# CVEs published 2026-08-06

483 CVEs were published on August 6, 2026: 84 critical, 186 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-70332](https://cve.now/CVE-2026-70332.md): Microsoft Office SharePoint Spoofing Vulnerability (CVSS 9.6, Microsoft SharePoint Online)
- [CVE-2026-62873](https://cve.now/CVE-2026-62873.md): Microsoft 365 Admin Center Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft 365 Admin Center)
- [CVE-2026-63508](https://cve.now/CVE-2026-63508.md): Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Planetary Computer Pro)
- [CVE-2026-50515](https://cve.now/CVE-2026-50515.md): Azure Service Bus Remote Code Execution Vulnerability (CVSS 9.9, Microsoft Azure Service Bus)
- [CVE-2026-56162](https://cve.now/CVE-2026-56162.md): Azure SQL Database Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure SQL Database)
- [CVE-2026-65667](https://cve.now/CVE-2026-65667.md): Microsoft Teams Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Teams)
- [CVE-2026-62830](https://cve.now/CVE-2026-62830.md): Azure SRE Agent Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure SRE Agent)
- [CVE-2026-56161](https://cve.now/CVE-2026-56161.md): Azure Logic Apps Information Disclosure Vulnerability (CVSS 9.6, Microsoft Azure Logic Apps)
- [CVE-2026-68823](https://cve.now/CVE-2026-68823.md): Azure Confidential Ledger Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Azure Confidential Ledger)
- [CVE-2026-49163](https://cve.now/CVE-2026-49163.md): Application Insights Profiler Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Application Insights Profiler)
- [CVE-2026-59115](https://cve.now/CVE-2026-59115.md): Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Entra Provisioning Service)
- [CVE-2026-62918](https://cve.now/CVE-2026-62918.md): Microsoft Teams Spoofing Vulnerability (CVSS 7.5, Microsoft Teams)
- [CVE-2026-50481](https://cve.now/CVE-2026-50481.md): Azure Active Directory Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Azure Active Directory)
- [CVE-2026-59118](https://cve.now/CVE-2026-59118.md): Copilot Cowork Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Copilot Cowork)
- [CVE-2026-65668](https://cve.now/CVE-2026-65668.md): Microsoft Purview eDiscovery Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Purview eDiscovery)
- [CVE-2026-62896](https://cve.now/CVE-2026-62896.md): Microsoft Teams Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Teams)
- [CVE-2026-62836](https://cve.now/CVE-2026-62836.md): Azure SQL Managed Instance Elevation of Privilege Vulnerability (CVSS 8.7, Microsoft Azure SQL Managed Instance)
- [CVE-2026-17264](https://cve.now/CVE-2026-17264.md): Medixant RadiAnt DICOM Out-of-bounds write (CVSS 5.3, Medixant RadiAnt DICOM)
- [CVE-2026-71555](https://cve.now/CVE-2026-71555.md): PILOS: Reverse tabnabbing in room description (CVSS 4.1, THM-Health PILOS)
- [CVE-2026-71554](https://cve.now/CVE-2026-71554.md): h2: Duplicate Host header could facilitate request smuggling (CVSS 5.3, python-hyper h2 · h2)
- [CVE-2026-48054](https://cve.now/CVE-2026-48054.md): OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri (CVSS 8.8, OpenZeppelin contracts-wizard · @openzeppelin/wizard)
- [CVE-2026-49391](https://cve.now/CVE-2026-49391.md): Frappe: Stored XSS in Column Headers via Data Import (CVSS 5.1, frappe)
- [CVE-2026-48088](https://cve.now/CVE-2026-48088.md): OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory (CVSS 9.4, open-reception appointment-booking-software)
- [CVE-2026-48087](https://cve.now/CVE-2026-48087.md): OpenReception: WebAuthn passkey injection allows account takeover (CVSS 9.8, open-reception appointment-booking-software)
- [CVE-2026-70636](https://cve.now/CVE-2026-70636.md): Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint (CVSS 8.7, FlowiseAI Flowise)
- [CVE-2026-67622](https://cve.now/CVE-2026-67622.md): Flowise 3.1.4 IDOR in OpenAI Assistants Integration (CVSS 8.5, FlowiseAI Flowise)
- [CVE-2026-67434](https://cve.now/CVE-2026-67434.md): PHP\_CodeSniffer gitblame report command injection via crafted filename (CVSS 7.3, PHPCSStandards PHP\_CodeSniffer · squizlabs/php\_codesniffer)
- [CVE-2026-67621](https://cve.now/CVE-2026-67621.md): Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints (CVSS 7.2, FlowiseAI Flowise)
- [CVE-2026-48086](https://cve.now/CVE-2026-48086.md): OpenReception: Tenant admin self-promotes to GLOBAL\_ADMIN (CVSS 9.9, open-reception appointment-booking-software)
- [CVE-2026-48085](https://cve.now/CVE-2026-48085.md): OpenReception has unauthenticated GLOBAL\_ADMIN account creation post-bootstrap (CVSS 9.8, open-reception appointment-booking-software)
- [CVE-2026-70632](https://cve.now/CVE-2026-70632.md): FFmpeg 4.4 \< 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing (CVSS 8.5, FFmpeg)
- [CVE-2026-71498](https://cve.now/CVE-2026-71498.md): node-re2: Out-of-bounds heap read in \`replace\`/\`split\` via a \`Buffer\` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript (CVSS 5.1, uhop node-re2 · re2)
- [CVE-2026-70631](https://cve.now/CVE-2026-70631.md): FFmpeg 0.5 \< 9.0 Uninitialized Heap Memory Read in TIFF Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-47765](https://cve.now/CVE-2026-47765.md): Frappe: Lack of Permissions in restore/bulk\_restore (CVSS 7.1, frappe)
- [CVE-2026-70630](https://cve.now/CVE-2026-70630.md): FFmpeg 3.0 \< 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-70629](https://cve.now/CVE-2026-70629.md): FFmpeg 3.0 \< 9.0 Uninitialized Heap Memory Read in RSCC Decoder (CVSS 6.8, FFmpeg)
- [CVE-2026-70628](https://cve.now/CVE-2026-70628.md): FFmpeg 0.5 \< 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File (CVSS 8.5, FFmpeg)
- [CVE-2026-71430](https://cve.now/CVE-2026-71430.md): node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length (CVSS 6.2, uhop node-re2 · re2)
- [CVE-2026-47194](https://cve.now/CVE-2026-47194.md): Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain (CVSS 8.6, frappe)
- [CVE-2026-48084](https://cve.now/CVE-2026-48084.md): OpenReception doesn't rate limit passphrase login attempts (CVSS 7.4, open-reception appointment-booking-software)
- [CVE-2026-48083](https://cve.now/CVE-2026-48083.md): OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits (CVSS 6.5, open-reception appointment-booking-software)
- [CVE-2026-48082](https://cve.now/CVE-2026-48082.md): OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification (CVSS 3.7, open-reception appointment-booking-software)
- [CVE-2026-48081](https://cve.now/CVE-2026-48081.md): OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer (CVSS 8.1, open-reception appointment-booking-software)
- [CVE-2026-71497](https://cve.now/CVE-2026-71497.md): jsoup: Cleaner may expose markup with custom raw-text elements (CVSS 4.7, jhy jsoup · org.jsoup:jsoup)
- [CVE-2026-47185](https://cve.now/CVE-2026-47185.md): Frappe Has Broken Access Control in its Workspace Save API (CVSS 5.1, frappe)
- [CVE-2026-62857](https://cve.now/CVE-2026-62857.md): Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources (CVSS 8.8, fedify-dev fedify)
- [CVE-2026-48079](https://cve.now/CVE-2026-48079.md): OpenReception's logout page clears local access\_token before server-side revocation, leaving duplicated tokens valid until expiry (CVSS 7.4, open-reception appointment-booking-software)
- [CVE-2026-61632](https://cve.now/CVE-2026-61632.md): PyMdown Extensions: Path traversal in the b64 extension lets \<img src\> read files outside base\_path (CVSS 5.3, facelessuser pymdown-extensions · pymdown-extensions)
- [CVE-2026-48078](https://cve.now/CVE-2026-48078.md): OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers (CVSS 5.3, open-reception appointment-booking-software)
- [CVE-2026-48077](https://cve.now/CVE-2026-48077.md): OpenReception: GET appointment by ID returns full appointment record without authorization (CVSS 5.3, open-reception appointment-booking-software)
- [CVE-2026-19110](https://cve.now/CVE-2026-19110.md): DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting (CVSS 4.8, DataGear)
- [CVE-2026-48076](https://cve.now/CVE-2026-48076.md): OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels (CVSS 6.5, open-reception appointment-booking-software)
- [CVE-2026-48075](https://cve.now/CVE-2026-48075.md): OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections (CVSS 6.5, open-reception appointment-booking-software)
- [CVE-2026-71488](https://cve.now/CVE-2026-71488.md): league/commonmark: Quadratic-time denial of service when parsing crafted Markdown (CVSS 7.5, thephpleague commonmark · league/commonmark)
- [CVE-2026-19177](https://cve.now/CVE-2026-19177.md): Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the (CVSS 8.3, Google Chrome)
- [CVE-2026-19176](https://cve.now/CVE-2026-19176.md): Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execut (CVSS 7.5, Google Chrome)
- [CVE-2026-19175](https://cve.now/CVE-2026-19175.md): Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-19174](https://cve.now/CVE-2026-19174.md): Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-19173](https://cve.now/CVE-2026-19173.md): Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-19171](https://cve.now/CVE-2026-19171.md): Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escap (CVSS 9.6, Google Chrome)
- [CVE-2026-19167](https://cve.now/CVE-2026-19167.md): Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak (CVSS 3.1, Google Chrome)
- [CVE-2026-19166](https://cve.now/CVE-2026-19166.md): Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-19165](https://cve.now/CVE-2026-19165.md): Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extens (CVSS 7.5, Google Chrome)
- [CVE-2026-19164](https://cve.now/CVE-2026-19164.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perfo (CVSS 9.6, Google Chrome)
- [CVE-2026-19163](https://cve.now/CVE-2026-19163.md): Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-19162](https://cve.now/CVE-2026-19162.md): Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-19161](https://cve.now/CVE-2026-19161.md): Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to lea (CVSS 3.1, Google Chrome)
- [CVE-2026-19160](https://cve.now/CVE-2026-19160.md): Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to lea (CVSS 3.1, Google Chrome)
- [CVE-2026-19159](https://cve.now/CVE-2026-19159.md): Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI ges (CVSS 7.5, Google Chrome)
- [CVE-2026-19158](https://cve.now/CVE-2026-19158.md): Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in spec (CVSS 7.5, Google Chrome)
- [CVE-2026-19156](https://cve.now/CVE-2026-19156.md): Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extens (CVSS 7.5, Google Chrome)
- [CVE-2026-19155](https://cve.now/CVE-2026-19155.md): Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-19153](https://cve.now/CVE-2026-19153.md): Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised (CVSS 8.1, Google Chrome)
- [CVE-2026-19152](https://cve.now/CVE-2026-19152.md): Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the ren (CVSS 8.3, Google Chrome)
- [CVE-2026-19151](https://cve.now/CVE-2026-19151.md): Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-19150](https://cve.now/CVE-2026-19150.md): Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-19148](https://cve.now/CVE-2026-19148.md): Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proc (CVSS 8.3, Google Chrome)
- [CVE-2026-19147](https://cve.now/CVE-2026-19147.md): Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-19146](https://cve.now/CVE-2026-19146.md): Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proc (CVSS 5.3, Google Chrome)
- [CVE-2026-19145](https://cve.now/CVE-2026-19145.md): Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-19144](https://cve.now/CVE-2026-19144.md): Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-19143](https://cve.now/CVE-2026-19143.md): Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potent (CVSS 8.6, Google Chrome)
- [CVE-2026-19142](https://cve.now/CVE-2026-19142.md): Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI ges (CVSS 7.5, Google Chrome)
- [CVE-2026-19141](https://cve.now/CVE-2026-19141.md): Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer p (CVSS 8.3, Google Chrome)
- [CVE-2026-19140](https://cve.now/CVE-2026-19140.md): Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-19139](https://cve.now/CVE-2026-19139.md): Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escala (CVSS 7.4, Google Chrome)
- [CVE-2026-19138](https://cve.now/CVE-2026-19138.md): Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer p (CVSS 8.3, Google Chrome)
- [CVE-2026-19168](https://cve.now/CVE-2026-19168.md): Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-19169](https://cve.now/CVE-2026-19169.md): Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform (CVSS 8.8, Google Chrome)
- [CVE-2026-19172](https://cve.now/CVE-2026-19172.md): Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-19170](https://cve.now/CVE-2026-19170.md): Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escap (CVSS 9.6, Google Chrome)
- [CVE-2026-19157](https://cve.now/CVE-2026-19157.md): Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox (CVSS 9.6, Google Chrome)
- [CVE-2026-19154](https://cve.now/CVE-2026-19154.md): Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-19149](https://cve.now/CVE-2026-19149.md): Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape v (CVSS 9.6, Google Chrome)
- [CVE-2026-19137](https://cve.now/CVE-2026-19137.md): Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-18367](https://cve.now/CVE-2026-18367.md): A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2 (CVSS 9.3, Sophos Endpoint for macOS · Sophos Home for macOS)
- [CVE-2026-71478](https://cve.now/CVE-2026-71478.md): league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes (CVSS 6.1, thephpleague commonmark · league/commonmark)
- [CVE-2026-19108](https://cve.now/CVE-2026-19108.md): MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free (CVSS 4.8, MZ Automation libiec61850)
- [CVE-2026-71502](https://cve.now/CVE-2026-71502.md): Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute (CVSS 5.1, misp cti-transmute)
- [CVE-2026-48074](https://cve.now/CVE-2026-48074.md): OpenReception: Staff deletion removes pending invites cross-tenant by email match (CVSS 2.7, open-reception appointment-booking-software)
- [CVE-2026-54717](https://cve.now/CVE-2026-54717.md): Silverstripe: XSS in breadcrumbs in page list view (CVSS 5.4, silverstripe-cms · silverstripe/cms)
- [CVE-2026-67422](https://cve.now/CVE-2026-67422.md): pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors (CVSS 7.5, facelessuser pymdown-extensions · pymdown-extensions)
- [CVE-2026-63637](https://cve.now/CVE-2026-63637.md): Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter (CVSS 8.6, dgraph-io dgraph)
- [CVE-2026-45378](https://cve.now/CVE-2026-45378.md): Decidim: Verification documents can be downloaded through reusable links (CVSS 7.5, decidim · decidim-verifications)
- [CVE-2026-19071](https://cve.now/CVE-2026-19071.md): itsourcecode Hospital Management System viewappointment.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-45573](https://cve.now/CVE-2026-45573.md): Decidim: Push subscriptions can be abused for server-side requests (CVSS 6.4, decidim · decidim-core)
- [CVE-2026-45572](https://cve.now/CVE-2026-45572.md): Decidim: HTML content blocks allow stored script execution (CVSS 4.8, decidim · decidim-core)
- [CVE-2026-71476](https://cve.now/CVE-2026-71476.md): Nx: Zip-Slip in the self-hosted remote cache (CVSS 8.7, nrwl nx · nx +8)
- [CVE-2026-71439](https://cve.now/CVE-2026-71439.md): Mermaid radar diagrams are vulnerable to DoS (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-15734](https://cve.now/CVE-2026-15734.md): WGDashboard Server-Side Template Injection vulnerability (CVSS 9.8, WGDashboard)
- [CVE-2026-15733](https://cve.now/CVE-2026-15733.md): WGDashboard Remote Code Execution vulnerability (CVSS 9.8, WGDashboard)
- [CVE-2026-19070](https://cve.now/CVE-2026-19070.md): itsourcecode Hospital Management System viewadmin.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-15732](https://cve.now/CVE-2026-15732.md): WGDashboard Server-Side Request Forgery Vulnerability (CVSS 9.8, WGDashboard)
- [CVE-2026-71438](https://cve.now/CVE-2026-71438.md): Mermaid configuration APIs allow prototype pollution (CVSS 2.4, mermaid-js mermaid · mermaid)
- [CVE-2026-50159](https://cve.now/CVE-2026-50159.md): Mermaid allows CSS injection applying to sibling elements of the diagram (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-71437](https://cve.now/CVE-2026-71437.md): Mermaid Architecture diagrams are vulnerable to prototype pollution (CVSS 6.5, mermaid-js mermaid · mermaid)
- [CVE-2026-71436](https://cve.now/CVE-2026-71436.md): Mermaid XY Charts are vulnerable to an infinite loop DoS (CVSS 5.3, mermaid-js mermaid · mermaid)
- [CVE-2026-19069](https://cve.now/CVE-2026-19069.md): itsourcecode Hospital Management System treatmentrecord.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-71435](https://cve.now/CVE-2026-71435.md): Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template (CVSS 6.1, statamic cms · statamic/cms)
- [CVE-2026-70559](https://cve.now/CVE-2026-70559.md): Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll (CVSS 7.5, DataLinkDC Dinky)
- [CVE-2026-71434](https://cve.now/CVE-2026-71434.md): Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types (CVSS 5.3, statamic cms · statamic/cms)
- [CVE-2026-45415](https://cve.now/CVE-2026-45415.md): Decidim: CSV census record endpoints improper authorization (CVSS 6.0, decidim · decidim-verifications)
- [CVE-2026-70558](https://cve.now/CVE-2026-70558.md): Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token (CVSS 9.8, DataLinkDC Dinky)
- [CVE-2026-64662](https://cve.now/CVE-2026-64662.md): Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries (CVSS 6.5, statamic cms · statamic/cms)
- [CVE-2026-64663](https://cve.now/CVE-2026-64663.md): Statamic: Unsafe method invocation via Antlers template resolution allows data destruction (CVSS 6.5, statamic cms · statamic/cms)
- [CVE-2026-64665](https://cve.now/CVE-2026-64665.md): Statamic: Account takeover via OAuth email matching without email-verification check (CVSS 8.1, statamic cms · statamic/cms)
- [CVE-2026-64664](https://cve.now/CVE-2026-64664.md): Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence (CVSS 4.3, statamic cms · statamic/cms)
- [CVE-2026-45414](https://cve.now/CVE-2026-45414.md): Decidim: JWT-backed authentication can be replayed across organizations (CVSS 8.5, decidim)
- [CVE-2026-70557](https://cve.now/CVE-2026-70557.md): diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts (CVSS 6.5, diboot-core)
- [CVE-2026-19068](https://cve.now/CVE-2026-19068.md): itsourcecode Hospital Management System treatmentdetail.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-71433](https://cve.now/CVE-2026-71433.md): LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores (CVSS 5.3, langchain-ai langgraph · langchain-ai langgraph-checkpoi… +3)
- [CVE-2026-5857](https://cve.now/CVE-2026-5857.md): Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments (CVSS 8.1, Contiki-NG)
- [CVE-2026-5856](https://cve.now/CVE-2026-5856.md): Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip\_name Traversal Before Transaction-ID Validation (CVSS 7.1, Contiki-NG)
- [CVE-2026-48071](https://cve.now/CVE-2026-48071.md): OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout (CVSS 5.8, open-reception appointment-booking-software)
- [CVE-2026-19067](https://cve.now/CVE-2026-19067.md): itsourcecode Hospital Management System treatment.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-64655](https://cve.now/CVE-2026-64655.md): GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching (CVSS 2.1, cli · github.com/cli/cli/v2 +1)
- [CVE-2026-5855](https://cve.now/CVE-2026-5855.md): Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m\_tlv\_read (CVSS 7.5, Contiki-NG)
- [CVE-2026-19066](https://cve.now/CVE-2026-19066.md): SourceCodester Online Examination & Learning Management System view\_students.php authorization (CVSS 5.3, SourceCodester Online Examination & Learning Management Sys…)
- [CVE-2026-41861](https://cve.now/CVE-2026-41861.md): Arbitrary Root File Write via Path Traversal in BOSH agent (CVSS 4.2, CloudFoundry Foundation BOSH)
- [CVE-2026-64654](https://cve.now/CVE-2026-64654.md): GitHub CLI: Terminal escape sequence injection in multiple \`gh\` commands (CVSS 5.3, cli)
- [CVE-2026-48080](https://cve.now/CVE-2026-48080.md): OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment (CVSS 8.0, open-reception appointment-booking-software)
- [CVE-2026-65400](https://cve.now/CVE-2026-65400.md): An authentication issue was addressed with improved state management. (CVSS 9.8, KEV, Apple macOS)
- [CVE-2026-19065](https://cve.now/CVE-2026-19065.md): SourceCodester Online Examination & Learning Management System upload\_files.php unrestricted upload (CVSS 5.3, SourceCodester Online Examination & Learning Management Sys…)
- [CVE-2026-19111](https://cve.now/CVE-2026-19111.md): Insecure direct object reference in Strands Agents Tools memory tool namespace isolation (CVSS 8.1, AWS strands-agents-tools)
- [CVE-2026-64653](https://cve.now/CVE-2026-64653.md): GitHub CLI: Unescaped variable components in request URLs could allow path traversal (CVSS 5.1, cli · github.com/cli/cli/v2 +1)
- [CVE-2026-64652](https://cve.now/CVE-2026-64652.md): GitHub CLI: Partial token disclosure in \`gh auth status\` output (CVSS 3.3, cli · github.com/cli/cli +1)
- [CVE-2026-68480](https://cve.now/CVE-2026-68480.md): x86/bugs: Make Safe-RET robust against interrupt injection (no CVSS, Linux)
- [CVE-2026-63725](https://cve.now/CVE-2026-63725.md): sysPass FileBackupService Authenticated OS Command Injection via Backup Path (CVSS 7.2, nuxsmin sysPass)
- [CVE-2026-3418](https://cve.now/CVE-2026-3418.md): Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (CVSS 9.1, WSO2 API Manager · WSO2 Traffic Manager +4)
- [CVE-2026-3415](https://cve.now/CVE-2026-3415.md): XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service (CVSS 8.7, WSO2 API Manager · WSO2 Universal Gateway +4)
- [CVE-2025-14561](https://cve.now/CVE-2025-14561.md): Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations (CVSS 9.0, WSO2 API Manager · WSO2 API Control Plane +4)
- [CVE-2025-12317](https://cve.now/CVE-2025-12317.md): Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges (CVSS 5.0, WSO2 Enterprise Integrator · WSO2 Identity Server)
- [CVE-2025-6508](https://cve.now/CVE-2025-6508.md): User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests (CVSS 4.3, WSO2 API Manager)
- [CVE-2024-6541](https://cve.now/CVE-2024-6541.md): Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products (CVSS 6.8, WSO2 Micro Integrator · WSO2 Enterprise Integrator +2)
- [CVE-2026-19064](https://cve.now/CVE-2026-19064.md): SourceCodester Online Examination & Learning Management System view.php authorization (CVSS 5.3, SourceCodester Online Examination & Learning Management Sys…)
- [CVE-2026-64677](https://cve.now/CVE-2026-64677.md): Anki's local HTTP server is vulnerable to directory traversal attacks (CVSS 5.9, ankitects anki)
- [CVE-2025-15674](https://cve.now/CVE-2025-15674.md): Content Protector (Passster) \< 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API (CVSS 2.7, Passster)
- [CVE-2026-16620](https://cve.now/CVE-2026-16620.md): WPC Name Your Price for WooCommerce \< 2.2.5 - Unauthenticated Price Manipulation via Select Mode (CVSS 7.5, WPC Name Your Price for WooCommerce)
- [CVE-2026-16619](https://cve.now/CVE-2026-16619.md): miniOrange 2FA \< 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts (CVSS 7.5, miniOrange 2FA)
- [CVE-2026-19062](https://cve.now/CVE-2026-19062.md): chiuwingyan house selectall.action sql injection (CVSS 6.9, chiuwingyan house)
- [CVE-2026-16067](https://cve.now/CVE-2026-16067.md): Event Booking Manager for WooCommerce (Pro) \< 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price (CVSS 5.3, Event Booking Manager for WooCommerce)
- [CVE-2026-15256](https://cve.now/CVE-2026-15256.md): Ninja Forms \< 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default (CVSS 4.8, Ninja Forms)
- [CVE-2026-17032](https://cve.now/CVE-2026-17032.md): Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server (CVSS 9.8, google-maps-easy-pro · supsystic-gallery-pro +1)
- [CVE-2026-13342](https://cve.now/CVE-2026-13342.md): Security Optimizer – The All-In-One Protection Plugin \< 1.6.5 - Login Access IP Allowlist Bypass via post\_password (CVSS 5.3, Security Optimizer)
- [CVE-2026-15149](https://cve.now/CVE-2026-15149.md): WP Hotel Booking \< 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation (CVSS 5.3, WP Hotel Booking)
- [CVE-2026-15208](https://cve.now/CVE-2026-15208.md): RegistrationMagic \< 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification (CVSS 5.3, RegistrationMagic)
- [CVE-2026-15147](https://cve.now/CVE-2026-15147.md): Five Star Restaurant Reservations \< 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR (CVSS 5.3, Five Star Restaurant Reservations)
- [CVE-2026-10524](https://cve.now/CVE-2026-10524.md): CoCart \< 4.9.0 - Unauthenticated Arbitrary Price Manipulation (CVSS 7.5, CoCart)
- [CVE-2026-71447](https://cve.now/CVE-2026-71447.md): Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework (CVSS 6.9, ail-project ail-framework)
- [CVE-2026-14936](https://cve.now/CVE-2026-14936.md): Simple Membership \< 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification (CVSS 5.3, Simple Membership)
- [CVE-2026-14831](https://cve.now/CVE-2026-14831.md): Easy Booking \< 3.5.0 - Unauthenticated Minimum Booking Duration Bypass (CVSS 5.3, Easy Booking)
- [CVE-2026-19127](https://cve.now/CVE-2026-19127.md): Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions (CVSS 6.5, GitroomHQ postiz-app)
- [CVE-2026-12901](https://cve.now/CVE-2026-12901.md): GetPaid \< 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification (CVSS 5.9, GetPaid)
- [CVE-2026-12501](https://cve.now/CVE-2026-12501.md): WP Travel Engine \< 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification (CVSS 5.3, WP Travel Engine)
- [CVE-2026-15152](https://cve.now/CVE-2026-15152.md): WP Hotel Booking \< 2.3.2 - Unauthenticated PayPal Payment Bypass (CVSS 5.3, WP Hotel Booking)
- [CVE-2026-14225](https://cve.now/CVE-2026-14225.md): Easy Appointments \< 3.12.28 - Contributor+ Shortcode Allowlist Bypass (CVSS 2.7, Easy Appointments)
- [CVE-2026-14842](https://cve.now/CVE-2026-14842.md): Events Made Easy \< 3.1.2 - Unauthenticated Payment Bypass (CVSS 5.3, Events Made Easy)
- [CVE-2026-19061](https://cve.now/CVE-2026-19061.md): Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity (CVSS 6.3, InstaKNXServiceApp)
- [CVE-2026-71446](https://cve.now/CVE-2026-71446.md): Stored Cross-Site Scripting in AIL Framework Domain Screenshot View (CVSS 6.9, ail-project ail-framework)
- [CVE-2026-70635](https://cve.now/CVE-2026-70635.md): TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index (CVSS 7.1, timescaledb)
- [CVE-2026-70634](https://cve.now/CVE-2026-70634.md): TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator (CVSS 7.2, timescaledb)
- [CVE-2026-14812](https://cve.now/CVE-2026-14812.md): Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) (CVSS 10.0, Premium SEO)
- [CVE-2026-13399](https://cve.now/CVE-2026-13399.md): Payment Plugins for PayPal WooCommerce \< 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order (CVSS 7.5, Payment Plugins for PayPal WooCommerce)
- [CVE-2026-70633](https://cve.now/CVE-2026-70633.md): TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator (CVSS 7.1, timescaledb)
- [CVE-2026-14306](https://cve.now/CVE-2026-14306.md): Tutor LMS \< 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass (CVSS 4.3, Tutor LMS)
- [CVE-2026-71445](https://cve.now/CVE-2026-71445.md): Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework (CVSS 8.2, ail-project ail-framework)
- [CVE-2026-12584](https://cve.now/CVE-2026-12584.md): Payment Gateway for Redsys & WooCommerce Lite \< 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback (CVSS 7.5, Payment Gateway for Redsys & WooCommerce Lite)
- [CVE-2026-11361](https://cve.now/CVE-2026-11361.md): Formidable Forms \< 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL\_PENDING Subscription Status (CVSS 5.9, Formidable Forms)
- [CVE-2026-10599](https://cve.now/CVE-2026-10599.md): Integrate PhonePe with WooCommerce \<= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse (CVSS 7.5, Integrate PhonePe with WooCommerce)
- [CVE-2026-19060](https://cve.now/CVE-2026-19060.md): FoundationAgents MetaGPT code injection (CVSS 4.8, FoundationAgents MetaGPT)
- [CVE-2026-11976](https://cve.now/CVE-2026-11976.md): MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise (CVSS 10.0, MonsterInsights Pro)
- [CVE-2026-71327](https://cve.now/CVE-2026-71327.md): Traefik: Gateway API route identity collision allows cross-namespace backend hijacking (CVSS 7.6, traefik · github.com/traefik/traefik +2)
- [CVE-2026-5336](https://cve.now/CVE-2026-5336.md): Dataverse Integration \< 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure (CVSS 6.8, DataPress)
- [CVE-2026-71326](https://cve.now/CVE-2026-71326.md): Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing (CVSS 2.1, traefik · github.com/traefik/traefik +2)
- [CVE-2026-18487](https://cve.now/CVE-2026-18487.md): Epiphany: address bar / host spoofing via userinfo in ephy\_uri\_get\_decoded\_host() (CVSS 5.4, GNOME Epiphany)
- [CVE-2026-7406](https://cve.now/CVE-2026-7406.md): BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +1)
- [CVE-2026-19059](https://cve.now/CVE-2026-19059.md): FoundationAgents MetaGPT editor.py read path traversal (CVSS 4.8, FoundationAgents MetaGPT)
- [CVE-2026-71325](https://cve.now/CVE-2026-71325.md): Traefik: \`allowCrossNamespace=false\` bypass via \`@kubernetescrd\` TraefikService backendRef (CVSS 4.8, traefik · github.com/traefik/traefik +2)
- [CVE-2026-7405](https://cve.now/CVE-2026-7405.md): TIF File Parsing Out-of-Bounds Read in certain Autodesk products (CVSS 5.5, Autodesk Revit · Autodesk AutoCAD +1)
- [CVE-2026-11803](https://cve.now/CVE-2026-11803.md): PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +1)
- [CVE-2026-8325](https://cve.now/CVE-2026-8325.md): PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +1)
- [CVE-2026-1289](https://cve.now/CVE-2026-1289.md): PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products (CVSS 7.8, Autodesk Revit · Autodesk AutoCAD +1)
- [CVE-2026-71324](https://cve.now/CVE-2026-71324.md): Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool (CVSS 7.0, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-43632](https://cve.now/CVE-2026-43632.md): llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints (CVSS 9.2, ggml-org llama.cpp)
- [CVE-2026-43631](https://cve.now/CVE-2026-43631.md): llama.cpp b7492–b9060 Use-After-Free RCE via llama-server (CVSS 9.2, ggml-org llama.cpp)
- [CVE-2026-43630](https://cve.now/CVE-2026-43630.md): llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure (CVSS 6.3, ggml-org llama.cpp)
- [CVE-2026-43629](https://cve.now/CVE-2026-43629.md): llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore (CVSS 9.2, ggml-org llama.cpp)
- [CVE-2026-43628](https://cve.now/CVE-2026-43628.md): llama.cpp b3978–b9058 Integer Underflow via DRY Sampler (CVSS 8.5, ggml-org llama.cpp)
- [CVE-2026-19058](https://cve.now/CVE-2026-19058.md): FoundationAgents MetaGPT data\_interpreter.py DataInterpreter code injection (CVSS 4.8, FoundationAgents MetaGPT)
- [CVE-2026-43627](https://cve.now/CVE-2026-43627.md): llama.cpp b1283–b9058 Integer Overflow in llama\_batch\_init() Function (CVSS 8.5, ggml-org llama.cpp)
- [CVE-2026-70640](https://cve.now/CVE-2026-70640.md): llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp (CVSS 7.3, ggml-org llama.cpp)
- [CVE-2026-53983](https://cve.now/CVE-2026-53983.md): Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL (CVSS 9.2, Efstratios Goudelis Ground Station)
- [CVE-2026-70639](https://cve.now/CVE-2026-70639.md): llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp (CVSS 6.8, ggml-org llama.cpp)
- [CVE-2026-7867](https://cve.now/CVE-2026-7867.md): Udisks2: udisks2: local privilege escalation via as-user option spoofing (CVSS 7.8, udisks · Red Hat Enterprise Linux)
- [CVE-2026-70638](https://cve.now/CVE-2026-70638.md): llama.cpp b1886–b7445 Integer Overflow via new\_1batch() in llama-android.cpp (CVSS 8.5, ggml-org llama.cpp)
- [CVE-2026-53984](https://cve.now/CVE-2026-53984.md): Ground Station prior to 0.6.0 Unauthenticated Database Wipe and Arbitrary Data Injection via Socket.IO database\_backup full\_restore Action (CVSS 8.8, Efstratios Goudelis Ground Station)
- [CVE-2026-19054](https://cve.now/CVE-2026-19054.md): Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal (CVSS 4.8, Lspace-io lspace-server)
- [CVE-2026-43622](https://cve.now/CVE-2026-43622.md): llama.cpp b1886–b7445 Double Free via llama-android.cpp (CVSS 8.5, ggml-org llama.cpp)
- [CVE-2026-53985](https://cve.now/CVE-2026-53985.md): Ground Station prior to 0.6.0 Unauthenticated DoS via service\_control Socket.IO (CVSS 8.7, Efstratios Goudelis Ground Station)
- [CVE-2026-5423](https://cve.now/CVE-2026-5423.md): Subscription Authentication Bypass via Unverified connectionParams.jwt (CVSS 8.2, neo4j graphql)
- [CVE-2026-18258](https://cve.now/CVE-2026-18258.md): Authorization Bypass Through User-Controlled Key in eScriptorium (CVSS 8.8, Scripta eScriptorium)
- [CVE-2026-18277](https://cve.now/CVE-2026-18277.md): Missing Authorization in eScriptorium (CVSS 7.1, Scripta eScriptorium)
- [CVE-2026-18359](https://cve.now/CVE-2026-18359.md): Server-Side Request Forgery (SSRF) in eScriptorium (CVSS 8.5, Scripta eScriptorium)
- [CVE-2026-18275](https://cve.now/CVE-2026-18275.md): Authorization Bypass Through User-Controlled Key in eScriptorium (CVSS 6.5, Scripta eScriptorium)
- [CVE-2026-18276](https://cve.now/CVE-2026-18276.md): Missing Authorization in eScriptorium (CVSS 4.3, Scripta eScriptorium)
- [CVE-2026-3430](https://cve.now/CVE-2026-3430.md): Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi (CVSS 8.6, Creative Mail)
- [CVE-2026-19047](https://cve.now/CVE-2026-19047.md): NocteDefensor LudusMCP ludus\_cli\_execute cliWrapper.ts executeCommand command injection (CVSS 4.8, NocteDefensor LudusMCP)
- [CVE-2026-18427](https://cve.now/CVE-2026-18427.md): @fastify/static vulnerable to route guard bypass via non-canonical path segments (CVSS 7.5, @fastify/static)
- [CVE-2026-68750](https://cve.now/CVE-2026-68750.md): Quadratic sibling re-flattening in the html\_sanitize\_ex traversal engine allows CPU-exhaustion denial of service (CVSS 8.2, rrrene html\_sanitize\_ex)
- [CVE-2026-68749](https://cve.now/CVE-2026-68749.md): Quadratic regex backtracking in the html\_sanitize\_ex CSS scrubber allows CPU-exhaustion denial of service (CVSS 8.2, rrrene html\_sanitize\_ex)
- [CVE-2026-68747](https://cve.now/CVE-2026-68747.md): CSS sanitizer allowlist bypass in html\_sanitize\_ex via non-declaration input (CVSS 2.3, rrrene html\_sanitize\_ex)
- [CVE-2026-66829](https://cve.now/CVE-2026-66829.md): html\_sanitize\_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection (CVSS 2.3, rrrene html\_sanitize\_ex)
- [CVE-2026-66370](https://cve.now/CVE-2026-66370.md): html\_sanitize\_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking (CVSS 4.8, rrrene html\_sanitize\_ex)
- [CVE-2026-66843](https://cve.now/CVE-2026-66843.md): html\_sanitize\_ex HTML5 scrubber keeps attacker-supplied \`\<object\>\` elements, allowing untrusted content embedding (CVSS 2.3, rrrene html\_sanitize\_ex)
- [CVE-2026-19046](https://cve.now/CVE-2026-19046.md): NocteDefensor LudusMCP ludus\_environment\_guides\_search ludusEnvironmentGuidesSearch.ts path traversal (CVSS 4.8, NocteDefensor LudusMCP)
- [CVE-2026-53977](https://cve.now/CVE-2026-53977.md): OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown (CVSS 8.7, Bohdan Triapitsyn OpenChamber)
- [CVE-2026-70646](https://cve.now/CVE-2026-70646.md): aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler (CVSS 7.5, vovchic17 aiosend · aiosend)
- [CVE-2025-49506](https://cve.now/CVE-2025-49506.md): Apache Portable Runtime Utility: apr\_password\_validate() vulnerable to timing attack (CVSS 7.5, Apache Software Foundation Apache Portable Runtime Utility)
- [CVE-2026-32327](https://cve.now/CVE-2026-32327.md): Apache Portable Runtime Utility: apr-util XML stack recursion crash (CVSS 9.1, Apache Software Foundation Apache Portable Runtime Utility)
- [CVE-2026-34191](https://cve.now/CVE-2026-34191.md): Apache Portable Runtime Utility: SQL Injection in apr\_dbd\_oracle (CVSS 9.1, Apache Software Foundation Apache Portable Runtime Utility)
- [CVE-2026-34501](https://cve.now/CVE-2026-34501.md): Apache Portable Runtime Utility: Heap buffer overflow in APR redis client (CVSS 7.5, Apache Software Foundation Apache Portable Runtime Utility)
- [CVE-2026-34502](https://cve.now/CVE-2026-34502.md): Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVSS 7.5, Apache Software Foundation Apache Portable Runtime Utility)
- [CVE-2026-19045](https://cve.now/CVE-2026-19045.md): NocteDefensor LudusMCP get\_credential\_from\_user secretDialog.ts SecretDialog.showSecretDialog command injection (CVSS 4.8, NocteDefensor LudusMCP)
- [CVE-2026-66711](https://cve.now/CVE-2026-66711.md): WordPress WooCommerce Multilingual & Multicurrency plugin \<= 5.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Amir Helzer WooCommerce Multilingual & Multicurrency)
- [CVE-2026-66710](https://cve.now/CVE-2026-66710.md): WordPress e2pdf plugin \<= 1.32.40 - Local File Inclusion vulnerability (CVSS 8.1, e2pdf)
- [CVE-2026-66709](https://cve.now/CVE-2026-66709.md): WordPress CTX Feed plugin \<= 6.6.42 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, WebAppick CTX Feed)
- [CVE-2026-66708](https://cve.now/CVE-2026-66708.md): WordPress Total Upkeep plugin \<= 1.17.2 - Broken Access Control vulnerability (CVSS 8.2, BoldGrid Total Upkeep)
- [CVE-2026-66707](https://cve.now/CVE-2026-66707.md): WordPress Facebook for WooCommerce plugin \<= 3.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Facebook for WooCommerce)
- [CVE-2026-66706](https://cve.now/CVE-2026-66706.md): WordPress Subscribe to Comments plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Mark Jaquith Subscribe to Comments)
- [CVE-2026-66705](https://cve.now/CVE-2026-66705.md): WordPress Facebook for WordPress plugin \<= 5.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Facebook for WordPress)
- [CVE-2026-66703](https://cve.now/CVE-2026-66703.md): WordPress MailOptin plugin \<= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, properfraction MailOptin)
- [CVE-2026-66702](https://cve.now/CVE-2026-66702.md): WordPress Rank Math SEO plugin \<= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rank Math SEO)
- [CVE-2026-66701](https://cve.now/CVE-2026-66701.md): WordPress Profile Builder plugin \<= 3.16.5 - Broken Access Control vulnerability (CVSS 5.3, Cozmoslabs Profile Builder)
- [CVE-2026-66699](https://cve.now/CVE-2026-66699.md): WordPress Dokan plugin \<= 5.0.10 - Broken Access Control vulnerability (CVSS 5.3, Dokan)
- [CVE-2026-66696](https://cve.now/CVE-2026-66696.md): WordPress Gutenberg Blocks by Kadence Blocks plugin \<= 3.7.8 - Sensitive Data Exposure vulnerability (CVSS 4.3, Nexcess Gutenberg Blocks by Kadence Blocks)
- [CVE-2026-66695](https://cve.now/CVE-2026-66695.md): WordPress W3 Total Cache plugin \<= 2.10.2 - Path Traversal vulnerability (CVSS 6.5, BoldGrid W3 Total Cache)
- [CVE-2026-66694](https://cve.now/CVE-2026-66694.md): WordPress Thrive Architect plugin \<= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Thrive Themes Coupon Thrive Architect)
- [CVE-2026-66692](https://cve.now/CVE-2026-66692.md): WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin \<= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Colissimo Officiel : Méthodes de livraison pour WooCommerce)
- [CVE-2026-66690](https://cve.now/CVE-2026-66690.md): WordPress GiveWP plugin \<= 4.16.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nexcess GiveWP)
- [CVE-2026-66688](https://cve.now/CVE-2026-66688.md): WordPress Ultimate Addons for Elementor plugin \<= 1.45.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Ultimate Addons for Elementor)
- [CVE-2026-66686](https://cve.now/CVE-2026-66686.md): WordPress Plugins Garbage Collector (Database Cleanup) plugin \<= 0.14 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Vladimir Garagulya Plugins Garbage Collector)
- [CVE-2026-66685](https://cve.now/CVE-2026-66685.md): WordPress Featured Video Plus plugin \<= 2.3.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Alex Featured Video Plus)
- [CVE-2026-66684](https://cve.now/CVE-2026-66684.md): WordPress Export Import Menus plugin \<= 1.9.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Akshay Menariya Export Import Menus)
- [CVE-2026-66683](https://cve.now/CVE-2026-66683.md): WordPress Custom CSS and JavaScript plugin \<= 2.0.16 - Sensitive Data Exposure vulnerability (CVSS 5.3, WP Zone Custom CSS and JavaScript)
- [CVE-2026-66681](https://cve.now/CVE-2026-66681.md): WordPress theme My Login plugin \<= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Jeff Farthing Theme My Login)
- [CVE-2026-66678](https://cve.now/CVE-2026-66678.md): WordPress Advanced Custom Fields: Font Awesome Field plugin \<= 6.1.1 - Broken Access Control vulnerability (CVSS 4.3, Justin Kruit Advanced Custom Fields: Font Awesome Field)
- [CVE-2026-66665](https://cve.now/CVE-2026-66665.md): WordPress Type Hub plugin \<= 2.0.6 - Arbitrary File Upload vulnerability (CVSS 10.0, Brandexponents Type Hub)
- [CVE-2026-66664](https://cve.now/CVE-2026-66664.md): WordPress SEO plugin by Squirrly SEO plugin \<= 14.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SEO Squirrly SEO Plugin by Squirrly SEO)
- [CVE-2026-66663](https://cve.now/CVE-2026-66663.md): WordPress WP Data Access plugin \<= 5.5.79 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Passionate Programmer Peter WP Data Access)
- [CVE-2026-66662](https://cve.now/CVE-2026-66662.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.29.10 - Privilege Escalation vulnerability (CVSS 9.8, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2026-66470](https://cve.now/CVE-2026-66470.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.29.10 - Broken Access Control vulnerability (CVSS 7.1, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2026-66457](https://cve.now/CVE-2026-66457.md): WordPress Events Manager plugin \<= 7.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pixelite Events Manager)
- [CVE-2026-66452](https://cve.now/CVE-2026-66452.md): WordPress Legal Text Connector of the IT-Recht Kanzlei plugin \<= 1.0.13 - Broken Access Control vulnerability (CVSS 6.5, Legal Text Connector of the IT-Recht Kanzlei)
- [CVE-2026-66451](https://cve.now/CVE-2026-66451.md): WordPress WP Event SOlution plugin \<= 4.1.9 - Broken Authentication vulnerability (CVSS 6.5, Arraytics WP Event SOlution)
- [CVE-2026-66447](https://cve.now/CVE-2026-66447.md): WordPress WordPress File Upload plugin \<= 5.1.7 - SQL Injection vulnerability (CVSS 9.3, nickboss WordPress File Upload)
- [CVE-2026-66440](https://cve.now/CVE-2026-66440.md): WordPress WPIDE – File Manager & Code Editor plugin \<= 3.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, XplodedThemes WPIDE – File Manager & Code Editor)
- [CVE-2026-66439](https://cve.now/CVE-2026-66439.md): WordPress Advanced AJAX Product Filters plugin \<= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BeRocket Advanced AJAX Product Filters)
- [CVE-2026-66425](https://cve.now/CVE-2026-66425.md): WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin \<= 1.9.0 - Broken Authentication vulnerability (CVSS 6.5, Saad Iqbal Gutena Forms – Contact Form, Survey Form, Feedba…)
- [CVE-2026-65581](https://cve.now/CVE-2026-65581.md): WordPress AI ANN theme \<= 1.29.0 - PHP Object Injection vulnerability (CVSS 9.8, Axiomthemes AI ANN)
- [CVE-2026-65579](https://cve.now/CVE-2026-65579.md): WordPress Agricola theme \<= 1.21.0 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Agricola)
- [CVE-2026-65578](https://cve.now/CVE-2026-65578.md): WordPress Agora theme \<= 1.9 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Agora)
- [CVE-2026-65577](https://cve.now/CVE-2026-65577.md): WordPress Advice theme \<= 1.18.0 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Advice)
- [CVE-2026-65576](https://cve.now/CVE-2026-65576.md): WordPress Adrena theme \<= 1.2.14 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Adrena)
- [CVE-2026-65575](https://cve.now/CVE-2026-65575.md): WordPress Accalia theme \<= 1.5.3 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Accalia)
- [CVE-2026-65574](https://cve.now/CVE-2026-65574.md): WordPress Abogado theme \<= 1.18 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Abogado)
- [CVE-2026-65573](https://cve.now/CVE-2026-65573.md): WordPress Abelle theme \<= 1.22 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Abelle)
- [CVE-2026-65572](https://cve.now/CVE-2026-65572.md): WordPress A.Williams theme \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 9.8, Axiomthemes A.Williams)
- [CVE-2026-65571](https://cve.now/CVE-2026-65571.md): WordPress 69 Clothing theme \<= 1.2.11.1 - PHP Object Injection vulnerability (CVSS 9.8, Axiomthemes 69 Clothing)
- [CVE-2026-65570](https://cve.now/CVE-2026-65570.md): WordPress Login with phone number plugin \<= 1.8.70 - Bypass vulnerability vulnerability (CVSS 8.1, Hamid Alinia Login with phone number)
- [CVE-2026-65569](https://cve.now/CVE-2026-65569.md): WordPress WP Job Portal plugin \<= 2.5.6 - SQL Injection vulnerability (CVSS 8.5, wpjobportal WP Job Portal)
- [CVE-2026-65565](https://cve.now/CVE-2026-65565.md): WordPress Survey Maker plugin \<= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Survey Maker)
- [CVE-2026-65560](https://cve.now/CVE-2026-65560.md): WordPress Houzez Property Feed plugin \<= 2.5.48 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Property Hive Houzez Property Feed)
- [CVE-2026-65559](https://cve.now/CVE-2026-65559.md): WordPress Order Delivery Date for WooCommerce plugin \<= 4.6.0 - Privilege Escalation vulnerability (CVSS 7.2, tychesoftwares Order Delivery Date for WooCommerce)
- [CVE-2026-65556](https://cve.now/CVE-2026-65556.md): WordPress WPBruiser {no- Captcha anti-Spam} plugin \<= 3.1.43 - PHP Object Injection vulnerability (CVSS 9.8, MihChe WPBruiser {no- Captcha anti-Spam})
- [CVE-2026-65554](https://cve.now/CVE-2026-65554.md): WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability (CVSS 7.1, lattepress AnsPress – Question and answer)
- [CVE-2026-65553](https://cve.now/CVE-2026-65553.md): WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin \<= 2.1.3 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, wbolt.com Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件)
- [CVE-2026-65552](https://cve.now/CVE-2026-65552.md): WordPress Export User Data plugin \<= 2.2.6 - PHP Object Injection vulnerability (CVSS 9.8, qstudio Export User Data)
- [CVE-2026-65549](https://cve.now/CVE-2026-65549.md): WordPress Jeg Elementor Kit plugin \<= 3.2.10 - PHP Object Injection vulnerability (CVSS 7.2, jegtheme Jeg Kit for Elementor)
- [CVE-2026-65548](https://cve.now/CVE-2026-65548.md): WordPress Betheme theme \<= 28.4.2 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Muffingroup Betheme)
- [CVE-2026-65546](https://cve.now/CVE-2026-65546.md): WordPress Qode Tours plugin \<= 3.1.3.1 - SQL Injection vulnerability (CVSS 9.3, Qode Tours)
- [CVE-2026-65545](https://cve.now/CVE-2026-65545.md): WordPress AI Engine plugin \<= 3.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jordy Meow AI Engine)
- [CVE-2026-65544](https://cve.now/CVE-2026-65544.md): WordPress Super Socializer plugin \<= 7.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rajat Varlani Super Socializer)
- [CVE-2026-65543](https://cve.now/CVE-2026-65543.md): WordPress Vimeo plugin \<= 1.2.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, vimeodev Vimeo)
- [CVE-2026-65542](https://cve.now/CVE-2026-65542.md): WordPress Super Socializer plugin \<= 7.14.5 - Broken Authentication vulnerability (CVSS 8.8, Rajat Varlani Super Socializer)
- [CVE-2026-65541](https://cve.now/CVE-2026-65541.md): WordPress Staff Training plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 7.3, solutioned Staff Training)
- [CVE-2026-65523](https://cve.now/CVE-2026-65523.md): WordPress Formidable Forms Signature Online Contract Automation plugin \<= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, approveme Formidable Forms Signature Online Contract Automa…)
- [CVE-2026-65520](https://cve.now/CVE-2026-65520.md): WordPress WP OAuth Server plugin \<= 6.2.0 - SQL Injection vulnerability (CVSS 9.3, miniOrange WP OAuth Server)
- [CVE-2026-65517](https://cve.now/CVE-2026-65517.md): WordPress Easy PayPal Buy Now Button plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Scott Paterson Easy PayPal Buy Now Button)
- [CVE-2026-65515](https://cve.now/CVE-2026-65515.md): WordPress AffiliateWP plugin \<= 2.35.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AffiliateWP)
- [CVE-2026-65513](https://cve.now/CVE-2026-65513.md): WordPress Simply Schedule Appointments plugin \<= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NSquared Simply Schedule Appointments)
- [CVE-2026-65509](https://cve.now/CVE-2026-65509.md): WordPress wpDataTables plugin \<= 7.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpDataTables)
- [CVE-2026-65508](https://cve.now/CVE-2026-65508.md): WordPress Simply Schedule Appointments plugin \<= 1.6.12.10 - SQL Injection vulnerability (CVSS 9.3, NSquared Simply Schedule Appointments)
- [CVE-2026-65507](https://cve.now/CVE-2026-65507.md): WordPress AIWU plugin \<= 1.5.6 - Privilege Escalation vulnerability (CVSS 9.8, Sergey AIWU)
- [CVE-2026-65504](https://cve.now/CVE-2026-65504.md): WordPress BOX NOW Delivery Croatia plugin \<= 3.3.0 - Broken Access Control vulnerability (CVSS 7.5, ivanbebek BOX NOW Delivery Croatia)
- [CVE-2026-65502](https://cve.now/CVE-2026-65502.md): WordPress Element Pack Elementor Addons plugin \<= 8.7.13 - Captcha Bypass vulnerability (CVSS 5.3, bdthemes Element Pack Elementor Addons)
- [CVE-2026-61982](https://cve.now/CVE-2026-61982.md): WordPress SiteGuard WP Plugin plugin \<= 1.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jp-secure SiteGuard WP Plugin)
- [CVE-2026-61964](https://cve.now/CVE-2026-61964.md): WordPress Ninja Tables plugin \<= 5.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPManageNinja Ninja Tables)
- [CVE-2026-61963](https://cve.now/CVE-2026-61963.md): WordPress Media LIbrary Assistant plugin \<= 3.38 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Lingren Media LIbrary Assistant)
- [CVE-2026-61961](https://cve.now/CVE-2026-61961.md): WordPress EmbedPress plugin \<= 4.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPDeveloper EmbedPress)
- [CVE-2026-61959](https://cve.now/CVE-2026-61959.md): WordPress Business Directory plugin \<= 6.4.24 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Strategy11 Team Business Directory)
- [CVE-2026-32548](https://cve.now/CVE-2026-32548.md): WordPress SureCart plugin \<= 4.6.2 - Broken Access Control vulnerability (CVSS 5.3, SureCart)
- [CVE-2026-32469](https://cve.now/CVE-2026-32469.md): WordPress CAPTCHA 4WP plugin \<= 7.6.0 - Captcha Bypass vulnerability (CVSS 5.3, WPKube CAPTCHA 4WP)
- [CVE-2026-28183](https://cve.now/CVE-2026-28183.md): WordPress PublishPress Capabilities plugin \<= 2.45.0 - Privilege Escalation vulnerability (CVSS 7.2, PublishPress Capabilities)
- [CVE-2026-28180](https://cve.now/CVE-2026-28180.md): WordPress Mercado Pago payments for WooCommerce plugin \<= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Mercado Pago payments for WooCommerce)
- [CVE-2026-28179](https://cve.now/CVE-2026-28179.md): WordPress FiboSearch plugin \<= 1.33.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Damian Góra FiboSearch)
- [CVE-2026-28178](https://cve.now/CVE-2026-28178.md): WordPress Powerkit plugin \<= 3.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codesupplyco Powerkit)
- [CVE-2026-28177](https://cve.now/CVE-2026-28177.md): WordPress Popup Maker plugin \<= 1.23.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Code Atlantic Popup Maker)
- [CVE-2026-28172](https://cve.now/CVE-2026-28172.md): WordPress Tracking Code Manager plugin \<= 2.6.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Data443 Risk Mitigation Tracking Code Manager)
- [CVE-2026-28169](https://cve.now/CVE-2026-28169.md): WordPress YITH WooCommerce Zoom Magnifier plugin \<= 2.52.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, YITHEMES YITH WooCommerce Zoom Magnifier)
- [CVE-2026-28146](https://cve.now/CVE-2026-28146.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.14 - Arbitrary File Download vulnerability (CVSS 6.5, Unlimited Elements For Elementor)
- [CVE-2026-28143](https://cve.now/CVE-2026-28143.md): WordPress Forminator plugin \<= 1.56.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPMU DEV Forminator)
- [CVE-2026-28141](https://cve.now/CVE-2026-28141.md): WordPress NextGEN Gallery plugin \<= 4.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Syed Balkhi NextGEN Gallery)
- [CVE-2026-28140](https://cve.now/CVE-2026-28140.md): WordPress JetFormBuilder plugin \<= 3.6.4.1 - Broken Access Control vulnerability (CVSS 7.5, jetmonsters JetFormBuilder)
- [CVE-2026-28139](https://cve.now/CVE-2026-28139.md): WordPress Ajax Search Lite plugin \<= 4.14.4 - PHP Object Injection vulnerability (CVSS 9.8, wpdreams Ajax Search Lite)
- [CVE-2026-28111](https://cve.now/CVE-2026-28111.md): WordPress Forminator plugin \<= 1.56.0 - Privilege Escalation vulnerability (CVSS 8.8, WPMU DEV Forminator)
- [CVE-2026-28082](https://cve.now/CVE-2026-28082.md): WordPress JetEngine plugin \<= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock. Jetimpex JetEngine)
- [CVE-2026-28005](https://cve.now/CVE-2026-28005.md): WordPress Kadence WooCommerce Email Designer plugin \<= 1.5.19 - Privilege Escalation vulnerability (CVSS 9.8, Nexcess Kadence WooCommerce Email Designer)
- [CVE-2026-25403](https://cve.now/CVE-2026-25403.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 3.0.5 - Broken Access Control vulnerability (CVSS 6.5, bdthemes Ultimate Store Kit Elementor Addons)
- [CVE-2026-66712](https://cve.now/CVE-2026-66712.md): WordPress Simple Membership plugin \<= 4.7.8 - Broken Access Control vulnerability (CVSS 7.5, wp.insider Simple Membership)
- [CVE-2026-53976](https://cve.now/CVE-2026-53976.md): OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter (CVSS 9.3, Bohdan Triapitsyn OpenChamber)
- [CVE-2026-15246](https://cve.now/CVE-2026-15246.md): RealHomes Memberships \< 3.1.0 - Subscriber+ Membership Payment Bypass (CVSS 4.3, RealHomes Memberships)
- [CVE-2026-19044](https://cve.now/CVE-2026-19044.md): LeeSinLiang godot-mcp create\_scene/add\_node index.ts executeOperation command injection (CVSS 4.8, LeeSinLiang godot-mcp)
- [CVE-2026-70637](https://cve.now/CVE-2026-70637.md): LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c (CVSS 8.2, hfiref0x LightFTP)
- [CVE-2026-53975](https://cve.now/CVE-2026-53975.md): OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec (CVSS 9.3, Bohdan Triapitsyn OpenChamber)
- [CVE-2026-54489](https://cve.now/CVE-2026-54489.md): Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulner (CVSS 9.1, Dell Virtual Storage Integrator for VMware vSphere Client)
- [CVE-2026-67261](https://cve.now/CVE-2026-67261.md): Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in (CVSS 9.8, Dell Virtual Storage Integrator for VMware vSphere Client)
- [CVE-2026-64993](https://cve.now/CVE-2026-64993.md): Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. (CVSS 6.8, Dell RVTools)
- [CVE-2026-5134](https://cve.now/CVE-2026-5134.md): SQLi in Loca Software's CMS (CVSS 9.8, Loca Software Informatics Technology Ltd. CMS)
- [CVE-2026-19041](https://cve.now/CVE-2026-19041.md): MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection (CVSS 5.3, MissionSquad mcp-api)
- [CVE-2026-18501](https://cve.now/CVE-2026-18501.md): UsersWP \<= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution (CVSS 6.4, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2026-12605](https://cve.now/CVE-2026-12605.md): In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin \`gfresttoken\` to attacker-co (CVSS 9.6, Eclipse Foundation Eclipse GlassFish)
- [CVE-2026-19040](https://cve.now/CVE-2026-19040.md): MissionSquad mcp-api dcrClients.ts server-side request forgery (CVSS 5.3, MissionSquad mcp-api)
- [CVE-2026-16731](https://cve.now/CVE-2026-16731.md): Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout (CVSS 8.3, OMICRON electronics OMICRON StationScout)
- [CVE-2026-16316](https://cve.now/CVE-2026-16316.md): Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard (CVSS 1.3, OMICRON electronics OMICRON StationGuard)
- [CVE-2026-16315](https://cve.now/CVE-2026-16315.md): Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard (CVSS 8.1, OMICRON electronics OMICRON StationGuard)
- [CVE-2026-19039](https://cve.now/CVE-2026-19039.md): Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh\_exec command injection (CVSS 4.8, Kino-Kafkaesque ssh-mcp-server)
- [CVE-2026-66733](https://cve.now/CVE-2026-66733.md): Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache (CVSS 8.7, Eukaryot sonic3air)
- [CVE-2026-66732](https://cve.now/CVE-2026-66732.md): Sonic 3 A.I.R. Missing Source Address Validation in ConnectionManager (CVSS 8.3, Eukaryot sonic3air)
- [CVE-2026-65551](https://cve.now/CVE-2026-65551.md): WordPress Breakdance plugin \< 2.7 - Broken Access Control vulnerability (CVSS 7.5, Soflyy Breakdance)
- [CVE-2026-19038](https://cve.now/CVE-2026-19038.md): MonomythDevelopment la-forge-mcp screenshot\_element Tool index.ts screenshotElement path traversal (CVSS 5.3, MonomythDevelopment la-forge-mcp)
- [CVE-2026-15599](https://cve.now/CVE-2026-15599.md): Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner (CVSS 3.3, TÜBİTAK BİLGEM Software Technologies Research Institute par…)
- [CVE-2026-19037](https://cve.now/CVE-2026-19037.md): WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update\_lob behavioral workflow (CVSS 5.3, WonderTrader)
- [CVE-2026-0673](https://cve.now/CVE-2026-0673.md): Element Pack Addons for Elementor \<= 8.3.15 - Unauthenticated SMTP Header Injection (CVSS 5.3, bdthemes Element Pack Addons for Elementor – Elementor Widg…)
- [CVE-2026-70556](https://cve.now/CVE-2026-70556.md): Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration (CVSS 5.1, Hubzilla)
- [CVE-2026-19036](https://cve.now/CVE-2026-19036.md): Shibby Tomato wanoptions sub\_40F88C os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-19035](https://cve.now/CVE-2026-19035.md): Shibby Tomato qoslimit new\_qoslimit\_start os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-8166](https://cve.now/CVE-2026-8166.md): Stored XSS in Logo Software's e-Logo Purchasing Portal (CVSS 5.4, Logo Software Industry and Trade e-Logo Purchasing Portal)
- [CVE-2025-9266](https://cve.now/CVE-2025-9266.md): Accelerate \<= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation (CVSS 4.3, themegrill Accelerate)
- [CVE-2025-15028](https://cve.now/CVE-2025-15028.md): FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More \<= 1.9.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, wpwax FormGent – Next-Gen AI Form Builder for WordPress wit…)
- [CVE-2026-11983](https://cve.now/CVE-2026-11983.md): Ad Inserter \<= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai\_ajax (CVSS 5.3, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-5391](https://cve.now/CVE-2026-5391.md): LatePoint \<= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-5158](https://cve.now/CVE-2026-5158.md): PostX \<= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comments Block (CVSS 6.4, wpxpo Post Grid Gutenberg Blocks – PostX)
- [CVE-2026-57818](https://cve.now/CVE-2026-57818.md): Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider (CVSS 8.1, Apache Software Foundation Apache CXF)
- [CVE-2026-61466](https://cve.now/CVE-2026-61466.md): Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation (CVSS 9.1, Apache Software Foundation Apache CXF)
- [CVE-2026-63687](https://cve.now/CVE-2026-63687.md): Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters (CVSS 9.1, Apache Software Foundation Apache CXF)
- [CVE-2026-65583](https://cve.now/CVE-2026-65583.md): Apache CXF: Self-issued ID token claims validation skipped (CVSS 9.1, Apache Software Foundation Apache CXF)
- [CVE-2026-68079](https://cve.now/CVE-2026-68079.md): Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay (CVSS 9.8, Apache Software Foundation Apache CXF)
- [CVE-2026-68481](https://cve.now/CVE-2026-68481.md): Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider (CVSS 7.5, Apache Software Foundation Apache CXF)
- [CVE-2026-19034](https://cve.now/CVE-2026-19034.md): Shibby Tomato qoslimittc\_stop.sh new\_qoslimit\_stop os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-65432](https://cve.now/CVE-2026-65432.md): Apache CXF: XXE via WSDL/XSD import parsing (CVSS 7.5, Apache Software Foundation Apache CXF)
- [CVE-2026-57817](https://cve.now/CVE-2026-57817.md): Apache CXF: The authorization code hash (c\_hash) is not enforced for the hybrid OIDC flow (CVSS 8.1, Apache Software Foundation Apache CXF)
- [CVE-2026-66909](https://cve.now/CVE-2026-66909.md): Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage (CVSS 9.8, Apache Software Foundation Apache CXF)
- [CVE-2026-64958](https://cve.now/CVE-2026-64958.md): Apache CXF: Denial of service via message header attachments (CVSS 7.5, Apache Software Foundation Apache CXF)
- [CVE-2026-57819](https://cve.now/CVE-2026-57819.md): Apache CXF: No default restriction on the amount of form parameters per message (CVSS 7.5, Apache Software Foundation Apache CXF)
- [CVE-2026-54225](https://cve.now/CVE-2026-54225.md): Apache CXF: Denial of Service attack via large attachments (CVSS 7.5, Apache Software Foundation Apache CXF)
- [CVE-2026-55980](https://cve.now/CVE-2026-55980.md): Denial-of-service vulnerability in CatchPulse (CVSS 5.5, SecureAge CatchPulse)
- [CVE-2026-55979](https://cve.now/CVE-2026-55979.md): Improper access control check in CatchPulse's named pipe communication interface (CVSS 5.2, SecureAge CatchPulse)
- [CVE-2026-55978](https://cve.now/CVE-2026-55978.md): Improper access control vulnerability in CatchPulse (CVSS 8.4, SecureAge CatchPulse)
- [CVE-2026-64640](https://cve.now/CVE-2026-64640.md): Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation (CVSS 5.3, Apache Software Foundation Apache Polaris · apache-polaris)
- [CVE-2026-19022](https://cve.now/CVE-2026-19022.md): OpenHands send\_pull\_request.py initialize\_repo command injection (CVSS 5.3, OpenHands)
- [CVE-2026-19021](https://cve.now/CVE-2026-19021.md): SourceCodester Computer Repair Shop Management System Master.php delete\_product sql injection (CVSS 6.9, SourceCodester Computer Repair Shop Management System)
- [CVE-2026-19020](https://cve.now/CVE-2026-19020.md): itsourcecode Hospital Management System servicetype.php sql injection (CVSS 5.3, itsourcecode Hospital Management System)
- [CVE-2026-18597](https://cve.now/CVE-2026-18597.md): Blind SSRF on Foxit PDF Services API (CVSS 8.5, Foxit Software Foxit PDF Services API)
- [CVE-2026-5430](https://cve.now/CVE-2026-5430.md): Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover (CVSS 10.0, KEV, WSO2 Universal Gateway · WSO2 Traffic Manager +3)
- [CVE-2026-1728](https://cve.now/CVE-2026-1728.md): Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover (CVSS 9.8, WSO2 API Manager · WSO2 API Control Plane +4)
- [CVE-2025-15039](https://cve.now/CVE-2025-15039.md): Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products (CVSS 9.4, WSO2 Identity Server · WSO2 API Manager +7)
- [CVE-2026-0637](https://cve.now/CVE-2026-0637.md): Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products (CVSS 4.4, WSO2 API Manager · WSO2 Traffic Manager +6)
- [CVE-2025-13394](https://cve.now/CVE-2025-13394.md): Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions (CVSS 5.4, WSO2 Identity Server · WSO2 API Manager +44)
- [CVE-2026-18915](https://cve.now/CVE-2026-18915.md): Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock (CVSS 5.0, TÜBİTAK BİLGEM Software Technologies Research Institute eta…)
- [CVE-2025-13909](https://cve.now/CVE-2025-13909.md): Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure (CVSS 4.3, WSO2 Identity Server · WSO2 Carbon Identity Application… +3)
- [CVE-2025-12627](https://cve.now/CVE-2025-12627.md): Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions (CVSS 2.4, WSO2 Identity Server · WSO2 Carbon OAuth)
- [CVE-2025-14779](https://cve.now/CVE-2025-14779.md): Improper Access Control via Secret Type Management API in WSO2 Identity Server (CVSS 3.8, WSO2 Identity Server · WSO2 Carbon Identity API Server S… +1)
- [CVE-2025-11850](https://cve.now/CVE-2025-11850.md): Improper Implicit Association via User Store Initialization in WSO2 Identity Server \[Identity Confusion / External IDP Use\] (CVSS 4.3, WSO2 Identity Server · WSO2 Token Exchange Grant Type For O…)
- [CVE-2025-13736](https://cve.now/CVE-2025-13736.md): Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery (CVSS 3.7, WSO2 Identity Server as Key Manager · WSO2 Identity Serv… +3)
- [CVE-2024-10302](https://cve.now/CVE-2024-10302.md): Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure (CVSS 4.0, WSO2 API Control Plane · WSO2 Traffic Manager +6)
- [CVE-2024-6832](https://cve.now/CVE-2024-6832.md): Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks (CVSS 5.9, WSO2 Enterprise Integrator · WSO2 API Control Plane +7)
- [CVE-2024-8995](https://cve.now/CVE-2024-8995.md): Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access (CVSS 4.9, WSO2 API Manager · WSO2 Traffic Manager +6)
- [CVE-2026-19019](https://cve.now/CVE-2026-19019.md): poco-ai poco-agent Claude File workspace.py WorkspaceManager.\_setup\_session\_persistence cleanup (CVSS 6.3, poco-ai poco-agent)
- [CVE-2026-19011](https://cve.now/CVE-2026-19011.md): TinyAGI agents.ts buildSystemPrompt file inclusion (CVSS 6.9, TinyAGI)
- [CVE-2026-64604](https://cve.now/CVE-2026-64604.md): KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (no CVSS, Linux)
- [CVE-2026-64603](https://cve.now/CVE-2026-64603.md): platform/x86: intel-hid: Protect ACPI notify handler against recursion (no CVSS, Linux)
- [CVE-2026-64602](https://cve.now/CVE-2026-64602.md): iio: adc: spear: Initialize completion before requesting IRQ (no CVSS, Linux)
- [CVE-2026-64601](https://cve.now/CVE-2026-64601.md): ALSA: us144mkii: capture\_urb\_complete: redundant usb\_anchor\_urb corrupts anchor list on each resubmission (CVSS 7.8, Linux)
- [CVE-2026-64599](https://cve.now/CVE-2026-64599.md): crypto: amlogic - avoid double cleanup in meson\_crypto\_probe() (CVSS 7.8, Linux)
- [CVE-2026-64598](https://cve.now/CVE-2026-64598.md): smb/client: Fix error code in smb2\_aead\_req\_alloc() (CVSS 8.8, Linux)
- [CVE-2026-64597](https://cve.now/CVE-2026-64597.md): smb: client: fix double-free in SMB2\_close() replay (CVSS 9.8, Linux)
- [CVE-2026-64596](https://cve.now/CVE-2026-64596.md): libfs: set SB\_I\_NOEXEC and SB\_I\_NODEV by default in init\_pseudo() (no CVSS, Linux)
- [CVE-2026-64595](https://cve.now/CVE-2026-64595.md): HID: hid-lenovo-go: cancel cfg\_setup work in hid\_go\_cfg\_remove() (no CVSS, Linux)
- [CVE-2026-64594](https://cve.now/CVE-2026-64594.md): usb: gadget: f\_fs: initialize reset\_work at allocation time (no CVSS, Linux)
- [CVE-2026-64593](https://cve.now/CVE-2026-64593.md): btrfs: do not trim a device which is not writeable (no CVSS, Linux)
- [CVE-2026-64592](https://cve.now/CVE-2026-64592.md): riscv: mm: Unconditionally sfence.vma for spurious fault (no CVSS, Linux)
- [CVE-2026-64591](https://cve.now/CVE-2026-64591.md): iommu/vt-d: Avoid WARNING in sva unbind path (no CVSS, Linux)
- [CVE-2026-64590](https://cve.now/CVE-2026-64590.md): dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning (no CVSS, Linux)
- [CVE-2026-64589](https://cve.now/CVE-2026-64589.md): i2c: core: fix NULL-deref on adapter registration failure (no CVSS, Linux)
- [CVE-2026-64588](https://cve.now/CVE-2026-64588.md): fuse-uring: fix data races on ring-\>ready (CVSS 7.8, Linux)
- [CVE-2026-64587](https://cve.now/CVE-2026-64587.md): net: ethernet: arc: emac: quiesce interrupts before requesting IRQ (CVSS 7.0, Linux)
- [CVE-2026-64586](https://cve.now/CVE-2026-64586.md): wifi: brcmfmac: drain bus\_reset work on device removal (CVSS 8.8, Linux)
- [CVE-2026-64585](https://cve.now/CVE-2026-64585.md): can: esd\_usb: kill anchored URBs before freeing netdevs (CVSS 7.8, Linux)
- [CVE-2026-64584](https://cve.now/CVE-2026-64584.md): usb: gadget: f\_midi: cancel pending IN work before freeing the midi object (CVSS 7.8, Linux)
- [CVE-2026-64583](https://cve.now/CVE-2026-64583.md): usb: gadget: udc: bdc: free IRQ and drain func\_wake\_notify before teardown (CVSS 7.8, Linux)
- [CVE-2026-19010](https://cve.now/CVE-2026-19010.md): TinyAGI Message API Endpoint index.ts processMessage authorization (CVSS 6.9, TinyAGI)
- [CVE-2026-18649](https://cve.now/CVE-2026-18649.md): Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-19009](https://cve.now/CVE-2026-19009.md): TinyAGI Message API Endpoint response.ts collectFiles file inclusion (CVSS 6.9, TinyAGI)
- [CVE-2026-19008](https://cve.now/CVE-2026-19008.md): mf-yang openclaw-cn apply\_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following (CVSS 5.3, mf-yang openclaw-cn)
- [CVE-2026-19007](https://cve.now/CVE-2026-19007.md): mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management (CVSS 5.3, mf-yang openclaw-cn)
- [CVE-2026-14204](https://cve.now/CVE-2026-14204.md): Google Authenticator \< 0.56 - 2FA Secret Overwrite via CSRF (CVSS 6.5, Google Authenticator)
- [CVE-2026-13703](https://cve.now/CVE-2026-13703.md): SEO Redirection Plugin – 301 Redirect Manager \< 9.19 - Subscriber+ Redirect Rule Disclosure (CVSS 5.4, SEO Redirection Plugin)
- [CVE-2026-13154](https://cve.now/CVE-2026-13154.md): Essential Blocks \< 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint (CVSS 7.5, Gutenberg Essential Blocks)
- [CVE-2026-13153](https://cve.now/CVE-2026-13153.md): Essential Blocks \< 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint (CVSS 7.5, Gutenberg Essential Blocks)
- [CVE-2026-12713](https://cve.now/CVE-2026-12713.md): WPCargo Track & Trace \< 8.0.4 - Unauthenticated SQL Injection via wpcargo\_tracking\_number (CVSS 9.1, WPCargo Track & Trace)
- [CVE-2025-15678](https://cve.now/CVE-2025-15678.md): Nexter Blocks \< 5.0.2 - Author+ Stored XSS via SVG Upload (CVSS 6.1, Nexter Blocks)
- [CVE-2026-16537](https://cve.now/CVE-2026-16537.md): Slick Slider \< 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode (CVSS 5.4, Slick Slider)
- [CVE-2026-18395](https://cve.now/CVE-2026-18395.md): Child Pages Card \< 1.09 - Contributor+ Stored XSS via Shortcode Attributes (CVSS 5.4, Child Pages Card)
- [CVE-2026-16065](https://cve.now/CVE-2026-16065.md): Welcart e-Commerce \< 2.11.32 - Editor+ SQL Injection via CSV Import (CVSS 6.5, Welcart e-Commerce)
- [CVE-2026-19006](https://cve.now/CVE-2026-19006.md): mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization (CVSS 5.3, mf-yang openclaw-cn)
- [CVE-2026-14829](https://cve.now/CVE-2026-14829.md): Checkimate \<= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret (CVSS 8.2, Checkimate — WooCommerce Checkout, Abandoned Cart Recovery…)
- [CVE-2026-11588](https://cve.now/CVE-2026-11588.md): EONSR AEO Agent \<= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation (CVSS 6.1, EONSR AEO Agent)
- [CVE-2026-18050](https://cve.now/CVE-2026-18050.md): Events Manager \< 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads (CVSS 7.5, Events Manager)
- [CVE-2026-16954](https://cve.now/CVE-2026-16954.md): AI Engine \< 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens (CVSS 6.5, AI Engine)
- [CVE-2026-16734](https://cve.now/CVE-2026-16734.md): Stripe Payment Forms by WP Full Pay \< 8.5.2 - Unauthenticated Payment Intent Amount Manipulation (CVSS 7.5, Stripe Payment Forms by WP Full Pay)
- [CVE-2026-16290](https://cve.now/CVE-2026-16290.md): ProfileGrid \< 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm\_get\_all\_users\_from\_group (CVSS 5.3, ProfileGrid)
- [CVE-2026-16268](https://cve.now/CVE-2026-16268.md): Newsletters \< 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler (CVSS 8.2, Newsletters)
- [CVE-2026-16054](https://cve.now/CVE-2026-16054.md): Drag and Drop Multiple File Upload for WooCommerce \< 1.1.8 - Unauthenticated File Deletion via Nonce Oracle (CVSS 9.1, Drag and Drop Multiple File Upload for WooCommerce)
- [CVE-2026-14547](https://cve.now/CVE-2026-14547.md): Estatik Real Estate Plugin \< 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form (CVSS 5.3, Estatik Real Estate Plugin)
- [CVE-2026-14240](https://cve.now/CVE-2026-14240.md): Tourmaster \< 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export (CVSS 5.3, tourmaster)
- [CVE-2026-14314](https://cve.now/CVE-2026-14314.md): PeproDev WooCommerce Receipt Uploader \<= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR (CVSS 5.3, PeproDev WooCommerce Receipt Uploader)
- [CVE-2026-14313](https://cve.now/CVE-2026-14313.md): PeproDev WooCommerce Receipt Uploader \<= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR (CVSS 5.3, PeproDev WooCommerce Receipt Uploader)
- [CVE-2026-19005](https://cve.now/CVE-2026-19005.md): nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management (CVSS 5.3, nanocoai NanoClaw)
- [CVE-2026-18967](https://cve.now/CVE-2026-18967.md): Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow (CVSS 6.4, Red Hat Build of Keycloak · Red Hat JBoss Enterprise App… +1)
- [CVE-2026-18510](https://cve.now/CVE-2026-18510.md): TranslatePress \<= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-18400](https://cve.now/CVE-2026-18400.md): Slider, Gallery, and Carousel by MetaSlider \<= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting (CVSS 6.4, Slider, Gallery, and Carousel by MetaSlider – Image Slider,…)
- [CVE-2026-19000](https://cve.now/CVE-2026-19000.md): JeecgBoot Anonymous Chat Attachment send server-side request forgery (CVSS 6.9, JeecgBoot)
- [CVE-2026-18998](https://cve.now/CVE-2026-18998.md): cosmicstack-labs mercury-agent delegate\_task Tool sub-agent.ts SubAgent.run improper authorization (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-18997](https://cve.now/CVE-2026-18997.md): cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-15459](https://cve.now/CVE-2026-15459.md): WPMU DEV Dashboard \<= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP\_AUTH HMAC on ?wpmudev-hub= Endpoint (CVSS 8.1, wpmudev WPMU DEV Dashboard)
- [CVE-2026-18996](https://cve.now/CVE-2026-18996.md): cosmicstack-labs mercury-agent run\_command permissions.ts PermissionManager.checkShellCommand privileges assignment (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-18995](https://cve.now/CVE-2026-18995.md): netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure (CVSS 5.3, netease-youdao LobsterAI)
- [CVE-2026-18909](https://cve.now/CVE-2026-18909.md): A stack-based buffer overflow vulnerability exists in ELAN Microelectronics Corp. (CVSS 5.6, ELAN Microelectronics ELAN Smart-Pad)
- [CVE-2026-18993](https://cve.now/CVE-2026-18993.md): NousResearch hermes-agent Memory Toolset model\_tools.py access control (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-18992](https://cve.now/CVE-2026-18992.md): zhayujie CowAgent Self-Evolution Review Agent executor.py \_select\_tools authorization (CVSS 5.3, zhayujie CowAgent)
- [CVE-2026-18325](https://cve.now/CVE-2026-18325.md): Forminator Forms \<= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field (CVSS 7.2, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-15991](https://cve.now/CVE-2026-15991.md): File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter (CVSS 8.8, bitpressadmin File Manager)
- [CVE-2026-16636](https://cve.now/CVE-2026-16636.md): FluentSMTP \<= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs (CVSS 7.2, wpmanageninja FluentSMTP – WP SMTP Plugin with Amazon SES,…)
- [CVE-2026-18991](https://cve.now/CVE-2026-18991.md): nanocoai NanoClaw send\_file core.ts path traversal (CVSS 6.9, nanocoai NanoClaw)
- [CVE-2026-18990](https://cve.now/CVE-2026-18990.md): letta-ai LettaBot API Status Route server.ts missing authentication (CVSS 6.9, letta-ai LettaBot)
- [CVE-2026-18980](https://cve.now/CVE-2026-18980.md): nearai ironclaw shell.rs classify\_command\_risk command injection (CVSS 5.3, nearai ironclaw)
- [CVE-2026-18976](https://cve.now/CVE-2026-18976.md): NousResearch hermes-agent disabled\_toolsets agent\_init.py get\_tool\_definitions privileges assignment (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-18974](https://cve.now/CVE-2026-18974.md): heshengtao super-agent-party execute\_tool\_manually Endpoint server.py get\_file\_content information disclosure (CVSS 6.9, heshengtao super-agent-party)
- [CVE-2026-18973](https://cve.now/CVE-2026-18973.md): heshengtao super-agent-party extension\_proxy Route server.py sanitize\_proxy\_url server-side request forgery (CVSS 6.9, heshengtao super-agent-party)
- [CVE-2024-39024](https://cve.now/CVE-2024-39024.md): In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. (CVSS 8.8)
- [CVE-2026-67687](https://cve.now/CVE-2026-67687.md): Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in R (CVSS 8.8)
- [CVE-2026-67688](https://cve.now/CVE-2026-67688.md): ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. (CVSS 9.8)
- [CVE-2026-67689](https://cve.now/CVE-2026-67689.md): SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the \`field\` and \`order\` parameters in p (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.