# CVEs published 2026-08-12

433 CVEs were published on August 12, 2026: 60 critical, 157 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-48791](https://cve.now/CVE-2026-48791.md): Sigstore Java has a vulnerability with bundle verification of integratedTime (CVSS 2.0, sigstore-java · dev.sigstore:sigstore-java)
- [CVE-2026-46382](https://cve.now/CVE-2026-46382.md): Meeting Room Booking System has server-side request forgery in import functionality (CVSS 8.7, meeting-room-booking-system mrbs-code)
- [CVE-2026-46688](https://cve.now/CVE-2026-46688.md): Meeting Room Booking System has an unauthenticated open redirect (CVSS 6.9, meeting-room-booking-system mrbs-code)
- [CVE-2026-49473](https://cve.now/CVE-2026-49473.md): @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation (CVSS 8.8, cedar-policy authorization-for-expressjs · @cedar-policy/au…)
- [CVE-2026-50544](https://cve.now/CVE-2026-50544.md): NortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure Permissions (CVSS 6.3, NortheBridge luminalshine)
- [CVE-2026-49819](https://cve.now/CVE-2026-49819.md): UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake\_cmd (CVSS 9.8, seriousm4x UpSnap)
- [CVE-2026-17431](https://cve.now/CVE-2026-17431.md): PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to\_pdf and of stylesheet paths in \_style\_tag\_for (CVSS 6.1, MITHALDU PDF::WebKit)
- [CVE-2026-16770](https://cve.now/CVE-2026-16770.md): PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document (CVSS 9.8, MITHALDU PDF::WebKit)
- [CVE-2026-49481](https://cve.now/CVE-2026-49481.md): UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake\_cmd/shutdown\_cmd (CVSS 9.6, seriousm4x UpSnap)
- [CVE-2026-15141](https://cve.now/CVE-2026-15141.md): Referer Validation Bypass in TL-WR820N Web Management Interface (CVSS 5.3, TP-Link Systems TL-WR820N)
- [CVE-2026-71194](https://cve.now/CVE-2026-71194.md): In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. (CVSS 6.8, OpenStack Designate)
- [CVE-2026-47718](https://cve.now/CVE-2026-47718.md): FUXA provides guest and invalid-token access to protected read APIs in secure mode (CVSS 5.5, frangoteam FUXA · fuxa-server)
- [CVE-2026-47717](https://cve.now/CVE-2026-47717.md): FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations (CVSS 7.5, frangoteam FUXA · fuxa-server)
- [CVE-2026-71193](https://cve.now/CVE-2026-71193.md): In OpenStack Designate before 22.0.1, zone creation checks (\_is\_subzone, \_is\_superzone, and the duplicate-zone DB constraint) are scoped to (CVSS 9.6, OpenStack Designate)
- [CVE-2026-71846](https://cve.now/CVE-2026-71846.md): Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege (CVSS 6.5, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-71469](https://cve.now/CVE-2026-71469.md): Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos (CVSS 7.5, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-71471](https://cve.now/CVE-2026-71471.md): Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image (CVSS 9.0, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-71473](https://cve.now/CVE-2026-71473.md): Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke (CVSS 8.5, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-10534](https://cve.now/CVE-2026-10534.md): IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser (CVSS 8.4, IBM Db2)
- [CVE-2026-17485](https://cve.now/CVE-2026-17485.md): IBM i is Affected By Denial of Service Vulnerability \[\] (CVSS 8.2, IBM i)
- [CVE-2026-73501](https://cve.now/CVE-2026-73501.md): kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default (CVSS 9.1, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2024-27253](https://cve.now/CVE-2024-27253.md): IBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request (CVSS 10.0, IBM DOORS Next)
- [CVE-2026-73500](https://cve.now/CVE-2026-73500.md): etcd: \`tlsListener.acceptLoop\` spawns unbounded handshake goroutines with no deadline (CVSS 8.7, etcd-io etcd · go.etcd.io/etcd/v3 +1)
- [CVE-2026-73499](https://cve.now/CVE-2026-73499.md): etcd: Watch API authorization bypass via open-ended range requests (CVSS 7.1, etcd-io etcd · go.etcd.io/etcd/server/v3 +1)
- [CVE-2026-7366](https://cve.now/CVE-2026-7366.md): IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall (CVSS 4.2, IBM DataPower Gateway)
- [CVE-2026-73498](https://cve.now/CVE-2026-73498.md): MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence\_upload\_attachment (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-73519](https://cve.now/CVE-2026-73519.md): WolfStack \< 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret (CVSS 9.3, wolfsoftwaresystemsltd WolfStack)
- [CVE-2026-18727](https://cve.now/CVE-2026-18727.md): Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-18726](https://cve.now/CVE-2026-18726.md): Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-73495](https://cve.now/CVE-2026-73495.md): blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) (CVSS 7.4, http4s blaze · org.http4s:blaze-http\_2.13 +2)
- [CVE-2026-18744](https://cve.now/CVE-2026-18744.md): CVE-2026-18744 (CVSS 6.5, CERT/CC VINCE)
- [CVE-2026-18749](https://cve.now/CVE-2026-18749.md): CVE-2026-18749 (CVSS 9.8, CERT/CC VINCE)
- [CVE-2026-18750](https://cve.now/CVE-2026-18750.md): CVE-2026-18750 (CVSS 5.3, CERT/CC VINCE)
- [CVE-2026-73493](https://cve.now/CVE-2026-73493.md): http4s-blaze-server: Unbounded WebSocket message aggregation (CVSS 7.5, http4s blaze · org.http4s:http4s-blaze-server\_2.13 +2)
- [CVE-2026-19003](https://cve.now/CVE-2026-19003.md): MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings (CVSS 8.4, MongoDB BI Connector ODBC Driver)
- [CVE-2026-73492](https://cve.now/CVE-2026-73492.md): Loofah \`allowed\_uri?\` does not detect \`javascript:\` URIs split by numeric character references without semicolons (CVSS 2.3, flavorjones loofah · loofah)
- [CVE-2026-73491](https://cve.now/CVE-2026-73491.md): Loofah \`allowed\_uri?\` does not detect \`javascript:\` URIs split by named whitespace character references (CVSS 2.3, flavorjones loofah · loofah)
- [CVE-2026-13476](https://cve.now/CVE-2026-13476.md): IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution (CVSS 7.3, IBM Informix Dynamic Server)
- [CVE-2026-73490](https://cve.now/CVE-2026-73490.md): Loofah: SVG \`href\` attribute bypasses local-reference restriction (CVSS 4.7, flavorjones loofah · loofah)
- [CVE-2026-73430](https://cve.now/CVE-2026-73430.md): Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode\_mpint OOB) (CVSS 5.3, Eugeny russh · russh)
- [CVE-2026-73429](https://cve.now/CVE-2026-73429.md): Russh: client wrong-length X25519 \`clone\_from\_slice\` panic (pre-auth DoS) (CVSS 5.3, Eugeny russh · russh)
- [CVE-2026-13367](https://cve.now/CVE-2026-13367.md): IBM Informix Dynamic Server Privilege Escalation Vulnerability in oninit Utility (CVSS 7.8, IBM Informix Dynamic Server)
- [CVE-2026-73427](https://cve.now/CVE-2026-73427.md): Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController) (CVSS 2.1, basecamp trix · trix +1)
- [CVE-2026-10543](https://cve.now/CVE-2026-10543.md): IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVSS 8.2, IBM Db2)
- [CVE-2026-16480](https://cve.now/CVE-2026-16480.md): IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. (CVSS 4.3, IBM Db2)
- [CVE-2026-18097](https://cve.now/CVE-2026-18097.md): IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. (CVSS 5.5, IBM Db2)
- [CVE-2026-18096](https://cve.now/CVE-2026-18096.md): IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak (CVSS 3.3, IBM Db2)
- [CVE-2026-19654](https://cve.now/CVE-2026-19654.md): Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash… (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Update Infrastructure)
- [CVE-2026-19130](https://cve.now/CVE-2026-19130.md): Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization (CVSS 5.8, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-13622](https://cve.now/CVE-2026-13622.md): Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host (CVSS 8.8, Red Hat Container Native Virtualization)
- [CVE-2026-13094](https://cve.now/CVE-2026-13094.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 7.8, IBM i Access Client Solutions)
- [CVE-2026-13433](https://cve.now/CVE-2026-13433.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 8.3, IBM i Access Client Solutions)
- [CVE-2026-64826](https://cve.now/CVE-2026-64826.md): rConfig \< 8.2.13 Path Traversal File Read via FileDownloadController (CVSS 7.1, rConfig)
- [CVE-2026-13105](https://cve.now/CVE-2026-13105.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 8.8, IBM i Access Client Solutions)
- [CVE-2026-73425](https://cve.now/CVE-2026-73425.md): @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped (CVSS 3.7, withastro astro · @astrojs/netlify)
- [CVE-2026-16695](https://cve.now/CVE-2026-16695.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 7.8, IBM i Access Client Solutions)
- [CVE-2026-73423](https://cve.now/CVE-2026-73423.md): Astro: composable \`astro/hono\` pipeline bypasses \`security.checkOrigin\` when \`middleware()\` is absent or misordered (CVSS 5.1, withastro astro · astro)
- [CVE-2026-19004](https://cve.now/CVE-2026-19004.md): MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters (CVSS 8.8, MongoDB BI Connector ODBC Driver)
- [CVE-2026-73422](https://cve.now/CVE-2026-73422.md): Astro: Reflected XSS via unescaped View Transition animation properties (CVSS 5.3, withastro astro · astro)
- [CVE-2026-18888](https://cve.now/CVE-2026-18888.md): MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data (CVSS 7.1, MongoDB BI Connector ODBC Driver)
- [CVE-2026-65370](https://cve.now/CVE-2026-65370.md): ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. (CVSS 7.5, Apple servicetalk)
- [CVE-2026-19001](https://cve.now/CVE-2026-19001.md): MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names (CVSS 9.5, MongoDB BI Connector ODBC Driver)
- [CVE-2026-19002](https://cve.now/CVE-2026-19002.md): Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver (CVSS 8.8, MongoDB BI Connector ODBC Driver)
- [CVE-2026-73419](https://cve.now/CVE-2026-73419.md): NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them (CVSS 6.8, nextauthjs next-auth · @auth core +2)
- [CVE-2026-73418](https://cve.now/CVE-2026-73418.md): NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers (CVSS 7.5, nextauthjs next-auth · @auth core +2)
- [CVE-2026-19503](https://cve.now/CVE-2026-19503.md): Insufficient OIDC endpoint validation could invoke unintended local protocol handlers (CVSS 6.3, MongoDB Atlas SQL ODBC Driver · MongoDB Schema Builder CLI)
- [CVE-2026-14866](https://cve.now/CVE-2026-14866.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 7.7, IBM i Access Client Solutions)
- [CVE-2026-19502](https://cve.now/CVE-2026-19502.md): Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI (CVSS 6.8, MongoDB Schema Builder CLI)
- [CVE-2026-11932](https://cve.now/CVE-2026-11932.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 5.3, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-16033](https://cve.now/CVE-2026-16033.md): Arbitrary file read+write on host via templates/ symlink in malicious image (CVSS 8.5, Canonical LXD)
- [CVE-2026-17616](https://cve.now/CVE-2026-17616.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.8, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-66898](https://cve.now/CVE-2026-66898.md): Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE (CVSS 9.9, Canonical LXD)
- [CVE-2026-67579](https://cve.now/CVE-2026-67579.md): Filter expression injection via forged keyset pagination cursor in Ash (CVSS 7.5, ash-project ash)
- [CVE-2026-12359](https://cve.now/CVE-2026-12359.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.1, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-11923](https://cve.now/CVE-2026-11923.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.4, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-12004](https://cve.now/CVE-2026-12004.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.7, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-63293](https://cve.now/CVE-2026-63293.md): Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (CVSS 9.9, Canonical LXD)
- [CVE-2026-13267](https://cve.now/CVE-2026-13267.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.1, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-63294](https://cve.now/CVE-2026-63294.md): Root RCE via image backup.yaml symlink (CVSS 9.9, Canonical LXD)
- [CVE-2026-11937](https://cve.now/CVE-2026-11937.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 3.1, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-12618](https://cve.now/CVE-2026-12618.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.2, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-73415](https://cve.now/CVE-2026-73415.md): jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab (CVSS 7.5, jupyterlab)
- [CVE-2026-12005](https://cve.now/CVE-2026-12005.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.2, IBM Security Verify Access · IBM Verify Identity Access)
- [CVE-2026-13361](https://cve.now/CVE-2026-13361.md): IBM Informix Server Vulnerability in SQL Interface Handler Could Allow Remote Code Execution (CVSS 8.8, IBM Informix Dynamic Server)
- [CVE-2026-17642](https://cve.now/CVE-2026-17642.md): IBM i is Affected By Remote Code Execution Vulnerabilities \[, \] (CVSS 8.8, IBM i)
- [CVE-2026-73414](https://cve.now/CVE-2026-73414.md): Shescape: Shell injection via unescaped parentheses on Windows with CMD (CVSS 9.2, ericcornelissen shescape · shescape)
- [CVE-2026-18150](https://cve.now/CVE-2026-18150.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 4.3, IBM i)
- [CVE-2026-72508](https://cve.now/CVE-2026-72508.md): Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (\*/\*/\*) (CVSS 9.9, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-18099](https://cve.now/CVE-2026-18099.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 8.9, IBM i)
- [CVE-2026-73413](https://cve.now/CVE-2026-73413.md): Shescape: Quadratic-time denial of service in flag-protection (CVSS 8.7, ericcornelissen shescape · shescape)
- [CVE-2026-18148](https://cve.now/CVE-2026-18148.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 4.3, IBM i)
- [CVE-2026-73412](https://cve.now/CVE-2026-73412.md): Shescape: Path disclosure on Unix with Zsh (CVSS 6.3, ericcornelissen shescape · shescape)
- [CVE-2026-19643](https://cve.now/CVE-2026-19643.md): Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms (CVSS 5.3, aws-sdk-cpp)
- [CVE-2026-17111](https://cve.now/CVE-2026-17111.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 7.6, IBM i)
- [CVE-2026-19642](https://cve.now/CVE-2026-19642.md): Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp (CVSS 5.9, aws-sdk-cpp)
- [CVE-2026-17082](https://cve.now/CVE-2026-17082.md): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (CVSS 8.8, IBM i)
- [CVE-2026-17083](https://cve.now/CVE-2026-17083.md): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (CVSS 9.8, IBM i)
- [CVE-2026-17445](https://cve.now/CVE-2026-17445.md): IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon \[\] (CVSS 8.2, IBM i)
- [CVE-2026-73411](https://cve.now/CVE-2026-73411.md): Shescape: Home-directory disclosure in assignment context on Unix with Dash (CVSS 6.3, ericcornelissen shescape · shescape)
- [CVE-2026-17417](https://cve.now/CVE-2026-17417.md): IBM i is Affected By Remote Code Execution Vulnerabilities \[, \] (CVSS 8.8, IBM i)
- [CVE-2026-63295](https://cve.now/CVE-2026-63295.md): Project restriction \`restricted.containers.privilege=isolated\` bypassable by omitting \`security.idmap.isolated\` (CVSS 4.3, Canonical LXD)
- [CVE-2026-63296](https://cve.now/CVE-2026-63296.md): Project restriction bypass via instance migration config override (CVSS 9.9, Canonical LXD)
- [CVE-2026-49466](https://cve.now/CVE-2026-49466.md): Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes (CVSS 6.5, dartiss draft-list)
- [CVE-2026-63297](https://cve.now/CVE-2026-63297.md): Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (CVSS 9.9, Canonical LXD)
- [CVE-2026-46731](https://cve.now/CVE-2026-46731.md): Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-63298](https://cve.now/CVE-2026-63298.md): LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration (CVSS 8.7, Canonical LXD)
- [CVE-2026-59914](https://cve.now/CVE-2026-59914.md): Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-73409](https://cve.now/CVE-2026-73409.md): Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile (CVSS 5.1, budibase · @budibase/server)
- [CVE-2026-59917](https://cve.now/CVE-2026-59917.md): Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-59916](https://cve.now/CVE-2026-59916.md): Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. (CVSS 7.8, Dell Display and Peripheral Manager)
- [CVE-2026-63299](https://cve.now/CVE-2026-63299.md): Storage volume cross-project move and snapshot restore bypass project disk limits (CVSS 8.5, Canonical LXD)
- [CVE-2026-19657](https://cve.now/CVE-2026-19657.md): ScadaLTS Unauthenticated Reflected XSS (CVSS 6.1, SCADA-LTS ScadaLTS)
- [CVE-2026-73326](https://cve.now/CVE-2026-73326.md): CamaleonCMS Missing Authorization via Plugin Administration Endpoints (CVSS 7.2, owen2345 CamaleonCMS)
- [CVE-2026-62420](https://cve.now/CVE-2026-62420.md): Cross-project cluster migration bypasses project restrictions via cluster notification flag (CVSS 9.9, Canonical LXD)
- [CVE-2026-19656](https://cve.now/CVE-2026-19656.md): ScadaLTS Authenticated Remote Code Execution (CVSS 9.9, SCADA-LTS ScadaLTS)
- [CVE-2026-73407](https://cve.now/CVE-2026-73407.md): Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) (CVSS 9.0, budibase · @budibase/server)
- [CVE-2026-73332](https://cve.now/CVE-2026-73332.md): CamaleonCMS cama\_contact\_form Plugin Stored XSS via before\_html Field (CVSS 9.2, owen2345 CamaleonCMS)
- [CVE-2026-63300](https://cve.now/CVE-2026-63300.md): Cross-project instance move bypasses all project restrictions allowing host command execution (CVSS 9.9, Canonical LXD)
- [CVE-2026-72809](https://cve.now/CVE-2026-72809.md): SiYuan before v3.7.4 Authentication Bypass via Localhost Trust (CVSS 7.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72808](https://cve.now/CVE-2026-72808.md): SiYuan before v3.7.4 Information Disclosure via getFileAnnotation (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72807](https://cve.now/CVE-2026-72807.md): SiYuan before v3.7.4 SQL Injection via queryBlocks template (CVSS 8.8, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72806](https://cve.now/CVE-2026-72806.md): SiYuan before v3.7.4 Authentication Bypass via Attribute View (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72805](https://cve.now/CVE-2026-72805.md): SiYuan before v3.7.4 Information Disclosure via Block Endpoints (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72804](https://cve.now/CVE-2026-72804.md): SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72803](https://cve.now/CVE-2026-72803.md): SiYuan before v3.7.4 Information Disclosure via getBlockAttrs (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72802](https://cve.now/CVE-2026-72802.md): SiYuan before v3.7.4 Information Disclosure via resolveAssetPath (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72801](https://cve.now/CVE-2026-72801.md): SiYuan before v3.7.4 Information Disclosure via Encryption Key Material (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72800](https://cve.now/CVE-2026-72800.md): SiYuan before v3.7.4 Information Disclosure via Unfiltered API (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72799](https://cve.now/CVE-2026-72799.md): SiYuan before v3.7.4 Information Disclosure via Path Resolution (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72798](https://cve.now/CVE-2026-72798.md): SiYuan before v3.7.4 Information Disclosure via renderAttributeView (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72797](https://cve.now/CVE-2026-72797.md): SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72796](https://cve.now/CVE-2026-72796.md): SiYuan before v3.7.4 Access Control Bypass via Static Routes (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72795](https://cve.now/CVE-2026-72795.md): SiYuan before v3.7.4 Information Disclosure via Embed Block (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72794](https://cve.now/CVE-2026-72794.md): siyuan before v3.7.4 Session Cookie Key Disclosure via getConf (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72793](https://cve.now/CVE-2026-72793.md): SiYuan before v3.7.4 Information Disclosure via /api/system/getConf (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72792](https://cve.now/CVE-2026-72792.md): SiYuan before v3.7.4 Information Disclosure via Tag API (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72791](https://cve.now/CVE-2026-72791.md): SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72790](https://cve.now/CVE-2026-72790.md): SiYuan before v3.7.4 Information Disclosure via getNotebookInfo (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72789](https://cve.now/CVE-2026-72789.md): SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks (CVSS 9.2, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72788](https://cve.now/CVE-2026-72788.md): SiYuan before v3.7.4 Information Disclosure via UILayout Filter (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-72787](https://cve.now/CVE-2026-72787.md): Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name (CVSS 5.1, craftcms cms · craftcms/cms)
- [CVE-2026-72786](https://cve.now/CVE-2026-72786.md): Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset (CVSS 7.1, craftcms cms · craftcms/cms)
- [CVE-2026-73331](https://cve.now/CVE-2026-73331.md): CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field (CVSS 7.1, owen2345 CamaleonCMS)
- [CVE-2025-9486](https://cve.now/CVE-2025-9486.md): Incorrect Privilege Assignment in GitLab (CVSS 3.3, GitLab)
- [CVE-2026-73433](https://cve.now/CVE-2026-73433.md): Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write (CVSS 6.6, GStreamer gst-plugins-good · Red Hat Enterprise Linux)
- [CVE-2026-73434](https://cve.now/CVE-2026-73434.md): Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (CVSS 6.1, GStreamer gst-plugins-good · Red Hat Enterprise Linux)
- [CVE-2026-73268](https://cve.now/CVE-2026-73268.md): Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection (CVSS 9.9, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-4879](https://cve.now/CVE-2026-4879.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-6821](https://cve.now/CVE-2026-6821.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-73269](https://cve.now/CVE-2026-73269.md): Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa (CVSS 9.9, Red Hat multicluster engine for Kubernetes)
- [CVE-2026-15217](https://cve.now/CVE-2026-15217.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-15216](https://cve.now/CVE-2026-15216.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2026-16494](https://cve.now/CVE-2026-16494.md): Missing Authorization in GitLab (CVSS 7.1, GitLab)
- [CVE-2026-18433](https://cve.now/CVE-2026-18433.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-19228](https://cve.now/CVE-2026-19228.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 8.5, GitLab)
- [CVE-2026-73406](https://cve.now/CVE-2026-73406.md): Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint (CVSS 7.5, budibase · @budibase/server)
- [CVE-2026-73308](https://cve.now/CVE-2026-73308.md): Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders (CVSS 5.7, budibase · @budibase/server)
- [CVE-2026-73330](https://cve.now/CVE-2026-73330.md): CamaleonCMS 2.9.1 Server-Side Template Injection via test\_email Action (CVSS 7.5, owen2345 CamaleonCMS)
- [CVE-2026-73307](https://cve.now/CVE-2026-73307.md): Budibase: SSRF via bare fetch() in uploadUrl during AI table generation (CVSS 4.9, budibase · @budibase/server)
- [CVE-2026-73306](https://cve.now/CVE-2026-73306.md): Budibase: Account Enumeration via Login Lockout Response Differential (CVSS 5.3, budibase · @budibase/server)
- [CVE-2026-73329](https://cve.now/CVE-2026-73329.md): CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint (CVSS 9.2, owen2345 CamaleonCMS)
- [CVE-2026-18679](https://cve.now/CVE-2026-18679.md): Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured (CVSS 5.8, Kong Mesh · github.com/kumahq/kuma/v2 +1)
- [CVE-2026-73303](https://cve.now/CVE-2026-73303.md): Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) (CVSS 8.2, budibase · @budibase/server)
- [CVE-2026-18678](https://cve.now/CVE-2026-18678.md): Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured (CVSS 5.5, Kong Mesh · github.com/kumahq/kuma +1)
- [CVE-2026-18677](https://cve.now/CVE-2026-18677.md): Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity (CVSS 6.0, Kong Mesh)
- [CVE-2026-18676](https://cve.now/CVE-2026-18676.md): Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin (CVSS 5.1, Kong Mesh · github.com/kumahq/kuma +1)
- [CVE-2026-18952](https://cve.now/CVE-2026-18952.md): Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin (CVSS 8.6, AWS Opensearch · Github Opensearch)
- [CVE-2026-18675](https://cve.now/CVE-2026-18675.md): Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid (CVSS 5.3, Kong Mesh)
- [CVE-2026-19311](https://cve.now/CVE-2026-19311.md): Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin (CVSS 8.6, AWS OpenSearch · Github OpenSearch)
- [CVE-2026-18673](https://cve.now/CVE-2026-18673.md): Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication (CVSS 5.3, Kong Mesh)
- [CVE-2026-73301](https://cve.now/CVE-2026-73301.md): Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings (CVSS 4.3, budibase · @budibase/server)
- [CVE-2026-7427](https://cve.now/CVE-2026-7427.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-8667](https://cve.now/CVE-2026-8667.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-73300](https://cve.now/CVE-2026-73300.md): Budibase: SQL Injection via \`multipleStatements: true\` (CVSS 9.6, budibase · @budibase/server)
- [CVE-2026-15423](https://cve.now/CVE-2026-15423.md): Incorrect Authorization in GitLab (CVSS 8.5, GitLab)
- [CVE-2026-16627](https://cve.now/CVE-2026-16627.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.7, GitLab)
- [CVE-2026-18244](https://cve.now/CVE-2026-18244.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-69106](https://cve.now/CVE-2026-69106.md): Potential cache poisoning in JFrog Artifactory (CVSS 8.8, jfrog artifactory)
- [CVE-2026-42018](https://cve.now/CVE-2026-42018.md): Anonymous user token generation exposure in JFrog Artifactory (CVSS 7.5, KEV, jfrog artifactory)
- [CVE-2026-16907](https://cve.now/CVE-2026-16907.md): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (CVSS 7.6, IBM i)
- [CVE-2026-17248](https://cve.now/CVE-2026-17248.md): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (CVSS 7.1, IBM i)
- [CVE-2026-17271](https://cve.now/CVE-2026-17271.md): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (CVSS 7.5, IBM i)
- [CVE-2026-17218](https://cve.now/CVE-2026-17218.md): IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon \[\] (CVSS 9.8, IBM i)
- [CVE-2026-18669](https://cve.now/CVE-2026-18669.md): IBM i is Affected By A Privilege Escalation Vulnerability \[\] (CVSS 8.8, IBM i)
- [CVE-2026-73299](https://cve.now/CVE-2026-73299.md): Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer (CVSS 10.0, microsoft prompty · @prompty/core)
- [CVE-2026-16863](https://cve.now/CVE-2026-16863.md): IBM i is Affected By Out-of-Bounds Read Vulnerability \[\] (CVSS 7.7, IBM i)
- [CVE-2026-16956](https://cve.now/CVE-2026-16956.md): IBM Db2 Mirror for i is vulnerable to OS command injection \[\] (CVSS 9.8, IBM Db2 Mirror for i)
- [CVE-2026-16860](https://cve.now/CVE-2026-16860.md): IBM i is Affected By Remote Code Execution Vulnerability \[\] (CVSS 9.9, IBM i)
- [CVE-2026-16906](https://cve.now/CVE-2026-16906.md): IBM i is Affected By Multiple Vulnerabilities in Domain Name System (CVSS 8.8, IBM i)
- [CVE-2026-16856](https://cve.now/CVE-2026-16856.md): IBM i is Affected By Multiple Vulnerabilities in Domain Name System (CVSS 8.8, IBM i)
- [CVE-2026-16931](https://cve.now/CVE-2026-16931.md): IBM i is Affected By A Denial of Service Vulnerability \[\] (CVSS 7.5, IBM i)
- [CVE-2026-17110](https://cve.now/CVE-2026-17110.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 8.8, IBM i)
- [CVE-2026-17109](https://cve.now/CVE-2026-17109.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 4.3, IBM i)
- [CVE-2026-17420](https://cve.now/CVE-2026-17420.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 6.3, IBM i)
- [CVE-2026-17222](https://cve.now/CVE-2026-17222.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 4.3, IBM i)
- [CVE-2026-73298](https://cve.now/CVE-2026-73298.md): Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes (CVSS 8.7, microsoft Container-Migration-Solution-Accelerator)
- [CVE-2026-17419](https://cve.now/CVE-2026-17419.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 6.5, IBM i)
- [CVE-2026-17418](https://cve.now/CVE-2026-17418.md): IBM i is Affected By Multiple Vulnerabilities in SQL (CVSS 8.5, IBM i)
- [CVE-2026-17266](https://cve.now/CVE-2026-17266.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 6.5, IBM i)
- [CVE-2026-18235](https://cve.now/CVE-2026-18235.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 8.3, IBM i)
- [CVE-2026-17268](https://cve.now/CVE-2026-17268.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 6.8, IBM i)
- [CVE-2026-17276](https://cve.now/CVE-2026-17276.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 9.6, IBM i)
- [CVE-2026-18250](https://cve.now/CVE-2026-18250.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 6.3, IBM i)
- [CVE-2026-18713](https://cve.now/CVE-2026-18713.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 8.8, IBM i)
- [CVE-2026-16904](https://cve.now/CVE-2026-16904.md): IBM i is Affected By improper privilege management in Navigator for i (CVSS 8.1, IBM i)
- [CVE-2026-44741](https://cve.now/CVE-2026-44741.md): Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter (CVSS 8.8, pimcore · pimcore/admin-ui-classic-bundle)
- [CVE-2026-49467](https://cve.now/CVE-2026-49467.md): TOTP enrollment hijack: password gate skipped due to unawaited promise (CVSS 8.8, smp46 pingvin-share-x)
- [CVE-2026-18847](https://cve.now/CVE-2026-18847.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 8.8, IBM i)
- [CVE-2026-16694](https://cve.now/CVE-2026-16694.md): IBM i is Affected By Stored Cross-site Scripting for i (CVSS 6.4, IBM i)
- [CVE-2026-17094](https://cve.now/CVE-2026-17094.md): IBM i is Affected By Path Traversal Vulnerability in Navigator for i (CVSS 4.3, IBM i)
- [CVE-2026-17095](https://cve.now/CVE-2026-17095.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 8.3, IBM i)
- [CVE-2026-18246](https://cve.now/CVE-2026-18246.md): IBM i is Affected By security restrictions bypass in Navigator for i (CVSS 3.0, IBM i)
- [CVE-2026-18106](https://cve.now/CVE-2026-18106.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 4.3, IBM i)
- [CVE-2026-18144](https://cve.now/CVE-2026-18144.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (CVSS 4.3, IBM i)
- [CVE-2026-18098](https://cve.now/CVE-2026-18098.md): IBM i is Affected By XML injection flaw in Navigator for i (CVSS 8.1, IBM i)
- [CVE-2026-18683](https://cve.now/CVE-2026-18683.md): IBM i is Affected By privilege escalation in Navigator for i (CVSS 8.8, IBM i)
- [CVE-2026-48554](https://cve.now/CVE-2026-48554.md): Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution (CVSS 7.7, Nagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…)
- [CVE-2026-48553](https://cve.now/CVE-2026-48553.md): Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection (CVSS 7.7, Nagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…)
- [CVE-2026-73237](https://cve.now/CVE-2026-73237.md): Apache Allura: XSS in markdown pipeline (CVSS 6.1, Apache Software Foundation Apache Allura)
- [CVE-2026-73238](https://cve.now/CVE-2026-73238.md): Apache Allura: XSS in code display (CVSS 6.1, Apache Software Foundation Apache Allura)
- [CVE-2026-73239](https://cve.now/CVE-2026-73239.md): Apache Allura: Missing permission checks IDOR (CVSS 6.5, Apache Software Foundation Apache Allura)
- [CVE-2026-73240](https://cve.now/CVE-2026-73240.md): Apache Allura: Git command injection (CVSS 9.8, Apache Software Foundation Apache Allura)
- [CVE-2026-48552](https://cve.now/CVE-2026-48552.md): Nagios Core / XI DOM-based XSS via jsonquery.js (CVSS 5.1, Nagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…)
- [CVE-2026-48551](https://cve.now/CVE-2026-48551.md): Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie (CVSS 6.1, Nagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…)
- [CVE-2026-73297](https://cve.now/CVE-2026-73297.md): Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation (CVSS 6.9, microsoft UFO)
- [CVE-2026-48550](https://cve.now/CVE-2026-48550.md): Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter (CVSS 5.1, Nagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…)
- [CVE-2026-73296](https://cve.now/CVE-2026-73296.md): Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure (CVSS 9.4, microsoft UFO)
- [CVE-2026-18499](https://cve.now/CVE-2026-18499.md): IBM WebSphere Application Server Liberty is affected by a privilege escalation (CVSS 8.1, IBM WebSphere Application Server - Liberty)
- [CVE-2026-73295](https://cve.now/CVE-2026-73295.md): Material for MkDocs: DOM XSS in search suggestions via query parameter (CVSS 5.4, squidfunk mkdocs-material · mkdocs-material)
- [CVE-2026-73294](https://cve.now/CVE-2026-73294.md): Semaphore U: OS Command Injection (CVSS 9.9, semaphoreui semaphore · github.com/semaphoreui/semaphore)
- [CVE-2026-69107](https://cve.now/CVE-2026-69107.md): Potential unauthorized artifact access in JFrog Artifactory (CVSS 5.9, jfrog artifactory)
- [CVE-2026-19548](https://cve.now/CVE-2026-19548.md): Binutils: binutils: multiple use-after-free in add\_archive\_element via lto plugin processing (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-73293](https://cve.now/CVE-2026-73293.md): Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision (CVSS 8.8, semaphoreui semaphore · github.com/semaphoreui/semaphore)
- [CVE-2026-59244](https://cve.now/CVE-2026-59244.md): Apache Airflow: Secrets masker: \`var.json\` Variable values not masked in the Rendered Templates UI (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-58076](https://cve.now/CVE-2026-58076.md): Apache Airflow: Unguarded import\_string() of airflow\_exc\_ser / base\_exc\_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-15803](https://cve.now/CVE-2026-15803.md): In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-base (CVSS 8.7, Eclipse Foundation Eclipse RDF4J)
- [CVE-2026-73325](https://cve.now/CVE-2026-73325.md): Fujitsu OneCompression \< 1.2.1 Arbitrary Code Execution via torch.load Deserialization (CVSS 8.4, Fujitsu Research OneCompression)
- [CVE-2026-59242](https://cve.now/CVE-2026-59242.md): Apache Airflow: Arbitrary airflow.\* class instantiation on the API server via the XCom deserialize endpoint (CVSS 5.4, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-73292](https://cve.now/CVE-2026-73292.md): Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation (CVSS 8.3, semaphoreui semaphore · github.com/semaphoreui/semaphore)
- [CVE-2026-54183](https://cve.now/CVE-2026-54183.md): Apache Airflow: Airflow Variables were not masked in the UI for authenticated users (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-67260](https://cve.now/CVE-2026-67260.md): Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting\_input next\_kwargs deserialization (CVSS 7.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-67587](https://cve.now/CVE-2026-67587.md): Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde \`Callback\` deserialization gadget (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-64639](https://cve.now/CVE-2026-64639.md): Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to (CVSS 9.3, WebPros Plesk)
- [CVE-2026-65017](https://cve.now/CVE-2026-65017.md): Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-68968](https://cve.now/CVE-2026-68968.md): Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretations of the backfill id (CVSS 7.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-68969](https://cve.now/CVE-2026-68969.md): Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-68970](https://cve.now/CVE-2026-68970.md): Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-68971](https://cve.now/CVE-2026-68971.md): Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints (CVSS 6.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-65941](https://cve.now/CVE-2026-65941.md): WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service. (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2026-65940](https://cve.now/CVE-2026-65940.md): WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server. (CVSS 6.8, Progress Software WhatsUp Gold)
- [CVE-2026-68076](https://cve.now/CVE-2026-68076.md): Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection (CVSS 5.4, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2026-65939](https://cve.now/CVE-2026-65939.md): WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler. (CVSS 6.8, Progress Software WhatsUp Gold)
- [CVE-2026-65938](https://cve.now/CVE-2026-65938.md): WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API. (CVSS 4.3, Progress Software WhatsUp Gold)
- [CVE-2026-65937](https://cve.now/CVE-2026-65937.md): WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scripting (XSS) vulnerabilities across the web UI (CVSS 8.0, Progress Software WhatsUp Gold)
- [CVE-2026-69105](https://cve.now/CVE-2026-69105.md): Potential package cache integrity issue in JFrog Artifactory (CVSS 8.1, jfrog artifactory)
- [CVE-2026-70547](https://cve.now/CVE-2026-70547.md): Potential unauthorized metadata exposure in JFrog Artifactory (CVSS 4.3, jfrog artifactory)
- [CVE-2026-66016](https://cve.now/CVE-2026-66016.md): Rendered Artifactory Helm manifests may contain generated TLS private keys (CVSS 6.7, jfrog artifactory)
- [CVE-2026-68759](https://cve.now/CVE-2026-68759.md): Integration credential holders may impersonate users in JFrog Access (CVSS 7.2, jfrog artifactory)
- [CVE-2026-65926](https://cve.now/CVE-2026-65926.md): Private Release Bundle versions may be disclosed under specific configurations (CVSS 3.1, jfrog artifactory)
- [CVE-2026-66384](https://cve.now/CVE-2026-66384.md): Authenticated users may write data outside the intended Docker cache path (CVSS 5.3, KEV, jfrog artifactory)
- [CVE-2026-68758](https://cve.now/CVE-2026-68758.md): Authenticated users may access restricted Artifactory support information (CVSS 6.5, jfrog artifactory)
- [CVE-2026-66375](https://cve.now/CVE-2026-66375.md): Low-privilege users may remove protected Artifactory metadata (CVSS 8.1, jfrog artifactory)
- [CVE-2026-68757](https://cve.now/CVE-2026-68757.md): Potential improper SAML signature verification in JFrog Artifactory (CVSS 7.5, jfrog artifactory)
- [CVE-2026-68756](https://cve.now/CVE-2026-68756.md): Potential insecure deserialization in JFrog Artifactory (CVSS 6.6, jfrog artifactory)
- [CVE-2026-66382](https://cve.now/CVE-2026-66382.md): Authenticated users may write files outside the intended Artifactory work directory (CVSS 4.3, jfrog artifactory)
- [CVE-2026-66381](https://cve.now/CVE-2026-66381.md): Repository readers may access content outside configured upstream paths (CVSS 5.3, jfrog artifactory)
- [CVE-2026-68760](https://cve.now/CVE-2026-68760.md): Potential remember-me authentication bypass in JFrog Artifactory (CVSS 5.3, jfrog artifactory)
- [CVE-2026-66379](https://cve.now/CVE-2026-66379.md): Authenticated users may view private Puppet module metadata (CVSS 4.3, jfrog artifactory)
- [CVE-2026-66378](https://cve.now/CVE-2026-66378.md): Authenticated users may access private NuGet metadata (CVSS 4.3, jfrog artifactory)
- [CVE-2026-66377](https://cve.now/CVE-2026-66377.md): Anonymous users may access restricted Artifactory repository information (CVSS 5.3, jfrog artifactory)
- [CVE-2026-68755](https://cve.now/CVE-2026-68755.md): Bundle writers may alter trusted release information in JFrog Artifactory (CVSS 4.3, jfrog artifactory)
- [CVE-2026-66380](https://cve.now/CVE-2026-66380.md): Authenticated users may access private OCI referrer metadata (CVSS 4.3, jfrog artifactory)
- [CVE-2026-68754](https://cve.now/CVE-2026-68754.md): Publishers without delete permission can overwrite docker layer information (CVSS 6.5, jfrog artifactory)
- [CVE-2026-68753](https://cve.now/CVE-2026-68753.md): Anonymous users may access restricted Artifactory content under specific configurations (CVSS 5.3, jfrog artifactory)
- [CVE-2026-66376](https://cve.now/CVE-2026-66376.md): Deleted users may temporarily retain access to JFrog Artifactory (CVSS 4.2, jfrog artifactory)
- [CVE-2026-68752](https://cve.now/CVE-2026-68752.md): Project Resource Managers may escalate privileges in JFrog Artifactory (CVSS 7.2, jfrog artifactory)
- [CVE-2026-14479](https://cve.now/CVE-2026-14479.md): Denial of Service in Autodesk Installer IPC Channel (CVSS 5.5, Autodesk Installer)
- [CVE-2026-14478](https://cve.now/CVE-2026-14478.md): Incorrect Permission Assignment in Autodesk Installer Named Pipes (CVSS 7.8, Autodesk Installer)
- [CVE-2026-73291](https://cve.now/CVE-2026-73291.md): Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag (CVSS 7.1, seerr-team seerr)
- [CVE-2026-18171](https://cve.now/CVE-2026-18171.md): Docker Sandboxes read-only runtime mount writable through its shared-export alias (CVSS 5.7, Docker Sandboxes)
- [CVE-2026-73290](https://cve.now/CVE-2026-73290.md): RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback (CVSS 5.3, rustfs)
- [CVE-2026-73289](https://cve.now/CVE-2026-73289.md): RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions (CVSS 8.1, rustfs)
- [CVE-2026-73288](https://cve.now/CVE-2026-73288.md): RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted (CVSS 6.1, rustfs)
- [CVE-2026-73287](https://cve.now/CVE-2026-73287.md): RustFS: FTPS MKD bypasses IAM CreateBucket authorization (CVSS 5.4, rustfs)
- [CVE-2026-73432](https://cve.now/CVE-2026-73432.md): Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup (CVSS 5.1, vulnerability-lookup)
- [CVE-2026-73286](https://cve.now/CVE-2026-73286.md): RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditions (CVSS 8.1, rustfs)
- [CVE-2026-73285](https://cve.now/CVE-2026-73285.md): RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged (CVSS 7.5, rustfs)
- [CVE-2026-73284](https://cve.now/CVE-2026-73284.md): RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts (CVSS 8.8, rustfs)
- [CVE-2026-73265](https://cve.now/CVE-2026-73265.md): RustFS: Version-specific object reads authorize the non-version action (CVSS 6.5, rustfs)
- [CVE-2026-73431](https://cve.now/CVE-2026-73431.md): Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup (CVSS 8.8, vulnerability-lookup)
- [CVE-2026-73264](https://cve.now/CVE-2026-73264.md): Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider (CVSS 7.6, prowler-cloud prowler)
- [CVE-2026-73263](https://cve.now/CVE-2026-73263.md): Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path (CVSS 9.9, prowler-cloud prowler)
- [CVE-2026-73405](https://cve.now/CVE-2026-73405.md): Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup (CVSS 5.3, vulnerability-lookup)
- [CVE-2026-73262](https://cve.now/CVE-2026-73262.md): Prowler: Stored XSS in HTML reports through unescaped cloud resource tags (CVSS 5.4, prowler-cloud prowler · prowler +1)
- [CVE-2026-49349](https://cve.now/CVE-2026-49349.md): regclient may leak authentication credentials to external blob stores (CVSS 6.8, regclient · github.com/regclient/regclient)
- [CVE-2026-50561](https://cve.now/CVE-2026-50561.md): Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse (CVSS 9.4, xerrors Yuxi)
- [CVE-2026-73374](https://cve.now/CVE-2026-73374.md): Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup (CVSS 6.1, vulnerability-lookup)
- [CVE-2026-49262](https://cve.now/CVE-2026-49262.md): Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy (CVSS 3.0, aimeos pagible · aimeos/pagible)
- [CVE-2026-67287](https://cve.now/CVE-2026-67287.md): Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder \< 6.8.0 (CVSS 6.3, joomshaper.com SP Page Builder extension for Joomla)
- [CVE-2026-67286](https://cve.now/CVE-2026-67286.md): Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder \< 6.8.0 (CVSS 6.3, joomshaper.com SP Page Builder extension for Joomla)
- [CVE-2026-47234](https://cve.now/CVE-2026-47234.md): Admidio writes session IDs and auto-login cookie values to application logs (CVSS 4.4, admidio · admidio/admidio)
- [CVE-2026-47233](https://cve.now/CVE-2026-47233.md): Admidio: Any logged-in user can delete inventory fields via \`mode=field\_delete\` — incomplete fix of #2024 (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-67285](https://cve.now/CVE-2026-67285.md): Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder \< 6.8.0 (CVSS 9.2, joomshaper.com SP Page Builder extension for Joomla)
- [CVE-2026-16999](https://cve.now/CVE-2026-16999.md): XXE in Ministry of Justice's UYAP Document Editor (CVSS 6.3, Ministry of Justice UYAP Document Editor)
- [CVE-2026-47232](https://cve.now/CVE-2026-47232.md): Admidio PKCS#12 private key export action lacks CSRF protection (CVSS 4.3, admidio · admidio/admidio)
- [CVE-2026-47231](https://cve.now/CVE-2026-47231.md): Admidio has IDOR in \`documents-files.php\` \`mode=move\_save\` that lets any folder-uploader exfiltrate files from private folders (CVSS 8.1, admidio · admidio/admidio)
- [CVE-2026-47230](https://cve.now/CVE-2026-47230.md): Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-47229](https://cve.now/CVE-2026-47229.md): Admidio: CSRF in SSO client \`enable\` action toggles SAML/OIDC clients without token validation (CVSS 5.4, admidio · admidio/admidio)
- [CVE-2026-47228](https://cve.now/CVE-2026-47228.md): Admidio's CSRF in registration \`send\_login\` mode resets arbitrary user passwords (CVSS 5.2, admidio · admidio/admidio)
- [CVE-2026-47227](https://cve.now/CVE-2026-47227.md): Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in \`modules/categories.php\` (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-47226](https://cve.now/CVE-2026-47226.md): Admidio: Authorization bypass in file\_delete enables cross-folder file removal by authenticated users without delete privileges (CVSS 6.5, admidio · admidio/admidio)
- [CVE-2026-53996](https://cve.now/CVE-2026-53996.md): NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO\_FGRP\_SETCONFIG ioctl (CVSS 7.3, The NetBSD Foundation NetBSD)
- [CVE-2026-57858](https://cve.now/CVE-2026-57858.md): Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID (CVSS 9.3, Cal.com Self-Hosted)
- [CVE-2026-70468](https://cve.now/CVE-2026-70468.md): A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, F (CVSS 7.3, Fortinet FortiManager)
- [CVE-2026-26035](https://cve.now/CVE-2026-26035.md): An Improper Authentication vulnerability \[CWE-287\] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, For (CVSS 8.8, Fortinet FortiWeb)
- [CVE-2026-70466](https://cve.now/CVE-2026-70466.md): A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 al (CVSS 4.8, Fortinet FortiWeb · Fortinet FortiOS)
- [CVE-2026-71407](https://cve.now/CVE-2026-71407.md): A Stack-based Buffer Overflow vulnerability \[CWE-121\] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated att (CVSS 5.1, Fortinet FortiOS · Fortinet FortiPAM +1)
- [CVE-2026-70467](https://cve.now/CVE-2026-70467.md): A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5 (CVSS 3.4, Fortinet FortiSIEM)
- [CVE-2026-71408](https://cve.now/CVE-2026-71408.md): A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, Fort (CVSS 5.0, Fortinet FortiOS)
- [CVE-2026-70465](https://cve.now/CVE-2026-70465.md): A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, F (CVSS 7.3, Fortinet FortiClientWindows)
- [CVE-2026-11325](https://cve.now/CVE-2026-11325.md): cloudflare/pages-action is deprecated — migration required by September 18th, 2026 (CVSS 8.8, https://github.com/cloudflare/pages-action)
- [CVE-2026-18044](https://cve.now/CVE-2026-18044.md): Estatik Real Estate Plugin \< 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch (CVSS 3.7, Estatik Real Estate Plugin)
- [CVE-2026-17008](https://cve.now/CVE-2026-17008.md): Quick PayPal Payments \<= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN (CVSS 5.3, Quick Paypal Payments)
- [CVE-2026-16990](https://cve.now/CVE-2026-16990.md): Payment Button for PayPal \<= 1.2.3.44 - Unauthenticated Payment Price Manipulation (CVSS 5.3, Payment Button for PayPal)
- [CVE-2026-16747](https://cve.now/CVE-2026-16747.md): Kirki \< 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions (CVSS 6.5, Kirki)
- [CVE-2026-16621](https://cve.now/CVE-2026-16621.md): Payment Gateway for PayPal on WooCommerce \< 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler (CVSS 5.3, Payment Gateway for PayPal on WooCommerce)
- [CVE-2026-15213](https://cve.now/CVE-2026-15213.md): Welcart e-Commerce \< 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback (CVSS 5.3, Welcart e-Commerce)
- [CVE-2026-15045](https://cve.now/CVE-2026-15045.md): Wallet System for WooCommerce \< 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount (CVSS 6.5, Wallet System for WooCommerce)
- [CVE-2026-70560](https://cve.now/CVE-2026-70560.md): Ultimate POS Stored XSS via First Name Field in Leave Notifications (CVSS 4.8, Ultimate Fosters Ultimate POS)
- [CVE-2026-68868](https://cve.now/CVE-2026-68868.md): Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables (CVSS 6.5, Apache Software Foundation Apache Airflow Google provider ·…)
- [CVE-2026-67284](https://cve.now/CVE-2026-67284.md): Joomla Extension - tabaoca.org - Improper ACL checks allow file operations in Cotton Cloud \< 2.0.2 (CVSS 5.3, tabaoca.org Cotton Cloud extension for Joomla)
- [CVE-2026-18652](https://cve.now/CVE-2026-18652.md): Velociraptor STACK Type Download Path Bypasses Denied Prefix Check (CVSS 6.5, Rapid7 Velociraptor)
- [CVE-2026-64951](https://cve.now/CVE-2026-64951.md): Velociraptor DoS triggered by Divide by Zero panic (CVSS 3.5, Rapid7 Velociraptor)
- [CVE-2026-64952](https://cve.now/CVE-2026-64952.md): Velociraptor Hunt Deletion With Insufficient Permission Check (CVSS 6.5, Rapid7 Velociraptor)
- [CVE-2026-64955](https://cve.now/CVE-2026-64955.md): Velociraptor CSV Formula Injection in Export Pipeline (CVSS 6.1, Rapid7 Velociraptor)
- [CVE-2026-18663](https://cve.now/CVE-2026-18663.md): 389-ds-base: 389-ds-base: pre-authentication double-free in get\_ldapmessage\_controls\_ext() via critical session tracking control (CVSS 5.9, Red Hat Directory Server · Red Hat Enterprise Linux)
- [CVE-2026-67283](https://cve.now/CVE-2026-67283.md): Joomla Extension - tabaoca.org - Improper ACL implementation allows allow file operations in Cotton Cloud \< 2.0.2 (CVSS 6.9, tabaoca.org Cotton Cloud extension for Joomla)
- [CVE-2026-67282](https://cve.now/CVE-2026-67282.md): Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik \< 4.6.8 (CVSS 10.0, fabrikar.com Fabrik extension for Joomla)
- [CVE-2026-19566](https://cve.now/CVE-2026-19566.md): Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths (CVSS 7.5, RRWO Net::CIDR::Set)
- [CVE-2025-41771](https://cve.now/CVE-2025-41771.md): SQL injection (CVSS 5.3, Phoenix Contact AXC F · Phoenix Contact BPC +5)
- [CVE-2025-41770](https://cve.now/CVE-2025-41770.md): Unauthenticated Denial of Service (CVSS 8.7, Phoenix Contact AXC F · Phoenix Contact BPC +5)
- [CVE-2025-41769](https://cve.now/CVE-2025-41769.md): Unauthenticated Buffer Overflow in PROFINET Service (CVSS 9.3, Phoenix Contact AXC F · Phoenix Contact BPC +4)
- [CVE-2026-19426](https://cve.now/CVE-2026-19426.md): FitSoft｜POS Sytstem - Missing Authentication (CVSS 8.2, FitSoft POS System)
- [CVE-2026-66659](https://cve.now/CVE-2026-66659.md): WordPress Tablesome Table plugin \<= 1.2.9 - SQL Injection vulnerability (CVSS 9.3, Essekia Tablesome Table)
- [CVE-2026-19217](https://cve.now/CVE-2026-19217.md): Royal Elementor Addons \< 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget (CVSS 5.4, Royal Addons for Elementor)
- [CVE-2026-19073](https://cve.now/CVE-2026-19073.md): Order Sync with Zendesk for WooCommerce \< 2.2.3 - Unauthenticated Customer Order Data Disclosure (CVSS 5.3, Order Sync with Zendesk for WooCommerce)
- [CVE-2026-19052](https://cve.now/CVE-2026-19052.md): ProSolution WP Client \< 2.0.9 - Subscriber+ proSol\_ajaxTablesync and proSol\_ajaxClearlog Calls (CVSS 4.3, ProSolution WP Client)
- [CVE-2026-19050](https://cve.now/CVE-2026-19050.md): ProSolution WP Client \< 2.0.9 - Subscriber+ SSRF via proSol\_url\_validate (CVSS 6.4, ProSolution WP Client)
- [CVE-2026-18962](https://cve.now/CVE-2026-18962.md): WP Photo Album Plus \< 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization (CVSS 4.3, WP Photo Album Plus)
- [CVE-2026-18943](https://cve.now/CVE-2026-18943.md): WPC Admin Columns \< 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure (CVSS 6.5, WPC Admin Columns)
- [CVE-2026-18789](https://cve.now/CVE-2026-18789.md): Ezoic \< 2.23.1 - Unauthenticated Database Export via Content Export REST Routes (CVSS 7.5, Ezoic)
- [CVE-2026-18474](https://cve.now/CVE-2026-18474.md): WP Directory Kit \< 1.5.6 - Unauthenticated SQL Injection via search\_location and search\_category (CVSS 8.6, WP Directory Kit)
- [CVE-2026-18391](https://cve.now/CVE-2026-18391.md): WooCommerce Subscriptions \< 9.1.0 - Unauthenticated RCE via PHP Object Injection (CVSS 9.8, WooCommerce Subscriptions)
- [CVE-2026-18366](https://cve.now/CVE-2026-18366.md): Events Manager \< 7.4.1 - Unauthenticated Privilege Escalation to Administrator (CVSS 9.8, Events Manager)
- [CVE-2026-18230](https://cve.now/CVE-2026-18230.md): WP Directory Kit \< 1.5.6 - Subscriber+ SQL Injection via section Parameter (CVSS 8.1, WP Directory Kit)
- [CVE-2026-18057](https://cve.now/CVE-2026-18057.md): Events Manager \< 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection (CVSS 8.1, Events Manager)
- [CVE-2026-18049](https://cve.now/CVE-2026-18049.md): WP Photo Album Plus \< 9.2.07.002 - Unauthenticated Option Disclosure via gettogo (CVSS 7.5, WP Photo Album Plus)
- [CVE-2026-18048](https://cve.now/CVE-2026-18048.md): WP Photo Album Plus \< 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal (CVSS 7.5, WP Photo Album Plus)
- [CVE-2026-18046](https://cve.now/CVE-2026-18046.md): Cookie Consent \< 0.0.10 - Subscriber+ MaxMind License Key Update (CVSS 4.3, Cookie Consent)
- [CVE-2026-18035](https://cve.now/CVE-2026-18035.md): User Access Manager \< 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API (CVSS 5.3, User Access Manager)
- [CVE-2026-17013](https://cve.now/CVE-2026-17013.md): WP Photo Album Plus \< 9.2.07.002 - Reflected XSS via lbstart (CVSS 6.1, WP Photo Album Plus)
- [CVE-2026-16977](https://cve.now/CVE-2026-16977.md): Form Maker by 10Web \< 1.15.45 - Subscriber+ SQL Injection via display\_name (CVSS 8.1, Form Maker by 10Web)
- [CVE-2026-16737](https://cve.now/CVE-2026-16737.md): WP Travel Engine \< 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte\_add\_trip\_to\_cart (CVSS 5.3, WP Travel Engine)
- [CVE-2026-16538](https://cve.now/CVE-2026-16538.md): TeraWallet - Wallet for WooCommerce \< 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up (CVSS 9.1, Wallet for WooCommerce)
- [CVE-2026-16294](https://cve.now/CVE-2026-16294.md): Blubrry PowerPress \< 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL (CVSS 7.1, PowerPress Podcasting plugin by Blubrry)
- [CVE-2026-16253](https://cve.now/CVE-2026-16253.md): Total Upkeep \< 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron\_secret (CVSS 7.5, Total Upkeep)
- [CVE-2026-16066](https://cve.now/CVE-2026-16066.md): Welcart e-Commerce \< 2.11.34 - Author+ Stored XSS via Product Name (CVSS 5.4, Welcart e-Commerce)
- [CVE-2026-16051](https://cve.now/CVE-2026-16051.md): WPMU DEV Dashboard \< 5.0.1 - Remote Code Execution via Hub Install Action (CVSS 9.8, wpmudev-updates)
- [CVE-2026-15388](https://cve.now/CVE-2026-15388.md): Cookie Consent \< 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure (CVSS 4.3, Cookie Consent)
- [CVE-2026-15249](https://cve.now/CVE-2026-15249.md): Patterns Kit \<= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link (CVSS 5.4, Patterns Kit)
- [CVE-2026-15039](https://cve.now/CVE-2026-15039.md): Gift Cards For WooCommerce Pro \< 4.2.10 - Unauthenticated Arbitrary File Upload (CVSS 9.8, giftware)
- [CVE-2026-14925](https://cve.now/CVE-2026-14925.md): Import WP \< 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download (CVSS 7.5, Import WP)
- [CVE-2026-14859](https://cve.now/CVE-2026-14859.md): WP Crowdfunding \< 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization (CVSS 4.3, WP Crowdfunding)
- [CVE-2026-14858](https://cve.now/CVE-2026-14858.md): WP Crowdfunding \< 2.2.1 - Subscriber+ Order Data Disclosure via IDOR (CVSS 4.3, WP Crowdfunding)
- [CVE-2026-14857](https://cve.now/CVE-2026-14857.md): WP Crowdfunding \< 2.2.1 - Subscriber+ Campaign Update Modification via IDOR (CVSS 4.3, WP Crowdfunding)
- [CVE-2026-13613](https://cve.now/CVE-2026-13613.md): KiviCare \< 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint (CVSS 8.8, KiviCare)
- [CVE-2026-13612](https://cve.now/CVE-2026-13612.md): KiviCare \< 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR (CVSS 4.3, KiviCare)
- [CVE-2026-13177](https://cve.now/CVE-2026-13177.md): Eventin \< 4.1.20 - Contributor+ Order Information Disclosure via IDOR (CVSS 4.3, Eventin)
- [CVE-2026-13171](https://cve.now/CVE-2026-13171.md): Eventin \< 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint (CVSS 8.2, Eventin)
- [CVE-2026-13168](https://cve.now/CVE-2026-13168.md): Eventin \< 4.1.20 - Contributor+ Customer PII Disclosure via REST API (CVSS 6.5, Eventin)
- [CVE-2026-12976](https://cve.now/CVE-2026-12976.md): LearnPress \< 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant (CVSS 6.5, LearnPress)
- [CVE-2026-19594](https://cve.now/CVE-2026-19594.md): Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation (CVSS 8.1, Snowflake Python APIs)
- [CVE-2026-12235](https://cve.now/CVE-2026-12235.md): Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787) (CVSS 6.3, zephyrproject zephyr)
- [CVE-2026-12234](https://cve.now/CVE-2026-12234.md): TOCTOU double-fetch in \`zsock\_sendmsg\`/\`recvmsg\` userspace verifiers allows kernel-heap out-of-bounds write (CVSS 7.8, zephyrproject zephyr)
- [CVE-2026-64954](https://cve.now/CVE-2026-64954.md): Velociraptor collect\_client() Permissions Bypass (CVSS 8.2, Rapid7 Velociraptor)
- [CVE-2026-12233](https://cve.now/CVE-2026-12233.md): Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-12232](https://cve.now/CVE-2026-12232.md): Out-of-bounds read via unvalidated stream\_id in Intel ALH DAI get\_properties (CVSS 6.1, zephyrproject zephyr)
- [CVE-2025-15687](https://cve.now/CVE-2025-15687.md): Open5GS SMF Diameter Gx Credit-Control-Answer smf\_gx\_cca\_cb denial of service (CVSS 5.3, Open5GS)
- [CVE-2025-15686](https://cve.now/CVE-2025-15686.md): Open5GS HSS Service fd\_msg\_sess\_get denial of service (CVSS 5.3, Open5GS)
- [CVE-2026-18961](https://cve.now/CVE-2026-18961.md): Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect \<= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback (CVSS 8.1, fahdaslam Social Login, Passkeys, Magic Link & Email OTP –…)
- [CVE-2026-19588](https://cve.now/CVE-2026-19588.md): Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. (CVSS 6.5, Samsung Open Source rlottie)
- [CVE-2026-9318](https://cve.now/CVE-2026-9318.md): tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title (CVSS 4.8, Jazzband tablib · tablib)
- [CVE-2025-15685](https://cve.now/CVE-2025-15685.md): Open5GS freeDiameter memory corruption (CVSS 5.3, Open5GS)
- [CVE-2026-19587](https://cve.now/CVE-2026-19587.md): Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allocation. (CVSS 6.5, Samsung Open Source rlottie)
- [CVE-2025-15684](https://cve.now/CVE-2025-15684.md): Open5GS CER init.c diam\_log\_func assertion (CVSS 6.9, Open5GS)
- [CVE-2026-64927](https://cve.now/CVE-2026-64927.md): Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy (CVSS 6.4, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-73122](https://cve.now/CVE-2026-73122.md): Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces (CVSS 7.7, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-66878](https://cve.now/CVE-2026-66878.md): Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration (CVSS 7.7, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-70398](https://cve.now/CVE-2026-70398.md): Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace (CVSS 9.6, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-72526](https://cve.now/CVE-2026-72526.md): Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation (CVSS 9.9, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2024-14044](https://cve.now/CVE-2024-14044.md): Open5GS Diameter Rx pcrf-rx-path.c pcrf\_rx\_aar\_cb buffer overflow (CVSS 5.3, Open5GS)
- [CVE-2026-68450](https://cve.now/CVE-2026-68450.md): btrfs: free mapping node on duplicate reloc root insert (no CVSS, Linux)
- [CVE-2026-68449](https://cve.now/CVE-2026-68449.md): ata: sata\_dwc\_460ex: fix infinite loop in NCQ tag completion bit-scanning (no CVSS, Linux)
- [CVE-2026-68448](https://cve.now/CVE-2026-68448.md): ovl: check access to copy\_file\_range source with src mounter creds (no CVSS, Linux)
- [CVE-2026-68447](https://cve.now/CVE-2026-68447.md): drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (CVSS 7.1, Linux)
- [CVE-2026-6484](https://cve.now/CVE-2026-6484.md): Lack of verified boot to certain FV may cause arbitrary code execution (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2026-68446](https://cve.now/CVE-2026-68446.md): drm/vmwgfx: Validate vmw\_surface\_metadata::array\_size (CVSS 7.8, Linux)
- [CVE-2026-68445](https://cve.now/CVE-2026-68445.md): drm/vc4: Prevent shader BO mappings from becoming writable (CVSS 7.8, Linux)
- [CVE-2026-68444](https://cve.now/CVE-2026-68444.md): firmware: arm\_ffa: Fix NULL dereference in ffa\_partition\_info\_get() (no CVSS, Linux)
- [CVE-2026-68443](https://cve.now/CVE-2026-68443.md): hwmon: (gigabyte\_waterforce) Stop device IO before calling hid\_hw\_stop (no CVSS, Linux)
- [CVE-2026-68442](https://cve.now/CVE-2026-68442.md): btrfs: don't propagate EXTENT\_FLAG\_LOGGING to split extent maps (CVSS 7.8, Linux)
- [CVE-2026-68441](https://cve.now/CVE-2026-68441.md): net/sched: Handle TC\_ACT\_REDIRECT from qdisc filter chains (no CVSS, Linux)
- [CVE-2026-68440](https://cve.now/CVE-2026-68440.md): net: txgbe: fix heap overflow when reading module EEPROM (CVSS 7.8, Linux)
- [CVE-2026-68439](https://cve.now/CVE-2026-68439.md): wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925\_mcu\_bss\_he\_tlv() (no CVSS, Linux)
- [CVE-2026-68438](https://cve.now/CVE-2026-68438.md): smp: Make CSD lock acquisition atomic for debug mode (no CVSS, Linux)
- [CVE-2026-68437](https://cve.now/CVE-2026-68437.md): drm/imagination: Fit paired fragment job in the correct CCCB (no CVSS, Linux)
- [CVE-2026-68436](https://cve.now/CVE-2026-68436.md): drm/amd/display: use kvzalloc to allocate struct dc (no CVSS, Linux)
- [CVE-2026-68435](https://cve.now/CVE-2026-68435.md): LoongArch: Fix address space mismatch in kexec command line lookup (no CVSS, Linux)
- [CVE-2026-68434](https://cve.now/CVE-2026-68434.md): serial: 8250\_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (no CVSS, Linux)
- [CVE-2026-68433](https://cve.now/CVE-2026-68433.md): libceph: bound get\_version reply decode to front len (CVSS 8.6, Linux)
- [CVE-2026-68432](https://cve.now/CVE-2026-68432.md): vxlan: require CAP\_NET\_ADMIN in the device netns for changelink (CVSS 8.8, Linux)
- [CVE-2026-68431](https://cve.now/CVE-2026-68431.md): ksmbd: validate minimum PDU size for transform requests (CVSS 9.1, Linux)
- [CVE-2026-68430](https://cve.now/CVE-2026-68430.md): drm/amdgpu/gfx8: drop unecessary BUG\_ON() (no CVSS, Linux)
- [CVE-2026-68429](https://cve.now/CVE-2026-68429.md): drm/dp\_mst: Handle torn-down topology gracefully in drm\_dp\_mst\_topology\_queue\_probe() (no CVSS, Linux)
- [CVE-2025-59319](https://cve.now/CVE-2025-59319.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first p (CVSS 7.2)
- [CVE-2025-59320](https://cve.now/CVE-2025-59320.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. (CVSS 4.6)
- [CVE-2025-59321](https://cve.now/CVE-2025-59321.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. (CVSS 9.8)
- [CVE-2025-59322](https://cve.now/CVE-2025-59322.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted (CVSS 7.5)
- [CVE-2025-59323](https://cve.now/CVE-2025-59323.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, respo (CVSS 8.4)
- [CVE-2025-59324](https://cve.now/CVE-2025-59324.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoP (CVSS 9.1)
- [CVE-2025-59325](https://cve.now/CVE-2025-59325.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the offline recovery of secrets (CVSS 7.5)
- [CVE-2025-59326](https://cve.now/CVE-2025-59326.md): CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for u (CVSS 9.8)
- [CVE-2025-59327](https://cve.now/CVE-2025-59327.md): In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is pres (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.