# CVEs published 2026-08-17 337 CVEs were published on August 17, 2026: 64 critical, 116 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2026-75081](https://cve.now/CVE-2026-75081.md): Webkul Bagisto store behavioral workflow (CVSS 5.3, Webkul Bagisto) - [CVE-2026-75080](https://cve.now/CVE-2026-75080.md): SourceCodester Class and Exam Timetabling System edit\_subject1.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System) - [CVE-2026-75079](https://cve.now/CVE-2026-75079.md): SourceCodester Class and Exam Timetabling System edit\_subject2.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System) - [CVE-2026-75078](https://cve.now/CVE-2026-75078.md): SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting (CVSS 5.3, SourceCodester Class and Exam Timetabling System) - [CVE-2026-75587](https://cve.now/CVE-2026-75587.md): Plaintext pre-auth secret exposure via Desktop App diagnostics report (CVSS 3.6, Mattermost) - [CVE-2026-9693](https://cve.now/CVE-2026-9693.md): Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite (CVSS 3.5, Mattermost) - [CVE-2026-9859](https://cve.now/CVE-2026-9859.md): Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels (CVSS 6.5, Mattermost) - [CVE-2026-9816](https://cve.now/CVE-2026-9816.md): Insufficient server-side validation of board member role fields permits privilege escalation (CVSS 8.3, Mattermost) - [CVE-2026-10080](https://cve.now/CVE-2026-10080.md): Boards plugin panics on WebSocket command with non-string field types (CVSS 6.5, Mattermost) - [CVE-2026-65331](https://cve.now/CVE-2026-65331.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64760](https://cve.now/CVE-2026-64760.md): An information leakage was addressed with additional validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-43794](https://cve.now/CVE-2026-43794.md): A memory corruption issue was addressed with improved memory handling. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2026-65346](https://cve.now/CVE-2026-65346.md): An integer overflow was addressed with improved input validation. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-65351](https://cve.now/CVE-2026-65351.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64782](https://cve.now/CVE-2026-64782.md): A memory corruption vulnerability was addressed with improved locking. (CVSS 3.1, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65347](https://cve.now/CVE-2026-65347.md): The issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-43795](https://cve.now/CVE-2026-43795.md): The issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65330](https://cve.now/CVE-2026-65330.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-65340](https://cve.now/CVE-2026-65340.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65337](https://cve.now/CVE-2026-65337.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64788](https://cve.now/CVE-2026-64788.md): The issue was addressed with improved memory handling. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2026-65336](https://cve.now/CVE-2026-65336.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64784](https://cve.now/CVE-2026-64784.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65341](https://cve.now/CVE-2026-65341.md): The issue was addressed with improved memory handling. (CVSS 5.4, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2026-63178](https://cve.now/CVE-2026-63178.md): Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure (CVSS 6.5, onyx-dot-app onyx) - [CVE-2026-28984](https://cve.now/CVE-2026-28984.md): The issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2026-64787](https://cve.now/CVE-2026-64787.md): A use-after-free issue was addressed with improved memory management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2026-65339](https://cve.now/CVE-2026-65339.md): A logic issue was addressed with improved checks. (CVSS 5.0, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-65335](https://cve.now/CVE-2026-65335.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65334](https://cve.now/CVE-2026-65334.md): A memory corruption issue was addressed with improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65338](https://cve.now/CVE-2026-65338.md): The issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65343](https://cve.now/CVE-2026-65343.md): A use after free issue was addressed with improved memory management. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-65333](https://cve.now/CVE-2026-65333.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64778](https://cve.now/CVE-2026-64778.md): The issue was addressed with improved checks. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2026-43667](https://cve.now/CVE-2026-43667.md): A reachable assertion was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2026-64781](https://cve.now/CVE-2026-64781.md): The issue was addressed with improved input validation. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64715](https://cve.now/CVE-2026-64715.md): A use-after-free issue was addressed with improved memory management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2026-65329](https://cve.now/CVE-2026-65329.md): An authentication issue was addressed with improved state management. (CVSS 5.9, Apple iOS and iPadOS) - [CVE-2026-64780](https://cve.now/CVE-2026-64780.md): The issue was addressed with improved checks. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-64779](https://cve.now/CVE-2026-64779.md): A memory corruption vulnerability was addressed with improved locking. (CVSS 3.1, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65332](https://cve.now/CVE-2026-65332.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2026-65349](https://cve.now/CVE-2026-65349.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.6, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2026-71424](https://cve.now/CVE-2026-71424.md): Onyx: Cross-user OAuth-token leak via /api/mcp/servers\* for per-user MCP servers (CVSS 9.6, onyx-dot-app onyx) - [CVE-2026-11817](https://cve.now/CVE-2026-11817.md): CVE-2026-11817 CVE Record (CVSS 5.3, Grafana OSS · Grafana Enterprise) - [CVE-2026-45791](https://cve.now/CVE-2026-45791.md): Dokploy: Password Change Does Not Revoke Active Sessions (CVSS 5.9, dokploy) - [CVE-2026-45790](https://cve.now/CVE-2026-45790.md): Dokploy: Invitation Role Escalation Allows Organization Takeover (CVSS 8.0, dokploy) - [CVE-2026-69146](https://cve.now/CVE-2026-69146.md): MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth (CVSS 6.5, mlflow) - [CVE-2026-69148](https://cve.now/CVE-2026-69148.md): MLflow: CreateModelVersion source validation does not check READ permission on referenced run\_id (CVSS 7.1, mlflow) - [CVE-2026-64849](https://cve.now/CVE-2026-64849.md): MLflow: Unauthenticated full-read SSRF in webhook delivery: \_validate\_webhook\_url bypassed via unvalidated HTTP redirects (and DNS rebinding) (CVSS 9.3, KEV, mlflow) - [CVE-2026-75077](https://cve.now/CVE-2026-75077.md): SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting (CVSS 5.3, SourceCodester Class and Exam Timetabling System) - [CVE-2026-56677](https://cve.now/CVE-2026-56677.md): 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint (CVSS 8.6, decolua 9router · 9router) - [CVE-2026-71518](https://cve.now/CVE-2026-71518.md): Typemill \< 2.26.0 Authorization Bypass via Media File Download Route (CVSS 8.7, typemill) - [CVE-2026-44846](https://cve.now/CVE-2026-44846.md): JumpServer: Privilege Overwrite via Organization Invite Logic Flaw (CVSS 6.2, jumpserver) - [CVE-2026-44845](https://cve.now/CVE-2026-44845.md): JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment (CVSS 6.7, jumpserver) - [CVE-2026-54336](https://cve.now/CVE-2026-54336.md): JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset (CVSS 5.4, jumpserver) - [CVE-2026-65976](https://cve.now/CVE-2026-65976.md): Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit (CVSS 6.5, deskflow) - [CVE-2026-75531](https://cve.now/CVE-2026-75531.md): Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora (CVSS 7.0, pandora-analysis pandora) - [CVE-2026-65832](https://cve.now/CVE-2026-65832.md): Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing (CVSS 8.2, deskflow) - [CVE-2026-63409](https://cve.now/CVE-2026-63409.md): Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client (CVSS 8.2, deskflow) - [CVE-2026-65640](https://cve.now/CVE-2026-65640.md): WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. (CVSS 8.8, WordPress) - [CVE-2026-47683](https://cve.now/CVE-2026-47683.md): vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike (CVSS 8.7, patriksimek vm2 · vm2) - [CVE-2026-47686](https://cve.now/CVE-2026-47686.md): vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE (CVSS 9.9, patriksimek vm2 · vm2) - [CVE-2026-47698](https://cve.now/CVE-2026-47698.md): vm2: Sandbox Breakout Using Dangerous Host Proto Mutators (CVSS 9.8, patriksimek vm2 · vm2) - [CVE-2026-75529](https://cve.now/CVE-2026-75529.md): Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora (CVSS 6.9, pandora-analysis pandora) - [CVE-2026-34398](https://cve.now/CVE-2026-34398.md): FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench (CVSS 7.8, FreeCAD) - [CVE-2026-34399](https://cve.now/CVE-2026-34399.md): FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page (CVSS 7.8, FreeCAD) - [CVE-2026-68765](https://cve.now/CVE-2026-68765.md): hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field (CVSS 5.2, hashcat) - [CVE-2026-34789](https://cve.now/CVE-2026-34789.md): FreeCAD: Arbitrary code execution via unsandboxed PyImport\_ImportModule in PropertyPythonObject::Restore (CVSS 7.0, FreeCAD) - [CVE-2026-65822](https://cve.now/CVE-2026-65822.md): ERPNext: SQL Injection in "Inactive Customers" report via unvalidated \`doctype\` filter (CVSS 7.6, frappe erpnext) - [CVE-2026-66795](https://cve.now/CVE-2026-66795.md): Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) (CVSS 9.9, Red Hat multicluster engine for Kubernetes) - [CVE-2026-65974](https://cve.now/CVE-2026-65974.md): ERPNext: Server-Side Template Injection leading to Remote Code Execution (CVSS 9.9, frappe erpnext) - [CVE-2026-40506](https://cve.now/CVE-2026-40506.md): OpenEMR Path Traversal Arbitrary Directory Deletion via standard\_tables\_manage.php (CVSS 7.0, openemr) - [CVE-2026-75483](https://cve.now/CVE-2026-75483.md): powerlevel10k Control Character Injection via package.json Version (CVSS 4.8, romkatv powerlevel10k) - [CVE-2026-75482](https://cve.now/CVE-2026-75482.md): SWE-agent Trajectory Inspector Path Traversal File Disclosure (CVSS 8.7, SWE-agent) - [CVE-2026-75481](https://cve.now/CVE-2026-75481.md): SkyPilot Authentication Bypass via Service Account Role Escalation (CVSS 8.7, skypilot-org skypilot) - [CVE-2026-75480](https://cve.now/CVE-2026-75480.md): OpenViking Debug Vector Endpoints Multi-tenant Data Exposure (CVSS 7.1, volcengine OpenViking) - [CVE-2026-75479](https://cve.now/CVE-2026-75479.md): JimuReport Unauthenticated Report Listing and Share Token Disclosure (CVSS 8.7, jeecgboot jimureport) - [CVE-2026-75111](https://cve.now/CVE-2026-75111.md): Evidently UI Path Traversal via Dataset Materialization Filename (CVSS 8.7, evidentlyai evidently) - [CVE-2026-75110](https://cve.now/CVE-2026-75110.md): MemOS Authentication Bypass via Unset INTERNAL\_SERVICE\_SECRET (CVSS 9.3, MemTensor MemOS) - [CVE-2026-75109](https://cve.now/CVE-2026-75109.md): Determined Missing Authorization Check on Generic Task Endpoints (CVSS 7.1, determined-ai determined) - [CVE-2026-75108](https://cve.now/CVE-2026-75108.md): Next Terminal Missing Per-Asset Authorization on Portal Endpoints (CVSS 5.3, next-terminal) - [CVE-2026-75106](https://cve.now/CVE-2026-75106.md): OpnForm Editable Submission Secret Derivation via Empty Hashids Salt (CVSS 9.3, OpnForm) - [CVE-2026-75105](https://cve.now/CVE-2026-75105.md): phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter (CVSS 8.7, phpipam) - [CVE-2026-75104](https://cve.now/CVE-2026-75104.md): Hugging Face Transformers Path Traversal via Checkpoint Index (CVSS 6.8, huggingface transformers) - [CVE-2026-75103](https://cve.now/CVE-2026-75103.md): Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover (CVSS 8.7, crawlab-team crawlab) - [CVE-2026-54356](https://cve.now/CVE-2026-54356.md): Budibase authenticated arbitrary S3 signed upload URL issuance via \`/api/attachments/:datasourceId/url\` (CVSS 7.1, budibase · @budibase/server) - [CVE-2026-35219](https://cve.now/CVE-2026-35219.md): Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist (CVSS 7.1, budibase · @budibase/server) - [CVE-2026-73410](https://cve.now/CVE-2026-73410.md): Budibase: SSRF via DNS rebinding in the REST datasource integration (CVSS 8.5, budibase · @budibase/server) - [CVE-2026-64657](https://cve.now/CVE-2026-64657.md): Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL (CVSS 8.4, budibase) - [CVE-2026-19589](https://cve.now/CVE-2026-19589.md): Packer vulnerable to arbitrary file write via crafted plugin archive during installation (CVSS 7.1, HashiCorp Packer) - [CVE-2026-73560](https://cve.now/CVE-2026-73560.md): vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor \`\_fetch\_image\` and audio loader bypass MediaConnector protections (CVSS 6.5, vllm-project vllm · vllm) - [CVE-2026-71486](https://cve.now/CVE-2026-71486.md): vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds (CVSS 4.3, vllm-project vllm · vllm) - [CVE-2026-57233](https://cve.now/CVE-2026-57233.md): Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction (CVSS 8.1, notepad-plus-plus) - [CVE-2026-52886](https://cve.now/CVE-2026-52886.md): Notepad++: session.xml backupFilePath starts\_with Bypass (CVSS 5.1, notepad-plus-plus) - [CVE-2026-71858](https://cve.now/CVE-2026-71858.md): Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution (CVSS 5.4, notepad-plus-plus) - [CVE-2026-54758](https://cve.now/CVE-2026-54758.md): Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs (CVSS 7.8, notepad-plus-plus) - [CVE-2026-19650](https://cve.now/CVE-2026-19650.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 7.1, GitLab) - [CVE-2026-19478](https://cve.now/CVE-2026-19478.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 9.4, GitLab) - [CVE-2026-71553](https://cve.now/CVE-2026-71553.md): ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS (CVSS 7.1, apostrophecms apostrophe · apostrophe) - [CVE-2026-63667](https://cve.now/CVE-2026-63667.md): ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal (CVSS 6.5, apostrophecms apostrophe · @apostrophecms/import-export) - [CVE-2026-63670](https://cve.now/CVE-2026-63670.md): ApostropheCMS: Mutation-XSS / allowedTags bypass via literal \`\\` solidus close (CVSS 6.1, apostrophecms apostrophe · sanitize-html) - [CVE-2026-75014](https://cve.now/CVE-2026-75014.md): SourceCodester Pet Grooming Management Software get\_barcode\_data.php sql injection (CVSS 6.9, SourceCodester Pet Grooming Management Software) - [CVE-2026-63669](https://cve.now/CVE-2026-63669.md): ApostropheCMS: Missing destination-parent authorization in page \`move()\` allows a low-privileged editor to move and re-rank pages inside a restricted subtree (CVSS 6.5, apostrophecms apostrophe · apostrophe) - [CVE-2026-57485](https://cve.now/CVE-2026-57485.md): Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint (CVSS 8.5, Stirling-Tools Stirling-PDF) - [CVE-2026-75013](https://cve.now/CVE-2026-75013.md): TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference (CVSS 7.1, TOTOLINK EX1200L) - [CVE-2026-71472](https://cve.now/CVE-2026-71472.md): Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work\_mem (CVSS 9.1, Red Hat Advanced Cluster Management for Kubernetes) - [CVE-2026-70495](https://cve.now/CVE-2026-70495.md): Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters (CVSS 8.8, Red Hat Advanced Cluster Management for Kubernetes) - [CVE-2026-75012](https://cve.now/CVE-2026-75012.md): TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference (CVSS 7.1, TOTOLINK EX1200L) - [CVE-2026-17639](https://cve.now/CVE-2026-17639.md): Certain HP Smart Tank All in One – Potential Denial of Service (CVSS 6.9, HP Smart Tank 5101 All-in-One Printer · HP Smart Tank 5… +37) - [CVE-2026-45698](https://cve.now/CVE-2026-45698.md): Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir() (CVSS 7.5, netatalk) - [CVE-2026-75011](https://cve.now/CVE-2026-75011.md): kylecui NetForensicMCP index.js execAsync command injection (CVSS 5.3, kylecui NetForensicMCP) - [CVE-2026-12553](https://cve.now/CVE-2026-12553.md): HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write (CVSS 8.9, HP Web Jetadmin) - [CVE-2026-74238](https://cve.now/CVE-2026-74238.md): TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder (CVSS 8.7, tier4 nebula) - [CVE-2026-66792](https://cve.now/CVE-2026-66792.md): Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters (CVSS 9.9, Red Hat Multicluster Global Hub · Red Hat Advanced Clust… +2) - [CVE-2026-73523](https://cve.now/CVE-2026-73523.md): COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation (CVSS 8.7, COVESA Open1722) - [CVE-2026-33437](https://cve.now/CVE-2026-33437.md): Stirling PDF: Stored XSS in Info Summary (CVSS 8.1, Stirling-Tools Stirling-PDF) - [CVE-2026-48053](https://cve.now/CVE-2026-48053.md): Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset (CVSS 5.8, learningequality kolibri · kolibri) - [CVE-2026-59903](https://cve.now/CVE-2026-59903.md): Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (CVSS 6.5, netty · io.netty:netty-codec-http) - [CVE-2026-46345](https://cve.now/CVE-2026-46345.md): compliance-trestle - jinja has an Arbitrary File Write via Path Traversal (CVSS 8.4, oscal-compass compliance-trestle · compliance-trestle) - [CVE-2026-73522](https://cve.now/CVE-2026-73522.md): COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp\_to\_can() in acf-can-listener (CVSS 8.7, COVESA Open1722) - [CVE-2026-71980](https://cve.now/CVE-2026-71980.md): Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe() (CVSS 8.7, BelledonneCommunications bcg729) - [CVE-2026-59902](https://cve.now/CVE-2026-59902.md): Netty: Memory Exhaustion in SctpMessageCompletionHandler (CVSS 7.5, netty · io.netty:netty-transport-sctp) - [CVE-2026-54284](https://cve.now/CVE-2026-54284.md): sqlparse: TokenList.\_\_init\_\_ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (CVSS 8.7, andialbrecht sqlparse · sqlparse) - [CVE-2026-59893](https://cve.now/CVE-2026-59893.md): sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) (CVSS 7.5, andialbrecht sqlparse · sqlparse) - [CVE-2026-71979](https://cve.now/CVE-2026-71979.md): INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing (CVSS 8.7, indilib indi) - [CVE-2026-71491](https://cve.now/CVE-2026-71491.md): sqlparse: Quadratic O(n²) DoS in group\_comments (CVSS 8.7, andialbrecht sqlparse · sqlparse) - [CVE-2026-59894](https://cve.now/CVE-2026-59894.md): sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (CVSS 6.2, andialbrecht sqlparse · sqlparse) - [CVE-2026-74253](https://cve.now/CVE-2026-74253.md): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer \< 16.0.0 (CVSS 10.0, regularlabs.com Sourcerer extension for Joomla) - [CVE-2026-73424](https://cve.now/CVE-2026-73424.md): Astro: Unauthenticated path override in the @astrojs/vercel ISR function (CVSS 6.5, withastro astro · @astrojs/vercel) - [CVE-2026-68519](https://cve.now/CVE-2026-68519.md): Glances: \`--disable-config-exec\` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) (CVSS 7.1, nicolargo glances · glances) - [CVE-2026-74254](https://cve.now/CVE-2026-74254.md): Joomla Extension - joomlack.fr - SQL injection in Page Builder CK \< 3.6.5 (CVSS 9.3, joomlack.fr Page Builder CK extension for Joomla) - [CVE-2026-62982](https://cve.now/CVE-2026-62982.md): Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection (CVSS 8.8, nicolargo glances · glances) - [CVE-2026-68520](https://cve.now/CVE-2026-68520.md): Glances: as\_dict\_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config (CVSS 5.3, nicolargo glances · glances) - [CVE-2026-68517](https://cve.now/CVE-2026-68517.md): Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard (CVSS 6.5, nicolargo glances · glances) - [CVE-2026-40145](https://cve.now/CVE-2026-40145.md): Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility (CVSS 7.1, BeyondTrust Endpoint Privilege Management) - [CVE-2026-12519](https://cve.now/CVE-2026-12519.md): Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing (CVSS 5.0, zephyrproject zephyr) - [CVE-2026-9771](https://cve.now/CVE-2026-9771.md): Missing device-pointer validation in flash\_copy() syscall allows userspace privilege escalation (CVSS 8.8, zephyrproject zephyr) - [CVE-2026-12630](https://cve.now/CVE-2026-12630.md): 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode (CVSS 4.3, zephyrproject zephyr) - [CVE-2026-12629](https://cve.now/CVE-2026-12629.md): PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service (CVSS 4.6, zephyrproject zephyr) - [CVE-2026-68518](https://cve.now/CVE-2026-68518.md): Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction (CVSS 8.8, nicolargo glances · glances) - [CVE-2026-61666](https://cve.now/CVE-2026-61666.md): websocket-driver: Denial of service via malformed Host header (CVSS 8.9, faye websocket-driver-ruby · websocket-driver) - [CVE-2026-64865](https://cve.now/CVE-2026-64865.md): New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass (CVSS 6.0, QuantumNous new-api · github.com/QuantumNous/new-api) - [CVE-2026-71479](https://cve.now/CVE-2026-71479.md): New API: Integer overflow in quota billing yields negative charges (self-crediting) (CVSS 9.1, QuantumNous new-api · github.com/QuantumNous/new-api) - [CVE-2026-64866](https://cve.now/CVE-2026-64866.md): New API: Admin can reset passkeys for same-level or higher-privileged users (CVSS 5.1, QuantumNous new-api · github.com/QuantumNous/new-api) - [CVE-2026-40144](https://cve.now/CVE-2026-40144.md): Memory corruption vulnerability in Endpoint Privilege Management (Windows deployments) (CVSS 7.3, BeyondTrust Endpoint Privilege Management) - [CVE-2026-75060](https://cve.now/CVE-2026-75060.md): In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools (CVSS 8.4, JetBrains PyCharm) - [CVE-2026-75059](https://cve.now/CVE-2026-75059.md): In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible (CVSS 4.4, JetBrains PyCharm) - [CVE-2026-75058](https://cve.now/CVE-2026-75058.md): In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers (CVSS 5.5, JetBrains IntelliJ IDEA) - [CVE-2026-75057](https://cve.now/CVE-2026-75057.md): In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log (CVSS 6.2, JetBrains IntelliJ IDEA) - [CVE-2026-75056](https://cve.now/CVE-2026-75056.md): In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible (CVSS 7.8, JetBrains IntelliJ IDEA) - [CVE-2026-75055](https://cve.now/CVE-2026-75055.md): In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE (CVSS 5.5, JetBrains IntelliJ IDEA) - [CVE-2026-75054](https://cve.now/CVE-2026-75054.md): In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects (CVSS 6.3, JetBrains IntelliJ IDEA) - [CVE-2026-75053](https://cve.now/CVE-2026-75053.md): In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint (CVSS 5.4, JetBrains IntelliJ IDEA) - [CVE-2026-75052](https://cve.now/CVE-2026-75052.md): In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects (CVSS 3.6, JetBrains IntelliJ IDEA) - [CVE-2026-75051](https://cve.now/CVE-2026-75051.md): In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible (CVSS 8.1, JetBrains YouTrack) - [CVE-2026-75050](https://cve.now/CVE-2026-75050.md): In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters (CVSS 7.1, JetBrains YouTrack) - [CVE-2026-75049](https://cve.now/CVE-2026-75049.md): In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the dr (CVSS 6.5, JetBrains YouTrack) - [CVE-2026-75048](https://cve.now/CVE-2026-75048.md): In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible (CVSS 8.2, JetBrains YouTrack) - [CVE-2026-75047](https://cve.now/CVE-2026-75047.md): In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint (CVSS 6.5, JetBrains YouTrack) - [CVE-2026-75046](https://cve.now/CVE-2026-75046.md): In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint (CVSS 4.3, JetBrains YouTrack) - [CVE-2026-75045](https://cve.now/CVE-2026-75045.md): In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via sha (CVSS 9.1, JetBrains YouTrack) - [CVE-2026-75044](https://cve.now/CVE-2026-75044.md): In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbit (CVSS 8.1, JetBrains YouTrack) - [CVE-2026-68762](https://cve.now/CVE-2026-68762.md): In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible (CVSS 5.9, JetBrains Ktor) - [CVE-2025-27772](https://cve.now/CVE-2025-27772.md): Uptrain vulnerable to remote code execution via \`/new\_run\` endpoint (CVSS 7.4, uptrain-ai uptrain) - [CVE-2025-27771](https://cve.now/CVE-2025-27771.md): Uptrain vulnerable to remote code execution via \`/add\_prompts\` endpoint (CVSS 7.4, uptrain-ai uptrain) - [CVE-2026-64868](https://cve.now/CVE-2026-64868.md): New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging (CVSS 7.5, QuantumNous new-api · github.com/QuantumNous/new-api) - [CVE-2025-27770](https://cve.now/CVE-2025-27770.md): UpTrain vulnerable to Remote code execution at \`/create\_project\` (CVSS 7.4, uptrain-ai uptrain) - [CVE-2025-27621](https://cve.now/CVE-2025-27621.md): UpTrain has a Constant Default API Key (CVSS 7.7, uptrain-ai uptrain) - [CVE-2026-64859](https://cve.now/CVE-2026-64859.md): New API: User List API Leaks Root User Access Token Leading to Privilege Escalation (CVSS 9.1, QuantumNous new-api · github.com/QuantumNous/new-api) - [CVE-2026-73646](https://cve.now/CVE-2026-73646.md): PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (CVSS 7.5, postcss) - [CVE-2026-53960](https://cve.now/CVE-2026-53960.md): Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD (CVSS 5.3, discourse) - [CVE-2026-55704](https://cve.now/CVE-2026-55704.md): Discourse: Shared-draft titles and excerpts leak through group post serialization (CVSS 4.3, discourse) - [CVE-2026-55674](https://cve.now/CVE-2026-55674.md): Discourse: Cache poisoning/XSS via color scheme cookies (CVSS 9.3, discourse) - [CVE-2026-59829](https://cve.now/CVE-2026-59829.md): Discourse: Review queue exposes flag-related private message excerpts to category group moderators (CVSS 4.3, discourse) - [CVE-2026-74858](https://cve.now/CVE-2026-74858.md): jae-jae fetcher-mcp URL Validation security-credentials fetch\_urls server-side request forgery (CVSS 5.3, jae-jae fetcher-mcp) - [CVE-2026-73851](https://cve.now/CVE-2026-73851.md): Kiota: Path traversal in generated plugin manifest static\_template.file reference (percent-encoding bypass) (CVSS 6.1, microsoft kiota · Microsoft.OpenApi.Kiota) - [CVE-2026-13202](https://cve.now/CVE-2026-13202.md): HTML Injection in OTDS Swagger UI (CVSS 7.3, Opentext Directory Services) - [CVE-2026-71567](https://cve.now/CVE-2026-71567.md): User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests (CVSS 7.7, openshift-metal3 fakefish) - [CVE-2026-10527](https://cve.now/CVE-2026-10527.md): Boards plugin retains Board Admin rights for users demoted to System Guest (CVSS 6.3, Mattermost) - [CVE-2026-15754](https://cve.now/CVE-2026-15754.md): Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal (CVSS 4.2, Mattermost) - [CVE-2026-16044](https://cve.now/CVE-2026-16044.md): Insufficient validation of guest board admin privileges on archive import (CVSS 3.9, Mattermost) - [CVE-2026-16045](https://cve.now/CVE-2026-16045.md): Delegated OAuth tokens could revoke unrelated OAuth application authorizations (CVSS 2.7, Mattermost) - [CVE-2026-16049](https://cve.now/CVE-2026-16049.md): \_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints\_ (CVSS 3.9, Mattermost) - [CVE-2026-16047](https://cve.now/CVE-2026-16047.md): Board channel linking without read channel permission validation (CVSS 4.3, Mattermost) - [CVE-2026-16046](https://cve.now/CVE-2026-16046.md): Missing run-state validation on finished playbook runs (CVSS 3.5, Mattermost) - [CVE-2026-16048](https://cve.now/CVE-2026-16048.md): Channel member roles accept out-of-scope roles (CVSS 6.3, Mattermost) - [CVE-2026-71566](https://cve.now/CVE-2026-71566.md): KubeVirt backend is not authenticated (CVSS 9.3, openshift-metal3 fakefish) - [CVE-2026-56089](https://cve.now/CVE-2026-56089.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. (CVSS 3.3, Dell ObjectScale) - [CVE-2026-59911](https://cve.now/CVE-2026-59911.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc\_tools. (CVSS 5.5, Dell ObjectScale) - [CVE-2026-59909](https://cve.now/CVE-2026-59909.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. (CVSS 7.1, Dell ObjectScale) - [CVE-2026-56090](https://cve.now/CVE-2026-56090.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. (CVSS 7.3, Dell ObjectScale) - [CVE-2026-56685](https://cve.now/CVE-2026-56685.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command In (CVSS 7.3, Dell ObjectScale) - [CVE-2026-15218](https://cve.now/CVE-2026-15218.md): Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation (CVSS 7.9, maas-api · maas-controller +1) - [CVE-2026-16137](https://cve.now/CVE-2026-16137.md): Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller (CVSS 7.2, Progress ShareFile Storage Zones Controller) - [CVE-2026-16138](https://cve.now/CVE-2026-16138.md): Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service (CVSS 8.0, Progress ShareFile Storage Zones Controller) - [CVE-2026-16139](https://cve.now/CVE-2026-16139.md): Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution (CVSS 7.2, Progress ShareFile Storage Zones Controller) - [CVE-2026-59910](https://cve.now/CVE-2026-59910.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command In (CVSS 7.8, Dell ObjectScale) - [CVE-2026-19693](https://cve.now/CVE-2026-19693.md): extract-zip arbitrary file write outside the destination directory via a symlink at the final path component (CVSS 8.1, max-mapper extract-zip · extract-zip) - [CVE-2026-56686](https://cve.now/CVE-2026-56686.md): Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command In (CVSS 7.8, Dell ObjectScale) - [CVE-2026-16471](https://cve.now/CVE-2026-16471.md): Broken Access Control in Dolusoft Software's Sonlogger (CVSS 7.5, Dolusoft Software Technologies Sonlogger) - [CVE-2026-70412](https://cve.now/CVE-2026-70412.md): Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Eras (CVSS 3.5, Dell iDRAC9 · Dell iDRAC10) - [CVE-2026-75010](https://cve.now/CVE-2026-75010.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication (CVSS 6.4, Roundcube Webmail) - [CVE-2026-16467](https://cve.now/CVE-2026-16467.md): Broken Access Control in Dolusoft Software's Fortilogger (CVSS 7.5, Dolusoft Software Technologies Fortilogger) - [CVE-2026-75007](https://cve.now/CVE-2026-75007.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitut (CVSS 5.4, Roundcube Webmail) - [CVE-2026-75006](https://cve.now/CVE-2026-75006.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma (CVSS 5.8, Roundcube Webmail) - [CVE-2026-75004](https://cve.now/CVE-2026-75004.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve\_disabled\_actions setting byp (CVSS 4.3, Roundcube Webmail) - [CVE-2026-75003](https://cve.now/CVE-2026-75003.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote i (CVSS 5.8, Roundcube Webmail) - [CVE-2026-75002](https://cve.now/CVE-2026-75002.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information d (CVSS 7.1, Roundcube Webmail) - [CVE-2026-75000](https://cve.now/CVE-2026-75000.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remo (CVSS 5.8, Roundcube Webmail) - [CVE-2026-74999](https://cve.now/CVE-2026-74999.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. (CVSS 5.4, Roundcube Webmail) - [CVE-2026-74998](https://cve.now/CVE-2026-74998.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which m (CVSS 7.2, Roundcube Webmail) - [CVE-2026-74997](https://cve.now/CVE-2026-74997.md): In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd\_learn driver of the markasjunk plugin is subject to remote code execution (CVSS 8.8, Roundcube Webmail) - [CVE-2026-14564](https://cve.now/CVE-2026-14564.md): Sensitive Data Exposure in Innotim Software's Logsign SIEM (CVSS 9.0, Innotim Software Telecommunications and Consulting Trade Lt…) - [CVE-2026-18674](https://cve.now/CVE-2026-18674.md): Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier (CVSS 7.0, Kong Mesh) - [CVE-2026-40126](https://cve.now/CVE-2026-40126.md): DOM-based Cross-Site Scripting in OutSystems Service Center (CVSS 4.8, OutSystems Service Center) - [CVE-2026-74843](https://cve.now/CVE-2026-74843.md): Wavlink WN531P3/WN535M1 Export Pingortrace CGI export\_pingortrace.cgi strcpy stack-based overflow (CVSS 10.0, Wavlink WN531P3 · Wavlink WN535M1) - [CVE-2026-74901](https://cve.now/CVE-2026-74901.md): openssl\_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74900](https://cve.now/CVE-2026-74900.md): openssl\_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74899](https://cve.now/CVE-2026-74899.md): openssl\_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74896](https://cve.now/CVE-2026-74896.md): openssl\_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74895](https://cve.now/CVE-2026-74895.md): openssl\_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74894](https://cve.now/CVE-2026-74894.md): openssl\_encrypt before 1.4.0 Authentication Bypass via Bearer Token (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74893](https://cve.now/CVE-2026-74893.md): openssl\_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74892](https://cve.now/CVE-2026-74892.md): openssl\_encrypt before 1.4.0 Hardcoded Secret Key (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74891](https://cve.now/CVE-2026-74891.md): openssl\_encrypt before 1.4.0 Hardcoded Database Credentials (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74890](https://cve.now/CVE-2026-74890.md): openssl\_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74889](https://cve.now/CVE-2026-74889.md): openssl\_encrypt before 1.4.0 Weak Key Derivation via HKDF (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74888](https://cve.now/CVE-2026-74888.md): openssl\_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74887](https://cve.now/CVE-2026-74887.md): openssl\_encrypt before 1.4.0 Insecure Random Import in PQC Module (CVSS 6.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74886](https://cve.now/CVE-2026-74886.md): openssl\_encrypt before 1.4.0 Plugin Import Guard Bypass (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74885](https://cve.now/CVE-2026-74885.md): openssl\_encrypt before 1.4.0 Logging Bug and Race Condition (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74884](https://cve.now/CVE-2026-74884.md): openssl\_encrypt before 1.4.0 Path Traversal via plugin\_id (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74883](https://cve.now/CVE-2026-74883.md): openssl\_encrypt before 1.4.0 Sandbox Bypass via pathlib and io (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74882](https://cve.now/CVE-2026-74882.md): openssl\_encrypt before 1.4.0 Insecure Default Configuration (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74881](https://cve.now/CVE-2026-74881.md): openssl\_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins (CVSS 7.1, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74880](https://cve.now/CVE-2026-74880.md): openssl\_encrypt before 1.4.0 Token Leakage via Query Parameters (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74879](https://cve.now/CVE-2026-74879.md): openssl\_encrypt before 1.4.0 Information Disclosure via /ready endpoint (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74878](https://cve.now/CVE-2026-74878.md): openssl\_encrypt before 1.4.0 TOTP Rate Limiter Bypass (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74877](https://cve.now/CVE-2026-74877.md): openssl\_encrypt before 1.4.0 Missing Ownership Verification via revoke\_key (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74876](https://cve.now/CVE-2026-74876.md): openssl\_encrypt before 1.4.0 Unverified Key Bundle Encryption (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74875](https://cve.now/CVE-2026-74875.md): openssl\_encrypt before 1.4.0 Schema Validation Bypass (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74874](https://cve.now/CVE-2026-74874.md): openssl\_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74873](https://cve.now/CVE-2026-74873.md): openssl\_encrypt before 1.4.0 Password Exposure via CLI Argument (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74872](https://cve.now/CVE-2026-74872.md): openssl\_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74871](https://cve.now/CVE-2026-74871.md): openssl\_encrypt before 1.4.6 KDF Bypass via Sequential-XOR (CVSS 6.9, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74870](https://cve.now/CVE-2026-74870.md): openssl\_encrypt before 1.4.8 Hardware Pepper Information Disclosure (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt) - [CVE-2026-74869](https://cve.now/CVE-2026-74869.md): stoatchat before 0.15.0 Missing Authorization via Subscribe (CVSS 8.3, stoatchat) - [CVE-2026-74868](https://cve.now/CVE-2026-74868.md): SiYuan before 3.7.4 Brute-Force Authentication via Publish Service (CVSS 8.7, siyuan-note siyuan) - [CVE-2026-74867](https://cve.now/CVE-2026-74867.md): SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth (CVSS 2.3, siyuan-note siyuan) - [CVE-2026-74802](https://cve.now/CVE-2026-74802.md): SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy (CVSS 7.1, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel) - [CVE-2026-74801](https://cve.now/CVE-2026-74801.md): SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe (CVSS 8.6, siyuan-note siyuan) - [CVE-2026-74800](https://cve.now/CVE-2026-74800.md): SiYuan before v3.7.4 Stored XSS via assets endpoint (CVSS 9.4, siyuan-note siyuan) - [CVE-2026-74799](https://cve.now/CVE-2026-74799.md): SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure (CVSS 9.2, siyuan-note siyuan) - [CVE-2026-74798](https://cve.now/CVE-2026-74798.md): SiYuan kernel Path Traversal via database\_clean MCP tool (CVSS 9.3, siyuan-note siyuan) - [CVE-2026-74842](https://cve.now/CVE-2026-74842.md): Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download\_image server-side request forgery (CVSS 5.3, Kira-Pgr PromptShopMCP) - [CVE-2026-74845](https://cve.now/CVE-2026-74845.md): 2100 Technology｜Official Document Management System - Arbitrary File Upload (CVSS 8.7, 2100 Technology Official Document Management System) - [CVE-2026-49303](https://cve.now/CVE-2026-49303.md): Permission control vulnerability in the notification module. (CVSS 5.1, Huawei HarmonyOS · Huawei EMUI) - [CVE-2026-49301](https://cve.now/CVE-2026-49301.md): Permission control vulnerability in the Gallery module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI) - [CVE-2026-49305](https://cve.now/CVE-2026-49305.md): Permission control vulnerability in the Wi-Fi enhancement module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI) - [CVE-2026-49308](https://cve.now/CVE-2026-49308.md): Permission control vulnerability in the clipboard module. (CVSS 5.5, Huawei HarmonyOS) - [CVE-2026-49306](https://cve.now/CVE-2026-49306.md): UAF vulnerability in the time and time zone module. (CVSS 3.3, Huawei HarmonyOS) - [CVE-2026-49304](https://cve.now/CVE-2026-49304.md): Permission control vulnerability in the device key management module. (CVSS 6.2, Huawei HarmonyOS) - [CVE-2026-49302](https://cve.now/CVE-2026-49302.md): Permission control vulnerability in the notification service module. (CVSS 6.2, Huawei HarmonyOS) - [CVE-2026-58561](https://cve.now/CVE-2026-58561.md): Null pointer dereference issue in the image codec module. (CVSS 4.0, Huawei HarmonyOS) - [CVE-2026-58560](https://cve.now/CVE-2026-58560.md): Null pointer dereference issue in the image codec module. (CVSS 4.0, Huawei HarmonyOS) - [CVE-2026-49307](https://cve.now/CVE-2026-49307.md): Permission control vulnerability in the multi-mode input module. (CVSS 6.2, Huawei HarmonyOS) - [CVE-2026-20000](https://cve.now/CVE-2026-20000.md): itsourcecode Hospital Management System viewprescriptionrecord.php sql injection (CVSS 5.3, itsourcecode Hospital Management System) - [CVE-2026-19999](https://cve.now/CVE-2026-19999.md): Open Asset Import Library Assimp 3DGS MDL7 Bone Transformation Key MDLLoader.cpp ParseBoneTrafoKeys\_3DGS\_MDL7 buffer overflow (CVSS 5.3, Open Asset Import Library Assimp Assimp) - [CVE-2026-19998](https://cve.now/CVE-2026-19998.md): code-projects Online Shopping System offersmail.php cross site scripting (CVSS 5.3, code-projects Online Shopping System) - [CVE-2026-19997](https://cve.now/CVE-2026-19997.md): Webkul Bagisto Backend Sales RMA Endpoint requests authorization (CVSS 5.1, Webkul Bagisto) - [CVE-2026-19996](https://cve.now/CVE-2026-19996.md): Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management (CVSS 5.3, Webkul Bagisto) - [CVE-2026-19995](https://cve.now/CVE-2026-19995.md): Webkul Bagisto RMA Message send-message cross site scripting (CVSS 5.1, Webkul Bagisto) - [CVE-2026-15623](https://cve.now/CVE-2026-15623.md): Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service (CVSS 9.4, Google Cloud Google SecOps) - [CVE-2026-19994](https://cve.now/CVE-2026-19994.md): Webkul Bagisto Configuration Management execute authorization (CVSS 5.3, Webkul Bagisto) - [CVE-2026-22072](https://cve.now/CVE-2026-22072.md): Arbitrary URL Loading in WebView Leading to Token Leakage Risk (CVSS 8.3, OPPO Health) - [CVE-2026-13700](https://cve.now/CVE-2026-13700.md): WooMS \<= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure (CVSS 5.9, WooMS) - [CVE-2026-14832](https://cve.now/CVE-2026-14832.md): ShopSmart Loyalty for WooCommerce \<= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart\_check\_phone (CVSS 5.3, ShopSmart Loyalty for WooCommerce) - [CVE-2026-19993](https://cve.now/CVE-2026-19993.md): Webkul Bagisto RMA State Validation update-status behavioral workflow (CVSS 5.3, Webkul Bagisto) - [CVE-2026-19992](https://cve.now/CVE-2026-19992.md): Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure (CVSS 2.3, Orange View Limited DualSafe Password Manager & Digital Vau…) - [CVE-2026-19988](https://cve.now/CVE-2026-19988.md): Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting (CVSS 5.3, Alaev SEO Tools Extension) - [CVE-2026-74579](https://cve.now/CVE-2026-74579.md): netfilter: nft\_payload: fix mask build for partial field offload (CVSS 7.1, Linux) - [CVE-2026-19987](https://cve.now/CVE-2026-19987.md): SourceCodester Best Employee Management System Profile exposure of information through directory listing (CVSS 6.9, SourceCodester Best Employee Management System) - [CVE-2026-19986](https://cve.now/CVE-2026-19986.md): Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization (CVSS 5.3, Adblock for Youtube Extension) - [CVE-2026-19984](https://cve.now/CVE-2026-19984.md): jkawamoto mcp-florence2 \_\_init\_\_.py get\_images server-side request forgery (CVSS 5.3, jkawamoto mcp-florence2) - [CVE-2026-19983](https://cve.now/CVE-2026-19983.md): GL.iNet XE3000 NAS Command Service gl\_nas\_sys os command injection (CVSS 6.9, GL.iNet A1300 · GL.iNet AX1800 +6) - [CVE-2026-19982](https://cve.now/CVE-2026-19982.md): GL.iNet BE9300/MT6000 Firewall-management RPC os command injection (CVSS 5.3, GL.iNet BE9300 · GL.iNet MT6000) - [CVE-2026-19981](https://cve.now/CVE-2026-19981.md): GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection (CVSS 5.3, GL.iNet A1300 · GL.iNet AX1800 +15) - [CVE-2026-19980](https://cve.now/CVE-2026-19980.md): GL.iNet XE3000 Language Update ui.update\_langs code injection (CVSS 5.3, GL.iNet A1300 · GL.iNet AX1800 +15) - [CVE-2026-19979](https://cve.now/CVE-2026-19979.md): GL.iNet XE3000 WebDAV Service MOVE authorization (CVSS 6.9, GL.iNet A1300 · GL.iNet AX1800 +15) - [CVE-2026-19978](https://cve.now/CVE-2026-19978.md): jiantao88 android-mcp-server Command Execution index.js child\_process.exec os command injection (CVSS 4.8, jiantao88 android-mcp-server) - [CVE-2026-19977](https://cve.now/CVE-2026-19977.md): EFM ipTIME A3004T Session Validation httpcon\_check\_session\_url improper authentication (CVSS 10.0, EFM ipTIME A3004T) - [CVE-2026-19976](https://cve.now/CVE-2026-19976.md): COMFAST CF-N1-S mbox-config sub\_44A968 command injection (CVSS 5.1, COMFAST CF-N1-S) - [CVE-2026-19975](https://cve.now/CVE-2026-19975.md): Azuriom CMS Money Transfer ProfileController.php transferMoney toctou (CVSS 2.3, Azuriom CMS) - [CVE-2026-50602](https://cve.now/CVE-2026-50602.md): Planet9 Incorrect Permission Assignment Vulnerability Information (CVSS 8.5, Acer Planet9 background service) - [CVE-2026-19974](https://cve.now/CVE-2026-19974.md): treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication (CVSS 6.3, treefrogframework treefrog-framework) - [CVE-2026-50601](https://cve.now/CVE-2026-50601.md): Planet9 Hardcoded Credentials Vulnerability Information (CVSS 6.6, Acer Planet9 desktop application) - [CVE-2026-19973](https://cve.now/CVE-2026-19973.md): itsourcecode Hospital Management System viewpaymentreport.php sql injection (CVSS 5.3, itsourcecode Hospital Management System) - [CVE-2026-19972](https://cve.now/CVE-2026-19972.md): itsourcecode Hospital Management System viewpatient.php sql injection (CVSS 5.3, itsourcecode Hospital Management System) - [CVE-2026-19971](https://cve.now/CVE-2026-19971.md): LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication (CVSS 5.3, LB-Link WR1210M) - [CVE-2026-19970](https://cve.now/CVE-2026-19970.md): Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph\_3DGS\_MDL7 heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp) - [CVE-2026-19969](https://cve.now/CVE-2026-19969.md): Open Asset Import Library Assimp 3DGS MDL7 Model Output Mesh Generator MDLLoader.cpp GenerateOutputMeshes\_3DGS\_MDL7 buffer overflow (CVSS 5.3, Open Asset Import Library Assimp) - [CVE-2026-19968](https://cve.now/CVE-2026-19968.md): Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces\_3DGS\_MDL7 heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp) - [CVE-2026-19967](https://cve.now/CVE-2026-19967.md): Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp) - [CVE-2026-19966](https://cve.now/CVE-2026-19966.md): CodeCanyon TimeCamp Integration for CRM Contact Information Update save\_contact authorization (CVSS 5.3, CodeCanyon TimeCamp Integration for CRM) - [CVE-2026-19965](https://cve.now/CVE-2026-19965.md): automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy (CVSS 6.3, automad) - [CVE-2026-38165](https://cve.now/CVE-2026-38165.md): A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows at (CVSS 9.8) - [CVE-2026-39254](https://cve.now/CVE-2026-39254.md): Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dy (CVSS 9.8) - [CVE-2026-39255](https://cve.now/CVE-2026-39255.md): Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dy (CVSS 9.8) - [CVE-2026-42162](https://cve.now/CVE-2026-42162.md): Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an (CVSS 9.1) - [CVE-2026-42163](https://cve.now/CVE-2026-42163.md): Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under (CVSS 9.8) - [CVE-2026-42164](https://cve.now/CVE-2026-42164.md): Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows (CVSS 9.8) - [CVE-2026-50768](https://cve.now/CVE-2026-50768.md): File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code (CVSS 8.8) - [CVE-2026-50769](https://cve.now/CVE-2026-50769.md): The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. (CVSS 9.8) - [CVE-2026-50770](https://cve.now/CVE-2026-50770.md): An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request. (CVSS 9.8) - [CVE-2026-50771](https://cve.now/CVE-2026-50771.md): Cross Site Scripting vulnerability in Squirro Cognitive Search \< 3.14.2 allows a remote attacker to execute arbtirary code via the Email Not (CVSS 6.1) - [CVE-2026-50772](https://cve.now/CVE-2026-50772.md): An issue in Squirro Cognitive Search \< 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset (CVSS 9.8) - [CVE-2026-50773](https://cve.now/CVE-2026-50773.md): An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll (CVSS 7.8) - [CVE-2026-50774](https://cve.now/CVE-2026-50774.md): An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role. (CVSS 9.8) - [CVE-2026-50775](https://cve.now/CVE-2026-50775.md): A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafte (CVSS 9.8) - [CVE-2026-50776](https://cve.now/CVE-2026-50776.md): Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - \< 04/2026 allows a remote attacker to obtain sensitive information and (CVSS 7.5) - [CVE-2026-51346](https://cve.now/CVE-2026-51346.md): SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obta (CVSS 9.1) - [CVE-2026-51977](https://cve.now/CVE-2026-51977.md): An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privilege (CVSS 9.1) - [CVE-2026-67678](https://cve.now/CVE-2026-67678.md): File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code (CVSS 9.8) - [CVE-2026-67854](https://cve.now/CVE-2026-67854.md): SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code (CVSS 9.8) - [CVE-2026-67868](https://cve.now/CVE-2026-67868.md): A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems process (CVSS 9.8) - [CVE-2026-67917](https://cve.now/CVE-2026-67917.md): zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. (CVSS 9.8) - [CVE-2026-67918](https://cve.now/CVE-2026-67918.md): Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath fu (CVSS 7.5) - [CVE-2026-67919](https://cve.now/CVE-2026-67919.md): An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPl (CVSS 9.8) - [CVE-2026-67925](https://cve.now/CVE-2026-67925.md): Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/uplo (CVSS 6.1) - [CVE-2026-67926](https://cve.now/CVE-2026-67926.md): An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module (CVSS 9.8) - [CVE-2026-67960](https://cve.now/CVE-2026-67960.md): An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentControll (CVSS 9.8) - [CVE-2026-67961](https://cve.now/CVE-2026-67961.md): An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution. (CVSS 7.8) - [CVE-2026-67965](https://cve.now/CVE-2026-67965.md): An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url\_need\_login function (CVSS 9.8) - [CVE-2026-67966](https://cve.now/CVE-2026-67966.md): Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root sh (CVSS 9.8) - [CVE-2026-67967](https://cve.now/CVE-2026-67967.md): Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. (CVSS 9.8) - [CVE-2026-68004](https://cve.now/CVE-2026-68004.md): An issue in OSSRS SRS (Simple Realtime Server) \