# CVEs published 2026-08-31

357 CVEs were published on August 31, 2026: 92 critical, 96 high. Days are UTC.

- [CVE-2026-83524](https://cve.now/CVE-2026-83524.md): RedPort Optimizer wXa-223 System Clock datetime.php exec command injection (CVSS 9.4, RedPort Optimizer wXa-203 · RedPort Optimizer wXa-213 +1)
- [CVE-2026-82971](https://cve.now/CVE-2026-82971.md): QVidium Opera11 CGI Script net\_tr.cgi command injection (CVSS 10.0, QVidium Opera11)
- [CVE-2026-82957](https://cve.now/CVE-2026-82957.md): hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery (CVSS 6.9, hyperledger-firefly firefly)
- [CVE-2026-82954](https://cve.now/CVE-2026-82954.md): Dokploy Settings application.ts writeTraefikConfigInPath path traversal (CVSS 9.4, Dokploy)
- [CVE-2026-82398](https://cve.now/CVE-2026-82398.md): pypdf: Inefficient handling of non-whitespace inputs in read\_until\_whitespace (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-82922](https://cve.now/CVE-2026-82922.md): ShopEx ECShop flow.php flow\_update\_cart sql injection (CVSS 6.9, ShopEx ECShop)
- [CVE-2026-82397](https://cve.now/CVE-2026-82397.md): Tornado: Urlencoded body parsing omits max\_num\_fields, so one request can stall the event loop (CVSS 7.5, tornadoweb tornado · tornado)
- [CVE-2026-82396](https://cve.now/CVE-2026-82396.md): Sulu: Stored XSS via media download inline-disposition override (CVSS 5.4, sulu · sulu/sulu)
- [CVE-2026-77353](https://cve.now/CVE-2026-77353.md): Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export (CVSS 4.6, ellite Wallos)
- [CVE-2026-77352](https://cve.now/CVE-2026-77352.md): Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) (CVSS 4.3, ellite Wallos)
- [CVE-2026-82395](https://cve.now/CVE-2026-82395.md): Sulu: Media move/update authorization bypass (IDOR) (CVSS 5.3, sulu · sulu/sulu)
- [CVE-2026-82394](https://cve.now/CVE-2026-82394.md): Sulu: Fix authorization bypass when creating preview links (CVSS 5.3, sulu · sulu/sulu)
- [CVE-2026-77348](https://cve.now/CVE-2026-77348.md): Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via \`endpoints/payments/search.php\` (CVSS 8.2, ellite Wallos)
- [CVE-2026-82921](https://cve.now/CVE-2026-82921.md): ShopEx ECShop pack.php check\_img\_type unrestricted upload (CVSS 6.9, ShopEx ECShop)
- [CVE-2026-77351](https://cve.now/CVE-2026-77351.md): Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings (CVSS 3.5, ellite Wallos)
- [CVE-2026-82393](https://cve.now/CVE-2026-82393.md): pnpm: A tarball dependency's manifest \`name\` escapes node\_modules → arbitrary file write/overwrite on install (CVSS 7.5, pnpm)
- [CVE-2026-82882](https://cve.now/CVE-2026-82882.md): Devtron through 2.2.0 Missing Authorization via webhook API token endpoint (CVSS 8.7, devtron-labs devtron)
- [CVE-2026-82392](https://cve.now/CVE-2026-82392.md): pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph (CVSS 7.1, pnpm)
- [CVE-2026-82919](https://cve.now/CVE-2026-82919.md): cu silicon edit Endpoint views.py create\_app missing authentication (CVSS 6.9, cu silicon)
- [CVE-2026-62993](https://cve.now/CVE-2026-62993.md): Smarty: SSRF via redirect bypass of trusted\_uri using {fetch} (CVSS 6.9, smarty-php smarty · smarty/smarty)
- [CVE-2026-75594](https://cve.now/CVE-2026-75594.md): Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling (CVSS 8.2, getkirby kirby · getkirby/cms)
- [CVE-2026-61641](https://cve.now/CVE-2026-61641.md): Wallos: OIDC account takeover via email-based account linking without \`email\_verified\` check (CVSS 8.1, ellite Wallos)
- [CVE-2026-75592](https://cve.now/CVE-2026-75592.md): Kirby: Access to image files outside of the site root via path traversal in the media handling (CVSS 6.9, getkirby kirby · getkirby/cms)
- [CVE-2026-61640](https://cve.now/CVE-2026-61640.md): Wallos: SSRF via OIDC Token/UserInfo URL Configuration (CVSS 8.5, ellite Wallos)
- [CVE-2026-83596](https://cve.now/CVE-2026-83596.md): Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature (CVSS 8.8, WebKit · WebKitGTK +2)
- [CVE-2026-71415](https://cve.now/CVE-2026-71415.md): Kirby: File upload permissions are not checked during processing of chunk data (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2026-82914](https://cve.now/CVE-2026-82914.md): kishan0725 Hospital-Management-System search.php sql injection (CVSS 6.9, kishan0725 Hospital-Management-System)
- [CVE-2026-61639](https://cve.now/CVE-2026-61639.md): Wallos: Zip Slip path traversal in database restore writes files to webroot (CVSS 8.5, ellite Wallos)
- [CVE-2026-81779](https://cve.now/CVE-2026-81779.md): WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability (CVSS 10.0, Silk Themes Newspapers X)
- [CVE-2026-61638](https://cve.now/CVE-2026-61638.md): Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port (CVSS 8.2, ellite Wallos)
- [CVE-2026-81278](https://cve.now/CVE-2026-81278.md): WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability (CVSS 5.4, WPExperts Post SMTP)
- [CVE-2026-81892](https://cve.now/CVE-2026-81892.md): EasyAdmin custom-action dispatcher bypasses access\_control on other routes (CVSS 8.1, EasyCorp EasyAdminBundle · easycorp/easyadmin-bundle)
- [CVE-2026-82346](https://cve.now/CVE-2026-82346.md): HP ImageDiags - Potential Escalation of Privilege (CVSS 7.0, HP ImageDiags)
- [CVE-2026-81891](https://cve.now/CVE-2026-81891.md): elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) (CVSS 8.1, Studio-42 elFinder · Studio-42/elFinder)
- [CVE-2026-54600](https://cve.now/CVE-2026-54600.md): Wallos: Unauthenticated database replacement via import endpoint on fresh install (CVSS 8.2, ellite Wallos)
- [CVE-2026-82229](https://cve.now/CVE-2026-82229.md): WordPress WordPress Social Login and Register plugin \<= 7.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, miniOrange WordPress Social Login and Register)
- [CVE-2026-82228](https://cve.now/CVE-2026-82228.md): WordPress SiteGround Security plugin \<= 1.6.6 - 2FA Bypass vulnerability (CVSS 8.1, SiteGround Security)
- [CVE-2026-82226](https://cve.now/CVE-2026-82226.md): WordPress Tickera plugin \<= 3.6.0.2 - PHP Object Injection vulnerability (CVSS 9.8, Tickera)
- [CVE-2026-82225](https://cve.now/CVE-2026-82225.md): WordPress RegistrationMagic plugin \<= 6.0.9.8 - Broken Authentication vulnerability (CVSS 7.4, Metagauss RegistrationMagic)
- [CVE-2026-82224](https://cve.now/CVE-2026-82224.md): WordPress SliceWP plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, iova.mihai SliceWP)
- [CVE-2026-82221](https://cve.now/CVE-2026-82221.md): WordPress RegistrationMagic plugin \<= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Metagauss RegistrationMagic)
- [CVE-2026-81780](https://cve.now/CVE-2026-81780.md): WordPress Hash Form plugin \<= 1.4.2 - Arbitrary File Upload vulnerability (CVSS 10.0, hashthemes Hash Form)
- [CVE-2026-81778](https://cve.now/CVE-2026-81778.md): WordPress Kalles Addons plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, The4 Kalles Addons)
- [CVE-2026-81768](https://cve.now/CVE-2026-81768.md): WordPress Super Store Finder plugin \<= 7.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, highwarden Super Store Finder)
- [CVE-2026-81765](https://cve.now/CVE-2026-81765.md): WordPress Tailored Tools plugin \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tailored Media Tailored Tools)
- [CVE-2026-81764](https://cve.now/CVE-2026-81764.md): WordPress Email Essentials plugin \<= 6.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Acato Email Essentials)
- [CVE-2026-81763](https://cve.now/CVE-2026-81763.md): WordPress Throws SPAM Away plugin \<= 3.8.2 - SQL Injection vulnerability (CVSS 9.3, ウェブ屋のさとーさん Throws SPAM Away)
- [CVE-2026-81762](https://cve.now/CVE-2026-81762.md): WordPress Booking and Rental Manager plugin \<= 2.7.6 - Broken Access Control vulnerability (CVSS 6.5, magepeopleteam Booking and Rental Manager)
- [CVE-2026-81758](https://cve.now/CVE-2026-81758.md): WordPress OwnerRez API plugin \<= 1.2.6 - Broken Access Control vulnerability (CVSS 6.3, OwnerRez API)
- [CVE-2026-81756](https://cve.now/CVE-2026-81756.md): WordPress Smart Marketing SMS and Newsletters Forms plugin \<= 5.1.24 - SQL Injection vulnerability (CVSS 9.3, Autorius E-goi Smart Marketing SMS and Newsletters Forms)
- [CVE-2026-81298](https://cve.now/CVE-2026-81298.md): WordPress LeadConnector plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, varunvairavanlc LeadConnector)
- [CVE-2026-81297](https://cve.now/CVE-2026-81297.md): WordPress Fluent Forms Pro Add On Pack plugin \<= 6.2.12 - Privilege Escalation vulnerability (CVSS 7.5, WP Manage Ninja Fluent Forms Pro Add On Pack)
- [CVE-2026-81296](https://cve.now/CVE-2026-81296.md): WordPress Fluent Forms Pro Add On Pack plugin \<= 6.2.12 - Broken Access Control vulnerability (CVSS 7.5, WP Manage Ninja Fluent Forms Pro Add On Pack)
- [CVE-2026-81293](https://cve.now/CVE-2026-81293.md): WordPress WP Data Access plugin \<= 5.5.81 - SQL Injection vulnerability (CVSS 9.3, Passionate Programmer Peter WP Data Access)
- [CVE-2026-81291](https://cve.now/CVE-2026-81291.md): WordPress Uncode theme \<= 2.12.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Uncode)
- [CVE-2026-81290](https://cve.now/CVE-2026-81290.md): WordPress Email Subscribers & Newsletters plugin \<= 5.9.33 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Icegram Email Subscribers & Newsletters)
- [CVE-2026-81287](https://cve.now/CVE-2026-81287.md): WordPress Charitable plugin \<= 1.8.12.1 - SQL Injection vulnerability (CVSS 8.5, Syed Balkhi Charitable)
- [CVE-2026-81280](https://cve.now/CVE-2026-81280.md): WordPress Print Barcode Labels for your WooCommerce products/orders plugin \<= 4.0.0 - Sensitive Data Exposure vulnerability (CVSS 6.5, UKR Solution Print Barcode Labels for your WooCommerce prod…)
- [CVE-2026-82852](https://cve.now/CVE-2026-82852.md): WordPress MapSVG plugin \<= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, MapSVG)
- [CVE-2026-54599](https://cve.now/CVE-2026-54599.md): Wallos: OIDC state parameter never validated — login CSRF / account takeover (CVSS 7.5, ellite Wallos)
- [CVE-2026-82909](https://cve.now/CVE-2026-82909.md): QuantumNous new-api Revoked API Token token session expiration (CVSS 5.3, QuantumNous new-api)
- [CVE-2026-81890](https://cve.now/CVE-2026-81890.md): elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections (CVSS 5.4, Studio-42 elFinder · studio-42/elfinder)
- [CVE-2026-54598](https://cve.now/CVE-2026-54598.md): Missing Authentication for Critical Function in wallos (CVSS 7.5, ellite Wallos)
- [CVE-2026-81888](https://cve.now/CVE-2026-81888.md): @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking (CVSS 5.4, honojs @hono/oauth-providers · @hono/oauth-providers)
- [CVE-2026-50199](https://cve.now/CVE-2026-50199.md): Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh (CVSS 4.3, ellite Wallos)
- [CVE-2026-81889](https://cve.now/CVE-2026-81889.md): elFinder: SSRF protection bypass via DNS rebinding in the \`fsock\_get\_contents()\` fallback (CVSS 8.6, Studio-42 elFinder · studio-42/elfinder)
- [CVE-2026-50198](https://cve.now/CVE-2026-50198.md): Wallos: Cross-user subscription cost inference via replacement\_subscription\_id (CVSS 4.3, ellite Wallos)
- [CVE-2026-82908](https://cve.now/CVE-2026-82908.md): MSI Dragon Center MMIO Write Path NTIOLib\_X64.sys MmioWritePath integer overflow (CVSS 9.3, MSI Dragon Center)
- [CVE-2026-81887](https://cve.now/CVE-2026-81887.md): Livewire DOM-based cross-site scripting during client-side state handling (CVSS 5.1, livewire · livewire/livewire)
- [CVE-2026-54179](https://cve.now/CVE-2026-54179.md): backpack/crud: SingleBase64Image accepts any base64 payload behind a \`data:image\` prefix — SVG-with-script lands on the public disk (CVSS 4.4, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-82906](https://cve.now/CVE-2026-82906.md): sdcb chats Signed File Download Endpoint FileController.cs DownloadPublic missing authentication (CVSS 6.3, sdcb chats)
- [CVE-2026-82905](https://cve.now/CVE-2026-82905.md): sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery (CVSS 5.3, sdcb chats)
- [CVE-2026-81267](https://cve.now/CVE-2026-81267.md): Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2026-14697](https://cve.now/CVE-2026-14697.md): IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-82835](https://cve.now/CVE-2026-82835.md): caoqianming django-vue-admin file access control (CVSS 5.3, caoqianming django-vue-admin)
- [CVE-2026-13732](https://cve.now/CVE-2026-13732.md): Gdb: gdb: out-of-bounds write in stabs parser read\_member\_functions() via crafted elf (CVSS 7.0, Red Hat Enterprise Linux · Red Hat Cost Management On-Pr… +2)
- [CVE-2026-52730](https://cve.now/CVE-2026-52730.md): Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence (CVSS 4.3, xibosignage xibo-cms)
- [CVE-2026-82834](https://cve.now/CVE-2026-82834.md): Doccano Open Source Annotation Tools for Machine Learning Practitioners Bulk-Delete Endpoint category-types LabelList access control (CVSS 5.3, Doccano Open Source Annotation Tools for Machine Learning P…)
- [CVE-2026-82833](https://cve.now/CVE-2026-82833.md): Doccano Open Source Annotation Tools for Machine Learning Practitioners Project Example Detail Endpoint examples ExampleDetail access control (CVSS 5.3, Doccano Open Source Annotation Tools for Machine Learning P…)
- [CVE-2026-53507](https://cve.now/CVE-2026-53507.md): oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs (CVSS 8.3, oasdiff-action)
- [CVE-2026-14696](https://cve.now/CVE-2026-14696.md): Ethernet bridge RX packet leak enables denial of service via RX buffer-pool exhaustion (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-53508](https://cve.now/CVE-2026-53508.md): oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) (CVSS 6.0, oasdiff · github.com/oasdiff/oasdiff)
- [CVE-2026-53553](https://cve.now/CVE-2026-53553.md): Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (CVSS 7.7, zhenorzz goploy · github.com/zhenorzz/goploy)
- [CVE-2026-53552](https://cve.now/CVE-2026-53552.md): Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project\_file handlers (CVSS 9.6, zhenorzz goploy · github.com/zhenorzz/goploy)
- [CVE-2026-82821](https://cve.now/CVE-2026-82821.md): FLVMeta AMF Object Parsing amf.c amf\_object\_get null pointer dereference (CVSS 5.3, FLVMeta)
- [CVE-2026-14368](https://cve.now/CVE-2026-14368.md): Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser (CVSS 5.4, zephyrproject zephyr)
- [CVE-2026-83497](https://cve.now/CVE-2026-83497.md): Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination (CVSS 8.8, OpenSearch · Amazon OpenSearch Service)
- [CVE-2026-82820](https://cve.now/CVE-2026-82820.md): FLVMeta AMF String Processing amf.c amf\_string\_new heap-based overflow (CVSS 5.3, FLVMeta)
- [CVE-2023-31308](https://cve.now/CVE-2023-31308.md): A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory rea (CVSS 3.3, AMD Radeon™ PRO V620 Graphics Products)
- [CVE-2026-72001](https://cve.now/CVE-2026-72001.md): Pangolin \< 1.22.0 Authentication Bypass via Share-Link Endpoint (CVSS 8.6, Pangolin)
- [CVE-2026-82818](https://cve.now/CVE-2026-82818.md): dibo-software diboot Tenant Resource Assignment resource access control (CVSS 5.3, dibo-software diboot)
- [CVE-2023-20511](https://cve.now/CVE-2023-20511.md): Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potent (CVSS 6.4, AMD Radeon™ Instinct™ MI25 Graphics Products · AMD Radeon™…)
- [CVE-2026-14367](https://cve.now/CVE-2026-14367.md): I3C IBI work-node free-list data race between ISR and workqueue thread (CVSS 3.1, zephyrproject zephyr)
- [CVE-2026-82817](https://cve.now/CVE-2026-82817.md): dibo-software diboot Tenant Administrator Management API admin access control (CVSS 5.3, dibo-software diboot)
- [CVE-2026-79743](https://cve.now/CVE-2026-79743.md): MCPHub: Path Traversal via Malicious MCPB Manifest Name (CVSS 6.9, samanhappy mcphub · @samanhappy/mcphub)
- [CVE-2026-79744](https://cve.now/CVE-2026-79744.md): MCPHub: Missing Authorization on \`PUT /api/system-config\` Lets Any Non-Admin Rewrite Global Security Configuration (CVSS 8.8, samanhappy mcphub)
- [CVE-2026-79745](https://cve.now/CVE-2026-79745.md): MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources) (CVSS 7.1, samanhappy mcphub)
- [CVE-2026-79746](https://cve.now/CVE-2026-79746.md): MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching (CVSS 8.1, samanhappy mcphub)
- [CVE-2026-79747](https://cve.now/CVE-2026-79747.md): MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial) (CVSS 7.1, samanhappy mcphub)
- [CVE-2026-79748](https://cve.now/CVE-2026-79748.md): MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args) (CVSS 9.9, samanhappy mcphub)
- [CVE-2026-79749](https://cve.now/CVE-2026-79749.md): MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation (CVSS 7.6, samanhappy mcphub)
- [CVE-2026-79750](https://cve.now/CVE-2026-79750.md): MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF) (CVSS 7.7, samanhappy mcphub)
- [CVE-2026-82816](https://cve.now/CVE-2026-82816.md): dibo-software diboot AI Session Endpoint ai-session authorization (CVSS 5.3, dibo-software diboot)
- [CVE-2026-82815](https://cve.now/CVE-2026-82815.md): MegaEase EaseProbe Middleware server.go realIP access control (CVSS 6.9, MegaEase EaseProbe)
- [CVE-2026-19953](https://cve.now/CVE-2026-19953.md): URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep (CVSS 6.5, URI)
- [CVE-2026-82813](https://cve.now/CVE-2026-82813.md): BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity (CVSS 5.3, BEN Group TubeBuddy for YouTube Extension)
- [CVE-2026-82811](https://cve.now/CVE-2026-82811.md): Toggl OÜ Toggl Track Extension postMessage origin validation (CVSS 5.3, Toggl OÜ Toggl Track Extension)
- [CVE-2026-14366](https://cve.now/CVE-2026-14366.md): SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net\_pkt (CVSS 6.4, zephyrproject zephyr)
- [CVE-2026-82810](https://cve.now/CVE-2026-82810.md): extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure (CVSS 4.8, extension.vn 2FA Authenticator Extension)
- [CVE-2026-82809](https://cve.now/CVE-2026-82809.md): vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure (CVSS 5.3, vidIQ Vision for YouTube Extension)
- [CVE-2026-82808](https://cve.now/CVE-2026-82808.md): Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials (CVSS 6.9, Inbox Foundry ActiveInbox Extension)
- [CVE-2026-17615](https://cve.now/CVE-2026-17615.md): Resteasy-core: resteasy sourceprovider remote unauthenticated file read (CVSS 7.5, Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat build… +9)
- [CVE-2026-82807](https://cve.now/CVE-2026-82807.md): ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management (CVSS 9.3, ieungSoft Ultra RAMDisk Pro)
- [CVE-2026-83492](https://cve.now/CVE-2026-83492.md): WordPress Kubio AI Website Builder - Denial Of Service (CVSS 6.9, Extend Themes Kubio AI Website Builder)
- [CVE-2026-21827](https://cve.now/CVE-2026-21827.md): HCL Connections is vulnerable to an information disclosure vulnerability (CVSS 3.1, HCLSoftware Connections)
- [CVE-2026-82805](https://cve.now/CVE-2026-82805.md): Typora Mermaid Rendering cross site scripting (CVSS 5.3, Typora)
- [CVE-2026-77966](https://cve.now/CVE-2026-77966.md): Ebyte NA111-M Missing Authorization (CVSS 8.8, Ebyte NA111-M Firmware)
- [CVE-2026-76133](https://cve.now/CVE-2026-76133.md): Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm (CVSS 9.8, Ebyte NA111-M Firmware)
- [CVE-2026-82803](https://cve.now/CVE-2026-82803.md): armink struct2json JSON Deserialization s2jdef.h S2J\_STRUCT\_GET\_string\_ELEMENT null pointer dereference (CVSS 6.9, armink struct2json)
- [CVE-2026-73819](https://cve.now/CVE-2026-73819.md): Ebyte NA111-M Weak Authentication (CVSS 9.8, Ebyte NA111-M Firmware)
- [CVE-2026-77975](https://cve.now/CVE-2026-77975.md): Ebyte NA111-M Cleartext Storage of Sensitive Information (CVSS 6.5, Ebyte NE2-D11 Firmware)
- [CVE-2026-75133](https://cve.now/CVE-2026-75133.md): Keep Backup Daily WordPress Plugin \< 2.1.4 Sensitive Information Exposure via kbd\_cron\_process (CVSS 8.7, Fahad Mahmood Keep Backup Daily)
- [CVE-2026-82802](https://cve.now/CVE-2026-82802.md): NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery (CVSS 6.9, NASA earthdata-search)
- [CVE-2026-75132](https://cve.now/CVE-2026-75132.md): WAPT Server SQL Injection via /api/v3/hosts Endpoint (CVSS 7.1, Tranquil\_IT WAPT)
- [CVE-2026-82801](https://cve.now/CVE-2026-82801.md): NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery (CVSS 6.9, NASA earthdata-search)
- [CVE-2026-66047](https://cve.now/CVE-2026-66047.md): ProfilePress WordPress Plugin \< 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE (CVSS 9.2, Proper Fraction ProfilePress)
- [CVE-2026-82703](https://cve.now/CVE-2026-82703.md): Edimax BR-6214K asp\_setPing Endpoint ping.asp system os command injection (CVSS 5.1, Edimax BR-6214K)
- [CVE-2026-82970](https://cve.now/CVE-2026-82970.md): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin \<= 4.4.1 - Arbitrary File Upload vulnerability (CVSS 10.0, WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy C…)
- [CVE-2026-59111](https://cve.now/CVE-2026-59111.md): Command Injection vulnerability in eObčanka-Identifikace (CVSS 9.3, Ministry of the Interior (MVČR) eObčanka-Identifikace)
- [CVE-2026-82702](https://cve.now/CVE-2026-82702.md): Edimax BR-6214K asp\_WlanMP Endpoint wlanMP.asp system os command injection (CVSS 5.1, Edimax BR-6214K)
- [CVE-2026-82701](https://cve.now/CVE-2026-82701.md): code-projects Online Shopping System Search Functionality action.php sql injection (CVSS 6.9, code-projects Online Shopping System)
- [CVE-2026-78422](https://cve.now/CVE-2026-78422.md): zbus\_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID (CVSS 7.3, z-galaxy zbus\_polkit · zbus\_polkit)
- [CVE-2026-82700](https://cve.now/CVE-2026-82700.md): code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting (CVSS 5.3, code-projects Online Shopping System)
- [CVE-2026-78075](https://cve.now/CVE-2026-78075.md): Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate \< 2.2.10 (CVSS 5.1, joomshaper.com Helix Ultimate extension for Joomla)
- [CVE-2026-78076](https://cve.now/CVE-2026-78076.md): Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate \< 2.2.10 (CVSS 5.1, joomshaper.com Helix Ultimate extension for Joomla)
- [CVE-2026-78078](https://cve.now/CVE-2026-78078.md): Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate \< 2.2.10 (CVSS 8.9, joomshaper.com Helix Ultimate extension for Joomla)
- [CVE-2026-19702](https://cve.now/CVE-2026-19702.md): OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair (CVSS 7.8, TÜBİTAK BİLGEM Software Technologies Research Institute Par…)
- [CVE-2026-76763](https://cve.now/CVE-2026-76763.md): Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals (CVSS 7.5, Red Hat build of Quarkus 3.27.5.SP1 · Red Hat build of Quar…)
- [CVE-2026-78077](https://cve.now/CVE-2026-78077.md): Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate \< 2.2.10 (CVSS 8.6, joomshaper.com Helix Ultimate extension for Joomla)
- [CVE-2026-78079](https://cve.now/CVE-2026-78079.md): Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate \< 2.2.10 (CVSS 5.3, joomshaper.com Helix Ultimate extension for Joomla)
- [CVE-2026-78074](https://cve.now/CVE-2026-78074.md): Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions (CVSS 8.8, miniorgange.com miniOrange Oauth Client (free) extensio… +21)
- [CVE-2026-19616](https://cve.now/CVE-2026-19616.md): Information Disclosure in TBC Technology's KitLogistic (CVSS 7.5, TBC Technology KitLogistic)
- [CVE-2026-82699](https://cve.now/CVE-2026-82699.md): sambitraj Student Management System Password aca.sql cleartext storage (CVSS 5.1, sambitraj Student Management System)
- [CVE-2026-82217](https://cve.now/CVE-2026-82217.md): In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent (CVSS 8.8, Eclipse Foundation Eclipse Theia)
- [CVE-2026-82698](https://cve.now/CVE-2026-82698.md): sambitraj Student-Management-System aca.sql default password (CVSS 6.9, sambitraj Student-Management-System)
- [CVE-2026-76986](https://cve.now/CVE-2026-76986.md): Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue (CVSS 6.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-76985](https://cve.now/CVE-2026-76985.md): Apache Wicket: XSS in Palette via getAdditionalAttributes (CVSS 5.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-82697](https://cve.now/CVE-2026-82697.md): sambitraj Student-Management-System session\_start cookie httponly flag (CVSS 6.3, sambitraj Student-Management-System)
- [CVE-2026-82696](https://cve.now/CVE-2026-82696.md): itsourcecode Sales and Inventory System inv\_searchfrm.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82695](https://cve.now/CVE-2026-82695.md): Tenda AC18 Telnet telnet missing authentication (CVSS 10.0, Tenda AC18)
- [CVE-2026-5956](https://cve.now/CVE-2026-5956.md): SQLi in Ankara Hosting's Site Management Panel (CVSS 8.8, Ankara Hosting Site Management Panel)
- [CVE-2026-82694](https://cve.now/CVE-2026-82694.md): Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication (CVSS 10.0, Tenda AC1206)
- [CVE-2026-82693](https://cve.now/CVE-2026-82693.md): Tenda AC1206 Web UI telnet TendaTelnet missing authentication (CVSS 10.0, Tenda AC1206)
- [CVE-2026-12894](https://cve.now/CVE-2026-12894.md): Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine (CVSS 8.8, quarkus-qute · Red Hat Build of Apache Camel 3.33.3.SP1 +4)
- [CVE-2026-74010](https://cve.now/CVE-2026-74010.md): WordPress bbPress plugin \<= 2.6.14 - Broken Access Control vulnerability (CVSS 5.3, John James Jacoby bbPress)
- [CVE-2026-82692](https://cve.now/CVE-2026-82692.md): D-Link DNS-340L/DNS-345 iscsi\_mgr.cgi os command injection (CVSS 9.4, D-Link DNS-340L · D-Link DNS-345)
- [CVE-2026-76983](https://cve.now/CVE-2026-76983.md): Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel (CVSS 5.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-76984](https://cve.now/CVE-2026-76984.md): Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute (CVSS 5.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-76982](https://cve.now/CVE-2026-76982.md): Apache Wicket: XSS in Button via its model object (CVSS 5.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-75802](https://cve.now/CVE-2026-75802.md): Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel (CVSS 5.1, Apache Software Foundation Apache Wicket)
- [CVE-2026-71378](https://cve.now/CVE-2026-71378.md): Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener (CVSS 4.6, Apache Software Foundation Apache Wicket)
- [CVE-2026-71257](https://cve.now/CVE-2026-71257.md): Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed (CVSS 7.5, Apache Software Foundation Apache Wicket)
- [CVE-2026-82691](https://cve.now/CVE-2026-82691.md): D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb\_device.cgi os command injection (CVSS 9.4, D-Link DNS-320L · D-Link DNS-327L +2)
- [CVE-2026-70449](https://cve.now/CVE-2026-70449.md): Apache Wicket: Path traversal in resource style/variation/locale (CVSS 5.3, Apache Software Foundation Apache Wicket)
- [CVE-2026-82690](https://cve.now/CVE-2026-82690.md): D-Link DNS-327L/DNS-340L ve\_mgr.cgi os command injection (CVSS 9.4, D-Link DNS-327L · D-Link DNS-340L)
- [CVE-2026-82797](https://cve.now/CVE-2026-82797.md): Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. (CVSS 5.5, Samsung Open Source rlottie)
- [CVE-2026-82689](https://cve.now/CVE-2026-82689.md): D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount\_mgr.cgi os command injection (CVSS 9.4, D-Link DNS-320L · D-Link DNS-327L +2)
- [CVE-2026-82688](https://cve.now/CVE-2026-82688.md): D-Link DNS-340L/DNS-345 Virtual Volume virtual\_vol.cgi os command injection (CVSS 9.4, D-Link DNS-340L · D-Link DNS-345)
- [CVE-2026-82881](https://cve.now/CVE-2026-82881.md): Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown (CVSS 5.1, apconw Aix-DB)
- [CVE-2026-82880](https://cve.now/CVE-2026-82880.md): YaCy Search Server through 1.941 XML External Entity Injection via Parsers (CVSS 8.7, yacy\_search\_server)
- [CVE-2026-82879](https://cve.now/CVE-2026-82879.md): DataEase before 2.10.26 Access Control Bypass via Share Tickets (CVSS 5.3, dataease)
- [CVE-2026-82878](https://cve.now/CVE-2026-82878.md): DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints (CVSS 5.3, dataease)
- [CVE-2026-82877](https://cve.now/CVE-2026-82877.md): ILIAS Arbitrary File Read via SOAP addFile (CVSS 7.1, ILIAS-eLearning e.V. ILIAS)
- [CVE-2026-82876](https://cve.now/CVE-2026-82876.md): Phison PS3111-S11 Controller Firmware Signature Verification Bypass (CVSS 9.3, Phison Electronics PS3111-S11 Controller Firmware)
- [CVE-2026-82680](https://cve.now/CVE-2026-82680.md): D-Link DSM-G600 Multipart load\_file.cgi out-of-bounds write (CVSS 8.7, D-Link DSM-G600)
- [CVE-2026-82679](https://cve.now/CVE-2026-82679.md): diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload (CVSS 5.3, diem-project diem)
- [CVE-2026-82678](https://cve.now/CVE-2026-82678.md): diem-project diem Administrative Console actions.class.php executeCommand os command injection (CVSS 5.1, diem-project diem)
- [CVE-2026-19873](https://cve.now/CVE-2026-19873.md): HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements (CVSS 7.5, HTML-FormFu)
- [CVE-2026-82677](https://cve.now/CVE-2026-82677.md): valkey-io valkey Module Timer module.c moduleTimerHandler double free (CVSS 4.8, valkey-io valkey)
- [CVE-2026-82671](https://cve.now/CVE-2026-82671.md): IObit Unlocker IRP\_MJ\_DEVICE\_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management (CVSS 4.6, IObit Unlocker)
- [CVE-2026-49003](https://cve.now/CVE-2026-49003.md): Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product (CVSS 9.6, ZTE ZXDU68 S202)
- [CVE-2026-82670](https://cve.now/CVE-2026-82670.md): IObit Uninstaller IOCTL IUForceDelete.sys IRP\_MJ\_DEVICE\_CONTROL privileges management (CVSS 4.8, IObit Uninstaller)
- [CVE-2026-82669](https://cve.now/CVE-2026-82669.md): klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service (CVSS 6.9, klaussilveira GitList)
- [CVE-2026-82668](https://cve.now/CVE-2026-82668.md): klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection (CVSS 6.9, klaussilveira GitList)
- [CVE-2026-81624](https://cve.now/CVE-2026-81624.md): Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite (CVSS 7.5, Red Hat build of Apache Camel for Spring Boot · Red Hat… +3)
- [CVE-2026-82875](https://cve.now/CVE-2026-82875.md): ToolJet before v3.16.208 Authorization Bypass via organizationId (CVSS 5.1, ToolJet)
- [CVE-2026-82874](https://cve.now/CVE-2026-82874.md): ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db (CVSS 9.4, ToolJet)
- [CVE-2026-82873](https://cve.now/CVE-2026-82873.md): ToolJet through 3.0.0-ee-beta.2 Cross-workspace Schema Disclosure via Export (CVSS 5.3, ToolJet)
- [CVE-2026-82872](https://cve.now/CVE-2026-82872.md): ToolJet before v3.16.208 Cross-Workspace Authorization Bypass (CVSS 7.1, ToolJet)
- [CVE-2026-82871](https://cve.now/CVE-2026-82871.md): ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes (CVSS 8.2, ToolJet)
- [CVE-2026-82870](https://cve.now/CVE-2026-82870.md): ToolJet before v3.16.208 Cross-Tenant Database Manipulation (CVSS 7.0, ToolJet)
- [CVE-2026-82869](https://cve.now/CVE-2026-82869.md): ToolJet Database before v3.16.44 Privilege Escalation via join\_tables (CVSS 8.2, ToolJet)
- [CVE-2026-82868](https://cve.now/CVE-2026-82868.md): @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG (CVSS 5.3, pdfme schemas · @pdfme/schemas)
- [CVE-2026-82867](https://cve.now/CVE-2026-82867.md): @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select (CVSS 5.3, pdfme schemas · @pdfme/schemas)
- [CVE-2026-82866](https://cve.now/CVE-2026-82866.md): @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch (CVSS 8.9, pdfme common · @pdfme/common)
- [CVE-2026-82865](https://cve.now/CVE-2026-82865.md): pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label (CVSS 2.1, pdfme schemas · @pdfme/schemas)
- [CVE-2026-82864](https://cve.now/CVE-2026-82864.md): pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb (CVSS 7.1, pdfme pdf-lib · @pdfme/pdf-lib)
- [CVE-2026-82863](https://cve.now/CVE-2026-82863.md): @hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection (CVSS 8.7, hulumi baseline · @hulumi/baseline)
- [CVE-2026-82862](https://cve.now/CVE-2026-82862.md): Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files (CVSS 8.6, kerberosmansour hulumi)
- [CVE-2026-82861](https://cve.now/CVE-2026-82861.md): @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass (CVSS 8.7, hulumi policies · @hulumi/policies)
- [CVE-2026-82860](https://cve.now/CVE-2026-82860.md): @hulumi/policies before 1.3.2 Admin Policy Bypass (CVSS 9.3, hulumi policies · @hulumi/policies)
- [CVE-2026-82859](https://cve.now/CVE-2026-82859.md): hulumi before v1.3.2 SCP Template Tag-on-Create Bypass (CVSS 9.3, kerberosmansour hulumi)
- [CVE-2026-82858](https://cve.now/CVE-2026-82858.md): @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance (CVSS 9.3, hulumi drift · @hulumi/drift)
- [CVE-2026-82857](https://cve.now/CVE-2026-82857.md): hulumi before v1.3.2 Privilege Escalation via IAM Policy (CVSS 9.3, kerberosmansour hulumi)
- [CVE-2026-82856](https://cve.now/CVE-2026-82856.md): @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass (CVSS 9.3, hulumi policies · @hulumi/policies)
- [CVE-2026-82855](https://cve.now/CVE-2026-82855.md): @hulumi/policies before 1.3.2 Evidence Validation Bypass (CVSS 9.3, hulumi policies · @hulumi/policies)
- [CVE-2026-82854](https://cve.now/CVE-2026-82854.md): Nodemailer before 8.0.4 SMTP Command Injection via envelope.size (CVSS 9.3, nodemailer)
- [CVE-2026-82853](https://cve.now/CVE-2026-82853.md): Nodemailer before 8.0.5 SMTP Command Injection via CRLF (CVSS 6.9, nodemailer)
- [CVE-2026-82662](https://cve.now/CVE-2026-82662.md): Nodemailer before 8.0.8 TLS Certificate Validation Bypass (CVSS 8.3, nodemailer)
- [CVE-2026-82661](https://cve.now/CVE-2026-82661.md): Nodemailer CRLF Injection via List-\* Header Comments (CVSS 5.3, nodemailer)
- [CVE-2026-82660](https://cve.now/CVE-2026-82660.md): Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess (CVSS 5.3, nodemailer)
- [CVE-2026-82659](https://cve.now/CVE-2026-82659.md): nodemailer before 9.0.1 File Read and SSRF via raw option (CVSS 7.1, nodemailer)
- [CVE-2024-58379](https://cve.now/CVE-2024-58379.md): nodemailer before 6.9.9 ReDoS via attachDataUrls parameter (CVSS 6.9, nodemailer)
- [CVE-2026-82667](https://cve.now/CVE-2026-82667.md): yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery (CVSS 5.1, yaojingang GEOFlow)
- [CVE-2026-82666](https://cve.now/CVE-2026-82666.md): yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection (CVSS 5.1, yaojingang GEOFlow)
- [CVE-2026-82665](https://cve.now/CVE-2026-82665.md): yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal (CVSS 5.1, yaojingang GEOFlow)
- [CVE-2026-19410](https://cve.now/CVE-2026-19410.md): Google Cloud Build Comment Control Bypass via Webhook Suppression (CVSS 9.4, Google Cloud Build)
- [CVE-2026-82664](https://cve.now/CVE-2026-82664.md): yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting (CVSS 5.3, yaojingang GEOFlow)
- [CVE-2026-82631](https://cve.now/CVE-2026-82631.md): valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free (CVSS 2.1, valkey-io valkey)
- [CVE-2026-82838](https://cve.now/CVE-2026-82838.md): Default webserver configuration with incorrect CSP (CVSS 6.4, pretix venueless)
- [CVE-2026-58301](https://cve.now/CVE-2026-58301.md): Apache Shiro: Server-side POST request may be steered to an alternate host (CVSS 5.9, Apache Software Foundation Apache Shiro)
- [CVE-2026-82630](https://cve.now/CVE-2026-82630.md): PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery (CVSS 6.9, PowerJob)
- [CVE-2026-82629](https://cve.now/CVE-2026-82629.md): jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload (CVSS 5.1, jeecgboot jeewx-boot)
- [CVE-2026-82628](https://cve.now/CVE-2026-82628.md): Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub\_11504 privileges management (CVSS 9.3, Colorful iGameCenter)
- [CVE-2026-82625](https://cve.now/CVE-2026-82625.md): code-projects Simple Inventory System User Registration register.php cross site scripting (CVSS 5.3, code-projects Simple Inventory System)
- [CVE-2026-40465](https://cve.now/CVE-2026-40465.md): An Open Re-direct Vulnerability in Nokia NSP (CVSS 5.3, Nokia NSP)
- [CVE-2026-40464](https://cve.now/CVE-2026-40464.md): A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP (CVSS 5.4, Nokia NSP)
- [CVE-2026-40463](https://cve.now/CVE-2026-40463.md): An Insufficient Role-based Access Control Vulnerability in WaveSuite (CVSS 7.6, Nokia WaveSuite)
- [CVE-2026-53620](https://cve.now/CVE-2026-53620.md): GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. (CVSS 6.3, GROWI)
- [CVE-2026-68951](https://cve.now/CVE-2026-68951.md): GROWI contains an incorrect authorization vulnerability. (CVSS 5.3, GROWI)
- [CVE-2026-82624](https://cve.now/CVE-2026-82624.md): code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure (CVSS 6.9, code-projects Simple Inventory System)
- [CVE-2026-58574](https://cve.now/CVE-2026-58574.md): Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. (CVSS 9.8, Dell PowerStore)
- [CVE-2026-82623](https://cve.now/CVE-2026-82623.md): open62541 History Backend ua\_history\_data\_backend\_memory.c UA\_DataValue\_backend\_copyRange use after free (CVSS 6.9, open62541)
- [CVE-2026-77013](https://cve.now/CVE-2026-77013.md): Icollect \<= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch (CVSS 5.3, 爱采集数据采集和发布插件)
- [CVE-2026-82622](https://cve.now/CVE-2026-82622.md): code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting (CVSS 5.1, code-projects Employee Leave Managing System)
- [CVE-2026-82621](https://cve.now/CVE-2026-82621.md): Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization (CVSS 6.9, Soarkey StudentManagement · Soarkey 学生信息管理系统)
- [CVE-2026-82620](https://cve.now/CVE-2026-82620.md): Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course\_ranking sql injection (CVSS 5.3, Soarkey StudentManagement · Soarkey 学生信息管理系统)
- [CVE-2026-82619](https://cve.now/CVE-2026-82619.md): Systerel S2OPC subscription\_mgr.c use after free (CVSS 5.3, Systerel S2OPC)
- [CVE-2026-82618](https://cve.now/CVE-2026-82618.md): Systerel S2OPC String Array Range Writing sopc\_builtintypes.c set\_range\_matrix\_on\_string\_array out-of-bounds (CVSS 5.3, Systerel S2OPC)
- [CVE-2026-82616](https://cve.now/CVE-2026-82616.md): TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow (CVSS 9.4, TOTOLINK NR1800X)
- [CVE-2026-82615](https://cve.now/CVE-2026-82615.md): itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find\_phone sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-82614](https://cve.now/CVE-2026-82614.md): itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-82613](https://cve.now/CVE-2026-82613.md): itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-82612](https://cve.now/CVE-2026-82612.md): itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-82611](https://cve.now/CVE-2026-82611.md): itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-82610](https://cve.now/CVE-2026-82610.md): itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-82725](https://cve.now/CVE-2026-82725.md): AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data (CVSS 2.3, ash-project ash\_phoenix)
- [CVE-2026-82724](https://cve.now/CVE-2026-82724.md): Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle\_subdomain (CVSS 7.6, ash-project ash\_phoenix)
- [CVE-2026-82726](https://cve.now/CVE-2026-82726.md): AshPhoenix get\_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant (CVSS 6.3, ash-project ash\_phoenix)
- [CVE-2026-82727](https://cve.now/CVE-2026-82727.md): AshPhoenix Form.Auto leaks submitted params in an unknown \_union\_type error message (CVSS 2.3, ash-project ash\_phoenix)
- [CVE-2026-82609](https://cve.now/CVE-2026-82609.md): itsourcecode Sales and Inventory System inv\_edit.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-82608](https://cve.now/CVE-2026-82608.md): Kamailio AVP cxdx\_avp.c get\_4bytes out-of-bounds (CVSS 5.3, Kamailio)
- [CVE-2026-82673](https://cve.now/CVE-2026-82673.md): Path traversal in AshAdmin file uploads via unsanitized client filename (CVSS 8.3, ash-project ash\_admin)
- [CVE-2026-81853](https://cve.now/CVE-2026-81853.md): AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle (CVSS 2.3, ash-project ash\_admin)
- [CVE-2026-82607](https://cve.now/CVE-2026-82607.md): Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb\_ajax\_simple\_avatar unrestricted upload (CVSS 6.9, Cozmoslabs Profile Builder Plugin)
- [CVE-2026-81852](https://cve.now/CVE-2026-81852.md): AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass (CVSS 2.1, ash-project ash\_admin)
- [CVE-2026-82681](https://cve.now/CVE-2026-82681.md): Query-parameter injection in AshAdmin row-action links via unencoded string primary keys (CVSS 2.0, ash-project ash\_admin)
- [CVE-2026-77850](https://cve.now/CVE-2026-77850.md): Stored XSS in AshAdmin relationship typeahead via unescaped label\_field content (CVSS 8.4, ash-project ash\_admin)
- [CVE-2026-82722](https://cve.now/CVE-2026-82722.md): AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) (CVSS 8.3, ash-project ash\_admin)
- [CVE-2026-75757](https://cve.now/CVE-2026-75757.md): AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain (CVSS 8.3, ash-project ash\_admin)
- [CVE-2026-82605](https://cve.now/CVE-2026-82605.md): BareBones BBEdit Lasso Language Tokenizer infinite loop (CVSS 5.3, BareBones BBEdit)
- [CVE-2026-82604](https://cve.now/CVE-2026-82604.md): BareBones BBEdit Java Language recursion (CVSS 5.3, BareBones BBEdit)
- [CVE-2026-82603](https://cve.now/CVE-2026-82603.md): SeaCMS Comment Cache member.php del\_pl path traversal (CVSS 5.3, SeaCMS)
- [CVE-2026-82602](https://cve.now/CVE-2026-82602.md): SeaCMS ass.php authorization (CVSS 6.9, SeaCMS)
- [CVE-2026-82601](https://cve.now/CVE-2026-82601.md): SeaCMS err.php cross site scripting (CVSS 5.3, SeaCMS)
- [CVE-2026-75760](https://cve.now/CVE-2026-75760.md): AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error (CVSS 7.1, ash-project ash\_ai)
- [CVE-2026-82580](https://cve.now/CVE-2026-82580.md): AshAi echoes raw tool exception messages into the conversation, disclosing internal details (CVSS 5.3, ash-project ash\_ai)
- [CVE-2026-82579](https://cve.now/CVE-2026-82579.md): AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service (CVSS 6.0, ash-project ash\_ai)
- [CVE-2026-82564](https://cve.now/CVE-2026-82564.md): Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records (CVSS 7.1, ash-project ash\_ai)
- [CVE-2026-82600](https://cve.now/CVE-2026-82600.md): SeaCMS zyapi.php sql injection (CVSS 6.9, SeaCMS)
- [CVE-2026-81315](https://cve.now/CVE-2026-81315.md): MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header (CVSS 7.4, ash-project ash\_ai)
- [CVE-2026-77956](https://cve.now/CVE-2026-77956.md): EEx template evaluation of prompt content in AshAi enables remote code execution (CVSS 8.9, ash-project ash\_ai)
- [CVE-2026-82599](https://cve.now/CVE-2026-82599.md): SeaCMS Avatar Upload member.php unlink path traversal (CVSS 5.3, SeaCMS)
- [CVE-2026-82598](https://cve.now/CVE-2026-82598.md): SeaCMS Template search.php parseIf code injection (CVSS 6.9, SeaCMS)
- [CVE-2026-82597](https://cve.now/CVE-2026-82597.md): TOTOLINK NR1800X cstecgi.cgi setUssd command injection (CVSS 5.3, TOTOLINK NR1800X)
- [CVE-2026-82596](https://cve.now/CVE-2026-82596.md): LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption (CVSS 4.8, LatencyUtils)
- [CVE-2025-63607](https://cve.now/CVE-2025-63607.md): TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2026-38577](https://cve.now/CVE-2026-38577.md): Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access. (CVSS 9.8)
- [CVE-2026-51152](https://cve.now/CVE-2026-51152.md): Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. (CVSS 9.1)
- [CVE-2026-51153](https://cve.now/CVE-2026-51153.md): Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. (CVSS 5.4)
- [CVE-2026-51666](https://cve.now/CVE-2026-51666.md): Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to reconfigure W (CVSS 4.3)
- [CVE-2026-51667](https://cve.now/CVE-2026-51667.md): Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain W (CVSS 4.3)
- [CVE-2026-51668](https://cve.now/CVE-2026-51668.md): Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to modify lang (CVSS 7.5)
- [CVE-2026-51669](https://cve.now/CVE-2026-51669.md): Incorrect access control in the getPairCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain pairing (CVSS 9.1)
- [CVE-2026-51670](https://cve.now/CVE-2026-51670.md): Incorrect access control in the getSlaveUpdate function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to query slave (CVSS 9.8)
- [CVE-2026-51671](https://cve.now/CVE-2026-51671.md): Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obt (CVSS 7.5)
- [CVE-2026-51672](https://cve.now/CVE-2026-51672.md): Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to obtain the r (CVSS 9.1)
- [CVE-2026-51673](https://cve.now/CVE-2026-51673.md): Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter time synch (CVSS 7.5)
- [CVE-2026-51674](https://cve.now/CVE-2026-51674.md): Incorrect access control in the setScheduleCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to configure f (CVSS 9.8)
- [CVE-2026-51675](https://cve.now/CVE-2026-51675.md): Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to reconfigure up (CVSS 9.1)
- [CVE-2026-51676](https://cve.now/CVE-2026-51676.md): Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter a (CVSS 9.1)
- [CVE-2026-51677](https://cve.now/CVE-2026-51677.md): Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to change UPnP ser (CVSS 9.1)
- [CVE-2026-51678](https://cve.now/CVE-2026-51678.md): Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter logging (CVSS 4.3)
- [CVE-2026-51679](https://cve.now/CVE-2026-51679.md): Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to change the (CVSS 9.1)
- [CVE-2026-51680](https://cve.now/CVE-2026-51680.md): Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to modify LED behav (CVSS 9.1)
- [CVE-2026-51681](https://cve.now/CVE-2026-51681.md): Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to expose WAN-si (CVSS 9.1)
- [CVE-2026-51683](https://cve.now/CVE-2026-51683.md): Incorrect access control in the setLanCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter LAN networ (CVSS 4.3)
- [CVE-2026-51684](https://cve.now/CVE-2026-51684.md): Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter the st (CVSS 9.8)
- [CVE-2026-51686](https://cve.now/CVE-2026-51686.md): Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to reconfigure (CVSS 9.8)
- [CVE-2026-51687](https://cve.now/CVE-2026-51687.md): Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to create (CVSS 9.1)
- [CVE-2026-51688](https://cve.now/CVE-2026-51688.md): Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to reduce wi (CVSS 7.5)
- [CVE-2026-51689](https://cve.now/CVE-2026-51689.md): Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to trigger firmw (CVSS 9.1)
- [CVE-2026-51690](https://cve.now/CVE-2026-51690.md): Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter upstream p (CVSS 9.1)
- [CVE-2026-51691](https://cve.now/CVE-2026-51691.md): Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to manipulat (CVSS 9.8)
- [CVE-2026-51692](https://cve.now/CVE-2026-51692.md): Incorrect access control in the setWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to establish (CVSS 9.1)
- [CVE-2026-51693](https://cve.now/CVE-2026-51693.md): Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to weaken edge (CVSS 9.8)
- [CVE-2026-51694](https://cve.now/CVE-2026-51694.md): Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to add or (CVSS 7.5)
- [CVE-2026-51695](https://cve.now/CVE-2026-51695.md): Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter dynamic D (CVSS 7.5)
- [CVE-2026-51696](https://cve.now/CVE-2026-51696.md): Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to expose (CVSS 9.8)
- [CVE-2026-51697](https://cve.now/CVE-2026-51697.md): Incorrect access control in the setIptvCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter IPTV serv (CVSS 9.1)
- [CVE-2026-51698](https://cve.now/CVE-2026-51698.md): Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter br (CVSS 9.1)
- [CVE-2026-51699](https://cve.now/CVE-2026-51699.md): Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to expose an intern (CVSS 9.8)
- [CVE-2026-51700](https://cve.now/CVE-2026-51700.md): Incorrect access control in the setWiFiAdvancedCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to degrade (CVSS 9.1)
- [CVE-2026-51701](https://cve.now/CVE-2026-51701.md): Incorrect access control in the setMacFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to change d (CVSS 9.1)
- [CVE-2026-51702](https://cve.now/CVE-2026-51702.md): Incorrect access control in the setIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter (CVSS 4.3)
- [CVE-2026-51703](https://cve.now/CVE-2026-51703.md): Incorrect access control in the setWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter w (CVSS 5.4)
- [CVE-2026-51704](https://cve.now/CVE-2026-51704.md): Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter me (CVSS 4.3)
- [CVE-2026-51705](https://cve.now/CVE-2026-51705.md): Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to rename mes (CVSS 9.8)
- [CVE-2026-51706](https://cve.now/CVE-2026-51706.md): Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to degrade tra (CVSS 4.3)
- [CVE-2026-51708](https://cve.now/CVE-2026-51708.md): Incorrect access control in the setWiFiWpsCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to change WPS a (CVSS 9.8)
- [CVE-2026-51709](https://cve.now/CVE-2026-51709.md): Incorrect access control in the setWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to reconfigur (CVSS 9.8)
- [CVE-2026-51710](https://cve.now/CVE-2026-51710.md): Incorrect access control in the setParentalRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter par (CVSS 9.1)
- [CVE-2026-51711](https://cve.now/CVE-2026-51711.md): Incorrect access control in the setWiFiWpsStart function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to open a wir (CVSS 9.1)
- [CVE-2026-51712](https://cve.now/CVE-2026-51712.md): Incorrect access control in the setApWiFiSchCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter wire (CVSS 5.9)
- [CVE-2026-51713](https://cve.now/CVE-2026-51713.md): Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to manipulat (CVSS 9.1)
- [CVE-2026-51714](https://cve.now/CVE-2026-51714.md): Incorrect access control in the setRoamingCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter roamin (CVSS 5.9)
- [CVE-2026-51715](https://cve.now/CVE-2026-51715.md): Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove M (CVSS 9.8)
- [CVE-2026-51716](https://cve.now/CVE-2026-51716.md): Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to delete (CVSS 7.5)
- [CVE-2026-51717](https://cve.now/CVE-2026-51717.md): Incorrect access control in the setOpModeCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to change the de (CVSS 9.1)
- [CVE-2026-51718](https://cve.now/CVE-2026-51718.md): Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove (CVSS 9.8)
- [CVE-2026-51719](https://cve.now/CVE-2026-51719.md): Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove U (CVSS 7.5)
- [CVE-2026-51720](https://cve.now/CVE-2026-51720.md): Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remov (CVSS 9.1)
- [CVE-2026-51721](https://cve.now/CVE-2026-51721.md): Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to alter the mesh (CVSS 9.1)
- [CVE-2026-51722](https://cve.now/CVE-2026-51722.md): Incorrect access control in the setWiFiRepeaterCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to repoint (CVSS 9.1)
- [CVE-2026-51723](https://cve.now/CVE-2026-51723.md): Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to install (CVSS 9.1)
- [CVE-2026-51724](https://cve.now/CVE-2026-51724.md): Incorrect access control in the delSmartQosCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove Smar (CVSS 9.8)
- [CVE-2026-51725](https://cve.now/CVE-2026-51725.md): Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to change the (CVSS 9.1)
- [CVE-2026-51726](https://cve.now/CVE-2026-51726.md): Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove pa (CVSS 9.1)
- [CVE-2026-51727](https://cve.now/CVE-2026-51727.md): Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to retrieve ad (CVSS 5.3)
- [CVE-2026-51728](https://cve.now/CVE-2026-51728.md): Incorrect access control in the UploadFirmwareFile function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to upload (CVSS 9.8)
- [CVE-2026-51729](https://cve.now/CVE-2026-51729.md): Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to request deletion (CVSS 9.1)
- [CVE-2026-51730](https://cve.now/CVE-2026-51730.md): Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove Wi- (CVSS 9.1)
- [CVE-2026-51731](https://cve.now/CVE-2026-51731.md): Incorrect access control in the delVlanCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove VLAN ent (CVSS 9.1)
- [CVE-2026-51732](https://cve.now/CVE-2026-51732.md): Incorrect access control in the delWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove (CVSS 5.3)
- [CVE-2026-51733](https://cve.now/CVE-2026-51733.md): Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to remove Wi- (CVSS 9.8)
- [CVE-2026-51734](https://cve.now/CVE-2026-51734.md): Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to trigger (CVSS 9.8)
- [CVE-2026-51735](https://cve.now/CVE-2026-51735.md): Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to retrieve recent (CVSS 7.5)
- [CVE-2026-51736](https://cve.now/CVE-2026-51736.md): Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to erase system l (CVSS 9.1)
- [CVE-2026-51737](https://cve.now/CVE-2026-51737.md): Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to erase t (CVSS 5.3)
- [CVE-2026-51738](https://cve.now/CVE-2026-51738.md): Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to reset the (CVSS 9.8)
- [CVE-2026-51739](https://cve.now/CVE-2026-51739.md): Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to trigg (CVSS 5.9)
- [CVE-2026-51740](https://cve.now/CVE-2026-51740.md): Incorrect access control in the killProcess function of TOTOLINK T6 4.1.5cu.748\_B20211015 allows unauthenticated attackers to terminate crit (CVSS 9.8)
- [CVE-2026-75458](https://cve.now/CVE-2026-75458.md): The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System \<= 3.9.0 contains a vertical privilege esca (CVSS 8.1)
- [CVE-2026-75460](https://cve.now/CVE-2026-75460.md): XueZhiSi Open Source Exam System \<= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/ (CVSS 6.5)
- [CVE-2026-79407](https://cve.now/CVE-2026-79407.md): A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE\_NAME value used (CVSS 7.5)
- [CVE-2026-79408](https://cve.now/CVE-2026-79408.md): An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser. (CVSS 9.8)
- [CVE-2026-79483](https://cve.now/CVE-2026-79483.md): FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.