# CVEs published 2026-08-11

932 CVEs were published on August 11, 2026: 56 critical, 526 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2024-14043](https://cve.now/CVE-2024-14043.md): Open5GS Diameter S6a mme-fd-path.c mme\_s6a\_subscription\_data\_from\_avp heap-based overflow (CVSS 5.3, Open5GS)
- [CVE-2026-73250](https://cve.now/CVE-2026-73250.md): Notepad++: Install-time PowerShell command injection through installation path (CVSS 5.4, notepad-plus-plus)
- [CVE-2026-18710](https://cve.now/CVE-2026-18710.md): Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization (CVSS 8.2, MongoDB Driver)
- [CVE-2026-73249](https://cve.now/CVE-2026-73249.md): calibre Content Server \`/book-update-annotations\` Missing Write Authorization Check Allows Unauthorized Annotation Modification (CVSS 7.5, kovidgoyal calibre)
- [CVE-2026-73248](https://cve.now/CVE-2026-73248.md): calibre: Bypass of Python template restrictions via nested \`template()\` leading to RCE (CVSS 8.5, kovidgoyal calibre)
- [CVE-2026-73247](https://cve.now/CVE-2026-73247.md): Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata (CVSS 8.6, kestra-io kestra · io.kestra:core +1)
- [CVE-2026-73246](https://cve.now/CVE-2026-73246.md): Kestra: Unauthenticated management \`/worker\` endpoint exposes live task configuration and plaintext credentials (CVSS 7.5, kestra-io kestra)
- [CVE-2026-5917](https://cve.now/CVE-2026-5917.md): libgit2 Shell Command Injection via ssh\_libssh2 Backend (CVSS 8.6, libgit2)
- [CVE-2026-73245](https://cve.now/CVE-2026-73245.md): Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth (CVSS 6.5, kestra-io kestra · io.kestra:kestra)
- [CVE-2026-66875](https://cve.now/CVE-2026-66875.md): Mira Hormone Monitor, Mira Android App Missing authentication for critical function (CVSS 8.7, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-29036](https://cve.now/CVE-2026-29036.md): cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding (CVSS 8.7, DaveGamble cJSON)
- [CVE-2026-66098](https://cve.now/CVE-2026-66098.md): Mira Hormone Monitor, Mira Android App Missing authentication for critical function (CVSS 7.1, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-67558](https://cve.now/CVE-2026-67558.md): Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing (CVSS 8.2, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-67568](https://cve.now/CVE-2026-67568.md): Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials (CVSS 9.3, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-19560](https://cve.now/CVE-2026-19560.md): Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-19559](https://cve.now/CVE-2026-19559.md): Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-19558](https://cve.now/CVE-2026-19558.md): Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extens (CVSS 7.5, Google Chrome)
- [CVE-2026-19557](https://cve.now/CVE-2026-19557.md): Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-19556](https://cve.now/CVE-2026-19556.md): Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-68067](https://cve.now/CVE-2026-68067.md): Mira Hormone Monitor, Mira Android App Weak Authentication (CVSS 9.3, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-66340](https://cve.now/CVE-2026-66340.md): Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts (CVSS 6.9, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-64934](https://cve.now/CVE-2026-64934.md): Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision (CVSS 5.3, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-48763](https://cve.now/CVE-2026-48763.md): TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath (CVSS 8.2, baptisteArno typebot.io)
- [CVE-2026-66832](https://cve.now/CVE-2026-66832.md): Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings (CVSS 6.9, Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Fi…)
- [CVE-2026-19550](https://cve.now/CVE-2026-19550.md): Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes (CVSS 8.2, Red Hat Enterprise Linux)
- [CVE-2026-14863](https://cve.now/CVE-2026-14863.md): FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection (CVSS 8.7, FileRun)
- [CVE-2026-48762](https://cve.now/CVE-2026-48762.md): TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler (CVSS 5.4, baptisteArno typebot.io)
- [CVE-2026-48765](https://cve.now/CVE-2026-48765.md): TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding (CVSS 9.9, baptisteArno typebot.io)
- [CVE-2026-71290](https://cve.now/CVE-2026-71290.md): Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) (CVSS 9.1, Apache Software Foundation Apache HttpComponents Client)
- [CVE-2026-63177](https://cve.now/CVE-2026-63177.md): Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC (CVSS 7.1, cisagov Malcolm)
- [CVE-2026-63134](https://cve.now/CVE-2026-63134.md): Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation (CVSS 5.4, cisagov Malcolm)
- [CVE-2026-15606](https://cve.now/CVE-2026-15606.md): Frontend Admin by DynamiApps \<= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token (CVSS 8.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-63133](https://cve.now/CVE-2026-63133.md): Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS) (CVSS 6.5, cisagov Malcolm)
- [CVE-2026-19579](https://cve.now/CVE-2026-19579.md): Snipe-IT Checkout Request Cancellation IDOR (CVSS 5.3, Grokability Snipe-IT)
- [CVE-2026-55676](https://cve.now/CVE-2026-55676.md): Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component (CVSS 8.8, cisagov Malcolm)
- [CVE-2026-66150](https://cve.now/CVE-2026-66150.md): Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated at (CVSS 7.8, SonicWall Email Security)
- [CVE-2026-66149](https://cve.now/CVE-2026-66149.md): Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated at (CVSS 7.8, SonicWall Email Security)
- [CVE-2026-18634](https://cve.now/CVE-2026-18634.md): An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and (CVSS 8.4, SonicWall GMS)
- [CVE-2026-29035](https://cve.now/CVE-2026-29035.md): CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression (CVSS 8.3, civetweb)
- [CVE-2026-66154](https://cve.now/CVE-2026-66154.md): An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) a (CVSS 8.3, SonicWall GMS)
- [CVE-2026-66148](https://cve.now/CVE-2026-66148.md): An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier vers (CVSS 6.3, SonicWall GMS)
- [CVE-2026-66147](https://cve.now/CVE-2026-66147.md): An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allo (CVSS 9.4, SonicWall GMS)
- [CVE-2026-73244](https://cve.now/CVE-2026-73244.md): kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing (CVSS 5.3, kekingcn kkFileView)
- [CVE-2026-66146](https://cve.now/CVE-2026-66146.md): Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote (CVSS 6.1, SonicWall GMS)
- [CVE-2026-66145](https://cve.now/CVE-2026-66145.md): An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remot (CVSS 9.1, SonicWall GMS)
- [CVE-2026-73243](https://cve.now/CVE-2026-73243.md): kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass (CVSS 5.8, kekingcn kkFileView)
- [CVE-2026-18844](https://cve.now/CVE-2026-18844.md): Pulsetto Vagus Nerve Stimulator Hidden Functionality (CVSS 7.2, Pulsetto Vagus Nerve Stimulator)
- [CVE-2026-73242](https://cve.now/CVE-2026-73242.md): FreeRDP: Kerberos GSS Wrap-token \`EC\` field is unbounded, causing an out-of-bounds decrypt in \`kerberos\_DecryptMessage\` (CVSS 8.3, FreeRDP)
- [CVE-2026-73241](https://cve.now/CVE-2026-73241.md): FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open \`resultCode\`) (CVSS 8.3, FreeRDP)
- [CVE-2026-73235](https://cve.now/CVE-2026-73235.md): FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser (CVSS 6.1, FreeCAD)
- [CVE-2026-73234](https://cve.now/CVE-2026-73234.md): FreeCAD: FCStd path traversal allows arbitrary file write via unsanitized file attribute in PropertyFileIncluded::Restore() (CVSS 7.8, FreeCAD)
- [CVE-2026-73233](https://cve.now/CVE-2026-73233.md): FreeCAD: FEM formula incomplete escape (CVSS 8.5, FreeCAD)
- [CVE-2026-13457](https://cve.now/CVE-2026-13457.md): InstaWP Connect \<= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure (CVSS 7.5, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2026-19091](https://cve.now/CVE-2026-19091.md): GeoDirectory \<= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post\_type' Parameter via Query-String Bypass in geodir\_save\_post + geodir\_delete\_revision (CVSS 8.1, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-16230](https://cve.now/CVE-2026-16230.md): Formidable Digital Signatures \<= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field (CVSS 9.8, Strategy11 Formidable Digital Signatures)
- [CVE-2026-73036](https://cve.now/CVE-2026-73036.md): Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml (CVSS 4.6, Bash-it)
- [CVE-2026-73232](https://cve.now/CVE-2026-73232.md): ffuf denial of service (OOM) via HTTP response decompression bomb (CVSS 7.5, ffuf · github.com/ffuf/ffuf +1)
- [CVE-2026-73034](https://cve.now/CVE-2026-73034.md): DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user\_id Header (CVSS 9.3, eosphoros-ai DB-GPT)
- [CVE-2026-65655](https://cve.now/CVE-2026-65655.md): Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy (CVSS 2.3, Temporal Technologies Temporal UI Server)
- [CVE-2026-73231](https://cve.now/CVE-2026-73231.md): Faker: helpers.fake exploitable into arbritary code execution (CVSS 7.8, faker-js faker · @faker-js/faker)
- [CVE-2026-45618](https://cve.now/CVE-2026-45618.md): LiquidJS is Vulnerable to Remote Code Execution (CVSS 10.0, harttle liquidjs · liquidjs)
- [CVE-2026-71474](https://cve.now/CVE-2026-71474.md): Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response (CVSS 7.1, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-48813](https://cve.now/CVE-2026-48813.md): Flawfinder output manipulation via untrusted filenames and source text (CVSS 8.7, david-a-wheeler flawfinder · flawfinder)
- [CVE-2026-71468](https://cve.now/CVE-2026-71468.md): Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache (CVSS 5.3, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-71475](https://cve.now/CVE-2026-71475.md): Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path (CVSS 6.8, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-71845](https://cve.now/CVE-2026-71845.md): Insights-client: insights-client: ccx\_token bearer credential logged in clear text at startup via setdefault() (CVSS 6.3, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-71467](https://cve.now/CVE-2026-71467.md): Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing (CVSS 7.5, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-73032](https://cve.now/CVE-2026-73032.md): PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval() (CVSS 9.4, papersgpt-for-zotero)
- [CVE-2026-70339](https://cve.now/CVE-2026-70339.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-48804](https://cve.now/CVE-2026-48804.md): python-socketio: Binary attachment accumulation can cause denial of service (CVSS 7.5, miguelgrinberg python-socketio · python-socketio)
- [CVE-2026-73230](https://cve.now/CVE-2026-73230.md): Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets (CVSS 5.9, ente)
- [CVE-2026-73283](https://cve.now/CVE-2026-73283.md): In sshd in OpenSSH before 10.5, the restrict keyword (in authorized\_keys) was supposed to be applicable to tunnel forwarding but was not. (CVSS 2.5, OpenBSD OpenSSH)
- [CVE-2024-14042](https://cve.now/CVE-2024-14042.md): Open5GS Diameter S6a hss-s6a-path.c hss\_ogs\_diam\_s6a\_ulr\_cb stack-based overflow (CVSS 5.3, Open5GS)
- [CVE-2026-73282](https://cve.now/CVE-2026-73282.md): In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. (CVSS 4.8, OpenBSD OpenSSH)
- [CVE-2026-73281](https://cve.now/CVE-2026-73281.md): In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that a (CVSS 3.5, OpenBSD OpenSSH)
- [CVE-2026-73031](https://cve.now/CVE-2026-73031.md): telegram-search Stored XSS via v-html in MessageList.vue (CVSS 8.2, GramSearch telegram-search)
- [CVE-2026-73229](https://cve.now/CVE-2026-73229.md): Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests (CVSS 4.3, encode django-rest-framework · djangorestframework)
- [CVE-2026-73228](https://cve.now/CVE-2026-73228.md): Django REST framework: Potential bypass of Django \`DATA\_UPLOAD\_MAX\_MEMORY\_SIZE\` when parsing oversized JSON and urlencoded request bodies via DRF \`request.data\` (CVSS 5.3, encode django-rest-framework · djangorestframework)
- [CVE-2026-72742](https://cve.now/CVE-2026-72742.md): DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing (CVSS 9.2, Stanford NLP DSPy)
- [CVE-2026-18712](https://cve.now/CVE-2026-18712.md): Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections (CVSS 7.2, MongoDB Server)
- [CVE-2026-18711](https://cve.now/CVE-2026-18711.md): Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-18709](https://cve.now/CVE-2026-18709.md): Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency (CVSS 5.9, MongoDB Server)
- [CVE-2026-18698](https://cve.now/CVE-2026-18698.md): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command (CVSS 5.3, MongoDB Server)
- [CVE-2026-18690](https://cve.now/CVE-2026-18690.md): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections (CVSS 7.2, MongoDB Server)
- [CVE-2026-18699](https://cve.now/CVE-2026-18699.md): Improper Input Validation in MongoDB Query Planner Leads to Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-18691](https://cve.now/CVE-2026-18691.md): Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure (CVSS 9.0, MongoDB Server)
- [CVE-2026-73227](https://cve.now/CVE-2026-73227.md): electerm's RDP clipboard file download may parse unsafe file name (CVSS 8.1, electerm)
- [CVE-2026-73226](https://cve.now/CVE-2026-73226.md): Electerm WebSocket \`upgrade-func\` and \`fs\` handlers allow arbitrary method/function invocation due to missing method-name allowlist (CVSS 8.8, electerm)
- [CVE-2026-18702](https://cve.now/CVE-2026-18702.md): Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings (CVSS 5.3, MongoDB Server)
- [CVE-2026-18694](https://cve.now/CVE-2026-18694.md): Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-73225](https://cve.now/CVE-2026-73225.md): electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename (CVSS 8.1, electerm)
- [CVE-2026-18708](https://cve.now/CVE-2026-18708.md): Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes (CVSS 5.3, MongoDB Server)
- [CVE-2026-18696](https://cve.now/CVE-2026-18696.md): Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections (CVSS 7.0, MongoDB Server)
- [CVE-2026-18700](https://cve.now/CVE-2026-18700.md): Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service (CVSS 6.0, MongoDB Server)
- [CVE-2026-18701](https://cve.now/CVE-2026-18701.md): Type Confusion in MongoDB Query Subsystem Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-73224](https://cve.now/CVE-2026-73224.md): Electerm check folder size function may get attacked by unsafe folder name (CVSS 8.8, electerm)
- [CVE-2026-18697](https://cve.now/CVE-2026-18697.md): Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos (CVSS 8.7, MongoDB Server)
- [CVE-2026-18693](https://cve.now/CVE-2026-18693.md): Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.2, MongoDB Server)
- [CVE-2026-18705](https://cve.now/CVE-2026-18705.md): Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data (CVSS 7.1, MongoDB Server)
- [CVE-2026-73223](https://cve.now/CVE-2026-73223.md): electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename (CVSS 8.1, electerm)
- [CVE-2026-18704](https://cve.now/CVE-2026-18704.md): Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations (CVSS 7.1, MongoDB Server)
- [CVE-2026-18692](https://cve.now/CVE-2026-18692.md): Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution (CVSS 7.7, MongoDB Server)
- [CVE-2026-18688](https://cve.now/CVE-2026-18688.md): Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure (CVSS 7.1, MongoDB Server)
- [CVE-2026-69119](https://cve.now/CVE-2026-69119.md): Taubyte Tau v1.1.10 Missing Authorization via GET and DELETE /projects/{id} (CVSS 7.2, Taubyte tau)
- [CVE-2026-18695](https://cve.now/CVE-2026-18695.md): Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service (CVSS 7.1, MongoDB Server)
- [CVE-2026-18687](https://cve.now/CVE-2026-18687.md): Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption (CVSS 7.1, MongoDB Server)
- [CVE-2026-18706](https://cve.now/CVE-2026-18706.md): Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution (CVSS 7.5, MongoDB Server)
- [CVE-2026-18707](https://cve.now/CVE-2026-18707.md): Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service (CVSS 5.3, MongoDB Server)
- [CVE-2026-18703](https://cve.now/CVE-2026-18703.md): Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method (CVSS 2.3, MongoDB Server)
- [CVE-2026-69117](https://cve.now/CVE-2026-69117.md): NetBox 4.5.8 ORM Injection via WritableNestedSerializer (CVSS 7.1, NetBox Labs NetBox)
- [CVE-2026-48802](https://cve.now/CVE-2026-48802.md): python-engineio has unbound thread allocation that can cause denial of service (CVSS 7.5, miguelgrinberg python-engineio · python-engineio)
- [CVE-2026-73222](https://cve.now/CVE-2026-73222.md): Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio) (CVSS 8.8, davila7 claude-code-templates · claude-code-templates)
- [CVE-2026-15426](https://cve.now/CVE-2026-15426.md): AcyMailing \<= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update (CVSS 8.8, acyba AcyMailing – An Ultimate Newsletter Plugin and Market…)
- [CVE-2026-73221](https://cve.now/CVE-2026-73221.md): CVAT: Flawed authorization logic in endpoints related to lambda requests (CVSS 5.3, cvat-ai cvat)
- [CVE-2026-69115](https://cve.now/CVE-2026-69115.md): OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints (CVSS 7.1, OpenIMSDK OpenIM Server)
- [CVE-2026-48809](https://cve.now/CVE-2026-48809.md): python-engineio has possible denial of service due to maximum payload size sometimes not being enforced (CVSS 7.5, miguelgrinberg python-engineio · python-engineio)
- [CVE-2026-69113](https://cve.now/CVE-2026-69113.md): Cap v0.3.1 Broken Access Control via video comment endpoint (CVSS 5.3, CapSoftware Cap)
- [CVE-2026-69102](https://cve.now/CVE-2026-69102.md): MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust (CVSS 9.3, dromara MaxKey)
- [CVE-2026-72713](https://cve.now/CVE-2026-72713.md): XAgent Path Traversal Arbitrary File Read via /workspace/file (CVSS 8.7, OpenBMB XAgent)
- [CVE-2026-48414](https://cve.now/CVE-2026-48414.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 7.7, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-48416](https://cve.now/CVE-2026-48416.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.5, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-48413](https://cve.now/CVE-2026-48413.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-48415](https://cve.now/CVE-2026-48415.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 7.6, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-48412](https://cve.now/CVE-2026-48412.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 2.7, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-48411](https://cve.now/CVE-2026-48411.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.5, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-71362](https://cve.now/CVE-2026-71362.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 9.1, KEV, Adobe Commerce · Adobe Magento Open Source)
- [CVE-2026-73219](https://cve.now/CVE-2026-73219.md): CVAT: Denial of service with regards to automatic annotation (CVSS 5.3, cvat-ai cvat)
- [CVE-2026-73218](https://cve.now/CVE-2026-73218.md): Cursor: Sandbox escape via launching privileged containers (CVSS 7.7, cursor)
- [CVE-2026-48381](https://cve.now/CVE-2026-48381.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.0, Adobe Campaign Classic)
- [CVE-2026-71398](https://cve.now/CVE-2026-71398.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-27302](https://cve.now/CVE-2026-27302.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-73217](https://cve.now/CVE-2026-73217.md): Cursor: Sandbox escape via tampered Python virtual environments (CVSS 7.7, cursor)
- [CVE-2026-48408](https://cve.now/CVE-2026-48408.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-48409](https://cve.now/CVE-2026-48409.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-48441](https://cve.now/CVE-2026-48441.md): Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.6, Adobe Lightroom Classic)
- [CVE-2026-48447](https://cve.now/CVE-2026-48447.md): Lightroom Classic | Incorrect Authorization (CWE-863) (CVSS 7.7, Adobe Lightroom Classic)
- [CVE-2026-48406](https://cve.now/CVE-2026-48406.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-48405](https://cve.now/CVE-2026-48405.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-48397](https://cve.now/CVE-2026-48397.md): Lightroom Classic | Deserialization of Untrusted Data (CWE-502) (CVSS 8.6, Adobe Lightroom Classic)
- [CVE-2026-48407](https://cve.now/CVE-2026-48407.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-48404](https://cve.now/CVE-2026-48404.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-48410](https://cve.now/CVE-2026-48410.md): Lightroom Classic | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-47940](https://cve.now/CVE-2026-47940.md): Lightroom Classic | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Lightroom Classic)
- [CVE-2026-65680](https://cve.now/CVE-2026-65680.md): Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft OneDrive for MacOS)
- [CVE-2026-73216](https://cve.now/CVE-2026-73216.md): coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity (CVSS 6.5, coturn)
- [CVE-2026-20712](https://cve.now/CVE-2026-20712.md): Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. (CVSS 4.0, Intel(R) reference platforms)
- [CVE-2026-73215](https://cve.now/CVE-2026-73215.md): The coturn server can end in a state where it does not accept more requests with "even-port" enabled. (CVSS 7.1, coturn)
- [CVE-2026-20917](https://cve.now/CVE-2026-20917.md): Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: (CVSS 4.0, Intel(R) Processors)
- [CVE-2026-72712](https://cve.now/CVE-2026-72712.md): Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet (CVSS 6.9, Nmap Project Nmap)
- [CVE-2026-73214](https://cve.now/CVE-2026-73214.md): coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS (CVSS 8.2, coturn)
- [CVE-2026-73213](https://cve.now/CVE-2026-73213.md): Coturn: \`addr\_less\_eq()\` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass \`denied-peer-ip\`/\`allowed-peer-ip\` IPv6 ranges (TURN-specific SSRF) (CVSS 5.8, coturn)
- [CVE-2026-73212](https://cve.now/CVE-2026-73212.md): coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE (CVSS 5.8, coturn)
- [CVE-2026-20901](https://cve.now/CVE-2026-20901.md): Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. (CVSS 4.0, Intel(R) Xeon(R) processors)
- [CVE-2026-48790](https://cve.now/CVE-2026-48790.md): turso-cli persists Turso platform JWT with world-readable (0o644) file permissions (CVSS 5.5, tursodatabase turso-cli · github.com/tursodatabase/turso-cli)
- [CVE-2026-73211](https://cve.now/CVE-2026-73211.md): PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore() (CVSS 9.8, Chocobozzz PeerTube)
- [CVE-2026-48771](https://cve.now/CVE-2026-48771.md): ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration (CVSS 8.2, Ishankjha740 ishankportfolio)
- [CVE-2026-73090](https://cve.now/CVE-2026-73090.md): PeerTube: Cross-origin remote video takeover via Update activity (CVSS 9.3, Chocobozzz PeerTube)
- [CVE-2026-47705](https://cve.now/CVE-2026-47705.md): TypeBot vulnerable to CSV injection in result export (CVSS 9.6, baptisteArno typebot.io)
- [CVE-2025-54512](https://cve.now/CVE-2025-54512.md): A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, (CVSS 7.0, AMD Ryzen™ Master)
- [CVE-2026-48767](https://cve.now/CVE-2026-48767.md): Google Sheets OAuth access token disclosure to guest members via getAccessToken (CVSS 7.6, baptisteArno typebot.io)
- [CVE-2022-50997](https://cve.now/CVE-2022-50997.md): Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp (CVSS 8.7, Weaver Network Co. E-cology)
- [CVE-2026-0465](https://cve.now/CVE-2026-0465.md): A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potential (CVSS 5.6, AMD Ryzen™ Master)
- [CVE-2016-20097](https://cve.now/CVE-2016-20097.md): Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad (CVSS 8.7, Weaver Network Co. E-cology)
- [CVE-2025-0046](https://cve.now/CVE-2025-0046.md): Incorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution. (CVSS 7.0, AMD Power Design Manager (PDM) Software Installer for Windo…)
- [CVE-2026-48494](https://cve.now/CVE-2026-48494.md): TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global \`wa-preview-{phone}\` session ids (CVSS 7.1, baptisteArno typebot.io)
- [CVE-2025-8087](https://cve.now/CVE-2025-8087.md): A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstall (CVSS 7.0, AMD Power Design Manager (PDM) Software Un-Installer)
- [CVE-2026-62869](https://cve.now/CVE-2026-62869.md): Azure Entra ID Spoofing Vulnerability (CVSS 8.8, Microsoft Entra)
- [CVE-2026-50516](https://cve.now/CVE-2026-50516.md): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (CVSS 9.4, Microsoft Azure Kubernetes Service)
- [CVE-2026-62917](https://cve.now/CVE-2026-62917.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-62839](https://cve.now/CVE-2026-62839.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-58639](https://cve.now/CVE-2026-58639.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-65767](https://cve.now/CVE-2026-65767.md): Microsoft Teams for Android Spoofing Vulnerability (CVSS 8.8, Microsoft Teams for Android)
- [CVE-2026-62898](https://cve.now/CVE-2026-62898.md): Microsoft QUIC Information Disclosure Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +7)
- [CVE-2026-62738](https://cve.now/CVE-2026-62738.md): Windows Management Instrumentation Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-71331](https://cve.now/CVE-2026-71331.md): Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-70354](https://cve.now/CVE-2026-70354.md): .NET Core Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8)
- [CVE-2026-63522](https://cve.now/CVE-2026-63522.md): Azure SQL Database Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure SQL Database)
- [CVE-2026-70337](https://cve.now/CVE-2026-70337.md): Microsoft PowerShell Remote Code Execution Vulnerability (CVSS 8.8, Microsoft PowerShell · powershell)
- [CVE-2026-70338](https://cve.now/CVE-2026-70338.md): Microsoft PowerShell Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft PowerShell · powershell)
- [CVE-2026-70326](https://cve.now/CVE-2026-70326.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Server Subscription Edition)
- [CVE-2026-70306](https://cve.now/CVE-2026-70306.md): Microsoft Office SharePoint Spoofing Vulnerability (CVSS 9.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-70130](https://cve.now/CVE-2026-70130.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-56179](https://cve.now/CVE-2026-56179.md): Windows Network Address Translation (NAT) Spoofing Vulnerability (CVSS 8.3, Microsoft Windows)
- [CVE-2026-68817](https://cve.now/CVE-2026-68817.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68814](https://cve.now/CVE-2026-68814.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68812](https://cve.now/CVE-2026-68812.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68805](https://cve.now/CVE-2026-68805.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68804](https://cve.now/CVE-2026-68804.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68803](https://cve.now/CVE-2026-68803.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68801](https://cve.now/CVE-2026-68801.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68799](https://cve.now/CVE-2026-68799.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68798](https://cve.now/CVE-2026-68798.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 365 for Mac)
- [CVE-2026-68797](https://cve.now/CVE-2026-68797.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-66809](https://cve.now/CVE-2026-66809.md): Microsoft Office Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-66810](https://cve.now/CVE-2026-66810.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-66808](https://cve.now/CVE-2026-66808.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-66807](https://cve.now/CVE-2026-66807.md): Microsoft Office Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-66806](https://cve.now/CVE-2026-66806.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-66805](https://cve.now/CVE-2026-66805.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Server Subscription Edition)
- [CVE-2026-66802](https://cve.now/CVE-2026-66802.md): Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-65810](https://cve.now/CVE-2026-65810.md): .NET Framework Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET Framework)
- [CVE-2026-65796](https://cve.now/CVE-2026-65796.md): Windows iSCSI Target Service Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-65798](https://cve.now/CVE-2026-65798.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-65799](https://cve.now/CVE-2026-65799.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-65797](https://cve.now/CVE-2026-65797.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-65794](https://cve.now/CVE-2026-65794.md): Windows SMB Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-65795](https://cve.now/CVE-2026-65795.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-65791](https://cve.now/CVE-2026-65791.md): Windows iSCSI Target Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2026-65790](https://cve.now/CVE-2026-65790.md): Windows Message Queuing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65781](https://cve.now/CVE-2026-65781.md): Windows Autopilot Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65782](https://cve.now/CVE-2026-65782.md): Windows Autopilot Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65778](https://cve.now/CVE-2026-65778.md): Windows Autopilot Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65780](https://cve.now/CVE-2026-65780.md): Windows Autopilot Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65779](https://cve.now/CVE-2026-65779.md): Windows Autopilot Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65777](https://cve.now/CVE-2026-65777.md): Active Directory Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2026-65776](https://cve.now/CVE-2026-65776.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65775](https://cve.now/CVE-2026-65775.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65774](https://cve.now/CVE-2026-65774.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65773](https://cve.now/CVE-2026-65773.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65679](https://cve.now/CVE-2026-65679.md): Windows iSCSI Target Service Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-65681](https://cve.now/CVE-2026-65681.md): Windows iSCSI Target Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2026-65673](https://cve.now/CVE-2026-65673.md): Microsoft Entra Connect Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Entra Connect)
- [CVE-2026-62882](https://cve.now/CVE-2026-62882.md): Microsoft Outlook Spoofing Vulnerability (CVSS 4.3, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-64921](https://cve.now/CVE-2026-64921.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-64919](https://cve.now/CVE-2026-64919.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2026-64917](https://cve.now/CVE-2026-64917.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-64920](https://cve.now/CVE-2026-64920.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2026-64916](https://cve.now/CVE-2026-64916.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-64915](https://cve.now/CVE-2026-64915.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-64914](https://cve.now/CVE-2026-64914.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2026-64908](https://cve.now/CVE-2026-64908.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2026-64911](https://cve.now/CVE-2026-64911.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64912](https://cve.now/CVE-2026-64912.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2026-64910](https://cve.now/CVE-2026-64910.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64909](https://cve.now/CVE-2026-64909.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64906](https://cve.now/CVE-2026-64906.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2026-64907](https://cve.now/CVE-2026-64907.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-64905](https://cve.now/CVE-2026-64905.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-64904](https://cve.now/CVE-2026-64904.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64901](https://cve.now/CVE-2026-64901.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-64903](https://cve.now/CVE-2026-64903.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64899](https://cve.now/CVE-2026-64899.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64902](https://cve.now/CVE-2026-64902.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-64900](https://cve.now/CVE-2026-64900.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-64898](https://cve.now/CVE-2026-64898.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64897](https://cve.now/CVE-2026-64897.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-63533](https://cve.now/CVE-2026-63533.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63532](https://cve.now/CVE-2026-63532.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63531](https://cve.now/CVE-2026-63531.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63530](https://cve.now/CVE-2026-63530.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63529](https://cve.now/CVE-2026-63529.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63527](https://cve.now/CVE-2026-63527.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63528](https://cve.now/CVE-2026-63528.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63526](https://cve.now/CVE-2026-63526.md): Microsoft Office Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63525](https://cve.now/CVE-2026-63525.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63524](https://cve.now/CVE-2026-63524.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-62842](https://cve.now/CVE-2026-62842.md): Microsoft Office Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-62911](https://cve.now/CVE-2026-62911.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-62888](https://cve.now/CVE-2026-62888.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62887](https://cve.now/CVE-2026-62887.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62886](https://cve.now/CVE-2026-62886.md): .NET Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET Framework · Microsoft Visual Studio +5)
- [CVE-2026-62885](https://cve.now/CVE-2026-62885.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62883](https://cve.now/CVE-2026-62883.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-62881](https://cve.now/CVE-2026-62881.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-62880](https://cve.now/CVE-2026-62880.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62872](https://cve.now/CVE-2026-62872.md): .NET Framework Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET Framework)
- [CVE-2026-62871](https://cve.now/CVE-2026-62871.md): .NET Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +1)
- [CVE-2026-62832](https://cve.now/CVE-2026-62832.md): Windows User Profile Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62822](https://cve.now/CVE-2026-62822.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62824](https://cve.now/CVE-2026-62824.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62823](https://cve.now/CVE-2026-62823.md): Windows DHCP Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2026-62814](https://cve.now/CVE-2026-62814.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62811](https://cve.now/CVE-2026-62811.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62807](https://cve.now/CVE-2026-62807.md): Windows DHCP Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2026-62803](https://cve.now/CVE-2026-62803.md): Windows DHCP Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2026-62793](https://cve.now/CVE-2026-62793.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62790](https://cve.now/CVE-2026-62790.md): Windows SMBv3 Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62788](https://cve.now/CVE-2026-62788.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62786](https://cve.now/CVE-2026-62786.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62800](https://cve.now/CVE-2026-62800.md): Windows SMBv3 Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62781](https://cve.now/CVE-2026-62781.md): RPC Runtime Library Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-62782](https://cve.now/CVE-2026-62782.md): Windows SMB Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-62780](https://cve.now/CVE-2026-62780.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62778](https://cve.now/CVE-2026-62778.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-62776](https://cve.now/CVE-2026-62776.md): Windows DHCP Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2026-62799](https://cve.now/CVE-2026-62799.md): Windows SMB Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62775](https://cve.now/CVE-2026-62775.md): Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62770](https://cve.now/CVE-2026-62770.md): Windows Shell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62768](https://cve.now/CVE-2026-62768.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62761](https://cve.now/CVE-2026-62761.md): Windows DHCP Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2026-62771](https://cve.now/CVE-2026-62771.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62769](https://cve.now/CVE-2026-62769.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-62752](https://cve.now/CVE-2026-62752.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62751](https://cve.now/CVE-2026-62751.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62749](https://cve.now/CVE-2026-62749.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62741](https://cve.now/CVE-2026-62741.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62757](https://cve.now/CVE-2026-62757.md): Windows Schannel Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2026-62736](https://cve.now/CVE-2026-62736.md): Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62734](https://cve.now/CVE-2026-62734.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62732](https://cve.now/CVE-2026-62732.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62730](https://cve.now/CVE-2026-62730.md): Windows Wired AutoConfig Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62743](https://cve.now/CVE-2026-62743.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-20349](https://cve.now/CVE-2026-20349.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability (CVSS 8.6, KEV, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-62733](https://cve.now/CVE-2026-62733.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62728](https://cve.now/CVE-2026-62728.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62726](https://cve.now/CVE-2026-62726.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62725](https://cve.now/CVE-2026-62725.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62721](https://cve.now/CVE-2026-62721.md): Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62717](https://cve.now/CVE-2026-62717.md): Windows Message Queuing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62714](https://cve.now/CVE-2026-62714.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62720](https://cve.now/CVE-2026-62720.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62711](https://cve.now/CVE-2026-62711.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62710](https://cve.now/CVE-2026-62710.md): Windows Device Association Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62709](https://cve.now/CVE-2026-62709.md): Windows GDI+ Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62708](https://cve.now/CVE-2026-62708.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 6.4, Microsoft Windows)
- [CVE-2026-62701](https://cve.now/CVE-2026-62701.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62700](https://cve.now/CVE-2026-62700.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62698](https://cve.now/CVE-2026-62698.md): Microsoft Digest Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61938](https://cve.now/CVE-2026-61938.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61929](https://cve.now/CVE-2026-61929.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61921](https://cve.now/CVE-2026-61921.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-61918](https://cve.now/CVE-2026-61918.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-61926](https://cve.now/CVE-2026-61926.md): Windows USB Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61920](https://cve.now/CVE-2026-61920.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2026-61360](https://cve.now/CVE-2026-61360.md): Windows GDI Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-61358](https://cve.now/CVE-2026-61358.md): Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61357](https://cve.now/CVE-2026-61357.md): Application Information Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61365](https://cve.now/CVE-2026-61365.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61364](https://cve.now/CVE-2026-61364.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61355](https://cve.now/CVE-2026-61355.md): Windows Sensor Data Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61359](https://cve.now/CVE-2026-61359.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61363](https://cve.now/CVE-2026-61363.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2026-61349](https://cve.now/CVE-2026-61349.md): Windows Work Folder Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-59131](https://cve.now/CVE-2026-59131.md): AMD Zen Information Disclosure Vulnerability (CVSS 5.6, Microsoft Windows)
- [CVE-2026-59126](https://cve.now/CVE-2026-59126.md): Windows Event Logging Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-59125](https://cve.now/CVE-2026-59125.md): Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-59122](https://cve.now/CVE-2026-59122.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-59119](https://cve.now/CVE-2026-59119.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft PowerShell · powershell)
- [CVE-2026-58651](https://cve.now/CVE-2026-58651.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office 365… +1)
- [CVE-2026-58641](https://cve.now/CVE-2026-58641.md): .NET Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft SkiaSharp)
- [CVE-2026-54981](https://cve.now/CVE-2026-54981.md): Visual Studio Code Python Extension Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Python extension for Visual Studio Code)
- [CVE-2026-42976](https://cve.now/CVE-2026-42976.md): Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-72971](https://cve.now/CVE-2026-72971.md): Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-70355](https://cve.now/CVE-2026-70355.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft SharePoint Server)
- [CVE-2026-70348](https://cve.now/CVE-2026-70348.md): Windows Management Services Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-73089](https://cve.now/CVE-2026-73089.md): Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM (CVSS 7.5, browserslist)
- [CVE-2026-70347](https://cve.now/CVE-2026-70347.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-70346](https://cve.now/CVE-2026-70346.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-70345](https://cve.now/CVE-2026-70345.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-70344](https://cve.now/CVE-2026-70344.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-66804](https://cve.now/CVE-2026-66804.md): Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65783](https://cve.now/CVE-2026-65783.md): Windows Autopilot Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61352](https://cve.now/CVE-2026-61352.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2026-65806](https://cve.now/CVE-2026-65806.md): Azure CycleCloud Information Disclosure Vulnerability (CVSS 6.5, Microsoft Azure CycleCloud)
- [CVE-2026-70340](https://cve.now/CVE-2026-70340.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Azure CycleCloud)
- [CVE-2026-57104](https://cve.now/CVE-2026-57104.md): Azure Storage Explorer Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure Storage Explorer)
- [CVE-2026-70336](https://cve.now/CVE-2026-70336.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio Code)
- [CVE-2026-70335](https://cve.now/CVE-2026-70335.md): GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2026-70330](https://cve.now/CVE-2026-70330.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-70304](https://cve.now/CVE-2026-70304.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2026-70329](https://cve.now/CVE-2026-70329.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 8.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-70328](https://cve.now/CVE-2026-70328.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-70327](https://cve.now/CVE-2026-70327.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-70324](https://cve.now/CVE-2026-70324.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-70322](https://cve.now/CVE-2026-70322.md): Powerpoint Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70323](https://cve.now/CVE-2026-70323.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70320](https://cve.now/CVE-2026-70320.md): Powerpoint Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70319](https://cve.now/CVE-2026-70319.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70325](https://cve.now/CVE-2026-70325.md): Powerpoint Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70317](https://cve.now/CVE-2026-70317.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70314](https://cve.now/CVE-2026-70314.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70318](https://cve.now/CVE-2026-70318.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-70321](https://cve.now/CVE-2026-70321.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Server Subscription Edition)
- [CVE-2026-70315](https://cve.now/CVE-2026-70315.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70316](https://cve.now/CVE-2026-70316.md): Powerpoint Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70310](https://cve.now/CVE-2026-70310.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-70313](https://cve.now/CVE-2026-70313.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-70311](https://cve.now/CVE-2026-70311.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-70312](https://cve.now/CVE-2026-70312.md): Powerpoint Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-66301](https://cve.now/CVE-2026-66301.md): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Dynamics 365 (on-premises))
- [CVE-2026-65769](https://cve.now/CVE-2026-65769.md): Microsoft Teams iOS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Teams for iOS)
- [CVE-2026-70307](https://cve.now/CVE-2026-70307.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-69306](https://cve.now/CVE-2026-69306.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 8.2, Microsoft Visual Studio Code)
- [CVE-2026-69278](https://cve.now/CVE-2026-69278.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2026-69320](https://cve.now/CVE-2026-69320.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio Code)
- [CVE-2026-68821](https://cve.now/CVE-2026-68821.md): Windows Package Manager Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft App Installer)
- [CVE-2026-68820](https://cve.now/CVE-2026-68820.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Windows)
- [CVE-2026-68819](https://cve.now/CVE-2026-68819.md): Windows Network File System Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2026-68816](https://cve.now/CVE-2026-68816.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68815](https://cve.now/CVE-2026-68815.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68813](https://cve.now/CVE-2026-68813.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-68811](https://cve.now/CVE-2026-68811.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-48505](https://cve.now/CVE-2025-48505.md): Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged e (CVSS 7.3, AMD Vitis™ Unified Installer for FPGAs & Adaptive SoCs in W…)
- [CVE-2026-68810](https://cve.now/CVE-2026-68810.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68809](https://cve.now/CVE-2026-68809.md): Powerpoint Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-68808](https://cve.now/CVE-2026-68808.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68806](https://cve.now/CVE-2026-68806.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68807](https://cve.now/CVE-2026-68807.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 365 for Mac)
- [CVE-2026-68802](https://cve.now/CVE-2026-68802.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68800](https://cve.now/CVE-2026-68800.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 365 for Mac)
- [CVE-2026-68796](https://cve.now/CVE-2026-68796.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68795](https://cve.now/CVE-2026-68795.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68794](https://cve.now/CVE-2026-68794.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68793](https://cve.now/CVE-2026-68793.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-68792](https://cve.now/CVE-2026-68792.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-66799](https://cve.now/CVE-2026-66799.md): Windows Key Guard Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65815](https://cve.now/CVE-2026-65815.md): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics 365 (on-premises))
- [CVE-2026-65814](https://cve.now/CVE-2026-65814.md): Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65813](https://cve.now/CVE-2026-65813.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-65811](https://cve.now/CVE-2026-65811.md): Power BI Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Power BI Report Server)
- [CVE-2026-65807](https://cve.now/CVE-2026-65807.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 8.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2026-65788](https://cve.now/CVE-2026-65788.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65787](https://cve.now/CVE-2026-65787.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65789](https://cve.now/CVE-2026-65789.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2026-65786](https://cve.now/CVE-2026-65786.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65784](https://cve.now/CVE-2026-65784.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-65785](https://cve.now/CVE-2026-65785.md): Windows DHCP Client Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-65678](https://cve.now/CVE-2026-65678.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-65675](https://cve.now/CVE-2026-65675.md): CoPilot Chat Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Visual Studio Code CoPilot Chat Extension)
- [CVE-2026-65672](https://cve.now/CVE-2026-65672.md): Remote Access API Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65671](https://cve.now/CVE-2026-65671.md): Remote Access API Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-65662](https://cve.now/CVE-2026-65662.md): Windows GDI Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-65665](https://cve.now/CVE-2026-65665.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Server)
- [CVE-2026-65664](https://cve.now/CVE-2026-65664.md): Microsoft Office Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-65660](https://cve.now/CVE-2026-65660.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-65663](https://cve.now/CVE-2026-65663.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-65661](https://cve.now/CVE-2026-65661.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-65658](https://cve.now/CVE-2026-65658.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-65656](https://cve.now/CVE-2026-65656.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-65657](https://cve.now/CVE-2026-65657.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-64922](https://cve.now/CVE-2026-64922.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-63519](https://cve.now/CVE-2026-63519.md): Microsoft Office Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63521](https://cve.now/CVE-2026-63521.md): Microsoft Office Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63518](https://cve.now/CVE-2026-63518.md): Microsoft Office Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2026-63517](https://cve.now/CVE-2026-63517.md): Microsoft Office Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63515](https://cve.now/CVE-2026-63515.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-63513](https://cve.now/CVE-2026-63513.md): Microsoft Office Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2026-54123](https://cve.now/CVE-2026-54123.md): Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability (CVSS 5.5, Microsoft Defender for Endpoint for Mac)
- [CVE-2026-62915](https://cve.now/CVE-2026-62915.md): Microsoft Exchange Server Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-62914](https://cve.now/CVE-2026-62914.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 7.3, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-62913](https://cve.now/CVE-2026-62913.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-62912](https://cve.now/CVE-2026-62912.md): Microsoft Exchange Server Denial of Service Vulnerability (CVSS 6.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-62910](https://cve.now/CVE-2026-62910.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2026-62909](https://cve.now/CVE-2026-62909.md): .NET Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +2)
- [CVE-2026-62908](https://cve.now/CVE-2026-62908.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62902](https://cve.now/CVE-2026-62902.md): .NET Information Disclosure Vulnerability (CVSS 6.5, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +6)
- [CVE-2026-62901](https://cve.now/CVE-2026-62901.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +2)
- [CVE-2026-62900](https://cve.now/CVE-2026-62900.md): .NET Information Disclosure Vulnerability (CVSS 5.9, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +2)
- [CVE-2026-62899](https://cve.now/CVE-2026-62899.md): .NET Security Feature Bypass Vulnerability (CVSS 5.9, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +2)
- [CVE-2026-62897](https://cve.now/CVE-2026-62897.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.0, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +8)
- [CVE-2026-62894](https://cve.now/CVE-2026-62894.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62893](https://cve.now/CVE-2026-62893.md): Windows Deployment Services TFTP Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2026-62892](https://cve.now/CVE-2026-62892.md): Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62890](https://cve.now/CVE-2026-62890.md): Windows GDI+ Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62889](https://cve.now/CVE-2026-62889.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-62878](https://cve.now/CVE-2026-62878.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2026-62877](https://cve.now/CVE-2026-62877.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office 365 for Mac · Microsoft Office for Andr… +1)
- [CVE-2026-62876](https://cve.now/CVE-2026-62876.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62820](https://cve.now/CVE-2026-62820.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2026-62819](https://cve.now/CVE-2026-62819.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-62818](https://cve.now/CVE-2026-62818.md): Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62817](https://cve.now/CVE-2026-62817.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2026-62816](https://cve.now/CVE-2026-62816.md): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62815](https://cve.now/CVE-2026-62815.md): Microsoft QUIC Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2026-62812](https://cve.now/CVE-2026-62812.md): Windows DHCP Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2026-62797](https://cve.now/CVE-2026-62797.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62796](https://cve.now/CVE-2026-62796.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62795](https://cve.now/CVE-2026-62795.md): Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62798](https://cve.now/CVE-2026-62798.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62787](https://cve.now/CVE-2026-62787.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2026-62784](https://cve.now/CVE-2026-62784.md): Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62792](https://cve.now/CVE-2026-62792.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2026-62779](https://cve.now/CVE-2026-62779.md): Windows Schannel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62777](https://cve.now/CVE-2026-62777.md): Windows License Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62785](https://cve.now/CVE-2026-62785.md): Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-62774](https://cve.now/CVE-2026-62774.md): Windows Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62772](https://cve.now/CVE-2026-62772.md): Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62773](https://cve.now/CVE-2026-62773.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62766](https://cve.now/CVE-2026-62766.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62758](https://cve.now/CVE-2026-62758.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62755](https://cve.now/CVE-2026-62755.md): Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62783](https://cve.now/CVE-2026-62783.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62754](https://cve.now/CVE-2026-62754.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62750](https://cve.now/CVE-2026-62750.md): Windows HTTP Protocol Stack Tampering Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-62747](https://cve.now/CVE-2026-62747.md): Windows Device Association Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62745](https://cve.now/CVE-2026-62745.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62742](https://cve.now/CVE-2026-62742.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62739](https://cve.now/CVE-2026-62739.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62737](https://cve.now/CVE-2026-62737.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62735](https://cve.now/CVE-2026-62735.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62753](https://cve.now/CVE-2026-62753.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62740](https://cve.now/CVE-2026-62740.md): Windows Imaging Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office 365 for Mac · Microsoft Office for Andr… +1)
- [CVE-2026-62746](https://cve.now/CVE-2026-62746.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62729](https://cve.now/CVE-2026-62729.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62748](https://cve.now/CVE-2026-62748.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62724](https://cve.now/CVE-2026-62724.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62723](https://cve.now/CVE-2026-62723.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62722](https://cve.now/CVE-2026-62722.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62719](https://cve.now/CVE-2026-62719.md): Windows Message Queuing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62716](https://cve.now/CVE-2026-62716.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62715](https://cve.now/CVE-2026-62715.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2026-62718](https://cve.now/CVE-2026-62718.md): Windows DHCP Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2026-62712](https://cve.now/CVE-2026-62712.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62713](https://cve.now/CVE-2026-62713.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62707](https://cve.now/CVE-2026-62707.md): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62705](https://cve.now/CVE-2026-62705.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62703](https://cve.now/CVE-2026-62703.md): Windows DWM Core Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-62699](https://cve.now/CVE-2026-62699.md): Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2026-62702](https://cve.now/CVE-2026-62702.md): Windows Graphics Kernel Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2026-62696](https://cve.now/CVE-2026-62696.md): Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62693](https://cve.now/CVE-2026-62693.md): Windows MIDI Service Module Elevation of Privileges Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62690](https://cve.now/CVE-2026-62690.md): Windows Push Notifications Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-62688](https://cve.now/CVE-2026-62688.md): Windows MIDI Service Module Elevation of Privileges Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62695](https://cve.now/CVE-2026-62695.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61939](https://cve.now/CVE-2026-61939.md): Winlogon Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61936](https://cve.now/CVE-2026-61936.md): Windows Defender Firewall Service Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-61934](https://cve.now/CVE-2026-61934.md): Windows Bind Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61933](https://cve.now/CVE-2026-61933.md): Windows DWM Core Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-61932](https://cve.now/CVE-2026-61932.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-62692](https://cve.now/CVE-2026-62692.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61937](https://cve.now/CVE-2026-61937.md): Windows HTTP.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61930](https://cve.now/CVE-2026-61930.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61928](https://cve.now/CVE-2026-61928.md): Windows Hello Tampering Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-61927](https://cve.now/CVE-2026-61927.md): Windows Bind Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61925](https://cve.now/CVE-2026-61925.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61924](https://cve.now/CVE-2026-61924.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-61368](https://cve.now/CVE-2026-61368.md): Windows Hyper-V Information Disclosure Vulnerability (CVSS 5.0, Microsoft Windows)
- [CVE-2026-61366](https://cve.now/CVE-2026-61366.md): Windows Network Connection Broker Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61923](https://cve.now/CVE-2026-61923.md): Windows Display Enhancement Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61367](https://cve.now/CVE-2026-61367.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61356](https://cve.now/CVE-2026-61356.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61350](https://cve.now/CVE-2026-61350.md): Windows NTFS Information Disclosure Vulnerability (CVSS 4.6, Microsoft Windows)
- [CVE-2026-61348](https://cve.now/CVE-2026-61348.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61361](https://cve.now/CVE-2026-61361.md): Windows DHCP Client Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61347](https://cve.now/CVE-2026-61347.md): Windows Event Logging Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-61353](https://cve.now/CVE-2026-61353.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-61346](https://cve.now/CVE-2026-61346.md): Windows Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-61345](https://cve.now/CVE-2026-61345.md): Microsoft Remote Registry Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-59138](https://cve.now/CVE-2026-59138.md): Microsoft Remote Registry Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2026-59137](https://cve.now/CVE-2026-59137.md): Windows Event Logging Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-59136](https://cve.now/CVE-2026-59136.md): Microsoft COM for Windows Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-59134](https://cve.now/CVE-2026-59134.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2026-59135](https://cve.now/CVE-2026-59135.md): Microsoft Windows Search Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-59132](https://cve.now/CVE-2026-59132.md): Windows TCP/IP Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2026-59130](https://cve.now/CVE-2026-59130.md): AMD Zen Information Disclosure Vulnerability (CVSS 5.6, Microsoft Windows)
- [CVE-2026-59133](https://cve.now/CVE-2026-59133.md): Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft HPC Pack)
- [CVE-2026-59128](https://cve.now/CVE-2026-59128.md): Windows Encrypting File System (EFS) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2026-59127](https://cve.now/CVE-2026-59127.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-59124](https://cve.now/CVE-2026-59124.md): Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability (CVSS 9.8, Microsoft HPC Pack)
- [CVE-2026-47285](https://cve.now/CVE-2026-47285.md): Visual Studio Code Information Disclosure Vulnerability (CVSS 6.5, Microsoft Visual Studio Code)
- [CVE-2026-47299](https://cve.now/CVE-2026-47299.md): Azure Monitor Agent Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Azure Monitor Agent Linux Extension)
- [CVE-2026-59113](https://cve.now/CVE-2026-59113.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio Code)
- [CVE-2026-58612](https://cve.now/CVE-2026-58612.md): PowerShell Information Disclosure Vulnerability (CVSS 7.4, Microsoft PowerShell · powershell)
- [CVE-2026-49179](https://cve.now/CVE-2026-49179.md): Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2026-54984](https://cve.now/CVE-2026-54984.md): Windows Imaging Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-54113](https://cve.now/CVE-2026-54113.md): Remote Procedure Call Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2026-40375](https://cve.now/CVE-2026-40375.md): Microsoft Dynamics Business Central Information Disclosure Vulnerability (CVSS 6.5, Microsoft Dynamics NAV)
- [CVE-2026-63520](https://cve.now/CVE-2026-63520.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-63516](https://cve.now/CVE-2026-63516.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-63512](https://cve.now/CVE-2026-63512.md): Microsoft SharePoint Server Tampering Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-63514](https://cve.now/CVE-2026-63514.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-62837](https://cve.now/CVE-2026-62837.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-62827](https://cve.now/CVE-2026-62827.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2026-62829](https://cve.now/CVE-2026-62829.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Server)
- [CVE-2026-57105](https://cve.now/CVE-2026-57105.md): Microsoft Office SharePoint Spoofing Vulnerability (CVSS 8.0, Microsoft SharePoint Server)
- [CVE-2026-65768](https://cve.now/CVE-2026-65768.md): Microsoft Teams Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Teams for Android)
- [CVE-2026-58650](https://cve.now/CVE-2026-58650.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2026-56174](https://cve.now/CVE-2026-56174.md): Windows Narrator Braille Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2026-50472](https://cve.now/CVE-2026-50472.md): Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2026-69223](https://cve.now/CVE-2026-69223.md): Apache Allura: Server-side request forgery (CVSS 9.1, Apache Software Foundation Apache Allura)
- [CVE-2025-48506](https://cve.now/CVE-2025-48506.md): Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, (CVSS 7.3, AMD Vitis™ Unified Installer for FPGAs & Adaptive SoCs in W…)
- [CVE-2026-73088](https://cve.now/CVE-2026-73088.md): Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) (CVSS 7.5, browserslist)
- [CVE-2026-48434](https://cve.now/CVE-2026-48434.md): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2025-61970](https://cve.now/CVE-2025-61970.md): Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary cod (CVSS 7.3, AMD Vitis™ Embedded Single File Download (SFD) for Windows)
- [CVE-2026-48443](https://cve.now/CVE-2026-48443.md): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-47922](https://cve.now/CVE-2026-47922.md): CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 4.7, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-71390](https://cve.now/CVE-2026-71390.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 4.0, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48442](https://cve.now/CVE-2026-48442.md): CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 7.1, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48445](https://cve.now/CVE-2026-48445.md): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48387](https://cve.now/CVE-2026-48387.md): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48436](https://cve.now/CVE-2026-48436.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 6.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48438](https://cve.now/CVE-2026-48438.md): CAI Content Credentials | NULL Pointer Dereference (CWE-476) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48446](https://cve.now/CVE-2026-48446.md): CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48444](https://cve.now/CVE-2026-48444.md): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48435](https://cve.now/CVE-2026-48435.md): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48439](https://cve.now/CVE-2026-48439.md): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-48437](https://cve.now/CVE-2026-48437.md): CAI Content Credentials | Improper Certificate Validation (CWE-295) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-71389](https://cve.now/CVE-2026-71389.md): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1)
- [CVE-2026-12571](https://cve.now/CVE-2026-12571.md): Authentication Bypass Leading to Account Takeover (CVSS 9.8, zohocorp manageengine\_ddi\_central)
- [CVE-2026-73087](https://cve.now/CVE-2026-73087.md): Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher (CVSS 2.3, amir20 dozzle · github.com/amir20/dozzle)
- [CVE-2025-0041](https://cve.now/CVE-2025-0041.md): Uncontrolled search paths in the Vitis™ Embedded Single File Download (SFD) for local Windows installation could allow a low-privileged user (CVSS 7.3, AMD Vitis™ Embedded Single File Download (SFD) for Windows)
- [CVE-2026-43606](https://cve.now/CVE-2026-43606.md): Observable Timing Discrepancy in the AMD Vitis Libraries ECDSA secp256k1 component could allow attackers with local access to potentially pe (CVSS 7.7, AMD Vitis™ Libraries - Security Module · AMD Vitis™ Unifie…)
- [CVE-2026-73086](https://cve.now/CVE-2026-73086.md): nanoid: Integer Overflow or Wraparound (CVSS 7.4, ai nanoid · nanoid)
- [CVE-2026-73085](https://cve.now/CVE-2026-73085.md): Audiobookshelf: Refresh Token Accepted on Resource Endpoints (CVSS 5.3, advplyr audiobookshelf)
- [CVE-2026-73084](https://cve.now/CVE-2026-73084.md): Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint (CVSS 6.1, activepieces)
- [CVE-2026-73083](https://cve.now/CVE-2026-73083.md): Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading (CVSS 7.6, activepieces)
- [CVE-2026-71387](https://cve.now/CVE-2026-71387.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 8.8, Adobe ColdFusion)
- [CVE-2026-48385](https://cve.now/CVE-2026-48385.md): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 7.7, Adobe ColdFusion)
- [CVE-2026-71383](https://cve.now/CVE-2026-71383.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 7.3, Adobe ColdFusion)
- [CVE-2026-21279](https://cve.now/CVE-2026-21279.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 8.2, Adobe ColdFusion)
- [CVE-2026-48384](https://cve.now/CVE-2026-48384.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 4.9, Adobe ColdFusion)
- [CVE-2026-48375](https://cve.now/CVE-2026-48375.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 6.5, Adobe ColdFusion)
- [CVE-2026-21269](https://cve.now/CVE-2026-21269.md): ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.6, Adobe ColdFusion)
- [CVE-2026-48376](https://cve.now/CVE-2026-48376.md): ColdFusion | Improper Encoding or Escaping of Output (CWE-116) (CVSS 5.4, Adobe ColdFusion)
- [CVE-2026-48440](https://cve.now/CVE-2026-48440.md): ColdFusion | Heap-based Buffer Overflow (CWE-122) (CVSS 8.1, Adobe ColdFusion)
- [CVE-2026-34635](https://cve.now/CVE-2026-34635.md): ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321) (CVSS 8.4, Adobe ColdFusion)
- [CVE-2026-48386](https://cve.now/CVE-2026-48386.md): ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327) (CVSS 7.5, Adobe ColdFusion)
- [CVE-2026-48362](https://cve.now/CVE-2026-48362.md): ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-71386](https://cve.now/CVE-2026-71386.md): ColdFusion | Cross-site Scripting (XSS) (CWE-79) (CVSS 8.8, Adobe ColdFusion)
- [CVE-2026-71384](https://cve.now/CVE-2026-71384.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.6, Adobe ColdFusion)
- [CVE-2026-25652](https://cve.now/CVE-2026-25652.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 7.8, Adobe ColdFusion)
- [CVE-2026-21273](https://cve.now/CVE-2026-21273.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 8.7, Adobe ColdFusion)
- [CVE-2026-73082](https://cve.now/CVE-2026-73082.md): Activepieces: Server-side request forgery in MCP tool validation endpoint (CVSS 5.3, activepieces)
- [CVE-2026-39452](https://cve.now/CVE-2026-39452.md): Protection mechanism failure for some Intel(R) Transfer Learning Tool before version v0.7 within Ring 3: User Applications may allow an esca (CVSS 6.3, Intel(R) Transfer Learning Tool)
- [CVE-2025-35987](https://cve.now/CVE-2025-35987.md): Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0: Kern (CVSS 4.3, Intel(R) Software Guard Extensions Data Center Attestation…)
- [CVE-2025-35973](https://cve.now/CVE-2025-35973.md): Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of priv (CVSS 4.5, Intel(R) Processors)
- [CVE-2026-35502](https://cve.now/CVE-2026-35502.md): Deserialization of untrusted data for some Intel(R) Extension for PyTorch before version 2.8.0 within Ring 3: User Applications may allow an (CVSS 4.6, Intel(R) Extension for PyTorch)
- [CVE-2026-34175](https://cve.now/CVE-2026-34175.md): Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may al (CVSS 5.4, Hardware-Aware-Automated-MachineLearning NA)
- [CVE-2026-32791](https://cve.now/CVE-2026-32791.md): Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Application (CVSS 5.4, Intel(R) Performance Counter Monitor (Intel(R) PCM))
- [CVE-2026-32788](https://cve.now/CVE-2026-32788.md): Uncontrolled search path for some Approximate Bayesian Inference Framework before version on commit #484c949 within Ring 3: User Application (CVSS 5.4, Approximate Bayesian Inference Framework)
- [CVE-2026-32677](https://cve.now/CVE-2026-32677.md): Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege. (CVSS 5.4, gaudi-container-runtime)
- [CVE-2026-73081](https://cve.now/CVE-2026-73081.md): Activepieces: Remote Code Execution via Command Injection in Code Step Name (CVSS 8.7, activepieces)
- [CVE-2025-31938](https://cve.now/CVE-2025-31938.md): Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an (CVSS 4.3, Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX ma…)
- [CVE-2025-31936](https://cve.now/CVE-2025-31936.md): Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may a (CVSS 7.0, Intel(R) Xeon(R) 6 processors when using Intel(R) TDX)
- [CVE-2025-31356](https://cve.now/CVE-2025-31356.md): Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow (CVSS 5.6, Intel(R) Trust Domain Extensions (Intel(R) TDX))
- [CVE-2026-28757](https://cve.now/CVE-2026-28757.md): Protection mechanism failure for some Intel(R) Workload Services Framework software within Ring 3: User Applications may allow an escalation (CVSS 5.4, Intel(R) Workload Services Framework software)
- [CVE-2026-28729](https://cve.now/CVE-2026-28729.md): Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader may allow an information disclosure. (CVSS 2.4, Intel(R) Slim Bootloader may allow an information disclosur…)
- [CVE-2026-28707](https://cve.now/CVE-2026-28707.md): Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. (CVSS 5.4, LLM-on-Ray)
- [CVE-2026-28700](https://cve.now/CVE-2026-28700.md): Uncontrolled search path for some EquiTriton before version f5ddbb5 within Ring 3: User Applications may allow an escalation of privilege. (CVSS 5.4, EquiTriton)
- [CVE-2026-27765](https://cve.now/CVE-2026-27765.md): Improper input validation for some vLLM Hardware Plugin for Intel(R) Gaudi(R) software before version 0.16.0 within Ring 3: User Application (CVSS 6.8, vLLM Hardware Plugin for Intel(R) Gaudi(R) software)
- [CVE-2026-25194](https://cve.now/CVE-2026-25194.md): Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. (CVSS 1.8, Intel(R) Slim Bootloader may allow a denial of service. Sys…)
- [CVE-2026-24911](https://cve.now/CVE-2026-24911.md): Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-24693](https://cve.now/CVE-2026-24693.md): Protection mechanism failure for some Intel(R) oneCCL Bindings for PyTorch before version v2.8.0 within Ring 3: User Applications may allow (CVSS 5.4, Intel(R) oneCCL Bindings for PyTorch)
- [CVE-2026-24099](https://cve.now/CVE-2026-24099.md): Use after free for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. (CVSS 5.9, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-22887](https://cve.now/CVE-2026-22887.md): Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-21400](https://cve.now/CVE-2026-21400.md): Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escal (CVSS 5.4, Intel(R) AI Reference Models)
- [CVE-2026-21399](https://cve.now/CVE-2026-21399.md): Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0 (CVSS 6.9, Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) lib…)
- [CVE-2026-21387](https://cve.now/CVE-2026-21387.md): Protection mechanism failure for some Intel(R) LLM Library for PyTorch within Ring 3: User Applications may allow an escalation of privilege (CVSS 5.4, Intel(R) LLM Library for PyTorch)
- [CVE-2026-20913](https://cve.now/CVE-2026-20913.md): Improper input validation for some Intel(R) Neural Compressor software before version v3.7 within Ring 3: User Applications may allow an esc (CVSS 4.8, Intel(R) Neural Compressor software)
- [CVE-2026-20908](https://cve.now/CVE-2026-20908.md): Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a (CVSS 5.8, Intel(R) NPU Driver for Windows)
- [CVE-2026-20906](https://cve.now/CVE-2026-20906.md): Protection mechanism failure for some Intel(R) Neural Compressor software before version v3.6 within Ring 3: User Applications may allow an (CVSS 5.4, Intel(R) Neural Compressor software)
- [CVE-2026-20903](https://cve.now/CVE-2026-20903.md): Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation (CVSS 5.4, Intel(R) AI Containers)
- [CVE-2026-20898](https://cve.now/CVE-2026-20898.md): Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalati (CVSS 8.5, in Alias Checking Trusted Module for some Intel(R) Xeon(R)…)
- [CVE-2026-20891](https://cve.now/CVE-2026-20891.md): Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of (CVSS 6.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20890](https://cve.now/CVE-2026-20890.md): Improper privilege management for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Privileged Process may allow an esc (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20886](https://cve.now/CVE-2026-20886.md): Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. (CVSS 6.9, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20885](https://cve.now/CVE-2026-20885.md): Improper authentication in the Intel(R) TDX module for some Intel(R) platforms within Ring 0: Trust Domain may allow an information disclosu (CVSS 7.0, Intel(R) platforms)
- [CVE-2026-20878](https://cve.now/CVE-2026-20878.md): Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of ser (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20799](https://cve.now/CVE-2026-20799.md): Untrusted search path for some Battery Life Diagnostic Tool software before version 2.9.0 within Ring 3: User Applications may allow an esca (CVSS 5.4, Battery Life Diagnostic Tool software)
- [CVE-2026-20795](https://cve.now/CVE-2026-20795.md): Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20789](https://cve.now/CVE-2026-20789.md): Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of (CVSS 8.4, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20787](https://cve.now/CVE-2026-20787.md): Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of ser (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20786](https://cve.now/CVE-2026-20786.md): Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. (CVSS 6.9, Intel(R) NPU Driver)
- [CVE-2026-20783](https://cve.now/CVE-2026-20783.md): Improper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of s (CVSS 6.9, Intel(R) NPU Driver)
- [CVE-2026-20780](https://cve.now/CVE-2026-20780.md): Uncontrolled resource consumption for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a deni (CVSS 6.9, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20778](https://cve.now/CVE-2026-20778.md): Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. (CVSS 7.0, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20776](https://cve.now/CVE-2026-20776.md): Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software)
- [CVE-2026-20775](https://cve.now/CVE-2026-20775.md): Uncaught exception for some Intel(R) TDX modules within Ring 0: Trust Domain may allow a denial of service. (CVSS 6.8, Intel(R) TDX modules)
- [CVE-2026-20770](https://cve.now/CVE-2026-20770.md): Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applicati (CVSS 5.4, Cluster Management Toolkit for Kubernetes software)
- [CVE-2026-20769](https://cve.now/CVE-2026-20769.md): Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. (CVSS 6.9, Intel(R) NPU Driver)
- [CVE-2026-20765](https://cve.now/CVE-2026-20765.md): Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of p (CVSS 4.6, Intel(R) TDX Guest software)
- [CVE-2026-20763](https://cve.now/CVE-2026-20763.md): Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of (CVSS 4.6, Intel(R) TDX Guest software)
- [CVE-2026-20760](https://cve.now/CVE-2026-20760.md): Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may al (CVSS 6.8, Intel(R) Processors)
- [CVE-2026-20755](https://cve.now/CVE-2026-20755.md): Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of privilege. (CVSS 5.4, LLM Scaler software)
- [CVE-2026-20752](https://cve.now/CVE-2026-20752.md): Improper authentication for some Intel(R) PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information disclosure. (CVSS 6.7, Intel(R) PROSet/Wireless WiFi Software)
- [CVE-2026-20749](https://cve.now/CVE-2026-20749.md): Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow an escalation of privilege. (CVSS 7.2, Intel(R) PROSet/Wireless WiFi Software)
- [CVE-2026-20747](https://cve.now/CVE-2026-20747.md): Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software)
- [CVE-2026-20745](https://cve.now/CVE-2026-20745.md): Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20741](https://cve.now/CVE-2026-20741.md): Improper access control for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow a denial of service. (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software)
- [CVE-2026-20739](https://cve.now/CVE-2026-20739.md): Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of se (CVSS 7.1, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20737](https://cve.now/CVE-2026-20737.md): Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device (CVSS 6.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20734](https://cve.now/CVE-2026-20734.md): Improper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(R) Standard Manageabi (CVSS 5.6, Intel(R) Active Management Technology (Intel(R) AMT), and s…)
- [CVE-2026-20731](https://cve.now/CVE-2026-20731.md): Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. (CVSS 6.9, Intel(R) NPU Driver)
- [CVE-2026-20728](https://cve.now/CVE-2026-20728.md): Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may a (CVSS 5.4, Intel Extension for TensorFlow software)
- [CVE-2026-20727](https://cve.now/CVE-2026-20727.md): Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. (CVSS 8.3, Intel(R) PROSet/Wireless WiFi Software for Windows)
- [CVE-2026-20716](https://cve.now/CVE-2026-20716.md): Improper access control for some Intel(R) Processors within Ring 3: User Applications may allow an escalation of privilege. (CVSS 7.2, Intel(R) Processors)
- [CVE-2026-20715](https://cve.now/CVE-2026-20715.md): Improper input validation in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT) and some Intel(R) Standard Manageab (CVSS 8.2, Intel(R) Active Management Technology (Intel(R) AMT) and so…)
- [CVE-2026-20713](https://cve.now/CVE-2026-20713.md): Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. (CVSS 4.5, Intel(R) Xeon(R) processors may allow an escalation of priv…)
- [CVE-2026-20708](https://cve.now/CVE-2026-20708.md): Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an info (CVSS 5.9, Intel(R) AMT and Intel(R) Standard Manageability may allow…)
- [CVE-2026-20707](https://cve.now/CVE-2026-20707.md): Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring 3: unprivileged software may allow (CVSS 6.8, 3rd Gen Intel(R) Xeon(R) Scalable Processors)
- [CVE-2026-20705](https://cve.now/CVE-2026-20705.md): Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow inform (CVSS 6.8, Intel(R) platform)
- [CVE-2026-20702](https://cve.now/CVE-2026-20702.md): Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. (CVSS 8.9, Intel(R) Data Center Attestation Primitives (Intel(R) DCAP)…)
- [CVE-2026-47704](https://cve.now/CVE-2026-47704.md): TypeBot vulnerable to cross-typebot webhook resume via unchecked \`resultId\` lineage allows unauthorized control of another bot's waiting session (CVSS 7.1, baptisteArno typebot.io)
- [CVE-2026-48483](https://cve.now/CVE-2026-48483.md): TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server (CVSS 5.4, baptisteArno typebot.io)
- [CVE-2026-18247](https://cve.now/CVE-2026-18247.md): DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals (CVSS 5.3, BlackBerry AtHoc IWS)
- [CVE-2026-53416](https://cve.now/CVE-2026-53416.md): Zoom VDI - Path Traversal (CVSS 7.1, Zoom Communications Zoom VDI)
- [CVE-2026-53415](https://cve.now/CVE-2026-53415.md): Zoom Clients - Use After Free (CVSS 8.3, Zoom Communications Zoom Clients)
- [CVE-2026-53414](https://cve.now/CVE-2026-53414.md): Zoom Clients - Buffer Over-read (CVSS 6.5, Zoom Communications Zoom Clients)
- [CVE-2026-48495](https://cve.now/CVE-2026-48495.md): TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots (CVSS 7.1, baptisteArno typebot.io)
- [CVE-2026-73080](https://cve.now/CVE-2026-73080.md): SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle (CVSS 9.3, seaweedfs · github.com/seaweedfs/seaweedfs)
- [CVE-2026-67180](https://cve.now/CVE-2026-67180.md): Google Turbinia arbitrary command execution (CVSS 8.4, Google Turbinia)
- [CVE-2026-67179](https://cve.now/CVE-2026-67179.md): Genkit improper host header validation (CVSS 7.8, genkit-ai genkit)
- [CVE-2026-53413](https://cve.now/CVE-2026-53413.md): Zoom Clients - Buffer Over-write (CVSS 8.3, Zoom Communications Zoom Clients)
- [CVE-2026-48766](https://cve.now/CVE-2026-48766.md): TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl (CVSS 7.6, baptisteArno typebot.io)
- [CVE-2026-73079](https://cve.now/CVE-2026-73079.md): Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials (CVSS 8.5, Wei-Shaw sub2api)
- [CVE-2026-56721](https://cve.now/CVE-2026-56721.md): CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController (CVSS 8.7, owen2345 CamaleonCMS)
- [CVE-2026-42142](https://cve.now/CVE-2026-42142.md): TypeBot has Authorization Bypass in Google Sheets \`getSheets\` Endpoint that Allows Cross-Workspace Credential Access (CVSS 7.1, baptisteArno typebot.io)
- [CVE-2026-73078](https://cve.now/CVE-2026-73078.md): Vim: Arbitrary Code Execution via Netrw Menu Construction (CVSS 8.6, vim)
- [CVE-2026-73077](https://cve.now/CVE-2026-73077.md): Vim: Arbitrary Code Execution via Shell Keyword Lookup (CVSS 8.4, vim)
- [CVE-2026-56720](https://cve.now/CVE-2026-56720.md): CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action (CVSS 5.3, owen2345 CamaleonCMS)
- [CVE-2026-73076](https://cve.now/CVE-2026-73076.md): Vim: Arbitrary Command Execution via Malicious \`.VimballRecord\` Entry Replay in \`vimball.vim\` (CVSS 8.4, vim)
- [CVE-2025-31114](https://cve.now/CVE-2025-31114.md): Fooocus webui vulnerable to Remote Code Execution (CVSS 9.3, lllyasviel Fooocus)
- [CVE-2026-73075](https://cve.now/CVE-2026-73075.md): Vim: Out-of-bounds Access in Popup Opacity Handling (CVSS 4.6, vim)
- [CVE-2026-73074](https://cve.now/CVE-2026-73074.md): Vim: Heap Buffer Overflow in Text Property Handling (CVSS 7.1, vim)
- [CVE-2026-19078](https://cve.now/CVE-2026-19078.md): Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter. (CVSS 4.3, Red Hat OpenShift Container Platform)
- [CVE-2026-14180](https://cve.now/CVE-2026-14180.md): Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap (CVSS 5.3, Red Hat JBoss Enterprise Application Platform 8.1.8.GA ·… +7)
- [CVE-2026-73072](https://cve.now/CVE-2026-73072.md): Vim: Heap Buffer Overflow when Loading a Spell File (CVSS 8.5, vim)
- [CVE-2026-73071](https://cve.now/CVE-2026-73071.md): Vim: Use-after-free in JSON Decoding (CVSS 3.3, vim)
- [CVE-2026-6726](https://cve.now/CVE-2026-6726.md): An information leakage vulnerability in the TCG TPM 2.0 reference code. (CVSS 7.9, Trusted Computing Group TPM2.0)
- [CVE-2026-6727](https://cve.now/CVE-2026-6727.md): CVE-2026-6727 (CVSS 5.9, Trusted Computing Group TPM2.0)
- [CVE-2026-73070](https://cve.now/CVE-2026-73070.md): Vim: Stack Buffer Overflow in the Vim Socket Server (CVSS 6.8, vim)
- [CVE-2026-73069](https://cve.now/CVE-2026-73069.md): Twenty: SQL Injection in the \`searchVector\` Field Settings Allows Arbitrary PostgreSQL Execution (CVSS 9.1, twentyhq twenty)
- [CVE-2026-19546](https://cve.now/CVE-2026-19546.md): Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute (CVSS 8.8, Red Hat Enterprise Linux)
- [CVE-2026-9214](https://cve.now/CVE-2026-9214.md): Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device. (CVSS 4.3, NETGEAR R7000)
- [CVE-2026-11736](https://cve.now/CVE-2026-11736.md): Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers (CVSS 1.9, NETGEAR RAX20 · NETGEAR RAX35v2 +17)
- [CVE-2026-11735](https://cve.now/CVE-2026-11735.md): Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models (CVSS 1.9, NETGEAR R7000 · NETGEAR RAX20 +18)
- [CVE-2026-11738](https://cve.now/CVE-2026-11738.md): Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device. (CVSS 4.3, NETGEAR R7000 · NETGEAR RAXE500 +1)
- [CVE-2026-11739](https://cve.now/CVE-2026-11739.md): Command injection vulnerability in some NETGEAR Nighthawk devices (CVSS 4.9, NETGEAR MR60 · NETGEAR MR70 +25)
- [CVE-2026-11734](https://cve.now/CVE-2026-11734.md): Device administrator can interrupt the normal operation of some NETGEAR Nighthawk devices. (CVSS 1.1, NETGEAR MR70 · NETGEAR MR90 +13)
- [CVE-2026-11733](https://cve.now/CVE-2026-11733.md): Buffer overflow vulnerability in some NETGEAR Nighthawk routers (CVSS 1.1, NETGEAR RAX41 · NETGEAR RAX41v2 +9)
- [CVE-2026-11737](https://cve.now/CVE-2026-11737.md): Some NETGEAR Nighthawk devices allow administrators to tamper with the device (CVSS 4.3, NETGEAR RAX20 · NETGEAR RAX41 +11)
- [CVE-2026-11814](https://cve.now/CVE-2026-11814.md): Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers (CVSS 4.9, NETGEAR BE9300 · NETGEAR MR60 +24)
- [CVE-2026-18639](https://cve.now/CVE-2026-18639.md): Velociraptor OIDC Authenticator susceptible to email spoofing (CVSS 7.3, Rapid7 Velociraptor)
- [CVE-2026-73068](https://cve.now/CVE-2026-73068.md): ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables (CVSS 5.9, ToolJet)
- [CVE-2026-18638](https://cve.now/CVE-2026-18638.md): Velociraptor server crash via the SetPassword API (CVSS 6.5, Rapid7 Velociraptor)
- [CVE-2026-18640](https://cve.now/CVE-2026-18640.md): Velociraptor directory traversal via the NewNotebook API (CVSS 7.1, Rapid7 Velociraptor)
- [CVE-2026-18860](https://cve.now/CVE-2026-18860.md): Velociraptor incorrect Org deletion permissions check (CVSS 8.7, Rapid7 Velociraptor)
- [CVE-2026-73067](https://cve.now/CVE-2026-73067.md): Tesseract: Heap OOB read in the DAWG loader (CVSS 6.7, tesseract-ocr tesseract)
- [CVE-2026-73066](https://cve.now/CVE-2026-73066.md): Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata (CVSS 6.8, tesseract-ocr tesseract)
- [CVE-2026-17535](https://cve.now/CVE-2026-17535.md): Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes (CVSS 6.2, Rapid7 Velociraptor)
- [CVE-2026-72925](https://cve.now/CVE-2026-72925.md): SWC HTML minifier may allow script element breakout when minifying embedded JSON (CVSS 6.1, swc-project swc · @swc html +3)
- [CVE-2026-18636](https://cve.now/CVE-2026-18636.md): Velociraptor VFSGetBuffer API path deny list bypass (CVSS 6.8, Rapid7 Velociraptor)
- [CVE-2026-72922](https://cve.now/CVE-2026-72922.md): AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification (CVSS 8.2, Significant-Gravitas AutoGPT)
- [CVE-2026-72921](https://cve.now/CVE-2026-72921.md): SeaweedFS: Filer JWT allowed\_prefixes literal prefix match allows cross-tenant access to sibling paths (CVSS 8.1, seaweedfs · github.com/seaweedfs/seaweedfs)
- [CVE-2026-18129](https://cve.now/CVE-2026-18129.md): Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticat (CVSS 8.1, Ivanti Endpoint Manager)
- [CVE-2026-18127](https://cve.now/CVE-2026-18127.md): External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full wr (CVSS 7.7, Ivanti Endpoint Manager)
- [CVE-2026-72920](https://cve.now/CVE-2026-72920.md): SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control (CVSS 9.8, seaweedfs · github.com/seaweedfs/seaweedfs)
- [CVE-2026-17061](https://cve.now/CVE-2026-17061.md): Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026 (CVSS 10.0, Dassault Systèmes SIMULIA Execution Engine)
- [CVE-2026-18125](https://cve.now/CVE-2026-18125.md): An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an a (CVSS 7.5, Ivanti Endpoint Manager)
- [CVE-2026-18635](https://cve.now/CVE-2026-18635.md): Velociraptor query plugin allows impersonation in other orgs (CVSS 7.2, Rapid7 Velociraptor)
- [CVE-2026-47702](https://cve.now/CVE-2026-47702.md): TypeBot API tokens stored in plaintext (CVSS 9.1, baptisteArno typebot.io)
- [CVE-2026-73210](https://cve.now/CVE-2026-73210.md): Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture (CVSS 5.1, Lookyloo PlaywrightCapture)
- [CVE-2026-46670](https://cve.now/CVE-2026-46670.md): YesWiki: Unauthenticated SQL Injection (CVSS 9.8, yeswiki · yeswiki/yeswiki)
- [CVE-2026-19539](https://cve.now/CVE-2026-19539.md): IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion (CVSS 8.6, Roskus Prospero Flow CRM)
- [CVE-2026-48056](https://cve.now/CVE-2026-48056.md): Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler (CVSS 10.0, truelockmc streambert)
- [CVE-2026-19434](https://cve.now/CVE-2026-19434.md): Stored Cross-site Scripting in Pentestify finding severity field (CVSS 5.1, maalfer Pentestify)
- [CVE-2026-48046](https://cve.now/CVE-2026-48046.md): Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler (CVSS 9.3, truelockmc streambert)
- [CVE-2026-18972](https://cve.now/CVE-2026-18972.md): Velociraptor authenticated identity-spoofing vulnerability (CVSS 9.6, Rapid7 Velociraptor)
- [CVE-2026-69109](https://cve.now/CVE-2026-69109.md): A vulnerability has been identified in Siemens License Server (SLS) (All versions \< V5.3). (CVSS 7.5, Siemens License Server)
- [CVE-2026-69108](https://cve.now/CVE-2026-69108.md): A vulnerability has been identified in Siemens License Server (SLS) (All versions \< V5.1). (CVSS 6.0, Siemens License Server)
- [CVE-2026-64629](https://cve.now/CVE-2026-64629.md): A vulnerability has been identified in Parasolid V38.0 (All versions \< V38.0.235), Parasolid V38.1 (All versions \< V38.1.230). (CVSS 7.8, Siemens Parasolid)
- [CVE-2026-59701](https://cve.now/CVE-2026-59701.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2606.0001). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2026-59700](https://cve.now/CVE-2026-59700.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2606.0001). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2026-59693](https://cve.now/CVE-2026-59693.md): A vulnerability has been identified in Desigo DXR2 (All versions \< V01.21.233.16-7862), Desigo PXC3 (All versions \< V01.21.233.16-7862), Des (CVSS 4.3, Siemens Desigo DXR2 · Siemens Desigo PXC3 +4)
- [CVE-2026-59086](https://cve.now/CVE-2026-59086.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2606), Simcenter Nastran (All versions \< V2606). (CVSS 7.8, Siemens Simcenter Femap · Siemens Simcenter Nastran)
- [CVE-2026-58115](https://cve.now/CVE-2026-58115.md): A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions \< V4.3.4.1 running Industrial OS with Nod (CVSS 10.0, Siemens SIMATIC IoT2050 Advanced)
- [CVE-2026-57263](https://cve.now/CVE-2026-57263.md): A vulnerability has been identified in LOGO! Soft Comfort (All versions \< V9). (CVSS 6.8, Siemens LOGO! Soft Comfort)
- [CVE-2026-57262](https://cve.now/CVE-2026-57262.md): A vulnerability has been identified in LOGO! Soft Comfort (All versions \< V9). (CVSS 6.8, Siemens LOGO! Soft Comfort)
- [CVE-2026-50064](https://cve.now/CVE-2026-50064.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-50063](https://cve.now/CVE-2026-50063.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-50062](https://cve.now/CVE-2026-50062.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-50061](https://cve.now/CVE-2026-50061.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-50060](https://cve.now/CVE-2026-50060.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-50059](https://cve.now/CVE-2026-50059.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-50058](https://cve.now/CVE-2026-50058.md): A vulnerability has been identified in Solid Edge SE2025 (All versions \< V225.0 Update 15), Solid Edge SE2026 (All versions \< V226.0 Update (CVSS 7.8, Siemens Solid Edge SE2025 · Siemens Solid Edge SE2026)
- [CVE-2026-72785](https://cve.now/CVE-2026-72785.md): Craft CMS before 5.10.6 Authorization Bypass via structures/move-element (CVSS 9.3, craftcms cms · craftcms/cms)
- [CVE-2026-72784](https://cve.now/CVE-2026-72784.md): Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation (CVSS 6.9, craftcms cms)
- [CVE-2026-72783](https://cve.now/CVE-2026-72783.md): Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained (CVSS 6.9, craftcms cms · craftcms/cms)
- [CVE-2026-72782](https://cve.now/CVE-2026-72782.md): Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-72781](https://cve.now/CVE-2026-72781.md): Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-72780](https://cve.now/CVE-2026-72780.md): Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-72779](https://cve.now/CVE-2026-72779.md): Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-72778](https://cve.now/CVE-2026-72778.md): Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-72775](https://cve.now/CVE-2026-72775.md): n8n before 1.123.67 SQL Injection via PostgresTrigger Node (CVSS 5.8, n8n-io n8n · n8n)
- [CVE-2026-72774](https://cve.now/CVE-2026-72774.md): n8n before 1.123.67 Authentication Bypass via HTTP Request Node (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-72773](https://cve.now/CVE-2026-72773.md): n8n before 2.32.1 Path Traversal via computer-use search\_files (CVSS 4.9, n8n-io n8n · n8n)
- [CVE-2026-72772](https://cve.now/CVE-2026-72772.md): n8n before 2.32.1 Authentication Bypass via Token Exchange (CVSS 8.9, n8n-io n8n · n8n)
- [CVE-2026-72771](https://cve.now/CVE-2026-72771.md): n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-72770](https://cve.now/CVE-2026-72770.md): n8n before 1.123.67 Path Traversal via Git Node Operations (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-72769](https://cve.now/CVE-2026-72769.md): n8n before 1.123.67 Prototype Pollution via VM Expression Engine (CVSS 6.1, n8n-io n8n · n8n)
- [CVE-2026-72768](https://cve.now/CVE-2026-72768.md): n8n before 2.32.1 SSRF Protection Bypass via MCP Client (CVSS 6.4, n8n-io n8n · n8n)
- [CVE-2026-72767](https://cve.now/CVE-2026-72767.md): n8n before 1.123.67 Remote Code Execution via Git node (CVSS 8.7, n8n-io n8n · n8n)
- [CVE-2026-72766](https://cve.now/CVE-2026-72766.md): n8n before 1.123.67 Arbitrary File Read via Send Email Node (CVSS 8.2, n8n-io n8n · n8n)
- [CVE-2026-72765](https://cve.now/CVE-2026-72765.md): n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape (CVSS 8.7, n8n-io n8n · n8n)
- [CVE-2026-72764](https://cve.now/CVE-2026-72764.md): n8n before 1.123.67 Module Cache Poisoning via Code Node (CVSS 5.8, n8n-io n8n · n8n)
- [CVE-2026-72763](https://cve.now/CVE-2026-72763.md): n8n before 1.123.67 Credential Exfiltration via Sub-Workflow (CVSS 7.2, n8n-io n8n · n8n)
- [CVE-2026-72762](https://cve.now/CVE-2026-72762.md): n8n before 1.123.67 Arbitrary File Write via Edit Image Node (CVSS 7.7, n8n-io n8n · n8n)
- [CVE-2026-72750](https://cve.now/CVE-2026-72750.md): n8n before 1.123.67 SQL Injection via executeQuery Operation (CVSS 5.3, n8n-io n8n · n8n)
- [CVE-2026-72749](https://cve.now/CVE-2026-72749.md): n8n before 1.123.67 Prototype Pollution via Edit Fields (CVSS 7.1, n8n-io n8n · n8n)
- [CVE-2026-72748](https://cve.now/CVE-2026-72748.md): AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-72747](https://cve.now/CVE-2026-72747.md): AVideo Stored Cross-Site Scripting via Unauthenticated Registration (CVSS 5.1, WWBN AVideo)
- [CVE-2026-72744](https://cve.now/CVE-2026-72744.md): Nuxt before 4.5.1 Information Disclosure via Chrome DevTools (CVSS 6.9, nuxt)
- [CVE-2026-50236](https://cve.now/CVE-2026-50236.md): Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console (CVSS 7.4, Red Hat OpenShift Container Platform)
- [CVE-2026-50237](https://cve.now/CVE-2026-50237.md): Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console (CVSS 7.4, Red Hat OpenShift Container Platform)
- [CVE-2026-72610](https://cve.now/CVE-2026-72610.md): Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation (CVSS 4.3, Koha Community Koha)
- [CVE-2026-72609](https://cve.now/CVE-2026-72609.md): Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl (CVSS 7.1, Koha Community Koha)
- [CVE-2026-72608](https://cve.now/CVE-2026-72608.md): Koha Community Koha - Stored SQL Injection via Patron Card Layout image\_name (CVSS 6.5, Koha Community Koha)
- [CVE-2026-72607](https://cve.now/CVE-2026-72607.md): Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age (CVSS 7.1, Koha Community Koha)
- [CVE-2026-72606](https://cve.now/CVE-2026-72606.md): Pinry Pinry - Server-Side Request Forgery (CVSS 7.5, Pinry)
- [CVE-2026-72605](https://cve.now/CVE-2026-72605.md): Swing Music Swing Music - Missing Authentication (CVSS 7.5, Swing Music)
- [CVE-2026-72604](https://cve.now/CVE-2026-72604.md): Intelliants Subrion CMS - Path Traversal (CVSS 6.5, Intelliants Subrion CMS)
- [CVE-2026-72603](https://cve.now/CVE-2026-72603.md): wg-easy wg-easy - OS Command Injection (CVSS 9.9, wg-easy)
- [CVE-2026-72602](https://cve.now/CVE-2026-72602.md): AsyncFuncAI deepwiki-open - Path Traversal (CVSS 7.5, AsyncFuncAI deepwiki-open)
- [CVE-2026-72601](https://cve.now/CVE-2026-72601.md): CSZ CMS CSZ CMS - Broken Access Control (CVSS 7.5, CSZ CMS)
- [CVE-2026-72600](https://cve.now/CVE-2026-72600.md): Idurar IDURAR ERP CRM - Broken Access Control (CVSS 7.5, IDURAR ERP CRM)
- [CVE-2026-72599](https://cve.now/CVE-2026-72599.md): e107 e107 - SQL Injection (CVSS 9.8, e107)
- [CVE-2026-72598](https://cve.now/CVE-2026-72598.md): Apioo Fusio - Server-Side Request Forgery (CVSS 6.5, Apioo Fusio)
- [CVE-2026-72597](https://cve.now/CVE-2026-72597.md): Friendica Friendica - Server-Side Request Forgery (CVSS 6.5, Friendica)
- [CVE-2026-72596](https://cve.now/CVE-2026-72596.md): Ghost Foundation Ghost - Broken Access Control (CVSS 8.1, Ghost Foundation Ghost)
- [CVE-2026-72595](https://cve.now/CVE-2026-72595.md): BadChoice Handesk - Broken Access Control (CVSS 8.1, BadChoice Handesk)
- [CVE-2026-72563](https://cve.now/CVE-2026-72563.md): BadChoice Handesk - Broken Access Control (CVSS 8.1, BadChoice Handesk)
- [CVE-2026-72562](https://cve.now/CVE-2026-72562.md): Pimcore pimcore admin-ui-classic-bundle - SQL Injection (CVSS 8.8, pimcore admin-ui-classic-bundle)
- [CVE-2026-72561](https://cve.now/CVE-2026-72561.md): Peppermint Lab Peppermint - Broken Access Control (CVSS 8.8, Peppermint Lab Peppermint)
- [CVE-2026-72560](https://cve.now/CVE-2026-72560.md): HumanSignal Label Studio - Server-Side Request Forgery (CVSS 6.5, HumanSignal Label Studio)
- [CVE-2026-72559](https://cve.now/CVE-2026-72559.md): Daniel Brendel HortusFox - Cross-Site Scripting (CVSS 5.4, Daniel Brendel HortusFox)
- [CVE-2026-72558](https://cve.now/CVE-2026-72558.md): CiviCRM CiviCRM - SQL Injection (CVSS 8.8, CiviCRM)
- [CVE-2026-72557](https://cve.now/CVE-2026-72557.md): Cockpit CMS Cockpit CMS - Unrestricted File Upload (CVSS 8.8, Cockpit CMS)
- [CVE-2026-72556](https://cve.now/CVE-2026-72556.md): ZoneMinder ZoneMinder - Remote Code Execution (CVSS 8.8, ZoneMinder)
- [CVE-2026-72555](https://cve.now/CVE-2026-72555.md): Peppermint Lab Peppermint - Broken Access Control (CVSS 8.1, Peppermint Lab Peppermint)
- [CVE-2026-72554](https://cve.now/CVE-2026-72554.md): Ladybird Web Solution Faveo Helpdesk - Broken Access Control (CVSS 6.5, Ladybird Web Solution Faveo Helpdesk)
- [CVE-2026-72553](https://cve.now/CVE-2026-72553.md): ElkArte Forum ElkArte - Cross-Site Scripting (CVSS 5.4, ElkArte Forum ElkArte)
- [CVE-2026-72552](https://cve.now/CVE-2026-72552.md): Dub Dub - Server-Side Request Forgery (CVSS 7.5, Dub)
- [CVE-2026-72551](https://cve.now/CVE-2026-72551.md): Apioo Fusio - Remote Code Execution (CVSS 8.8, Apioo Fusio)
- [CVE-2026-72550](https://cve.now/CVE-2026-72550.md): Friendica Friendica - SQL Injection (CVSS 9.8, Friendica)
- [CVE-2026-72549](https://cve.now/CVE-2026-72549.md): OpenSignLabs OpenSign - Information Disclosure (CVSS 5.3, OpenSignLabs OpenSign)
- [CVE-2026-72548](https://cve.now/CVE-2026-72548.md): OpenSignLabs OpenSign - Information Disclosure (CVSS 7.5, OpenSignLabs OpenSign)
- [CVE-2026-72547](https://cve.now/CVE-2026-72547.md): Attendize Attendize - Insecure Direct Object Reference (CVSS 7.1, Attendize)
- [CVE-2026-72546](https://cve.now/CVE-2026-72546.md): Attendize Attendize - Insecure Direct Object Reference (CVSS 7.1, Attendize)
- [CVE-2026-72545](https://cve.now/CVE-2026-72545.md): OpenSignLabs OpenSign - Insecure Direct Object Reference (CVSS 7.5, OpenSignLabs OpenSign)
- [CVE-2026-72544](https://cve.now/CVE-2026-72544.md): OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity (CVSS 7.5, OpenSignLabs OpenSign)
- [CVE-2026-72543](https://cve.now/CVE-2026-72543.md): OpenSignLabs OpenSign - Insecure Direct Object Reference (CVSS 7.5, OpenSignLabs OpenSign)
- [CVE-2026-72542](https://cve.now/CVE-2026-72542.md): Windmill Labs Windmill - Missing Authorization (CVSS 5.4, Windmill Labs Windmill)
- [CVE-2026-72541](https://cve.now/CVE-2026-72541.md): Windmill Labs Windmill - Missing Authorization (CVSS 6.5, Windmill Labs Windmill)
- [CVE-2026-72539](https://cve.now/CVE-2026-72539.md): Windmill Labs Windmill - Information Disclosure (CVSS 6.5, Windmill Labs Windmill)
- [CVE-2026-72538](https://cve.now/CVE-2026-72538.md): PrefectHQ Prefect - Argument Injection (CVSS 8.8, PrefectHQ Prefect)
- [CVE-2026-72537](https://cve.now/CVE-2026-72537.md): Authentik Security authentik - Privilege Escalation (CVSS 8.8, Authentik Security authentik)
- [CVE-2026-72536](https://cve.now/CVE-2026-72536.md): Chaskiq Chaskiq - Missing Authentication (CVSS 8.2, Chaskiq)
- [CVE-2026-72535](https://cve.now/CVE-2026-72535.md): Chaskiq Chaskiq - Missing Authentication (CVSS 8.2, Chaskiq)
- [CVE-2026-72534](https://cve.now/CVE-2026-72534.md): Authentik Security authentik - Privilege Escalation (CVSS 8.8, Authentik Security authentik)
- [CVE-2026-72533](https://cve.now/CVE-2026-72533.md): Portainer Portainer CE - Authentication Bypass (CVSS 8.8, Portainer CE)
- [CVE-2026-13738](https://cve.now/CVE-2026-13738.md): Improper Authorization Validation (CVSS 9.2, Commvault Cloud)
- [CVE-2026-13737](https://cve.now/CVE-2026-13737.md): Command Restriction Bypass (CVSS 9.2, Commvault Cloud)
- [CVE-2026-13739](https://cve.now/CVE-2026-13739.md): Server-Side Request Forgery (SSRF) (CVSS 8.8, Commvault Cloud)
- [CVE-2026-58231](https://cve.now/CVE-2026-58231.md): Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) (CVSS 10.0, SAP\_SE SAP Commerce Cloud)
- [CVE-2026-33922](https://cve.now/CVE-2026-33922.md): Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0 (CVSS 6.8, Nozomi Networks Arc)
- [CVE-2026-33921](https://cve.now/CVE-2026-33921.md): Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0 (CVSS 4.8, Nozomi Networks Arc)
- [CVE-2026-73162](https://cve.now/CVE-2026-73162.md): cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes (CVSS 5.3, MISP cti-transmute)
- [CVE-2026-73161](https://cve.now/CVE-2026-73161.md): cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting (CVSS 5.1, MISP cti-transmute)
- [CVE-2026-73160](https://cve.now/CVE-2026-73160.md): cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses (CVSS 8.7, MISP cti-transmute)
- [CVE-2026-71218](https://cve.now/CVE-2026-71218.md): Iperf3: unbounded peer-controlled allocation in iperf3 json\_read() allows unauthenticated remote memory exhaustion (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2026-71217](https://cve.now/CVE-2026-71217.md): Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-15567](https://cve.now/CVE-2026-15567.md): Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener (CVSS 7.5, Red Hat JBoss Enterprise Application Platform · Red Hat… +1)
- [CVE-2026-15565](https://cve.now/CVE-2026-15565.md): Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method (CVSS 7.5, Red Hat JBoss Enterprise Application Platform · Red Hat… +3)
- [CVE-2026-15563](https://cve.now/CVE-2026-15563.md): Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos (CVSS 7.4, Red Hat JBoss Enterprise Application Platform · Red Hat… +2)
- [CVE-2026-15562](https://cve.now/CVE-2026-15562.md): Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service (CVSS 7.5, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-15561](https://cve.now/CVE-2026-15561.md): Undertow-core: oom via missing limits in chunked trailer in eap's undertow (CVSS 7.5, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-15560](https://cve.now/CVE-2026-15560.md): Openjdk-orb: unauthed class loading via iiop in eap (CVSS 8.1, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-15556](https://cve.now/CVE-2026-15556.md): Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions (CVSS 8.1, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-15555](https://cve.now/CVE-2026-15555.md): Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller (CVSS 8.8, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-15554](https://cve.now/CVE-2026-15554.md): Undertow-core: undertow: authentication bypass via ajp ssl\_cert/is\_ssl forgery (CVSS 7.4, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-10579](https://cve.now/CVE-2026-10579.md): Picketlink-federation: auth bypass in picketlink saml unsolicited-response (CVSS 9.8, Red Hat JBoss Enterprise Application Platform)
- [CVE-2026-73159](https://cve.now/CVE-2026-73159.md): cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface (CVSS 5.1, MISP cti-transmute)
- [CVE-2026-72693](https://cve.now/CVE-2026-72693.md): Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVSS 7.8, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2026-72694](https://cve.now/CVE-2026-72694.md): Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2026-73158](https://cve.now/CVE-2026-73158.md): cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon (CVSS 5.1, MISP cti-transmute)
- [CVE-2026-73157](https://cve.now/CVE-2026-73157.md): cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata (CVSS 2.3, MISP cti-transmute)
- [CVE-2026-19519](https://cve.now/CVE-2026-19519.md): Claircore: claircore: denial of service via unchecked type assertion in rpm header parser (CVSS 4.3, Red Hat Advanced Cluster Security · Red Hat Quay)
- [CVE-2026-73156](https://cve.now/CVE-2026-73156.md): cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data (CVSS 5.3, MISP cti-transmute)
- [CVE-2026-73155](https://cve.now/CVE-2026-73155.md): cti-transmute Missing Authorization Allows Reactions to Private Comments (CVSS 5.3, MISP cti-transmute)
- [CVE-2026-19418](https://cve.now/CVE-2026-19418.md): TYPO3 CMS - Broken Access Control in Backend and Install Tool (CVSS 7.3, TYPO3 CMS · typo3/cms-backend +1)
- [CVE-2026-73140](https://cve.now/CVE-2026-73140.md): cti-transmute Evaluation Report Exports Expose Private Comments and Author Information (CVSS 5.3, MISP cti-transmute)
- [CVE-2026-16053](https://cve.now/CVE-2026-16053.md): Path Traversal (CVSS 8.5, Zohocorp ManageEngine M365 Manager Plus · Zohocorp ManageEn…)
- [CVE-2026-19518](https://cve.now/CVE-2026-19518.md): Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. (CVSS 6.5, Samsung Open Source rlottie)
- [CVE-2026-19391](https://cve.now/CVE-2026-19391.md): Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives (CVSS 6.5, Pen Drive Powered by Red Hat Lightspeed · Red Hat Certif… +2)
- [CVE-2026-19517](https://cve.now/CVE-2026-19517.md): Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open So (CVSS 6.5, Samsung Open Source rlottie)
- [CVE-2026-13716](https://cve.now/CVE-2026-13716.md): Path Traversal: '.../...//' in Crafty Controller (CVSS 9.1, Arcadia Technology Crafty Controller)
- [CVE-2026-14549](https://cve.now/CVE-2026-14549.md): Ray Enterprise Translation \<= 1.7.3 - Subscriber+ Language Addition and Deletion (CVSS 4.3, Ray Enterprise Translation)
- [CVE-2026-14548](https://cve.now/CVE-2026-14548.md): Ray Enterprise Translation \<= 1.7.3 - Subscriber+ Arbitrary API Token Update (CVSS 6.5, Ray Enterprise Translation)
- [CVE-2026-4757](https://cve.now/CVE-2026-4757.md): A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. (CVSS 7.2, Axis Communications AB AXIS OS)
- [CVE-2026-12052](https://cve.now/CVE-2026-12052.md): Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response (CVSS 5.2, zephyrproject zephyr)
- [CVE-2026-6505](https://cve.now/CVE-2026-6505.md): The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. (CVSS 5.1, Axis Communications AB AXIS OS)
- [CVE-2026-5304](https://cve.now/CVE-2026-5304.md): An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. (CVSS 5.7, Axis Communications AB AXIS OS)
- [CVE-2026-5303](https://cve.now/CVE-2026-5303.md): The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. (CVSS 5.7, Axis Communications AB AXIS OS)
- [CVE-2026-8158](https://cve.now/CVE-2026-8158.md): The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. (CVSS 5.3, Axis Communications AB Signed Video Framework · Axis Com… +1)
- [CVE-2026-6181](https://cve.now/CVE-2026-6181.md): The Device Configuration Framework is vulnerable to an authentication bypass flaw. (CVSS 5.9, Axis Communications AB AXIS OS)
- [CVE-2026-18348](https://cve.now/CVE-2026-18348.md): Velociraptor NETWORK ACL bypass via upload\_azure / upload\_sftp / upload\_smb VQL plugins (CVSS 4.1, Rapid7 Velociraptor)
- [CVE-2026-12051](https://cve.now/CVE-2026-12051.md): NULL pointer dereference in USB DFU device\_next download handler (handle\_download) (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-19516](https://cve.now/CVE-2026-19516.md): CVE-2026-19516 CVE Record (CVSS 9.1, Grafana MCP Server · mcp-grafana)
- [CVE-2026-11894](https://cve.now/CVE-2026-11894.md): Double-free / use-after-free in Realtek BEE Bluetooth HCI driver \`send()\` error paths (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-11985](https://cve.now/CVE-2026-11985.md): Cross-thread FPU register leak on ARM when FPU enabled without register sharing (CVSS 3.6, zephyrproject zephyr)
- [CVE-2026-11893](https://cve.now/CVE-2026-11893.md): Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci\_bflb) (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-16974](https://cve.now/CVE-2026-16974.md): Kirki - Freeform Page Builder, Website Builder & Customizer \<= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post\_meta Shortcode (CVSS 6.4, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-19425](https://cve.now/CVE-2026-19425.md): Win Men Intermational｜Travel Agency Management System - SQL Injection (CVSS 9.8, Win Men Intermational Travel Agency Management System)
- [CVE-2026-24330](https://cve.now/CVE-2026-24330.md): Wildfly-core: wildfly: arbitrary file read via malicious archive deployment (CVSS 6.5, Red Hat Fuse · Red Hat JBoss Enterprise Application Plat… +2)
- [CVE-2026-24329](https://cve.now/CVE-2026-24329.md): Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. (CVSS 4.9, Red Hat Fuse · Red Hat JBoss Enterprise Application Plat… +2)
- [CVE-2026-8917](https://cve.now/CVE-2026-8917.md): Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to wr (CVSS 8.4, ASUS GPU Tweak III · ASUS GPUTweakII +2)
- [CVE-2026-19424](https://cve.now/CVE-2026-19424.md): Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference (CVSS 7.5, Inventec Appliances Chiline Cloud)
- [CVE-2026-66779](https://cve.now/CVE-2026-66779.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (CVSS 6.3, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2026-66778](https://cve.now/CVE-2026-66778.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.3, SAP\_SE SAP Business AI Platform)
- [CVE-2026-66777](https://cve.now/CVE-2026-66777.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9, SAP\_SE SAP Business AI Platform)
- [CVE-2026-66776](https://cve.now/CVE-2026-66776.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9, SAP\_SE SAP Business AI Platform)
- [CVE-2026-66775](https://cve.now/CVE-2026-66775.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 4.3, SAP\_SE SAP Business AI Platform)
- [CVE-2026-66774](https://cve.now/CVE-2026-66774.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 3.7, SAP\_SE SAP Business AI Platform)
- [CVE-2026-66773](https://cve.now/CVE-2026-66773.md): Server-controlled \`\_\_next\` URL is not checking cross-origin (CVSS 5.9, SAP\_SE Odata)
- [CVE-2026-66772](https://cve.now/CVE-2026-66772.md): Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) (CVSS 4.3, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2026-66771](https://cve.now/CVE-2026-66771.md): Cross Site Scripting (XSS) vulnerability in SAPUI5 (CVSS 6.1, SAP\_SE SAPUI5)
- [CVE-2026-66770](https://cve.now/CVE-2026-66770.md): SQL Injection vulnerability in SAP Social Intelligence (CVSS 6.3, SAP\_SE SAP Social Intelligence)
- [CVE-2026-66764](https://cve.now/CVE-2026-66764.md): Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) (CVSS 4.3, SAP\_SE SAP S/4 HANA)
- [CVE-2026-66763](https://cve.now/CVE-2026-66763.md): Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) (CVSS 7.9, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2026-66761](https://cve.now/CVE-2026-66761.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 4.3, SAP\_SE SAP Business AI Platform)
- [CVE-2026-66760](https://cve.now/CVE-2026-66760.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 6.4, SAP\_SE SAP Business AI Platform)
- [CVE-2026-58248](https://cve.now/CVE-2026-58248.md): XML External Entity Injection in SAP BusinessObjects Business Intelligence (CVSS 6.5, SAP\_SE SAP BusinessObjects Business Intelligence)
- [CVE-2026-58247](https://cve.now/CVE-2026-58247.md): Memory Corruption vulnerability in SAP ABAP Platform (CVSS 5.3, SAP\_SE SAP ABAP Platform)
- [CVE-2026-58245](https://cve.now/CVE-2026-58245.md): Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning) (CVSS 3.8, SAP\_SE SAP Advanced Planning and Optimization)
- [CVE-2026-58244](https://cve.now/CVE-2026-58244.md): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) (CVSS 4.3, SAP\_SE SAP Manufacturing Integration and Intelligence)
- [CVE-2026-58243](https://cve.now/CVE-2026-58243.md): Privilege Escalation vulnerability in SAP ABAP Developer Tools (CVSS 8.8, SAP\_SE SAP ABAP Developer Tools)
- [CVE-2026-58241](https://cve.now/CVE-2026-58241.md): Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) (CVSS 4.2, SAP\_SE SAP NetWeaver and ABAP Platform (Change and Transpor…)
- [CVE-2026-58239](https://cve.now/CVE-2026-58239.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 3.7, SAP\_SE SAP Business AI Platform)
- [CVE-2026-58238](https://cve.now/CVE-2026-58238.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9, SAP\_SE SAP Business AI Platform)
- [CVE-2026-58237](https://cve.now/CVE-2026-58237.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 5.9, SAP\_SE SAP Business AI Platform)
- [CVE-2026-58236](https://cve.now/CVE-2026-58236.md): OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 5.5, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2026-58235](https://cve.now/CVE-2026-58235.md): Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) (CVSS 6.3, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2026-58230](https://cve.now/CVE-2026-58230.md): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (CVSS 7.0, SAP\_SE SAP Business AI Platform · @sap/approuter)
- [CVE-2026-44765](https://cve.now/CVE-2026-44765.md): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (CVSS 7.3, SAP\_SE SAP Manufacturing Integration and Intelligence)
- [CVE-2026-44764](https://cve.now/CVE-2026-44764.md): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (CVSS 7.3, SAP\_SE SAP Manufacturing Integration and Intelligence)
- [CVE-2026-44763](https://cve.now/CVE-2026-44763.md): Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence (CVSS 7.6, SAP\_SE SAP Manufacturing Integration and Intelligence)
- [CVE-2026-44762](https://cve.now/CVE-2026-44762.md): Security Misconfiguration in SAP Data Services Management Console (CVSS 3.7, SAP\_SE SAP Data Services Management Console)
- [CVE-2026-44758](https://cve.now/CVE-2026-44758.md): Code Injection vulnerability in Manufacturing Integration and Intelligence (CVSS 9.1, SAP\_SE SAP Manufacturing Integration and Intelligence)
- [CVE-2026-40130](https://cve.now/CVE-2026-40130.md): Memory Corruption vulnerability in SAPSPrint Service (CVSS 5.3, SAP\_SE SAPSPrint Service)
- [CVE-2026-34265](https://cve.now/CVE-2026-34265.md): Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform (CVSS 9.8, SAP\_SE SAP NetWeaver and ABAP Platform)
- [CVE-2026-51583](https://cve.now/CVE-2026-51583.md): An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook va (CVSS 8.5)
- [CVE-2026-51584](https://cve.now/CVE-2026-51584.md): An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in ser (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.