# CVEs published 2026-08-28

496 CVEs were published on August 28, 2026: 63 critical, 204 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2026-55860](https://cve.now/CVE-2026-55860.md): MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport) (CVSS 5.9, mariadb-corporation mariadb-connector-r2dbc · org.mariad… +1)
- [CVE-2026-55859](https://cve.now/CVE-2026-55859.md): MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb (CVSS 5.9, mariadb-corporation mariadb-connector-r2dbc · org.mariad… +1)
- [CVE-2026-55858](https://cve.now/CVE-2026-55858.md): MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-55857](https://cve.now/CVE-2026-55857.md): MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-55856](https://cve.now/CVE-2026-55856.md): MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake (CVSS 5.9, mariadb-corporation mariadb-connector-j · org.mariadb.jdbc:…)
- [CVE-2026-55848](https://cve.now/CVE-2026-55848.md): mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types (CVSS 8.6, mapfish-print · org.mapfish.print.print-lib +4)
- [CVE-2026-55785](https://cve.now/CVE-2026-55785.md): free5GC AUSF uses non-constant-time authentication comparisons and logs XRES\* in 5G-AKA (CVSS 3.7, free5gc · github.com/free5gc/ausf)
- [CVE-2026-55784](https://cve.now/CVE-2026-55784.md): free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI (CVSS 7.5, free5gc · github.com/free5gc/ausf)
- [CVE-2026-55779](https://cve.now/CVE-2026-55779.md): Silverstripe Versioned: XSS in archive admin restore (CVSS 5.4, silverstripe-versioned · silverstripe/versioned)
- [CVE-2026-55867](https://cve.now/CVE-2026-55867.md): Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens (CVSS 5.3, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-55841](https://cve.now/CVE-2026-55841.md): Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message (CVSS 7.5, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-55764](https://cve.now/CVE-2026-55764.md): Klever-Go: SFT add-quantity \`int64\` overflow bypasses a finite per-nonce MaxSupply (CVSS 8.7, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-55855](https://cve.now/CVE-2026-55855.md): MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets (CVSS 6.5, mariadb-corporation mariadb-connector-nodejs · mariadb)
- [CVE-2026-55854](https://cve.now/CVE-2026-55854.md): MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials in mariadb (CVSS 5.9, mariadb-corporation mariadb-connector-nodejs · mariadb)
- [CVE-2026-22056](https://cve.now/CVE-2026-22056.md): CVE-2026-22056 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 2.3, NetApp StorageGRID)
- [CVE-2026-82018](https://cve.now/CVE-2026-82018.md): IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File (CVSS 6.8, IGEL OS)
- [CVE-2026-82017](https://cve.now/CVE-2026-82017.md): IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area (CVSS 8.6, IGEL OS)
- [CVE-2026-3686](https://cve.now/CVE-2026-3686.md): Vulnerabilities exists in IBM Cloud Pak for Data System (CVSS 6.2, IBM Cloud Pak for Data System)
- [CVE-2026-3627](https://cve.now/CVE-2026-3627.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 9.1, IBM Concert)
- [CVE-2026-19295](https://cve.now/CVE-2026-19295.md): Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-19294](https://cve.now/CVE-2026-19294.md): Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities (CVSS 6.4, IBM Langflow OSS)
- [CVE-2026-19286](https://cve.now/CVE-2026-19286.md): Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-18904](https://cve.now/CVE-2026-18904.md): Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities (CVSS 8.2, IBM Langflow OSS)
- [CVE-2026-18899](https://cve.now/CVE-2026-18899.md): Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-18891](https://cve.now/CVE-2026-18891.md): Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities (CVSS 8.2, IBM Langflow OSS)
- [CVE-2026-18729](https://cve.now/CVE-2026-18729.md): Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-18545](https://cve.now/CVE-2026-18545.md): Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities (CVSS 4.3, IBM Langflow OSS)
- [CVE-2026-18527](https://cve.now/CVE-2026-18527.md): IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information \[, \]. (CVSS 9.9, IBM Administration Runtime Expert for i)
- [CVE-2026-17203](https://cve.now/CVE-2026-17203.md): IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information \[, \]. (CVSS 7.5, IBM Administration Runtime Expert for i)
- [CVE-2026-16821](https://cve.now/CVE-2026-16821.md): Vulnerabilities in IBM AIX and PowerVM VIOS (CVSS 7.0, IBM AIX · IBM PowerVM VIOS)
- [CVE-2025-64649](https://cve.now/CVE-2025-64649.md): Multiple Vulnerabilities in IBM Concert Software (CVSS 5.9, IBM Concert)
- [CVE-2025-36290](https://cve.now/CVE-2025-36290.md): IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component (CVSS 5.9, IBM Integrated Analytics System)
- [CVE-2025-36271](https://cve.now/CVE-2025-36271.md): IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component (CVSS 5.9, IBM Integrated Analytics System)
- [CVE-2026-13735](https://cve.now/CVE-2026-13735.md): WireGuard keepalive transport-data messages accepted without Poly1305 authentication (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-13734](https://cve.now/CVE-2026-13734.md): Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-55678](https://cve.now/CVE-2026-55678.md): Arc: Unauthenticated cluster node admission when \`cluster.shared\_secret\` is unset (CVSS 6.9, Basekick-Labs arc · github.com/basekick-labs/arc)
- [CVE-2026-75118](https://cve.now/CVE-2026-75118.md): http\_gdpr\_decrypt Pre-Authentication Stack-Based Buffer Overflow (CVSS 8.7, TP-Link Systems TL-MR100)
- [CVE-2026-81533](https://cve.now/CVE-2026-81533.md): MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values (CVSS 6.0, MongoDB BI Connector ODBC Driver)
- [CVE-2026-55763](https://cve.now/CVE-2026-55763.md): Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits (CVSS 8.7, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-81532](https://cve.now/CVE-2026-81532.md): BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption (CVSS 8.7, MongoDB BI Connector ODBC Driver)
- [CVE-2026-55891](https://cve.now/CVE-2026-55891.md): PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST\_URI (CVSS 0.0, PrivateBin · privatebin/privatebin)
- [CVE-2026-81520](https://cve.now/CVE-2026-81520.md): MongoDB Connector for BI Unbounded Authentication Negotiation Leading to Connection Exhaustion (CVSS 8.7, MongoDB BI Connector)
- [CVE-2026-55696](https://cve.now/CVE-2026-55696.md): PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction (CVSS 4.3, PrivateBin · privatebin/privatebin)
- [CVE-2026-76651](https://cve.now/CVE-2026-76651.md): Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N (CVSS 5.3, TP-Link System TL-WR841N)
- [CVE-2026-76650](https://cve.now/CVE-2026-76650.md): Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N (CVSS 5.3, TP-Link System TL-WR841N)
- [CVE-2026-76649](https://cve.now/CVE-2026-76649.md): Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N (CVSS 5.3, TP-Link System TL-WR841N)
- [CVE-2026-81518](https://cve.now/CVE-2026-81518.md): BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections (CVSS 8.7, MongoDB BI Connector)
- [CVE-2026-81517](https://cve.now/CVE-2026-81517.md): MongoDB Connector for BI Improper Error Handling of Log Write Failures May Cause Loss of SQL Service (CVSS 8.7, MongoDB BI Connector)
- [CVE-2026-82333](https://cve.now/CVE-2026-82333.md): multer vulnerable to Denial of Service via oversized array index in field names (CVSS 7.5, multer)
- [CVE-2026-81490](https://cve.now/CVE-2026-81490.md): MongoDB Connector for BI Improper Error Handling During Schema Sampling May Cause Loss of SQL Service (CVSS 8.3, MongoDB BI Connector)
- [CVE-2026-77078](https://cve.now/CVE-2026-77078.md): multer vulnerable to Denial of Service via crafted multipart field names (CVSS 7.5, multer)
- [CVE-2026-77063](https://cve.now/CVE-2026-77063.md): multer vulnerable to file size limit bypass via async fileFilter race condition (CVSS 3.7, multer)
- [CVE-2026-77037](https://cve.now/CVE-2026-77037.md): multer vulnerable to Denial of Service via file descriptor leak on aborted uploads (CVSS 7.5, multer)
- [CVE-2026-77586](https://cve.now/CVE-2026-77586.md): MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output (CVSS 8.5, MongoDB BI Connector)
- [CVE-2026-77184](https://cve.now/CVE-2026-77184.md): MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output (CVSS 5.6, MongoDB BI Connector)
- [CVE-2026-76798](https://cve.now/CVE-2026-76798.md): MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports (CVSS 6.9, MongoDB BI Connector Transition Readiness Report)
- [CVE-2026-76797](https://cve.now/CVE-2026-76797.md): MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports (CVSS 5.8, MongoDB BI Connector Transition Readiness Report)
- [CVE-2026-76794](https://cve.now/CVE-2026-76794.md): MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata (CVSS 4.8, MongoDB BI Connector Transition Readiness Report)
- [CVE-2026-55484](https://cve.now/CVE-2026-55484.md): ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server (CVSS 7.5, guno1928 alos-http · github.com/guno1928/alos-http)
- [CVE-2026-55634](https://cve.now/CVE-2026-55634.md): Pimcore: Remote Code Execution via DataObject Class-Definition Field Name (CVSS 9.9, pimcore · pimcore/pimcore)
- [CVE-2026-55220](https://cve.now/CVE-2026-55220.md): Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (CVSS 9.3, pimcore · pimcore/pimcore)
- [CVE-2026-55215](https://cve.now/CVE-2026-55215.md): MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite \`ssl: true\` (CVSS 7.5, mariadb-corporation mariadb-connector-nodejs · mariadb)
- [CVE-2026-55247](https://cve.now/CVE-2026-55247.md): plone.app.event: Denial of service via iCalendar import (CVSS 9.1, plone.app.event · plone-app-event)
- [CVE-2026-82021](https://cve.now/CVE-2026-82021.md): Hermes Agent 0.18.2 \< 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference (CVSS 9.0, NousResearch hermes-agent)
- [CVE-2026-82020](https://cve.now/CVE-2026-82020.md): Hermes Agent 0.16.0 \< 0.17.0 Credential Store Overwrite via File-Write Tool (CVSS 7.6, NousResearch hermes-agent)
- [CVE-2026-55520](https://cve.now/CVE-2026-55520.md): Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching (CVSS 7.1, scrapy protego · protego)
- [CVE-2026-55248](https://cve.now/CVE-2026-55248.md): plone.app.portlets: Denial of service via RSS feed portlet (CVSS 9.1, plone.app.portlets · plone-app-portlets)
- [CVE-2026-55673](https://cve.now/CVE-2026-55673.md): PowSyBl: Command Injection in LocalCommandExecutor-s (CVSS 7.1, powsybl-core · com.powsybl:powsybl-computation-local)
- [CVE-2026-55584](https://cve.now/CVE-2026-55584.md): phpSysInfo: IP allowlist (PSI\_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers (CVSS 7.5, phpsysinfo · phpsysinfo/phpsysinfo)
- [CVE-2026-82329](https://cve.now/CVE-2026-82329.md): Potential authentication bypass leading to administrative access in Artifactory (CVSS 9.8, KEV, jfrog artifactory)
- [CVE-2026-55245](https://cve.now/CVE-2026-55245.md): Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL (CVSS 8.7, maximhq bifrost · github.com/maximhq/bifrost/core)
- [CVE-2026-55378](https://cve.now/CVE-2026-55378.md): JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values (CVSS 9.3, shriyanss js-recon)
- [CVE-2026-55485](https://cve.now/CVE-2026-55485.md): Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/. (CVSS 8.8, piccolo-orm piccolo\_admin · piccolo-admin)
- [CVE-2026-55509](https://cve.now/CVE-2026-55509.md): WsgiDAV: Blind SQL injection in the MySQL provider (CVSS 8.8, mar10 wsgidav · wsgidav)
- [CVE-2026-55425](https://cve.now/CVE-2026-55425.md): Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields (CVSS 5.0, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2026-81849](https://cve.now/CVE-2026-81849.md): Path traversal in the aws:downloadContent plugin in amazon-ssm-agent (CVSS 8.7, amazon-ssm-agent)
- [CVE-2026-56100](https://cve.now/CVE-2026-56100.md): SpringBlade 2.7.3 \< 5.0.0 Privilege Escalation via Exposed Feign Endpoint (CVSS 8.6, SpringBlade)
- [CVE-2026-70309](https://cve.now/CVE-2026-70309.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-72984](https://cve.now/CVE-2026-72984.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-66798](https://cve.now/CVE-2026-66798.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2026-66324](https://cve.now/CVE-2026-66324.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2026-66323](https://cve.now/CVE-2026-66323.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-62904](https://cve.now/CVE-2026-62904.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-58616](https://cve.now/CVE-2026-58616.md): Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability (CVSS 4.4, Microsoft Edge)
- [CVE-2026-70331](https://cve.now/CVE-2026-70331.md): Microsoft Edge for iOS Spoofing Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2026-55566](https://cve.now/CVE-2026-55566.md): Yamcs: DOM XSS in Extension Routing (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55565](https://cve.now/CVE-2026-55565.md): Yamcs: Authenticated remote code execution via unescaped StreamSQL \`LIKE\` pattern compiled by Janino (\`LikeExpression\`) (CVSS 9.9, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55559](https://cve.now/CVE-2026-55559.md): Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) (CVSS 9.8, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55552](https://cve.now/CVE-2026-55552.md): Yamcs: Unauthenticated Directory Traversal (CVSS 7.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55549](https://cve.now/CVE-2026-55549.md): Yamcs: Reflected XSS in the URL of the Authorize Endpoint (CVSS 6.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55547](https://cve.now/CVE-2026-55547.md): Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration (CVSS 4.3, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55545](https://cve.now/CVE-2026-55545.md): Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce (CVSS 6.5, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55521](https://cve.now/CVE-2026-55521.md): Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API (CVSS 8.8, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-77939](https://cve.now/CVE-2026-77939.md): Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint (CVSS 7.1, flextype)
- [CVE-2026-55511](https://cve.now/CVE-2026-55511.md): Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs \`executeSql\` (CVSS 9.1, yamcs · org.yamcs:yamcs-core)
- [CVE-2026-55068](https://cve.now/CVE-2026-55068.md): free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints (CVSS 9.3, free5gc · github.com/free5gc/free5gc)
- [CVE-2026-55067](https://cve.now/CVE-2026-55067.md): Vikunja: Authenticated cross-tenant kanban-bucket relocation via \`project\_view\_id\` mass-assignment (CVSS 5.0, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-55066](https://cve.now/CVE-2026-55066.md): Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task\_id (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-55065](https://cve.now/CVE-2026-55065.md): Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api (CVSS 8.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-55064](https://cve.now/CVE-2026-55064.md): Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent\_project\_id=0 (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-54766](https://cve.now/CVE-2026-54766.md): Vikunja: Project duplication bypasses write-permission check on the target parent project (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-54788](https://cve.now/CVE-2026-54788.md): dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS (CVSS 7.5, DataDog dd-trace-rs · datadog-opentelemetry)
- [CVE-2026-55834](https://cve.now/CVE-2026-55834.md): Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect\_uri with prompt=none (CVSS 4.3, pocket-id · github.com/pocket-id/pocket-id/backend)
- [CVE-2026-55569](https://cve.now/CVE-2026-55569.md): aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory (CVSS 6.6, aquaproj aqua · github.com/aquaproj/aqua +1)
- [CVE-2026-82343](https://cve.now/CVE-2026-82343.md): Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling (CVSS 6.1, GNOME GIMP · Red Hat Enterprise Linux)
- [CVE-2026-54755](https://cve.now/CVE-2026-54755.md): Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) (CVSS 9.6, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-54754](https://cve.now/CVE-2026-54754.md): Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) (CVSS 9.6, klever-io klever-go · github.com/klever-io/klever-go)
- [CVE-2026-82306](https://cve.now/CVE-2026-82306.md): StarRocks Query Detail Endpoint Returns Every User's Query History (CVSS 6.5, starrocks)
- [CVE-2026-82291](https://cve.now/CVE-2026-82291.md): HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials (CVSS 8.1, heyform)
- [CVE-2026-82290](https://cve.now/CVE-2026-82290.md): Chainlit Feedback Endpoints Missing Ownership Validation (CVSS 6.0, chainlit)
- [CVE-2026-82289](https://cve.now/CVE-2026-82289.md): Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure (CVSS 8.3, coderamp-labs gitingest)
- [CVE-2026-82288](https://cve.now/CVE-2026-82288.md): Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags (CVSS 8.7, AUTOMATIC1111 stable-diffusion-webui)
- [CVE-2026-82287](https://cve.now/CVE-2026-82287.md): Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials (CVSS 8.6, rybbit-io rybbit)
- [CVE-2026-82286](https://cve.now/CVE-2026-82286.md): gpt-crawler Arbitrary File Write via outputFileName Parameter (CVSS 8.8, BuilderIO gpt-crawler)
- [CVE-2026-82285](https://cve.now/CVE-2026-82285.md): BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback (CVSS 8.8, dataelement bisheng)
- [CVE-2026-82284](https://cve.now/CVE-2026-82284.md): Quivr Chat Endpoints Missing Ownership Validation (CVSS 8.6, QuivrHQ quivr)
- [CVE-2026-82283](https://cve.now/CVE-2026-82283.md): VoltAgent Memory API Handlers Missing Ownership Checks (CVSS 8.6, voltagent)
- [CVE-2026-82282](https://cve.now/CVE-2026-82282.md): Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers (CVSS 8.8, runatlantis atlantis)
- [CVE-2026-82281](https://cve.now/CVE-2026-82281.md): Kotaemon Missing Ownership Check in Conversation Functions (CVSS 9.1, Cinnamon kotaemon)
- [CVE-2026-82280](https://cve.now/CVE-2026-82280.md): Quivr Prompt Endpoints Missing Ownership Validation (CVSS 7.1, QuivrHQ quivr)
- [CVE-2026-82279](https://cve.now/CVE-2026-82279.md): HyperDX Team Management Operations Missing Role-Based Access Control (CVSS 7.2, hyperdxio hyperdx)
- [CVE-2026-82278](https://cve.now/CVE-2026-82278.md): BISHENG Authenticated Arbitrary Python Code Execution via Workflow run\_once (CVSS 8.7, dataelement bisheng)
- [CVE-2026-82277](https://cve.now/CVE-2026-82277.md): Argo Rollouts Dashboard Unauthenticated Mutating Operations (CVSS 9.3, argoproj argo-rollouts)
- [CVE-2026-82276](https://cve.now/CVE-2026-82276.md): StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate (CVSS 5.3, starrocks)
- [CVE-2026-82275](https://cve.now/CVE-2026-82275.md): Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path (CVSS 8.7, QwenLM Qwen-Agent)
- [CVE-2026-82274](https://cve.now/CVE-2026-82274.md): Twenty Open Redirect via OAuth Propagator Callback (CVSS 5.3, twentyhq twenty)
- [CVE-2026-82273](https://cve.now/CVE-2026-82273.md): Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset (CVSS 7.1, mastra-ai mastra)
- [CVE-2026-82272](https://cve.now/CVE-2026-82272.md): Immich Locked Assets Remain Readable Through Albums and Shared Links (CVSS 7.1, immich-app immich)
- [CVE-2026-82271](https://cve.now/CVE-2026-82271.md): R2R Missing Ownership Check Allows Modifying Other Users' Conversations (CVSS 7.1, SciPhi-AI R2R)
- [CVE-2026-82270](https://cve.now/CVE-2026-82270.md): Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/\* (CVSS 8.7, Portkey-AI gateway)
- [CVE-2026-82269](https://cve.now/CVE-2026-82269.md): Gophish Account Lockout and Forced Password Change Bypassable via API Key (CVSS 8.6, gophish)
- [CVE-2026-82268](https://cve.now/CVE-2026-82268.md): Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL (CVSS 8.7, QwenLM Qwen-Agent)
- [CVE-2026-82267](https://cve.now/CVE-2026-82267.md): Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check (CVSS 5.3, moghtech komodo)
- [CVE-2026-82266](https://cve.now/CVE-2026-82266.md): Redpanda Admin API Unauthenticated Superuser Access via Default Configuration (CVSS 9.3, redpanda-data redpanda)
- [CVE-2026-82265](https://cve.now/CVE-2026-82265.md): Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure (CVSS 6.9, openzipkin zipkin)
- [CVE-2026-82264](https://cve.now/CVE-2026-82264.md): Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths (CVSS 6.1, gilbertchen duplicacy)
- [CVE-2026-82263](https://cve.now/CVE-2026-82263.md): Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL (CVSS 8.2, logto-io logto)
- [CVE-2026-82262](https://cve.now/CVE-2026-82262.md): Logto Server-Side Request Forgery via webhook test endpoint (CVSS 8.2, logto-io logto)
- [CVE-2026-55108](https://cve.now/CVE-2026-55108.md): KubeVela Terraform remote loader DoS via unbounded file read (CVSS 8.5, kubevela · github.com/oam-dev/kubevela)
- [CVE-2026-54746](https://cve.now/CVE-2026-54746.md): Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe (CVSS 6.4, hatchet-dev hatchet · github.com/hatchet-dev/hatchet)
- [CVE-2026-54745](https://cve.now/CVE-2026-54745.md): Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /\_proxy/ route, bypasses ENABLE\_AUTHZ=true (CVSS 10.0, kubeflow pipelines)
- [CVE-2026-75486](https://cve.now/CVE-2026-75486.md): Synk Sweater Comb \< 3.8.8 Command Injection via .vervet.yaml Branch Name (CVSS 8.5, snyk sweater-comb)
- [CVE-2026-77218](https://cve.now/CVE-2026-77218.md): PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Credential Handlers (CVSS 6.9, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-77217](https://cve.now/CVE-2026-77217.md): PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers (CVSS 6.9, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-75126](https://cve.now/CVE-2026-75126.md): PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Standard Handlers (CVSS 6.9, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-75125](https://cve.now/CVE-2026-75125.md): PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web\_poe\_alive\_rmtip\_post (CVSS 6.9, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-75124](https://cve.now/CVE-2026-75124.md): PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi \_readHttpParam (CVSS 8.7, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-75123](https://cve.now/CVE-2026-75123.md): PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web\_smtp\_test\_post (CVSS 8.6, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-75122](https://cve.now/CVE-2026-75122.md): PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi (CVSS 8.6, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-75121](https://cve.now/CVE-2026-75121.md): PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web\_vlan\_membership\_edit\_dialog\_post (CVSS 8.6, PLANET Technology PLANET GS-4210-16P2S)
- [CVE-2026-56854](https://cve.now/CVE-2026-56854.md): Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh (CVSS 7.5, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-4378](https://cve.now/CVE-2026-4378.md): Stored XSS in Akıllı Ticaret's E-Commerce Pack (CVSS 5.4, Akilli Ticaret Software Technologies E-Commerce Pack)
- [CVE-2026-82330](https://cve.now/CVE-2026-82330.md): Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check (CVSS 6.1, GNOME GIMP · Red Hat Enterprise Linux)
- [CVE-2026-81341](https://cve.now/CVE-2026-81341.md): wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records (CVSS 6.5, wolfSSL wolfEngine)
- [CVE-2026-81020](https://cve.now/CVE-2026-81020.md): wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record (CVSS 7.4, wolfSSL wolfEngine)
- [CVE-2026-81019](https://cve.now/CVE-2026-81019.md): wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record (CVSS 7.4, wolfSSL wolfProvider)
- [CVE-2026-82220](https://cve.now/CVE-2026-82220.md): WordPress Forminator plugin \<= 1.57.1 - Other vulnerability Type vulnerability (CVSS 5.3, WPMU DEV Forminator)
- [CVE-2026-81767](https://cve.now/CVE-2026-81767.md): WordPress Simple Payment plugin \<= 2.5.2 - Broken Access Control vulnerability (CVSS 7.5, yalla ya! Simple Payment)
- [CVE-2026-81761](https://cve.now/CVE-2026-81761.md): WordPress WpEvently plugin \<= 5.5.0 - Broken Access Control vulnerability (CVSS 4.3, Magepeople WpEvently)
- [CVE-2026-81760](https://cve.now/CVE-2026-81760.md): WordPress JetEngine plugin \<= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Crocoblock JetEngine)
- [CVE-2026-81759](https://cve.now/CVE-2026-81759.md): WordPress WpEvently plugin \<= 5.5.0 - Broken Access Control vulnerability (CVSS 5.4, Magepeople WpEvently)
- [CVE-2026-81757](https://cve.now/CVE-2026-81757.md): WordPress Rank Math SEO plugin \<= 1.0.276 - Remote Code Execution (RCE) vulnerability (CVSS 7.2, Rank Math SEO)
- [CVE-2026-81299](https://cve.now/CVE-2026-81299.md): WordPress WP Job Portal plugin \<= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Ahmad WP Job Portal)
- [CVE-2026-81285](https://cve.now/CVE-2026-81285.md): WordPress Smush Image Compression and Optimization plugin \<= 4.2.0 - Denial of Service Attack vulnerability (CVSS 7.5, WPMU DEV Smush Image Compression and Optimization)
- [CVE-2026-81284](https://cve.now/CVE-2026-81284.md): WordPress ACF Extended plugin \<= 0.9.2.6 - Broken Access Control vulnerability (CVSS 4.3, ACF Extended)
- [CVE-2026-82227](https://cve.now/CVE-2026-82227.md): WordPress WPBulky plugin \<= 1.2.2 - SQL Injection vulnerability (CVSS 8.5, VillaTheme WPBulky)
- [CVE-2026-82328](https://cve.now/CVE-2026-82328.md): Gimp: heap out-of-bounds read in ico loader via unvalidated used\_clrs palette count (CVSS 6.1, GNOME GIMP · Red Hat Enterprise Linux)
- [CVE-2026-82327](https://cve.now/CVE-2026-82327.md): Libsolv: libsolv: out-of-bounds write in repo\_write() via unvalidated directory id from vertical/paged .solv filelist data (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images +3)
- [CVE-2026-5953](https://cve.now/CVE-2026-5953.md): Reflected XSS in Ceviz Informatics's Web Design (CVSS 6.1, Ceviz Informatics Web Design)
- [CVE-2026-5800](https://cve.now/CVE-2026-5800.md): Reflected XSS in Dayneks Software's E-Commerce Platform (CVSS 6.1, Dayneks Software Industry and Trade E-Commerce Platform)
- [CVE-2026-82324](https://cve.now/CVE-2026-82324.md): Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0 (CVSS 6.1, GNOME GIMP · Red Hat Enterprise Linux)
- [CVE-2026-15603](https://cve.now/CVE-2026-15603.md): morgan vulnerable to Log Forging via unescaped Unicode line separators (CVSS 5.3, morgan)
- [CVE-2026-19412](https://cve.now/CVE-2026-19412.md): Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router (CVSS 8.7, CP Plus CP-XR-DE21-S Router)
- [CVE-2026-13761](https://cve.now/CVE-2026-13761.md): Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. (CVSS 8.8, Pegasystems Pega Infinity)
- [CVE-2026-58107](https://cve.now/CVE-2026-58107.md): Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun (CVSS 5.5, Ericsson CodeChecker)
- [CVE-2026-58106](https://cve.now/CVE-2026-58106.md): Incomplete fix for CVE-2025-40843: safe\_strcpy is called with PATH\_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation (CVSS 2.0, Ericsson CodeChecker)
- [CVE-2026-82181](https://cve.now/CVE-2026-82181.md): Le-yan｜Medical Practice Management System - Sensitive Data in URL (CVSS 6.8, Le-yan Medical Practice Management System)
- [CVE-2026-82078](https://cve.now/CVE-2026-82078.md): PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector (CVSS 9.4, KEV, PaperCut MF/NG)
- [CVE-2026-81578](https://cve.now/CVE-2026-81578.md): PaperCut MF/NG: Authentication Bypass (CVSS 8.8, KEV, PaperCut MF/NG)
- [CVE-2026-82112](https://cve.now/CVE-2026-82112.md): houtini-ai houtini-lm code\_task\_files index.ts path traversal (CVSS 5.1, houtini-ai houtini-lm)
- [CVE-2026-6176](https://cve.now/CVE-2026-6176.md): Customer Reviews for WooCommerce \<= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form (CVSS 7.2, ivole Customer Reviews for WooCommerce)
- [CVE-2026-5096](https://cve.now/CVE-2026-5096.md): Everest Forms \<= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' (CVSS 5.3, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2026-5934](https://cve.now/CVE-2026-5934.md): WP Rocket \<= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket\_beacon Endpoint (CVSS 7.2, WP Media WP Rocket)
- [CVE-2026-3423](https://cve.now/CVE-2026-3423.md): Envira Gallery \<= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description (CVSS 6.4, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2026-75758](https://cve.now/CVE-2026-75758.md): Unbounded recursion between Inspect.List charlist rendering and List.to\_string/1 error path in Elixir (CVSS 5.9, elixir-lang elixir)
- [CVE-2026-82111](https://cve.now/CVE-2026-82111.md): iswalle getnote-mcp upload\_image index.ts fs.readFileSync path traversal (CVSS 5.3, iswalle getnote-mcp)
- [CVE-2026-82261](https://cve.now/CVE-2026-82261.md): SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization (CVSS 8.7, sveltejs kit · @sveltejs/kit)
- [CVE-2026-82260](https://cve.now/CVE-2026-82260.md): SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization (CVSS 8.7, sveltejs kit · @sveltejs/kit)
- [CVE-2026-82259](https://cve.now/CVE-2026-82259.md): SvelteKit 2.49.0 before 2.53.3 Denial of Service via form (CVSS 8.7, sveltejs kit · @sveltejs/kit)
- [CVE-2026-82258](https://cve.now/CVE-2026-82258.md): SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch (CVSS 5.9, sveltejs kit · @sveltejs/kit)
- [CVE-2026-82257](https://cve.now/CVE-2026-82257.md): SvelteKit before 2.69.1 Prototype Pollution via File Input (CVSS 5.3, sveltejs kit · @sveltejs/kit)
- [CVE-2026-82256](https://cve.now/CVE-2026-82256.md): SvelteKit before 2.69.1 Denial of Service via Remote Form (CVSS 6.9, sveltejs kit · @sveltejs/kit)
- [CVE-2026-82255](https://cve.now/CVE-2026-82255.md): gitoxide 0.25.4 HTTP Credential Leak via Redirect (CVSS 7.6, GitoxideLabs gitoxide · gix-transport)
- [CVE-2026-82254](https://cve.now/CVE-2026-82254.md): gitoxide before 0.69.0 Denial of Service via gix-pack (CVSS 8.7, GitoxideLabs gitoxide · gix-pack)
- [CVE-2026-82253](https://cve.now/CVE-2026-82253.md): gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass (CVSS 8.7, GitoxideLabs gitoxide · gix +1)
- [CVE-2026-82252](https://cve.now/CVE-2026-82252.md): gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules (CVSS 8.7, GitoxideLabs gitoxide · gitoxide +1)
- [CVE-2026-82251](https://cve.now/CVE-2026-82251.md): gitoxide before 0.52.1 Path Traversal via Submodule Name (CVSS 8.7, GitoxideLabs gitoxide · gitoxide +1)
- [CVE-2026-82250](https://cve.now/CVE-2026-82250.md): gitoxide gix-packetline before 0.21.5 Denial of Service (CVSS 7.1, GitoxideLabs gitoxide · gix-packetline)
- [CVE-2026-82249](https://cve.now/CVE-2026-82249.md): gitoxide before 0.38.2 Credential Helper Protocol Field Injection (CVSS 2.3, GitoxideLabs gitoxide)
- [CVE-2026-82248](https://cve.now/CVE-2026-82248.md): gitoxide before 0.33.0 Path Traversal via symlink following (CVSS 6.0, GitoxideLabs gitoxide)
- [CVE-2026-82247](https://cve.now/CVE-2026-82247.md): gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing (CVSS 8.7, GitoxideLabs gitoxide)
- [CVE-2026-82246](https://cve.now/CVE-2026-82246.md): Budibase Server before 3.41.3 SSRF via Query Import (CVSS 7.1, budibase server)
- [CVE-2026-82245](https://cve.now/CVE-2026-82245.md): Budibase before 3.41.3 Missing Authorization License Management (CVSS 7.2, budibase server)
- [CVE-2026-82244](https://cve.now/CVE-2026-82244.md): Budibase before 3.41.3 Remote Code Execution via Plugin eval() (CVSS 9.4, budibase server)
- [CVE-2026-82243](https://cve.now/CVE-2026-82243.md): Budibase Server before 3.41.3 SSRF with Credential Leakage (CVSS 8.3, budibase server)
- [CVE-2026-82242](https://cve.now/CVE-2026-82242.md): Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization (CVSS 8.3, budibase server)
- [CVE-2026-82241](https://cve.now/CVE-2026-82241.md): Budibase backend-core SSRF via incomplete default blacklist (CVSS 7.1, budibase server)
- [CVE-2026-82240](https://cve.now/CVE-2026-82240.md): Budibase before 3.41.3 Privilege Escalation via User Update API (CVSS 8.6, budibase server)
- [CVE-2026-82239](https://cve.now/CVE-2026-82239.md): Budibase before 3.41.3 Authorization Bypass via datasources/query (CVSS 8.6, budibase server)
- [CVE-2026-82238](https://cve.now/CVE-2026-82238.md): filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads (CVSS 2.3, filebrowser)
- [CVE-2026-82237](https://cve.now/CVE-2026-82237.md): filebrowser through 2.63.23 Stale Share Link via File Rename (CVSS 2.3, filebrowser)
- [CVE-2026-82236](https://cve.now/CVE-2026-82236.md): File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion (CVSS 2.3, filebrowser)
- [CVE-2026-82235](https://cve.now/CVE-2026-82235.md): filebrowser through 2.63.23 Denial of Service via named pipes (CVSS 8.2, filebrowser)
- [CVE-2026-82234](https://cve.now/CVE-2026-82234.md): SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU (CVSS 8.4, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-82233](https://cve.now/CVE-2026-82233.md): SiYuan before v3.8.1 Path Traversal via asset.upload (CVSS 6.9, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-81733](https://cve.now/CVE-2026-81733.md): WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php (CVSS 5.1, WWBN AVideo)
- [CVE-2026-81732](https://cve.now/CVE-2026-81732.md): WWBN AVideo through 30.0 Information Disclosure via report4.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-82222](https://cve.now/CVE-2026-82222.md): WordPress GiveWP plugin \<= 4.16.7.1 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Liquid Web / StellarWP GiveWP)
- [CVE-2026-73209](https://cve.now/CVE-2026-73209.md): An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. (CVSS 6.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-73208](https://cve.now/CVE-2026-73208.md): An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a s (CVSS 7.4, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-52687](https://cve.now/CVE-2026-52687.md): An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large (CVSS 6.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-52681](https://cve.now/CVE-2026-52681.md): Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly (CVSS 3.1, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-42395](https://cve.now/CVE-2026-42395.md): A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following log (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-42393](https://cve.now/CVE-2026-42393.md): The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. (CVSS 3.1, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-42392](https://cve.now/CVE-2026-42392.md): An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the er (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-42391](https://cve.now/CVE-2026-42391.md): An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CP (CVSS 7.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-42008](https://cve.now/CVE-2026-42008.md): Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a va (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-42007](https://cve.now/CVE-2026-42007.md): An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing (CVSS 9.1, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40205](https://cve.now/CVE-2026-40205.md): An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is requi (CVSS 5.9, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40204](https://cve.now/CVE-2026-40204.md): None None None No publicly available exploits are known. (CVSS 3.1, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40203](https://cve.now/CVE-2026-40203.md): When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attac (CVSS 3.7, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40019](https://cve.now/CVE-2026-40019.md): An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop c (CVSS 5.9, Open-Xchange OX Dovecot CE)
- [CVE-2026-40018](https://cve.now/CVE-2026-40018.md): None None None No publicly available exploits are known. (CVSS 7.4, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40017](https://cve.now/CVE-2026-40017.md): An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which make (CVSS 6.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40015](https://cve.now/CVE-2026-40015.md): An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermit (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40014](https://cve.now/CVE-2026-40014.md): An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the s (CVSS 6.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-40013](https://cve.now/CVE-2026-40013.md): An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-33607](https://cve.now/CVE-2026-33607.md): An attacker that has valid credentials can use IMAP LIST command to consume CPU. (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-33606](https://cve.now/CVE-2026-33606.md): Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync wit (CVSS 4.8, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-33605](https://cve.now/CVE-2026-33605.md): An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. (CVSS 7.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-33604](https://cve.now/CVE-2026-33604.md): An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending i (CVSS 5.9, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-33263](https://cve.now/CVE-2026-33263.md): When mail\_max\_userip\_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor ha (CVSS 4.3, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-27852](https://cve.now/CVE-2026-27852.md): An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters (CVSS 7.5, Open-Xchange OX Dovecot Pro · Open-Xchange OX Dovecot CE)
- [CVE-2026-81777](https://cve.now/CVE-2026-81777.md): WordPress Essential Addons for Elementor plugin \<= 6.8.0 - Bypass vulnerability vulnerability (CVSS 5.3, WPDeveloper Essential Addons for Elementor)
- [CVE-2026-18393](https://cve.now/CVE-2026-18393.md): Ffmpeg: ffmpeg: heap buffer overflow in tdsc\_load\_cursor() via cur\_fmt\_mono cursor (CVSS 5.4, Red Hat Enterprise Linux AI (RHEL AI) · Red Hat OpenShift AI)
- [CVE-2026-18918](https://cve.now/CVE-2026-18918.md): OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1\_0Allowed default (CVSS 9.1, Eclipse Foundation Eclipse Lyo)
- [CVE-2026-78071](https://cve.now/CVE-2026-78071.md): Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 (CVSS 7.5, digital-peak.com DP Calendar extension for Joomla)
- [CVE-2026-78073](https://cve.now/CVE-2026-78073.md): Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0 (CVSS 5.3, mrvinoth.com All Video Share extension for Joomla)
- [CVE-2026-78072](https://cve.now/CVE-2026-78072.md): Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded \< 5.6.1 (CVSS 8.7, Jefferson49 Sexy Polling Reloaded extension for Joomla)
- [CVE-2026-78070](https://cve.now/CVE-2026-78070.md): Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 (CVSS 6.9, digital-peak.com DP Calendar extension for Joomla)
- [CVE-2026-5510](https://cve.now/CVE-2026-5510.md): GiveWP \<= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2026-6128](https://cve.now/CVE-2026-6128.md): All-in-One WP Migration Unlimited Extension \<= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm\_backups\_path' Parameter (CVSS 6.4, servmask All-in-One WP Migration Unlimited Extension)
- [CVE-2026-9548](https://cve.now/CVE-2026-9548.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Ser (CVSS 6.5, Synology Chat Server)
- [CVE-2026-9491](https://cve.now/CVE-2026-9491.md): A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to (CVSS 4.3, Synology Chat Server)
- [CVE-2026-40541](https://cve.now/CVE-2026-40541.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Ser (CVSS 9.0, Synology Chat Server)
- [CVE-2026-80724](https://cve.now/CVE-2026-80724.md): ptp: vmclock: prevent read-only mappings from becoming writable (CVSS 8.8, Linux)
- [CVE-2026-82123](https://cve.now/CVE-2026-82123.md): WordPress Loops & Logic - Reflected XSS (CVSS 6.5, Tangible Loops & Logic)
- [CVE-2026-80723](https://cve.now/CVE-2026-80723.md): of: reserved\_mem: prevent OOB when too many dynamic regions are defined (CVSS 8.4, Linux)
- [CVE-2026-80722](https://cve.now/CVE-2026-80722.md): wifi: mac80211: validate individual TWT params before driver setup (CVSS 8.8, Linux)
- [CVE-2026-80721](https://cve.now/CVE-2026-80721.md): Bluetooth: ISO: ensure no dangling hcon references in iso\_conn (CVSS 8.8, Linux)
- [CVE-2026-80720](https://cve.now/CVE-2026-80720.md): iomap: add a separate bio\_set for iomap\_split\_ioend (CVSS 7.5, Linux)
- [CVE-2026-80719](https://cve.now/CVE-2026-80719.md): mm: mglru: fix stale batch updates after memcg reparenting (no CVSS, Linux)
- [CVE-2026-80718](https://cve.now/CVE-2026-80718.md): mm/percpu-km: fix bitmap overflow and accounting in pcpu\_create\_chunk() (CVSS 7.8, Linux)
- [CVE-2026-80717](https://cve.now/CVE-2026-80717.md): sctp: validate Adaptation Indication parameter length (CVSS 7.5, Linux)
- [CVE-2026-80716](https://cve.now/CVE-2026-80716.md): ALSA: pcm: wake linked drain waiters on unlink (CVSS 7.8, Linux)
- [CVE-2026-80715](https://cve.now/CVE-2026-80715.md): igc: remove napi\_synchronize() in igc\_down() (no CVSS, Linux)
- [CVE-2026-80714](https://cve.now/CVE-2026-80714.md): ipvs: do not propagate one-packet flag to synced conns (CVSS 9.8, Linux)
- [CVE-2026-80713](https://cve.now/CVE-2026-80713.md): io\_uring: preserve task restrictions across exec (CVSS 8.4, Linux)
- [CVE-2026-80712](https://cve.now/CVE-2026-80712.md): spi: spi-qpic-snand: write the feature value before executing SET\_FEATURE (CVSS 8.4, Linux)
- [CVE-2026-80711](https://cve.now/CVE-2026-80711.md): power: supply: max17040: handle missing status supplier (no CVSS, Linux)
- [CVE-2026-80710](https://cve.now/CVE-2026-80710.md): s390/dasd: Fix undersized format-check buffer (CVSS 7.8, Linux)
- [CVE-2026-80709](https://cve.now/CVE-2026-80709.md): s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (CVSS 7.8, Linux)
- [CVE-2026-80708](https://cve.now/CVE-2026-80708.md): s390/zcrypt: Fix missing mem scrub at clear key import in cca\_clr2cipherkey() (no CVSS, Linux)
- [CVE-2026-80707](https://cve.now/CVE-2026-80707.md): can: j1939: transport: j1939\_session\_fresh\_new(): initialize receive buffer (CVSS 7.5, Linux)
- [CVE-2026-80706](https://cve.now/CVE-2026-80706.md): can: softing: fw\_parse(): validate firmware record spans (CVSS 7.8, Linux)
- [CVE-2026-80705](https://cve.now/CVE-2026-80705.md): drm/amd/display: check if dml21\_add\_phantom\_plane() is successful (no CVSS, Linux)
- [CVE-2026-80704](https://cve.now/CVE-2026-80704.md): drm/amd/display: use proper context for logging (no CVSS, Linux)
- [CVE-2026-80703](https://cve.now/CVE-2026-80703.md): drm/amdkfd: Fix missing authorization check in KFD\_IOC\_DBG\_TRAP\_DISABLE (no CVSS, Linux)
- [CVE-2026-80702](https://cve.now/CVE-2026-80702.md): drm/vmwgfx: fix guest\_memory\_dirty bitfield clobbered as size (CVSS 7.8, Linux)
- [CVE-2026-80701](https://cve.now/CVE-2026-80701.md): drm/vmwgfx: enforce cursor size limits for MOB cursors (no CVSS, Linux)
- [CVE-2026-80700](https://cve.now/CVE-2026-80700.md): drm/vmwgfx: validate external BO copy bounds for both stride paths (CVSS 7.8, Linux)
- [CVE-2026-80699](https://cve.now/CVE-2026-80699.md): KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context (no CVSS, Linux)
- [CVE-2026-80698](https://cve.now/CVE-2026-80698.md): dmaengine: idxd: fix double free of wq, engine, and group structs (no CVSS, Linux)
- [CVE-2026-80697](https://cve.now/CVE-2026-80697.md): erofs: ensure valid f\_path for page cache sharing (no CVSS, Linux)
- [CVE-2026-80696](https://cve.now/CVE-2026-80696.md): hwmon: (ltc4282) Fix reading the minimum alarm voltage (CVSS 7.8, Linux)
- [CVE-2026-80695](https://cve.now/CVE-2026-80695.md): hwmon: (sht3x) Fix unaligned accesses (no CVSS, Linux)
- [CVE-2026-80694](https://cve.now/CVE-2026-80694.md): net: ethernet: mtk\_eth\_soc: pass eth to mtk\_handle\_irq\_rx in poll\_controller (CVSS 9.8, Linux)
- [CVE-2026-80693](https://cve.now/CVE-2026-80693.md): idpf: bound interrupt-vector register fill to the allocated array (CVSS 9.3, Linux)
- [CVE-2026-80692](https://cve.now/CVE-2026-80692.md): Bluetooth: hci\_sync: hold conn in hci\_connect\_acl/le\_sync() callbacks (CVSS 8.8, Linux)
- [CVE-2026-80691](https://cve.now/CVE-2026-80691.md): scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE (CVSS 7.5, Linux)
- [CVE-2026-80690](https://cve.now/CVE-2026-80690.md): scsi: ufs: core: Initialize hba-\>rpmbs list in ufshcd (no CVSS, Linux)
- [CVE-2026-80689](https://cve.now/CVE-2026-80689.md): tracing/mmiotrace: Add NULL check for mmio\_trace\_array in logging functions (no CVSS, Linux)
- [CVE-2026-80688](https://cve.now/CVE-2026-80688.md): riscv: drop \_\_init from vec\_check\_unaligned\_access\_speed\_all\_cpus (no CVSS, Linux)
- [CVE-2026-80687](https://cve.now/CVE-2026-80687.md): iommufd/viommu: Release the igroup lock on the vdevice\_size error path (no CVSS, Linux)
- [CVE-2026-80686](https://cve.now/CVE-2026-80686.md): mm: migrate\_device: fix pte\_pfn/pte\_dirty called on non-present PTE (no CVSS, Linux)
- [CVE-2026-80685](https://cve.now/CVE-2026-80685.md): mm/util: don't read \_\_page\_2 for order-1 folios in snapshot\_page() (CVSS 7.1, Linux)
- [CVE-2026-80684](https://cve.now/CVE-2026-80684.md): KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (CVSS 9.3, Linux)
- [CVE-2026-80683](https://cve.now/CVE-2026-80683.md): Bluetooth: SCO: give the socket its own sco\_conn reference (CVSS 8.8, Linux)
- [CVE-2026-80682](https://cve.now/CVE-2026-80682.md): riscv/mm: use physical alignment for vmemmap\_start\_pfn (CVSS 7.8, Linux)
- [CVE-2026-80681](https://cve.now/CVE-2026-80681.md): vxlan: re-fetch eth header after route\_shortcircuit() (CVSS 9.8, Linux)
- [CVE-2026-80680](https://cve.now/CVE-2026-80680.md): i2c: amd-mp2: Unregister callback on adapter add failure (CVSS 7.8, Linux)
- [CVE-2026-80679](https://cve.now/CVE-2026-80679.md): s390/dasd: Fix potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2026-80678](https://cve.now/CVE-2026-80678.md): i2c: imx: Fix slave registration race and error handling (CVSS 8.4, Linux)
- [CVE-2026-80677](https://cve.now/CVE-2026-80677.md): driver core: use READ\_ONCE() for dev-\>driver in dev\_has\_sync\_state() (CVSS 7.8, Linux)
- [CVE-2026-80676](https://cve.now/CVE-2026-80676.md): Drivers: hv: vmbus: use generic driver\_override infrastructure (no CVSS, Linux)
- [CVE-2026-80675](https://cve.now/CVE-2026-80675.md): libbpf: Reject non-exclusive metadata maps in the signed loader (CVSS 7.1, Linux)
- [CVE-2026-80674](https://cve.now/CVE-2026-80674.md): ntfs: validate resident attribute lists and harden the validator (CVSS 9.8, Linux)
- [CVE-2026-80673](https://cve.now/CVE-2026-80673.md): ntfs: bound the look-ahead attribute-list entry in ntfs\_external\_attr\_find() (CVSS 9.8, Linux)
- [CVE-2026-80672](https://cve.now/CVE-2026-80672.md): ntfs: fix u16 truncation of restart-area length check (CVSS 8.8, Linux)
- [CVE-2026-80671](https://cve.now/CVE-2026-80671.md): perf sched: Fix register\_pid() overflow, strcpy, and BUG\_ON (CVSS 9.3, Linux)
- [CVE-2026-80670](https://cve.now/CVE-2026-80670.md): perf tools: Use perf\_env\_\_get\_cpu\_topology() in machine\_\_resolve() (CVSS 9.1, Linux)
- [CVE-2026-80669](https://cve.now/CVE-2026-80669.md): bpf: Disable xfrm\_decode\_session hook attachment (no CVSS, Linux)
- [CVE-2026-80668](https://cve.now/CVE-2026-80668.md): netfilter: nf\_conntrack\_expect: use conntrack GC to reap expectations (CVSS 9.8, Linux)
- [CVE-2026-80667](https://cve.now/CVE-2026-80667.md): net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (no CVSS, Linux)
- [CVE-2026-80666](https://cve.now/CVE-2026-80666.md): Bluetooth: sco: Fix a race condition in sco\_sock\_timeout() (no CVSS, Linux)
- [CVE-2026-80665](https://cve.now/CVE-2026-80665.md): KVM: arm64: nv: Inject SEA if kvm\_translate\_vncr() can't resolve PFN (CVSS 7.1, Linux)
- [CVE-2026-80664](https://cve.now/CVE-2026-80664.md): netfilter: xt\_nat: reject unsupported target families (CVSS 7.3, Linux)
- [CVE-2026-80663](https://cve.now/CVE-2026-80663.md): tools/power/x86/intel-speed-select: Harden daemon pidfile open (CVSS 7.1, Linux)
- [CVE-2026-80662](https://cve.now/CVE-2026-80662.md): cxl: Fix CXL\_HEADERLOG\_SIZE to match RAS Capability size (CVSS 7.1, Linux)
- [CVE-2026-80661](https://cve.now/CVE-2026-80661.md): ufs: core: tracing: Do not dereference pointers in TP\_printk() (CVSS 7.8, Linux)
- [CVE-2026-80660](https://cve.now/CVE-2026-80660.md): hwmon: (occ) unregister sysfs devices outside occ lock (no CVSS, Linux)
- [CVE-2026-80659](https://cve.now/CVE-2026-80659.md): mmc: vub300: defer reset until cmd\_mutex is unlocked (no CVSS, Linux)
- [CVE-2026-80658](https://cve.now/CVE-2026-80658.md): drm/rockchip: dw\_dp: Fix null-ptr-deref in dw\_dp\_remove() (no CVSS, Linux)
- [CVE-2026-80657](https://cve.now/CVE-2026-80657.md): accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer (no CVSS, Linux)
- [CVE-2026-80656](https://cve.now/CVE-2026-80656.md): hfsplus: Add a sanity check for btree node size (CVSS 7.8, Linux)
- [CVE-2026-80655](https://cve.now/CVE-2026-80655.md): soc: xilinx: Fix race condition in event registration (no CVSS, Linux)
- [CVE-2026-80654](https://cve.now/CVE-2026-80654.md): soc: xilinx: Shutdown and free rx mailbox channel (no CVSS, Linux)
- [CVE-2026-80653](https://cve.now/CVE-2026-80653.md): scsi: hisi\_sas: Add slave\_destroy interface for v3 hw (CVSS 8.4, Linux)
- [CVE-2026-80652](https://cve.now/CVE-2026-80652.md): crypto: ccp - Treat zero-length cert chain as query for blob lengths (no CVSS, Linux)
- [CVE-2026-80651](https://cve.now/CVE-2026-80651.md): crypto: ccp/sev-dev-tsm - bail out early when pdev-\>bus is NULL (no CVSS, Linux)
- [CVE-2026-80650](https://cve.now/CVE-2026-80650.md): media: atomisp: gc2235: fix UAF and memory leak (no CVSS, Linux)
- [CVE-2026-80649](https://cve.now/CVE-2026-80649.md): firmware: arm\_scmi: Fix OOB in scmi\_power\_name\_get() (CVSS 7.8, Linux)
- [CVE-2026-80648](https://cve.now/CVE-2026-80648.md): pinctrl: spacemit: fix NULL check in spacemit\_pin\_set\_config (no CVSS, Linux)
- [CVE-2026-80647](https://cve.now/CVE-2026-80647.md): RDMA/hns: Fix warning in poll cq direct mode (no CVSS, Linux)
- [CVE-2026-80646](https://cve.now/CVE-2026-80646.md): ipv6: guard against possible NULL deref in \_\_in6\_dev\_stats\_get() (CVSS 7.5, Linux)
- [CVE-2026-80645](https://cve.now/CVE-2026-80645.md): rapidio/tsi721: prevent a bad dereference in tsi721\_db\_dpc() (CVSS 8.1, Linux)
- [CVE-2026-80644](https://cve.now/CVE-2026-80644.md): ocfs2: don't BUG\_ON an invalid journal dinode (no CVSS, Linux)
- [CVE-2026-80643](https://cve.now/CVE-2026-80643.md): EDAC/igen6: Fix call trace due to missing release() (no CVSS, Linux)
- [CVE-2026-80642](https://cve.now/CVE-2026-80642.md): liveupdate: Reference count incoming FLB data (no CVSS, Linux)
- [CVE-2026-80641](https://cve.now/CVE-2026-80641.md): wifi: wlcore: enable the right set of ciphers (no CVSS, Linux)
- [CVE-2026-80640](https://cve.now/CVE-2026-80640.md): cxl/fwctl: Fix \_\_fortify\_panic (no CVSS, Linux)
- [CVE-2026-80639](https://cve.now/CVE-2026-80639.md): cxl/test: Fix \_\_fortify\_panic (no CVSS, Linux)
- [CVE-2026-80638](https://cve.now/CVE-2026-80638.md): ocfs2: fix out-of-bounds write in ocfs2\_remove\_refcount\_extent (CVSS 8.8, Linux)
- [CVE-2026-80637](https://cve.now/CVE-2026-80637.md): netfilter: synproxy: fix unaligned memory access in timestamp adjustment (CVSS 7.5, Linux)
- [CVE-2026-80636](https://cve.now/CVE-2026-80636.md): netfilter: conntrack: revert ct extension genid infrastructure (no CVSS, Linux)
- [CVE-2026-80635](https://cve.now/CVE-2026-80635.md): wifi: wcn36xx: fix OOB read from short trigger BA firmware response (CVSS 8.8, Linux)
- [CVE-2026-80634](https://cve.now/CVE-2026-80634.md): netfilter: flowtable: avoid num\_encaps underflow on bridge VLAN untag (CVSS 9.8, Linux)
- [CVE-2026-80633](https://cve.now/CVE-2026-80633.md): iommufd: Take dma\_resv lock before dma\_buf\_unpin() in release path (CVSS 8.8, Linux)
- [CVE-2026-80632](https://cve.now/CVE-2026-80632.md): wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996\_init\_tx\_queues() (no CVSS, Linux)
- [CVE-2026-80631](https://cve.now/CVE-2026-80631.md): btrfs: lzo: reject compressed segment that overflows the compressed input (CVSS 7.5, Linux)
- [CVE-2026-80630](https://cve.now/CVE-2026-80630.md): net/sched: sch\_fq\_codel: Do not call qdisc\_tree\_reduce\_backlog during peek before restoring qlen (CVSS 9.8, Linux)
- [CVE-2026-80629](https://cve.now/CVE-2026-80629.md): octeontx2-af: npc: Fix size of entry2cntr\_map (no CVSS, Linux)
- [CVE-2026-80628](https://cve.now/CVE-2026-80628.md): ALSA: seq: oss: Serialize readq reset state with q-\>lock (CVSS 7.8, Linux)
- [CVE-2026-80627](https://cve.now/CVE-2026-80627.md): MIPS: mm: Fix out-of-bounds write in maar\_res\_walk() (no CVSS, Linux)
- [CVE-2026-80626](https://cve.now/CVE-2026-80626.md): powerpc/perf: fix preempt count underflow in fsl\_emb\_pmu\_del (no CVSS, Linux)
- [CVE-2026-80625](https://cve.now/CVE-2026-80625.md): RDMA/hns: Fix memory leak of bonding resources (no CVSS, Linux)
- [CVE-2026-80624](https://cve.now/CVE-2026-80624.md): mfd: cs42l43: Sanity check firmware size (no CVSS, Linux)
- [CVE-2026-80623](https://cve.now/CVE-2026-80623.md): coresight: ete: Always save state on power down (no CVSS, Linux)
- [CVE-2026-80622](https://cve.now/CVE-2026-80622.md): char: tlclk: fix use-after-free in tlclk\_cleanup() (CVSS 7.8, Linux)
- [CVE-2026-80621](https://cve.now/CVE-2026-80621.md): PCI: dwc: Avoid dwc\_pcie\_rasdes\_debugfs\_deinit() NULL dereference when no RAS DES capability (no CVSS, Linux)
- [CVE-2026-80620](https://cve.now/CVE-2026-80620.md): Revert "PCI/MSI: Unmap MSI-X region on error" (no CVSS, Linux)
- [CVE-2026-80619](https://cve.now/CVE-2026-80619.md): apparmor: fix potential UAF in aa\_replace\_profiles (CVSS 7.8, Linux)
- [CVE-2026-80618](https://cve.now/CVE-2026-80618.md): drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (no CVSS, Linux)
- [CVE-2026-80617](https://cve.now/CVE-2026-80617.md): net: airoha: fix foe\_check\_time allocation size (CVSS 9.8, Linux)
- [CVE-2026-80616](https://cve.now/CVE-2026-80616.md): ieee802154: Avoid calling WARN\_ON() on -ENOMEM in cfg802154\_switch\_netns() (no CVSS, Linux)
- [CVE-2026-80615](https://cve.now/CVE-2026-80615.md): net: dst\_metadata: fix false-positive memcpy overflow in tun\_dst\_unclone (CVSS 8.2, Linux)
- [CVE-2026-80614](https://cve.now/CVE-2026-80614.md): net: emac: Fix NULL pointer dereference in emac\_probe (CVSS 7.5, Linux)
- [CVE-2026-80613](https://cve.now/CVE-2026-80613.md): veth: fix NAPI leak in XDP enable error path (CVSS 7.8, Linux)
- [CVE-2026-80612](https://cve.now/CVE-2026-80612.md): net: lwtunnel: Drop skb metadata before LWT encapsulation (CVSS 9.8, Linux)
- [CVE-2026-80611](https://cve.now/CVE-2026-80611.md): ACPI: processor\_idle: Mark LPI enter functions as \_\_cpuidle (no CVSS, Linux)
- [CVE-2026-80610](https://cve.now/CVE-2026-80610.md): net: enetc: fix potential divide-by-zero when num\_vsi is zero (no CVSS, Linux)
- [CVE-2026-80609](https://cve.now/CVE-2026-80609.md): qede: fix out-of-bounds check for cqe-\>len\_list\[\] (CVSS 9.8, Linux)
- [CVE-2026-80608](https://cve.now/CVE-2026-80608.md): accel/amdxdna: Fix iommu domain lifetime race during device removal (CVSS 8.8, Linux)
- [CVE-2026-80607](https://cve.now/CVE-2026-80607.md): tracing/probes: Remove WARN\_ON\_ONCE from parse\_btf\_arg (no CVSS, Linux)
- [CVE-2026-80606](https://cve.now/CVE-2026-80606.md): drm/xe/userptr: Hold notifier\_lock for write on inject test path (CVSS 7.8, Linux)
- [CVE-2026-80605](https://cve.now/CVE-2026-80605.md): HID: picolcd: prevent NULL pointer dereference in picolcd\_send\_and\_wait() (no CVSS, Linux)
- [CVE-2026-80604](https://cve.now/CVE-2026-80604.md): HID: core: Fix OOB read in hid\_get\_report for numbered reports (CVSS 8.8, Linux)
- [CVE-2026-80603](https://cve.now/CVE-2026-80603.md): netfilter: nf\_conntrack\_irc: fix parse\_dcc() off-by-one OOB read (CVSS 9.1, Linux)
- [CVE-2026-80602](https://cve.now/CVE-2026-80602.md): perf/x86/amd/lbr: Fix kernel address leakage (no CVSS, Linux)
- [CVE-2026-80601](https://cve.now/CVE-2026-80601.md): batman-adv: gw: acquire ethernet header only after skb realloc (CVSS 8.8, Linux)
- [CVE-2026-80600](https://cve.now/CVE-2026-80600.md): batman-adv: dat: acquire ARP hw source only after skb realloc (CVSS 9.8, Linux)
- [CVE-2026-80599](https://cve.now/CVE-2026-80599.md): batman-adv: dat: ensure accessible eth\_hdr proto field (CVSS 8.1, Linux)
- [CVE-2026-80598](https://cve.now/CVE-2026-80598.md): ntfs3: fix out-of-bounds read in decompress\_lznt (CVSS 7.8, Linux)
- [CVE-2026-80597](https://cve.now/CVE-2026-80597.md): mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (no CVSS, Linux)
- [CVE-2026-80596](https://cve.now/CVE-2026-80596.md): Input: ims-pcu - only expose sysfs attributes on control interface (CVSS 8.4, Linux)
- [CVE-2026-80595](https://cve.now/CVE-2026-80595.md): Input: ims-pcu - add response length checks (no CVSS, Linux)
- [CVE-2026-80594](https://cve.now/CVE-2026-80594.md): Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (no CVSS, Linux)
- [CVE-2026-80593](https://cve.now/CVE-2026-80593.md): hwmon: (asus\_atk0110) Check package count before accessing element (CVSS 8.4, Linux)
- [CVE-2026-80592](https://cve.now/CVE-2026-80592.md): samples/damon/mtier: fail early if address range parameters are invalid (no CVSS, Linux)
- [CVE-2026-80591](https://cve.now/CVE-2026-80591.md): f2fs: fix listxattr handling of corrupted xattr entries (CVSS 7.8, Linux)
- [CVE-2026-5097](https://cve.now/CVE-2026-5097.md): wpForo Forum \<= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter (CVSS 7.5, tomdever wpForo Forum)
- [CVE-2026-6286](https://cve.now/CVE-2026-6286.md): Booking for Appointments and Events Calendar \<= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission (CVSS 7.2, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-76581](https://cve.now/CVE-2026-76581.md): WPMU DEV Dashboard \<= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion (CVSS 9.8, wpmudev WPMU DEV Dashboard)
- [CVE-2026-80590](https://cve.now/CVE-2026-80590.md): inet: frags: strip GSO state from fragments before reassembly (CVSS 8.6, Linux)
- [CVE-2026-78032](https://cve.now/CVE-2026-78032.md): SOY CMS contains an issue with deserialization of untrusted data. (CVSS 9.8, Tsuyoshi Saito SOY CMS)
- [CVE-2026-78238](https://cve.now/CVE-2026-78238.md): SOY Gallery contains a cross-site scripting vulnerability. (CVSS 5.4, Tsuyoshi Saito SOY Gallery)
- [CVE-2026-77838](https://cve.now/CVE-2026-77838.md): SOY Calendar contains a cross-site scripting vulnerability. (CVSS 5.4, Tsuyoshi Saito SOY Calendar)
- [CVE-2026-73827](https://cve.now/CVE-2026-73827.md): SOY Calendar contains a cross-site scripting vulnerability. (CVSS 5.4, Tsuyoshi Saito SOY Calendar)
- [CVE-2026-79996](https://cve.now/CVE-2026-79996.md): User Registration & Membership \< 5.2.6 - Authenticated Privilege Escalation via Login Settings (CVSS 7.2, User Registration & Membership)
- [CVE-2026-79995](https://cve.now/CVE-2026-79995.md): User Registration & Membership \< 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR (CVSS 4.3, User Registration & Membership)
- [CVE-2026-79706](https://cve.now/CVE-2026-79706.md): Breeze Cache \< 2.5.13 - Unauthenticated File Creation via Cache Path Traversal (CVSS 5.3, Breeze Cache)
- [CVE-2026-79615](https://cve.now/CVE-2026-79615.md): Quiz And Survey Master \< 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR (CVSS 2.7, Quiz and Survey Master)
- [CVE-2026-77701](https://cve.now/CVE-2026-77701.md): WCFM Marketplace \< 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders (CVSS 5.3, WCFM Marketplace)
- [CVE-2026-19423](https://cve.now/CVE-2026-19423.md): Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms (CVSS 8.1, Ultimate Member)
- [CVE-2026-19084](https://cve.now/CVE-2026-19084.md): Shared Files \< 1.7.70 - Unauthenticated Arbitrary File Read (CVSS 7.5, shared-files-pro)
- [CVE-2026-14567](https://cve.now/CVE-2026-14567.md): WP User Frontend \< 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory (CVSS 5.3, User Frontend)
- [CVE-2026-14558](https://cve.now/CVE-2026-14558.md): WP User Frontend \< 4.3.10 - Editor+ PHP Object Injection via AI Form Builder (CVSS 7.2, User Frontend)
- [CVE-2026-12514](https://cve.now/CVE-2026-12514.md): Shared Files \< 1.7.70 - Unauthenticated Limited File Upload (CVSS 5.3, Shared Files · shared-files-pro)
- [CVE-2026-12513](https://cve.now/CVE-2026-12513.md): Shared Files \< 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal (CVSS 6.8, Shared Files · shared-files-pro)
- [CVE-2026-4246](https://cve.now/CVE-2026-4246.md): ElementsKit Pro \<= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter (CVSS 6.1, wpmet ElementsKit Pro)
- [CVE-2026-16654](https://cve.now/CVE-2026-16654.md): Avada (Fusion) Builder \<= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute (CVSS 6.4, themefusion Avada (Fusion) Builder)
- [CVE-2026-18983](https://cve.now/CVE-2026-18983.md): One User Avatar | User Profile Picture \<= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter (CVSS 7.5, onedesigns One User Avatar | User Profile Picture)
- [CVE-2026-3129](https://cve.now/CVE-2026-3129.md): LiteSpeed Cache \<= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes (CVSS 6.4, litespeedtech LiteSpeed Cache)
- [CVE-2026-16759](https://cve.now/CVE-2026-16759.md): Tutor LMS \<= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-18324](https://cve.now/CVE-2026-18324.md): Forminator Forms \<= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (CVSS 7.2, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2026-18978](https://cve.now/CVE-2026-18978.md): LiteSpeed Cache \<= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, litespeedtech LiteSpeed Cache)
- [CVE-2026-82090](https://cve.now/CVE-2026-82090.md): Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. (CVSS 9.2, getpocket Pocket)
- [CVE-2026-82089](https://cve.now/CVE-2026-82089.md): The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a (CVSS 8.8, wallabag android-app)
- [CVE-2026-82082](https://cve.now/CVE-2026-82082.md): Green-Computing｜NUMail - OS Command Injection (CVSS 9.3, Green-Computing NUMail)
- [CVE-2026-82081](https://cve.now/CVE-2026-82081.md): wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export. (CVSS 6.4, wallabag)
- [CVE-2026-15798](https://cve.now/CVE-2026-15798.md): Smart Slider 3 \<= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute (CVSS 6.4, nextendweb Smart Slider)
- [CVE-2026-77365](https://cve.now/CVE-2026-77365.md): Optimole \<= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above\_fold\_images) Parameter (CVSS 7.2, Optimole – Optimize Images | Convert WebP & AVIF | CDN & La…)
- [CVE-2026-76053](https://cve.now/CVE-2026-76053.md): TranslatePress \<= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-38822](https://cve.now/CVE-2026-38822.md): In openNDS before 11.0.0, the client\_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulne (CVSS 7.6, openNDS)
- [CVE-2026-38821](https://cve.now/CVE-2026-38821.md): A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal net (CVSS 7.1, openNDS)
- [CVE-2026-38820](https://cve.now/CVE-2026-38820.md): openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on (CVSS 8.3, openNDS)
- [CVE-2026-38819](https://cve.now/CVE-2026-38819.md): Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memo (CVSS 5.3, openNDS)
- [CVE-2026-37236](https://cve.now/CVE-2026-37236.md): grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2026-37237](https://cve.now/CVE-2026-37237.md): vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. (CVSS 7.5)
- [CVE-2026-37710](https://cve.now/CVE-2026-37710.md): Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL (CVSS 6.1)
- [CVE-2026-37736](https://cve.now/CVE-2026-37736.md): An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a (CVSS 7.5)
- [CVE-2026-37751](https://cve.now/CVE-2026-37751.md): An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attac (CVSS 9.8)
- [CVE-2026-38093](https://cve.now/CVE-2026-38093.md): file\_picker (aka flutter\_file\_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android imp (CVSS 3.3)
- [CVE-2026-38636](https://cve.now/CVE-2026-38636.md): An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafte (CVSS 7.5)
- [CVE-2026-38638](https://cve.now/CVE-2026-38638.md): An issue in the with\_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafte (CVSS 7.5)
- [CVE-2026-38725](https://cve.now/CVE-2026-38725.md): xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and cont (CVSS 5.4)
- [CVE-2026-39070](https://cve.now/CVE-2026-39070.md): WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. (CVSS 4.8)
- [CVE-2026-39071](https://cve.now/CVE-2026-39071.md): WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. (CVSS 5.4)
- [CVE-2026-50979](https://cve.now/CVE-2026-50979.md): A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated atta (CVSS 8.1)
- [CVE-2026-50980](https://cve.now/CVE-2026-50980.md): Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute (CVSS 6.1)
- [CVE-2026-51376](https://cve.now/CVE-2026-51376.md): An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mes (CVSS 6.5)
- [CVE-2026-51610](https://cve.now/CVE-2026-51610.md): Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to arbitrarily f (CVSS 4.3)
- [CVE-2026-51611](https://cve.now/CVE-2026-51611.md): Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to arbitrari (CVSS 9.8)
- [CVE-2026-51613](https://cve.now/CVE-2026-51613.md): Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain devic (CVSS 4.3)
- [CVE-2026-51614](https://cve.now/CVE-2026-51614.md): Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51615](https://cve.now/CVE-2026-51615.md): Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain LAN addre (CVSS 7.5)
- [CVE-2026-51616](https://cve.now/CVE-2026-51616.md): Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain LAN add (CVSS 7.5)
- [CVE-2026-51617](https://cve.now/CVE-2026-51617.md): Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain sen (CVSS 7.5)
- [CVE-2026-51618](https://cve.now/CVE-2026-51618.md): Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain setup (CVSS 7.5)
- [CVE-2026-51619](https://cve.now/CVE-2026-51619.md): Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain onl (CVSS 7.5)
- [CVE-2026-51620](https://cve.now/CVE-2026-51620.md): Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain netwo (CVSS 7.5)
- [CVE-2026-51621](https://cve.now/CVE-2026-51621.md): Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain sensitiv (CVSS 7.5)
- [CVE-2026-51622](https://cve.now/CVE-2026-51622.md): Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain WAN confi (CVSS 9.1)
- [CVE-2026-51623](https://cve.now/CVE-2026-51623.md): Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain DDNS (CVSS 7.5)
- [CVE-2026-51624](https://cve.now/CVE-2026-51624.md): Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain a (CVSS 7.5)
- [CVE-2026-51625](https://cve.now/CVE-2026-51625.md): Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain sens (CVSS 7.5)
- [CVE-2026-51626](https://cve.now/CVE-2026-51626.md): Incorrect access control in the getWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain WPS c (CVSS 9.1)
- [CVE-2026-51627](https://cve.now/CVE-2026-51627.md): Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain IPTV and (CVSS 7.5)
- [CVE-2026-51628](https://cve.now/CVE-2026-51628.md): Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to gene (CVSS 9.1)
- [CVE-2026-51629](https://cve.now/CVE-2026-51629.md): Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51630](https://cve.now/CVE-2026-51630.md): Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain DDNS con (CVSS 4.3)
- [CVE-2026-51631](https://cve.now/CVE-2026-51631.md): Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51632](https://cve.now/CVE-2026-51632.md): Incorrect access control in the getWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51633](https://cve.now/CVE-2026-51633.md): Incorrect access control in the getWiFiEasyGuestCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51634](https://cve.now/CVE-2026-51634.md): Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain cor (CVSS 4.3)
- [CVE-2026-51635](https://cve.now/CVE-2026-51635.md): Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51636](https://cve.now/CVE-2026-51636.md): Incorrect access control in the getWiFiAclRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain Wi- (CVSS 9.1)
- [CVE-2026-51637](https://cve.now/CVE-2026-51637.md): Incorrect access control in the getMeshPortalTable function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 4.3)
- [CVE-2026-51638](https://cve.now/CVE-2026-51638.md): Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain gue (CVSS 4.3)
- [CVE-2026-51639](https://cve.now/CVE-2026-51639.md): Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain AP- (CVSS 4.3)
- [CVE-2026-51640](https://cve.now/CVE-2026-51640.md): Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtai (CVSS 4.3)
- [CVE-2026-51641](https://cve.now/CVE-2026-51641.md): Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain m (CVSS 7.5)
- [CVE-2026-51642](https://cve.now/CVE-2026-51642.md): Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 7.5)
- [CVE-2026-51643](https://cve.now/CVE-2026-51643.md): Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain NTP confi (CVSS 9.1)
- [CVE-2026-51644](https://cve.now/CVE-2026-51644.md): Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain cloud (CVSS 7.5)
- [CVE-2026-51645](https://cve.now/CVE-2026-51645.md): Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain the (CVSS 9.8)
- [CVE-2026-51646](https://cve.now/CVE-2026-51646.md): Incorrect access control in the getParentalRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain pa (CVSS 9.1)
- [CVE-2026-51647](https://cve.now/CVE-2026-51647.md): Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain cloud re (CVSS 7.5)
- [CVE-2026-51648](https://cve.now/CVE-2026-51648.md): Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain WAN info (CVSS 7.5)
- [CVE-2026-51649](https://cve.now/CVE-2026-51649.md): Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain dia (CVSS 9.1)
- [CVE-2026-51650](https://cve.now/CVE-2026-51650.md): Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain remote (CVSS 7.5)
- [CVE-2026-51651](https://cve.now/CVE-2026-51651.md): Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain Smar (CVSS 4.3)
- [CVE-2026-51652](https://cve.now/CVE-2026-51652.md): Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain UPnP ena (CVSS 4.3)
- [CVE-2026-51653](https://cve.now/CVE-2026-51653.md): Incorrect access control in the getStorageCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain stora (CVSS 4.3)
- [CVE-2026-51654](https://cve.now/CVE-2026-51654.md): Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain sche (CVSS 4.3)
- [CVE-2026-51655](https://cve.now/CVE-2026-51655.md): Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain M (CVSS 4.3)
- [CVE-2026-51656](https://cve.now/CVE-2026-51656.md): Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain VPN p (CVSS 4.3)
- [CVE-2026-51657](https://cve.now/CVE-2026-51657.md): Incorrect access control in the getSyslogCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain syslog (CVSS 9.1)
- [CVE-2026-51658](https://cve.now/CVE-2026-51658.md): Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain DMZ confi (CVSS 7.5)
- [CVE-2026-51659](https://cve.now/CVE-2026-51659.md): Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain D (CVSS 7.5)
- [CVE-2026-51660](https://cve.now/CVE-2026-51660.md): Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtai (CVSS 9.1)
- [CVE-2026-51661](https://cve.now/CVE-2026-51661.md): Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain (CVSS 9.1)
- [CVE-2026-51662](https://cve.now/CVE-2026-51662.md): Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obt (CVSS 7.5)
- [CVE-2026-51663](https://cve.now/CVE-2026-51663.md): Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to trigger w (CVSS 9.8)
- [CVE-2026-51664](https://cve.now/CVE-2026-51664.md): Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain Telnet (CVSS 4.3)
- [CVE-2026-51665](https://cve.now/CVE-2026-51665.md): Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain tr (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.