# CVEs published 2026-08-27

437 CVEs were published on August 27, 2026: 80 critical, 190 high. Days are UTC.

- [CVE-2026-61802](https://cve.now/CVE-2026-61802.md): Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config (CVSS 6.5, wazuh)
- [CVE-2026-78616](https://cve.now/CVE-2026-78616.md): Dimension Stored XSS via Trusted CA Certificate Configuration (CVSS 4.8, WatchGuard Dimension)
- [CVE-2026-78498](https://cve.now/CVE-2026-78498.md): Dimension Server-Side Request Forgery via Email Server Test Settings (CVSS 5.1, WatchGuard Dimension)
- [CVE-2026-78612](https://cve.now/CVE-2026-78612.md): Dimension SQL Injection in Scheduled Report (CVSS 8.6, WatchGuard Dimension)
- [CVE-2026-78103](https://cve.now/CVE-2026-78103.md): Dimension Log Server Configuration Lock Bypass Vulnerability (CVSS 5.1, WatchGuard Dimension)
- [CVE-2026-78615](https://cve.now/CVE-2026-78615.md): WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page (CVSS 4.6, WatchGuard Dimension)
- [CVE-2026-78613](https://cve.now/CVE-2026-78613.md): Dimension SQL Injection in Log Viewer (CVSS 8.6, WatchGuard Dimension)
- [CVE-2026-78495](https://cve.now/CVE-2026-78495.md): Dimension Server-Side Request Forgery via Remote Backup Connection Test (CVSS 5.3, WatchGuard Dimension)
- [CVE-2026-78617](https://cve.now/CVE-2026-78617.md): WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting (CVSS 6.3, WatchGuard Dimension)
- [CVE-2026-78047](https://cve.now/CVE-2026-78047.md): Dimension Stored XSS in Scheduled Report Task (CVSS 5.1, WatchGuard Dimension)
- [CVE-2026-78610](https://cve.now/CVE-2026-78610.md): Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint (CVSS 8.4, WatchGuard Dimension)
- [CVE-2026-78499](https://cve.now/CVE-2026-78499.md): Dimension SSRF via FTP Server Test Connection (CVSS 5.1, WatchGuard Dimension)
- [CVE-2026-78174](https://cve.now/CVE-2026-78174.md): WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs (CVSS 9.3, WatchGuard Dimension)
- [CVE-2026-78618](https://cve.now/CVE-2026-78618.md): Dimension Business Logic Flaw Allows Chained Backend Object Operations (CVSS 6.9, WatchGuard Dimension)
- [CVE-2026-78500](https://cve.now/CVE-2026-78500.md): Dimension Blind SSRF via Database Test Connection Feature (CVSS 5.1, WatchGuard Dimension)
- [CVE-2026-13108](https://cve.now/CVE-2026-13108.md): Dimension Denial-of-Service (CVSS 8.7, WatchGuard Dimension)
- [CVE-2026-78614](https://cve.now/CVE-2026-78614.md): Dimension SQL Injection in Audit Report (CVSS 8.6, WatchGuard Dimension)
- [CVE-2026-61800](https://cve.now/CVE-2026-61800.md): Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) (CVSS 9.1, wazuh)
- [CVE-2026-19315](https://cve.now/CVE-2026-19315.md): Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution (CVSS 9.3, WatchGuard Fireware OS)
- [CVE-2026-19314](https://cve.now/CVE-2026-19314.md): Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS) (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-19317](https://cve.now/CVE-2026-19317.md): Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS) (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-78011](https://cve.now/CVE-2026-78011.md): Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS) (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-78010](https://cve.now/CVE-2026-78010.md): Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-13086](https://cve.now/CVE-2026-13086.md): Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint (CVSS 9.3, WatchGuard Fireware OS)
- [CVE-2026-19313](https://cve.now/CVE-2026-19313.md): Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution (CVSS 9.3, WatchGuard Fireware OS)
- [CVE-2026-19316](https://cve.now/CVE-2026-19316.md): Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS) (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-78009](https://cve.now/CVE-2026-78009.md): Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS) (CVSS 8.7, WatchGuard Fireware OS)
- [CVE-2026-19318](https://cve.now/CVE-2026-19318.md): Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution (CVSS 9.3, WatchGuard Fireware OS)
- [CVE-2026-78008](https://cve.now/CVE-2026-78008.md): Fireware OS Authenticated Buffer Overflow in wgagent (CVSS 8.6, WatchGuard Fireware OS)
- [CVE-2026-61783](https://cve.now/CVE-2026-61783.md): Wazuh: RBAC permission-effect check in mask\_sensitive\_config allows low-privilege users to read cluster.key (CVSS 7.0, wazuh)
- [CVE-2026-54084](https://cve.now/CVE-2026-54084.md): Wazuh agent enrollment NULL pointer dereference via malformed manager response (CVSS 5.3, wazuh)
- [CVE-2026-82072](https://cve.now/CVE-2026-82072.md): Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-81851](https://cve.now/CVE-2026-81851.md): Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service (CVSS 6.9, WatchGuard Fireware OS)
- [CVE-2026-54085](https://cve.now/CVE-2026-54085.md): Wazuh: Missing input validation in multiple active response scripts allows argument injection (CVSS 7.1, wazuh)
- [CVE-2026-54083](https://cve.now/CVE-2026-54083.md): Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion (CVSS 8.1, wazuh)
- [CVE-2026-77358](https://cve.now/CVE-2026-77358.md): cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown\_and\_close() (CVSS 8.2, yhirose cpp-httplib)
- [CVE-2026-81848](https://cve.now/CVE-2026-81848.md): cyberchitta scrapling-fetch-mcp \_fetcher.py s\_fetch\_pattern server-side request forgery (CVSS 5.1, cyberchitta scrapling-fetch-mcp)
- [CVE-2026-17610](https://cve.now/CVE-2026-17610.md): RAIL 802.15.4 Mux missing ACK can lead to DoS (CVSS 6.0, Silicon Labs SiSDK)
- [CVE-2026-77341](https://cve.now/CVE-2026-77341.md): cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing (CVSS 5.3, yhirose cpp-httplib)
- [CVE-2026-81847](https://cve.now/CVE-2026-81847.md): MAA-AI MaaMCP pipeline\_tools.py load\_pipeline path traversal (CVSS 5.1, MAA-AI MaaMCP)
- [CVE-2026-5706](https://cve.now/CVE-2026-5706.md): Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements (CVSS 8.9, Silicon Labs BT Mesh SDK)
- [CVE-2026-44629](https://cve.now/CVE-2026-44629.md): Improper access control to the Synergis Softwire installation folder. (CVSS 7.9, Genetec Synergis Softwire)
- [CVE-2026-77977](https://cve.now/CVE-2026-77977.md): Ebyte NA111-M Missing Authentication for Critical Function (CVSS 8.1, Ebyte NA111-M Firmware)
- [CVE-2026-76943](https://cve.now/CVE-2026-76943.md): Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Xiiaozet LK100W)
- [CVE-2026-78239](https://cve.now/CVE-2026-78239.md): Xiiaozet LK100W Missing Authentication for Critical Function (CVSS 9.8, Xiiaozet LK100W)
- [CVE-2026-78037](https://cve.now/CVE-2026-78037.md): Xiiaozet LK100W OS Command Injection (CVSS 8.8, Xiiaozet LK100W)
- [CVE-2026-81845](https://cve.now/CVE-2026-81845.md): arben-adm mcp-sequential-thinking Import Session/Export Session server.py export\_session path traversal (CVSS 5.3, arben-adm mcp-sequential-thinking)
- [CVE-2026-69658](https://cve.now/CVE-2026-69658.md): Ebyte NA111-M Cleartext Transmission of Sensitive Information (CVSS 9.8, Ebyte NA111-M Firmware)
- [CVE-2026-76945](https://cve.now/CVE-2026-76945.md): Ebyte NE2-D11 Use of Client-Side Authentication (CVSS 7.5, Ebyte NE2-D11 Firmware)
- [CVE-2026-75813](https://cve.now/CVE-2026-75813.md): Ebyte NE2-D11 Missing Authorization (CVSS 7.5, Ebyte NE2-D11 Firmware)
- [CVE-2026-75548](https://cve.now/CVE-2026-75548.md): Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames (CVSS 5.4, Ebyte NA111-M Firmware)
- [CVE-2026-81837](https://cve.now/CVE-2026-81837.md): RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal (CVSS 5.3, RooCodeInc Roo-Code)
- [CVE-2026-76940](https://cve.now/CVE-2026-76940.md): Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts (CVSS 7.5, Ebyte NA111-M Firmware)
- [CVE-2026-75814](https://cve.now/CVE-2026-75814.md): Ebyte NA111-M Cross-Site Request Forgery (CVSS 8.8, Ebyte NA111-M Firmware)
- [CVE-2026-76179](https://cve.now/CVE-2026-76179.md): Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings (CVSS 9.8, Ebyte NA111-M Firmware)
- [CVE-2026-71187](https://cve.now/CVE-2026-71187.md): Ebyte NA111-M Use of Client-Side Authentication (CVSS 9.8, Ebyte NA111-M Firmware)
- [CVE-2026-73839](https://cve.now/CVE-2026-73839.md): Ebyte NE2-D11 Insufficiently Protected Credentials (CVSS 4.6, Ebyte NE2-D11 Firmware)
- [CVE-2026-73809](https://cve.now/CVE-2026-73809.md): Ebyte NA111-M Cleartext Transmission of Sensitive Information (CVSS 7.5, Ebyte NA111-M Firmware)
- [CVE-2026-81836](https://cve.now/CVE-2026-81836.md): RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission (CVSS 6.3, RooCodeInc Roo-Code)
- [CVE-2026-80179](https://cve.now/CVE-2026-80179.md): Jwcrypto: jwcrypto: denial of service via malformed jwe tokens (CVSS 5.9, Red Hat Ansible Automation Platform · Red Hat Enterprise… +2)
- [CVE-2026-73125](https://cve.now/CVE-2026-73125.md): Ebyte NA111-M Missing Authentication for Critical Function (CVSS 9.8, Ebyte NA111-M Firmware)
- [CVE-2026-54330](https://cve.now/CVE-2026-54330.md): Ceph RGW SigV4 handler accepts unsigned x-amz-\* headers on presigned requests, allowing privilege escalation (CVSS 8.1, ceph)
- [CVE-2026-67560](https://cve.now/CVE-2026-67560.md): Stack-based Buffer Overflow in Bendix EC80 Brake ECU (CVSS 7.5, Bendix EC80ESP+ J1708 · Bendix EC80ESP+ 6S/6M +8)
- [CVE-2026-50152](https://cve.now/CVE-2026-50152.md): Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users (CVSS 9.1, ceph)
- [CVE-2026-68967](https://cve.now/CVE-2026-68967.md): Out-of-bounds Write in Bendix EC80 Brake ECU (CVSS 6.5, Bendix EC80ESP+ J1708 · Bendix EC80ESP+ 6S/6M +8)
- [CVE-2026-39944](https://cve.now/CVE-2026-39944.md): Ceph: CephX AES Authentication error (CVSS 8.8, ceph)
- [CVE-2026-71396](https://cve.now/CVE-2026-71396.md): Use of Hard-coded Credentials in Bendix EC80 Brake ECU (CVSS 5.4, Bendix EC80ESP+ J1708 · Bendix EC80ESP+ 6S/6M +8)
- [CVE-2026-81835](https://cve.now/CVE-2026-81835.md): RooCodeInc Roo-Code MCP Integration Trust Model malicious\_mcp\_server.py fetch\_instructions code injection (CVSS 5.1, RooCodeInc Roo-Code)
- [CVE-2025-30156](https://cve.now/CVE-2025-30156.md): Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery (CVSS 8.9, ceph)
- [CVE-2026-18965](https://cve.now/CVE-2026-18965.md): Missing Authorization in PayRange API (CVSS 8.8, PayRange API)
- [CVE-2026-76060](https://cve.now/CVE-2026-76060.md): OS Command Injection in PayRange API (CVSS 8.8, Zoneminder)
- [CVE-2026-68929](https://cve.now/CVE-2026-68929.md): FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization (CVSS 9.3, labring FastGPT)
- [CVE-2026-18717](https://cve.now/CVE-2026-18717.md): Improper Certificate Validation in ASE 2000 (CVSS 7.4, Applied Systems Engineering ASE2000)
- [CVE-2026-81731](https://cve.now/CVE-2026-81731.md): Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description (CVSS 5.1, frappe)
- [CVE-2026-81730](https://cve.now/CVE-2026-81730.md): Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename (CVSS 8.8, dolibarr)
- [CVE-2026-81729](https://cve.now/CVE-2026-81729.md): Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion (CVSS 7.1, dolibarr)
- [CVE-2026-81728](https://cve.now/CVE-2026-81728.md): Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys (CVSS 8.6, dolibarr)
- [CVE-2026-81838](https://cve.now/CVE-2026-81838.md): Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac) (CVSS 6.8, aws diagram-as-code)
- [CVE-2026-81834](https://cve.now/CVE-2026-81834.md): RooCodeInc Roo-Code README File ExecaTerminalProcess code injection (CVSS 5.3, RooCodeInc Roo-Code)
- [CVE-2026-77438](https://cve.now/CVE-2026-77438.md): Trilium unauthenticated share-search discloses password-protected and hidden shared notes (CVSS 7.5, TriliumNext Trilium)
- [CVE-2026-53580](https://cve.now/CVE-2026-53580.md): Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature (CVSS 8.1, TriliumNext Trilium)
- [CVE-2026-81833](https://cve.now/CVE-2026-81833.md): RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection (CVSS 5.1, RooCodeInc Roo-Code)
- [CVE-2026-81934](https://cve.now/CVE-2026-81934.md): Redis TLS pending-data list use-after-free (CVSS 7.1, Redis)
- [CVE-2026-10036](https://cve.now/CVE-2026-10036.md): SpeechBrain \< 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing (CVSS 8.7, speechbrain)
- [CVE-2026-81931](https://cve.now/CVE-2026-81931.md): Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting (CVSS 4.8, Roskus Prospero Flow CRM)
- [CVE-2026-53579](https://cve.now/CVE-2026-53579.md): Trilium: Note Import to RCE via Book Note (CVSS 9.3, TriliumNext Trilium)
- [CVE-2026-53578](https://cve.now/CVE-2026-53578.md): Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml (CVSS 9.3, TriliumNext Trilium)
- [CVE-2026-18374](https://cve.now/CVE-2026-18374.md): Passing an effectively empty string to the \`,ccs=\` syntax extension of the mode argument in the \`fopen\` function in the GNU C Library versio (CVSS 4.9, The GNU C Library glibc)
- [CVE-2026-74820](https://cve.now/CVE-2026-74820.md): Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause (CVSS 10.0, ServiceNow AI Platform)
- [CVE-2026-18886](https://cve.now/CVE-2026-18886.md): Unauthenticated Privilege Escalation via System Configuration Image Upload Processor (CVSS 10.0, ServiceNow AI Platform)
- [CVE-2026-18885](https://cve.now/CVE-2026-18885.md): Unauthenticated Remote Code Execution in GraphQL Composite Data API (CVSS 10.0, ServiceNow AI Platform)
- [CVE-2026-6876](https://cve.now/CVE-2026-6876.md): Sandbox Escape in ServiceNow AI Platform (CVSS 10.0, ServiceNow AI Platform)
- [CVE-2026-81893](https://cve.now/CVE-2026-81893.md): Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery (CVSS 4.7, Red Hat Enterprise Linux)
- [CVE-2026-34616](https://cve.now/CVE-2026-34616.md): DNG SDK | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-34620](https://cve.now/CVE-2026-34620.md): DNG SDK | Out-of-bounds Write (CWE-787) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-81530](https://cve.now/CVE-2026-81530.md): KMS master key exposure via unredacted credential serialization in driver settings string (CVSS 6.8, MongoDB C# Driver)
- [CVE-2026-81529](https://cve.now/CVE-2026-81529.md): Connection-option injection via unescaped settings in the canonical MongoDB URL builder (CVSS 7.1, MongoDB C# Driver)
- [CVE-2026-81528](https://cve.now/CVE-2026-81528.md): NoSQL injection via array replacement bypassing update shape validation in driver write path (CVSS 5.3, MongoDB C# Driver)
- [CVE-2026-81527](https://cve.now/CVE-2026-81527.md): NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation (CVSS 6.9, MongoDB C# Driver)
- [CVE-2026-81526](https://cve.now/CVE-2026-81526.md): Cross-database write redirection via unvalidated dotted database name in bulk write namespaces (CVSS 7.1, MongoDB Rust Driver)
- [CVE-2026-81525](https://cve.now/CVE-2026-81525.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver (CVSS 8.6, MongoDB PHP Library · MongoDB PHP Extension +1)
- [CVE-2026-81524](https://cve.now/CVE-2026-81524.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver (CVSS 5.3, MongoDB C Driver)
- [CVE-2026-81523](https://cve.now/CVE-2026-81523.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt (CVSS 2.0, MongoDB libmongocrypt)
- [CVE-2026-81522](https://cve.now/CVE-2026-81522.md): Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver (CVSS 8.6, MongoDB C++ Driver)
- [CVE-2026-81521](https://cve.now/CVE-2026-81521.md): Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver (CVSS 7.1, MongoDB GO Driver)
- [CVE-2026-59324](https://cve.now/CVE-2026-59324.md): fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction (CVSS 8.2, Spring Integration)
- [CVE-2026-59322](https://cve.now/CVE-2026-59322.md): EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders (CVSS 6.3, Spring Integration)
- [CVE-2026-59321](https://cve.now/CVE-2026-59321.md): Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check (CVSS 4.2, Spring Integration)
- [CVE-2026-59320](https://cve.now/CVE-2026-59320.md): In Spring AMQP the link credit never replenished on listener exception path (CVSS 6.5, Spring AMQP)
- [CVE-2026-59319](https://cve.now/CVE-2026-59319.md): RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure (CVSS 4.3, Spring AI)
- [CVE-2026-59317](https://cve.now/CVE-2026-59317.md): In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loop (CVSS 6.5, Spring for Apache Kafka)
- [CVE-2026-59316](https://cve.now/CVE-2026-59316.md): Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) (CVSS 8.2, Spring Authorization Server)
- [CVE-2026-59315](https://cve.now/CVE-2026-59315.md): Spring Cloud Config Monitor Denial of Service (CVSS 5.3, Spring Cloud Config)
- [CVE-2026-59314](https://cve.now/CVE-2026-59314.md): Spring Framework response splitting in ContentDisposition (CVSS 3.7, Spring Framework)
- [CVE-2026-59311](https://cve.now/CVE-2026-59311.md): Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation (CVSS 6.8, Spring Integration)
- [CVE-2026-59306](https://cve.now/CVE-2026-59306.md): Potential for deserialization of untrusted types in Spring Cloud Stream (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59313](https://cve.now/CVE-2026-59313.md): Server Sent Event stream corruption in Spring MVC functional web framework (CVSS 9.8, Spring Framework)
- [CVE-2026-59307](https://cve.now/CVE-2026-59307.md): Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference (CVSS 8.0, Spring Integration)
- [CVE-2026-59305](https://cve.now/CVE-2026-59305.md): Partition interceptor may be improperly added while sending message (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59304](https://cve.now/CVE-2026-59304.md): Improper caching of the original content type in Spring Cloud Stream Avro (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59303](https://cve.now/CVE-2026-59303.md): Dynamic destination cache size is not properly bound in Spring Cloud Stream (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59302](https://cve.now/CVE-2026-59302.md): Potential for logging sensitive data in Spring Cloud Stream (CVSS 3.1, Spring Cloud Stream)
- [CVE-2026-59301](https://cve.now/CVE-2026-59301.md): Potential for logging sensitive data in Spring Cloud Function Azure (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59300](https://cve.now/CVE-2026-59300.md): Potential for logging sensitive data in Spring Cloud Function AWS (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59299](https://cve.now/CVE-2026-59299.md): Composition lookup can potentially poison base function in Spring Cloud Function (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59298](https://cve.now/CVE-2026-59298.md): Potential for improper filtering of HTTP headers in Spring Cloud Function (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59297](https://cve.now/CVE-2026-59297.md): Spring Cloud Function can incorrectly determine if URI is secure (CVSS 3.1, Spring Cloud Function)
- [CVE-2026-59294](https://cve.now/CVE-2026-59294.md): Arbitrary File Write via Path Traversal in ResourceCacheService (CVSS 5.9, Spring AI)
- [CVE-2026-59293](https://cve.now/CVE-2026-59293.md): SMB minimum protocol dialect defaults to SMB1 (CVSS 6.6, Spring Integration)
- [CVE-2026-59292](https://cve.now/CVE-2026-59292.md): World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) (CVSS 3.2, Spring Integration)
- [CVE-2026-59291](https://cve.now/CVE-2026-59291.md): Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function (CVSS 2.0, Spring Cloud Function)
- [CVE-2026-59289](https://cve.now/CVE-2026-59289.md): Spring for GraphQL Denial of Service via pagination support (CVSS 7.5, Spring for GraphQL)
- [CVE-2026-59288](https://cve.now/CVE-2026-59288.md): Spring for GraphQL Information Exposure in GraphiQL support (CVSS 7.5, Spring for GraphQL)
- [CVE-2026-59287](https://cve.now/CVE-2026-59287.md): Spring for GraphQL WebSocket Client Denial of Service (CVSS 5.9, Spring for GraphQL)
- [CVE-2026-59286](https://cve.now/CVE-2026-59286.md): Spring for GraphQL loads Untrusted Resources in GraphiQL support (CVSS 8.1, Spring for GraphQL)
- [CVE-2026-59285](https://cve.now/CVE-2026-59285.md): Spring for GraphQL Unsafe Deserialization in pagination support (CVSS 8.1, Spring for GraphQL)
- [CVE-2026-59284](https://cve.now/CVE-2026-59284.md): Spring Cloud Commons no allow list for writable env actuator endpoint (CVSS 6.6, Spring Cloud Commons)
- [CVE-2026-59283](https://cve.now/CVE-2026-59283.md): Spring Framework Safety Guard Bypass via SpEL Expression Compilation (CVSS 9.1, Spring Framework)
- [CVE-2026-59282](https://cve.now/CVE-2026-59282.md): Spring Framework Denial of Service via Unbounded List Growth in Data Binding (CVSS 7.5, Spring Framework)
- [CVE-2026-59281](https://cve.now/CVE-2026-59281.md): Spring Framework Cross-site Scripting via EscapedErrors (CVSS 6.1, Spring Framework)
- [CVE-2026-59277](https://cve.now/CVE-2026-59277.md): Spring Security InetAddressMatchers Incomplete Internal Network Classification (CVSS 3.7, Spring Security)
- [CVE-2026-59276](https://cve.now/CVE-2026-59276.md): Timing Attack via Non-Constant-Time Comparison of Sensitive Values (CVSS 5.9, Spring Security)
- [CVE-2026-4398](https://cve.now/CVE-2026-4398.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-76640](https://cve.now/CVE-2026-76640.md): Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack (CVSS 7.7, Unitree Robotics G1 EDU)
- [CVE-2026-76639](https://cve.now/CVE-2026-76639.md): Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal (CVSS 8.7, Unitree Robotics G1 EDU)
- [CVE-2026-65931](https://cve.now/CVE-2026-65931.md): LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint (CVSS 5.1, LimeSurvey)
- [CVE-2026-48996](https://cve.now/CVE-2026-48996.md): Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client (CVSS 9.3, TriliumNext Trilium)
- [CVE-2026-75889](https://cve.now/CVE-2026-75889.md): CVE-2026-75889 CVE Record (CVSS 7.7, Grafana Alloy)
- [CVE-2026-54732](https://cve.now/CVE-2026-54732.md): libreoffice-convert: path traversal / arbitrary file write (CVSS 6.5, elwerene libreoffice-convert · libreoffice-convert)
- [CVE-2026-54718](https://cve.now/CVE-2026-54718.md): Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template (CVSS 7.2, silverstripe-advancedworkflow · symbiote/silverstripe-advan…)
- [CVE-2026-55758](https://cve.now/CVE-2026-55758.md): CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection (CVSS 6.9, CC-Tweaked)
- [CVE-2026-54687](https://cve.now/CVE-2026-54687.md): n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db\_path parameter) (CVSS 6.1, DangerBlack n8n-node-sqlite3 · n8n-nodes-sqlite3)
- [CVE-2026-19092](https://cve.now/CVE-2026-19092.md): Tutor LMS \< 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing (CVSS 9.8, Tutor LMS)
- [CVE-2026-54713](https://cve.now/CVE-2026-54713.md): CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions (CVSS 3.7, cakephp queue · cakephp/queue)
- [CVE-2026-25250](https://cve.now/CVE-2026-25250.md): EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable." (CVSS 6.0, eazsolution EazyFix)
- [CVE-2026-54721](https://cve.now/CVE-2026-54721.md): Silverstripe UserForms: Remote code execution via userforms email subject (CVSS 8.8, silverstripe-userforms · silverstripe/userforms)
- [CVE-2026-47727](https://cve.now/CVE-2026-47727.md): Trilium: RCE via \`shareTemplate\` relation missing \`isDangerous\` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668) (CVSS 8.6, TriliumNext Trilium)
- [CVE-2026-66353](https://cve.now/CVE-2026-66353.md): Doggo vulnerable to cross-site scripting via unescaped date field values (CVSS 5.3, woylie doggo)
- [CVE-2026-59280](https://cve.now/CVE-2026-59280.md): Spring Framework Path Traversal via Backslash in SpringTemplateLoader (CVSS 4.3, Spring Framework)
- [CVE-2026-59272](https://cve.now/CVE-2026-59272.md): Log4j2 AmqpAppender disables TLS hostname verification by default (CVSS 6.8, Spring AMQP)
- [CVE-2026-79720](https://cve.now/CVE-2026-79720.md): Reflected XSS in Netron versions \<=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, per (CVSS 6.8, Netron)
- [CVE-2026-79719](https://cve.now/CVE-2026-79719.md): Reflected XSS in Netron versions \<=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, per (CVSS 6.8, Netron)
- [CVE-2026-79718](https://cve.now/CVE-2026-79718.md): Reflected XSS in Netron versions \<=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, per (CVSS 6.8, Netron)
- [CVE-2026-19854](https://cve.now/CVE-2026-19854.md): CVE-2026-19854 CVE Record (CVSS 6.1, Grafana Clickhouse Datasource)
- [CVE-2026-75871](https://cve.now/CVE-2026-75871.md): Server-Side Request Forgery (SSRF) in GitLab AI Gateway (CVSS 8.2, GitLab AI Gateway)
- [CVE-2026-19889](https://cve.now/CVE-2026-19889.md): Server-Side Request Forgery (SSRF) in GitLab AI Gateway (CVSS 8.2, GitLab AI Gateway)
- [CVE-2026-5680](https://cve.now/CVE-2026-5680.md): Undertow-core: undertow: denial of service via websocket permessage-deflate processing (CVSS 7.5, Red Hat JBoss Enterprise Application Platform 8.1.8.GA ·… +8)
- [CVE-2026-78002](https://cve.now/CVE-2026-78002.md): Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Update Infrastructure)
- [CVE-2026-75573](https://cve.now/CVE-2026-75573.md): MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied (CVSS 4.1, MongoDB BI Connector)
- [CVE-2026-75159](https://cve.now/CVE-2026-75159.md): MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination (CVSS 8.2, MongoDB BI Connector)
- [CVE-2026-34674](https://cve.now/CVE-2026-34674.md): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance 3D Sampler)
- [CVE-2026-79988](https://cve.now/CVE-2026-79988.md): Authenticated RCE through Twig sandbox escape (CVSS 8.7, craftcms cms)
- [CVE-2026-71402](https://cve.now/CVE-2026-71402.md): wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length (CVSS 5.3, SUSE wicked)
- [CVE-2026-71401](https://cve.now/CVE-2026-71401.md): wicked: integer underflow of the UDP length in ni\_capture\_inspect\_udp\_header() leads to an out-of-bounds read (CVSS 5.3, SUSE wicked)
- [CVE-2026-81735](https://cve.now/CVE-2026-81735.md): UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution (CVSS 10.0, bytedance UI-TARS-desktop)
- [CVE-2026-81727](https://cve.now/CVE-2026-81727.md): NLTK before 3.10.3 Hardlink File Overwrite via downloader (CVSS 6.9, nltk)
- [CVE-2026-81726](https://cve.now/CVE-2026-81726.md): NLTK through 3.10.3 Path Traversal via Model-Artifact APIs (CVSS 8.3, nltk)
- [CVE-2026-81725](https://cve.now/CVE-2026-81725.md): NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader (CVSS 6.3, nltk)
- [CVE-2026-81724](https://cve.now/CVE-2026-81724.md): NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion (CVSS 6.9, nltk)
- [CVE-2026-81723](https://cve.now/CVE-2026-81723.md): NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView (CVSS 6.3, nltk)
- [CVE-2026-81722](https://cve.now/CVE-2026-81722.md): nltk PorterStemmer before 3.10.3 Quadratic-time DoS (CVSS 8.7, nltk)
- [CVE-2026-81721](https://cve.now/CVE-2026-81721.md): openssl\_encrypt before 1.4.9 Denial of Service via KDF (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81720](https://cve.now/CVE-2026-81720.md): openssl\_encrypt before 1.4.9 Denial of Service via Unbounded Argon2 (CVSS 6.9, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81719](https://cve.now/CVE-2026-81719.md): openssl\_encrypt before 1.4.9 Remote Code Execution via Plugin (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81718](https://cve.now/CVE-2026-81718.md): openssl\_encrypt before 1.4.9 Weak Cryptographic Parameters (CVSS 8.7, jahlives openssl\_encrypt)
- [CVE-2026-81717](https://cve.now/CVE-2026-81717.md): openssl\_encrypt before 1.4.9 Integrity Bypass via Added Files (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81716](https://cve.now/CVE-2026-81716.md): openssl\_encrypt before 1.4.9 Plugin Sandbox Path Traversal (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81715](https://cve.now/CVE-2026-81715.md): openssl\_encrypt before 1.4.9 Credential Exposure via Debug Output (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81714](https://cve.now/CVE-2026-81714.md): openssl\_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81707](https://cve.now/CVE-2026-81707.md): openssl\_encrypt before 1.4.9 ANSI Escape Injection via Identity Email (CVSS 9.3, jahlives openssl\_encrypt)
- [CVE-2026-81706](https://cve.now/CVE-2026-81706.md): openssl\_encrypt before 1.4.9 Key Substitution via Identity Shadowing (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81705](https://cve.now/CVE-2026-81705.md): openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81704](https://cve.now/CVE-2026-81704.md): openssl\_encrypt before 1.4.9 Weak Key Derivation via D-Bus (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81703](https://cve.now/CVE-2026-81703.md): openssl\_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81702](https://cve.now/CVE-2026-81702.md): openssl\_encrypt before 1.4.9 Key Substitution via Identity Load (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81701](https://cve.now/CVE-2026-81701.md): openssl\_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81700](https://cve.now/CVE-2026-81700.md): openssl\_encrypt before 1.4.9 GPG Signature Verification Bypass (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81699](https://cve.now/CVE-2026-81699.md): openssl\_encrypt before 1.4.9 Denial of Service via unbounded KDF cost (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81698](https://cve.now/CVE-2026-81698.md): openssl\_encrypt before 1.4.9 Shell Injection via info command (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81697](https://cve.now/CVE-2026-81697.md): openssl\_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration (CVSS 8.7, jahlives openssl\_encrypt)
- [CVE-2026-81696](https://cve.now/CVE-2026-81696.md): openssl\_encrypt before 1.4.9 Terminal Injection via info Command (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81695](https://cve.now/CVE-2026-81695.md): openssl\_encrypt before 1.4.9 Terminal Injection via key\_id (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81694](https://cve.now/CVE-2026-81694.md): openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81693](https://cve.now/CVE-2026-81693.md): openssl\_encrypt before 1.4.9 Denial of Service via QR total field (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81692](https://cve.now/CVE-2026-81692.md): openssl\_encrypt before 1.4.9 Denial of Service via STREAMINFO (CVSS 8.7, jahlives openssl\_encrypt)
- [CVE-2026-81691](https://cve.now/CVE-2026-81691.md): openssl\_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81690](https://cve.now/CVE-2026-81690.md): verify-usb before 1.4.9 Symlink Directory Traversal Code Execution (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81689](https://cve.now/CVE-2026-81689.md): openssl\_encrypt before 1.4.9 Weak Pepper Key Derivation (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81688](https://cve.now/CVE-2026-81688.md): openssl\_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 (CVSS 8.7, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81687](https://cve.now/CVE-2026-81687.md): openssl\_encrypt before 1.4.9 Denial of Service via KDF (CVSS 8.7, jahlives openssl\_encrypt)
- [CVE-2026-81686](https://cve.now/CVE-2026-81686.md): openssl\_encrypt before 1.4.9 D-Bus Properties Authorization Bypass (CVSS 6.9, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81685](https://cve.now/CVE-2026-81685.md): openssl\_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81684](https://cve.now/CVE-2026-81684.md): openssl\_encrypt before 1.4.9 Information Disclosure via Command Line (CVSS 6.9, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81683](https://cve.now/CVE-2026-81683.md): openssl\_encrypt before 1.4.9 Plaintext Private Key Storage (CVSS 8.6, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81682](https://cve.now/CVE-2026-81682.md): openssl\_encrypt before 1.4.9 Insecure File Permissions (CVSS 8.6, jahlives openssl\_encrypt)
- [CVE-2026-81681](https://cve.now/CVE-2026-81681.md): openssl\_encrypt before 1.4.9 False Encryption via Cleartext Storage (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81680](https://cve.now/CVE-2026-81680.md): openssl\_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal (CVSS 9.3, jahlives openssl\_encrypt · openssl-encrypt)
- [CVE-2026-81679](https://cve.now/CVE-2026-81679.md): OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API (CVSS 8.3, openremote)
- [CVE-2026-81678](https://cve.now/CVE-2026-81678.md): AVideo SSRF Guard Bypass via IPv6 Transition Addresses (CVSS 6.9, WWBN AVideo)
- [CVE-2026-81664](https://cve.now/CVE-2026-81664.md): OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route (CVSS 6.9, openfaas faas)
- [CVE-2026-81335](https://cve.now/CVE-2026-81335.md): Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources (CVSS 8.7, Baserow)
- [CVE-2026-81334](https://cve.now/CVE-2026-81334.md): darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser (CVSS 6.9, hank-ai darknet)
- [CVE-2026-81102](https://cve.now/CVE-2026-81102.md): Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation (CVSS 2.3, dropbox mcp-server-dash)
- [CVE-2026-81101](https://cve.now/CVE-2026-81101.md): Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint (CVSS 6.9, airtable-mcp-cli)
- [CVE-2026-81100](https://cve.now/CVE-2026-81100.md): Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List (CVSS 7.6, timescale tiger-gh-mcp-server)
- [CVE-2026-81099](https://cve.now/CVE-2026-81099.md): Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List (CVSS 7.6, timescale tiger-slack)
- [CVE-2026-81098](https://cve.now/CVE-2026-81098.md): Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport (CVSS 9.3, team-telnyx telnyx-mcp)
- [CVE-2026-81097](https://cve.now/CVE-2026-81097.md): rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute\_ruby PTY Escape (CVSS 8.6, maquina-app rails-mcp-server)
- [CVE-2026-81096](https://cve.now/CVE-2026-81096.md): ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python\_code\_executor Sandbox Escape (CVSS 9.3, mims-harvard ToolUniverse)
- [CVE-2026-81095](https://cve.now/CVE-2026-81095.md): Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List (CVSS 7.6, timescale pg-aiguide)
- [CVE-2026-81094](https://cve.now/CVE-2026-81094.md): mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication (CVSS 9.3, mcp-router)
- [CVE-2026-81093](https://cve.now/CVE-2026-81093.md): Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton (CVSS 8.7, apify actors-mcp-server)
- [CVE-2026-81092](https://cve.now/CVE-2026-81092.md): mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding (CVSS 7.6, mark3labs mcp-go)
- [CVE-2026-81091](https://cve.now/CVE-2026-81091.md): mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL (CVSS 8.7, mcp-use)
- [CVE-2026-80211](https://cve.now/CVE-2026-80211.md): FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage (CVSS 8.2, FrontAccounting)
- [CVE-2026-80210](https://cve.now/CVE-2026-80210.md): FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms (CVSS 7.1, FrontAccounting)
- [CVE-2026-80209](https://cve.now/CVE-2026-80209.md): Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler (CVSS 5.3, fonoster)
- [CVE-2026-80208](https://cve.now/CVE-2026-80208.md): APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints (CVSS 8.8, apitable)
- [CVE-2026-80207](https://cve.now/CVE-2026-80207.md): APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint (CVSS 6.9, apitable)
- [CVE-2026-64896](https://cve.now/CVE-2026-64896.md): T2000 open debug port (CVSS 5.2, Johnson Controls T2000)
- [CVE-2026-80213](https://cve.now/CVE-2026-80213.md): An issue was discovered in the resolv gem before 0.7.2 for Ruby. (CVSS 4.0, Ruby resolv)
- [CVE-2026-80212](https://cve.now/CVE-2026-80212.md): An issue was discovered in the resolv gem before 0.7.2 for Ruby. (CVSS 7.5, Ruby resolv)
- [CVE-2026-16279](https://cve.now/CVE-2026-16279.md): Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x (CVSS 9.3, Dassault Systèmes 3DSwymer)
- [CVE-2026-57499](https://cve.now/CVE-2026-57499.md): Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE) (CVSS 9.1, limanmys core)
- [CVE-2026-11754](https://cve.now/CVE-2026-11754.md): User Enumeration in Seres Software's syWEB (CVSS 5.3, Seres Software syWEB)
- [CVE-2026-11747](https://cve.now/CVE-2026-11747.md): Reflected XSS in Seres Software's syWEB (CVSS 6.1, Seres Software syWEB)
- [CVE-2026-81827](https://cve.now/CVE-2026-81827.md): Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input (CVSS 6.9, flowintel)
- [CVE-2026-81826](https://cve.now/CVE-2026-81826.md): Flowintel Fails to Invalidate Active Sessions After Password Change (CVSS 9.1, flowintel)
- [CVE-2026-81820](https://cve.now/CVE-2026-81820.md): Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes (CVSS 5.1, flowintel)
- [CVE-2026-79653](https://cve.now/CVE-2026-79653.md): In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key ena (CVSS 6.0, Eclipse Foundation Eclipse SW360)
- [CVE-2026-56651](https://cve.now/CVE-2026-56651.md): Arbitrary File Overwrite via Symlink Following in dool project (CVSS 2.0, scottchiefbaker dool)
- [CVE-2026-56652](https://cve.now/CVE-2026-56652.md): Formula Injection in dool project (CVSS 4.6, scottchiefbaker dool)
- [CVE-2026-81819](https://cve.now/CVE-2026-81819.md): Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments (CVSS 5.3, flowintel)
- [CVE-2026-5738](https://cve.now/CVE-2026-5738.md): Reflected XSS in BilPark's DoXBASE (CVSS 6.1, BilPark Informatics Technologies Industry and Trade DoXBASE)
- [CVE-2026-81818](https://cve.now/CVE-2026-81818.md): Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges (CVSS 8.6, flowintel)
- [CVE-2026-40526](https://cve.now/CVE-2026-40526.md): Volmarg Personal Management System Path Traversal via get-file Endpoint (CVSS 7.1, Volmarg personal-management-system)
- [CVE-2025-62343](https://cve.now/CVE-2025-62343.md): HCL IntelliOps Event Management is affected by multiple security vulnerabilities. (CVSS 3.1, HCL Software HCL IEM)
- [CVE-2025-62342](https://cve.now/CVE-2025-62342.md): HCL IntelliOps Event Management is affected by multiple security vulnerabilities. (CVSS 6.4, HCL Software IEM)
- [CVE-2026-81817](https://cve.now/CVE-2026-81817.md): Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification (CVSS 7.2, flowintel)
- [CVE-2026-81814](https://cve.now/CVE-2026-81814.md): Flowintel Stored XSS in Calendar via Malicious Case Title (CVSS 5.1, flowintel)
- [CVE-2026-81677](https://cve.now/CVE-2026-81677.md): Multiple Vulnerabilities in TOOOLS' iSquad (CVSS 8.8, TOOOLS iSquad)
- [CVE-2026-81676](https://cve.now/CVE-2026-81676.md): Multiple Vulnerabilities in TOOOLS' iSquad (CVSS 8.8, TOOOLS iSquad)
- [CVE-2026-81675](https://cve.now/CVE-2026-81675.md): Multiple Vulnerabilities in TOOOLS' iSquad (CVSS 9.3, TOOOLS iSquad)
- [CVE-2026-81674](https://cve.now/CVE-2026-81674.md): Multiple Vulnerabilities in TOOOLS' iSquad (CVSS 9.3, TOOOLS iSquad)
- [CVE-2026-81753](https://cve.now/CVE-2026-81753.md): Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content (CVSS 5.1, flowintel)
- [CVE-2026-81673](https://cve.now/CVE-2026-81673.md): Multiple Vulnerabilities in TOOOLS' iSquad (CVSS 9.3, TOOOLS iSquad)
- [CVE-2026-81743](https://cve.now/CVE-2026-81743.md): Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection (CVSS 7.5, flowintel)
- [CVE-2026-66155](https://cve.now/CVE-2026-66155.md): A vulnerability has been identified in Element maps-ng V47 (All versions \< V47.12.3), Element maps-ng V48 (All versions \< V48.11.3), Element (CVSS 7.6, Siemens Element maps-ng)
- [CVE-2026-81672](https://cve.now/CVE-2026-81672.md): Multiple Vulnerabilities in TOOOLS' iSquad (CVSS 9.3, TOOOLS iSquad)
- [CVE-2026-81562](https://cve.now/CVE-2026-81562.md): AlexGladkov claude-in-mobile client.ts execSync os command injection (CVSS 4.8, AlexGladkov claude-in-mobile)
- [CVE-2026-81668](https://cve.now/CVE-2026-81668.md): Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup (CVSS 5.4, Red Hat Satellite)
- [CVE-2026-5218](https://cve.now/CVE-2026-5218.md): HTML Injection in Softtr's E-Commerce Pack (CVSS 4.3, Softtr Informatics Technology Trading Limited Company E-Com…)
- [CVE-2026-17562](https://cve.now/CVE-2026-17562.md): IDOR in Zirve Security's AdisyonPro (CVSS 6.5, Summit Security Systems AdisyonPro)
- [CVE-2026-74233](https://cve.now/CVE-2026-74233.md): Zbtlink MQWrt infosrvd Command Injection (CVSS 9.3, Zbtlink WE1326 · Zbtlink WE2426-C +14)
- [CVE-2026-74232](https://cve.now/CVE-2026-74232.md): Zbtlink MQWrt yunmgrd Cloud C2 Implant (CVSS 9.3, Zbtlink L3\_V2\_8 · Zbtlink WE826-T2 +13)
- [CVE-2026-81560](https://cve.now/CVE-2026-81560.md): blackms aistack Static File server.ts path traversal (CVSS 6.9, blackms aistack)
- [CVE-2026-81662](https://cve.now/CVE-2026-81662.md): Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys (CVSS 8.6, flowintel)
- [CVE-2026-81658](https://cve.now/CVE-2026-81658.md): Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup (CVSS 6.5, Red Hat Satellite)
- [CVE-2026-81659](https://cve.now/CVE-2026-81659.md): Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing (CVSS 7.1, flowintel)
- [CVE-2026-74848](https://cve.now/CVE-2026-74848.md): Apache APISIX: Cross-user response poisoning in serverless plugins (CVSS 7.0, Apache Software Foundation Apache APISIX)
- [CVE-2026-75005](https://cve.now/CVE-2026-75005.md): Apache APISIX: Unauthenticated CPU-exhaustion DoS (CVSS 8.7, Apache Software Foundation Apache APISIX)
- [CVE-2026-75020](https://cve.now/CVE-2026-75020.md): Apache APISIX: ldap-auth plugin cross-subtree identity impersonation (CVSS 7.0, Apache Software Foundation Apache APISIX)
- [CVE-2026-81625](https://cve.now/CVE-2026-81625.md): Stack buffer overflow in Greenbone OS and openvas-scanner (CVSS 8.7, Greenbone OS · greenbone openvas-scanner)
- [CVE-2026-81277](https://cve.now/CVE-2026-81277.md): WordPress Suggestion Engine for WooCommerce plugin \<= 2.0.11 - SQL Injection vulnerability (CVSS 8.5, VillaTheme Suggestion Engine for WooCommerce)
- [CVE-2026-81276](https://cve.now/CVE-2026-81276.md): WordPress Kali Forms plugin \<= 2.4.23 - Broken Access Control vulnerability (CVSS 5.3, WP Chill Kali Forms)
- [CVE-2026-81274](https://cve.now/CVE-2026-81274.md): WordPress Ditty plugin \<= 3.1.67 - Broken Access Control vulnerability (CVSS 5.3, metaphorcreations Ditty)
- [CVE-2026-81273](https://cve.now/CVE-2026-81273.md): WordPress FluentBooking Pro plugin \<= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.1, WP Manage Ninja FluentBooking Pro)
- [CVE-2026-81272](https://cve.now/CVE-2026-81272.md): WordPress FluentPlayer Pro plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 4.9, WP Manage Ninja FluentPlayer Pro)
- [CVE-2026-81271](https://cve.now/CVE-2026-81271.md): WordPress GeoDirectory plugin \<= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Paolo GeoDirectory)
- [CVE-2026-80433](https://cve.now/CVE-2026-80433.md): WordPress SureFeedback Client Site plugin \<= 1.2.12 - Sensitive Data Exposure vulnerability (CVSS 7.5, Brainstorm Force SureFeedback Client Site)
- [CVE-2026-78293](https://cve.now/CVE-2026-78293.md): WordPress WP w3all phpBB plugin \<= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, axew3 WP w3all phpBB)
- [CVE-2026-78292](https://cve.now/CVE-2026-78292.md): WordPress Hash Form plugin \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 9.8, hashthemes Hash Form)
- [CVE-2026-78289](https://cve.now/CVE-2026-78289.md): WordPress CozyStay theme \<= 1.10.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LoftOcean CozyStay)
- [CVE-2026-78288](https://cve.now/CVE-2026-78288.md): WordPress Beautiful Taxonomy Filters plugin \<= 2.4.6 - SQL Injection vulnerability (CVSS 9.3, Jonathan de Jong Beautiful Taxonomy Filters)
- [CVE-2026-78286](https://cve.now/CVE-2026-78286.md): WordPress Geo Controller plugin \<= 8.9.8 - PHP Object Injection vulnerability (CVSS 9.8, INFINITUM FORM Geo Controller)
- [CVE-2026-78285](https://cve.now/CVE-2026-78285.md): WordPress Like Button Rating plugin \<= 2.6.61 - SQL Injection vulnerability (CVSS 8.5, LikeBtn Like Button Rating)
- [CVE-2026-78283](https://cve.now/CVE-2026-78283.md): WordPress Music Player for WooCommerce plugin \<= 1.8.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codepeople Music Player for WooCommerce)
- [CVE-2026-78281](https://cve.now/CVE-2026-78281.md): WordPress CP Media Player plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codepeople CP Media Player)
- [CVE-2026-78276](https://cve.now/CVE-2026-78276.md): WordPress Fluent Boards Pro plugin \<= 2.0.11 - PHP Object Injection vulnerability (CVSS 7.2, WP Manage Ninja Fluent Boards Pro)
- [CVE-2026-78275](https://cve.now/CVE-2026-78275.md): WordPress Fluent Boards Pro plugin \<= 2.0.11 - Arbitrary File Deletion vulnerability (CVSS 6.8, WP Manage Ninja Fluent Boards Pro)
- [CVE-2026-78274](https://cve.now/CVE-2026-78274.md): WordPress Fluent Boards Pro plugin \<= 2.0.11 - Arbitrary File Upload vulnerability (CVSS 9.1, WP Manage Ninja Fluent Boards Pro)
- [CVE-2026-78273](https://cve.now/CVE-2026-78273.md): WordPress Fluent Boards Pro plugin \<= 2.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Manage Ninja Fluent Boards Pro)
- [CVE-2026-78271](https://cve.now/CVE-2026-78271.md): WordPress FluentCRM Pro plugin \<= 3.1.12 - Privilege Escalation vulnerability (CVSS 7.2, WP Manage Ninja FluentCRM Pro)
- [CVE-2026-78261](https://cve.now/CVE-2026-78261.md): WordPress Realtyna Organic IDX plugin plugin \<= 5.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Realtyna Organic IDX plugin)
- [CVE-2026-78260](https://cve.now/CVE-2026-78260.md): WordPress Epayco plugin \<= 8.4.6 - SQL Injection vulnerability (CVSS 9.3, Epayco)
- [CVE-2026-78257](https://cve.now/CVE-2026-78257.md): WordPress Booking and Rental Manager plugin \<= 2.7.5 - PHP Object Injection vulnerability (CVSS 8.8, magepeopleteam Booking and Rental Manager)
- [CVE-2026-32566](https://cve.now/CVE-2026-32566.md): WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin \<= 2.0.63 - Privilege Escalation vulnerability (CVSS 9.8, ACPT (Pro) - Custom Post Types Plugin for WordPress)
- [CVE-2026-32564](https://cve.now/CVE-2026-32564.md): WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin \<= 2.0.63 - SQL Injection vulnerability (CVSS 8.5, ACPT (Pro) - Custom Post Types Plugin for WordPress)
- [CVE-2026-32550](https://cve.now/CVE-2026-32550.md): WordPress Kadence Shop Kit plugin \<= 3.0.6 - SQL Injection vulnerability (CVSS 8.5, Liquid Web Kadence Shop Kit)
- [CVE-2026-32479](https://cve.now/CVE-2026-32479.md): WordPress Visitor Traffic Real Time Statistics Pro plugin \<= 11.17 - SQL Injection vulnerability (CVSS 9.3, CODEPRESS IT Solutions Visitor Traffic Real Time Statistics…)
- [CVE-2026-27330](https://cve.now/CVE-2026-27330.md): WordPress Mobile App for WooCommerce plugin \<= 0.4.62 - Broken Access Control vulnerability (CVSS 8.6, Weptile Mobile App for WooCommerce)
- [CVE-2026-81279](https://cve.now/CVE-2026-81279.md): WordPress Push Notification for Post and BuddyPress plugin \<= 3.20 - Broken Access Control vulnerability (CVSS 5.4, Murali Push Notification for Post and BuddyPress)
- [CVE-2026-81581](https://cve.now/CVE-2026-81581.md): User input in WibuKey is used (without proper sanitization) to compute the address of a pointer, which can be exploited to let the user point to any storage, to which Windows responds with a denial of service. (CVSS 8.8, wibu-systems-ag wibukey)
- [CVE-2026-81579](https://cve.now/CVE-2026-81579.md): An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows (CVSS 8.8, wibu-systems-ag wibukey)
- [CVE-2026-81576](https://cve.now/CVE-2026-81576.md): Improper Authentication of Session Handles (CVSS 7.7, wibu-systems-ag codemeter-runtime)
- [CVE-2026-81575](https://cve.now/CVE-2026-81575.md): Missing Sanity Checks for Buffer Lengths (CVSS 7.5, wibu-systems-ag codemeter-runtime)
- [CVE-2026-81574](https://cve.now/CVE-2026-81574.md): Format String Vulnerability in Logger (CVSS 8.2, wibu-systems-ag codemeter-runtime)
- [CVE-2026-81573](https://cve.now/CVE-2026-81573.md): Improper Access Control in Local-Only Configuration Commands (CVSS 8.6, wibu-systems-ag codemeter-runtime)
- [CVE-2026-81572](https://cve.now/CVE-2026-81572.md): Local Privilege Escalation in CodeMeter Runtime on Windows (CVSS 7.8, wibu-systems-ag codemeter-runtime)
- [CVE-2026-59355](https://cve.now/CVE-2026-59355.md): Spring Authorization Server: Open Redirect via request\_uri parameter (CVSS 6.1, VMware Spring Authorization Server)
- [CVE-2026-59354](https://cve.now/CVE-2026-59354.md): Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata (CVSS 9.6, VMware by Broadcom Spring Security)
- [CVE-2026-78333](https://cve.now/CVE-2026-78333.md): 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log (CVSS 8.8, 12 Step Meeting List)
- [CVE-2026-78139](https://cve.now/CVE-2026-78139.md): Notifima \< 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR (CVSS 4.3, Notifima)
- [CVE-2026-78138](https://cve.now/CVE-2026-78138.md): Finale Lite \< 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct\_quick\_view\_html (CVSS 4.3, Finale Lite)
- [CVE-2026-78137](https://cve.now/CVE-2026-78137.md): StoreGrowth: Smart Sales Booster for WooCommerce \< 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart (CVSS 7.5, StoreGrowth)
- [CVE-2026-78125](https://cve.now/CVE-2026-78125.md): LearnPress – Sepay Payment \< 4.0.3 - Unauthenticated Order Status Disclosure (CVSS 5.3, LearnPress)
- [CVE-2026-77018](https://cve.now/CVE-2026-77018.md): Workeera Remote Tech Job Board \< 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment (CVSS 8.8, Workeera)
- [CVE-2026-77017](https://cve.now/CVE-2026-77017.md): Workeera Remote Tech Job Board \< 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment (CVSS 7.7, Workeera)
- [CVE-2026-77016](https://cve.now/CVE-2026-77016.md): Workeera Remote Tech Job Board \< 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment (CVSS 9.6, Workeera)
- [CVE-2026-76549](https://cve.now/CVE-2026-76549.md): UpdraftPlus \< 1.26.7 - Backup Restoration via CSRF (CVSS 5.9, UpdraftPlus: WP Backup & Migration Plugin)
- [CVE-2026-19715](https://cve.now/CVE-2026-19715.md): WP OAuth Server \< 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File (CVSS 7.5, WP OAuth Server)
- [CVE-2026-19454](https://cve.now/CVE-2026-19454.md): JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download (CVSS 4.4, JetBackup)
- [CVE-2026-19225](https://cve.now/CVE-2026-19225.md): Defender Security \< 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite (CVSS 6.6, Defender Security)
- [CVE-2026-19223](https://cve.now/CVE-2026-19223.md): Smush \< 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite (CVSS 7.2, Smush)
- [CVE-2026-16569](https://cve.now/CVE-2026-16569.md): ShopApper \<= 0.4.62 - Subscriber+ Arbitrary Product Stock Update (CVSS 4.3, Mobile App for WooCommerce: ShopApper Mobile App Builder Se…)
- [CVE-2026-16568](https://cve.now/CVE-2026-16568.md): ShopApper \<= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR (CVSS 4.3, Mobile App for WooCommerce: ShopApper Mobile App Builder Se…)
- [CVE-2026-16567](https://cve.now/CVE-2026-16567.md): Document Embedder \< 2.3.1 - Unauthenticated Private Document Download via Token Oracle (CVSS 5.3, Document Embedder)
- [CVE-2026-13416](https://cve.now/CVE-2026-13416.md): CMP - Coming Soon & Maintenance \< 4.1.18 - Editor+ Stored XSS via niteoCS\_socialmedia (CVSS 3.5, CMP)
- [CVE-2026-13415](https://cve.now/CVE-2026-13415.md): CMP - Coming Soon & Maintenance \< 4.1.18 - Editor+ Privilege Escalation via cmp\_ajax\_import\_settings (CVSS 7.2, CMP)
- [CVE-2026-13414](https://cve.now/CVE-2026-13414.md): CMP - Coming Soon & Maintenance \< 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp\_disable\_comingsoon\_ajax (CVSS 4.8, CMP)
- [CVE-2026-77991](https://cve.now/CVE-2026-77991.md): Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager \< 5.0.1 (CVSS 9.4, joomlaeventmanager.net JEM - Joomla Event Manager extension…)
- [CVE-2026-77034](https://cve.now/CVE-2026-77034.md): Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager \< 5.0.1 (CVSS 6.9, joomlaeventmanager.net JEM - Joomla Event Manager extension…)
- [CVE-2026-77990](https://cve.now/CVE-2026-77990.md): Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \< 5.0.1 (CVSS 5.3, joomlaeventmanager.net JEM - Joomla Event Manager extension…)
- [CVE-2026-77035](https://cve.now/CVE-2026-77035.md): Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager \< 5.0.1 (CVSS 5.1, joomlaeventmanager.net JEM - Joomla Event Manager extension…)
- [CVE-2026-77989](https://cve.now/CVE-2026-77989.md): Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager \< 5.0.1 (CVSS 5.3, joomlaeventmanager.net JEM - Joomla Event Manager extension…)
- [CVE-2026-47893](https://cve.now/CVE-2026-47893.md): Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService (CVSS 7.5, Spring Framework)
- [CVE-2026-47892](https://cve.now/CVE-2026-47892.md): Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints (CVSS 9.8, Spring Framework · org.springframework:spring-webflux)
- [CVE-2026-47891](https://cve.now/CVE-2026-47891.md): Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder (CVSS 9.8, Spring Framework)
- [CVE-2026-47890](https://cve.now/CVE-2026-47890.md): Spring Framework Server Sent Event stream corruption while rendering fragments (CVSS 9.8, Spring Framework · org.springframework:spring-webflux +1)
- [CVE-2026-47889](https://cve.now/CVE-2026-47889.md): Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse (CVSS 7.5, Spring Framework)
- [CVE-2026-47888](https://cve.now/CVE-2026-47888.md): Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler (CVSS 7.5, Spring Framework)
- [CVE-2026-47887](https://cve.now/CVE-2026-47887.md): Spring Framework Open Redirect in UrlFileNameViewController (CVSS 6.1, Spring Framework)
- [CVE-2026-47886](https://cve.now/CVE-2026-47886.md): Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions (CVSS 7.5, Spring Framework)
- [CVE-2026-47885](https://cve.now/CVE-2026-47885.md): Spring Framework maxPartSize Ignored in PartEventHttpMessageReader (CVSS 7.5, Spring Framework)
- [CVE-2026-47884](https://cve.now/CVE-2026-47884.md): Spring Framework Improper Path Limitation in XsltView (CVSS 9.8, Spring Framework · org.springframework:spring-webmvc)
- [CVE-2026-47883](https://cve.now/CVE-2026-47883.md): Spring Framework Open Redirect in UrlHandlerFilter (CVSS 6.1, Spring Framework)
- [CVE-2026-59278](https://cve.now/CVE-2026-59278.md): In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages (CVSS 6.5, Spring for Apache Kafka)
- [CVE-2026-59275](https://cve.now/CVE-2026-59275.md): Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99) (CVSS 6.6, Spring AMQP)
- [CVE-2026-59274](https://cve.now/CVE-2026-59274.md): Unbounded decompression in UnZipTransformer enables zip-bomb DoS (CVSS 6.5, Spring Integration)
- [CVE-2026-59271](https://cve.now/CVE-2026-59271.md): Admin password disclosed in BrokerNotAliveException message (CVSS 5.3, Spring AMQP)
- [CVE-2026-59270](https://cve.now/CVE-2026-59270.md): Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces (CVSS 9.4, Spring Security)
- [CVE-2026-47894](https://cve.now/CVE-2026-47894.md): Spring Cloud Config Server Native Environment Repository Exposure (CVSS 4.9, Spring Cloud Config)
- [CVE-2026-47881](https://cve.now/CVE-2026-47881.md): Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File (CVSS 5.9, Spring Batch)
- [CVE-2026-47880](https://cve.now/CVE-2026-47880.md): DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names (CVSS 5.4, Spring Integration)
- [CVE-2026-47879](https://cve.now/CVE-2026-47879.md): Spring Cloud Gateway SSRF and native file access with gRPC (CVSS 7.7, Spring Cloud Gateway)
- [CVE-2026-47878](https://cve.now/CVE-2026-47878.md): Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist (CVSS 5.6, Spring Batch)
- [CVE-2026-47877](https://cve.now/CVE-2026-47877.md): Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) (CVSS 8.2, Spring Security)
- [CVE-2026-47875](https://cve.now/CVE-2026-47875.md): JobParameterDeserializer bypasses the trusted-type allowlist (CVSS 5.6, Spring Batch)
- [CVE-2026-47864](https://cve.now/CVE-2026-47864.md): Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution (CVSS 6.4, Spring Integration)
- [CVE-2026-47849](https://cve.now/CVE-2026-47849.md): Spring Data REST allows mutation of identifier and version properties via JSON Patch (CVSS 7.1, Spring Data REST)
- [CVE-2026-16895](https://cve.now/CVE-2026-16895.md): Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails (CVSS 5.1, Rapid7 Metasploit-framework)
- [CVE-2026-81491](https://cve.now/CVE-2026-81491.md): boxpositron with-context-mcp index.ts project\_folder path traversal (CVSS 6.9, boxpositron with-context-mcp)
- [CVE-2026-19398](https://cve.now/CVE-2026-19398.md): An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BS (CVSS 6.8, ASUS FA507NV · ASUS FA507NU)
- [CVE-2026-81486](https://cve.now/CVE-2026-81486.md): bsmi021 mcp-file-context-server Path Resolution index.ts read\_context path traversal (CVSS 6.9, bsmi021 mcp-file-context-server)
- [CVE-2026-81485](https://cve.now/CVE-2026-81485.md): danielpopamd linkedin-ads-mcp Media Upload campaign-management.ts fs.readFileSync path traversal (CVSS 6.9, danielpopamd linkedin-ads-mcp)
- [CVE-2026-26452](https://cve.now/CVE-2026-26452.md): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when p (CVSS 7.5)
- [CVE-2026-26453](https://cve.now/CVE-2026-26453.md): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap\_server\_handle\_session() functio (CVSS 7.5)
- [CVE-2026-26456](https://cve.now/CVE-2026-26456.md): A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd (CVSS 7.5)
- [CVE-2026-26457](https://cve.now/CVE-2026-26457.md): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap\_dump\_msg() function when proces (CVSS 7.5)
- [CVE-2026-26459](https://cve.now/CVE-2026-26459.md): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when pr (CVSS 7.5)
- [CVE-2026-26897](https://cve.now/CVE-2026-26897.md): An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive informatio (CVSS 9.8)
- [CVE-2026-26899](https://cve.now/CVE-2026-26899.md): An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (\< 2026-01-17). (CVSS 8.8)
- [CVE-2026-30045](https://cve.now/CVE-2026-30045.md): An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via su (CVSS 7.5)
- [CVE-2026-30046](https://cve.now/CVE-2026-30046.md): A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via sup (CVSS 7.5)
- [CVE-2026-30047](https://cve.now/CVE-2026-30047.md): A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of (CVSS 7.5)
- [CVE-2026-30050](https://cve.now/CVE-2026-30050.md): An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event\_exposure.go) of free5gc v4.1.0 allows attackers to cause a Den (CVSS 7.5)
- [CVE-2026-30051](https://cve.now/CVE-2026-30051.md): An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service ( (CVSS 7.5)
- [CVE-2026-30056](https://cve.now/CVE-2026-30056.md): A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via su (CVSS 7.5)
- [CVE-2026-30057](https://cve.now/CVE-2026-30057.md): An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a craf (CVSS 7.5)
- [CVE-2026-30058](https://cve.now/CVE-2026-30058.md): Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a (CVSS 7.5)
- [CVE-2026-30059](https://cve.now/CVE-2026-30059.md): An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Reque (CVSS 7.5)
- [CVE-2026-30060](https://cve.now/CVE-2026-30060.md): An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration. (CVSS 7.5)
- [CVE-2026-30062](https://cve.now/CVE-2026-30062.md): An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU. (CVSS 7.5)
- [CVE-2026-30063](https://cve.now/CVE-2026-30063.md): An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query. (CVSS 7.5)
- [CVE-2026-30064](https://cve.now/CVE-2026-30064.md): Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Servi (CVSS 7.5)
- [CVE-2026-30067](https://cve.now/CVE-2026-30067.md): An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of S (CVSS 7.5)
- [CVE-2026-30068](https://cve.now/CVE-2026-30068.md): Improper input validation in the HandleUpdate function (/sbi/parameter\_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of (CVSS 7.5)
- [CVE-2026-30069](https://cve.now/CVE-2026-30069.md): A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) (CVSS 7.5)
- [CVE-2026-30070](https://cve.now/CVE-2026-30070.md): An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 7.5)
- [CVE-2026-30071](https://cve.now/CVE-2026-30071.md): An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 7.5)
- [CVE-2026-30072](https://cve.now/CVE-2026-30072.md): A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying cr (CVSS 7.5)
- [CVE-2026-30073](https://cve.now/CVE-2026-30073.md): An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a cr (CVSS 7.5)
- [CVE-2026-30612](https://cve.now/CVE-2026-30612.md): An issue in Time4 Popcorn for Windows \<= 6.2.1.18 and Time4Popcorn for MacOS \<= 6.2.1.17 and Time4Popcorn for Android \<= 3.5.0.173 allows a (CVSS 9.8)
- [CVE-2026-35868](https://cve.now/CVE-2026-35868.md): A Command Injection vulnerability exists in the bs\_SetLimitCli\_info function within the libshare.so library of LB-link Router AC2100\_AZ3 V1. (CVSS 9.8)
- [CVE-2026-35869](https://cve.now/CVE-2026-35869.md): A Command Injection vulnerability exists in the bs\_SetLimitCli\_info function within the libshare.so library of LB-link Router AC450M V4.0.0. (CVSS 9.8)
- [CVE-2026-36102](https://cve.now/CVE-2026-36102.md): An issue in the inviteController.js component in Bluewave Labs Checkmate \<=3.3.0 allows remote authenticated administrators to escalate priv (CVSS 7.2)
- [CVE-2026-37003](https://cve.now/CVE-2026-37003.md): Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. (CVSS 9.8)
- [CVE-2026-37004](https://cve.now/CVE-2026-37004.md): BerriAI litellm \<=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute ar (CVSS 9.8, litellm)
- [CVE-2026-37006](https://cve.now/CVE-2026-37006.md): A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code exe (CVSS 9.8)
- [CVE-2026-37007](https://cve.now/CVE-2026-37007.md): A vulnerability in FileWriterTool in crewai-tools \<= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path travers (CVSS 9.8)
- [CVE-2026-37009](https://cve.now/CVE-2026-37009.md): A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an uns (CVSS 6.5)
- [CVE-2026-37012](https://cve.now/CVE-2026-37012.md): A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via har (CVSS 7.5)
- [CVE-2026-37064](https://cve.now/CVE-2026-37064.md): User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the app (CVSS 5.3)
- [CVE-2026-37065](https://cve.now/CVE-2026-37065.md): Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=. (CVSS 9.1)
- [CVE-2026-37066](https://cve.now/CVE-2026-37066.md): Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 a (CVSS 6.5)
- [CVE-2026-37067](https://cve.now/CVE-2026-37067.md): Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker t (CVSS 5.3)
- [CVE-2026-37068](https://cve.now/CVE-2026-37068.md): Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated u (CVSS 8.1)
- [CVE-2026-37069](https://cve.now/CVE-2026-37069.md): Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 all (CVSS 5.3)
- [CVE-2026-37070](https://cve.now/CVE-2026-37070.md): Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any (CVSS 6.5)
- [CVE-2026-37071](https://cve.now/CVE-2026-37071.md): Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authent (CVSS 9.8)
- [CVE-2026-37072](https://cve.now/CVE-2026-37072.md): Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. (CVSS 9.8)
- [CVE-2026-37073](https://cve.now/CVE-2026-37073.md): Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emai (CVSS 5.3)
- [CVE-2026-37198](https://cve.now/CVE-2026-37198.md): An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP p (CVSS 7.5)
- [CVE-2026-38343](https://cve.now/CVE-2026-38343.md): An integer overflow in the libavfilter/vf\_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (Do (CVSS 6.5)
- [CVE-2026-38344](https://cve.now/CVE-2026-38344.md): A NULL pointer dereference in the get\_min\_buffer\_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to caus (CVSS 7.5)
- [CVE-2026-38345](https://cve.now/CVE-2026-38345.md): A Division-by-Zero vulnerability in the ff\_sws\_init\_single\_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows atta (CVSS 6.5)
- [CVE-2026-38346](https://cve.now/CVE-2026-38346.md): An integer overflow in the yuv2planeX\_8\_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial (CVSS 7.5)
- [CVE-2026-38347](https://cve.now/CVE-2026-38347.md): A heap overflow in the ff\_sws\_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to caus (CVSS 7.5)
- [CVE-2026-38348](https://cve.now/CVE-2026-38348.md): An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) v (CVSS 7.5)
- [CVE-2026-38349](https://cve.now/CVE-2026-38349.md): An integer overflow in the hScale16To19\_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial (CVSS 7.5)
- [CVE-2026-38350](https://cve.now/CVE-2026-38350.md): An integer overflow in the target\_sws\_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Den (CVSS 7.5)
- [CVE-2026-75337](https://cve.now/CVE-2026-75337.md): The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. (CVSS 9.8)
- [CVE-2026-75339](https://cve.now/CVE-2026-75339.md): The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. (CVSS 8.8)
- [CVE-2026-75357](https://cve.now/CVE-2026-75357.md): An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js component (CVSS 9.8)
- [CVE-2026-75417](https://cve.now/CVE-2026-75417.md): A SQL injection vulnerability was found in YzmCMS 7.5. (CVSS 7.2)
- [CVE-2026-75418](https://cve.now/CVE-2026-75418.md): A path traversal vulnerability exists in the built-in preview/development web server of Lektor \<3.3.14 on Windows. (CVSS 7.5)
- [CVE-2026-75419](https://cve.now/CVE-2026-75419.md): go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.