# CVEs published 2026-08-10

671 CVEs were published on August 10, 2026: 85 critical, 250 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-11812](https://cve.now/CVE-2026-11812.md): UpdateHub: race condition on shared context causes out-of-bounds write and DoS (CVSS 2.5, zephyrproject zephyr)
- [CVE-2026-11811](https://cve.now/CVE-2026-11811.md): Socket file-descriptor leak in UpdateHub OTA client start\_coap\_client() leading to resource-exhaustion DoS (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-8718](https://cve.now/CVE-2026-8718.md): Out-of-bounds write in DTLS peer Connection ID getsockopt (\`TLS\_DTLS\_PEER\_CID\_VALUE\`) in Zephyr net sockets/TLS (CVSS 8.4, zephyrproject zephyr)
- [CVE-2026-48161](https://cve.now/CVE-2026-48161.md): react18-use was vulnerable to malicious code execution via compromised commits (CVSS 9.3, dai-shi react18-use)
- [CVE-2025-30241](https://cve.now/CVE-2025-30241.md): OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices (CVSS 8.6, TP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +29)
- [CVE-2025-30240](https://cve.now/CVE-2025-30240.md): Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices (CVSS 5.1, TP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +30)
- [CVE-2025-30239](https://cve.now/CVE-2025-30239.md): Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices (CVSS 8.5, TP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +62)
- [CVE-2025-30238](https://cve.now/CVE-2025-30238.md): Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices (CVSS 8.6, TP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +56)
- [CVE-2025-30237](https://cve.now/CVE-2025-30237.md): Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices (CVSS 8.7, TP-Link Systems HB810(US2) V1.0/1.6/2.0/2.6 · TP-Link S… +53)
- [CVE-2025-32736](https://cve.now/CVE-2025-32736.md): PingFederate Administrative Console CSRF weaknesses (CVSS 4.9, Ping Identity PingFederate)
- [CVE-2026-72919](https://cve.now/CVE-2026-72919.md): Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams (CVSS 4.3, RocketChat Rocket.Chat)
- [CVE-2026-72918](https://cve.now/CVE-2026-72918.md): Rocket.Chat: Insecure implementation of websocket notifications (CVSS 5.4, RocketChat Rocket.Chat)
- [CVE-2026-72917](https://cve.now/CVE-2026-72917.md): AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization (CVSS 5.9, Mintplex-Labs anything-llm)
- [CVE-2026-6426](https://cve.now/CVE-2026-6426.md): Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access (CVSS 4.4, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-72916](https://cve.now/CVE-2026-72916.md): Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses (CVSS 6.3, mastodon)
- [CVE-2026-72915](https://cve.now/CVE-2026-72915.md): Mastodon: Personally-identifying information disclosure due to incorrect access control validation (CVSS 7.5, mastodon)
- [CVE-2026-72914](https://cve.now/CVE-2026-72914.md): Mastodon: Exhausting data by an unauthenticated request to the admin retention API (CVSS 7.5, mastodon)
- [CVE-2026-48160](https://cve.now/CVE-2026-48160.md): react-tracked was vulnerable to malicious code execution via compromised commits (CVSS 9.3, dai-shi react-tracked)
- [CVE-2026-72913](https://cve.now/CVE-2026-72913.md): Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences (CVSS 7.3, kovidgoyal kitty)
- [CVE-2026-72912](https://cve.now/CVE-2026-72912.md): CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL (CVSS 4.3, gchq CyberChef)
- [CVE-2026-72911](https://cve.now/CVE-2026-72911.md): ERPNext: Possibility of server-side template injection due to missing validation (CVSS 9.9, frappe erpnext)
- [CVE-2026-72910](https://cve.now/CVE-2026-72910.md): ERPNext: Unauthorised modification of master data due to missing validation (CVSS 7.1, frappe erpnext)
- [CVE-2026-72909](https://cve.now/CVE-2026-72909.md): ERPNext: Broken Access Control on certain endpoints (CVSS 7.1, frappe erpnext)
- [CVE-2026-72908](https://cve.now/CVE-2026-72908.md): ERPNext: Possibility of SQL injection due to missing validation (CVSS 6.5, frappe erpnext)
- [CVE-2026-72907](https://cve.now/CVE-2026-72907.md): ERPNext: Broken Access Control on certain endpoint (CVSS 6.5, frappe erpnext)
- [CVE-2026-72906](https://cve.now/CVE-2026-72906.md): ERPNext: Unauthorised triggering of automated emails due to missing validation (CVSS 4.3, frappe erpnext)
- [CVE-2026-19411](https://cve.now/CVE-2026-19411.md): Shim/dp.c library: null-pointer dereference in is\_removable\_media\_path() when devicepathtostr() returns null (CVSS 3.9, Red Hat Enterprise Linux)
- [CVE-2026-18620](https://cve.now/CVE-2026-18620.md): Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy (CVSS 7.1, Red Hat OpenShift AI)
- [CVE-2026-18618](https://cve.now/CVE-2026-18618.md): Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener (CVSS 7.5, Red Hat OpenShift AI)
- [CVE-2026-18611](https://cve.now/CVE-2026-18611.md): Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials (CVSS 7.5, Red Hat OpenShift AI)
- [CVE-2026-63622](https://cve.now/CVE-2026-63622.md): Libvirt: swtpm privilege escalation via symlink following (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-18982](https://cve.now/CVE-2026-18982.md): Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles (CVSS 8.8, Red Hat OpenShift AI)
- [CVE-2026-18951](https://cve.now/CVE-2026-18951.md): Odh-training-operator-rhel9: \[trainer v2 security\] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole (CVSS 8.8, Red Hat OpenShift AI)
- [CVE-2026-18950](https://cve.now/CVE-2026-18950.md): Odh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creation (CVSS 8.8, Red Hat OpenShift AI)
- [CVE-2026-18949](https://cve.now/CVE-2026-18949.md): Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources (CVSS 8.8, Red Hat OpenShift AI)
- [CVE-2026-18948](https://cve.now/CVE-2026-18948.md): Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server (CVSS 9.9, Red Hat OpenShift AI)
- [CVE-2026-18947](https://cve.now/CVE-2026-18947.md): Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization (CVSS 8.5, Red Hat OpenShift AI)
- [CVE-2026-18942](https://cve.now/CVE-2026-18942.md): Feast-operator: feast: feast apply cronjob runs user python with feature-server sa — tenant code to sa token escalation (CVSS 5.5, Red Hat OpenShift AI)
- [CVE-2026-18941](https://cve.now/CVE-2026-18941.md): Feast: feast-operator: feast: default authentication mode is no\_auth — shared multi-tenant instances deployed without authentication (CVSS 7.7, Red Hat OpenShift AI)
- [CVE-2026-18621](https://cve.now/CVE-2026-18621.md): Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening (CVSS 7.6, Red Hat OpenShift AI · Red Hat AI Inference Server)
- [CVE-2026-18617](https://cve.now/CVE-2026-18617.md): Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod (CVSS 8.8, Red Hat OpenShift AI)
- [CVE-2026-18608](https://cve.now/CVE-2026-18608.md): Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:\*, kubeflow.org \*/\*, and clusterrole/binding crud cluster-wide (CVSS 8.7, Red Hat OpenShift AI)
- [CVE-2026-16456](https://cve.now/CVE-2026-16456.md): Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy (CVSS 6.5, Red Hat OpenShift AI)
- [CVE-2026-15581](https://cve.now/CVE-2026-15581.md): Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide (CVSS 8.0, Red Hat OpenShift AI)
- [CVE-2026-15467](https://cve.now/CVE-2026-15467.md): Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust\_remote\_code policy override (CVSS 8.1, Red Hat OpenShift AI)
- [CVE-2026-14450](https://cve.now/CVE-2026-14450.md): Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication (CVSS 9.9, Red Hat OpenShift AI)
- [CVE-2026-13717](https://cve.now/CVE-2026-13717.md): Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs) (CVSS 8.8, llm-d · Red Hat OpenShift AI)
- [CVE-2026-72904](https://cve.now/CVE-2026-72904.md): Firecrawl: Arbitrary file read via JSON Schema $ref expansion (CVSS 9.3, firecrawl)
- [CVE-2026-72903](https://cve.now/CVE-2026-72903.md): Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory (CVSS 8.1, Eugeny tabby)
- [CVE-2026-11809](https://cve.now/CVE-2026-11809.md): UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-11810](https://cve.now/CVE-2026-11810.md): NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS) (CVSS 7.5, zephyrproject zephyr)
- [CVE-2026-73035](https://cve.now/CVE-2026-73035.md): npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences (CVSS 5.3, raineorshine npm-check-updates)
- [CVE-2026-73033](https://cve.now/CVE-2026-73033.md): Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php (CVSS 7.0, sucuri-wordpress-plugin)
- [CVE-2026-73030](https://cve.now/CVE-2026-73030.md): unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape (CVSS 7.2, frostming unearth)
- [CVE-2026-72743](https://cve.now/CVE-2026-72743.md): SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html (CVSS 5.1, dataease SQLBot)
- [CVE-2026-69118](https://cve.now/CVE-2026-69118.md): Cachet 2.4.1 Authenticated Server-Side Template Injection RCE (CVSS 8.7, cachethq cachet)
- [CVE-2026-72902](https://cve.now/CVE-2026-72902.md): Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById (CVSS 9.9, dokploy)
- [CVE-2026-72901](https://cve.now/CVE-2026-72901.md): Dokploy: Remote Code Execution via volume-backup (CVSS 9.9, dokploy)
- [CVE-2025-15683](https://cve.now/CVE-2025-15683.md): Multiple Unauthenticated Denial-of-Service Conditions (CVSS 8.8, TBEA TLogger)
- [CVE-2026-72886](https://cve.now/CVE-2026-72886.md): Dokploy: Non-admin member gains root on the host by bypassing the owner/admin check on server-level schedules (incomplete fix of CVE-2026-45632) (CVSS 9.9, dokploy)
- [CVE-2026-69116](https://cve.now/CVE-2026-69116.md): FlyEnv \< 4.18.0 Cross-Site Scripting via v-html (CVSS 5.3, xpf0000 FlyEnv)
- [CVE-2025-15682](https://cve.now/CVE-2025-15682.md): Unauthenticated Resource Exhaustion (CVSS 8.7, TBEA TLogger)
- [CVE-2026-72885](https://cve.now/CVE-2026-72885.md): Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder (CVSS 0.0, dokploy)
- [CVE-2025-15681](https://cve.now/CVE-2025-15681.md): Insufficient Webserver Authentication (CVSS 9.2, TBEA TLogger)
- [CVE-2026-72884](https://cve.now/CVE-2026-72884.md): Dokploy: Command Injection via Compose Custom Command (CVSS 8.7, dokploy)
- [CVE-2026-44401](https://cve.now/CVE-2026-44401.md): Typemill CMS 2.x Persistent XSS via Markdown javascript URI (CVSS 4.6, Typemill)
- [CVE-2026-69114](https://cve.now/CVE-2026-69114.md): Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass (CVSS 7.1, Spacebar Server)
- [CVE-2026-72883](https://cve.now/CVE-2026-72883.md): Dokploy: WebSocket Terminal Missing Service-Level Access Control (CVSS 8.8, dokploy)
- [CVE-2025-15680](https://cve.now/CVE-2025-15680.md): Information Disclosure via UART (CVSS 2.4, TBEA TLogger)
- [CVE-2026-72882](https://cve.now/CVE-2026-72882.md): Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers (CVSS 9.9, dokploy)
- [CVE-2025-13294](https://cve.now/CVE-2025-13294.md): Unauthenticated SQL Injection (CVSS 9.3, TBEA TLogger)
- [CVE-2025-13293](https://cve.now/CVE-2025-13293.md): Backdoor / default root credentials (CVSS 9.3, TBEA TLogger)
- [CVE-2026-72881](https://cve.now/CVE-2026-72881.md): Dokploy: Command Injection via database credentials in backup/restore commands (CVSS 6.4, dokploy)
- [CVE-2026-72880](https://cve.now/CVE-2026-72880.md): Dokploy: Arbitrary File Write + Remote OS Command Injection via \`certificatePath\` (CVSS 9.9, dokploy)
- [CVE-2026-72879](https://cve.now/CVE-2026-72879.md): Dokploy: Command Injection via Registry Credentials in Swarm Upload (CVSS 9.4, dokploy)
- [CVE-2026-72878](https://cve.now/CVE-2026-72878.md): Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments (CVSS 9.6, dokploy)
- [CVE-2026-69112](https://cve.now/CVE-2026-69112.md): Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight\_map (CVSS 6.9, huggingface accelerate · accelerate)
- [CVE-2026-72877](https://cve.now/CVE-2026-72877.md): Dokploy: Command Injection via dockerImage in buildRemoteDocker (CVSS 9.6, dokploy)
- [CVE-2026-72876](https://cve.now/CVE-2026-72876.md): Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.\* (CVSS 9.9, dokploy)
- [CVE-2026-72875](https://cve.now/CVE-2026-72875.md): Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile (CVSS 8.8, dokploy)
- [CVE-2026-72874](https://cve.now/CVE-2026-72874.md): Dokploy: Command Injection via Unescaped Git URL in Clone Commands (CVSS 8.7, dokploy)
- [CVE-2026-14886](https://cve.now/CVE-2026-14886.md): Vault Enterprise vulnerable to cross-namespace entity deletion (CVSS 8.2, HashiCorp Vault Enterprise)
- [CVE-2026-72873](https://cve.now/CVE-2026-72873.md): Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via \`application.one\` (CVSS 6.5, dokploy)
- [CVE-2026-71966](https://cve.now/CVE-2026-71966.md): CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer (CVSS 8.7, usmannasir cyberpanel)
- [CVE-2026-71965](https://cve.now/CVE-2026-71965.md): CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature (CVSS 8.7, usmannasir cyberpanel)
- [CVE-2026-71964](https://cve.now/CVE-2026-71964.md): CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload (CVSS 7.1, usmannasir cyberpanel)
- [CVE-2026-72872](https://cve.now/CVE-2026-72872.md): Dokploy: OS Command Injection via Bitbucket \`owner\`/\`repository\` in \`git clone\` (CVSS 9.9, dokploy)
- [CVE-2026-59091](https://cve.now/CVE-2026-59091.md): Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file (CVSS 7.3, gimp · Red Hat Enterprise Linux)
- [CVE-2026-72871](https://cve.now/CVE-2026-72871.md): Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback (CVSS 7.5, dokploy)
- [CVE-2026-72870](https://cve.now/CVE-2026-72870.md): Dokploy: Command Injection via Docker Credentials in buildRemoteDocker (CVSS 8.7, dokploy)
- [CVE-2026-6791](https://cve.now/CVE-2026-6791.md): Potential stack-based buffer clash during tilde expansion in wordexp (CVSS 6.6, The GNU C Library glibc)
- [CVE-2026-72869](https://cve.now/CVE-2026-72869.md): Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE (CVSS 9.9, dokploy)
- [CVE-2026-6368](https://cve.now/CVE-2026-6368.md): wordexp with WRDE\_APPEND can return or use invalid memory (CVSS 2.1, glibc)
- [CVE-2026-72868](https://cve.now/CVE-2026-72868.md): Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection (CVSS 9.9, dokploy)
- [CVE-2026-72867](https://cve.now/CVE-2026-72867.md): Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts) (CVSS 9.9, dokploy)
- [CVE-2026-72866](https://cve.now/CVE-2026-72866.md): WebSocket Terminal Auth Bypass (CVSS 8.8, dokploy)
- [CVE-2026-72865](https://cve.now/CVE-2026-72865.md): Dokploy: OS Command Injection via compose \`composePath\` (CVSS 9.9, dokploy)
- [CVE-2026-72864](https://cve.now/CVE-2026-72864.md): Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -\> Root in Arbitrary Containers) (CVSS 9.9, dokploy)
- [CVE-2026-72863](https://cve.now/CVE-2026-72863.md): Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host (CVSS 9.9, dokploy)
- [CVE-2026-71962](https://cve.now/CVE-2026-71962.md): Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download (CVSS 8.7, FlowiseAI Flowise)
- [CVE-2026-68872](https://cve.now/CVE-2026-68872.md): Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable (CVSS 6.5, Apache Software Foundation Apache Airflow Amazon provider ·…)
- [CVE-2026-12339](https://cve.now/CVE-2026-12339.md): Authenticated Arbitrary File Write Vulnerability in multiple devices (CVSS 6.9, TP-Link Systems TL-MR6400 · TP-Link Systems Archer MR600 +3)
- [CVE-2026-71969](https://cve.now/CVE-2026-71969.md): OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations (CVSS 8.4, OP-TEE optee\_os)
- [CVE-2026-68871](https://cve.now/CVE-2026-68871.md): Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable (CVSS 6.5, Apache Software Foundation Apache Airflow Yandex provider ·…)
- [CVE-2026-71968](https://cve.now/CVE-2026-71968.md): OP-TEE OS 4.10.0 Use-After-Free via Trusted Application Loader TA\_FLAG\_CONCURRENT (CVSS 8.4, OP-TEE optee\_os)
- [CVE-2026-71967](https://cve.now/CVE-2026-71967.md): OP-TEE OS 4.10.0 NULL Pointer Dereference DoS via Widevine PTA open\_session (CVSS 5.7, OP-TEE optee\_os)
- [CVE-2026-68870](https://cve.now/CVE-2026-68870.md): Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable (CVSS 5.3, Apache Software Foundation Apache Airflow Microsoft Azure p…)
- [CVE-2026-16626](https://cve.now/CVE-2026-16626.md): JasperReports Server: XXE Injection Vulnerability (Unauthenticated) (CVSS 9.3, Jaspersoft JasperReports Server)
- [CVE-2026-72862](https://cve.now/CVE-2026-72862.md): Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE (CVSS 9.9, dokploy)
- [CVE-2026-72900](https://cve.now/CVE-2026-72900.md): Metabase information exposure (CVSS 6.5, Metabase)
- [CVE-2026-72899](https://cve.now/CVE-2026-72899.md): Metabase SQL injection via public card or dashboard (CVSS 10.0, Metabase)
- [CVE-2026-72898](https://cve.now/CVE-2026-72898.md): Metabase SQL injection via password reset endpoint (CVSS 10.0, KEV, Metabase)
- [CVE-2026-72740](https://cve.now/CVE-2026-72740.md): Dokploy: OS Command Injection via SSH-form \`customGitUrl\` domain in \`ssh-keyscan\` (CVSS 9.9, dokploy)
- [CVE-2026-48159](https://cve.now/CVE-2026-48159.md): use-reducer-async was vulnerable to malicious code execution via compromised commits (CVSS 9.3, dai-shi use-reducer-async)
- [CVE-2026-72739](https://cve.now/CVE-2026-72739.md): Dokploy: Command Injection via Compose Shell Execution (CVSS 6.5, dokploy)
- [CVE-2026-72738](https://cve.now/CVE-2026-72738.md): Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter (CVSS 9.9, dokploy)
- [CVE-2026-72737](https://cve.now/CVE-2026-72737.md): Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups (CVSS 9.6, dokploy)
- [CVE-2026-72736](https://cve.now/CVE-2026-72736.md): Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE (CVSS 9.9, dokploy)
- [CVE-2026-10754](https://cve.now/CVE-2026-10754.md): Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. (CVSS 8.6, Pegasystems Pega Infinity)
- [CVE-2026-70622](https://cve.now/CVE-2026-70622.md): tar-rs 0.4.11 - 0.4.46 Symlink Escape via append\_dir\_all() (CVSS 7.1, composefs tar-rs)
- [CVE-2026-72735](https://cve.now/CVE-2026-72735.md): Dokploy: Command injection in writeTraefikConfigRemote via shell interpolation of unescaped YAML in SSH remote execution (CVSS 9.9, dokploy)
- [CVE-2026-72734](https://cve.now/CVE-2026-72734.md): Dokploy: Cross-organization authorization bypass in server.remove allows deletion of another organization's server registration (CVSS 8.4, dokploy)
- [CVE-2026-72733](https://cve.now/CVE-2026-72733.md): Dokploy: OS Command Injection via \`databaseName\` / \`backupFile\` in database restore (CVSS 9.9, dokploy)
- [CVE-2026-72732](https://cve.now/CVE-2026-72732.md): Discourse: Templates endpoint exposes hidden tag names (CVSS 4.3, discourse)
- [CVE-2026-12624](https://cve.now/CVE-2026-12624.md): Vault vulnerable to LIST authorization bypass via trailing-slash strip (CVSS 4.3, HashiCorp Vault)
- [CVE-2026-71577](https://cve.now/CVE-2026-71577.md): Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration (CVSS 6.3, Red Hat Multicluster Global Hub)
- [CVE-2026-63623](https://cve.now/CVE-2026-63623.md): Libvirt: information disclosure via world-readable storage volume images during clone/convert (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-71576](https://cve.now/CVE-2026-71576.md): Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers (CVSS 8.5, Red Hat Multicluster Global Hub)
- [CVE-2026-72731](https://cve.now/CVE-2026-72731.md): Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer (CVSS 7.1, discourse)
- [CVE-2026-72730](https://cve.now/CVE-2026-72730.md): Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor (CVSS 8.7, discourse)
- [CVE-2026-72729](https://cve.now/CVE-2026-72729.md): Discourse: Stored XSS in discourse-local-dates plugin (CVSS 2.0, discourse)
- [CVE-2026-56619](https://cve.now/CVE-2026-56619.md): HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) (CVSS 5.4, HCLSoftware HCL BigFix Mobile)
- [CVE-2026-72728](https://cve.now/CVE-2026-72728.md): Discourse: Onebox iframe origin allowlist enforces URL authority boundary (CVSS 6.3, discourse)
- [CVE-2026-72727](https://cve.now/CVE-2026-72727.md): Discourse: Stored XSS in the moderation review queue (CVSS 4.8, discourse)
- [CVE-2026-72726](https://cve.now/CVE-2026-72726.md): Discourse: Unauthorized eavesdropping on private AI bot conversations. (CVSS 6.5, discourse)
- [CVE-2026-72725](https://cve.now/CVE-2026-72725.md): Discourse: Stored XSS in staff action logs injects staff UI (CVSS 5.4, discourse)
- [CVE-2026-72724](https://cve.now/CVE-2026-72724.md): Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch (CVSS 4.3, discourse)
- [CVE-2026-56620](https://cve.now/CVE-2026-56620.md): HCL BigFix Mobile is vulnerable to information disclosure (CVSS 4.3, HCLSoftware HCL BigFix Mobile)
- [CVE-2026-48158](https://cve.now/CVE-2026-48158.md): use-context-selector was vulnerable to malicious code execution via compromised commits (CVSS 9.3, dai-shi use-context-selector)
- [CVE-2026-72723](https://cve.now/CVE-2026-72723.md): Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags (CVSS 5.3, discourse)
- [CVE-2026-72722](https://cve.now/CVE-2026-72722.md): Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs (CVSS 4.3, discourse)
- [CVE-2026-48048](https://cve.now/CVE-2026-48048.md): XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…)
- [CVE-2026-72721](https://cve.now/CVE-2026-72721.md): Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison (CVSS 5.3, discourse)
- [CVE-2026-72720](https://cve.now/CVE-2026-72720.md): Discourse: HTML injection in PrettyText.format\_for\_email from cooked-attribute reparsing (CVSS 6.4, discourse)
- [CVE-2026-66738](https://cve.now/CVE-2026-66738.md): SPIP \< 4.4.18 Code Injection via Navigation Endpoint on SQLite (CVSS 7.7, SPIP)
- [CVE-2026-72719](https://cve.now/CVE-2026-72719.md): Chatwoot: Cross-Account Resource Transfer via \`account\_id\` Parameter (CVSS 6.7, chatwoot)
- [CVE-2026-72718](https://cve.now/CVE-2026-72718.md): goose: Arbitrary command execution in goose CLI via \`goose review\` via git core.fsmonitor (CVSS 7.0, aaif-goose goose)
- [CVE-2026-47754](https://cve.now/CVE-2026-47754.md): unauthenticated path traversal in Metacat 2.x (CVSS 9.3, NCEAS metacat)
- [CVE-2026-18412](https://cve.now/CVE-2026-18412.md): The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability (CVSS 9.1, OpenCart)
- [CVE-2026-72761](https://cve.now/CVE-2026-72761.md): Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is\_global check) in vulnerability-lookup (CVSS 6.9, vulnerability-lookup)
- [CVE-2026-72760](https://cve.now/CVE-2026-72760.md): cti-transmute Following List Exposes User Email Addresses to Authenticated Users (CVSS 5.3, MISP cti-transmute)
- [CVE-2026-72759](https://cve.now/CVE-2026-72759.md): cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion (CVSS 6.9, misp cti-transmute)
- [CVE-2026-19433](https://cve.now/CVE-2026-19433.md): Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export (CVSS 8.6, Roskus Prospero Flow CRM)
- [CVE-2026-72751](https://cve.now/CVE-2026-72751.md): Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content (CVSS 5.1, misp cti-transmute)
- [CVE-2026-59112](https://cve.now/CVE-2026-59112.md): Signature validation vulnerability affecting DigiDoc applications (CVSS 4.4, Estonian Information System Authority (RIA) libdigidocpp… +1)
- [CVE-2026-71959](https://cve.now/CVE-2026-71959.md): Bitwarden Server \< 2026.7.2 Audit Log Injection via POST /collect (CVSS 6.9, bitwarden server)
- [CVE-2026-18503](https://cve.now/CVE-2026-18503.md): Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() (CVSS 2.4, Python Software Foundation CPython · libpython +2)
- [CVE-2026-63106](https://cve.now/CVE-2026-63106.md): ReadyEcommerce \< 4.5.2 Unauthenticated SQL Injection via ProductController.php (CVSS 9.3, Razinsoft Ready eCommerce)
- [CVE-2026-63105](https://cve.now/CVE-2026-63105.md): ReadyEcommerce \< 4.5.2 Stored XSS via Chat and Support Ticket Systems (CVSS 5.1, Razinsoft Ready eCommerce)
- [CVE-2026-15060](https://cve.now/CVE-2026-15060.md): systemd-machined: unprivileged users can terminate arbitrary processes (CVSS 4.7, systemd-machined)
- [CVE-2026-16742](https://cve.now/CVE-2026-16742.md): systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path (CVSS 6.7, systemd-homed)
- [CVE-2026-15059](https://cve.now/CVE-2026-15059.md): systemd-oomd: unprivileged users can terminate arbitrary processes (CVSS 5.5, systemd-oomd)
- [CVE-2026-18478](https://cve.now/CVE-2026-18478.md): Stored XSS in Magnolia CMS (CVSS 5.1, Magnolia DXP Magnolia CMS)
- [CVE-2026-18370](https://cve.now/CVE-2026-18370.md): Heap-based buffer overflow in entr (CVSS 4.8, eradman entr)
- [CVE-2026-12984](https://cve.now/CVE-2026-12984.md): Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601 (CVSS 8.2, Zyxel Networks WAH7601)
- [CVE-2026-13206](https://cve.now/CVE-2026-13206.md): Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command Injection (CVSS 9.8, Zyxel Networks WAH7601)
- [CVE-2026-6373](https://cve.now/CVE-2026-6373.md): Sensitive Data Exposure in Zyxel WAH7601 Router (CVSS 6.5, Zyxel Networks WAH7601)
- [CVE-2026-6374](https://cve.now/CVE-2026-6374.md): Hardcoded Credentials in Zyxel WAH7601 Router (CVSS 7.3, Zyxel Networks WAH7601)
- [CVE-2026-59233](https://cve.now/CVE-2026-59233.md): Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation (CVSS 8.7, Roskus Prospero Flow CRM)
- [CVE-2026-19278](https://cve.now/CVE-2026-19278.md): Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings (CVSS 6.8, Red Hat Advanced Cluster Security)
- [CVE-2026-59090](https://cve.now/CVE-2026-59090.md): Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow (CVSS 8.4, gimp · Red Hat Enterprise Linux)
- [CVE-2026-68428](https://cve.now/CVE-2026-68428.md): KVM: x86/mmu: Fix use-after-free on vendor module reload (no CVSS, Linux)
- [CVE-2026-68427](https://cve.now/CVE-2026-68427.md): gpu: host1x: Fix use-after-free in host1x\_bo\_clear\_cached\_mappings (CVSS 7.8, Linux)
- [CVE-2026-68426](https://cve.now/CVE-2026-68426.md): xfrm: fix stale skb-\>prev after async crypto steals a GSO segment (CVSS 9.8, Linux)
- [CVE-2026-68425](https://cve.now/CVE-2026-68425.md): IB/mad: Drop unmatched RMPP responses before reassembly (CVSS 7.1, Linux)
- [CVE-2026-68424](https://cve.now/CVE-2026-68424.md): mtd: virt\_concat: fix use-after-free in mtd\_virt\_concat\_destroy\_joins() (no CVSS, Linux)
- [CVE-2026-68423](https://cve.now/CVE-2026-68423.md): mtd: virt\_concat: fix use-after-free in mtd\_virt\_concat\_destroy() (no CVSS, Linux)
- [CVE-2026-68422](https://cve.now/CVE-2026-68422.md): btrfs: fix root leak if its reloc root is unexpected in merge\_reloc\_roots() (no CVSS, Linux)
- [CVE-2026-68421](https://cve.now/CVE-2026-68421.md): sched\_ext: Don't warn on core-sched forced idle in put\_prev\_task\_scx() (no CVSS, Linux)
- [CVE-2026-68420](https://cve.now/CVE-2026-68420.md): xfrm: reject optional IPTFS templates in outbound policies (CVSS 7.1, Linux)
- [CVE-2026-68419](https://cve.now/CVE-2026-68419.md): RDMA/irdma: Prevent rereg\_mr for non-mem regions (CVSS 7.8, Linux)
- [CVE-2026-68418](https://cve.now/CVE-2026-68418.md): RDMA/irdma: Prevent user-triggered null deref on QP create (no CVSS, Linux)
- [CVE-2026-68417](https://cve.now/CVE-2026-68417.md): RDMA/siw: publish QP after initialization (CVSS 7.8, Linux)
- [CVE-2026-68416](https://cve.now/CVE-2026-68416.md): mtd: fix double free and WARN\_ON in add\_mtd\_device() error paths (no CVSS, Linux)
- [CVE-2026-68415](https://cve.now/CVE-2026-68415.md): xfrm: clear mode callbacks after failed mode setup (CVSS 7.8, Linux)
- [CVE-2026-68414](https://cve.now/CVE-2026-68414.md): wifi: cfg80211: cancel sched scan results work on unregister (CVSS 7.5, Linux)
- [CVE-2026-68413](https://cve.now/CVE-2026-68413.md): wifi: ipw2100: fix potential memory leak in ipw2100\_pci\_init\_one() (no CVSS, Linux)
- [CVE-2026-68412](https://cve.now/CVE-2026-68412.md): wifi: cfg80211: Fix an error handling path in cfg80211\_wext\_siwscan() (no CVSS, Linux)
- [CVE-2026-68411](https://cve.now/CVE-2026-68411.md): wifi: mac80211\_hwsim: clamp virtio RX length before skb\_put (no CVSS, Linux)
- [CVE-2026-68410](https://cve.now/CVE-2026-68410.md): wifi: libertas: fix memory leak in helper\_firmware\_cb() (no CVSS, Linux)
- [CVE-2026-68409](https://cve.now/CVE-2026-68409.md): wifi: mac80211: defer link RX stats percpu free to RCU (CVSS 8.8, Linux)
- [CVE-2026-68408](https://cve.now/CVE-2026-68408.md): wifi: cfg80211: convert pmsr\_free\_wk to wiphy\_work to fix deadlock (no CVSS, Linux)
- [CVE-2026-68407](https://cve.now/CVE-2026-68407.md): wifi: nl80211: free RNR data on MBSSID mismatch (no CVSS, Linux)
- [CVE-2026-68406](https://cve.now/CVE-2026-68406.md): wifi: cfg80211: validate PMSR FTM preamble range (no CVSS, Linux)
- [CVE-2026-68405](https://cve.now/CVE-2026-68405.md): wifi: mac80211: free AP\_VLAN bc\_buf SKBs outside IRQ lock (no CVSS, Linux)
- [CVE-2026-68404](https://cve.now/CVE-2026-68404.md): wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVSS 7.8, Linux)
- [CVE-2026-68403](https://cve.now/CVE-2026-68403.md): wifi: brcmfmac: initialize SDIO data work before cleanup (no CVSS, Linux)
- [CVE-2026-68402](https://cve.now/CVE-2026-68402.md): wifi: cfg80211: bound element ID read when checking non-inheritance (CVSS 7.1, Linux)
- [CVE-2026-68401](https://cve.now/CVE-2026-68401.md): firmware: arm\_ffa: Fix out-of-bound writes in ffa\_setup\_and\_transmit() (CVSS 7.8, Linux)
- [CVE-2026-68400](https://cve.now/CVE-2026-68400.md): firmware: arm\_ffa: Fix Endpoint Memory Access Descriptor offset calculation (CVSS 7.8, Linux)
- [CVE-2026-68399](https://cve.now/CVE-2026-68399.md): bpf: Fix UAF in sock clone early bailouts (CVSS 7.8, Linux)
- [CVE-2026-68398](https://cve.now/CVE-2026-68398.md): ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (CVSS 7.8, Linux)
- [CVE-2026-68397](https://cve.now/CVE-2026-68397.md): net/iucv: take a reference on the socket found in afiucv\_hs\_rcv() (CVSS 8.8, Linux)
- [CVE-2026-68396](https://cve.now/CVE-2026-68396.md): scsi: core: wake eh reliably when using scsi\_schedule\_eh (no CVSS, Linux)
- [CVE-2026-68395](https://cve.now/CVE-2026-68395.md): ata: sata\_dwc\_460ex: enable SATA interrupts only after IRQ handler is registered (no CVSS, Linux)
- [CVE-2026-68394](https://cve.now/CVE-2026-68394.md): Bluetooth: MGMT: revalidate LOAD\_CONN\_PARAM queued update (CVSS 7.8, Linux)
- [CVE-2026-68393](https://cve.now/CVE-2026-68393.md): Bluetooth: hci\_sync: extend conn\_hash lookup critical sections (CVSS 8.8, Linux)
- [CVE-2026-68392](https://cve.now/CVE-2026-68392.md): Bluetooth: mgmt: fix locking in unpair\_device/disconnect\_sync (CVSS 7.8, Linux)
- [CVE-2026-68391](https://cve.now/CVE-2026-68391.md): Bluetooth: mgmt: hold reference for hci\_conn in mgmt\_pending\_cmds (CVSS 7.8, Linux)
- [CVE-2026-68390](https://cve.now/CVE-2026-68390.md): Bluetooth: hci\_sync: hold hdev-\>lock for hci\_conn\_params lookups (CVSS 8.8, Linux)
- [CVE-2026-68389](https://cve.now/CVE-2026-68389.md): Bluetooth: hci\_qca: Clear memdump state on invalid dump size (CVSS 8.8, Linux)
- [CVE-2026-68388](https://cve.now/CVE-2026-68388.md): smb/client: handle overlapping allocated ranges in fallocate (CVSS 9.8, Linux)
- [CVE-2026-68387](https://cve.now/CVE-2026-68387.md): can: raw: add locking for raw flags bitfield (CVSS 7.8, Linux)
- [CVE-2026-68386](https://cve.now/CVE-2026-68386.md): bpf, sockmap: Reject unhashed UDP sockets on sockmap update (no CVSS, Linux)
- [CVE-2026-68385](https://cve.now/CVE-2026-68385.md): s390/checksum: Fix csum\_partial() without vector facility (CVSS 9.8, Linux)
- [CVE-2026-68384](https://cve.now/CVE-2026-68384.md): drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves (CVSS 7.8, Linux)
- [CVE-2026-68383](https://cve.now/CVE-2026-68383.md): drm/xe/guc: Keep scheduler timeline name alive (CVSS 7.8, Linux)
- [CVE-2026-68382](https://cve.now/CVE-2026-68382.md): drm/xe/guc: Hold device ref until queue teardown completes (CVSS 7.8, Linux)
- [CVE-2026-68381](https://cve.now/CVE-2026-68381.md): ksmbd: pin conn during async oplock break notification (CVSS 9.8, Linux)
- [CVE-2026-68380](https://cve.now/CVE-2026-68380.md): accel/amdxdna: Fix use-after-free of mm\_struct in job scheduler (CVSS 7.8, Linux)
- [CVE-2026-68379](https://cve.now/CVE-2026-68379.md): tcp: fix TIME\_WAIT socket reference leak on PSP policy failure (CVSS 7.5, Linux)
- [CVE-2026-68378](https://cve.now/CVE-2026-68378.md): dpll: fix NULL pointer dereference in dpll\_msg\_add\_pin\_ref\_sync() (no CVSS, Linux)
- [CVE-2026-68377](https://cve.now/CVE-2026-68377.md): net/sched: act\_tunnel\_key: Defer dst\_release to RCU callback (CVSS 7.8, Linux)
- [CVE-2026-68376](https://cve.now/CVE-2026-68376.md): sctp: fix auth\_hmacs array size in struct sctp\_cookie (CVSS 8.1, Linux)
- [CVE-2026-68375](https://cve.now/CVE-2026-68375.md): bnxt\_en: Handle partially initialized auxiliary devices (no CVSS, Linux)
- [CVE-2026-68374](https://cve.now/CVE-2026-68374.md): usb: core: sysfs: add lock to bos\_descriptors\_read() (CVSS 7.8, Linux)
- [CVE-2026-68373](https://cve.now/CVE-2026-68373.md): wifi: at76c50x-usb: avoid length underflow in at76\_guess\_freq() (CVSS 8.1, Linux)
- [CVE-2026-68372](https://cve.now/CVE-2026-68372.md): usb: core: port: Deattach Type-C connector on component unbind (no CVSS, Linux)
- [CVE-2026-68371](https://cve.now/CVE-2026-68371.md): usb: musb: omap2430: Do not put borrowed of\_node in probe (CVSS 8.4, Linux)
- [CVE-2026-68370](https://cve.now/CVE-2026-68370.md): usb: gadget: dummy\_hcd: prevent fifo\_req reuse during giveback (CVSS 7.8, Linux)
- [CVE-2026-68369](https://cve.now/CVE-2026-68369.md): usb: gadget: printer: fix infinite loop in printer\_read() (no CVSS, Linux)
- [CVE-2026-68368](https://cve.now/CVE-2026-68368.md): usb: gadget: f\_ncm: validate datagram bounds in ncm\_unwrap\_ntb() (no CVSS, Linux)
- [CVE-2026-68367](https://cve.now/CVE-2026-68367.md): usb: gadget: f\_tcm: synchronize delayed set\_alt with teardown (no CVSS, Linux)
- [CVE-2026-68366](https://cve.now/CVE-2026-68366.md): usb: gadget: uvc: clamp SEND\_RESPONSE length to the response buffer (no CVSS, Linux)
- [CVE-2026-68365](https://cve.now/CVE-2026-68365.md): USB: serial: io\_edgeport: cap received transmit credits (no CVSS, Linux)
- [CVE-2026-68364](https://cve.now/CVE-2026-68364.md): drm/amd/display: Fix ISM dc\_lock deadlock during suspend (no CVSS, Linux)
- [CVE-2026-68363](https://cve.now/CVE-2026-68363.md): wifi: ath9k: hif\_usb: don't dereference hif\_dev after re-arming firmware request (no CVSS, Linux)
- [CVE-2026-68362](https://cve.now/CVE-2026-68362.md): wifi: ath11k: fix NULL pointer dereference in ath11k\_hal\_srng\_access\_begin (no CVSS, Linux)
- [CVE-2026-68361](https://cve.now/CVE-2026-68361.md): hwmon: (corsair-psu) Stop device IO before calling hid\_hw\_stop (no CVSS, Linux)
- [CVE-2026-68360](https://cve.now/CVE-2026-68360.md): hwmon: (corsair-cpro) Stop device IO before calling hid\_hw\_stop (no CVSS, Linux)
- [CVE-2026-68359](https://cve.now/CVE-2026-68359.md): hwmon: (nzxt-smart2) Stop device IO before calling hid\_hw\_stop (no CVSS, Linux)
- [CVE-2026-68358](https://cve.now/CVE-2026-68358.md): hwmon: (nzxt-kraken3) Stop device IO before calling hid\_hw\_stop (no CVSS, Linux)
- [CVE-2026-68357](https://cve.now/CVE-2026-68357.md): watchdog: pretimeout: Fix UAF in watchdog\_unregister\_governor() (no CVSS, Linux)
- [CVE-2026-68356](https://cve.now/CVE-2026-68356.md): watchdog: airoha: Prevent division by zero when clock frequency is zero (no CVSS, Linux)
- [CVE-2026-68355](https://cve.now/CVE-2026-68355.md): wifi: ath11k: fix potential buffer underflow in ath11k\_hal\_rx\_msdu\_list\_get() (no CVSS, Linux)
- [CVE-2026-68354](https://cve.now/CVE-2026-68354.md): firewire: net: Fix fragmented datagram reassembly (CVSS 8.8, Linux)
- [CVE-2026-68353](https://cve.now/CVE-2026-68353.md): wifi: ath6kl: fix OOB read from firmware num\_msg in TX complete handler (CVSS 8.1, Linux)
- [CVE-2026-68352](https://cve.now/CVE-2026-68352.md): wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (CVSS 8.3, Linux)
- [CVE-2026-68351](https://cve.now/CVE-2026-68351.md): wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (no CVSS, Linux)
- [CVE-2026-68350](https://cve.now/CVE-2026-68350.md): wifi: carl9170: fix OOB read from off-by-two in TX status handler (no CVSS, Linux)
- [CVE-2026-68349](https://cve.now/CVE-2026-68349.md): wifi: carl9170: fix buffer overflow in rx\_stream failover path (no CVSS, Linux)
- [CVE-2026-68348](https://cve.now/CVE-2026-68348.md): ASoC: tas2781: bound firmware description string parsing (CVSS 7.1, Linux)
- [CVE-2026-68347](https://cve.now/CVE-2026-68347.md): iommu/amd: Fix IRQ unsafe locking in gdom allocation (no CVSS, Linux)
- [CVE-2026-68346](https://cve.now/CVE-2026-68346.md): ALSA: hda: cs35l41: validate and free ACPI mute object (no CVSS, Linux)
- [CVE-2026-68345](https://cve.now/CVE-2026-68345.md): arm\_mpam: guard MBWU state before adding it to garbage (no CVSS, Linux)
- [CVE-2026-68344](https://cve.now/CVE-2026-68344.md): usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (no CVSS, Linux)
- [CVE-2026-68343](https://cve.now/CVE-2026-68343.md): smb: client: validate DFS referral PathConsumed (CVSS 9.1, Linux)
- [CVE-2026-68342](https://cve.now/CVE-2026-68342.md): ovpn: avoid putting unrelated P2P peer on socket release (no CVSS, Linux)
- [CVE-2026-68341](https://cve.now/CVE-2026-68341.md): ovpn: fix use after free in unlock\_ovpn() (CVSS 8.8, Linux)
- [CVE-2026-68340](https://cve.now/CVE-2026-68340.md): hwmon: occ: validate poll response sensor blocks (CVSS 7.7, Linux)
- [CVE-2026-68339](https://cve.now/CVE-2026-68339.md): Bluetooth: btusb: validate Realtek vendor event length (no CVSS, Linux)
- [CVE-2026-68338](https://cve.now/CVE-2026-68338.md): net/packet: avoid fanout hook re-registration after unregister (CVSS 7.8, Linux)
- [CVE-2026-68337](https://cve.now/CVE-2026-68337.md): bpf: Reject redirect helpers without a bpf\_net\_context (no CVSS, Linux)
- [CVE-2026-68336](https://cve.now/CVE-2026-68336.md): bonding: fix devconf\_all NULL dereference when IPv6 is disabled (no CVSS, Linux)
- [CVE-2026-68335](https://cve.now/CVE-2026-68335.md): rds: drop incoming messages that cross network namespace boundaries (CVSS 7.8, Linux)
- [CVE-2026-68334](https://cve.now/CVE-2026-68334.md): rxrpc: fix io\_thread race in rxrpc\_wake\_up\_io\_thread() (no CVSS, Linux)
- [CVE-2026-68333](https://cve.now/CVE-2026-68333.md): dpaa2-switch: put MAC endpoint device on disconnect (no CVSS, Linux)
- [CVE-2026-68332](https://cve.now/CVE-2026-68332.md): net: airoha: Fix potential use-after-free in airoha\_ppe\_deinit() (no CVSS, Linux)
- [CVE-2026-68331](https://cve.now/CVE-2026-68331.md): dpaa2-eth: put MAC endpoint device on disconnect (no CVSS, Linux)
- [CVE-2026-68330](https://cve.now/CVE-2026-68330.md): net: airoha: Fix DMA direction for NPU mailbox buffer (CVSS 7.8, Linux)
- [CVE-2026-68329](https://cve.now/CVE-2026-68329.md): iommu/amd: Wait for completion instead of returning early in iommu\_completion\_wait() (CVSS 8.8, Linux)
- [CVE-2026-68328](https://cve.now/CVE-2026-68328.md): nfp: Check resource mutex allocation (no CVSS, Linux)
- [CVE-2026-68327](https://cve.now/CVE-2026-68327.md): wan: wanxl: Only reset hardware after BAR mapping (no CVSS, Linux)
- [CVE-2026-68326](https://cve.now/CVE-2026-68326.md): wifi: mwifiex: bound uAP association event IEs to the event buffer (CVSS 8.8, Linux)
- [CVE-2026-68325](https://cve.now/CVE-2026-68325.md): iommu/amd: Bound the early ACPI HID map (no CVSS, Linux)
- [CVE-2026-68324](https://cve.now/CVE-2026-68324.md): iommu/intel: Fix out-of-bounds memset in dmar\_latency\_disable() (no CVSS, Linux)
- [CVE-2026-68323](https://cve.now/CVE-2026-68323.md): tipc: serialize udp bearer replicast list updates (CVSS 7.8, Linux)
- [CVE-2026-68322](https://cve.now/CVE-2026-68322.md): rds: Fix inet6\_addr\_lst NULL dereference when IPv6 is disabled (no CVSS, Linux)
- [CVE-2026-68321](https://cve.now/CVE-2026-68321.md): net: txgbe: fix FDIR filter leak on remove (no CVSS, Linux)
- [CVE-2026-68320](https://cve.now/CVE-2026-68320.md): sctp: fix auth\_chunk\_list capacity check in sctp\_auth\_ep\_add\_chunkid (CVSS 7.3, Linux)
- [CVE-2026-68319](https://cve.now/CVE-2026-68319.md): pds\_core: fix deadlock between reset thread and remove (no CVSS, Linux)
- [CVE-2026-68318](https://cve.now/CVE-2026-68318.md): pds\_core: fix use-after-free on workqueue during remove (no CVSS, Linux)
- [CVE-2026-68317](https://cve.now/CVE-2026-68317.md): pds\_core: fix auxiliary device add/del races (no CVSS, Linux)
- [CVE-2026-68316](https://cve.now/CVE-2026-68316.md): accel: ethosu: Fix element size accounting for cmd stream validation (CVSS 7.8, Linux)
- [CVE-2026-68315](https://cve.now/CVE-2026-68315.md): sctp: validate stream count in sctp\_process\_strreset\_inreq() (CVSS 7.5, Linux)
- [CVE-2026-68314](https://cve.now/CVE-2026-68314.md): net: mctp i3c: clean up notifier and buses if driver register fails (CVSS 7.8, Linux)
- [CVE-2026-68313](https://cve.now/CVE-2026-68313.md): tipc: fix infinite loop in \_\_tipc\_nl\_compat\_dumpit (no CVSS, Linux)
- [CVE-2026-68312](https://cve.now/CVE-2026-68312.md): cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (no CVSS, Linux)
- [CVE-2026-68311](https://cve.now/CVE-2026-68311.md): wifi: mt76: mt7925: guard link STA in decap offload (no CVSS, Linux)
- [CVE-2026-68310](https://cve.now/CVE-2026-68310.md): wifi: mt76: mt7915: guard HE capability lookups (no CVSS, Linux)
- [CVE-2026-68309](https://cve.now/CVE-2026-68309.md): wifi: mt76: connac: fix possible NULL-pointer deref in mt76\_connac\_mcu\_uni\_bss\_he\_tlv() (no CVSS, Linux)
- [CVE-2026-68308](https://cve.now/CVE-2026-68308.md): wifi: mt76: mt7996: check pointer returned by mt76\_connac\_get\_he\_phy\_cap() (no CVSS, Linux)
- [CVE-2026-68307](https://cve.now/CVE-2026-68307.md): wifi: mt76: mt7925: fix crash in reset link replay (no CVSS, Linux)
- [CVE-2026-68306](https://cve.now/CVE-2026-68306.md): wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996\_mcu\_sta\_bfer\_eht() (no CVSS, Linux)
- [CVE-2026-68305](https://cve.now/CVE-2026-68305.md): drm/xe/vf: Add drm\_dev guards when detaching CCS read/write buffers (CVSS 7.8, Linux)
- [CVE-2026-68304](https://cve.now/CVE-2026-68304.md): wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (no CVSS, Linux)
- [CVE-2026-68303](https://cve.now/CVE-2026-68303.md): drm/vc4: hvs/v3d: Fix null dereference in unbind (no CVSS, Linux)
- [CVE-2026-68302](https://cve.now/CVE-2026-68302.md): amt: re-read skb header pointers after every pull (CVSS 9.8, Linux)
- [CVE-2026-68301](https://cve.now/CVE-2026-68301.md): net: hsr: fix memory leak on slave unregistration by removing synced VLANs (no CVSS, Linux)
- [CVE-2026-68300](https://cve.now/CVE-2026-68300.md): sctp: auth: verify auth requirement when auth\_chunk is NULL (CVSS 9.8, Linux)
- [CVE-2026-68299](https://cve.now/CVE-2026-68299.md): vmxnet3: fix BUG\_ON in vmxnet3\_get\_hdr\_len() for Geneve packets (CVSS 7.5, Linux)
- [CVE-2026-68298](https://cve.now/CVE-2026-68298.md): drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe\_vm\_create() (CVSS 7.8, Linux)
- [CVE-2026-68297](https://cve.now/CVE-2026-68297.md): tipc: fix u16 MTU truncation in media and bearer MTU validation (CVSS 7.8, Linux)
- [CVE-2026-68296](https://cve.now/CVE-2026-68296.md): net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (no CVSS, Linux)
- [CVE-2026-68295](https://cve.now/CVE-2026-68295.md): LoongArch: BPF: Zero-extend signed ALU32 div/mod results (CVSS 7.8, Linux)
- [CVE-2026-68294](https://cve.now/CVE-2026-68294.md): net: qrtr: restrict socket creation to the initial network namespace (CVSS 8.8, Linux)
- [CVE-2026-68293](https://cve.now/CVE-2026-68293.md): net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVSS 7.1, Linux)
- [CVE-2026-68292](https://cve.now/CVE-2026-68292.md): ice: prevent tstamp ring allocation for non-PF VSI types (no CVSS, Linux)
- [CVE-2026-68291](https://cve.now/CVE-2026-68291.md): idpf: fix max\_vport related crash on allocation error during init (no CVSS, Linux)
- [CVE-2026-68290](https://cve.now/CVE-2026-68290.md): rds: tcp: unregister sysctl before tearing down listen socket (CVSS 7.8, Linux)
- [CVE-2026-68289](https://cve.now/CVE-2026-68289.md): tipc: fix integer overflow in tipc\_recvmsg() and tipc\_recvstream() (no CVSS, Linux)
- [CVE-2026-68288](https://cve.now/CVE-2026-68288.md): net: drop\_monitor: fix info leak in NET\_DM\_ATTR\_PAYLOAD (no CVSS, Linux)
- [CVE-2026-68287](https://cve.now/CVE-2026-68287.md): drop\_monitor: fix size calculations for 64-bit attributes (CVSS 7.5, Linux)
- [CVE-2026-68286](https://cve.now/CVE-2026-68286.md): drop\_monitor: perform u64\_stats updates under IRQ-disabled section (no CVSS, Linux)
- [CVE-2026-68285](https://cve.now/CVE-2026-68285.md): LoongArch: BPF: Fix memory leak in bpf\_jit\_free() (no CVSS, Linux)
- [CVE-2026-68284](https://cve.now/CVE-2026-68284.md): bpf, sockmap: Fix cork use-after-free in tcp\_bpf\_sendmsg() (CVSS 7.8, Linux)
- [CVE-2026-68283](https://cve.now/CVE-2026-68283.md): tracing: Fix use-after-free freeing trigger private data (CVSS 8.8, Linux)
- [CVE-2026-68282](https://cve.now/CVE-2026-68282.md): drm/rockchip: analogix\_dp: Add missing error check for platform\_get\_resource() (no CVSS, Linux)
- [CVE-2026-68281](https://cve.now/CVE-2026-68281.md): drm/imagination: Count paired job fence as dependency in prepare\_job() (no CVSS, Linux)
- [CVE-2026-68280](https://cve.now/CVE-2026-68280.md): drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL\_DEV\_PM\_OPS() (no CVSS, Linux)
- [CVE-2026-68279](https://cve.now/CVE-2026-68279.md): drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers (no CVSS, Linux)
- [CVE-2026-68278](https://cve.now/CVE-2026-68278.md): drm/dp/mst: fix buffer overflows in sideband chunk accumulation (no CVSS, Linux)
- [CVE-2026-68277](https://cve.now/CVE-2026-68277.md): drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers (no CVSS, Linux)
- [CVE-2026-68276](https://cve.now/CVE-2026-68276.md): drm/amdgpu/gfx: fix cleaner shader IB buffer overflow (no CVSS, Linux)
- [CVE-2026-68275](https://cve.now/CVE-2026-68275.md): drm/amdgpu: check amdgpu\_vm\_bo\_find() result in GET\_MAPPING\_INFO (no CVSS, Linux)
- [CVE-2026-68274](https://cve.now/CVE-2026-68274.md): drm/xe/guc: Fix buffer overflow in steered register list allocation (CVSS 7.8, Linux)
- [CVE-2026-68273](https://cve.now/CVE-2026-68273.md): drm/amdgpu: Fix context pstate override handling (CVSS 7.8, Linux)
- [CVE-2026-68272](https://cve.now/CVE-2026-68272.md): drm/amdgpu: validate CP\_GFX\_SHADOW chunk size in CS pass1 (no CVSS, Linux)
- [CVE-2026-68271](https://cve.now/CVE-2026-68271.md): drm/nouveau: fix reversed error cleanup order in ucopy functions (no CVSS, Linux)
- [CVE-2026-68270](https://cve.now/CVE-2026-68270.md): drm/sysfb: Avoid possible truncation with calculating visible size (no CVSS, Linux)
- [CVE-2026-68269](https://cve.now/CVE-2026-68269.md): drm/i915/gem: Add missing nospec on parallel submit slot (no CVSS, Linux)
- [CVE-2026-68268](https://cve.now/CVE-2026-68268.md): drm/xe: Return error on non-migratable faults requiring devmem (no CVSS, Linux)
- [CVE-2026-68267](https://cve.now/CVE-2026-68267.md): drm/xe/rtp: Add RING\_FORCE\_TO\_NONPRIV\_DENY to OA whitelists (no CVSS, Linux)
- [CVE-2026-68266](https://cve.now/CVE-2026-68266.md): drm/xe: Hold a dma-buf reference for imported BOs (CVSS 7.8, Linux)
- [CVE-2026-68265](https://cve.now/CVE-2026-68265.md): drm/xe/vm: Fix BO prefetch with CONSULT\_MEM\_ADVISE\_PREF\_LOC (CVSS 7.3, Linux)
- [CVE-2026-68264](https://cve.now/CVE-2026-68264.md): drm/xe/pt: Reset current\_op in xe\_pt\_update\_ops\_init() (CVSS 7.8, Linux)
- [CVE-2026-68263](https://cve.now/CVE-2026-68263.md): drm/imagination: Fix double call to drm\_sched\_entity\_fini() (CVSS 7.8, Linux)
- [CVE-2026-68262](https://cve.now/CVE-2026-68262.md): drm/imagination: Fix user array stride in pvr\_set\_uobj\_array() (CVSS 7.1, Linux)
- [CVE-2026-68261](https://cve.now/CVE-2026-68261.md): drm/imagination: fix error checking of pvr\_vm\_context\_lookup() (no CVSS, Linux)
- [CVE-2026-68260](https://cve.now/CVE-2026-68260.md): drm/imagination: acquire vm\_ctx-\>lock before mapping memory to GPU VM (CVSS 7.8, Linux)
- [CVE-2026-68259](https://cve.now/CVE-2026-68259.md): drm/amdkfd: Check bounds in allocate\_event\_notification\_slot (no CVSS, Linux)
- [CVE-2026-68258](https://cve.now/CVE-2026-68258.md): drm/amdkfd: Check bounds on CRIU restore queue type and mqd size (CVSS 7.1, Linux)
- [CVE-2026-68257](https://cve.now/CVE-2026-68257.md): drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVSS 7.8, Linux)
- [CVE-2026-68256](https://cve.now/CVE-2026-68256.md): drm/amd/display: detect\_link\_and\_local\_sink: DP alt mode timeout path leaks prev\_sink reference (no CVSS, Linux)
- [CVE-2026-68255](https://cve.now/CVE-2026-68255.md): drm/virtio: bound EDID block reads to the response buffer (CVSS 7.7, Linux)
- [CVE-2026-68254](https://cve.now/CVE-2026-68254.md): drm/i915/vrr: require valid min/max vfreq for VRR (no CVSS, Linux)
- [CVE-2026-68253](https://cve.now/CVE-2026-68253.md): drm/i915/hdcp: check streams\[\] bounds before overflow (CVSS 7.8, Linux)
- [CVE-2026-68252](https://cve.now/CVE-2026-68252.md): drm/amdgpu/sdma7.0: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68251](https://cve.now/CVE-2026-68251.md): drm/amdgpu/sdma6.0: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68250](https://cve.now/CVE-2026-68250.md): drm/amdgpu/sdma5.2: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68249](https://cve.now/CVE-2026-68249.md): drm/amdgpu/sdma5.0: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68248](https://cve.now/CVE-2026-68248.md): drm/i915: Return NULL on error in active\_instance (no CVSS, Linux)
- [CVE-2026-68247](https://cve.now/CVE-2026-68247.md): drm/i915/bios: range check LFP Data Block panel\_type2 (no CVSS, Linux)
- [CVE-2026-68246](https://cve.now/CVE-2026-68246.md): drm/amdgpu/gfx11: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68245](https://cve.now/CVE-2026-68245.md): drm/amdgpu: fix lifetime issue of amdgpu\_vm\_get\_task\_info\_pasid() (CVSS 7.8, Linux)
- [CVE-2026-68244](https://cve.now/CVE-2026-68244.md): drm/i915/gem: Do not leak siblings\[\] on proto context error (no CVSS, Linux)
- [CVE-2026-68243](https://cve.now/CVE-2026-68243.md): drm/i915/gem: Fix NULL deref in I915\_CONTEXT\_PARAM\_SSEU (no CVSS, Linux)
- [CVE-2026-68242](https://cve.now/CVE-2026-68242.md): drm/i915/gt: Fix NULL deref on sched\_engine alloc failure (no CVSS, Linux)
- [CVE-2026-68241](https://cve.now/CVE-2026-68241.md): drm/i915/mst: limit DP MST ESI service loop (no CVSS, Linux)
- [CVE-2026-68240](https://cve.now/CVE-2026-68240.md): drm/gpusvm: publish dpagemap early to avoid device mapping leak on error (CVSS 8.8, Linux)
- [CVE-2026-68239](https://cve.now/CVE-2026-68239.md): drm/ttm: Account for NULL and handle pages in ttm\_pool\_backup (no CVSS, Linux)
- [CVE-2026-68238](https://cve.now/CVE-2026-68238.md): drm/amdgpu: Release VFCT ACPI table reference (no CVSS, Linux)
- [CVE-2026-68237](https://cve.now/CVE-2026-68237.md): drm/amdgpu/userq: fix indefinite fence wait during GPU reset (no CVSS, Linux)
- [CVE-2026-68236](https://cve.now/CVE-2026-68236.md): drm/amd/display: set new\_stream to NULL after release (CVSS 7.8, Linux)
- [CVE-2026-68235](https://cve.now/CVE-2026-68235.md): drm/amd/display: dce100: skip non-DP stream encoders for DP MST (no CVSS, Linux)
- [CVE-2026-68234](https://cve.now/CVE-2026-68234.md): drm/amdgpu: fix bo-\>pin leaking in amdgpu\_bo\_create\_reserved (no CVSS, Linux)
- [CVE-2026-68233](https://cve.now/CVE-2026-68233.md): drm/vc4: Shut down BO cache timer before teardown (no CVSS, Linux)
- [CVE-2026-68232](https://cve.now/CVE-2026-68232.md): drm/gpusvm: Fix MM reference leak in drm\_gpusvm\_range\_evict (no CVSS, Linux)
- [CVE-2026-68231](https://cve.now/CVE-2026-68231.md): media: airspy: Return queued buffers on start\_streaming() failure (no CVSS, Linux)
- [CVE-2026-68230](https://cve.now/CVE-2026-68230.md): media: amlogic-c3: Add validations for ae and awb config (CVSS 7.3, Linux)
- [CVE-2026-68229](https://cve.now/CVE-2026-68229.md): media: cedrus: skip invalid H.264 reference list entries (CVSS 7.1, Linux)
- [CVE-2026-68228](https://cve.now/CVE-2026-68228.md): media: chips-media: wave5: Move src\_buf Removal to finish\_encode (CVSS 7.8, Linux)
- [CVE-2026-68227](https://cve.now/CVE-2026-68227.md): media: cx231xx: fix devres lifetime (no CVSS, Linux)
- [CVE-2026-68226](https://cve.now/CVE-2026-68226.md): media: cx23885: add ioremap return check and cleanup (no CVSS, Linux)
- [CVE-2026-68225](https://cve.now/CVE-2026-68225.md): media: i2c: alvium: fix critical pointer access in alvium\_ctrl\_init (no CVSS, Linux)
- [CVE-2026-68224](https://cve.now/CVE-2026-68224.md): media: mali-c55: Fix possible ERR\_PTR in enable\_streams (no CVSS, Linux)
- [CVE-2026-68223](https://cve.now/CVE-2026-68223.md): media: meson: vdec: Fix memory leak in error path of vdec\_open (no CVSS, Linux)
- [CVE-2026-68222](https://cve.now/CVE-2026-68222.md): media: msi2500: Return queued buffers on start\_streaming() failure (CVSS 7.8, Linux)
- [CVE-2026-68221](https://cve.now/CVE-2026-68221.md): media: nuvoton: npcm-video: fix memory leaks in probe and remove (no CVSS, Linux)
- [CVE-2026-68220](https://cve.now/CVE-2026-68220.md): media: nxp: imx8-isi: Add missing v4l2\_subdev\_cleanup() in crossbar and pipe (no CVSS, Linux)
- [CVE-2026-68219](https://cve.now/CVE-2026-68219.md): media: nxp: imx8-isi: Fix potential out-of-bounds issues (CVSS 7.8, Linux)
- [CVE-2026-68218](https://cve.now/CVE-2026-68218.md): media: pci: dm1105: Free allocated workqueue (no CVSS, Linux)
- [CVE-2026-68217](https://cve.now/CVE-2026-68217.md): media: pwc: Drain fill\_buf on start\_streaming() failure (no CVSS, Linux)
- [CVE-2026-68216](https://cve.now/CVE-2026-68216.md): media: pwc: Return queued buffers on start\_streaming() failure (CVSS 7.8, Linux)
- [CVE-2026-68215](https://cve.now/CVE-2026-68215.md): media: radio-si476x: Unregister v4l2\_device on probe failure (no CVSS, Linux)
- [CVE-2026-68214](https://cve.now/CVE-2026-68214.md): media: rtl2832: fix use-after-free in rtl2832\_remove() (no CVSS, Linux)
- [CVE-2026-68213](https://cve.now/CVE-2026-68213.md): media: rtl2832\_sdr: Return queued buffers on start\_streaming() failure (CVSS 7.8, Linux)
- [CVE-2026-68212](https://cve.now/CVE-2026-68212.md): media: saa7134: Fix a possible memory leak in saa7134\_video\_init1 (no CVSS, Linux)
- [CVE-2026-68211](https://cve.now/CVE-2026-68211.md): media: stm32-dcmipp: Return queued buffers on start\_streaming() failure (no CVSS, Linux)
- [CVE-2026-68210](https://cve.now/CVE-2026-68210.md): media: stm32: dcmi: unregister notifier on probe failure (CVSS 7.8, Linux)
- [CVE-2026-68209](https://cve.now/CVE-2026-68209.md): media: sun4i-csi: Return queued buffers on start\_streaming() failure (CVSS 7.8, Linux)
- [CVE-2026-68208](https://cve.now/CVE-2026-68208.md): media: ti: vpe: Fix the error code of devm\_kzalloc() in vip\_probe\_slice() (no CVSS, Linux)
- [CVE-2026-68207](https://cve.now/CVE-2026-68207.md): media: ti: vpe: unwind v4l2 device registration on probe error (no CVSS, Linux)
- [CVE-2026-68206](https://cve.now/CVE-2026-68206.md): media: v4l2-ctrls: validate HEVC active reference counts (CVSS 7.8, Linux)
- [CVE-2026-68205](https://cve.now/CVE-2026-68205.md): media: v4l2-fwnode: Fix subdev owner overwritten in v4l2\_async\_register\_subdev\_sensor() (no CVSS, Linux)
- [CVE-2026-68204](https://cve.now/CVE-2026-68204.md): media: vivid: check for vb2\_is\_busy() when toggling caps (CVSS 7.8, Linux)
- [CVE-2026-68203](https://cve.now/CVE-2026-68203.md): media: vivid: fix cleanup bugs in vivid\_init() (no CVSS, Linux)
- [CVE-2026-68202](https://cve.now/CVE-2026-68202.md): ALSA: seq: close a re-opened queue timer in the destructor (CVSS 7.8, Linux)
- [CVE-2026-68201](https://cve.now/CVE-2026-68201.md): ALSA: timer: drain a slave's callback before its master detaches it (CVSS 7.8, Linux)
- [CVE-2026-68200](https://cve.now/CVE-2026-68200.md): ALSA: timer: don't re-enter an instance callback that is still running (CVSS 7.8, Linux)
- [CVE-2026-68199](https://cve.now/CVE-2026-68199.md): wifi: ath6kl: fix OOB access from firmware ADDBA window size (CVSS 8.8, Linux)
- [CVE-2026-68198](https://cve.now/CVE-2026-68198.md): wifi: ath6kl: fix use-after-free in aggr\_reset\_state() (CVSS 8.8, Linux)
- [CVE-2026-68197](https://cve.now/CVE-2026-68197.md): wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (no CVSS, Linux)
- [CVE-2026-68196](https://cve.now/CVE-2026-68196.md): wifi: wilc1000: validate assoc response length before subtracting header (CVSS 8.3, Linux)
- [CVE-2026-68195](https://cve.now/CVE-2026-68195.md): wifi: mt76: mt7615: drop TXRX\_NOTIFY on non-mmio buses (no CVSS, Linux)
- [CVE-2026-68194](https://cve.now/CVE-2026-68194.md): wifi: mt76: mt7921: drop TXRX\_NOTIFY on non-mmio buses (no CVSS, Linux)
- [CVE-2026-68193](https://cve.now/CVE-2026-68193.md): wifi: mt76: mt7925: drop TXRX\_NOTIFY on non-mmio buses (no CVSS, Linux)
- [CVE-2026-68192](https://cve.now/CVE-2026-68192.md): wifi: brcmfmac: make release\_scratchbuffers idempotent (CVSS 8.8, Linux)
- [CVE-2026-68191](https://cve.now/CVE-2026-68191.md): wifi: ath12k: fix NULL pointer dereference in rhash table destroy (no CVSS, Linux)
- [CVE-2026-68190](https://cve.now/CVE-2026-68190.md): staging: rtl8723bs: fix OOB reads in rtw\_get\_wps\_ie() (no CVSS, Linux)
- [CVE-2026-68189](https://cve.now/CVE-2026-68189.md): Bluetooth: hci\_sync: Protect UUID list traversal (CVSS 7.8, Linux)
- [CVE-2026-68188](https://cve.now/CVE-2026-68188.md): Bluetooth: RFCOMM: Fix session UAF in set\_termios (no CVSS, Linux)
- [CVE-2026-68187](https://cve.now/CVE-2026-68187.md): exec: fix unsigned loop counter wrap in transfer\_args\_to\_stack() (no CVSS, Linux)
- [CVE-2026-68186](https://cve.now/CVE-2026-68186.md): binfmt\_misc: set have\_execfd only once the interpreter is opened (no CVSS, Linux)
- [CVE-2026-68185](https://cve.now/CVE-2026-68185.md): LoongArch: Move jump\_label\_init() before parse\_early\_param() (no CVSS, Linux)
- [CVE-2026-68184](https://cve.now/CVE-2026-68184.md): cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (no CVSS, Linux)
- [CVE-2026-68183](https://cve.now/CVE-2026-68183.md): firmware: stratix10-svc: fix memory leaks and list corruption bugs (no CVSS, Linux)
- [CVE-2026-68182](https://cve.now/CVE-2026-68182.md): comedi: comedi\_parport: deal with premature interrupt (no CVSS, Linux)
- [CVE-2026-68181](https://cve.now/CVE-2026-68181.md): mei: bus: access mei\_device under device\_lock on cleanup (no CVSS, Linux)
- [CVE-2026-68180](https://cve.now/CVE-2026-68180.md): intel\_th: fix MSC output device reference leak (no CVSS, Linux)
- [CVE-2026-68179](https://cve.now/CVE-2026-68179.md): misc: nsm: only unlock nsm\_dev on post-lock error paths (CVSS 8.4, Linux)
- [CVE-2026-68178](https://cve.now/CVE-2026-68178.md): misc: nsm: pin the module while the device is open (CVSS 7.8, Linux)
- [CVE-2026-68177](https://cve.now/CVE-2026-68177.md): tracing: Delay module ref count for "enable\_event" trigger (CVSS 7.8, Linux)
- [CVE-2026-68176](https://cve.now/CVE-2026-68176.md): tracing: Fix mmiotrace possible NULL dereferencing of hiter-\>dev (no CVSS, Linux)
- [CVE-2026-68175](https://cve.now/CVE-2026-68175.md): tracing: Fix resource leak on mmiotrace trace\_pipe close (no CVSS, Linux)
- [CVE-2026-68174](https://cve.now/CVE-2026-68174.md): tracing: Fix union collision of module and refcnt for dynamic events (no CVSS, Linux)
- [CVE-2026-68173](https://cve.now/CVE-2026-68173.md): ublk: wait on ublk\_dev\_ready() instead of ub-\>completion (CVSS 7.1, Linux)
- [CVE-2026-68172](https://cve.now/CVE-2026-68172.md): arm64: make huge\_ptep\_get handled unaligned addresses (CVSS 7.1, Linux)
- [CVE-2026-68170](https://cve.now/CVE-2026-68170.md): mptcp: fix stale skb-\>sk reference on subflow close (CVSS 9.8, Linux)
- [CVE-2026-68169](https://cve.now/CVE-2026-68169.md): mptcp: pm: userspace: fix use-after-free in get\_local\_id (no CVSS, Linux)
- [CVE-2026-68168](https://cve.now/CVE-2026-68168.md): afs: Fix afs\_edit\_dir\_remove() to get, not find, block 0 (no CVSS, Linux)
- [CVE-2026-68167](https://cve.now/CVE-2026-68167.md): btrfs: do not try compression for data reloc inodes (no CVSS, Linux)
- [CVE-2026-68166](https://cve.now/CVE-2026-68166.md): userfaultfd: prevent registration of special VMAs (no CVSS, Linux)
- [CVE-2026-68165](https://cve.now/CVE-2026-68165.md): mm/damon/core: validate ranges in damon\_set\_regions() (no CVSS, Linux)
- [CVE-2026-68164](https://cve.now/CVE-2026-68164.md): mm/damon/core: disallow overlapping input ranges for damon\_set\_regions() (no CVSS, Linux)
- [CVE-2026-68163](https://cve.now/CVE-2026-68163.md): mm/page\_vma\_mapped: fix device-private PMD handling (CVSS 7.8, Linux)
- [CVE-2026-68162](https://cve.now/CVE-2026-68162.md): sctp: avoid auth\_enable sysctl UAF during netns teardown (CVSS 7.8, Linux)
- [CVE-2026-68161](https://cve.now/CVE-2026-68161.md): sctp: close UDP tunnel sockets during netns teardown (CVSS 9.8, Linux)
- [CVE-2026-68160](https://cve.now/CVE-2026-68160.md): ceph: fix pre-auth out-of-bounds read on snaptrace in ceph\_handle\_caps() (CVSS 9.8, Linux)
- [CVE-2026-68159](https://cve.now/CVE-2026-68159.md): libceph: bound pg\_{temp,upmap,upmap\_items} length to CEPH\_PG\_MAX\_SIZE (CVSS 9.8, Linux)
- [CVE-2026-68158](https://cve.now/CVE-2026-68158.md): libceph: Fix multiplication overflow in decode\_new\_up\_state\_weight() (CVSS 9.8, Linux)
- [CVE-2026-68157](https://cve.now/CVE-2026-68157.md): libceph: guard missing CRUSH type name lookup (CVSS 7.5, Linux)
- [CVE-2026-68156](https://cve.now/CVE-2026-68156.md): libceph: refresh auth-\>authorizer\_buf{,\_len} after authorizer update (CVSS 9.8, Linux)
- [CVE-2026-68155](https://cve.now/CVE-2026-68155.md): libceph: Reject monmaps advertising zero monitors (CVSS 7.5, Linux)
- [CVE-2026-68154](https://cve.now/CVE-2026-68154.md): libceph: reject zero bucket types in crush\_decode (CVSS 9.8, Linux)
- [CVE-2026-68153](https://cve.now/CVE-2026-68153.md): libceph: remove debugfs files before client teardown (CVSS 7.8, Linux)
- [CVE-2026-68152](https://cve.now/CVE-2026-68152.md): amt: fix use-after-free in AMT delayed works (CVSS 7.8, Linux)
- [CVE-2026-68151](https://cve.now/CVE-2026-68151.md): binfmt\_elf\_fdpic: only honour the first PT\_INTERP (no CVSS, Linux)
- [CVE-2026-68150](https://cve.now/CVE-2026-68150.md): fs/super: fix emergency thaw double-unlock of s\_umount (no CVSS, Linux)
- [CVE-2026-72692](https://cve.now/CVE-2026-72692.md): OpenSignLabs opensignserver - Missing Authorization (CVSS 7.5, OpenSignLabs opensignserver)
- [CVE-2026-68149](https://cve.now/CVE-2026-68149.md): fs: preserve ACL\_DONT\_CACHE state in forget\_cached\_acl() (CVSS 8.4, Linux)
- [CVE-2026-68148](https://cve.now/CVE-2026-68148.md): fscrypt: Add missing superblock check in find\_or\_insert\_direct\_key() (CVSS 7.8, Linux)
- [CVE-2026-68147](https://cve.now/CVE-2026-68147.md): fscrypt: Avoid dynamic allocation in fscrypt\_get\_devices() (CVSS 7.8, Linux)
- [CVE-2026-72691](https://cve.now/CVE-2026-72691.md): OpenSignLabs opensignserver - Authentication Bypass (CVSS 7.5, OpenSignLabs opensignserver)
- [CVE-2026-68146](https://cve.now/CVE-2026-68146.md): ftrace: Add global mutex to serialize trace\_parser access (no CVSS, Linux)
- [CVE-2026-68145](https://cve.now/CVE-2026-68145.md): iomap: fix out-of-bounds bitmap\_set() with zero-length range (CVSS 7.8, Linux)
- [CVE-2026-72690](https://cve.now/CVE-2026-72690.md): Attendize Attendize - Cross-Tenant Authorization Bypass (CVSS 5.4, Attendize)
- [CVE-2026-68144](https://cve.now/CVE-2026-68144.md): phonet: pep: fix use-after-free in pep\_get\_sb() (CVSS 9.8, Linux)
- [CVE-2026-68143](https://cve.now/CVE-2026-68143.md): net: slip: serialize receive against buffer reallocation (CVSS 7.8, Linux)
- [CVE-2026-68142](https://cve.now/CVE-2026-68142.md): geneve: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-72689](https://cve.now/CVE-2026-72689.md): OpenSignLabs opensignserver - Broken Object Level Authorization (CVSS 7.5, OpenSignLabs opensignserver)
- [CVE-2026-68141](https://cve.now/CVE-2026-68141.md): net/af\_iucv: fix NULL deref in afiucv\_hs\_callback\_syn() (CVSS 7.5, Linux)
- [CVE-2026-68140](https://cve.now/CVE-2026-68140.md): net/iucv: fix use-after-free of a severed iucv\_path (CVSS 8.8, Linux)
- [CVE-2026-72688](https://cve.now/CVE-2026-72688.md): OpenSignLabs opensignserver - Missing Authentication for Critical Function (CVSS 7.5, OpenSignLabs opensignserver)
- [CVE-2026-68139](https://cve.now/CVE-2026-68139.md): net/mlx5e: Use sender devcom for MPV master-up (no CVSS, Linux)
- [CVE-2026-68138](https://cve.now/CVE-2026-68138.md): net/sched: serialize qdisc\_rtab\_list against concurrent get/put (CVSS 7.8, Linux)
- [CVE-2026-68137](https://cve.now/CVE-2026-68137.md): net/x25: fix use-after-free in x25\_kill\_by\_neigh() (CVSS 9.8, Linux)
- [CVE-2026-68136](https://cve.now/CVE-2026-68136.md): net: gro: fix double aggregation of flush-marked skbs (CVSS 9.8, Linux)
- [CVE-2026-68135](https://cve.now/CVE-2026-68135.md): net: hip04: fix RX buffer leak on build\_skb failure (no CVSS, Linux)
- [CVE-2026-68134](https://cve.now/CVE-2026-68134.md): ptp: ptp\_s390: Add missing facility check (CVSS 7.3, Linux)
- [CVE-2026-68133](https://cve.now/CVE-2026-68133.md): ice: fix PTP Call Trace during PTP release (no CVSS, Linux)
- [CVE-2026-68132](https://cve.now/CVE-2026-68132.md): super: fix emergency thaw deadlock on frozen block devices (no CVSS, Linux)
- [CVE-2026-68131](https://cve.now/CVE-2026-68131.md): rbd: Reset positive result codes to zero in object map update path (CVSS 7.5, Linux)
- [CVE-2026-68130](https://cve.now/CVE-2026-68130.md): ksmbd: defer destroy\_previous\_session() until after NTLM authentication (no CVSS, Linux)
- [CVE-2026-68129](https://cve.now/CVE-2026-68129.md): gve: fix Rx queue stall on alloc failure (CVSS 7.5, Linux)
- [CVE-2026-68128](https://cve.now/CVE-2026-68128.md): ice: reject out-of-range ptype in ice\_parser\_profile\_init (CVSS 8.8, Linux)
- [CVE-2026-68127](https://cve.now/CVE-2026-68127.md): ila: reload IPv6 header after pskb\_may\_pull in checksum adjust (CVSS 9.8, Linux)
- [CVE-2026-68126](https://cve.now/CVE-2026-68126.md): mac802154: hold an interface reference across the scan worker (no CVSS, Linux)
- [CVE-2026-68125](https://cve.now/CVE-2026-68125.md): mac802154: llsec: reject frames shorter than the authentication tag (CVSS 8.8, Linux)
- [CVE-2026-68124](https://cve.now/CVE-2026-68124.md): mctp: serial: handle zero-length frames to prevent rx buffer overflow (CVSS 9.6, Linux)
- [CVE-2026-68123](https://cve.now/CVE-2026-68123.md): openvswitch: fix GSO userspace truncation underflow (CVSS 9.8, Linux)
- [CVE-2026-68122](https://cve.now/CVE-2026-68122.md): ovpn: fix peer refcount leak in TCP error paths (no CVSS, Linux)
- [CVE-2026-68121](https://cve.now/CVE-2026-68121.md): pppoe: reload header pointer after dev\_hard\_header() (CVSS 7.8, Linux)
- [CVE-2026-68120](https://cve.now/CVE-2026-68120.md): rtase: Workaround for TX hang caused by hardware packet parsing (CVSS 7.5, Linux)
- [CVE-2026-68119](https://cve.now/CVE-2026-68119.md): tcp: initialize standalone TCP-AO response padding (CVSS 7.5, Linux)
- [CVE-2026-68118](https://cve.now/CVE-2026-68118.md): tcp: challenge ACK for non-exact RST in SYN-RECEIVED (CVSS 8.2, Linux)
- [CVE-2026-68117](https://cve.now/CVE-2026-68117.md): tipc: clear sock-\>sk on the failed-insert path in tipc\_sk\_create() (CVSS 9.8, Linux)
- [CVE-2026-68116](https://cve.now/CVE-2026-68116.md): vxlan: mdb: Fix source list corruption on a failed replace (CVSS 7.9, Linux)
- [CVE-2026-68115](https://cve.now/CVE-2026-68115.md): drm/amdgpu/gfx10: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68114](https://cve.now/CVE-2026-68114.md): drm/amdgpu/gfx12.1: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68113](https://cve.now/CVE-2026-68113.md): drm/amdgpu/gfx12: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68112](https://cve.now/CVE-2026-68112.md): drm/amdgpu/gfx9.4.3: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68111](https://cve.now/CVE-2026-68111.md): drm/amdgpu/gfx9: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68110](https://cve.now/CVE-2026-68110.md): drm/amdgpu/sdma4.4.2: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68109](https://cve.now/CVE-2026-68109.md): drm/amdgpu/sdma7.1: replace BUG\_ON() with WARN\_ON() (no CVSS, Linux)
- [CVE-2026-68108](https://cve.now/CVE-2026-68108.md): drm/amdgpu/vce: fix integer overflow in image size (CVSS 8.8, Linux)
- [CVE-2026-68107](https://cve.now/CVE-2026-68107.md): drm/amdgpu/vcn4: avoid rereading IB param length (CVSS 8.8, Linux)
- [CVE-2026-68106](https://cve.now/CVE-2026-68106.md): drm/amdgpu: fix division by zero with invalid uvd dimensions (CVSS 7.8, Linux)
- [CVE-2026-68105](https://cve.now/CVE-2026-68105.md): drm/amdgpu: Fix kernel panic during driver load failure (no CVSS, Linux)
- [CVE-2026-68104](https://cve.now/CVE-2026-68104.md): drm/amdgpu: invoke pm\_genpd\_remove() before freeing genpd (CVSS 7.8, Linux)
- [CVE-2026-68103](https://cve.now/CVE-2026-68103.md): drm/amdgpu: reject mapping a reserved doorbell to a new queue (CVSS 7.1, Linux)
- [CVE-2026-68102](https://cve.now/CVE-2026-68102.md): drm/amdgpu: fix aperture mapping leak (no CVSS, Linux)
- [CVE-2026-68100](https://cve.now/CVE-2026-68100.md): ksmbd: validate num\_subauth when copying ACE in set\_ntacl\_dacl (CVSS 8.1, Linux)
- [CVE-2026-68099](https://cve.now/CVE-2026-68099.md): ksmbd: restore DACL size on check\_add\_overflow() to avoid malformed ACL (no CVSS, Linux)
- [CVE-2026-68098](https://cve.now/CVE-2026-68098.md): ksmbd: bound DACL dedup walk to copied ACEs (CVSS 8.8, Linux)
- [CVE-2026-68097](https://cve.now/CVE-2026-68097.md): ksmbd: validate ACE size against SID sub-authorities (CVSS 8.8, Linux)
- [CVE-2026-68096](https://cve.now/CVE-2026-68096.md): audit: fix recursive locking deadlock in audit\_dupe\_exe() (CVSS 7.5, Linux)
- [CVE-2026-68095](https://cve.now/CVE-2026-68095.md): fuse-uring: fix race between registration and connection abortion (no CVSS, Linux)
- [CVE-2026-68094](https://cve.now/CVE-2026-68094.md): sched\_ext: Preserve rq tracking across local DSQ dispatch (no CVSS, Linux)
- [CVE-2026-68093](https://cve.now/CVE-2026-68093.md): KVM: SVM: Bump asid\_generation on CPU online to avoid ASID collision after hotplug (no CVSS, Linux)
- [CVE-2026-68092](https://cve.now/CVE-2026-68092.md): time/jiffies: Register jiffies clocksource before usage (no CVSS, Linux)
- [CVE-2026-68091](https://cve.now/CVE-2026-68091.md): HID: wacom: stop hardware after post-start probe failures (CVSS 8.8, Linux)
- [CVE-2026-68090](https://cve.now/CVE-2026-68090.md): debugobjects: Plug race against a concurrent OOM disable (no CVSS, Linux)
- [CVE-2026-68089](https://cve.now/CVE-2026-68089.md): iio: core: fix uninitialized data in debugfs (no CVSS, Linux)
- [CVE-2026-68088](https://cve.now/CVE-2026-68088.md): usb: gadget: function: rndis: add length check to response query (no CVSS, Linux)
- [CVE-2026-68087](https://cve.now/CVE-2026-68087.md): HID: wacom: use GFP\_ATOMIC in wacom\_wac\_queue\_flush() (no CVSS, Linux)
- [CVE-2026-68086](https://cve.now/CVE-2026-68086.md): mm/khugepaged: write all dirty file folios when collapsing (no CVSS, Linux)
- [CVE-2026-68085](https://cve.now/CVE-2026-68085.md): Bluetooth: hci\_uart: clear HCI\_UART\_SENDING when write\_work is canceled (CVSS 8.0, Linux)
- [CVE-2026-68084](https://cve.now/CVE-2026-68084.md): staging: vme\_user: fix location monitor leak in tsi148 bridge (no CVSS, Linux)
- [CVE-2026-68083](https://cve.now/CVE-2026-68083.md): ksmbd: fix path resolution in ksmbd\_vfs\_kern\_path\_create (CVSS 9.1, Linux)
- [CVE-2026-64941](https://cve.now/CVE-2026-64941.md): Open redirect in Phoenix.LiveView.validate\_local\_url!/2 via ASCII tab, LF and CR (CVSS 2.1, phoenixframework phoenix\_live\_view)
- [CVE-2026-59088](https://cve.now/CVE-2026-59088.md): Gimp: gimp: denial of service via signed integer overflow in fli file processing (CVSS 5.5, gimp · Red Hat Enterprise Linux)
- [CVE-2026-59087](https://cve.now/CVE-2026-59087.md): Gimp: heap buffer overflow in \`file-seattle-filmworks\` load — \`fread\` writes attacker-controlled length into undersized allocation (CVSS 7.8, gimp · Red Hat Enterprise Linux)
- [CVE-2026-72594](https://cve.now/CVE-2026-72594.md): lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload (CVSS 7.6, lobehub lobe-chat)
- [CVE-2026-72593](https://cve.now/CVE-2026-72593.md): dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access (CVSS 9.8, dulldusk phpfm)
- [CVE-2026-72592](https://cve.now/CVE-2026-72592.md): dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload (CVSS 9.8, dulldusk phpfm)
- [CVE-2026-72591](https://cve.now/CVE-2026-72591.md): Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter (CVSS 7.7, gabehf Koito)
- [CVE-2026-72590](https://cve.now/CVE-2026-72590.md): alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env\_vars Parameter (CVSS 9.8, alseambusher crontab-ui)
- [CVE-2026-72589](https://cve.now/CVE-2026-72589.md): alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field (CVSS 9.8, alseambusher crontab-ui)
- [CVE-2026-72588](https://cve.now/CVE-2026-72588.md): bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery (CVSS 5.3, bluewave-labs Checkmate)
- [CVE-2026-72587](https://cve.now/CVE-2026-72587.md): Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint (CVSS 6.1, CoreBunch Instatic)
- [CVE-2026-72586](https://cve.now/CVE-2026-72586.md): frangoteam FUXA - Missing Authentication on DAQ\_QUERY Socket.IO Event Handler (CVSS 7.5, frangoteam FUXA)
- [CVE-2026-72584](https://cve.now/CVE-2026-72584.md): fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery (CVSS 7.4, fastschema)
- [CVE-2026-72583](https://cve.now/CVE-2026-72583.md): fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload (CVSS 5.4, fastschema)
- [CVE-2026-72582](https://cve.now/CVE-2026-72582.md): fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint (CVSS 7.5, fastschema)
- [CVE-2026-72581](https://cve.now/CVE-2026-72581.md): duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint (CVSS 8.6, duhow xiaoai-patch)
- [CVE-2026-72580](https://cve.now/CVE-2026-72580.md): duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints (CVSS 9.8, duhow xiaoai-patch)
- [CVE-2026-72579](https://cve.now/CVE-2026-72579.md): NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server (CVSS 7.5, NASA HyperCP)
- [CVE-2026-72578](https://cve.now/CVE-2026-72578.md): FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher (CVSS 8.8, FreePBX Framework)
- [CVE-2026-72577](https://cve.now/CVE-2026-72577.md): NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection (CVSS 9.8, NASA fprime-gds)
- [CVE-2026-72576](https://cve.now/CVE-2026-72576.md): Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload (CVSS 5.4, Bludit)
- [CVE-2026-72575](https://cve.now/CVE-2026-72575.md): daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects (CVSS 9.1, daptin)
- [CVE-2026-72574](https://cve.now/CVE-2026-72574.md): picocms Pico - Host Header Injection Enables Script Source Hijacking (CVSS 6.1, picocms Pico)
- [CVE-2026-72573](https://cve.now/CVE-2026-72573.md): 4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter (CVSS 8.8, 4xmen pm2panel)
- [CVE-2026-72572](https://cve.now/CVE-2026-72572.md): o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter (CVSS 7.5, o1lab xmysql)
- [CVE-2026-72571](https://cve.now/CVE-2026-72571.md): mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter (CVSS 7.5, mustafaakin cast-localvideo)
- [CVE-2026-72570](https://cve.now/CVE-2026-72570.md): cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename (CVSS 5.4, cube-root directory-serve)
- [CVE-2026-72569](https://cve.now/CVE-2026-72569.md): cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion (CVSS 9.1, cube-root directory-serve)
- [CVE-2026-72567](https://cve.now/CVE-2026-72567.md): deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete (CVSS 9.8, AsyncFuncAI deepwiki-open)
- [CVE-2026-72566](https://cve.now/CVE-2026-72566.md): automatisch - Server-Side Request Forgery via HTTP Request Custom Action (CVSS 7.7, automatisch)
- [CVE-2026-72565](https://cve.now/CVE-2026-72565.md): Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass (CVSS 9.8, Tencent APIJSON)
- [CVE-2026-72564](https://cve.now/CVE-2026-72564.md): fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication (CVSS 9.6, fosrl Pangolin)
- [CVE-2026-61899](https://cve.now/CVE-2026-61899.md): Apache Tapestry: Possible classpath file download through URL manipulation (CVSS 7.5, Apache Software Foundation Apache Tapestry)
- [CVE-2026-28672](https://cve.now/CVE-2026-28672.md): Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder (CVSS 9.8, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2026-32227](https://cve.now/CVE-2026-32227.md): Apache Ranger: SQL Injection vulnerability in lookup functionality (CVSS 9.8, Apache Software Foundation Apache Ranger)
- [CVE-2026-40920](https://cve.now/CVE-2026-40920.md): Apache Ranger: Privilege Escalation via URL Parameter (CVSS 9.8, Apache Software Foundation Apache Ranger)
- [CVE-2026-66486](https://cve.now/CVE-2026-66486.md): Improper Output Encoding in GNU cpio (CVSS 4.6, GNU cpio)
- [CVE-2026-66485](https://cve.now/CVE-2026-66485.md): Uncontrolled Memory Allocation in GNU cpio (CVSS 4.6, GNU cpio)
- [CVE-2026-66484](https://cve.now/CVE-2026-66484.md): Path Traversal in GNU cpio (CVSS 4.6, GNU cpio)
- [CVE-2026-42537](https://cve.now/CVE-2026-42537.md): Apache Ranger: Remote Code Execution via JDBC URL Injection (CVSS 9.8, Apache Software Foundation Apache Ranger)
- [CVE-2026-44416](https://cve.now/CVE-2026-44416.md): Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation (CVSS 9.8, Apache Software Foundation Apache Ranger)
- [CVE-2026-55799](https://cve.now/CVE-2026-55799.md): Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator (CVSS 9.8, Apache Software Foundation Apache Ranger)
- [CVE-2026-71394](https://cve.now/CVE-2026-71394.md): Heap Use of Uninitialized Memory in GNU Emacs for Android (CVSS 5.3, GNU Emacs)
- [CVE-2026-71393](https://cve.now/CVE-2026-71393.md): Heap Buffer Overflow in GNU Emacs for Android (CVSS 5.3, GNU Emacs)
- [CVE-2026-71392](https://cve.now/CVE-2026-71392.md): Integer Overflow in GNU Emacs for Android (CVSS 5.3, GNU Emacs)
- [CVE-2026-71391](https://cve.now/CVE-2026-71391.md): Off-by-One Error in GNU Emacs for Android (CVSS 5.3, GNU Emacs)
- [CVE-2026-55814](https://cve.now/CVE-2026-55814.md): Apache Ranger: Download APIs expose plugin data without authentication (CVSS 7.5, Apache Software Foundation Apache Ranger)
- [CVE-2026-65942](https://cve.now/CVE-2026-65942.md): Apache Ranger: Clients accept TLS certificates issued for other hostnames (CVSS 7.5, Apache Software Foundation Apache Ranger)
- [CVE-2026-65945](https://cve.now/CVE-2026-65945.md): Apache Ranger: Logs contain replayable JWT bearer tokens (CVSS 6.5, Apache Software Foundation Apache Ranger)
- [CVE-2026-65948](https://cve.now/CVE-2026-65948.md): Apache Ranger: UnixAuth lacks brute-force protection (CVSS 7.3, Apache Software Foundation Apache Ranger)
- [CVE-2026-66642](https://cve.now/CVE-2026-66642.md): WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WP Umbrella)
- [CVE-2026-66915](https://cve.now/CVE-2026-66915.md): Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik \< 4.7.2 (CVSS 10.0, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-19404](https://cve.now/CVE-2026-19404.md): 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance (CVSS 6.5, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-44630](https://cve.now/CVE-2026-44630.md): Apache IoTDB: RPC service denial of service via unchecked Thrift string length (CVSS 7.5, Apache Software Foundation Apache IoTDB)
- [CVE-2026-66411](https://cve.now/CVE-2026-66411.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. (CVSS 5.3, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66410](https://cve.now/CVE-2026-66410.md): Android and iOS apps ECOVACS PRO App improperly validate server certificates. (CVSS 4.8, ECOVACS ROBOTICS Android App "ECOVACS PRO" · ECOVACS ROBOTI…)
- [CVE-2026-66409](https://cve.now/CVE-2026-66409.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. (CVSS 5.3, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66408](https://cve.now/CVE-2026-66408.md): The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. (CVSS 4.6, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66407](https://cve.now/CVE-2026-66407.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. (CVSS 8.1, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66406](https://cve.now/CVE-2026-66406.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. (CVSS 4.8, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66405](https://cve.now/CVE-2026-66405.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. (CVSS 8.8, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66404](https://cve.now/CVE-2026-66404.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. (CVSS 6.5, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-66403](https://cve.now/CVE-2026-66403.md): DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. (CVSS 7.5, ECOVACS ROBOTICS DEEBOT PRO M1 · ECOVACS ROBOTICS DEEBOT PR…)
- [CVE-2026-21084](https://cve.now/CVE-2026-21084.md): Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. (CVSS 6.9, Samsung Mobile SmartThings)
- [CVE-2026-21083](https://cve.now/CVE-2026-21083.md): Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. (CVSS 6.8, Samsung Mobile Smart Switch)
- [CVE-2026-21082](https://cve.now/CVE-2026-21082.md): Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. (CVSS 6.9, Samsung Mobile Samsung Health)
- [CVE-2026-21081](https://cve.now/CVE-2026-21081.md): Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitiv (CVSS 5.1, Samsung Mobile SamsungPassAutofill)
- [CVE-2026-21080](https://cve.now/CVE-2026-21080.md): Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. (CVSS 6.9, Samsung Mobile Smart Switch)
- [CVE-2026-21079](https://cve.now/CVE-2026-21079.md): Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. (CVSS 7.0, Samsung Mobile Smart Switch)
- [CVE-2026-21078](https://cve.now/CVE-2026-21078.md): Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to (CVSS 4.7, Samsung Mobile Smart Switch)
- [CVE-2026-21077](https://cve.now/CVE-2026-21077.md): Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. (CVSS 6.9, Samsung Mobile Samsung Health)
- [CVE-2026-21076](https://cve.now/CVE-2026-21076.md): Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. (CVSS 6.9, Samsung Mobile Samsung Health)
- [CVE-2026-21075](https://cve.now/CVE-2026-21075.md): Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive inform (CVSS 5.3, Samsung Mobile My Galaxy)
- [CVE-2026-21074](https://cve.now/CVE-2026-21074.md): Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege. (CVSS 7.2, Samsung Mobile Bixby)
- [CVE-2026-21073](https://cve.now/CVE-2026-21073.md): Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity. (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2026-21072](https://cve.now/CVE-2026-21072.md): Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21071](https://cve.now/CVE-2026-21071.md): Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memor (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21070](https://cve.now/CVE-2026-21070.md): Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21069](https://cve.now/CVE-2026-21069.md): Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out- (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21068](https://cve.now/CVE-2026-21068.md): Stack-based buffer overflow in libril\_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers to execute arbitrary code. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-21067](https://cve.now/CVE-2026-21067.md): Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21066](https://cve.now/CVE-2026-21066.md): Improper input validation in libcodec2\_sec\_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21065](https://cve.now/CVE-2026-21065.md): Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2026-21064](https://cve.now/CVE-2026-21064.md): Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inoperability. (CVSS 7.0, Samsung Mobile Devices)
- [CVE-2026-21063](https://cve.now/CVE-2026-21063.md): Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock fu (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2026-21062](https://cve.now/CVE-2026-21062.md): Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data. (CVSS 4.8, Samsung Mobile Devices)
- [CVE-2026-21061](https://cve.now/CVE-2026-21061.md): Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2026-21060](https://cve.now/CVE-2026-21060.md): Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2026-21059](https://cve.now/CVE-2026-21059.md): Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21058](https://cve.now/CVE-2026-21058.md): Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' p (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-57279](https://cve.now/CVE-2026-57279.md): Cybozu Garoon contains a cross-site scripting vulnerability. (CVSS 6.8, Cybozu Garoon)
- [CVE-2026-64940](https://cve.now/CVE-2026-64940.md): Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may a (CVSS 8.6, Nishishi Factory Tegalog -Fumy Otegaru Memo Logger-)
- [CVE-2026-12570](https://cve.now/CVE-2026-12570.md): Denial of Service via HDF5 Shape Bomb in keras.models.load\_model() in keras-team/keras (CVSS 5.5, keras-team/keras · keras)
- [CVE-2026-19089](https://cve.now/CVE-2026-19089.md): Product Input Fields for WooCommerce \< 2.0.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Product Input Fields for WooCommerce)
- [CVE-2026-19077](https://cve.now/CVE-2026-19077.md): Copy & Delete Posts \< 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization (CVSS 6.5, Duplicate Post)
- [CVE-2026-19075](https://cve.now/CVE-2026-19075.md): All-in-One Video Gallery \< 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter (CVSS 5.0, All-in-One Video Gallery)
- [CVE-2026-19074](https://cve.now/CVE-2026-19074.md): Advanced Classifieds & Directory Pro \< 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure (CVSS 5.3, Advanced Classifieds & Directory Pro)
- [CVE-2026-18786](https://cve.now/CVE-2026-18786.md): CheckView \< 2.3.2 - Administrator Account Creation via REST API Authentication Bypass (CVSS 8.8, CheckView)
- [CVE-2026-18200](https://cve.now/CVE-2026-18200.md): FoodBoxBooker \< 1.0.8 - Subscriber+ Arbitrary User Profile Update (CVSS 4.3, FoodBoxBooker)
- [CVE-2026-15047](https://cve.now/CVE-2026-15047.md): s2Member \< 260805 - Contributor+ Stored XSS via Shortcode (CVSS 6.8, s2Member)
- [CVE-2026-14293](https://cve.now/CVE-2026-14293.md): Autopay / Blue Media for WooCommerce \< 5.0.1 - Unauthenticated Stored XSS via CSS Editor (CVSS 8.8, Autopay)
- [CVE-2026-14238](https://cve.now/CVE-2026-14238.md): Vitepos \< 3.6.0 - Admin+ SQL Injection via product-details-report (CVSS 4.1, vitepos)
- [CVE-2026-14237](https://cve.now/CVE-2026-14237.md): Vitepos \< 3.6.0 - Outlet Manager+ Privilege Escalation (CVSS 7.2, vitepos)
- [CVE-2026-14211](https://cve.now/CVE-2026-14211.md): Amelia Pro \< 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR (CVSS 3.8, Booking for Appointments and Events Calendar)
- [CVE-2026-17023](https://cve.now/CVE-2026-17023.md): Salon Booking System – Free Version \<= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback (CVSS 4.8, Salon Booking System)
- [CVE-2026-17022](https://cve.now/CVE-2026-17022.md): Salon Booking System – Free Version \< 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard (CVSS 7.5, Salon Booking System)
- [CVE-2026-17021](https://cve.now/CVE-2026-17021.md): Salon Booking System – Free Version \< 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering (CVSS 5.3, Salon Booking System)
- [CVE-2026-17020](https://cve.now/CVE-2026-17020.md): Salon Booking System – Free Version \<= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure (CVSS 4.3, Salon Booking System)
- [CVE-2026-15229](https://cve.now/CVE-2026-15229.md): Pinpoint Booking System \<= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation (CVSS 5.3, Pinpoint Booking System)
- [CVE-2026-19053](https://cve.now/CVE-2026-19053.md): ProSolution WP Client \< 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter (CVSS 9.1, ProSolution WP Client)
- [CVE-2026-19049](https://cve.now/CVE-2026-19049.md): ProSolution WP Client \< 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie (CVSS 8.6, ProSolution WP Client)
- [CVE-2026-18960](https://cve.now/CVE-2026-18960.md): Block User Account \< 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords (CVSS 5.4, Block User Account)
- [CVE-2026-18946](https://cve.now/CVE-2026-18946.md): Contact Form to Any API \< 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename (CVSS 7.5, Contact Form to Any API)
- [CVE-2026-18934](https://cve.now/CVE-2026-18934.md): RSS Aggregator by Feedzy \< 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion (CVSS 5.5, RSS Aggregator by Feedzy)
- [CVE-2026-16985](https://cve.now/CVE-2026-16985.md): Squeeze \< 1.7.12 - Author+ Arbitrary File Upload (CVSS 8.8, Squeeze)
- [CVE-2026-16949](https://cve.now/CVE-2026-16949.md): Term Pages \< 2.0.0 - Unauthenticated SQL Injection via tp\_lookup (CVSS 5.8, Term Pages)
- [CVE-2026-15238](https://cve.now/CVE-2026-15238.md): Hotel Booking Lite \< 6.2.3 - Subscriber+ Customer Data Modification via IDOR (CVSS 5.4, MotoPress Hotel Booking)
- [CVE-2026-15237](https://cve.now/CVE-2026-15237.md): Hotel Booking Lite \< 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint (CVSS 5.3, MotoPress Hotel Booking)
- [CVE-2026-14941](https://cve.now/CVE-2026-14941.md): Customer Reviews for WooCommerce \< 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions (CVSS 5.4, Customer Reviews for WooCommerce)
- [CVE-2026-14860](https://cve.now/CVE-2026-14860.md): Podcast Player \< 8.3.1 - Unauthenticated Server-Side Request Forgery (CVSS 5.3, Podcast Player)
- [CVE-2026-14206](https://cve.now/CVE-2026-14206.md): HT Contact Form \< 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure (CVSS 7.5, HT Contact Form)
- [CVE-2026-13701](https://cve.now/CVE-2026-13701.md): Advanced Excerpt \< 4.5 - Admin+ Stored XSS via Ellipsis Setting (CVSS 4.8, Advanced Excerpt)
- [CVE-2026-13600](https://cve.now/CVE-2026-13600.md): AutoNetTV Relay \< 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron (CVSS 8.1, AutoNetTV Relay)
- [CVE-2026-13170](https://cve.now/CVE-2026-13170.md): Eventin \< 4.1.20 - Editor+ Local File Inclusion via speaker\_template Setting (CVSS 7.2, Eventin)
- [CVE-2026-12971](https://cve.now/CVE-2026-12971.md): LearnPress \< 4.4.4 - Instructor+ Server-Side Request Forgery via openai\_apply\_image\_feature (CVSS 2.2, LearnPress)
- [CVE-2026-17018](https://cve.now/CVE-2026-17018.md): CubeWP Framework \<= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR (CVSS 4.9, CubeWP Framework)
- [CVE-2026-17010](https://cve.now/CVE-2026-17010.md): Saitama Addon Pack \<= 1.0.8 - Contributor+ Stored XSS via Post Meta (CVSS 5.4, Saitama Addon Pack)
- [CVE-2026-17016](https://cve.now/CVE-2026-17016.md): Restore PayPal Standard for WooCommerce \<= 3.1.0 - Payment Bypass via PDT Underpayment (CVSS 3.7, Accept PayPal & Stripe with Subscriptions for WooCommerce)
- [CVE-2026-17012](https://cve.now/CVE-2026-17012.md): Restore PayPal Standard for WooCommerce \<= 3.1.0 - Payment Bypass via Unvalidated receiver\_email (CVSS 5.3, Accept PayPal & Stripe with Subscriptions for WooCommerce)
- [CVE-2026-18666](https://cve.now/CVE-2026-18666.md): Library Management System \< 3.6.7 - Subscriber+ SQL Injection via Filter Value (CVSS 4.3, Library Management System)
- [CVE-2026-18470](https://cve.now/CVE-2026-18470.md): Login & Register Forms \< 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response (CVSS 7.5, Login & Register Forms)
- [CVE-2026-18469](https://cve.now/CVE-2026-18469.md): Login & Register Forms \< 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force (CVSS 8.1, Login & Register Forms)
- [CVE-2026-18468](https://cve.now/CVE-2026-18468.md): Login & Register Forms \< 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header (CVSS 8.1, Login & Register Forms)
- [CVE-2026-13133](https://cve.now/CVE-2026-13133.md): A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative (CVSS 8.4, LY LINE for Windows)
- [CVE-2026-17019](https://cve.now/CVE-2026-17019.md): JetEngine \< 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) (CVSS 6.1, JetEngine)
- [CVE-2026-16299](https://cve.now/CVE-2026-16299.md): Single Sign On For TNG \< 2.2.0 - Unauthenticated Arbitrary Password Reset (CVSS 9.8, Single Sign On For TNG)
- [CVE-2026-16298](https://cve.now/CVE-2026-16298.md): FoodBoxBooker \< 1.0.7 - Unauthenticated Arbitrary Password Reset (CVSS 9.8, FoodBoxBooker)
- [CVE-2026-16257](https://cve.now/CVE-2026-16257.md): Arvow AI SEO Writer \< 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling (CVSS 8.2, Arvow AI SEO Writer)
- [CVE-2026-18030](https://cve.now/CVE-2026-18030.md): Bricksforge \< 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms (CVSS 8.1, BricksForge)
- [CVE-2026-17542](https://cve.now/CVE-2026-17542.md): Bit File Manager \< 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps\_fm\_connector (CVSS 7.5, File Manager)
- [CVE-2026-17541](https://cve.now/CVE-2026-17541.md): Bit File Manager \< 6.9.1 - Unauthenticated File Activity Log Disclosure (CVSS 7.5, File Manager)
- [CVE-2026-17540](https://cve.now/CVE-2026-17540.md): Bit File Manager \< 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch (CVSS 8.8, File Manager)
- [CVE-2026-72522](https://cve.now/CVE-2026-72522.md): libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates d (CVSS 6.2, libexpat project libexpat)
- [CVE-2026-19389](https://cve.now/CVE-2026-19389.md): Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-19387](https://cve.now/CVE-2026-19387.md): Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder (CVSS 7.6, Red Hat Enterprise Linux)
- [CVE-2026-19384](https://cve.now/CVE-2026-19384.md): SourceCodester Simple Doctors Appointment System ajax.php set\_appointment sql injection (CVSS 6.9, SourceCodester Simple Doctors Appointment System)
- [CVE-2026-19383](https://cve.now/CVE-2026-19383.md): saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell\_exec unrestricted upload (CVSS 5.1, saithink SaiAdmin · saigroup SaiAdmin)
- [CVE-2026-19382](https://cve.now/CVE-2026-19382.md): Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leak (CVSS 4.6, Almico Speedfan)
- [CVE-2026-19381](https://cve.now/CVE-2026-19381.md): Kingston FURY CTRL RGB Control Software Driver NTIOLib\_KSFX.sys privileges management (CVSS 8.5, Kingston FURY CTRL RGB Control Software)
- [CVE-2026-19380](https://cve.now/CVE-2026-19380.md): Mullvad wireguard.sys IOCTL AdapterState reference count (CVSS 4.6, Mullvad wireguard.sys)
- [CVE-2026-19379](https://cve.now/CVE-2026-19379.md): EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection (CVSS 6.9, EFM ipTIME AX8004M)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.