# CVEs published 2026-08-05

429 CVEs were published on August 5, 2026: 53 critical, 206 high. Days are UTC.

- [CVE-2026-18970](https://cve.now/CVE-2026-18970.md): Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2026-18969](https://cve.now/CVE-2026-18969.md): Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload (CVSS 6.9, Rongzhitong Visual Integrated Command and Dispatch Platform)
- [CVE-2026-19028](https://cve.now/CVE-2026-19028.md): HDF5 integer underflow in Fletcher32 filter leads to massive out-of-bounds read (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-19027](https://cve.now/CVE-2026-19027.md): HDF5 out-of-bounds heap read in N-Bit filter decompression (CVSS 6.9, The HDF Group HDF5)
- [CVE-2026-18968](https://cve.now/CVE-2026-18968.md): ttttonyhe OBlog tags.php cross site scripting (CVSS 5.3, ttttonyhe OBlog)
- [CVE-2026-67531](https://cve.now/CVE-2026-67531.md): FrontMCP: CodeCall sandbox escape -\> host RCE via live Zod schema exposure by getTool (CVSS 9.3, agentfront frontmcp)
- [CVE-2026-19026](https://cve.now/CVE-2026-19026.md): Nbit filter NULL/short parameter-array dereference (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-19025](https://cve.now/CVE-2026-19025.md): HDF5 divide-by-zero (SIGFPE) via mismatched chunk-layout dimensionality and dataspace rank on dataset open (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-19024](https://cve.now/CVE-2026-19024.md): HDF5 H5Pget\_fill\_value NULL Pointer Dereference via Malformed Fill Value Message (CVSS 8.2, The HDF Group HDF5)
- [CVE-2026-19023](https://cve.now/CVE-2026-19023.md): HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets (CVSS 6.8, The HDF Group HDF5)
- [CVE-2026-71321](https://cve.now/CVE-2026-71321.md): Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation (CVSS 7.5, nuxt)
- [CVE-2026-71320](https://cve.now/CVE-2026-71320.md): Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props (CVSS 8.1, nuxt)
- [CVE-2026-71319](https://cve.now/CVE-2026-71319.md): Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution (CVSS 9.6, nuxt devtools · @nuxt/devtools)
- [CVE-2026-71318](https://cve.now/CVE-2026-71318.md): Nuxt: Unauthorized Component Instantiation via Server Island Props (CVSS 4.8, nuxt)
- [CVE-2026-71316](https://cve.now/CVE-2026-71316.md): Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients (CVSS 7.5, nuxt)
- [CVE-2026-71315](https://cve.now/CVE-2026-71315.md): Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) (CVSS 8.2, nuxt)
- [CVE-2026-71314](https://cve.now/CVE-2026-71314.md): Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering (CVSS 7.5, nuxt)
- [CVE-2026-71313](https://cve.now/CVE-2026-71313.md): rclone: Local Encoding Path Traversal (CVSS 6.9, rclone · github.com/rclone/rclone)
- [CVE-2026-18839](https://cve.now/CVE-2026-18839.md): Popt-devel: popt-static: size\_t underflow in singleoptionhelp (CVSS 2.2, rpm-software-management popt · Red Hat Hardened Images +2)
- [CVE-2026-71312](https://cve.now/CVE-2026-71312.md): rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution (CVSS 8.0, rclone · github.com/rclone/rclone)
- [CVE-2026-71311](https://cve.now/CVE-2026-71311.md): rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines (CVSS 6.4, rclone · github.com/rclone/rclone)
- [CVE-2026-34966](https://cve.now/CVE-2026-34966.md): Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass (CVSS 8.3, Gitea · code.gitea.io/gitea +1)
- [CVE-2026-17583](https://cve.now/CVE-2026-17583.md): Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check (CVSS 8.4, Thermo Fisher Applied Biosystems 3500/3500xL Series Data… +6)
- [CVE-2026-71310](https://cve.now/CVE-2026-71310.md): rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory (CVSS 5.9, rclone · github.com/rclone/rclone)
- [CVE-2026-18959](https://cve.now/CVE-2026-18959.md): yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal (CVSS 5.3, yushine InnoShop)
- [CVE-2026-71309](https://cve.now/CVE-2026-71309.md): rclone: Incomplete path validation allows backend root escape in serve restic (CVSS 8.6, rclone · github.com/rclone/rclone)
- [CVE-2026-18411](https://cve.now/CVE-2026-18411.md): Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100 (CVSS 7.2, Acrisure KARR BT · Acrisure DR-100)
- [CVE-2026-15996](https://cve.now/CVE-2026-15996.md): Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters (CVSS 6.6, GitHub Enterprise Server)
- [CVE-2026-21766](https://cve.now/CVE-2026-21766.md): HCL Digital Experience and Digital Experience Compose insufficiently protects credentials (CVSS 5.4, HCLSoftware HCL Digital Experience and Digital Experience C…)
- [CVE-2026-18954](https://cve.now/CVE-2026-18954.md): Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server (CVSS 5.5, AWS documentdb-mcp-server)
- [CVE-2026-17556](https://cve.now/CVE-2026-17556.md): Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header (CVSS 8.8, GitHub Enterprise Server)
- [CVE-2026-18958](https://cve.now/CVE-2026-18958.md): imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection (CVSS 6.9, imranrisal-dev Student-Management-System)
- [CVE-2026-55524](https://cve.now/CVE-2026-55524.md): PraisonAI: SSRF in web\_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) (CVSS 7.5, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-70618](https://cve.now/CVE-2026-70618.md): Spacebar Server Missing Authorization via member-ids Endpoint (CVSS 5.3, Spacebar Server)
- [CVE-2026-70617](https://cve.now/CVE-2026-70617.md): Spacebar Server Missing Authorization via Group DM Recipient Endpoint (CVSS 8.6, Spacebar Server)
- [CVE-2026-66885](https://cve.now/CVE-2026-66885.md): Livebook Teams identity callback lacks state binding, allowing login CSRF (CVSS 6.8, livebook-dev livebook)
- [CVE-2026-66298](https://cve.now/CVE-2026-66298.md): JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts (CVSS 8.6, livebook-dev livebook)
- [CVE-2026-66297](https://cve.now/CVE-2026-66297.md): Unescaped deployment environment variables in generated setup commands (CVSS 5.0, livebook-dev livebook)
- [CVE-2026-66881](https://cve.now/CVE-2026-66881.md): Path traversal in imported file\_entries name allows arbitrary file write via URL-type entry download (CVSS 7.0, livebook-dev livebook)
- [CVE-2026-68746](https://cve.now/CVE-2026-68746.md): Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access (CVSS 7.7, livebook-dev livebook)
- [CVE-2026-70616](https://cve.now/CVE-2026-70616.md): boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint (CVSS 7.1, boringproxy)
- [CVE-2026-70615](https://cve.now/CVE-2026-70615.md): boringproxy 0.10.0 SSH authorized\_keys Injection via Tunnel Creation (CVSS 8.5, boringproxy)
- [CVE-2026-18953](https://cve.now/CVE-2026-18953.md): Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server (CVSS 8.6, aws-transform-mcp-server)
- [CVE-2026-55523](https://cve.now/CVE-2026-55523.md): PraisonAI has a\`web\_crawl\` SSRF protection bypass via unchecked redirect targets (CVSS 7.7, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-69111](https://cve.now/CVE-2026-69111.md): Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop (CVSS 8.7, milvus-io milvus)
- [CVE-2026-55522](https://cve.now/CVE-2026-55522.md): PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code (CVSS 7.8, MervinPraison PraisonAI · MervinPraison praisonaiagents +2)
- [CVE-2026-18485](https://cve.now/CVE-2026-18485.md): Local Privilege Escalation in NI-PAL (CVSS 8.5, NI-PAL)
- [CVE-2026-17624](https://cve.now/CVE-2026-17624.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-17633](https://cve.now/CVE-2026-17633.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-17632](https://cve.now/CVE-2026-17632.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-48168](https://cve.now/CVE-2026-48168.md): PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name (CVSS 10.0, MervinPraison PraisonAI)
- [CVE-2026-9196](https://cve.now/CVE-2026-9196.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-8182](https://cve.now/CVE-2026-8182.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-9201](https://cve.now/CVE-2026-9201.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-8478](https://cve.now/CVE-2026-8478.md): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-8183](https://cve.now/CVE-2026-8183.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 7.7, IBM Langflow OSS)
- [CVE-2026-7658](https://cve.now/CVE-2026-7658.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-9130](https://cve.now/CVE-2026-9130.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-10547](https://cve.now/CVE-2026-10547.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 5.9, IBM Langflow OSS)
- [CVE-2026-7869](https://cve.now/CVE-2026-7869.md): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-8470](https://cve.now/CVE-2026-8470.md): Langflow is affected by weaknesses in secret handling and sensitive configuration access (CVSS 7.4, IBM Langflow OSS)
- [CVE-2026-63457](https://cve.now/CVE-2026-63457.md): A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. (CVSS 6.5, Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out)
- [CVE-2026-9205](https://cve.now/CVE-2026-9205.md): Langflow is affected by weaknesses in secret handling and sensitive configuration access (CVSS 7.4, IBM Langflow OSS · langflow)
- [CVE-2026-70612](https://cve.now/CVE-2026-70612.md): Electron: Sandboxed iframes can launch external protocol handlers (CVSS 5.4, electron)
- [CVE-2026-70611](https://cve.now/CVE-2026-70611.md): Electron: DevTools embedder handler executes arbitrary files via shell open (CVSS 6.9, electron)
- [CVE-2026-10128](https://cve.now/CVE-2026-10128.md): Langflow is affected by weaknesses in secret handling and sensitive configuration access (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-70610](https://cve.now/CVE-2026-70610.md): Electron: contextBridge object copy honors prototype setters (CVSS 5.4, electron)
- [CVE-2026-70448](https://cve.now/CVE-2026-70448.md): Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy (CVSS 7.1, Jenkins Project Jenkins Ivy Report Plugin)
- [CVE-2026-70447](https://cve.now/CVE-2026-70447.md): Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credent (CVSS 4.3, Jenkins Project Jenkins AWS CodeBuild Plugin)
- [CVE-2026-70446](https://cve.now/CVE-2026-70446.md): Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credential (CVSS 4.3, Jenkins Project Jenkins CodeSonar Plugin)
- [CVE-2026-70445](https://cve.now/CVE-2026-70445.md): Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate crede (CVSS 4.3, Jenkins Project Jenkins Sauce OnDemand Plugin)
- [CVE-2026-70444](https://cve.now/CVE-2026-70444.md): A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission t (CVSS 4.3, Jenkins Project Jenkins Violation Comments to GitLab Plugin)
- [CVE-2026-70443](https://cve.now/CVE-2026-70443.md): Jenkins Horreum Plugin 0.16.162.v33b\_4a\_a\_b\_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attacker (CVSS 4.3, Jenkins Project Jenkins Horreum Plugin)
- [CVE-2026-70442](https://cve.now/CVE-2026-70442.md): Jenkins Google Chat Notification Plugin 166.ve6b\_de280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing (CVSS 4.3, Jenkins Project Jenkins Google Chat Notification Plugin)
- [CVE-2026-70441](https://cve.now/CVE-2026-70441.md): Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a s (CVSS 5.4, Jenkins Project Jenkins Summary Display Plugin)
- [CVE-2026-70440](https://cve.now/CVE-2026-70440.md): Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, (CVSS 5.4, Jenkins Project Jenkins Qualys Container Scanning Connector…)
- [CVE-2026-70439](https://cve.now/CVE-2026-70439.md): Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions (CVSS 6.5, Jenkins Project Jenkins XML Job to Job DSL Plugin)
- [CVE-2026-70438](https://cve.now/CVE-2026-70438.md): A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to (CVSS 4.3, Jenkins Project Jenkins Parameterized Remote Trigger Plugin)
- [CVE-2026-70437](https://cve.now/CVE-2026-70437.md): Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa\_f0215cf5 and earlier does not use a constant-time comparison function when check (CVSS 3.7, Jenkins Project Jenkins Webhook Secret Credentials Provider…)
- [CVE-2026-70436](https://cve.now/CVE-2026-70436.md): Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper (CVSS 4.3, Jenkins Project Jenkins External Workspace Manager Plugin)
- [CVE-2026-70435](https://cve.now/CVE-2026-70435.md): A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an a (CVSS 4.2, Jenkins Project Jenkins SCM-Manager Plugin)
- [CVE-2026-70434](https://cve.now/CVE-2026-70434.md): A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacke (CVSS 4.2, Jenkins Project Jenkins SCM-Manager Plugin)
- [CVE-2026-70433](https://cve.now/CVE-2026-70433.md): Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credenti (CVSS 4.3, Jenkins Project Jenkins HCL AppScan Plugin)
- [CVE-2026-70432](https://cve.now/CVE-2026-70432.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier allows attackers to execute arb (CVSS 8.8, Jenkins Project Jenkins Multijob Plugin)
- [CVE-2026-70431](https://cve.now/CVE-2026-70431.md): Jenkins Multijob Plugin 669.v9d96a\_d9c71b\_0 and earlier provides Groovy scripting features that do not integrate with Script Security Plugin (CVSS 8.8, Jenkins Project Jenkins Multijob Plugin)
- [CVE-2026-70430](https://cve.now/CVE-2026-70430.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project na (CVSS 2.7, Jenkins Project Jenkins)
- [CVE-2026-70429](https://cve.now/CVE-2026-70429.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attacke (CVSS 8.1, Jenkins Project Jenkins)
- [CVE-2026-70428](https://cve.now/CVE-2026-70428.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allow (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-70427](https://cve.now/CVE-2026-70427.md): Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-70426](https://cve.now/CVE-2026-70426.md): In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, (CVSS 9.0, Jenkins Project Jenkins · Jenkins Project Remoting)
- [CVE-2026-9081](https://cve.now/CVE-2026-9081.md): Langflow OSS is affected by server-side request forgery in provider validation and API request functionality (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-7657](https://cve.now/CVE-2026-7657.md): Langflow OSS is affected by server-side request forgery in provider validation and API request functionality (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-70609](https://cve.now/CVE-2026-70609.md): Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (CVSS 5.7, electron)
- [CVE-2026-44605](https://cve.now/CVE-2026-44605.md): Rpm: heap buffer overflow in ndb slot table parsing (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-70608](https://cve.now/CVE-2026-70608.md): Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path (CVSS 7.2, electron)
- [CVE-2026-17625](https://cve.now/CVE-2026-17625.md): Langflow is affected by OS Command Injection in Model Context Protocol features (CVSS 7.2, IBM Langflow OSS)
- [CVE-2026-10716](https://cve.now/CVE-2026-10716.md): Directus \<12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation (CVSS 7.5, Directus)
- [CVE-2026-17623](https://cve.now/CVE-2026-17623.md): Langflow is affected OS Command Injection in Model Context Protocol features (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-17630](https://cve.now/CVE-2026-17630.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 7.2, IBM Langflow OSS)
- [CVE-2026-20313](https://cve.now/CVE-2026-20313.md): Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerabilities (CVSS 7.7, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20311](https://cve.now/CVE-2026-20311.md): Cisco IOS XE Software Web UI Denial of Service Vulnerability (CVSS 6.3, Cisco IOS XE Software)
- [CVE-2026-20289](https://cve.now/CVE-2026-20289.md): Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability (CVSS 5.7, Cisco RoomOS Software)
- [CVE-2026-17626](https://cve.now/CVE-2026-17626.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-20312](https://cve.now/CVE-2026-20312.md): Cisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vulnerabilities (CVSS 8.8, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20310](https://cve.now/CVE-2026-20310.md): Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access (CVSS 9.1, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-18927](https://cve.now/CVE-2026-18927.md): imranrisal-dev Student-Management-System Shared Upload Helper student\_profile\_pic.php storeProfileImage unrestricted upload (CVSS 5.3, imranrisal-dev Student-Management-System)
- [CVE-2026-20303](https://cve.now/CVE-2026-20303.md): Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities (CVSS 9.9, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20294](https://cve.now/CVE-2026-20294.md): Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability (CVSS 6.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2026-20301](https://cve.now/CVE-2026-20301.md): Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software · Cisco IOS)
- [CVE-2026-20288](https://cve.now/CVE-2026-20288.md): Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability (CVSS 6.5, Cisco Enterprise NFV Infrastructure Software · Cisco Unifie…)
- [CVE-2026-8446](https://cve.now/CVE-2026-8446.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-7646](https://cve.now/CVE-2026-7646.md): Langflow is affected by security vulnerabilities in Model Context Protocol features (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-9077](https://cve.now/CVE-2026-9077.md): Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-70607](https://cve.now/CVE-2026-70607.md): Electron: window.open features string controls some window options considered privileged (CVSS 5.3, electron)
- [CVE-2026-20308](https://cve.now/CVE-2026-20308.md): Cisco IOS XE Software Web-Based Management Interface Vulnerability (CVSS 4.3, Cisco IOS XE Software)
- [CVE-2026-20304](https://cve.now/CVE-2026-20304.md): Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabilities (CVSS 9.9, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-20273](https://cve.now/CVE-2026-20273.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20272](https://cve.now/CVE-2026-20272.md): Cisco IOS XE Software Security Hardening Release (CVSS 9.8, Cisco IOS XE Software)
- [CVE-2026-20271](https://cve.now/CVE-2026-20271.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20270](https://cve.now/CVE-2026-20270.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20269](https://cve.now/CVE-2026-20269.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20268](https://cve.now/CVE-2026-20268.md): Cisco IOS XE Software Security Hardening Release (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20267](https://cve.now/CVE-2026-20267.md): Cisco IOS XE Software Security Hardening Release (CVSS 9.0, Cisco IOS XE Software)
- [CVE-2026-20263](https://cve.now/CVE-2026-20263.md): Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2026-20200](https://cve.now/CVE-2026-20200.md): Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2026-17617](https://cve.now/CVE-2026-17617.md): Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator (CVSS 8.5, IBM Application Gateway Operator)
- [CVE-2026-20124](https://cve.now/CVE-2026-20124.md): Cisco IOS XE Software SNMP Denial of Service Vulnerability (CVSS 7.7, Cisco IOS XE Software)
- [CVE-2026-20198](https://cve.now/CVE-2026-20198.md): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Enterprise NFV Infrastructure Software · Cisco Unifie…)
- [CVE-2026-20028](https://cve.now/CVE-2026-20028.md): Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability (CVSS 5.0, Cisco Terminal Services Agent)
- [CVE-2026-14587](https://cve.now/CVE-2026-14587.md): Unathenticated connection can hold Bolt channel open (CVSS 5.5, neo4j Enterprise Edition · neo4j Community Edition)
- [CVE-2026-70606](https://cve.now/CVE-2026-70606.md): Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (CVSS 5.9, electron)
- [CVE-2026-15656](https://cve.now/CVE-2026-15656.md): IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret (CVSS 4.3, IBM Maximo Application Suite)
- [CVE-2026-18531](https://cve.now/CVE-2026-18531.md): IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret (CVSS 5.3, IBM Maximo Application Suite)
- [CVE-2026-70605](https://cve.now/CVE-2026-70605.md): Electron: HTTP redirect followed into local file loader (CVSS 5.9, electron)
- [CVE-2026-10025](https://cve.now/CVE-2026-10025.md): IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability (CVSS 8.2, IBM QRadar)
- [CVE-2026-70604](https://cve.now/CVE-2026-70604.md): Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (CVSS 7.4, electron)
- [CVE-2026-13477](https://cve.now/CVE-2026-13477.md): IBM QRadar SIEM is vulnerable to remote code execution by privileged users (CVSS 4.7, IBM QRadar)
- [CVE-2026-8400](https://cve.now/CVE-2026-8400.md): Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU (CVSS 8.1, IBM WebSphere Application Server)
- [CVE-2026-12730](https://cve.now/CVE-2026-12730.md): Improper Validation of Certificate with Host Mismatch in IBM Business Automation Workflow containers (CVSS 3.8, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-70603](https://cve.now/CVE-2026-70603.md): Electron: shell.openPath path validation bypass via embedded null byte (CVSS 6.0, electron)
- [CVE-2026-70602](https://cve.now/CVE-2026-70602.md): Electron: Extension tab APIs operate across session boundaries (CVSS 6.6, electron)
- [CVE-2026-12762](https://cve.now/CVE-2026-12762.md): Insertion of Sensitive Information into Externally-Accessible File in IBM Business Automation Insights (CVSS 5.3, IBM Cloud Pak For Business Automation)
- [CVE-2026-70601](https://cve.now/CVE-2026-70601.md): Electron: Context isolation bypass via Function.prototype.bind hijack (CVSS 7.5, electron)
- [CVE-2026-70600](https://cve.now/CVE-2026-70600.md): Electron: Cross-origin iframe can position native autofill popup (CVSS 3.1, electron)
- [CVE-2026-9203](https://cve.now/CVE-2026-9203.md): Server-side request forgery in Progress MarkLogic Server (CVSS 8.5, Progress Software MarkLogic Server)
- [CVE-2026-9195](https://cve.now/CVE-2026-9195.md): Cross-site scripting in Progress MarkLogic Server Query Console (CVSS 9.3, Progress Software MarkLogic Server)
- [CVE-2026-9193](https://cve.now/CVE-2026-9193.md): Privilege escalation in Progress MarkLogic Server Hadoop integration (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-70599](https://cve.now/CVE-2026-70599.md): Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin (CVSS 5.9, electron)
- [CVE-2026-9192](https://cve.now/CVE-2026-9192.md): Authentication bypass in Progress MarkLogic Server ODBC App Server (CVSS 9.8, Progress Software MarkLogic Server)
- [CVE-2026-9190](https://cve.now/CVE-2026-9190.md): HTTP request smuggling in Progress MarkLogic Server (CVSS 9.1, Progress Software MarkLogic Server)
- [CVE-2026-8709](https://cve.now/CVE-2026-8709.md): Privilege escalation in Progress MarkLogic Server REST document patch operation (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-7557](https://cve.now/CVE-2026-7557.md): SAML authentication bypass in Progress MarkLogic Server (CVSS 9.1, Progress Software MarkLogic Server)
- [CVE-2026-7329](https://cve.now/CVE-2026-7329.md): Privilege escalation in Progress MarkLogic Server REST query interfaces (CVSS 9.9, Progress Software MarkLogic Server)
- [CVE-2026-7327](https://cve.now/CVE-2026-7327.md): Privilege escalation in Progress MarkLogic Server REST API document processing (CVSS 8.1, Progress Software MarkLogic Server)
- [CVE-2026-7326](https://cve.now/CVE-2026-7326.md): Cross-site request forgery in Progress MarkLogic Server Admin UI (CVSS 7.5, Progress Software MarkLogic Server)
- [CVE-2026-70598](https://cve.now/CVE-2026-70598.md): Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size (CVSS 3.9, electron)
- [CVE-2026-70597](https://cve.now/CVE-2026-70597.md): Electron: Parent process code-sign check is spoofable (CVSS 6.3, electron)
- [CVE-2026-60053](https://cve.now/CVE-2026-60053.md): Apache Answer: Residual Administrative API Key Access After Role or Account Revocation (CVSS 9.1, Apache Software Foundation Apache Answer)
- [CVE-2026-60023](https://cve.now/CVE-2026-60023.md): Apache Answer: Unauthorized disclosure of deleted or pending answer content (CVSS 7.5, Apache Software Foundation Apache Answer)
- [CVE-2026-50749](https://cve.now/CVE-2026-50749.md): Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions (CVSS 6.5, Apache Software Foundation Apache Answer)
- [CVE-2026-48912](https://cve.now/CVE-2026-48912.md): Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL (CVSS 6.5, Apache Software Foundation Apache Answer)
- [CVE-2026-15572](https://cve.now/CVE-2026-15572.md): Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation (CVSS 8.8, Red Hat build of Keycloak)
- [CVE-2026-48911](https://cve.now/CVE-2026-48911.md): Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow (CVSS 7.5, Apache Software Foundation Apache Answer)
- [CVE-2026-48834](https://cve.now/CVE-2026-48834.md): Apache Answer: Denial of service via crafted Accept-Language header parsing (CVSS 7.5, Apache Software Foundation Apache Answer)
- [CVE-2026-16442](https://cve.now/CVE-2026-16442.md): Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction (CVSS 7.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-53992](https://cve.now/CVE-2026-53992.md): Reflected XSS in ProjectSend thumbnails-regenerate.php via start\_date / end\_date Parameters (CVSS 5.1, ProjectSend)
- [CVE-2026-49331](https://cve.now/CVE-2026-49331.md): Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths (CVSS 6.5, Red Hat OpenShift Container Platform)
- [CVE-2026-39924](https://cve.now/CVE-2026-39924.md): Flarum \< 1.8.16 Session Persistence via Improper Access Token Revocation (CVSS 7.6, Flarum Framework)
- [CVE-2026-70596](https://cve.now/CVE-2026-70596.md): Ghost: Cross-Site Scripting in Feature Image Captions (CVSS 4.3, TryGhost Ghost · ghost)
- [CVE-2026-15587](https://cve.now/CVE-2026-15587.md): Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header (CVSS 9.4, Google Cloud Google SecOps)
- [CVE-2026-39923](https://cve.now/CVE-2026-39923.md): Flarum \< 1.8.16 Password Reset Token Expiry Bypass via POST /reset (CVSS 9.2, Flarum Framework)
- [CVE-2026-70595](https://cve.now/CVE-2026-70595.md): Ghost: Server-Side Request Forgery Mitigation Issue (CVSS 4.0, TryGhost Ghost · ghost)
- [CVE-2026-12410](https://cve.now/CVE-2026-12410.md): CCleaner local privilege escalation via link following on uninstall (CVSS 7.8, Gen Digital CCleaner)
- [CVE-2026-17613](https://cve.now/CVE-2026-17613.md): CVE-2026-17613 (CVSS 7.5, Penpot)
- [CVE-2026-54876](https://cve.now/CVE-2026-54876.md): Client-Side Memory Leak in OCSP Response Checking (CVSS 7.5, OpenSSL)
- [CVE-2026-16100](https://cve.now/CVE-2026-16100.md): Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text (CVSS 6.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16071](https://cve.now/CVE-2026-16071.md): Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary (CVSS 5.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16102](https://cve.now/CVE-2026-16102.md): Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (CVSS 8.1, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-15573](https://cve.now/CVE-2026-15573.md): Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (CVSS 8.1, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-16443](https://cve.now/CVE-2026-16443.md): Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation (CVSS 7.4, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-67623](https://cve.now/CVE-2026-67623.md): Mistral Vibe \< 2.23.3 Arbitrary Command Execution via git fsmonitor Hook (CVSS 8.6, mistralai mistral-vibe)
- [CVE-2026-15979](https://cve.now/CVE-2026-15979.md): Content Egg \<= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion (CVSS 8.1, keywordrush Content Egg – Affiliate Product Importer & Pric…)
- [CVE-2026-7529](https://cve.now/CVE-2026-7529.md): wiseCampaign \<= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API (CVSS 7.5, wisemattic wiseCampaign – WooCommerce Conversions Made Easy)
- [CVE-2026-17506](https://cve.now/CVE-2026-17506.md): Independent Analytics \<= 2.15.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, bensibley Independent Analytics – WordPress Analytics Plugin)
- [CVE-2026-7456](https://cve.now/CVE-2026-7456.md): Udimi Tools \<= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action (CVSS 6.5, webocoders Udimi Tools)
- [CVE-2026-71227](https://cve.now/CVE-2026-71227.md): Libkcapi: infinite loop denial of service in libkcapi \_kcapi\_aio\_read\_all() due to unhandled io\_getevents() timeout return (CVSS 5.1, Stephan Muelle libkcapi · Red Hat Enterprise Linux +2)
- [CVE-2026-71294](https://cve.now/CVE-2026-71294.md): Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions (CVSS 7.7, Cotonti)
- [CVE-2026-71293](https://cve.now/CVE-2026-71293.md): Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current\_user Variable (CVSS 6.2, statamic cms · statamic/cms)
- [CVE-2026-71292](https://cve.now/CVE-2026-71292.md): Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter (CVSS 7.2, intelliants subrion)
- [CVE-2026-71291](https://cve.now/CVE-2026-71291.md): Bolt CMS Server-Side Template Injection via Unsandboxed allow\_twig Field Rendering (CVSS 8.8, bolt core)
- [CVE-2026-71226](https://cve.now/CVE-2026-71226.md): Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path (CVSS 7.3, Stephan Muelle libkcapi · Red Hat Enterprise Linux +2)
- [CVE-2026-71289](https://cve.now/CVE-2026-71289.md): NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API (CVSS 9.8, NASA-AMMOS anms)
- [CVE-2026-71288](https://cve.now/CVE-2026-71288.md): Koha SQL Injection via order\_by and {order}\_ovalue Parameters in guided\_reports.pl (CVSS 8.8, Koha Community Koha)
- [CVE-2026-71287](https://cve.now/CVE-2026-71287.md): Cacti sanitize\_sql\_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection (CVSS 8.8, cacti)
- [CVE-2026-71286](https://cve.now/CVE-2026-71286.md): ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString (CVSS 6.1, miguelcobain ember-dynamic-render-template)
- [CVE-2026-71285](https://cve.now/CVE-2026-71285.md): Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages (CVSS 8.1, louislam uptime-kuma)
- [CVE-2026-71284](https://cve.now/CVE-2026-71284.md): Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename (CVSS 7.2, fledge-iot fledge)
- [CVE-2026-71283](https://cve.now/CVE-2026-71283.md): Fledge IoT Gateway Backup Restore Tar Path Traversal (CVSS 4.9, fledge-iot fledge)
- [CVE-2026-71282](https://cve.now/CVE-2026-71282.md): ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter (CVSS 6.5, chirpstack)
- [CVE-2026-71281](https://cve.now/CVE-2026-71281.md): peft Unsafe Deserialization via torch.load() Without weights\_only in LoRA-GA and CorDA Modules (CVSS 8.8, huggingface peft)
- [CVE-2026-71280](https://cve.now/CVE-2026-71280.md): go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch (CVSS 8.5, go-shiori shiori)
- [CVE-2026-71279](https://cve.now/CVE-2026-71279.md): Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution (CVSS 8.1, Koenkk zigbee2mqtt)
- [CVE-2026-71278](https://cve.now/CVE-2026-71278.md): rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation (CVSS 9.8, iot-ecology rust-iot-platform)
- [CVE-2026-71277](https://cve.now/CVE-2026-71277.md): rust-iot-platform Authentication Bypass via Non-Validated Authorization Header (CVSS 9.1, iot-ecology rust-iot-platform)
- [CVE-2026-71276](https://cve.now/CVE-2026-71276.md): Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter (CVSS 7.1, absmach magistrala)
- [CVE-2026-71275](https://cve.now/CVE-2026-71275.md): OpenBK7231T - Reflected XSS via OTA host Parameter (CVSS 5.4, openshwprojects OpenBK7231T\_App)
- [CVE-2026-71274](https://cve.now/CVE-2026-71274.md): OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels (CVSS 8.5, openshwprojects OpenBK7231T\_App)
- [CVE-2026-71273](https://cve.now/CVE-2026-71273.md): OpenBK7231T CSRF in /cfg\_wifi\_set Leading to Implicit Web Password Disable and WiFi Hijack (CVSS 6.5, openshwprojects OpenBK7231T\_App)
- [CVE-2026-71272](https://cve.now/CVE-2026-71272.md): Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() (CVSS 8.5, usememos memos)
- [CVE-2026-71271](https://cve.now/CVE-2026-71271.md): Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass (CVSS 8.5, usememos memos)
- [CVE-2026-71270](https://cve.now/CVE-2026-71270.md): Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess (CVSS 8.6, Stirling-Tools Stirling-PDF)
- [CVE-2026-71268](https://cve.now/CVE-2026-71268.md): OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write (CVSS 9.9, thiagoralves OpenPLC\_v3)
- [CVE-2026-71267](https://cve.now/CVE-2026-71267.md): microtar Stack Buffer Overflow in mtar\_write\_file\_header() and mtar\_write\_dir\_header() (CVSS 9.8, rxi microtar)
- [CVE-2026-71266](https://cve.now/CVE-2026-71266.md): tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing (CVSS 7.8, syoyo tinyobjloader-c)
- [CVE-2026-71265](https://cve.now/CVE-2026-71265.md): Domoticz MochadTCP Stack Buffer Overflow via MOCHAD\_RFSEC strcpy() (CVSS 7.5, domoticz)
- [CVE-2026-71264](https://cve.now/CVE-2026-71264.md): WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State (CVSS 8.2, Aircoookie WLED)
- [CVE-2026-71263](https://cve.now/CVE-2026-71263.md): FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() (CVSS 9.1, cwalter-at FreeModbus)
- [CVE-2026-71262](https://cve.now/CVE-2026-71262.md): IoTSharp BlobStorageController Missing Authentication and Path Traversal (CVSS 9.8, IoTSharp)
- [CVE-2026-71261](https://cve.now/CVE-2026-71261.md): dr\_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds (CVSS 7.8, mackron dr\_libs)
- [CVE-2026-71260](https://cve.now/CVE-2026-71260.md): ESPHome web\_server Plaintext Password Disclosure via JSON "value" Field (CVSS 6.5, esphome)
- [CVE-2026-71259](https://cve.now/CVE-2026-71259.md): ESPHome external\_components file:// Scheme Validation Bypass Leading to Remote Code Execution (CVSS 8.6, esphome)
- [CVE-2026-71225](https://cve.now/CVE-2026-71225.md): Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries (CVSS 6.5, Stephan Muelle libkcapi · Red Hat Enterprise Linux +2)
- [CVE-2026-16022](https://cve.now/CVE-2026-16022.md): Command Injection in @oblique/cli (CVSS 7.8, Swiss Federal Office of Information Technology, Systems and…)
- [CVE-2026-0516](https://cve.now/CVE-2026-0516.md): A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host (CVSS 6.5, SonicWall SonicOS)
- [CVE-2026-71256](https://cve.now/CVE-2026-71256.md): nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object\_id (CVSS 9.8, debevv nanoMODBUS)
- [CVE-2026-71255](https://cve.now/CVE-2026-71255.md): nanoMODBUS Client-Side Out-of-Bounds Write via object\_length in recv\_read\_device\_identification\_res() (CVSS 8.6, debevv nanoMODBUS)
- [CVE-2026-71254](https://cve.now/CVE-2026-71254.md): nanoMODBUS Server-Side Out-of-Bounds Write in handle\_read\_file\_record() (CVSS 9.8, debevv nanoMODBUS)
- [CVE-2026-18933](https://cve.now/CVE-2026-18933.md): wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal (CVSS 7.2, wp-downloadmanager)
- [CVE-2026-64582](https://cve.now/CVE-2026-64582.md): RDMA/rxe: Fix a use-after-free problem in rxe\_mmap (CVSS 7.8, Linux)
- [CVE-2026-46581](https://cve.now/CVE-2026-46581.md): In Eclipse Mojarra versions 2.3 and following, URL handing in \`DefaultFaceletFactory\` does not properly sanitize and/or block remote URLs, a (CVSS 7.5, Eclipse Foundation Eclipse Mojarra)
- [CVE-2026-61891](https://cve.now/CVE-2026-61891.md): In Eclipse Theia versions up to and including 1.73.1, the \`@theia/filesystem\` backend exposes HTTP file-download endpoints (\`GET /file\`, \`GE (CVSS 7.5, Eclipse Foundation Eclipse Theia)
- [CVE-2026-60009](https://cve.now/CVE-2026-60009.md): In Eclipse Theia versions up to and including 1.73.1, the \`@theia/filesystem\` backend binds \`POST /file-upload\` in every filesystem-enabled (CVSS 8.8, Eclipse Foundation Eclipse Theia)
- [CVE-2026-71252](https://cve.now/CVE-2026-71252.md): toner-management - Unauthenticated State-Changing Admin Actions (CVSS 8.2, raghav993 toner-management)
- [CVE-2026-71251](https://cve.now/CVE-2026-71251.md): Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint (CVSS 6.5, akaunting)
- [CVE-2026-71250](https://cve.now/CVE-2026-71250.md): Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding (CVSS 4.3, firefly-iii)
- [CVE-2026-71249](https://cve.now/CVE-2026-71249.md): 299Ko - Unauthenticated Reflected XSS in Public Contact Form (CVSS 6.1, 299Ko)
- [CVE-2026-71248](https://cve.now/CVE-2026-71248.md): Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion (CVSS 9.8, Harsh21Patel Inventory-Management-System-PHP)
- [CVE-2026-71247](https://cve.now/CVE-2026-71247.md): Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents (CVSS 6.5, documenso)
- [CVE-2026-71246](https://cve.now/CVE-2026-71246.md): Pixelfed - Authenticated SSRF via Remote URL Search (CVSS 4.3, pixelfed)
- [CVE-2026-71244](https://cve.now/CVE-2026-71244.md): Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host (CVSS 6.5, paperless-ngx)
- [CVE-2026-71243](https://cve.now/CVE-2026-71243.md): backmeup (npm) - OS Command Injection via Backup Option Values (CVSS 8.8, adaltas backmeup)
- [CVE-2026-71242](https://cve.now/CVE-2026-71242.md): Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy (CVSS 8.2, crater-invoice crater)
- [CVE-2026-71241](https://cve.now/CVE-2026-71241.md): Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History (CVSS 7.5, lyric777 Book-Management-System)
- [CVE-2026-71240](https://cve.now/CVE-2026-71240.md): DjangoCRM - Unauthenticated Open Redirect via toggle\_default\_sorting next\_url Parameter (CVSS 4.3, DjangoCRM django-crm)
- [CVE-2026-71239](https://cve.now/CVE-2026-71239.md): DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering (CVSS 8.1, DjangoCRM django-crm)
- [CVE-2026-71238](https://cve.now/CVE-2026-71238.md): DjangoCRM - Hardcoded Django SECRET\_KEY Enables Session and CSRF Token Forgery (CVSS 9.1, DjangoCRM django-crm)
- [CVE-2026-71237](https://cve.now/CVE-2026-71237.md): Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin (CVSS 9.8, Miantang IoT-PHP)
- [CVE-2026-71236](https://cve.now/CVE-2026-71236.md): Grocy - Stored XSS via HTMLPurifier Output Double-Decode (CVSS 8.7, grocy)
- [CVE-2026-71235](https://cve.now/CVE-2026-71235.md): Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine (CVSS 8.8, absmach magistrala)
- [CVE-2026-71234](https://cve.now/CVE-2026-71234.md): Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token (CVSS 7.5, documize community)
- [CVE-2026-71233](https://cve.now/CVE-2026-71233.md): InvoiceNinja - Stored XSS via Invoice/Quote Terms Field (CVSS 8.7, invoiceninja)
- [CVE-2026-71232](https://cve.now/CVE-2026-71232.md): MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE (CVSS 7.2, magicblack maccms10)
- [CVE-2026-71231](https://cve.now/CVE-2026-71231.md): IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie (CVSS 9.8, thebradleysanders IOTSmartHome)
- [CVE-2026-12609](https://cve.now/CVE-2026-12609.md): In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the \`@theia/plugin-ext\` backend exposes the \`/hostedPlugin/:pluginId/:path(\* (CVSS 7.5, Eclipse Foundation Eclipse Theia)
- [CVE-2026-14574](https://cve.now/CVE-2026-14574.md): In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the \`PreferenceUtils.merge\` function in \`@theia/core\` recursively merges pref (CVSS 5.7, Eclipse Foundation Eclipse Theia)
- [CVE-2026-66747](https://cve.now/CVE-2026-66747.md): ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant (CVSS 9.3, Zbtlink CPE2801 Firmware · Zbtlink WE1026-5G-WD Firmware +18)
- [CVE-2026-14304](https://cve.now/CVE-2026-14304.md): In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based applicat (CVSS 4.6, Eclipse Foundation Eclipse Accessibility Tools Framework)
- [CVE-2026-17578](https://cve.now/CVE-2026-17578.md): Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement (CVSS 2.3, Kong Event Gateway)
- [CVE-2026-44945](https://cve.now/CVE-2026-44945.md): Cross-Cluster Impersonation Confused-Deputy Privilege Escalation (CVSS 9.1, SUSE Rancher)
- [CVE-2026-25703](https://cve.now/CVE-2026-25703.md): Potential information leakage from manager /network/graph API in NeuVector (CVSS 7.3, SUSE NeuVector)
- [CVE-2026-0931](https://cve.now/CVE-2026-0931.md): Denial-of-service vulnerability in M-Files Server (CVSS 6.9, M-Files Server)
- [CVE-2026-15452](https://cve.now/CVE-2026-15452.md): Smash Balloon Social Photo Feed \<= 6.11.3 - Reflected Cross-Site Scripting via REQUEST\_URI Query String (CVSS 4.7, smub Smash Balloon Social Photo Feed – Easy Social Feeds Pl…)
- [CVE-2026-10090](https://cve.now/CVE-2026-10090.md): Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription (CVSS 9.0, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-10059](https://cve.now/CVE-2026-10059.md): Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token (CVSS 9.1, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-8029](https://cve.now/CVE-2026-8029.md): SQL Injection Vulnerability in ZTE SmartLife App (CVSS 3.9, ZTE SmartLife)
- [CVE-2026-64581](https://cve.now/CVE-2026-64581.md): xfrm: fix sk\_dst\_cache double-free in xfrm\_user\_policy() (CVSS 7.8, Linux)
- [CVE-2026-64580](https://cve.now/CVE-2026-64580.md): xfrm6: clear dst.dev on error to avoid double netdev\_put in xfrm6\_fill\_dst() (CVSS 7.8, Linux)
- [CVE-2026-64579](https://cve.now/CVE-2026-64579.md): xfrm: policy: preallocate inexact bins before xfrm\_hash\_rebuild reinsert (no CVSS, Linux)
- [CVE-2026-64578](https://cve.now/CVE-2026-64578.md): ksmbd: validate compound request size before reading StructureSize2 (CVSS 8.2, Linux)
- [CVE-2026-64577](https://cve.now/CVE-2026-64577.md): gtp: check skb\_pull\_data() return in gtp1u\_send\_echo\_resp() (CVSS 7.5, Linux)
- [CVE-2026-64576](https://cve.now/CVE-2026-64576.md): nexthop: initialize extack in nh\_res\_bucket\_migrate() (CVSS 7.1, Linux)
- [CVE-2026-64575](https://cve.now/CVE-2026-64575.md): bpf: tcp: fix double sock release on batch realloc (CVSS 7.8, Linux)
- [CVE-2026-64574](https://cve.now/CVE-2026-64574.md): wifi: mac80211: tear down new links on vif update error path (CVSS 7.8, Linux)
- [CVE-2026-64573](https://cve.now/CVE-2026-64573.md): Bluetooth: qca: fix NVM tag length underflow in TLV parser (no CVSS, Linux)
- [CVE-2026-64572](https://cve.now/CVE-2026-64572.md): ipv4: fib: free fib\_alias with kfree\_rcu() on insert error path (no CVSS, Linux)
- [CVE-2026-64571](https://cve.now/CVE-2026-64571.md): wifi: p54: validate RX frame length in p54\_rx\_eeprom\_readback() (no CVSS, Linux)
- [CVE-2026-64570](https://cve.now/CVE-2026-64570.md): wifi: mac80211: fix fils\_discovery double free on alloc failure (CVSS 7.8, Linux)
- [CVE-2026-64569](https://cve.now/CVE-2026-64569.md): mpls: fix NULL deref in mpls\_valid\_fib\_dump\_req() on CONFIG\_INET=n (no CVSS, Linux)
- [CVE-2026-64568](https://cve.now/CVE-2026-64568.md): wifi: mac80211: fix unsol\_bcast\_probe\_resp double free on alloc failure (CVSS 7.8, Linux)
- [CVE-2026-64567](https://cve.now/CVE-2026-64567.md): btrfs: reject free space cache with more entries than pages (CVSS 7.8, Linux)
- [CVE-2026-64566](https://cve.now/CVE-2026-64566.md): xfrm: iptfs: propagate SKBFL\_SHARED\_FRAG in iptfs\_skb\_add\_frags() (CVSS 9.8, Linux)
- [CVE-2026-55997](https://cve.now/CVE-2026-55997.md): Long-lived Rancher registration token exposed in plaintext (CVSS 8.8, rancher)
- [CVE-2026-55998](https://cve.now/CVE-2026-55998.md): Cluster Existence Oracle via Unauthenticated Import Endpoint (CVSS 5.3, SUSE Rancher)
- [CVE-2026-59675](https://cve.now/CVE-2026-59675.md): Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service (CVSS 7.5, SUSE Rancher)
- [CVE-2026-55996](https://cve.now/CVE-2026-55996.md): Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent (CVSS 4.3, SUSE Rancher)
- [CVE-2026-11920](https://cve.now/CVE-2026-11920.md): JoomSport \<= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter (CVSS 4.9, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2026-11977](https://cve.now/CVE-2026-11977.md): WP Post Author \<= 3.9.1 - Authenticated (Author+) SQL Injection (CVSS 6.5, afthemes WP Post Author – Author Box, Multiple Authors, Gue…)
- [CVE-2026-7520](https://cve.now/CVE-2026-7520.md): MailChimp Forms by MailMunch \<= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign\_in' AJAX Action (CVSS 8.1, Mailmunch Forms for Mailchimp)
- [CVE-2026-11969](https://cve.now/CVE-2026-11969.md): WP TripAdvisor Review Slider \<= 14.3 - Authenticated (Administrator+) SQL Injection (CVSS 4.9, jgwhite33 WP TripAdvisor Review Slider)
- [CVE-2026-4431](https://cve.now/CVE-2026-4431.md): Easy Post Submission \<= 2.3.0 - Missing Authorization (CVSS 9.1, themeruby Easy Post Submission – Frontend Posting, Guest Pu…)
- [CVE-2026-6020](https://cve.now/CVE-2026-6020.md): ShopLentor \<= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API (CVSS 7.2, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2026-71215](https://cve.now/CVE-2026-71215.md): art-template - Path Traversal in Sub-Template Resolution via include()/extend() (CVSS 7.5, art-template)
- [CVE-2026-71214](https://cve.now/CVE-2026-71214.md): NASA-AMMOS plandev - Client-Supplied session\_variables Bypass Hasura-Origin Authorization in sequencing-server (CVSS 9.8, NASA-AMMOS plandev)
- [CVE-2026-71213](https://cve.now/CVE-2026-71213.md): typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force (CVSS 9.1, typemill)
- [CVE-2026-71212](https://cve.now/CVE-2026-71212.md): xidown - Argument Injection via Unterminated yt-dlp Command Line Construction (CVSS 4.4, indravoyager xidown)
- [CVE-2026-71211](https://cve.now/CVE-2026-71211.md): mlflow - Unvalidated Gateway Secret api\_base Enables SSRF via Gateway Proxy Endpoint (CVSS 7.1, mlflow)
- [CVE-2026-71210](https://cve.now/CVE-2026-71210.md): mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access (CVSS 5.3, mealie-recipes mealie)
- [CVE-2026-71209](https://cve.now/CVE-2026-71209.md): audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal (CVSS 7.5, advplyr audiobookshelf)
- [CVE-2026-71208](https://cve.now/CVE-2026-71208.md): KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation (CVSS 6.5, KubeSphere)
- [CVE-2026-71207](https://cve.now/CVE-2026-71207.md): Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass (CVSS 9.8, mrswapnilsahu Stock-Inventory-Management-System)
- [CVE-2026-71206](https://cve.now/CVE-2026-71206.md): shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion (CVSS 8.2, go-shiori shiori)
- [CVE-2026-71205](https://cve.now/CVE-2026-71205.md): changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force (CVSS 6.5, dgtlmoon changedetection.io)
- [CVE-2026-71204](https://cve.now/CVE-2026-71204.md): changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement (CVSS 6.3, dgtlmoon changedetection.io)
- [CVE-2026-71203](https://cve.now/CVE-2026-71203.md): changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema (CVSS 5.3, dgtlmoon changedetection.io)
- [CVE-2026-71202](https://cve.now/CVE-2026-71202.md): raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic (CVSS 7.5, kosinix raster)
- [CVE-2026-70378](https://cve.now/CVE-2026-70378.md): imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic (CVSS 7.5, theotherphil imagecli)
- [CVE-2026-70377](https://cve.now/CVE-2026-70377.md): imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service (CVSS 7.5, theotherphil imagecli)
- [CVE-2026-70376](https://cve.now/CVE-2026-70376.md): Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE (CVSS 9.6, pluck-cms Pluck CMS)
- [CVE-2026-55747](https://cve.now/CVE-2026-55747.md): PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools (CVSS 6.8, The-Pocket PocketFlow)
- [CVE-2026-55739](https://cve.now/CVE-2026-55739.md): Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion (CVSS 8.2, crater-invoice Crater)
- [CVE-2026-54418](https://cve.now/CVE-2026-54418.md): Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass (CVSS 8.1, Leantime)
- [CVE-2026-54416](https://cve.now/CVE-2026-54416.md): Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist (CVSS 7.2, pluck-cms Pluck CMS)
- [CVE-2026-61486](https://cve.now/CVE-2026-61486.md): Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input (CVSS 9.8, Apache Software Foundation Apache Lucy)
- [CVE-2026-61484](https://cve.now/CVE-2026-61484.md): Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -\> RCE/DoS (CVSS 9.8, Apache Software Foundation Apache Lucy)
- [CVE-2026-12000](https://cve.now/CVE-2026-12000.md): Page and Post Restriction \<= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API (CVSS 7.5, cyberlord92 Page and Post Restriction)
- [CVE-2026-7105](https://cve.now/CVE-2026-7105.md): Xpro Addons \<= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get\_menu\_content\_editor() Function (CVSS 4.3, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-6972](https://cve.now/CVE-2026-6972.md): SKT Skill Bar \<= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sonalsinha21 SKT Skill Bar)
- [CVE-2026-7441](https://cve.now/CVE-2026-7441.md): Simple Yearly Archive \<= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, alphawolf Simple Yearly Archive)
- [CVE-2026-7444](https://cve.now/CVE-2026-7444.md): Search Analytics for WP \<= 1.4.16 - Cross-Site Request Forgery (CVSS 8.1, cornelraiu-1 Search Analytics for WP)
- [CVE-2026-5651](https://cve.now/CVE-2026-5651.md): Askeet \<= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql\_query' Parameter (CVSS 4.9, 2wstechnologies Askeet — Talk to Your WooCommerce Data)
- [CVE-2026-7693](https://cve.now/CVE-2026-7693.md): Backup Migration \<= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter (CVSS 7.2, inisev Backup Migration)
- [CVE-2026-18881](https://cve.now/CVE-2026-18881.md): TableOn \<= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment\_count' Filter Parameter (CVSS 7.5, realmag777 TableOn – WordPress Posts Table Filterable)
- [CVE-2026-6147](https://cve.now/CVE-2026-6147.md): LightSync Pro \<= 2.1.6 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, lightsyncpro LightSync Pro – Connect & Sync Cloud Assets |…)
- [CVE-2026-15281](https://cve.now/CVE-2026-15281.md): User Access Manager \<= 2.3.12 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, gm\_alex User Access Manager)
- [CVE-2026-17505](https://cve.now/CVE-2026-17505.md): TranslatePress \<= 3.2.5 - Reflected Cross-Site Scripting (CVSS 6.1, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-11454](https://cve.now/CVE-2026-11454.md): Groundhogg — CRM, Newsletters, and Marketing Automation \<= 4.5.2 - Insecure Direct Object Reference (CVSS 6.5, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-5116](https://cve.now/CVE-2026-5116.md): Contact Form 7 – Dynamic Text Extension \<= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 4.4, sevenspark DTX – Dynamic Text Extension for Contact Form)
- [CVE-2026-17532](https://cve.now/CVE-2026-17532.md): Seraphinite Accelerator \<= 2.29.18 - Reflected Cross-Site Scripting (CVSS 6.1, seraphinitesoft Seraphinite Accelerator)
- [CVE-2026-6079](https://cve.now/CVE-2026-6079.md): Material Dashboard \<= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion (CVSS 7.3, ho3einie Material Dashboard)
- [CVE-2026-6627](https://cve.now/CVE-2026-6627.md): WPFormify \<= 1.1.1 - Missing Authorization (CVSS 8.2, saadiqbal WPFormify – Stripe Payments with Form and Checkout)
- [CVE-2026-7726](https://cve.now/CVE-2026-7726.md): Layouts for WPBakery \<= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle\_sync' AJAX Action (CVSS 6.5, techeshta Layouts for WPBakery)
- [CVE-2026-6639](https://cve.now/CVE-2026-6639.md): AI Chatbot & Workflow Automation by AIWU \<= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 7.5, wupsales AI Copilot – Content Generator)
- [CVE-2026-5581](https://cve.now/CVE-2026-5581.md): Multi Uploader for Gravity Forms \<= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion (CVSS 9.1, sh1zen Multi Uploader for Gravity Forms)
- [CVE-2026-5108](https://cve.now/CVE-2026-5108.md): Super Progressive Web Apps \<= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting (CVSS 4.4, superpwa Super Progressive Web Apps)
- [CVE-2026-61483](https://cve.now/CVE-2026-61483.md): Apache Lucy: QueryParser unbounded recursion on deeply-nested query -\> C-stack-overflow DoS (CVSS 7.5, Apache Software Foundation Apache Lucy)
- [CVE-2026-71201](https://cve.now/CVE-2026-71201.md): In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or (CVSS 5.0, OpenStack Ironic)
- [CVE-2026-49004](https://cve.now/CVE-2026-49004.md): PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product (CVSS 6.5, ZTE NX799J)
- [CVE-2026-17515](https://cve.now/CVE-2026-17515.md): MLS Import \< 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport\_logger\_per\_item (CVSS 4.3, MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings)
- [CVE-2026-16055](https://cve.now/CVE-2026-16055.md): Contest Gallery \< 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post\_cg\_login (CVSS 7.5, Contest Gallery)
- [CVE-2026-16036](https://cve.now/CVE-2026-16036.md): miniOrange 2FA \< 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding (CVSS 7.5, miniOrange 2FA)
- [CVE-2026-15372](https://cve.now/CVE-2026-15372.md): WP 2FA \< 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider (CVSS 7.5, WP 2FA)
- [CVE-2026-15360](https://cve.now/CVE-2026-15360.md): Ajax Load More \< 8.0.1 - Unauthenticated SQL Injection via custom\_args (CVSS 9.1, Ajax Load More)
- [CVE-2026-15210](https://cve.now/CVE-2026-15210.md): Login/Signup with Phone Number, OTP Verification \< 1.8.71 - Unauthenticated Account Takeover via OTP Brute Force (CVSS 9.1, OTP Login With Phone Number, OTP Verification)
- [CVE-2026-15230](https://cve.now/CVE-2026-15230.md): YayPricing \< 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure (CVSS 8.1, YayPricing)
- [CVE-2026-14553](https://cve.now/CVE-2026-14553.md): Zportals \< 6.3.4 - Subscriber+ Arbitrary File Upload (CVSS 8.1, zportals)
- [CVE-2025-15677](https://cve.now/CVE-2025-15677.md): GeoDirectory \< 2.8.110 - Editor+ Stored XSS via Place Categories (CVSS 3.5, GeoDirectory)
- [CVE-2026-16993](https://cve.now/CVE-2026-16993.md): DHL for WooCommerce \< 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory (CVSS 3.7, DHL Shipping Germany for WooCommerce)
- [CVE-2026-16981](https://cve.now/CVE-2026-16981.md): DHL for WooCommerce \< 4.0.1 - Unauthenticated Shipping Label Download via IDOR (CVSS 5.3, DHL Shipping Germany for WooCommerce)
- [CVE-2026-16968](https://cve.now/CVE-2026-16968.md): GeoDirectory \< 2.8.168 - Contributor+ User Email Disclosure via geodir\_json\_search\_users (CVSS 6.5, GeoDirectory)
- [CVE-2026-16942](https://cve.now/CVE-2026-16942.md): WP Custom HTML Pages \<= 0.6.2 - Author+ Stored XSS (CVSS 5.4, WP Custom HTML Page)
- [CVE-2026-16940](https://cve.now/CVE-2026-16940.md): Custom Fields for WooCommerce \< 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal (CVSS 10.0, Custom Fields)
- [CVE-2026-16746](https://cve.now/CVE-2026-16746.md): MultiVendorX \< 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint (CVSS 2.7, MultiVendorX)
- [CVE-2026-16736](https://cve.now/CVE-2026-16736.md): User Registration & Membership \< 5.2.6 - Unauthenticated Account Creation While Registration Disabled (CVSS 7.5, User Registration & Membership)
- [CVE-2026-16613](https://cve.now/CVE-2026-16613.md): GDPR Cookie Compliance \< 5.1.0 - Cookie Deletion and Forced Logout via CSRF (CVSS 4.3, GDPR Cookie Compliance)
- [CVE-2026-16605](https://cve.now/CVE-2026-16605.md): MultiVendorX \< 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization (CVSS 7.2, MultiVendorX)
- [CVE-2026-16604](https://cve.now/CVE-2026-16604.md): Content Protector (Passster) \< 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content Attribute (CVSS 7.5, Passster)
- [CVE-2026-16603](https://cve.now/CVE-2026-16603.md): Content Protector (Passster) \< 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API (CVSS 7.5, Passster)
- [CVE-2026-16602](https://cve.now/CVE-2026-16602.md): Content Protector (Passster) \< 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint (CVSS 7.5, Passster)
- [CVE-2026-16583](https://cve.now/CVE-2026-16583.md): Orbit Fox by ThemeIsle \< 3.0.8 - Author+ Stored XSS via SVG Upload (CVSS 6.1, Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie…)
- [CVE-2026-16573](https://cve.now/CVE-2026-16573.md): Bit Form \< 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload (CVSS 7.5, Bit Form)
- [CVE-2026-16561](https://cve.now/CVE-2026-16561.md): Sunshine Photo Cart \< 3.6.12 - Unauthenticated Private Gallery Comment Disclosure (CVSS 7.5, Sunshine Photo Cart)
- [CVE-2026-68080](https://cve.now/CVE-2026-68080.md): Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-70375](https://cve.now/CVE-2026-70375.md): HashBrown CMS - OS Command Injection via Git Deployer Branch Field (CVSS 8.8, HashBrownCMS hashbrown-cms)
- [CVE-2026-70374](https://cve.now/CVE-2026-70374.md): HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation (CVSS 8.8, HashBrownCMS hashbrown-cms)
- [CVE-2026-67592](https://cve.now/CVE-2026-67592.md): Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 7.5, Apache Software Foundation Apache Qpid ProtonJ2)
- [CVE-2026-67555](https://cve.now/CVE-2026-67555.md): Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 6.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68078](https://cve.now/CVE-2026-68078.md): Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 6.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-66277](https://cve.now/CVE-2026-66277.md): Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery (CVSS 6.5, Apache Software Foundation Apache Qpid Proton-J)
- [CVE-2026-67554](https://cve.now/CVE-2026-67554.md): Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68077](https://cve.now/CVE-2026-68077.md): Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-66276](https://cve.now/CVE-2026-66276.md): Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Qpid Proton-J)
- [CVE-2026-67591](https://cve.now/CVE-2026-67591.md): Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation Apache Qpid ProtonJ2)
- [CVE-2026-67553](https://cve.now/CVE-2026-67553.md): Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68075](https://cve.now/CVE-2026-68075.md): Apache Qpid Broker-J: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-66275](https://cve.now/CVE-2026-66275.md): Apache Qpid Proton-J: Incoming session flow control window can be exceeded (CVSS 6.5, Apache Software Foundation Apache Qpid Proton-J)
- [CVE-2026-67590](https://cve.now/CVE-2026-67590.md): Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow (CVSS 7.5, Apache Software Foundation Apache Qpid ProtonJ2)
- [CVE-2026-67552](https://cve.now/CVE-2026-67552.md): Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow (CVSS 7.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68073](https://cve.now/CVE-2026-68073.md): Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-66274](https://cve.now/CVE-2026-66274.md): Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow (CVSS 7.5, Apache Software Foundation Apache Qpid Proton-J)
- [CVE-2026-67589](https://cve.now/CVE-2026-67589.md): Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation Apache Qpid ProtonJ2)
- [CVE-2026-5062](https://cve.now/CVE-2026-5062.md): PrettyLinks \<= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter (CVSS 4.9, supercleanse PrettyLinks – Affiliate Link Management, URL S…)
- [CVE-2026-7753](https://cve.now/CVE-2026-7753.md): Cost Calculator Builder \<= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure (CVSS 6.5, stylemix Cost Calculator Builder)
- [CVE-2026-15941](https://cve.now/CVE-2026-15941.md): Relevanssi \<= 4.27.1 and Relevanssi Premium \<= 2.30.2 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, Relevanssi Premium – A Better Search · comesio Relevanssi –…)
- [CVE-2026-67551](https://cve.now/CVE-2026-67551.md): Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68060](https://cve.now/CVE-2026-68060.md): Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-66273](https://cve.now/CVE-2026-66273.md): Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication (CVSS 7.5, Apache Software Foundation Apache Qpid Proton-J)
- [CVE-2026-67588](https://cve.now/CVE-2026-67588.md): Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation Apache Qpid ProtonJ2)
- [CVE-2026-67465](https://cve.now/CVE-2026-67465.md): Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation Apache Qpid Proton Dotnet)
- [CVE-2026-68074](https://cve.now/CVE-2026-68074.md): Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation Apache Qpid Broker-J)
- [CVE-2026-66257](https://cve.now/CVE-2026-66257.md): Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (CVSS 7.5, Apache Software Foundation Apache Qpid Proton-J)
- [CVE-2026-71192](https://cve.now/CVE-2026-71192.md): In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) fr (CVSS 6.0, OpenStack Swift)
- [CVE-2026-71191](https://cve.now/CVE-2026-71191.md): In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-\* headers are covered by the SigV4 signature on pre (CVSS 6.0, OpenStack Swift)
- [CVE-2026-71190](https://cve.now/CVE-2026-71190.md): In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracki (CVSS 8.7, OpenStack Swift)
- [CVE-2026-18903](https://cve.now/CVE-2026-18903.md): yeqifu warehouse FileController.java path traversal (CVSS 5.3, yeqifu warehouse)
- [CVE-2026-55707](https://cve.now/CVE-2026-55707.md): In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. (CVSS 7.1, OpenStack Neutron)
- [CVE-2026-18902](https://cve.now/CVE-2026-18902.md): H3C NX15 esps repeaterproc command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-66839](https://cve.now/CVE-2026-66839.md): NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). (CVSS 6.7, Integrated Systems Technologies NetKids iMark)
- [CVE-2026-66344](https://cve.now/CVE-2026-66344.md): NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). (CVSS 6.7, Integrated Systems Technologies NetKids iMark)
- [CVE-2026-9273](https://cve.now/CVE-2026-9273.md): Membership Plugin – Kadence Memberships \<= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover (CVSS 9.3, stellarwp Membership Plugin – Kadence Memberships)
- [CVE-2026-11421](https://cve.now/CVE-2026-11421.md): ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support \<= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter (CVSS 6.5, wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…)
- [CVE-2026-8790](https://cve.now/CVE-2026-8790.md): Football Pool \<= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting (CVSS 6.1, antoineh Football Pool)
- [CVE-2026-18322](https://cve.now/CVE-2026-18322.md): Smart Popup by Supsystic \<= 1.12.0 - Unauthenticated Privilege Escalation to Administrator (CVSS 8.8, supsysticcom Smart Popup by Supsystic)
- [CVE-2026-15918](https://cve.now/CVE-2026-15918.md): VikAppointments – Services Booking Calendar \<= 1.2.19 - Unauthenticated SQL Injection (CVSS 7.5, e4jvikwp VikAppointments Services Booking Calendar)
- [CVE-2026-8761](https://cve.now/CVE-2026-8761.md): Dokan \<= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation (CVSS 8.8, dokaninc Dokan: AI Powered WooCommerce Multivendor Marketpl…)
- [CVE-2026-16143](https://cve.now/CVE-2026-16143.md): VikRentItems Flexible Rental Management System \<= 1.2.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, e4jvikwp VikRentItems Flexible Rental Management System)
- [CVE-2026-18901](https://cve.now/CVE-2026-18901.md): H3C NX15 Web API esps service.add routine (CVSS 8.6, H3C NX15)
- [CVE-2026-18900](https://cve.now/CVE-2026-18900.md): H3C NX15 Backend RPC esps file.exec os command injection (CVSS 8.6, H3C NX15)
- [CVE-2026-18898](https://cve.now/CVE-2026-18898.md): UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1200GW)
- [CVE-2026-18897](https://cve.now/CVE-2026-18897.md): UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-18907](https://cve.now/CVE-2026-18907.md): PathTravelsal Vulnerability in com.talpa.hibrowser (CVSS 7.5, TECNO Mobile Hi Browser)
- [CVE-2026-18896](https://cve.now/CVE-2026-18896.md): lavkush-maurya Student-Registration-System changepass.php sql injection (CVSS 5.3, lavkush-maurya Student-Registration-System)
- [CVE-2026-18895](https://cve.now/CVE-2026-18895.md): UTT HiPER 1250GW APSecurity\_5g strcpy stack-based overflow (CVSS 8.7, UTT HiPER 1250GW)
- [CVE-2026-18859](https://cve.now/CVE-2026-18859.md): ESAFENET CDG usbkey;logindojojs sql injection (CVSS 6.9, ESAFENET CDG)
- [CVE-2026-18856](https://cve.now/CVE-2026-18856.md): Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery (CVSS 5.1, Poesis Rhymix CMS)
- [CVE-2026-18854](https://cve.now/CVE-2026-18854.md): Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection (CVSS 6.9, Shandong Hoteam PDM Product Data Management System)
- [CVE-2025-63822](https://cve.now/CVE-2025-63822.md): SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. (CVSS 8.1)
- [CVE-2025-63823](https://cve.now/CVE-2025-63823.md): My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass (CVSS 9.8)
- [CVE-2025-70962](https://cve.now/CVE-2025-70962.md): Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2026-52466](https://cve.now/CVE-2026-52466.md): Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. (CVSS 9.8)
- [CVE-2026-67863](https://cve.now/CVE-2026-67863.md): In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. (CVSS 7.5)
- [CVE-2026-67864](https://cve.now/CVE-2026-67864.md): An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation log (CVSS 7.5)
- [CVE-2026-67865](https://cve.now/CVE-2026-67865.md): S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. (CVSS 7.5)
- [CVE-2026-67866](https://cve.now/CVE-2026-67866.md): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac\_ProcessMsg\_ (CVSS 7.5)
- [CVE-2026-67867](https://cve.now/CVE-2026-67867.md): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper (CVSS 7.5)
- [CVE-2026-67869](https://cve.now/CVE-2026-67869.md): Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service\_Call validates input (CVSS 7.5)
- [CVE-2026-67870](https://cve.now/CVE-2026-67870.md): In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId target (CVSS 9.8)
- [CVE-2026-67871](https://cve.now/CVE-2026-67871.md): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address\_space\_ (CVSS 7.5)
- [CVE-2026-67872](https://cve.now/CVE-2026-67872.md): An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling (CVSS 7.5)
- [CVE-2026-67873](https://cve.now/CVE-2026-67873.md): A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.