243](https://cve.now/CVE-2026-18243.md): HP DesignJet T3500 - Potential Cross-Site Scripting (XSS) (CVSS 6.9, HP DesignJet T3500)
- [CVE-2026-68945](https://cve.now/CVE-2026-68945.md): Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning (CVSS 8.8, angular · @angular common +1)
- [CVE-2026-39931](https://cve.now/CVE-2026-39931.md): OpenEMR Authenticated SQL Injection via backup.php Import Feature (CVSS 8.6, openemr)
- [CVE-2026-41453](https://cve.now/CVE-2026-41453.md): Krayin CRM \< 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten\_lead Parameter (CVSS 8.7, krayin laravel-crm)
- [CVE-2026-18604](https://cve.now/CVE-2026-18604.md): textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components (CVSS 4.8, textPlus Text Message and Call App)
- [CVE-2026-41452](https://cve.now/CVE-2026-41452.md): Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup (CVSS 9.3, krayin laravel-crm)
- [CVE-2026-61372](https://cve.now/CVE-2026-61372.md): Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions (CVSS 7.5, Apache Software Foundation Apache Jena Fuseki)
- [CVE-2026-68930](https://cve.now/CVE-2026-68930.md): Russh: Channel-scoped server callbacks can be reached without an open channel (CVSS 6.5, Eugeny russh · russh)
- [CVE-2026-18477](https://cve.now/CVE-2026-18477.md): Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape (CVSS 4.4, Red Hat Enterprise Linux · Red Hat Discovery +3)
- [CVE-2026-18602](https://cve.now/CVE-2026-18602.md): GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get\_recommend\_config command injection (CVSS 9.3, GL.iNet GL-MT3000)
- [CVE-2026-18248](https://cve.now/CVE-2026-18248.md): @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header (CVSS 9.1, @fastify/aws-lambda)
- [CVE-2026-18651](https://cve.now/CVE-2026-18651.md): 389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account (CVSS 5.4, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-18508](https://cve.now/CVE-2026-18508.md): Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (CVSS 4.4, Red Hat Enterprise Linux · Red Hat Discovery +3)
- [CVE-2026-15430](https://cve.now/CVE-2026-15430.md): CVE-2026-15430 (CVSS 6.2, Wellbia XIGNCODE3)
- [CVE-2026-18568](https://cve.now/CVE-2026-18568.md): XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check (CVSS 7.5, TIMLEGGE XML::Sig)
- [CVE-2026-67609](https://cve.now/CVE-2026-67609.md): Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration (CVSS 8.5, Telenia Software TVox)
- [CVE-2026-18642](https://cve.now/CVE-2026-18642.md): Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock (CVSS 7.8, TUBITAK BILGEM Software Technologies Research Institute eta…)
- [CVE-2026-67608](https://cve.now/CVE-2026-67608.md): Telenia TVox 26.5.3 OS Command Injection via action\_audio.php (CVSS 8.6, Telenia Software TVox)
- [CVE-2026-64827](https://cve.now/CVE-2026-64827.md): Telenia TVox 26.5.3 Authentication Bypass via set\_env.php (CVSS 9.3, Telenia Software TVox)
- [CVE-2026-18092](https://cve.now/CVE-2026-18092.md): Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new\_from\_xml reads assertion identity with document-wide XPath instead of the signed subtree (CVSS 8.1, TIMLEGGE Net::SAML2)
- [CVE-2026-69097](https://cve.now/CVE-2026-69097.md): GitPython before 3.1.53 Config Injection via Submodule Names (CVSS 7.3, gitpython-developers GitPython · gitpython)
- [CVE-2026-69096](https://cve.now/CVE-2026-69096.md): OpenWrt luci-app-dockerman Read ACL Remote Code Execution (CVSS 8.7, openwrt luci)
- [CVE-2026-69095](https://cve.now/CVE-2026-69095.md): OpenWrt luci-app-bmx7 Path Traversal via bmx7-info (CVSS 8.7, openwrt luci)
- [CVE-2026-69094](https://cve.now/CVE-2026-69094.md): Admidio before 5.0.11 IDOR via save\_temporary mylist\_function.php (CVSS 5.3, admidio)
- [CVE-2026-69093](https://cve.now/CVE-2026-69093.md): Admidio before 5.0.11 CSRF via category-report preferences (CVSS 7.1, admidio)
- [CVE-2026-69092](https://cve.now/CVE-2026-69092.md): Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint (CVSS 6.9, admidio)
- [CVE-2026-69091](https://cve.now/CVE-2026-69091.md): Admidio before 5.0.11 Authentication Bypass via forum.php (CVSS 8.7, admidio)
- [CVE-2026-69090](https://cve.now/CVE-2026-69090.md): Admidio before 5.0.11 Cross-Organization Role Modification (CVSS 6.9, admidio)
- [CVE-2026-69089](https://cve.now/CVE-2026-69089.md): Grav CMS before 2.0.11 Path Traversal via watermark (CVSS 8.7, getgrav grav · getgrav/grav)
- [CVE-2026-69088](https://cve.now/CVE-2026-69088.md): Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint (CVSS 8.6, getgrav grav · getgrav/grav)
- [CVE-2026-69087](https://cve.now/CVE-2026-69087.md): Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig (CVSS 7.1, getgrav grav-plugin-form)
- [CVE-2026-69086](https://cve.now/CVE-2026-69086.md): SiYuan before v3.7.3 Path Traversal via unvalidated avID (CVSS 8.3, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-69085](https://cve.now/CVE-2026-69085.md): SiYuan before v3.7.3 SQL Injection via searchDocs (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-69084](https://cve.now/CVE-2026-69084.md): SiYuan before v3.7.3 SQL Injection via searchEmbedBlock (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-69083](https://cve.now/CVE-2026-69083.md): SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent (CVSS 9.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-68587](https://cve.now/CVE-2026-68587.md): SiYuan before v3.7.3 Information Disclosure via getHeading\*Transaction (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-68586](https://cve.now/CVE-2026-68586.md): SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-68585](https://cve.now/CVE-2026-68585.md): SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-68584](https://cve.now/CVE-2026-68584.md): SiYuan before v3.7.3 Authentication Bypass via Content Endpoints (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-18601](https://cve.now/CVE-2026-18601.md): GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check\_config command injection (CVSS 9.3, GL.iNet GL-MT3000)
- [CVE-2026-9487](https://cve.now/CVE-2026-9487.md): XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID (CVSS 9.1, TIMLEGGE XML::Sig)
- [CVE-2026-9390](https://cve.now/CVE-2026-9390.md): XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup (CVSS 9.1, TIMLEGGE XML::Sig)
- [CVE-2026-18108](https://cve.now/CVE-2026-18108.md): Net::SAML2 versions before 0.86 for Perl allow authentication bypass because \_verify\_encrypted\_assertion accepts an EncryptedAssertion whose decrypted content carries no signature (CVSS 9.8, TIMLEGGE Net::SAML2)
- [CVE-2026-18600](https://cve.now/CVE-2026-18600.md): GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch\_status command injection (CVSS 8.7, GL.iNet GL-MT3000)
- [CVE-2026-18089](https://cve.now/CVE-2026-18089.md): Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify\_xml when no trust anchor is configured (CVSS 7.5, TIMLEGGE Net::SAML2)
- [CVE-2026-18574](https://cve.now/CVE-2026-18574.md): Authentication Bypass in Check Point Security Management Server (CVSS 9.3, checkpoint Security Management Server · checkpoint Multi-Do…)
- [CVE-2026-18599](https://cve.now/CVE-2026-18599.md): GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set\_config command injection (CVSS 8.6, GL.iNet GL-MT3000)
- [CVE-2026-2346](https://cve.now/CVE-2026-2346.md): IDOR in Menulux Software's Mobile App (CVSS 9.8, Menulux Software Mobile App)
- [CVE-2026-18598](https://cve.now/CVE-2026-18598.md): GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get\_system\_log command injection (CVSS 8.7, GL.iNet GL-MT3000)
- [CVE-2026-56609](https://cve.now/CVE-2026-56609.md): HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609). (CVSS 4.8, HCL Software HCL iControl)
- [CVE-2026-56608](https://cve.now/CVE-2026-56608.md): HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609). (CVSS 3.7, HCL Software HCL iControl)
- [CVE-2026-0392](https://cve.now/CVE-2026-0392.md): eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update (CVSS 7.3, Latvijas Valsts radio un televīzijas centrs (LVRTC) eParaks…)
- [CVE-2026-68742](https://cve.now/CVE-2026-68742.md): Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-69082](https://cve.now/CVE-2026-69082.md): Cross-Site Request Forgery in the Administrative User Deletion Endpoint (CVSS 8.8, misp cti-transmute)
- [CVE-2026-33591](https://cve.now/CVE-2026-33591.md): Authentication bypass on WaptServer (CVSS 10.0, Tranquil IT Systems WAPT Server)
- [CVE-2026-69079](https://cve.now/CVE-2026-69079.md): Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute (CVSS 8.7, misp cti-transmute)
- [CVE-2026-69078](https://cve.now/CVE-2026-69078.md): Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering (CVSS 8.8, misp cti-transmute)
- [CVE-2026-69075](https://cve.now/CVE-2026-69075.md): Stored Cross-Site Scripting via Vue Template Injection in FlowIntel (CVSS 6.9, flowintel)
- [CVE-2026-62416](https://cve.now/CVE-2026-62416.md): Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication (CVSS 5.3, Sharp Network Scanner Tool Lite · Network Scanner Tool)
- [CVE-2026-63563](https://cve.now/CVE-2026-63563.md): Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in (CVSS 6.5, Sharp MFPs · Toshiba Tec MFPs)
- [CVE-2026-63545](https://cve.now/CVE-2026-63545.md): Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. (CVSS 2.4, Sharp MFPs · Toshiba Tec MFPs)
- [CVE-2026-60011](https://cve.now/CVE-2026-60011.md): Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the (CVSS 5.3, Sharp MFPs · Toshiba Tec MFPs)
- [CVE-2026-18593](https://cve.now/CVE-2026-18593.md): vxcontrol PentAGI Tool Management Protocol pentester.tmpl sandbox (CVSS 6.3, vxcontrol PentAGI)
- [CVE-2026-18592](https://cve.now/CVE-2026-18592.md): osCommerce Email Template Configuration EmailController.php EmailController sql injection (CVSS 5.1, osCommerce)
- [CVE-2026-21555](https://cve.now/CVE-2026-21555.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. UDX710)
- [CVE-2026-21554](https://cve.now/CVE-2026-21554.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. UDX710)
- [CVE-2026-21553](https://cve.now/CVE-2026-21553.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2026-21552](https://cve.now/CVE-2026-21552.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2026-21551](https://cve.now/CVE-2026-21551.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2026-21550](https://cve.now/CVE-2026-21550.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2026-21549](https://cve.now/CVE-2026-21549.md): In modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2026-21548](https://cve.now/CVE-2026-21548.md): In nr modem, there is a possible improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T8100/T9100/T8200/T8300)
- [CVE-2026-18591](https://cve.now/CVE-2026-18591.md): Meesho Online Shopping App com.meesho.supply cleartext storage (CVSS 2.4, Meesho Online Shopping App)
- [CVE-2026-28147](https://cve.now/CVE-2026-28147.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 5.4, Unlimited Elements For Elementor)
- [CVE-2026-12259](https://cve.now/CVE-2026-12259.md): Improper Input Validation in nltk/nltk (CVSS 5.3, nltk/nltk · nltk)
- [CVE-2026-8794](https://cve.now/CVE-2026-8794.md): PaperCut NG/MF: User enumeration via timing attack (CVSS 6.9, PaperCut NG/MF)
- [CVE-2026-8793](https://cve.now/CVE-2026-8793.md): PaperCut NG/MF: Insufficient brute-force protection (CVSS 6.9, PaperCut NG/MF)
- [CVE-2026-18590](https://cve.now/CVE-2026-18590.md): Wavlink WL-NU516U1 Admin Password adm.cgi set\_sys\_adm os command injection (CVSS 5.3, Wavlink WL-NU516U1)
- [CVE-2026-18589](https://cve.now/CVE-2026-18589.md): Wavlink WL-NU516U1 nas.cgi change\_password stack-based overflow (CVSS 9.3, Wavlink WL-NU516U1)
- [CVE-2026-9593](https://cve.now/CVE-2026-9593.md): iDTM FDI Unauthorized Debug Interface Enablement (CVSS 8.4, Endress+Hauser FDI Package library)
- [CVE-2026-4793](https://cve.now/CVE-2026-4793.md): An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files (CVSS 7.3, Synology Assistant)
- [CVE-2026-16572](https://cve.now/CVE-2026-16572.md): LogMyTrip \<= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie (CVSS 8.6, LogMyTrip)
- [CVE-2026-16565](https://cve.now/CVE-2026-16565.md): Dokan \< 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API (CVSS 4.3, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-16564](https://cve.now/CVE-2026-16564.md): Dokan \< 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint (CVSS 4.3, Dokan: AI Powered WooCommerce Multivendor Marketplace Solut…)
- [CVE-2026-16563](https://cve.now/CVE-2026-16563.md): Academy LMS \< 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint (CVSS 6.5, Academy LMS)
- [CVE-2026-16539](https://cve.now/CVE-2026-16539.md): SM Page Duplicator \<= 1.0.0 - Editor+ SQL Injection via Page Duplication (CVSS 8.1, sm page duplicator)
- [CVE-2026-16300](https://cve.now/CVE-2026-16300.md): Chama \< 1.0.13 - Unauthenticated Arbitrary User Password Reset (CVSS 9.8, ChamaWP)
- [CVE-2026-16297](https://cve.now/CVE-2026-16297.md): Clearfy \< 2.4.3 - Admin+ PHP Object Injection via Settings Import (CVSS 4.1, Clearfy Cache)
- [CVE-2026-16289](https://cve.now/CVE-2026-16289.md): ProfileGrid \< 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm\_get\_all\_requests\_from\_group (CVSS 4.3, ProfileGrid)
- [CVE-2026-16250](https://cve.now/CVE-2026-16250.md): Personal QR Message \<= 1.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Personal QR Message)
- [CVE-2026-16060](https://cve.now/CVE-2026-16060.md): Insert or Embed Articulate Content into WordPress \<= 4.3000000027 - Editor+ Arbitrary File Upload (CVSS 9.8, Insert or Embed Articulate Content into WordPress)
- [CVE-2026-15931](https://cve.now/CVE-2026-15931.md): Simple Membership \< 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name (CVSS 6.1, Simple Membership)
- [CVE-2026-15930](https://cve.now/CVE-2026-15930.md): Simple Membership \< 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision (CVSS 9.4, Simple Membership)
- [CVE-2026-15383](https://cve.now/CVE-2026-15383.md): Blog Floating Button \<= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header (CVSS 6.1, Blog Floating Button)
- [CVE-2026-15260](https://cve.now/CVE-2026-15260.md): Geo My WP \< 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR (CVSS 4.3, GEO my WP)
- [CVE-2026-15231](https://cve.now/CVE-2026-15231.md): TaxoPress \< 3.51.0 - Contributor+ Private Post Disclosure via IDOR (CVSS 2.7, Tag, Category, and Taxonomy Manager)
- [CVE-2026-14557](https://cve.now/CVE-2026-14557.md): SoftMarket \<= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass (CVSS 9.1, SoftMarket — Digital Marketplace)
- [CVE-2026-13340](https://cve.now/CVE-2026-13340.md): SVG Support \< 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass (CVSS 6.1, SVG Support)
- [CVE-2026-12965](https://cve.now/CVE-2026-12965.md): Super Store Finder \< 7.11 - Unauthenticated SQL Injection via ssf\_tracking (CVSS 9.1, Super Store Finder WordPress)
- [CVE-2026-12872](https://cve.now/CVE-2026-12872.md): Webinfos \<= 1.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Webinfos)
- [CVE-2025-15673](https://cve.now/CVE-2025-15673.md): Import and export users and customers \< 2.4.3 - Admin+ Arbitrary File Read (CVSS 4.9, Import and export users and customers)
- [CVE-2025-15672](https://cve.now/CVE-2025-15672.md): Chama \< 1.0.13 - Unauthenticated PHP Object Injection (CVSS 8.1, ChamaWP)
- [CVE-2026-18588](https://cve.now/CVE-2026-18588.md): Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow (CVSS 9.3, Wavlink WL-NU516U1)
- [CVE-2026-16534](https://cve.now/CVE-2026-16534.md): Import and export users and customers \< 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import (CVSS 9.1, Import and export users and customers)
- [CVE-2026-16532](https://cve.now/CVE-2026-16532.md): Link Library \< 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form (CVSS 9.1, Link Library)
- [CVE-2026-16276](https://cve.now/CVE-2026-16276.md): Classified Listing \< 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl\_revenue\_order\_search (CVSS 2.7, Classified Listing)
- [CVE-2026-16274](https://cve.now/CVE-2026-16274.md): Classified Listing \< 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl\_block\_css\_get\_posts (CVSS 2.7, Classified Listing)
- [CVE-2026-16057](https://cve.now/CVE-2026-16057.md): Contest Gallery \< 30.0.7 - Author+ Arbitrary Post Deletion via post\_cg\_youtube\_delete\_from\_library (CVSS 6.5, Contest Gallery)
- [CVE-2026-15254](https://cve.now/CVE-2026-15254.md): Simply Schedule Appointments \< 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode (CVSS 6.5, Simply Schedule Appointments)
- [CVE-2026-18587](https://cve.now/CVE-2026-18587.md): Wavlink WL-NU516U1 Config Import os command injection (CVSS 7.7, Wavlink WL-NU516U1)
- [CVE-2026-18585](https://cve.now/CVE-2026-18585.md): GL.iNet MT2500 APPS-NAS nas-web.get\_file\_list heap-based overflow (CVSS 5.3, GL.iNet MT3000 · GL.iNet MT6000 +9)
- [CVE-2026-18584](https://cve.now/CVE-2026-18584.md): GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization (CVSS 5.3, GL.iNet E5800 · GL.iNet E750 +4)
- [CVE-2026-18583](https://cve.now/CVE-2026-18583.md): mz-automation libiec61850 MMS Request mms\_mapping.c checkDataSetAccess out-of-bounds (CVSS 6.9, mz-automation libiec61850)
- [CVE-2026-6695](https://cve.now/CVE-2026-6695.md): Gimp: gimp: remote code execution via crafted paa file (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-6694](https://cve.now/CVE-2026-6694.md): Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-13586](https://cve.now/CVE-2026-13586.md): PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) (CVSS 5.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-13506](https://cve.now/CVE-2026-13506.md): Lazy ASN.1 sequence forcing resets nesting-depth guard (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +5)
- [CVE-2026-12860](https://cve.now/CVE-2026-12860.md): RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-12852](https://cve.now/CVE-2026-12852.md): MLS wire decoder allocates attacker-declared opaque length before bounds check (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-12817](https://cve.now/CVE-2026-12817.md): OpenPGP AEAD decryption skips final tag on chunk-aligned data (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-12816](https://cve.now/CVE-2026-12816.md): IESEngine stream-mode MAC forgery via length-dependent KDF split (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-12803](https://cve.now/CVE-2026-12803.md): KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery) (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-12802](https://cve.now/CVE-2026-12802.md): CMS AuthEnvelopedData fails to enforce tag-length on decryption (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-14682](https://cve.now/CVE-2026-14682.md): Possible OOM from unbounded up-front allocation on a definite-length read (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-58059](https://cve.now/CVE-2026-58059.md): Quadratic-time escaping when stringifying X.500 distinguished names (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-58060](https://cve.now/CVE-2026-58060.md): HSS public-key level count unbounded, enabling huge allocation on verify (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-58061](https://cve.now/CVE-2026-58061.md): CCM-family modes write plaintext to caller buffer before tag check (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-58062](https://cve.now/CVE-2026-58062.md): Stapled OCSP response accepted without binding to the checked certificate (CVSS 9.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-58063](https://cve.now/CVE-2026-58063.md): BCFKS keystore load honours unbounded KDF cost from untrusted file (CVSS 5.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-20498](https://cve.now/CVE-2026-20498.md): In geniezone, there is a possible escalation of privilege due to a missing permission check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20496](https://cve.now/CVE-2026-20496.md): In geniezone, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20495](https://cve.now/CVE-2026-20495.md): In Bluetooth driver, there is a possible permission bypass due to a missing permission check. (CVSS 7.8, MediaTek chipset)
- [CVE-2026-20494](https://cve.now/CVE-2026-20494.md): In wifi, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20493](https://cve.now/CVE-2026-20493.md): In wifi, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20492](https://cve.now/CVE-2026-20492.md): In Audio HAL, there is a possible system becoming unresponsive due to a race condition. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20491](https://cve.now/CVE-2026-20491.md): In med, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20490](https://cve.now/CVE-2026-20490.md): In ccci, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20489](https://cve.now/CVE-2026-20489.md): In display, there is a possible information disclosure due to an integer overflow. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20488](https://cve.now/CVE-2026-20488.md): In display, there is a possible information disclosure due to a missing bounds check. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20486](https://cve.now/CVE-2026-20486.md): In imgsensor, there is a possible application crash due to incorrect error handling. (CVSS 6.7, MediaTek chipset)
- [CVE-2026-20485](https://cve.now/CVE-2026-20485.md): In HFRP, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20484](https://cve.now/CVE-2026-20484.md): In TFA, there is a possible information disclosure due to a missing permission check. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20470](https://cve.now/CVE-2026-20470.md): In Telephony, there is a possible information disclosure due to a missing permission check. (CVSS 6.2, MediaTek chipset)
- [CVE-2026-20483](https://cve.now/CVE-2026-20483.md): In Telephony, there is a possible escalation of privilege due to a missing permission check. (CVSS 7.7, MediaTek chipset)
- [CVE-2026-20482](https://cve.now/CVE-2026-20482.md): In wlan STA FW, there is a possible system becoming unresponsive due to logging. (CVSS 6.5, MediaTek chipset)
- [CVE-2026-20481](https://cve.now/CVE-2026-20481.md): In geniezone, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20497](https://cve.now/CVE-2026-20497.md): In geniezone, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20480](https://cve.now/CVE-2026-20480.md): In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20479](https://cve.now/CVE-2026-20479.md): In Modem, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, MediaTek chipset)
- [CVE-2026-20478](https://cve.now/CVE-2026-20478.md): In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20477](https://cve.now/CVE-2026-20477.md): In display, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20476](https://cve.now/CVE-2026-20476.md): In ccci, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, MediaTek chipset)
- [CVE-2026-20475](https://cve.now/CVE-2026-20475.md): In display, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20474](https://cve.now/CVE-2026-20474.md): In display, there is a possible escalation of privilege due to a race condition. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20473](https://cve.now/CVE-2026-20473.md): In display, there is a possible memory corruption due to use after free. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20472](https://cve.now/CVE-2026-20472.md): In TFA, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, MediaTek chipset)
- [CVE-2026-20471](https://cve.now/CVE-2026-20471.md): In DA, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.6, MediaTek chipset)
- [CVE-2026-20469](https://cve.now/CVE-2026-20469.md): In trusted\_mem, there is a possible escalation of privilege due to improper input validation. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20468](https://cve.now/CVE-2026-20468.md): In apusys, there is a possible escalation of privilege due to a confused deputy. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20467](https://cve.now/CVE-2026-20467.md): In apusys, there is a possible escalation of privilege due to a missing bounds check. (CVSS 6.0, MediaTek chipset)
- [CVE-2026-20466](https://cve.now/CVE-2026-20466.md): In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. (CVSS 6.1, MediaTek chipset)
- [CVE-2026-20465](https://cve.now/CVE-2026-20465.md): In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.1, MediaTek chipset)
- [CVE-2026-20464](https://cve.now/CVE-2026-20464.md): In hevc decoder, there is a possible out of bounds write due to an integer overflow. (CVSS 6.5, MediaTek chipset)
- [CVE-2026-18582](https://cve.now/CVE-2026-18582.md): mz-automation libiec61850 Report Sending Path reporting.c Reporting\_RCBWriteAccessHandler free of memory not on the heap (CVSS 6.9, mz-automation libiec61850)
- [CVE-2026-59638](https://cve.now/CVE-2026-59638.md): JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (CVSS 9.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59639](https://cve.now/CVE-2026-59639.md): CMS verifySignatures returns true for SignedData with zero signers (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59640](https://cve.now/CVE-2026-59640.md): OpenPGP CFB quick-check oracle active on symmetric/session-key paths (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59641](https://cve.now/CVE-2026-59641.md): S/MIME validator trusts signer-asserted signingTime for path validation (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59642](https://cve.now/CVE-2026-59642.md): CMS AuthenticatedData content not bound to MAC when authAttrs present (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59643](https://cve.now/CVE-2026-59643.md): OpenPGP inline-signature policy failures silently ignored (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-59644](https://cve.now/CVE-2026-59644.md): MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-59645](https://cve.now/CVE-2026-59645.md): OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59646](https://cve.now/CVE-2026-59646.md): DTLS handshake reassembler allocates buffer from unchecked 24-bit length (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59647](https://cve.now/CVE-2026-59647.md): CRMF/CMP password-MAC honours unbounded iteration count (CVSS 6.9, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59648](https://cve.now/CVE-2026-59648.md): OpenPGP Argon2 S2K honours attacker-chosen memory and passes (CVSS 6.9, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59649](https://cve.now/CVE-2026-59649.md): OpenPGP user-attribute subpacket length bounded only by JVM max memory (CVSS 8.7, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-59650](https://cve.now/CVE-2026-59650.md): MTI/A0 DH agreement exponentiates unvalidated peer value (CVSS 9.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-59651](https://cve.now/CVE-2026-59651.md): BKS keystore accepts legacy version with 16-bit integrity MAC key (CVSS 7.1, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-59652](https://cve.now/CVE-2026-59652.md): LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (CVSS 6.9, Legion of the Bouncy Castle BC-JAVA)
- [CVE-2026-12185](https://cve.now/CVE-2026-12185.md): BKS/UBER keystore allocates from untrusted lengths before integrity check (CVSS 7.1, Legion of the Bouncy Castle BC-JAVA · Legion of the Bouncy…)
- [CVE-2026-8763](https://cve.now/CVE-2026-8763.md): Name Constraints bypass via trailing dot in rfc822Name and URI (CVSS 9.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +5)
- [CVE-2026-15055](https://cve.now/CVE-2026-15055.md): PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (CVSS 5.3, Legion of the Bouncy Castle BC-JAVA · Legion of the Boun… +1)
- [CVE-2026-18581](https://cve.now/CVE-2026-18581.md): ggml-org llama.cpp Jinja Minja Template parser.cpp assertion (CVSS 4.8, ggml-org llama.cpp)
- [CVE-2026-65875](https://cve.now/CVE-2026-65875.md): BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. (CVSS 7.1, baserCMS Users Community BaserCMS)
- [CVE-2026-38444](https://cve.now/CVE-2026-38444.md): osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. (CVSS 6.1)
- [CVE-2026-38446](https://cve.now/CVE-2026-38446.md): A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. (CVSS 6.1)
- [CVE-2026-38447](https://cve.now/CVE-2026-38447.md): osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. (CVSS 9.8)
- [CVE-2026-51190](https://cve.now/CVE-2026-51190.md): The "s init" command in Serverless-Devs @serverless-devs/s \<= 3.1.11 passes unsanitized user input to child\_process.spawn() with shell: true (CVSS 9.8)
- [CVE-2026-51775](https://cve.now/CVE-2026-51775.md): SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller (CVSS 9.8)
- [CVE-2026-52102](https://cve.now/CVE-2026-52102.md): An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary comma (CVSS 9.8)
- [CVE-2026-52520](https://cve.now/CVE-2026-52520.md): Emlog CMS \<= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). (CVSS 5.4)
- [CVE-2026-52521](https://cve.now/CVE-2026-52521.md): A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in th (CVSS 8.1)
- [CVE-2026-67673](https://cve.now/CVE-2026-67673.md): A stack-based buffer overflow vulnerability exists in the cmd\_edl function of OreSat Firmware v1.0. (CVSS 4.6)
- [CVE-2026-67969](https://cve.now/CVE-2026-67969.md): An issue in the HS\_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a craft (CVSS 7.5)
- [CVE-2026-67970](https://cve.now/CVE-2026-67970.md): Incorrect access control in the DS\_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path (CVSS 7.5)
- [CVE-2026-67972](https://cve.now/CVE-2026-67972.md): An issue in the CF\_CFDP\_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly (CVSS 7.5)
- [CVE-2026-67973](https://cve.now/CVE-2026-67973.md): An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs. (CVSS 7.5)
- [CVE-2026-67974](https://cve.now/CVE-2026-67974.md): A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attacker (CVSS 7.5)
- [CVE-2026-67975](https://cve.now/CVE-2026-67975.md): Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending T (CVSS 7.5)
- [CVE-2026-67976](https://cve.now/CVE-2026-67976.md): The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to ca (CVSS 7.5)
- [CVE-2026-67977](https://cve.now/CVE-2026-67977.md): An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (CVSS 7.5)
- [CVE-2026-67978](https://cve.now/CVE-2026-67978.md): An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN fram (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.