# CVEs published 2026-08-04

272 CVEs were published on August 4, 2026: 46 critical, 113 high. Days are UTC.

- [CVE-2026-46334](https://cve.now/CVE-2026-46334.md): OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning (CVSS 8.7, opensips)
- [CVE-2026-18853](https://cve.now/CVE-2026-18853.md): ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal (CVSS 4.8, ZomboDroid Meme Generator App)
- [CVE-2026-45809](https://cve.now/CVE-2026-45809.md): OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI (CVSS 8.7, opensips)
- [CVE-2026-45705](https://cve.now/CVE-2026-45705.md): OpenSIPS: OOB Read in Multipart Body Boundary Parsing (CVSS 5.3, opensips)
- [CVE-2026-18852](https://cve.now/CVE-2026-18852.md): epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition (CVSS 4.8, epsilla-cloud vectordb)
- [CVE-2026-18103](https://cve.now/CVE-2026-18103.md): Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi (CVSS 4.9, Red Hat Enterprise Linux)
- [CVE-2026-45537](https://cve.now/CVE-2026-45537.md): OpenSIPS: Global Buffer Overflow in construct\_uri (CVSS 9.1, opensips)
- [CVE-2026-18819](https://cve.now/CVE-2026-18819.md): RackTables cross-site request forgery (CVSS 5.3, RackTables)
- [CVE-2026-18818](https://cve.now/CVE-2026-18818.md): Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization (CVSS 5.3, Ehco1996 django-sspanel)
- [CVE-2026-18817](https://cve.now/CVE-2026-18817.md): Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization (CVSS 2.1, Baserow)
- [CVE-2026-45103](https://cve.now/CVE-2026-45103.md): OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow (CVSS 7.5, opensips)
- [CVE-2026-70594](https://cve.now/CVE-2026-70594.md): Ghost: Session Fixation in Ghost Admin (CVSS 6.7, TryGhost Ghost · ghost)
- [CVE-2026-70593](https://cve.now/CVE-2026-70593.md): Ghost: Theme Upload Path Traversal (CVSS 6.6, TryGhost Ghost · ghost)
- [CVE-2026-18816](https://cve.now/CVE-2026-18816.md): Baserow 2FA Verify Endpoint views.py verify improper authentication (CVSS 2.3, Baserow)
- [CVE-2026-45100](https://cve.now/CVE-2026-45100.md): OpenSIPS: Buffer Overflow in Base64 Encode Transformation (CVSS 9.1, opensips)
- [CVE-2026-70592](https://cve.now/CVE-2026-70592.md): Ghost: Database Backup Path Traversal (CVSS 5.5, TryGhost Ghost · ghost)
- [CVE-2026-70591](https://cve.now/CVE-2026-70591.md): Ghost: Server-Side Request Forgery in Image Fetching (CVSS 4.1, TryGhost Ghost · ghost)
- [CVE-2026-70590](https://cve.now/CVE-2026-70590.md): Ghost: Blind Password Hash Disclosure in Ghost Admin API (CVSS 4.8, TryGhost Ghost · ghost)
- [CVE-2026-45084](https://cve.now/CVE-2026-45084.md): OpenSIPS: Denial of service in presence.handle\_publish() from unchecked Content-Type state (CVSS 8.7, opensips)
- [CVE-2026-70619](https://cve.now/CVE-2026-70619.md): Odysseus Missing Admin Authorization via Embedding Endpoint Routes (CVSS 8.7, odysseus-dev odysseus)
- [CVE-2026-70620](https://cve.now/CVE-2026-70620.md): Odysseus SSRF via Embedding Endpoint Configuration (CVSS 6.1, odysseus-dev odysseus)
- [CVE-2026-18814](https://cve.now/CVE-2026-18814.md): H3C NX15 esps reload.reload\_config command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-70589](https://cve.now/CVE-2026-70589.md): Ghost: Archived Offers can be Redeemed (CVSS 4.8, TryGhost Ghost · ghost)
- [CVE-2026-70588](https://cve.now/CVE-2026-70588.md): Ghost: Cross-Site Scripting in Universal Import (CVSS 5.0, TryGhost Ghost · ghost)
- [CVE-2026-18813](https://cve.now/CVE-2026-18813.md): H3C NX15 esps delete command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-70494](https://cve.now/CVE-2026-70494.md): Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder (CVSS 8.1, open-webui)
- [CVE-2026-70493](https://cve.now/CVE-2026-70493.md): Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically (CVSS 6.5, open-webui)
- [CVE-2026-13227](https://cve.now/CVE-2026-13227.md): ERPNext v16.25.0 - Improper authorization in Prospect opportunities API (CVSS 7.1, Frappe ERPNext)
- [CVE-2026-70492](https://cve.now/CVE-2026-70492.md): Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages (CVSS 8.7, open-webui)
- [CVE-2026-70491](https://cve.now/CVE-2026-70491.md): Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints (CVSS 6.5, open-webui)
- [CVE-2026-66902](https://cve.now/CVE-2026-66902.md): Google::Auth versions before 0.06 for Perl run a command named in an external\_account credentials JSON via an ungated system call (CVSS 9.8, CJCOLLIER Google::Auth)
- [CVE-2026-66901](https://cve.now/CVE-2026-66901.md): Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON (CVSS 7.5, CJCOLLIER Google::Auth)
- [CVE-2026-45538](https://cve.now/CVE-2026-45538.md): OpenSIPS: Stack Buffer Overflow in sip\_to\_json() Header Name Copy (CVSS 9.8, opensips)
- [CVE-2026-70490](https://cve.now/CVE-2026-70490.md): Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check (CVSS 6.3, open-webui)
- [CVE-2026-70489](https://cve.now/CVE-2026-70489.md): Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing (CVSS 6.5, open-webui)
- [CVE-2026-54020](https://cve.now/CVE-2026-54020.md): Open WebUI: DNS Rebinding SSRF Bypass (CVSS 6.3, open-webui)
- [CVE-2026-70488](https://cve.now/CVE-2026-70488.md): Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup (CVSS 4.3, open-webui)
- [CVE-2026-18812](https://cve.now/CVE-2026-18812.md): H3C NX15 esps esps.ipv6.wan command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-70487](https://cve.now/CVE-2026-70487.md): Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata (CVSS 5.3, open-webui)
- [CVE-2026-18811](https://cve.now/CVE-2026-18811.md): H3C NX15 esps add command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-65986](https://cve.now/CVE-2026-65986.md): CVAT has stored XSS via annotation guide assets (CVSS 8.5, cvat-ai cvat)
- [CVE-2026-70554](https://cve.now/CVE-2026-70554.md): MaxSite CMS Unauthenticated PHP Object Injection via maxsite\_comuser Cookie (CVSS 9.3, MaxSite CMS)
- [CVE-2026-70486](https://cve.now/CVE-2026-70486.md): Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin (CVSS 8.2, open-webui)
- [CVE-2026-47682](https://cve.now/CVE-2026-47682.md): CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes (CVSS 7.1, cvat-ai cvat)
- [CVE-2026-18810](https://cve.now/CVE-2026-18810.md): H3C NX15 networkSetup missing authentication (CVSS 6.9, H3C NX15)
- [CVE-2026-70485](https://cve.now/CVE-2026-70485.md): Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs (CVSS 7.1, open-webui)
- [CVE-2026-70484](https://cve.now/CVE-2026-70484.md): Open WebUI: Users denied the image-generation permission can still generate images via chat completions (CVSS 4.3, open-webui)
- [CVE-2026-70483](https://cve.now/CVE-2026-70483.md): Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint (CVSS 3.1, open-webui)
- [CVE-2026-70482](https://cve.now/CVE-2026-70482.md): Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client (CVSS 8.1, open-webui)
- [CVE-2026-16793](https://cve.now/CVE-2026-16793.md): Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator (CVSS 8.8, Lenovo XClarity Orchestrator)
- [CVE-2026-16792](https://cve.now/CVE-2026-16792.md): Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator (CVSS 6.1, Lenovo XClarity Orchestrator)
- [CVE-2026-16791](https://cve.now/CVE-2026-16791.md): Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI (CVSS 3.9, Lenovo XClarity Essentials OneCLI)
- [CVE-2026-48154](https://cve.now/CVE-2026-48154.md): GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access (CVSS 5.9, pilinux gorest · github.com/pilinux/gorest)
- [CVE-2026-70481](https://cve.now/CVE-2026-70481.md): Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages (CVSS 5.4, open-webui)
- [CVE-2026-70480](https://cve.now/CVE-2026-70480.md): Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering (CVSS 4.1, open-webui)
- [CVE-2026-70479](https://cve.now/CVE-2026-70479.md): Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader (CVSS 7.7, open-webui)
- [CVE-2026-18657](https://cve.now/CVE-2026-18657.md): Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows (CVSS 7.8, Amazon Kiro CLI)
- [CVE-2026-70553](https://cve.now/CVE-2026-70553.md): MaxSite CMS Unauthenticated RCE via Install Endpoint (CVSS 9.3, MaxSite CMS)
- [CVE-2026-70478](https://cve.now/CVE-2026-70478.md): Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service (CVSS 9.2, FlowiseAI Flowise · flowise)
- [CVE-2026-18656](https://cve.now/CVE-2026-18656.md): Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows (CVSS 7.8, Amazon Kiro IDE)
- [CVE-2026-70477](https://cve.now/CVE-2026-70477.md): Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability (CVSS 9.5, FlowiseAI Flowise · flowise +1)
- [CVE-2026-70552](https://cve.now/CVE-2026-70552.md): MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php (CVSS 9.3, MaxSite CMS)
- [CVE-2026-70476](https://cve.now/CVE-2026-70476.md): Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation (CVSS 8.3, FlowiseAI Flowise · flowise)
- [CVE-2026-70475](https://cve.now/CVE-2026-70475.md): Flowise: Missing Authorization on Execution Update Endpoint (CVSS 7.1, FlowiseAI Flowise · flowise)
- [CVE-2026-49435](https://cve.now/CVE-2026-49435.md): Keysight IxChariot-related products stack-based buffer overflow (CVSS 9.8, Keysight Hawkeye · Keysight IxChariot +3)
- [CVE-2017-20242](https://cve.now/CVE-2017-20242.md): Keysight IxChariot Endpoint stack-based buffer overflow (CVSS 9.8, Keysight IxChariot)
- [CVE-2017-20241](https://cve.now/CVE-2017-20241.md): Keysight IxChariot Endpoint heap-based buffer overflow (CVSS 9.8, Keysight IxChariot)
- [CVE-2026-66300](https://cve.now/CVE-2026-66300.md): SNOMED International Snowstorm reflected XSS (CVSS 5.0, SNOMED International Snowstorm)
- [CVE-2026-69704](https://cve.now/CVE-2026-69704.md): Atals-Livre SQL Injection via Unsanitized GET Parameter in supp() (CVSS 7.0, maximeAmini Atals-Livre)
- [CVE-2026-47781](https://cve.now/CVE-2026-47781.md): pdm: Project-Controlled \`.pdm-plugins\` Content Executes Before CLI Parsing (CVSS 8.4, pdm-project pdm · pdm)
- [CVE-2026-69703](https://cve.now/CVE-2026-69703.md): Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit (CVSS 9.3, maximeAmini Atals-Livre)
- [CVE-2026-68743](https://cve.now/CVE-2026-68743.md): Sssd: sssd: pam responder out-of-bounds read via unchecked auth\_token\_length in protocol v1 (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-0163](https://cve.now/CVE-2026-0163.md): In multiple functions of vpu\_ioctl.c, there is a possible use after free due to a use after free. (CVSS 9.8, Google Android)
- [CVE-2026-13229](https://cve.now/CVE-2026-13229.md): Zammad 7.0.1 - Improper authorization in ticket article attachment cloning (CVSS 7.1, Zammad)
- [CVE-2026-70474](https://cve.now/CVE-2026-70474.md): Flowise: Cross-Workspace OAuth2 Credential Metadata Leak (CVSS 7.6, FlowiseAI Flowise · flowise)
- [CVE-2026-47764](https://cve.now/CVE-2026-47764.md): pdm: Path traversal in wheel installation via overridden write\_to\_fs (CVSS 8.4, pdm-project pdm · pdm)
- [CVE-2026-70473](https://cve.now/CVE-2026-70473.md): Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history (CVSS 8.3, FlowiseAI Flowise · flowise)
- [CVE-2026-70472](https://cve.now/CVE-2026-70472.md): Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store (CVSS 7.1, FlowiseAI Flowise · flowise)
- [CVE-2026-69702](https://cve.now/CVE-2026-69702.md): SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM (CVSS 7.1, aizuda SnailJob)
- [CVE-2026-70471](https://cve.now/CVE-2026-70471.md): Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure (CVSS 7.1, FlowiseAI Flowise · flowise)
- [CVE-2026-18830](https://cve.now/CVE-2026-18830.md): Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API (CVSS 8.1, AWS Amazon Bedrock AgentCore harness)
- [CVE-2026-47623](https://cve.now/CVE-2026-47623.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. (CVSS 8.2, NVIDIA Dynamo)
- [CVE-2026-47622](https://cve.now/CVE-2026-47622.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive infor (CVSS 5.3, NVIDIA Dynamo)
- [CVE-2026-47621](https://cve.now/CVE-2026-47621.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization (CVSS 6.5, NVIDIA Dynamo)
- [CVE-2026-47620](https://cve.now/CVE-2026-47620.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization (CVSS 6.5, NVIDIA Dynamo)
- [CVE-2026-47619](https://cve.now/CVE-2026-47619.md): NVIDIA Dynamo for Linux examples and recipes contain a vulnerability where an attacker could cause a system failure. (CVSS 6.6, NVIDIA Dynamo)
- [CVE-2026-47618](https://cve.now/CVE-2026-47618.md): NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could cause server-side request forg (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-47617](https://cve.now/CVE-2026-47617.md): NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery via (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-70470](https://cve.now/CVE-2026-70470.md): Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE (CVSS 9.5, FlowiseAI Flowise · flowise +1)
- [CVE-2026-47616](https://cve.now/CVE-2026-47616.md): NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause server-side request forgery. (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-47615](https://cve.now/CVE-2026-47615.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a mul (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-18790](https://cve.now/CVE-2026-18790.md): Systerel S2OPC DeleteMonitoredItemsRequest state\_machine.c out-of-bounds (CVSS 4.8, Systerel S2OPC)
- [CVE-2026-47763](https://cve.now/CVE-2026-47763.md): pdm: Project-Local State and Config Writes Follow Symlinks (CVSS 6.8, pdm-project pdm · pdm)
- [CVE-2026-47614](https://cve.now/CVE-2026-47614.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-47613](https://cve.now/CVE-2026-47613.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to a restricted directory by (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-47612](https://cve.now/CVE-2026-47612.md): NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathnam (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-24255](https://cve.now/CVE-2026-24255.md): NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submit (CVSS 7.5, NVIDIA Dynamo)
- [CVE-2026-24254](https://cve.now/CVE-2026-24254.md): NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. (CVSS 9.8, NVIDIA Dynamo)
- [CVE-2026-69264](https://cve.now/CVE-2026-69264.md): Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation (CVSS 9.4, FlowiseAI Flowise · flowise +1)
- [CVE-2026-24253](https://cve.now/CVE-2026-24253.md): NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. (CVSS 8.2, NVIDIA Dynamo)
- [CVE-2026-47487](https://cve.now/CVE-2026-47487.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, wr (CVSS 4.4, NVIDIA Triton Inference Server)
- [CVE-2026-18788](https://cve.now/CVE-2026-18788.md): Trippo ResponsiveFilemanager dialog.php unrestricted upload (CVSS 6.9, Trippo ResponsiveFilemanager)
- [CVE-2026-18787](https://cve.now/CVE-2026-18787.md): GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove\_rule command injection (CVSS 8.7, GL.iNet AX1800)
- [CVE-2026-15314](https://cve.now/CVE-2026-15314.md): Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110 (CVSS 7.1, TP-Link Systems P110)
- [CVE-2026-69263](https://cve.now/CVE-2026-69263.md): Flowise: CVE-2025-8943 Patch Bypass: npm\_config\_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) (CVSS 8.7, FlowiseAI Flowise · flowise +1)
- [CVE-2026-69262](https://cve.now/CVE-2026-69262.md): Flowise: \`DELETE /api/v1/chatflows/:id\` does not validate resource type, allowing \`agentflows:delete\` and \`chatflows:delete\` to delete each other’s flow type (CVSS 7.1, FlowiseAI Flowise · flowise)
- [CVE-2026-48121](https://cve.now/CVE-2026-48121.md): @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access (CVSS 6.7, langchain-ai langgraphjs · @langchain/langgraph-checkpoint-…)
- [CVE-2026-18785](https://cve.now/CVE-2026-18785.md): o6 open62541 client\_types\_custom.c UA\_Client\_getRemoteDataTypes use after free (CVSS 4.8, o6 open62541)
- [CVE-2026-63456](https://cve.now/CVE-2026-63456.md): Authentication bypass via spoofed HTTP headers Orchestrator REST API (CVSS 9.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…)
- [CVE-2026-63455](https://cve.now/CVE-2026-63455.md): Authentication bypass via spoofed HTTP headers Orchestrator REST API (CVSS 9.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchest…)
- [CVE-2026-18784](https://cve.now/CVE-2026-18784.md): o6 open62541 ua\_client\_highlevel.c UA\_Client\_readNodeClassAttribute heap-based overflow (CVSS 4.8, o6 open62541)
- [CVE-2026-18775](https://cve.now/CVE-2026-18775.md): NousResearch hermes-agent Browser Tooling browser\_tool.py browser\_snapshot server-side request forgery (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-69259](https://cve.now/CVE-2026-69259.md): Flowise RCE via SQLite Record Manager Node (CVSS 9.4, FlowiseAI Flowise · flowise +1)
- [CVE-2026-18774](https://cve.now/CVE-2026-18774.md): NousResearch hermes-agent xAI Image Generation Provider image\_gen\_provider.py save\_url\_image server-side request forgery (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-56848](https://cve.now/CVE-2026-56848.md): A flaw in Node.js HTTP/2 handling allows \`nghttp2\_session\_mem\_send()\` to be called re-entrantly while \`nghttp2\_session\_mem\_recv()\` is execut (CVSS 7.5, nodejs node)
- [CVE-2026-69258](https://cve.now/CVE-2026-69258.md): Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated \`overrideConfig\` Spread in Prediction API (CVSS 8.8, FlowiseAI Flowise · flowise)
- [CVE-2026-58072](https://cve.now/CVE-2026-58072.md): A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execu (CVSS 9.0, Veeam Service Provider Console)
- [CVE-2026-58074](https://cve.now/CVE-2026-58074.md): A vulnerability allowing a high-privileged user to execute arbitrary code on the server. (CVSS 8.6, Veeam ONE)
- [CVE-2026-64630](https://cve.now/CVE-2026-64630.md): A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link. (CVSS 5.3, Veeam ONE)
- [CVE-2026-58073](https://cve.now/CVE-2026-58073.md): A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's (CVSS 9.5, Veeam Service Provider Console)
- [CVE-2026-64631](https://cve.now/CVE-2026-64631.md): A vulnerability allowing a low-privileged user to inject SQL and extract database contents. (CVSS 8.6, Veeam ONE)
- [CVE-2026-58075](https://cve.now/CVE-2026-58075.md): A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privil (CVSS 8.7, Veeam ONE)
- [CVE-2026-64633](https://cve.now/CVE-2026-64633.md): A vulnerability allowing remote unauthenticated code execution on the agent host. (CVSS 10.0, Veeam ONE)
- [CVE-2026-64634](https://cve.now/CVE-2026-64634.md): A vulnerability allowing local privilege escalation to the Reporter service context. (CVSS 8.4, Veeam ONE)
- [CVE-2026-58071](https://cve.now/CVE-2026-58071.md): A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administ (CVSS 8.2, Veeam Service Provider Console)
- [CVE-2026-58067](https://cve.now/CVE-2026-58067.md): A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. (CVSS 8.7, Veeam Service Provider Console)
- [CVE-2026-69257](https://cve.now/CVE-2026-69257.md): Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses (CVSS 7.6, FlowiseAI Flowise · flowise)
- [CVE-2026-15920](https://cve.now/CVE-2026-15920.md): Potential cross-site scripting via URLField values in the admin (CVSS 6.1, djangoproject Django)
- [CVE-2026-15830](https://cve.now/CVE-2026-15830.md): Potential denial-of-service vulnerability via nested geometry collections (CVSS 5.3, djangoproject Django · django)
- [CVE-2026-15337](https://cve.now/CVE-2026-15337.md): Potential denial-of-service vulnerability in check\_for\_language() (CVSS 5.3, djangoproject Django)
- [CVE-2026-15307](https://cve.now/CVE-2026-15307.md): Server-side file-write and request forgery via spatial lookups (CVSS 8.8, djangoproject Django · django)
- [CVE-2026-69256](https://cve.now/CVE-2026-69256.md): Flowise: Remote Code Execution Vulnerability in CSVAgent (CVSS 9.4, FlowiseAI Flowise · flowise-components +1)
- [CVE-2026-69255](https://cve.now/CVE-2026-69255.md): Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified (CVSS 9.2, FlowiseAI Flowise · flowise +1)
- [CVE-2026-10032](https://cve.now/CVE-2026-10032.md): Arbitrary JavaScript Execution via openUrl in @a2ui/web\_core (CVSS 6.1, Google @a2ui/web\_core · @a2ui/web\_core)
- [CVE-2026-69110](https://cve.now/CVE-2026-69110.md): OpenCode Studio \< 2.4.4 Unauthenticated File Read via /api/tmp and /api/music (CVSS 9.3, Microck opencode-studio)
- [CVE-2026-69254](https://cve.now/CVE-2026-69254.md): Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override (CVSS 9.4, FlowiseAI Flowise · flowise +1)
- [CVE-2026-69100](https://cve.now/CVE-2026-69100.md): LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution (CVSS 8.7, dromara lamp-cloud)
- [CVE-2026-69098](https://cve.now/CVE-2026-69098.md): kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization (CVSS 9.3, Cinnamon kotaemon)
- [CVE-2026-69253](https://cve.now/CVE-2026-69253.md): Flowise Sandbox Escape to RCE (CVSS 9.0, FlowiseAI Flowise · flowise +1)
- [CVE-2026-25292](https://cve.now/CVE-2026-25292.md): Improper Validation of Syntactic Correctness of Input in Automotive Linux OS (CVSS 7.6, Qualcomm Snapdragon)
- [CVE-2026-25289](https://cve.now/CVE-2026-25289.md): Stack-based Buffer Overflow in WLAN Firmware (CVSS 9.6, Qualcomm Snapdragon)
- [CVE-2026-25288](https://cve.now/CVE-2026-25288.md): Buffer Over-read in WLAN Firmware (CVSS 7.4, Qualcomm Snapdragon)
- [CVE-2026-24084](https://cve.now/CVE-2026-24084.md): Insecure Security Identifier Mechanism in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2026-24083](https://cve.now/CVE-2026-24083.md): Untrusted Pointer Dereference in Automotive Security (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-24080](https://cve.now/CVE-2026-24080.md): Buffer Copy Without Checking Size of Input in Biometrics (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-24079](https://cve.now/CVE-2026-24079.md): Missing Authentication for Critical Function in Data Modem (CVSS 8.1, Qualcomm Snapdragon)
- [CVE-2026-24078](https://cve.now/CVE-2026-24078.md): Exposure of Private Personal Information to an Unauthorized Actor in Data Modem (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2026-24077](https://cve.now/CVE-2026-24077.md): Integer Underflow (Wrap or Wraparound) in WLAN Host (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2026-24076](https://cve.now/CVE-2026-24076.md): Buffer Copy Without Checking Size of Input in Bluetooth HOST (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2026-21366](https://cve.now/CVE-2026-21366.md): Integer Overflow or Wraparound in Data Network Stack & Connectivity (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2026-18773](https://cve.now/CVE-2026-18773.md): NousResearch hermes-agent Quick run.py \_check\_slash\_access authorization (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-69252](https://cve.now/CVE-2026-69252.md): Flowise: Missing authorization on \`/api/v1/files\` allows low-privileged API keys to list and delete files across workspaces within the same organization (CVSS 7.2, FlowiseAI Flowise · flowise)
- [CVE-2026-18801](https://cve.now/CVE-2026-18801.md): Stored Clickhouse SQL Injection Through Customer Usage Attribution (CVSS 9.3, openmeter)
- [CVE-2026-18770](https://cve.now/CVE-2026-18770.md): vibesurf-ai VibeSurf Python Validation code code injection (CVSS 6.9, vibesurf-ai VibeSurf)
- [CVE-2026-68494](https://cve.now/CVE-2026-68494.md): jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq) (CVSS 8.7, FasterXML jackson-core · com.fasterxml.jackson.core:jack… +1)
- [CVE-2026-67618](https://cve.now/CVE-2026-67618.md): marimo \< 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata (CVSS 7.1, marimo-team marimo)
- [CVE-2026-69251](https://cve.now/CVE-2026-69251.md): Flowise RCE via TypeORM DataSource (CVSS 9.0, FlowiseAI Flowise · FlowiseAI flowise-components +2)
- [CVE-2026-11368](https://cve.now/CVE-2026-11368.md): Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer (CVSS 7.1, zephyrproject zephyr)
- [CVE-2026-18401](https://cve.now/CVE-2026-18401.md): jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service (CVSS 6.9, FasterXML jackson-core · tools.jackson.core:jackson-core +1)
- [CVE-2026-69250](https://cve.now/CVE-2026-69250.md): Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration (CVSS 8.5, FlowiseAI Flowise · flowise)
- [CVE-2026-18766](https://cve.now/CVE-2026-18766.md): chetans9 core-php-admin-panel customers.php sql injection (CVSS 5.3, chetans9 core-php-admin-panel)
- [CVE-2026-67200](https://cve.now/CVE-2026-67200.md): Perspective 5.0.0 Path Traversal via cwd\_static\_file\_handler (CVSS 8.7, perspective-dev perspective)
- [CVE-2026-67199](https://cve.now/CVE-2026-67199.md): Perspective 5.0.0 DoS via Loop Expression Evaluation (CVSS 7.1, perspective-dev perspective)
- [CVE-2026-67198](https://cve.now/CVE-2026-67198.md): Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher (CVSS 8.7, perspective-dev perspective)
- [CVE-2026-67196](https://cve.now/CVE-2026-67196.md): Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation (CVSS 5.1, perspective-dev perspective)
- [CVE-2026-67195](https://cve.now/CVE-2026-67195.md): Perspective 5.0.0 RCE via eval() Expression Injection (CVSS 8.7, perspective-dev perspective)
- [CVE-2026-18650](https://cve.now/CVE-2026-18650.md): Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS (CVSS 8.8, HAVELSAN Liman MYS)
- [CVE-2026-61514](https://cve.now/CVE-2026-61514.md): Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456 (CVSS 9.3, Puwell Technology IP Camera)
- [CVE-2026-61515](https://cve.now/CVE-2026-61515.md): Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell (CVSS 9.3, Puwell Technology IP Camera)
- [CVE-2026-70368](https://cve.now/CVE-2026-70368.md): Stunnel: stack-based out-of-bounds read/write in stunnel s\_vlog via oversized log message (CVSS 6.5, Mobi-Com Polska Sp. z o.o. stunnel · Red Hat Enterprise Lin…)
- [CVE-2026-70367](https://cve.now/CVE-2026-70367.md): Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services (CVSS 5.4, Mobi-Com Polska Sp. z o.o. stunnel · Red Hat Enterprise Lin…)
- [CVE-2026-14337](https://cve.now/CVE-2026-14337.md): Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role. (CVSS 4.6, Pegasystems Pega Infinity)
- [CVE-2026-17070](https://cve.now/CVE-2026-17070.md): Vault Credential Confusion via Authorization Bypass in HAVELSAN's Liman MYS (CVSS 8.8, HAVELSAN Liman MYS)
- [CVE-2026-70373](https://cve.now/CVE-2026-70373.md): Koha - SQL Injection in reports/issues\_stats.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-70372](https://cve.now/CVE-2026-70372.md): Koha - SQL Injection in reports/bor\_issues\_top.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-70371](https://cve.now/CVE-2026-70371.md): Koha - SQL Injection in reports/issues\_avg\_stats.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-70370](https://cve.now/CVE-2026-70370.md): Koha - SQL Injection in reports/catalogue\_stats.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-70369](https://cve.now/CVE-2026-70369.md): Koha - SQL Injection in reports/acquisitions\_stats.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-10710](https://cve.now/CVE-2026-10710.md): FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK (CVSS 7.8, Autodesk FBX SDK)
- [CVE-2026-10709](https://cve.now/CVE-2026-10709.md): FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK (CVSS 7.8, Autodesk FBX SDK)
- [CVE-2026-18806](https://cve.now/CVE-2026-18806.md): Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer (CVSS 7.1, TÜBİTAK BİLGEM Software Technologies Research Institute par…)
- [CVE-2026-18809](https://cve.now/CVE-2026-18809.md): Information disclosure in Firefox for Android and Firefox Focus for Android (CVSS 6.5, Mozilla Firefox)
- [CVE-2026-63248](https://cve.now/CVE-2026-63248.md): In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. (CVSS 6.9, Eclipse Foundation Eclipse Milo)
- [CVE-2026-58080](https://cve.now/CVE-2026-58080.md): In Eclipse Milo versions 1.0.0 through 1.1.4, \`OpcUaServerConfig.copy()\` fails to preserve a configured \`RoleMapper\`. (CVSS 8.8, Eclipse Foundation Eclipse Milo)
- [CVE-2026-63252](https://cve.now/CVE-2026-63252.md): In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel (CVSS 8.7, Eclipse Foundation Eclipse Milo)
- [CVE-2026-62927](https://cve.now/CVE-2026-62927.md): In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculati (CVSS 8.7, Eclipse Foundation Eclipse Milo)
- [CVE-2026-60007](https://cve.now/CVE-2026-60007.md): In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a (CVSS 9.1, Eclipse Foundation Eclipse Milo)
- [CVE-2026-61387](https://cve.now/CVE-2026-61387.md): In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecke (CVSS 6.9, Eclipse Foundation Eclipse Milo)
- [CVE-2026-66883](https://cve.now/CVE-2026-66883.md): Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup (CVSS 6.3, Erlang Ecosystem Foundation oidcc\_plug)
- [CVE-2026-66884](https://cve.now/CVE-2026-66884.md): Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection (CVSS 2.1, Erlang Ecosystem Foundation oidcc\_plug)
- [CVE-2026-10050](https://cve.now/CVE-2026-10050.md): Digest authentication lossy encoding (CVSS 8.7, Eclipse Foundation Eclipse Jetty - EE8 · Eclipse Foundat… +4)
- [CVE-2026-14202](https://cve.now/CVE-2026-14202.md): Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources (CVSS 5.3, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14465](https://cve.now/CVE-2026-14465.md): Session Fixation in Bilin Software's HUMANIST Digital Human Resources (CVSS 6.5, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14192](https://cve.now/CVE-2026-14192.md): Stored XSS in Bilin Software's HUMANIST Digital Human Resources (CVSS 5.4, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14838](https://cve.now/CVE-2026-14838.md): Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources (CVSS 7.4, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14804](https://cve.now/CVE-2026-14804.md): Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources (CVSS 9.1, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14219](https://cve.now/CVE-2026-14219.md): URL Redirection in Bilin Software's HUMANIST Digital Human Resources (CVSS 5.4, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14194](https://cve.now/CVE-2026-14194.md): Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources (CVSS 6.5, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-14175](https://cve.now/CVE-2026-14175.md): Unrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources (CVSS 9.8, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-18772](https://cve.now/CVE-2026-18772.md): Improperly controlled sequential memory allocation vulnerability in Samsung Open Source rlottie allows Exponential Data Expansion. (CVSS 6.5, Samsung Open Source rlottie)
- [CVE-2026-15721](https://cve.now/CVE-2026-15721.md): Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources (CVSS 9.8, Bilin Software and Informatics Consultancy HUMANIST Digital…)
- [CVE-2026-18759](https://cve.now/CVE-2026-18759.md): An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync. (CVSS 8.5, ASUSTOR ABP · ASUSTOR AES)
- [CVE-2026-18755](https://cve.now/CVE-2026-18755.md): GV-ASManager DLL hijacking vulnerability (CVSS 7.3, GeoVision GV-ASManager)
- [CVE-2026-18754](https://cve.now/CVE-2026-18754.md): Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud) (CVSS 9.1, GeoVision GV-AS1620)
- [CVE-2026-18753](https://cve.now/CVE-2026-18753.md): Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager) (CVSS 9.1, GeoVision GV-AS1620)
- [CVE-2026-67243](https://cve.now/CVE-2026-67243.md): freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. (CVSS 7.2, refirio freo2)
- [CVE-2026-64565](https://cve.now/CVE-2026-64565.md): Input: ims-pcu - fix heap-buffer-overflow in ims\_pcu\_process\_data() (no CVSS, Linux)
- [CVE-2026-64564](https://cve.now/CVE-2026-64564.md): sctp: don't free the ASCONF's own transport in DEL-IP processing (CVSS 9.8, Linux)
- [CVE-2026-64563](https://cve.now/CVE-2026-64563.md): rhashtable: clear stale iter-\>p on table restart (CVSS 7.8, Linux)
- [CVE-2026-64562](https://cve.now/CVE-2026-64562.md): KVM: nVMX: Hide shadow VMCS right after VMCLEAR (CVSS 8.8, Linux)
- [CVE-2026-64561](https://cve.now/CVE-2026-64561.md): KVM: x86: Check for invalid/obsolete root \*after\* making MMU pages available (CVSS 8.8, Linux)
- [CVE-2026-16548](https://cve.now/CVE-2026-16548.md): Bit Assist \< 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint (CVSS 6.5, Chat Widget: Floating Customer Support Button for 30+ Chann…)
- [CVE-2026-16547](https://cve.now/CVE-2026-16547.md): REST API Log \< 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint (CVSS 5.9, REST API Log)
- [CVE-2026-16546](https://cve.now/CVE-2026-16546.md): Wired Impact Volunteer Management \< 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm\_remove\_rsvp (CVSS 4.3, Wired Impact Volunteer Management)
- [CVE-2026-16296](https://cve.now/CVE-2026-16296.md): Clearfy \< 2.4.3 - Open Redirect via Cyrlitera 404 Handler (CVSS 4.7, Clearfy Cache)
- [CVE-2026-16295](https://cve.now/CVE-2026-16295.md): Clearfy \< 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher (CVSS 4.3, Clearfy Cache)
- [CVE-2026-16293](https://cve.now/CVE-2026-16293.md): Blubrry PowerPress \< 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL (CVSS 6.8, PowerPress Podcasting plugin by Blubrry)
- [CVE-2026-16070](https://cve.now/CVE-2026-16070.md): Brizy - Page Builder \< 2.8.19 - Contributor+ Template Type Update via IDOR (CVSS 2.7, Brizy)
- [CVE-2026-16069](https://cve.now/CVE-2026-16069.md): Brizy - Page Builder \< 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point (CVSS 6.8, Brizy)
- [CVE-2026-16068](https://cve.now/CVE-2026-16068.md): Brizy - Page Builder \< 2.8.19 - Author+ Stored XSS via brizy\_set\_project Global Project Code Asset (CVSS 3.5, Brizy)
- [CVE-2026-16056](https://cve.now/CVE-2026-16056.md): Contest Gallery \< 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post\_cg\_get\_openai\_prompts (CVSS 4.3, Contest Gallery)
- [CVE-2026-16035](https://cve.now/CVE-2026-16035.md): miniOrange 2FA \< 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send (CVSS 4.3, miniOrange 2FA)
- [CVE-2026-15958](https://cve.now/CVE-2026-15958.md): Easy Dropbox Integration \< 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX (CVSS 9.3, Easy Integration for Dropbox)
- [CVE-2026-15233](https://cve.now/CVE-2026-15233.md): Nested Pages \< 3.2.15 - Editor+ Stored XSS via Post Title (CVSS 4.8, Nested Pages)
- [CVE-2026-14939](https://cve.now/CVE-2026-14939.md): Visualizer: Tables and Charts Manager \< 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import (CVSS 6.8, Visualizer)
- [CVE-2026-14872](https://cve.now/CVE-2026-14872.md): Database for Contact Form 7, WPforms, Elementor forms \< 1.5.5 - Authenticated SQL Injection via id Parameter (CVSS 6.8, Database for Contact Form 7, WPforms, Elementor forms)
- [CVE-2026-14848](https://cve.now/CVE-2026-14848.md): Paid Member Subscriptions \< 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process\_checkout (CVSS 5.4, Paid Membership Subscriptions)
- [CVE-2026-14824](https://cve.now/CVE-2026-14824.md): Quiz And Survey Master \< 11.2.2 - Contributor+ Stored XSS via Polar Question (CVSS 4.8, Quiz and Survey Master)
- [CVE-2026-14816](https://cve.now/CVE-2026-14816.md): The GDPR Framework \< 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam (CVSS 6.5, The GDPR Framework By Data443)
- [CVE-2026-12698](https://cve.now/CVE-2026-12698.md): wpForo Forum \< 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment (CVSS 4.3, wpForo Forum)
- [CVE-2026-11366](https://cve.now/CVE-2026-11366.md): MonsterInsights \< 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass (CVSS 3.7, MonsterInsights)
- [CVE-2026-10526](https://cve.now/CVE-2026-10526.md): EmbedPress \< 4.6.1 - Unauthenticated Blind SSRF (CVSS 5.8, EmbedPress)
- [CVE-2026-16536](https://cve.now/CVE-2026-16536.md): Simple Google Calendar Outlook Events Widget \< 3.1.0 - Unauthenticated SSRF via calendar\_id (CVSS 5.3, Simple Google Calendar Outlook Events Widget)
- [CVE-2026-16623](https://cve.now/CVE-2026-16623.md): Create Block Theme \< 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) (CVSS 8.0, Create Block Theme)
- [CVE-2026-16618](https://cve.now/CVE-2026-16618.md): ImproveSEO \<= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution (CVSS 9.8, Improve SEO)
- [CVE-2026-18739](https://cve.now/CVE-2026-18739.md): Popt-devel: popt-static: off-by-one in poptstuffargs (CVSS 2.5, rpm-software-management popt · Red Hat Hardened Images +2)
- [CVE-2026-68744](https://cve.now/CVE-2026-68744.md): Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply (CVSS 3.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-18569](https://cve.now/CVE-2026-18569.md): Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens (CVSS 3.7, Red Hat Build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16881](https://cve.now/CVE-2026-16881.md): A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. (CVSS 8.7, LY LINE client for Android)
- [CVE-2026-42169](https://cve.now/CVE-2026-42169.md): Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c) (CVSS 7.3, Red Hat Enterprise Linux)
- [CVE-2026-18723](https://cve.now/CVE-2026-18723.md): diaowen DWSurvey Survey Status up-survey-status.do improper authorization (CVSS 5.3, diaowen DWSurvey)
- [CVE-2026-18722](https://cve.now/CVE-2026-18722.md): diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization (CVSS 5.3, diaowen DWSurvey)
- [CVE-2026-18721](https://cve.now/CVE-2026-18721.md): kalcaddle kodbox SSO API Login apiLogin redirect (CVSS 5.3, kalcaddle kodbox)
- [CVE-2026-14818](https://cve.now/CVE-2026-14818.md): A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 throu (CVSS 7.2, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2)
- [CVE-2026-17614](https://cve.now/CVE-2026-17614.md): Wildfly-core: path traversal on wildfly domain controller (CVSS 4.4, Red Hat JBoss Enterprise Application Platform · Red Hat Sin…)
- [CVE-2026-8508](https://cve.now/CVE-2026-8508.md): An improper authentication vulnerability in the "social\_login.cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 cou (CVSS 6.5, Zyxel WAX650S firmware)
- [CVE-2026-6837](https://cve.now/CVE-2026-6837.md): A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10(ABRM.4 (CVSS 7.2, Zyxel WAX650S firmware)
- [CVE-2026-18720](https://cve.now/CVE-2026-18720.md): kalcaddle kodbox msgWarning Plugin action improper authorization (CVSS 6.9, kalcaddle kodbox)
- [CVE-2026-18719](https://cve.now/CVE-2026-18719.md): cemtan sar2html Search sar2html.py sql injection (CVSS 5.3, cemtan sar2html)
- [CVE-2026-58042](https://cve.now/CVE-2026-58042.md): A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. (CVSS 5.9, nodejs node)
- [CVE-2026-56846](https://cve.now/CVE-2026-56846.md): A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. (CVSS 7.5, nodejs node)
- [CVE-2026-58044](https://cve.now/CVE-2026-58044.md): A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from (CVSS 3.7, nodejs node)
- [CVE-2026-58045](https://cve.now/CVE-2026-58045.md): A flaw in Node.js allows a spoofed \`TypedArray\` \`byteLength\` to trigger a reachable assertion in the synchronous \`node:zlib\` APIs, causing t (CVSS 6.2, nodejs node)
- [CVE-2026-58041](https://cve.now/CVE-2026-58041.md): A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cac (CVSS 5.3, nodejs node)
- [CVE-2026-56845](https://cve.now/CVE-2026-56845.md): An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. (CVSS 7.5, Rocket.Chat)
- [CVE-2026-11835](https://cve.now/CVE-2026-11835.md): Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU) (CVSS 5.6, Caliptra Core ROM)
- [CVE-2026-11836](https://cve.now/CVE-2026-11836.md): Production Debug-Unlock Token Verification Missing Device Binding (CVSS 1.8, Caliptra Core ROM · Caliptra Core Firmware)
- [CVE-2026-18686](https://cve.now/CVE-2026-18686.md): GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add\_user command injection (CVSS 9.3, GL.iNet GL-MT3000)
- [CVE-2025-29296](https://cve.now/CVE-2025-29296.md): H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R (CVSS 9.8)
- [CVE-2026-51144](https://cve.now/CVE-2026-51144.md): Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary (CVSS 6.1)
- [CVE-2026-51400](https://cve.now/CVE-2026-51400.md): An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms\_fixfilename() function within fi (CVSS 8.4)
- [CVE-2026-51401](https://cve.now/CVE-2026-51401.md): An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms\_fixfilename() function within fi (CVSS 7.7)
- [CVE-2026-52370](https://cve.now/CVE-2026-52370.md): A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascr (CVSS 6.1)
- [CVE-2026-67855](https://cve.now/CVE-2026-67855.md): open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA\_ENABLE\_GDS\_PUSHMANAGEMENT is enabled. (CVSS 7.5)
- [CVE-2026-67856](https://cve.now/CVE-2026-67856.md): An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitor (CVSS 7.5)
- [CVE-2026-67857](https://cve.now/CVE-2026-67857.md): open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/client/ua\_client\_connect.c. (CVSS 7.5)
- [CVE-2026-67858](https://cve.now/CVE-2026-67858.md): Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled thro (CVSS 7.5)
- [CVE-2026-67859](https://cve.now/CVE-2026-67859.md): Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling. (CVSS 7.5)
- [CVE-2026-67860](https://cve.now/CVE-2026-67860.md): open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the mem (CVSS 7.5)
- [CVE-2026-67861](https://cve.now/CVE-2026-67861.md): An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA\_Client\_getRemoteDataTypes componen (CVSS 7.5)
- [CVE-2026-67862](https://cve.now/CVE-2026-67862.md): open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua\_client\_highlevel.c. (CVSS 7.5)
- [CVE-2026-67979](https://cve.now/CVE-2026-67979.md): Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute a (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.