# CVEs published 2026-09-02

322 CVEs were published on September 2, 2026: 22 critical, 117 high. Days are UTC.

- [CVE-2026-85084](https://cve.now/CVE-2026-85084.md): Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check (CVSS 6.3, Samsung Open Source TizenFX)
- [CVE-2026-84888](https://cve.now/CVE-2026-84888.md): RightNow-AI OpenFang tool\_runner.rs shell\_exec memory allocation (CVSS 5.3, RightNow-AI OpenFang)
- [CVE-2026-84887](https://cve.now/CVE-2026-84887.md): simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service (CVSS 5.3, simular-ai Agent-S)
- [CVE-2026-84886](https://cve.now/CVE-2026-84886.md): simular-ai Agent-S OCR HTTP API ocr\_server.py ImageData resource consumption (CVSS 6.9, simular-ai Agent-S)
- [CVE-2026-84885](https://cve.now/CVE-2026-84885.md): simular-ai Agent-S CodeAgent code\_agent.py denial of service (CVSS 5.3, simular-ai Agent-S)
- [CVE-2026-84394](https://cve.now/CVE-2026-84394.md): fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority (CVSS 7.5, fast-uri)
- [CVE-2026-84851](https://cve.now/CVE-2026-84851.md): Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 (CVSS 7.5, Amazon ion-c)
- [CVE-2026-84292](https://cve.now/CVE-2026-84292.md): fast-uri vulnerable to authority injection via an unvalidated port in serialize (CVSS 7.5, fast-uri)
- [CVE-2026-84857](https://cve.now/CVE-2026-84857.md): sigoden aichat API Endpoint serve.rs memory allocation (CVSS 6.9, sigoden aichat)
- [CVE-2023-20577](https://cve.now/CVE-2023-20577.md): A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially res (CVSS 7.4, 2nd Gen AMD EPYC™ Processors · 3rd Gen AMD EPYC™ Proces… +25)
- [CVE-2026-84856](https://cve.now/CVE-2026-84856.md): rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service (CVSS 6.9, rowboatlabs rowboat)
- [CVE-2023-20576](https://cve.now/CVE-2023-20576.md): Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of ser (CVSS 7.7, AMD Ryzen™ 3000 Series Desktop Processors · AMD Ryzen™ 5… +9)
- [CVE-2026-56855](https://cve.now/CVE-2026-56855.md): Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh (CVSS 7.5, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-78662](https://cve.now/CVE-2026-78662.md): Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh (CVSS 7.5, golang.org/x/crypto/ssh · golang.org/x/crypto)
- [CVE-2026-82524](https://cve.now/CVE-2026-82524.md): UnoPim File Upload RCE via TinyMCE Image Upload Endpoint (CVSS 8.6, unopim)
- [CVE-2026-84452](https://cve.now/CVE-2026-84452.md): Windows ML CLI: CORS misconfig enables localhost RCE (CVSS 8.6, microsoft winml-cli · winml-cli)
- [CVE-2026-75134](https://cve.now/CVE-2026-75134.md): SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload (CVSS 5.1, SEOWriting)
- [CVE-2026-75137](https://cve.now/CVE-2026-75137.md): UpSignOn \< 7.19.0 Sensitive Data Exposure in Process Memory after Lock (CVSS 6.9, Septeo IT Solutions UpSignOn)
- [CVE-2026-75136](https://cve.now/CVE-2026-75136.md): UpSignOn \< 7.19.0 Biometric Key Exposure via Windows PasswordVault (CVSS 6.9, Septeo IT Solutions UpSignOn)
- [CVE-2026-75135](https://cve.now/CVE-2026-75135.md): UpSignOn \< 7.19.0 Sensitive Key Retention in Memory (CVSS 6.9, Septeo IT Solutions UpSignOn)
- [CVE-2026-84852](https://cve.now/CVE-2026-84852.md): Reader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal (CVSS 4.8, Reader Tools PDF Reader App)
- [CVE-2026-84841](https://cve.now/CVE-2026-84841.md): tsi-coop tsi-dpdp-cms client-side enforcement of server-side security (CVSS 6.9, tsi-coop tsi-dpdp-cms)
- [CVE-2026-84840](https://cve.now/CVE-2026-84840.md): tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication (CVSS 6.9, tsi-coop tsi-dpdp-cms)
- [CVE-2026-84839](https://cve.now/CVE-2026-84839.md): tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication (CVSS 6.9, tsi-coop tsi-dpdp-cms)
- [CVE-2026-19117](https://cve.now/CVE-2026-19117.md): Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability (CVSS 9.8, Delinea Secret Server)
- [CVE-2026-84382](https://cve.now/CVE-2026-84382.md): HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) (CVSS 7.5, pydantic httpx2 · httpx2)
- [CVE-2026-84381](https://cve.now/CVE-2026-84381.md): HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies (CVSS 8.1, pydantic httpx2 · pydantic httpcore2 +2)
- [CVE-2026-84380](https://cve.now/CVE-2026-84380.md): HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated (CVSS 5.6, pydantic httpx2 · httpx2)
- [CVE-2026-66786](https://cve.now/CVE-2026-66786.md): Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets (CVSS 9.1, Red Hat Advanced Cluster Management for Kubernetes)
- [CVE-2026-84379](https://cve.now/CVE-2026-84379.md): HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers (CVSS 5.3, pydantic httpx2 · httpx2)
- [CVE-2026-53706](https://cve.now/CVE-2026-53706.md): PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs (CVSS 8.8, vbpf prevail)
- [CVE-2026-53670](https://cve.now/CVE-2026-53670.md): PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification (CVSS 9.3, vbpf prevail)
- [CVE-2026-53671](https://cve.now/CVE-2026-53671.md): PREVAIL: Context-write no-op in do\_mem\_store allows unsafe eBPF programs to pass verification (CVSS 9.3, vbpf prevail)
- [CVE-2026-84378](https://cve.now/CVE-2026-84378.md): HTTPX2: Quadratic SSE line buffering can cause CPU denial of service (CVSS 5.9, pydantic httpx2 · httpx2)
- [CVE-2026-82522](https://cve.now/CVE-2026-82522.md): libjxl \< 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation (CVSS 5.3, libjxl)
- [CVE-2026-49249](https://cve.now/CVE-2026-49249.md): Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2 (CVSS 7.1, malach-it boruta-server)
- [CVE-2026-55221](https://cve.now/CVE-2026-55221.md): Boruta: OAuth credentials exposed in Boruta business logs (CVSS 6.5, malach-it boruta-server)
- [CVE-2026-53649](https://cve.now/CVE-2026-53649.md): Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE (CVSS 9.6, BishopFox joro · github.com/BishopFox/joro)
- [CVE-2026-49832](https://cve.now/CVE-2026-49832.md): DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN (CVSS 8.0, DSpace · org.dspace:dspace-api)
- [CVE-2026-84377](https://cve.now/CVE-2026-84377.md): LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters (CVSS 6.5, BerriAI litellm · litellm)
- [CVE-2026-49833](https://cve.now/CVE-2026-49833.md): DSpace: Path Traversal possible in LDN message generation (CVSS 5.5, DSpace · org.dspace:dspace-api)
- [CVE-2026-49831](https://cve.now/CVE-2026-49831.md): DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) (CVSS 5.5, DSpace · org.dspace:dspace-api)
- [CVE-2026-49830](https://cve.now/CVE-2026-49830.md): DSpace: ORE resource URI does not validate scheme for non-web resources (CVSS 4.4, DSpace · org.dspace:dspace-api)
- [CVE-2026-77121](https://cve.now/CVE-2026-77121.md): Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields (CVSS 5.3, Sonatype Nexus Repository)
- [CVE-2026-77122](https://cve.now/CVE-2026-77122.md): Nexus Repository 3 - Incorrect Authorization Allows Disclosure of Member Repository Metadata via Group Repository Permissions (CVSS 5.3, Sonatype Nexus Repository)
- [CVE-2026-77123](https://cve.now/CVE-2026-77123.md): Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API (CVSS 6.0, Sonatype Nexus Repository)
- [CVE-2026-77124](https://cve.now/CVE-2026-77124.md): Nexus Repository 3 - Script Execution Disable Setting Not Enforced (CVSS 7.5, Sonatype Nexus Repository)
- [CVE-2026-77125](https://cve.now/CVE-2026-77125.md): Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints (CVSS 7.1, Sonatype Nexus Repository)
- [CVE-2026-84833](https://cve.now/CVE-2026-84833.md): ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption (CVSS 5.3, ntegrals openbrowser)
- [CVE-2026-84811](https://cve.now/CVE-2026-84811.md): agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode (CVSS 7.1, agentverus-scanner)
- [CVE-2026-84810](https://cve.now/CVE-2026-84810.md): claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan (CVSS 7.1, claude-world claude-skill-antivirus)
- [CVE-2026-84809](https://cve.now/CVE-2026-84809.md): Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode (CVSS 7.1, Tencent AI-Infra-Guard · Tencent aig-skill-scan)
- [CVE-2026-55421](https://cve.now/CVE-2026-55421.md): Open edX Platform: SSRF in Studio Video Download Endpoint (CVSS 6.8, openedx-platform)
- [CVE-2026-53636](https://cve.now/CVE-2026-53636.md): Open edX LTI OAuth Replay Attack (CVSS 4.7, openedx-platform)
- [CVE-2026-53635](https://cve.now/CVE-2026-53635.md): Open edX Platform: Insufficient Permission on set\_course\_mode\_price() (CVSS 7.6, openedx-platform)
- [CVE-2026-52831](https://cve.now/CVE-2026-52831.md): Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE (CVSS 8.0, nuclio · github.com/nuclio/nuclio)
- [CVE-2026-79756](https://cve.now/CVE-2026-79756.md): Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform (CVSS 8.7, nuclio)
- [CVE-2026-79755](https://cve.now/CVE-2026-79755.md): Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform) (CVSS 8.0, nuclio)
- [CVE-2026-79754](https://cve.now/CVE-2026-79754.md): Nuclio: Kaniko build tempDir command injection (CVSS 7.1, nuclio)
- [CVE-2026-52833](https://cve.now/CVE-2026-52833.md): Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE (CVSS 8.0, nuclio · github.com/nuclio/nuclio)
- [CVE-2026-52832](https://cve.now/CVE-2026-52832.md): Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container (CVSS 4.9, nuclio · github.com/nuclio/nuclio)
- [CVE-2026-82404](https://cve.now/CVE-2026-82404.md): TOON: Prototype pollution when decoding untrusted TOON input (CVSS 8.3, toon-format toon · @toon-format/toon)
- [CVE-2026-84376](https://cve.now/CVE-2026-84376.md): Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base (CVSS 6.3, withastro astro · astro)
- [CVE-2026-45730](https://cve.now/CVE-2026-45730.md): Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project (CVSS 8.3, nuclio · github.com/nuclio/nuclio)
- [CVE-2026-20355](https://cve.now/CVE-2026-20355.md): Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty (CVSS 5.9, Cisco Secure Email)
- [CVE-2026-20354](https://cve.now/CVE-2026-20354.md): Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty (CVSS 5.9, Cisco Secure Email)
- [CVE-2026-20281](https://cve.now/CVE-2026-20281.md): Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability (CVSS 7.5, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2026-20278](https://cve.now/CVE-2026-20278.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2026-20280](https://cve.now/CVE-2026-20280.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2026-20279](https://cve.now/CVE-2026-20279.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 9.8, Cisco IOS XR Software)
- [CVE-2026-20275](https://cve.now/CVE-2026-20275.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.8, Cisco IOS XR Software)
- [CVE-2026-20274](https://cve.now/CVE-2026-20274.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 9.8, Cisco IOS XR Software)
- [CVE-2026-20276](https://cve.now/CVE-2026-20276.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2026-20277](https://cve.now/CVE-2026-20277.md): Cisco IOS XR Software Security Hardening Release: September 2026 (CVSS 8.2, Cisco IOS XR Software)
- [CVE-2026-20212](https://cve.now/CVE-2026-20212.md): Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability (CVSS 9.8, Cisco NX-OS Software)
- [CVE-2026-53600](https://cve.now/CVE-2026-53600.md): async-tar PAX extension-header desync enables tar entry/content smuggling (CVSS 6.3, dignifiedquire async-tar · async-tar)
- [CVE-2026-53611](https://cve.now/CVE-2026-53611.md): Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation (CVSS 9.8, AS203038 looking-glass)
- [CVE-2026-14199](https://cve.now/CVE-2026-14199.md): Session takeover via Auth Proxy cache key collision (CVSS 7.1, Grafana Enterprise · Grafana OSS)
- [CVE-2026-12704](https://cve.now/CVE-2026-12704.md): SAML assertion replay via skipped InResponseTo validation (CVSS 6.8, Grafana Enterprise)
- [CVE-2026-19475](https://cve.now/CVE-2026-19475.md): SQL Data Source Plugin: OOM DoS via $\_\_timeGroup macro (CVSS 6.5, Grafana PostgreSQL Datasource · Grafana MySQL Datasource +2)
- [CVE-2026-84677](https://cve.now/CVE-2026-84677.md): Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugi (CVSS 5.4, Jenkins Project Jenkins update-center2)
- [CVE-2026-84676](https://cve.now/CVE-2026-84676.md): Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller wh (CVSS 4.3, Jenkins Project Jenkins Parameterized Remote Trigger Plugin)
- [CVE-2026-84675](https://cve.now/CVE-2026-84675.md): OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable v (CVSS 7.4, Jenkins Project Jenkins TICS Plugin)
- [CVE-2026-84674](https://cve.now/CVE-2026-84674.md): Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate (CVSS 5.4, Jenkins Project Jenkins XebiaLabs XL Deploy Plugin)
- [CVE-2026-84673](https://cve.now/CVE-2026-84673.md): Jenkins Customizable Header Plugin 295.v2544b\_ca\_19b\_97 and earlier allows overwriting the plugin's appearance configuration through Stapler (CVSS 8.8, Jenkins Project Jenkins Customizable Header Plugin)
- [CVE-2026-84672](https://cve.now/CVE-2026-84672.md): Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b\_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's (CVSS 8.8, Jenkins Project Jenkins Microsoft Entra ID (previously Azur…)
- [CVE-2026-78222](https://cve.now/CVE-2026-78222.md): NGINX ngx\_http\_js\_module vulnerability (CVSS 7.5, F5 NGINX JavaScript)
- [CVE-2026-84671](https://cve.now/CVE-2026-84671.md): Jenkins File Parameter Plugin 425.v3fa\_801681b\_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sys (CVSS 8.8, Jenkins Project Jenkins File Parameter Plugin)
- [CVE-2026-78689](https://cve.now/CVE-2026-78689.md): NGINX ngx\_http\_js\_module vulnerablility (CVSS 8.1, F5 NGINX JavaScript)
- [CVE-2026-77180](https://cve.now/CVE-2026-77180.md): NGINX Ingress Controller vulnerability (CVSS 8.3, F5 NGINX Ingress Controller)
- [CVE-2026-84670](https://cve.now/CVE-2026-84670.md): Jenkins Performance Plugin 1015.v09ca\_52b\_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached (CVSS 8.8, Jenkins Project Jenkins Performance Plugin)
- [CVE-2026-66362](https://cve.now/CVE-2026-66362.md): NGF vulnerability (CVSS 8.1, F5 NGINX Gateway Fabric)
- [CVE-2026-18329](https://cve.now/CVE-2026-18329.md): NGINX ngx\_http\_js\_module vulnerability (CVSS 8.2, F5 NGINX JavaScript)
- [CVE-2026-84669](https://cve.now/CVE-2026-84669.md): A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A (CVSS 8.8, Jenkins Project Jenkins Allure Plugin)
- [CVE-2026-66842](https://cve.now/CVE-2026-66842.md): BIG-IP and BIG-IQ Configuration utility vulnerability (CVSS 8.8, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2026-63020](https://cve.now/CVE-2026-63020.md): BIG-IP Configuration utility vulnerability (CVSS 3.1, F5 BIG-IP)
- [CVE-2026-84668](https://cve.now/CVE-2026-84668.md): Jenkins SAML Plugin 4.618.v441a\_27fa\_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi (CVSS 8.8, Jenkins Project Jenkins SAML Plugin)
- [CVE-2026-84667](https://cve.now/CVE-2026-84667.md): Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta (CVSS 7.1, Jenkins Project Jenkins ThinBackup Plugin)
- [CVE-2026-84666](https://cve.now/CVE-2026-84666.md): Jenkins Job Configuration History Plugin 1367.vc8fa\_b\_15101dc and earlier allows overwriting the plugin's history recording configuration th (CVSS 5.4, Jenkins Project Jenkins Job Configuration History Plugin)
- [CVE-2026-84665](https://cve.now/CVE-2026-84665.md): Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner (CVSS 8.0, Jenkins Project Jenkins SonarQube Scanner Plugin)
- [CVE-2026-84664](https://cve.now/CVE-2026-84664.md): Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowin (CVSS 5.4, Jenkins Project Jenkins GitLab Plugin)
- [CVE-2026-84663](https://cve.now/CVE-2026-84663.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attacker (CVSS 5.4, Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin)
- [CVE-2026-84662](https://cve.now/CVE-2026-84662.md): Jenkins LDAP Plugin 807.809.vd3a\_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers (CVSS 4.3, Jenkins Project Jenkins LDAP Plugin)
- [CVE-2026-84661](https://cve.now/CVE-2026-84661.md): A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b\_67ea\_11b\_152 and earlier causes downstream builds awaited by the \` (CVSS 5.4, Jenkins Project Jenkins Pipeline: Build Step Plugin)
- [CVE-2026-84660](https://cve.now/CVE-2026-84660.md): A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b\_67ea\_11b\_152 and earlier causes downstream builds triggered by the (CVSS 5.4, Jenkins Project Jenkins Pipeline: Build Step Plugin)
- [CVE-2026-84659](https://cve.now/CVE-2026-84659.md): Jenkins Script Security Plugin 1412.v7737b\_3405f86 and earlier does not enforce a permission check in the method that controls the "Force th (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-84658](https://cve.now/CVE-2026-84658.md): Jenkins Script Security Plugin 1412.v7737b\_3405f86 and earlier uses the \`@DataBoundConstructor\` annotation on a constructor that loads scrip (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-84657](https://cve.now/CVE-2026-84657.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s fla (CVSS 4.2, Jenkins Project Jenkins)
- [CVE-2026-84656](https://cve.now/CVE-2026-84656.md): A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-84655](https://cve.now/CVE-2026-84655.md): Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-84654](https://cve.now/CVE-2026-84654.md): In Stapler 2107.v8dfcb\_e8ed317 and earlier, except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, (CVSS 5.4, Jenkins Project Jenkins)
- [CVE-2026-84653](https://cve.now/CVE-2026-84653.md): Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in t (CVSS 3.5, Jenkins Project Jenkins)
- [CVE-2026-84652](https://cve.now/CVE-2026-84652.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me (CVSS 7.3, Jenkins Project Jenkins)
- [CVE-2026-84651](https://cve.now/CVE-2026-84651.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm (CVSS 6.3, Jenkins Project Jenkins)
- [CVE-2026-84650](https://cve.now/CVE-2026-84650.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84649](https://cve.now/CVE-2026-84649.md): In Stapler 1839.ved17667b\_a\_eb\_5 through 2107.v8dfcb\_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.447 th (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84648](https://cve.now/CVE-2026-84648.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84647](https://cve.now/CVE-2026-84647.md): In Stapler 2107.v8dfcb\_e8ed317 and earlier, except 2088.2093.vd7c3e58008a\_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-84646](https://cve.now/CVE-2026-84646.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all (CVSS 4.3, Jenkins Project Jenkins)
- [CVE-2026-84645](https://cve.now/CVE-2026-84645.md): In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi (CVSS 8.8, Jenkins Project Jenkins)
- [CVE-2026-18058](https://cve.now/CVE-2026-18058.md): The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. (CVSS 7.3, Motorola Smart Connect Application)
- [CVE-2026-84838](https://cve.now/CVE-2026-84838.md): Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() (CVSS 7.8, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-84837](https://cve.now/CVE-2026-84837.md): Rpm: command injection in \`rpmbuild -t\*\` (\`gettarspec\`) via unescaped tarball path (CVSS 7.8, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-78409](https://cve.now/CVE-2026-78409.md): Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks (CVSS 7.0, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-78410](https://cve.now/CVE-2026-78410.md): Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection (CVSS 7.8, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-78408](https://cve.now/CVE-2026-78408.md): Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVSS 7.9, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2024-7956](https://cve.now/CVE-2024-7956.md): Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud (CVSS 7.6, Rockwell Automation DataMosaix™ Private Cloud)
- [CVE-2026-82293](https://cve.now/CVE-2026-82293.md): Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption (CVSS 4.3, Elastic Kibana)
- [CVE-2026-78588](https://cve.now/CVE-2026-78588.md): Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service (CVSS 6.5, Elastic Filebeat)
- [CVE-2026-78587](https://cve.now/CVE-2026-78587.md): Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations (CVSS 3.1, Elastic Fleet Server)
- [CVE-2026-78586](https://cve.now/CVE-2026-78586.md): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVSS 6.5, Elastic Kibana)
- [CVE-2026-78584](https://cve.now/CVE-2026-78584.md): Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure (CVSS 4.3, Elastic Kibana)
- [CVE-2026-78591](https://cve.now/CVE-2026-78591.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion (CVSS 6.3, Elastic Kibana)
- [CVE-2026-78590](https://cve.now/CVE-2026-78590.md): Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources (CVSS 7.3, Elastic Kibana)
- [CVE-2026-78599](https://cve.now/CVE-2026-78599.md): Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources (CVSS 6.5, Elastic Kibana)
- [CVE-2026-78598](https://cve.now/CVE-2026-78598.md): Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data (CVSS 5.4, Elastic Kibana)
- [CVE-2026-78594](https://cve.now/CVE-2026-78594.md): Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service (CVSS 4.9, Elastic Apm Server)
- [CVE-2026-78604](https://cve.now/CVE-2026-78604.md): Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM (CVSS 7.8, Elastic Agent)
- [CVE-2026-82955](https://cve.now/CVE-2026-82955.md): In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Ga (CVSS 9.0, Eclipse Foundation Eclipse aeriOS)
- [CVE-2026-78602](https://cve.now/CVE-2026-78602.md): Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure (CVSS 5.3, Elastic Maps Server)
- [CVE-2026-78601](https://cve.now/CVE-2026-78601.md): Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure (CVSS 5.5, Elastic Kibana)
- [CVE-2026-78600](https://cve.now/CVE-2026-78600.md): Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention (CVSS 3.5, Elastic Eck Operator)
- [CVE-2026-78609](https://cve.now/CVE-2026-78609.md): Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data (CVSS 5.4, Elastic Eck Operator)
- [CVE-2026-14255](https://cve.now/CVE-2026-14255.md): IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products (CVSS 5.5, Autodesk Shared Components · Autodesk Revit)
- [CVE-2026-2811](https://cve.now/CVE-2026-2811.md): Ajaxify Comments \< 3.2 - Unauthenticated HTTP Header Injection (CVSS 5.4, Ajaxify Comments)
- [CVE-2025-9314](https://cve.now/CVE-2025-9314.md): Developer Tools \<= 1.1.3 – Unauthenticated Arbitrary File Upload (CVSS 9.8, Developer Tools)
- [CVE-2025-8945](https://cve.now/CVE-2025-8945.md): Wp Edit Password Protected \< 1.3.5 - Protection Bypass via REST API (CVSS 5.3, Wp Edit Password Protected)
- [CVE-2025-15490](https://cve.now/CVE-2025-15490.md): Passster \< 4.2.26 - Global Protection Bypass (CVSS 5.3, Passster)
- [CVE-2025-15489](https://cve.now/CVE-2025-15489.md): Passster \< 4.2.24 - Password Protection Bypass (CVSS 5.3, Passster)
- [CVE-2025-15485](https://cve.now/CVE-2025-15485.md): Auto x LINE \<= 1.0.0 – Unauthenticated REST API Endpoints Call (CVSS 8.2, Auto x LINE)
- [CVE-2025-15481](https://cve.now/CVE-2025-15481.md): Notification Bar for WordPress \<= 1.1.8 – Unauthenticated Subscriber Data Disclosure (CVSS 5.3, Notification Bar for WordPress)
- [CVE-2024-3773](https://cve.now/CVE-2024-3773.md): LiveJournal Shortcode \<= 1.1.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.9, LiveJournal Shortcode)
- [CVE-2023-3360](https://cve.now/CVE-2023-3360.md): Weaver Show Posts \< 1.8.1 - Admin+ PHP Object Injection (CVSS 3.3, Weaver Show Posts)
- [CVE-2026-79991](https://cve.now/CVE-2026-79991.md): Authenticated SQL Injection via nested eager-loading criteria (CVSS 7.1, craftcms cms)
- [CVE-2026-79990](https://cve.now/CVE-2026-79990.md): GQL entry mutation \`siteId\` bypasses schema site scope, enabling cross-site content read/write/delete (CVSS 8.7, craftcms cms)
- [CVE-2026-83547](https://cve.now/CVE-2026-83547.md): Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets (CVSS 6.8, Xpro Addons)
- [CVE-2026-83533](https://cve.now/CVE-2026-83533.md): WP Express Checkout \< 2.4.9 - Unauthenticated Payment Bypass via wpec\_process\_payment (CVSS 5.3, WP Express Checkout)
- [CVE-2026-82884](https://cve.now/CVE-2026-82884.md): All in One SEO \< 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block (CVSS 6.8, All in One SEO)
- [CVE-2026-81571](https://cve.now/CVE-2026-81571.md): Brave Popup Builder \< 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM Parameter (CVSS 4.8, Brave)
- [CVE-2026-8151](https://cve.now/CVE-2026-8151.md): Simple Membership MailChimp Integration \< 1.9.8 - API Key Update via CSRF (CVSS 5.4, Simple Membership MailChimp Integration)
- [CVE-2026-78153](https://cve.now/CVE-2026-78153.md): Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization (CVSS 5.3, Restrict User Access)
- [CVE-2026-77794](https://cve.now/CVE-2026-77794.md): RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity (CVSS 5.3, RegistrationMagic)
- [CVE-2026-77793](https://cve.now/CVE-2026-77793.md): RegistrationMagic \< 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field (CVSS 5.3, RegistrationMagic)
- [CVE-2026-77009](https://cve.now/CVE-2026-77009.md): WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console (CVSS 9.9, WatchMan-Site7)
- [CVE-2026-4357](https://cve.now/CVE-2026-4357.md): Embed HTML5 Game \<= 1.3 - Unauthenticated Arbitrary File Upload (CVSS 10.0, Embed HTML5 Game)
- [CVE-2026-2688](https://cve.now/CVE-2026-2688.md): CM HIPAA Forms \< 3.2.0 - Unauthenticated Authorization Bypass (CVSS 6.5, HIPAA FORMS)
- [CVE-2026-19698](https://cve.now/CVE-2026-19698.md): GutenKit \< 2.5.1 - Contributor+ Stored CSS Injection (CVSS 3.5, GutenKit)
- [CVE-2026-17563](https://cve.now/CVE-2026-17563.md): WP User Frontend \< 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form (CVSS 5.3, User Frontend)
- [CVE-2026-14326](https://cve.now/CVE-2026-14326.md): Timetics \<= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR (CVSS 3.8, Timetics)
- [CVE-2026-10821](https://cve.now/CVE-2026-10821.md): Yoast SEO Premium \< 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE (CVSS 6.6, Yoast SEO Premium)
- [CVE-2025-15692](https://cve.now/CVE-2025-15692.md): Icegram Express \< 5.8.6 - Admin+ Stored XSS (CVSS 3.5, Icegram Express)
- [CVE-2026-79989](https://cve.now/CVE-2026-79989.md): Arbitrary user password reset leading to administrator account takeover (CVSS 8.7, craftcms cms · craftcms/cms)
- [CVE-2026-16647](https://cve.now/CVE-2026-16647.md): Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 (CVSS 4.1, Drupal Disable Login Page · drupal/disable\_login)
- [CVE-2026-18986](https://cve.now/CVE-2026-18986.md): Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094 (CVSS 4.8, Drupal Entity Browser · drupal/entity\_browser)
- [CVE-2026-73475](https://cve.now/CVE-2026-73475.md): Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095 (CVSS 9.1, Drupal Commerce PayPal · drupal/commerce\_paypal)
- [CVE-2026-73478](https://cve.now/CVE-2026-73478.md): Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 (CVSS 5.3, Drupal Diff · drupal/diff)
- [CVE-2026-73474](https://cve.now/CVE-2026-73474.md): Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 (CVSS 5.3, Drupal Entity Share Websub · drupal/entity\_share\_websub)
- [CVE-2026-73476](https://cve.now/CVE-2026-73476.md): External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 (CVSS 5.4, Drupal External Authentication · drupal/externalauth)
- [CVE-2026-73477](https://cve.now/CVE-2026-73477.md): Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 (CVSS 5.3, Drupal Quick Tabs · drupal/quicktabs)
- [CVE-2026-76757](https://cve.now/CVE-2026-76757.md): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (CVSS 5.9, Drupal Gammu SMS Daemon · drupal/gammu\_smsd)
- [CVE-2026-76756](https://cve.now/CVE-2026-76756.md): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (CVSS 5.9, Drupal Gammu SMS Daemon · drupal/gammu\_smsd)
- [CVE-2026-76755](https://cve.now/CVE-2026-76755.md): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (CVSS 5.9, Drupal Gammu SMS Daemon · drupal/gammu\_smsd)
- [CVE-2026-76758](https://cve.now/CVE-2026-76758.md): Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 (CVSS 5.9, Drupal Link content parser · drupal/postlight\_parser)
- [CVE-2026-76782](https://cve.now/CVE-2026-76782.md): Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 (CVSS 7.3, Drupal Screenshot · drupal/screenshot)
- [CVE-2026-76759](https://cve.now/CVE-2026-76759.md): Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 (CVSS 7.3, Drupal Screenshot · drupal/screenshot)
- [CVE-2026-81167](https://cve.now/CVE-2026-81167.md): Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 (CVSS 4.8, Drupal Address Suggestion · drupal/address\_suggestion)
- [CVE-2026-81165](https://cve.now/CVE-2026-81165.md): Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 (CVSS 5.3, Drupal Blazy · drupal/blazy)
- [CVE-2026-81168](https://cve.now/CVE-2026-81168.md): CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105 (CVSS 3.7, Drupal CAPTCHA Protected Page · drupal/captcha\_protected\_pa…)
- [CVE-2026-81159](https://cve.now/CVE-2026-81159.md): Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 (CVSS 3.7, Drupal Commerce CyberSource · drupal/commerce\_cybersource)
- [CVE-2026-81161](https://cve.now/CVE-2026-81161.md): Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 (CVSS 3.3, Drupal Content Moderation Notifications · drupal/content\_mo…)
- [CVE-2026-81269](https://cve.now/CVE-2026-81269.md): Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 (CVSS 5.3, Drupal Data field · drupal/datafield)
- [CVE-2026-81166](https://cve.now/CVE-2026-81166.md): Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 (CVSS 5.3, Drupal Digital Signage Framework · drupal/digital\_signage\_f…)
- [CVE-2026-81162](https://cve.now/CVE-2026-81162.md): DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112 (CVSS 5.3, DXPR Builder: The Best Editing (AI) Experience for Drupal ·…)
- [CVE-2026-81158](https://cve.now/CVE-2026-81158.md): Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 (CVSS 5.3, Drupal Entity API · drupal/entity)
- [CVE-2026-81164](https://cve.now/CVE-2026-81164.md): Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 (CVSS 5.4, Drupal Entity PDF · drupal/entity\_pdf)
- [CVE-2026-81205](https://cve.now/CVE-2026-81205.md): LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 (CVSS 5.3, Drupal LDAP / Active Directory Integration · drupal/ldap\_au…)
- [CVE-2026-81201](https://cve.now/CVE-2026-81201.md): Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 (CVSS 6.1, Drupal Monster Menus · drupal/monster\_menus)
- [CVE-2026-81160](https://cve.now/CVE-2026-81160.md): Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117 (CVSS 6.1, Drupal Slick Carousel · drupal/slick)
- [CVE-2026-84217](https://cve.now/CVE-2026-84217.md): WordPress Classified Listing plugin \<= 6.1.3 - Broken Access Control vulnerability (CVSS 5.4, Mamunur Rashid Classified Listing)
- [CVE-2026-84835](https://cve.now/CVE-2026-84835.md): WordPress Rentsyst plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 5.3, DimaFreund Rentsyst)
- [CVE-2026-66652](https://cve.now/CVE-2026-66652.md): WordPress Grand Tour theme \<= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ThemeGoods Grand Tour)
- [CVE-2026-84780](https://cve.now/CVE-2026-84780.md): WordPress WP Go Maps plugin \<= 10.1.08 - Denial of Service Attack vulnerability (CVSS 5.3, WPGMaps WP Go Maps)
- [CVE-2026-84775](https://cve.now/CVE-2026-84775.md): WordPress Really Simple SSL plugin \<= 9.8.0 - Denial of Service Attack vulnerability (CVSS 5.3, Really Simple Plugins Really Simple SSL)
- [CVE-2026-84772](https://cve.now/CVE-2026-84772.md): WordPress Broken Link Checker plugin \<= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5, WPMU DEV Broken Link Checker)
- [CVE-2026-84771](https://cve.now/CVE-2026-84771.md): WordPress PublishPress Permissions plugin \<= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, PublishPress Permissions)
- [CVE-2026-84770](https://cve.now/CVE-2026-84770.md): WordPress Mang Board WP plugin \<= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Kitae Park Mang Board WP)
- [CVE-2026-84764](https://cve.now/CVE-2026-84764.md): WordPress Simply Schedule Appointments plugin \<= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, NSquared Simply Schedule Appointments)
- [CVE-2026-84760](https://cve.now/CVE-2026-84760.md): WordPress Ultimate Gift Cards For WooCommerce plugin \<= 3.2.9 - Broken Access Control vulnerability (CVSS 5.3, WP Swings Ultimate Gift Cards For WooCommerce)
- [CVE-2026-84759](https://cve.now/CVE-2026-84759.md): WordPress Activity Log plugin \<= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Elementor Activity Log)
- [CVE-2026-83562](https://cve.now/CVE-2026-83562.md): WordPress WCFM Marketplace plugin \<= 3.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WC Lovers WCFM Marketplace)
- [CVE-2026-82223](https://cve.now/CVE-2026-82223.md): WordPress WP Event SOlution plugin \<= 4.1.22 - Broken Access Control vulnerability (CVSS 6.5, Arraytics WP Event SOlution)
- [CVE-2026-81775](https://cve.now/CVE-2026-81775.md): WordPress Estatik plugin \<= 4.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Estatik)
- [CVE-2026-81774](https://cve.now/CVE-2026-81774.md): WordPress WooCommerce Product Attachment plugin \<= 2.3.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, Dotstore WooCommerce Product Attachment)
- [CVE-2026-81772](https://cve.now/CVE-2026-81772.md): WordPress Ninja Forms - Layout & Styles plugin \<= 3.0.31 - PHP Object Injection vulnerability (CVSS 8.8, Saturday Drive Ninja Forms - Layout & Styles)
- [CVE-2026-81771](https://cve.now/CVE-2026-81771.md): WordPress TrustedSite plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TrustedSite)
- [CVE-2026-81770](https://cve.now/CVE-2026-81770.md): WordPress Interactive Geo Maps plugin \<= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MapGeo Interactive Geo Maps)
- [CVE-2026-81769](https://cve.now/CVE-2026-81769.md): WordPress Booking Hub plugin \<= 1.3.1 - Privilege Escalation vulnerability (CVSS 8.8, LiquidThemes Booking Hub)
- [CVE-2026-81294](https://cve.now/CVE-2026-81294.md): WordPress Authorizer plugin \<= 3.15.1 - Privilege Escalation vulnerability (CVSS 9.8, Paul Ryan Authorizer)
- [CVE-2026-81289](https://cve.now/CVE-2026-81289.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 5.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MP3 Audio Player for Music, Radio & Podcast by Sonaar)
- [CVE-2026-81288](https://cve.now/CVE-2026-81288.md): WordPress Upsell Order Bump Offer for WooCommerce plugin \<= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Swings Upsell Order Bump Offer for WooCommerce)
- [CVE-2026-81286](https://cve.now/CVE-2026-81286.md): WordPress WCFM Marketplace plugin \<= 3.8.1 - SQL Injection vulnerability (CVSS 9.3, WC Lovers WCFM Marketplace)
- [CVE-2026-81283](https://cve.now/CVE-2026-81283.md): WordPress WP User Frontend plugin \<= 4.3.10 - PHP Object Injection vulnerability (CVSS 8.8, weDevs WP User Frontend)
- [CVE-2026-84781](https://cve.now/CVE-2026-84781.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Chill Gallery PhotoBlocks)
- [CVE-2026-84808](https://cve.now/CVE-2026-84808.md): Kimai before 2.65.0 Authorization Bypass via API Timesheet (CVSS 5.3, kimai)
- [CVE-2026-84807](https://cve.now/CVE-2026-84807.md): Kimai before 2.65.0 Authentication Bypass via Team Creation (CVSS 5.3, kimai)
- [CVE-2026-84806](https://cve.now/CVE-2026-84806.md): Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints (CVSS 5.3, kimai)
- [CVE-2026-84805](https://cve.now/CVE-2026-84805.md): Kimai 2.61.0 before 2.63.0 Authentication Bypass via API (CVSS 5.3, kimai)
- [CVE-2026-84804](https://cve.now/CVE-2026-84804.md): Kimai before 2.65.0 Authorization Bypass via Team Activity API (CVSS 5.3, kimai)
- [CVE-2026-84803](https://cve.now/CVE-2026-84803.md): SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist (CVSS 8.6, siyuan-note siyuan)
- [CVE-2026-84802](https://cve.now/CVE-2026-84802.md): Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController (CVSS 5.3, craftcms cms)
- [CVE-2026-84801](https://cve.now/CVE-2026-84801.md): Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers (CVSS 8.7, craftcms cms)
- [CVE-2026-84800](https://cve.now/CVE-2026-84800.md): Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file (CVSS 7.1, craftcms cms)
- [CVE-2026-84799](https://cve.now/CVE-2026-84799.md): Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations (CVSS 5.3, craftcms cms)
- [CVE-2026-84798](https://cve.now/CVE-2026-84798.md): Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite (CVSS 7.1, craftcms cms)
- [CVE-2026-84797](https://cve.now/CVE-2026-84797.md): Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate (CVSS 5.3, craftcms cms)
- [CVE-2026-84796](https://cve.now/CVE-2026-84796.md): Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass (CVSS 8.7, craftcms cms)
- [CVE-2026-84795](https://cve.now/CVE-2026-84795.md): Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance (CVSS 9.2, craftcms cms)
- [CVE-2026-84794](https://cve.now/CVE-2026-84794.md): Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset (CVSS 7.1, craftcms cms)
- [CVE-2026-84793](https://cve.now/CVE-2026-84793.md): Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name (CVSS 4.8, craftcms cms)
- [CVE-2026-84792](https://cve.now/CVE-2026-84792.md): Craft CMS before 5.10.11 Broken Access Control via element-indexes (CVSS 5.3, craftcms cms)
- [CVE-2026-32773](https://cve.now/CVE-2026-32773.md): Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (CVSS 6.1, Apache Software Foundation Apache Spark · pyspark +2)
- [CVE-2026-19219](https://cve.now/CVE-2026-19219.md): DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1, Progress Software Telerik UI for ASP.NET AJAX)
- [CVE-2026-18672](https://cve.now/CVE-2026-18672.md): RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5, Progress Software Telerik UI for ASP.NET AJAX)
- [CVE-2026-82958](https://cve.now/CVE-2026-82958.md): In Eclipse Ditto versions \[1.3.0, 3.9.6\], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by (CVSS 7.6, Eclipse Foundation Eclipse Ditto)
- [CVE-2026-84175](https://cve.now/CVE-2026-84175.md): In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API use (CVSS 5.3, Eclipse Foundation Eclipse Ditto)
- [CVE-2026-53683](https://cve.now/CVE-2026-53683.md): Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset\_password.html (CVSS 4.3, Red Hat Enterprise Linux)
- [CVE-2026-75528](https://cve.now/CVE-2026-75528.md): Broken Link Checker \<= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log (CVSS 7.2, wpmudev Broken Link Checker)
- [CVE-2025-7963](https://cve.now/CVE-2025-7963.md): Easy Waveform Player \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode\_easywaveformplayer Function (CVSS 6.4, tymotey Easy Waveform Player)
- [CVE-2026-14828](https://cve.now/CVE-2026-14828.md): Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 (CVSS 8.8, Zohocorp ManageEngine Password Manager Pro · Zohocorp Ma… +1)
- [CVE-2026-82883](https://cve.now/CVE-2026-82883.md): WordPress Login With Ajax plugin \<= 4.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marcus Login With Ajax)
- [CVE-2026-3850](https://cve.now/CVE-2026-3850.md): Divi \<= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect\_url' Shortcode Parameter (CVSS 6.4, Elegant Themes Divi)
- [CVE-2026-82183](https://cve.now/CVE-2026-82183.md): OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion (CVSS 8.1, OAuth Single Sign On)
- [CVE-2026-82182](https://cve.now/CVE-2026-82182.md): WPvivid Backup & Migration \< 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation (CVSS 4.1, WPvivid — Backup, Migration & Staging)
- [CVE-2026-81807](https://cve.now/CVE-2026-81807.md): Simple Ajax Chat \< 20260827 - Unauthenticated Stored XSS via Chat Message Linkification (CVSS 8.8, Simple Ajax Chat)
- [CVE-2026-81737](https://cve.now/CVE-2026-81737.md): FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays\_get\_user\_information (CVSS 8.8, FAQ Builder AYS)
- [CVE-2026-81583](https://cve.now/CVE-2026-81583.md): Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation (CVSS 5.4, Theme My Login)
- [CVE-2026-81432](https://cve.now/CVE-2026-81432.md): JetStyleManager \< 1.3.9 - Skin Deletion and Modification via CSRF (CVSS 4.3, JetStyleManager for Gutenberg)
- [CVE-2026-81428](https://cve.now/CVE-2026-81428.md): WC Vendors \< 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR (CVSS 6.5, WC Vendors)
- [CVE-2026-81427](https://cve.now/CVE-2026-81427.md): WC Vendors \< 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change (CVSS 4.3, WC Vendors)
- [CVE-2026-81426](https://cve.now/CVE-2026-81426.md): WC Vendors \< 2.7.2.1 - Order Shipment Status Change via CSRF (CVSS 4.3, WC Vendors)
- [CVE-2026-81199](https://cve.now/CVE-2026-81199.md): MasterStudy LMS \< 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route (CVSS 5.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81198](https://cve.now/CVE-2026-81198.md): MasterStudy LMS \< 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR (CVSS 3.8, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81197](https://cve.now/CVE-2026-81197.md): MasterStudy LMS \< 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route (CVSS 5.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81196](https://cve.now/CVE-2026-81196.md): MasterStudy LMS \< 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR (CVSS 2.7, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81195](https://cve.now/CVE-2026-81195.md): MasterStudy LMS \< 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route (CVSS 5.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-81194](https://cve.now/CVE-2026-81194.md): MasterStudy LMS \< 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author\_id Parameter (CVSS 4.3, MasterStudy LMS WordPress Plugin)
- [CVE-2026-80467](https://cve.now/CVE-2026-80467.md): Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action (CVSS 8.1, Advanced Custom Fields: Extended)
- [CVE-2026-79621](https://cve.now/CVE-2026-79621.md): CatalogX \< 6.1.3 - Unauthenticated Email Content Injection via Shared Transient (CVSS 4.3, CatalogX)
- [CVE-2026-78151](https://cve.now/CVE-2026-78151.md): FormLayer \< 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response (CVSS 5.3, FormLayer)
- [CVE-2026-77792](https://cve.now/CVE-2026-77792.md): RegistrationMagic \< 6.0.9.9 - Unauthenticated Stored XSS via Rating Field (CVSS 7.5, RegistrationMagic)
- [CVE-2026-77788](https://cve.now/CVE-2026-77788.md): Rank Math SEO \< 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas (CVSS 4.9, Rank Math SEO)
- [CVE-2026-77787](https://cve.now/CVE-2026-77787.md): Rank Math SEO \< 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk (CVSS 2.7, Rank Math SEO)
- [CVE-2026-77785](https://cve.now/CVE-2026-77785.md): Rank Math SEO \< 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API (CVSS 2.7, Rank Math SEO)
- [CVE-2026-77784](https://cve.now/CVE-2026-77784.md): Rank Math SEO \< 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark\_page\_as (CVSS 2.7, Rank Math SEO)
- [CVE-2026-77783](https://cve.now/CVE-2026-77783.md): Rank Math SEO \< 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure (CVSS 3.7, Rank Math SEO)
- [CVE-2026-77782](https://cve.now/CVE-2026-77782.md): Rank Math SEO \< 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt (CVSS 5.3, Rank Math SEO)
- [CVE-2026-77764](https://cve.now/CVE-2026-77764.md): GamiPress \< 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners (CVSS 4.3, GamiPress)
- [CVE-2026-74927](https://cve.now/CVE-2026-74927.md): MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint (CVSS 5.3, MultiVendorX)
- [CVE-2026-19723](https://cve.now/CVE-2026-19723.md): Social Media Share Buttons & Social Sharing Icons \< 3.0.1 - Reflected XSS via Pin It Share Handler (CVSS 7.1, Social Media Share Buttons & Social Sharing Icons)
- [CVE-2026-19719](https://cve.now/CVE-2026-19719.md): Social Media Share Buttons & Social Sharing Icons \< 3.0.1 - Contributor+ Stored XSS via Post Title (CVSS 6.8, Social Media Share Buttons & Social Sharing Icons)
- [CVE-2026-19704](https://cve.now/CVE-2026-19704.md): Comments – wpDiscuz \< 7.6.66 - Unauthenticated Comment Disclosure via SQLi (CVSS 5.3, Comments)
- [CVE-2026-19453](https://cve.now/CVE-2026-19453.md): JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection (CVSS 7.1, JetBackup)
- [CVE-2026-19251](https://cve.now/CVE-2026-19251.md): Ultimate Member \< 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity (CVSS 5.3, Ultimate Member)
- [CVE-2026-19116](https://cve.now/CVE-2026-19116.md): WP User Frontend \< 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form (CVSS 8.8, User Frontend)
- [CVE-2026-16983](https://cve.now/CVE-2026-16983.md): Gutentor \< 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API (CVSS 4.3, Gutentor)
- [CVE-2026-16966](https://cve.now/CVE-2026-16966.md): Solace Extra \< 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get\_elementor\_content (CVSS 5.3, Solace Extra)
- [CVE-2026-15232](https://cve.now/CVE-2026-15232.md): Appointment Booking Lite \< 2.4.8 - Unauthenticated Arbitrary Reservation Deletion (CVSS 5.3, MotoPress Appointment Booking)
- [CVE-2026-14215](https://cve.now/CVE-2026-14215.md): Amelia \< 2.4.9 - Unauthenticated Post-Booking Action Trigger (CVSS 6.5, Booking for Appointments and Events Calendar)
- [CVE-2026-12865](https://cve.now/CVE-2026-12865.md): Photo Gallery by 10Web \< 1.8.44 - Reflected XSS via title and paged Parameters (CVSS 7.1, Photo Gallery by 10Web)
- [CVE-2026-12526](https://cve.now/CVE-2026-12526.md): Advanced Custom Fields: Extended \< 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action (CVSS 8.1, Advanced Custom Fields: Extended)
- [CVE-2025-15664](https://cve.now/CVE-2025-15664.md): BEAF \< 4.7.19 - Author+ Stored XSS via Before Label (CVSS 6.8, Ultimate Before After Image Slider & Gallery)
- [CVE-2025-15663](https://cve.now/CVE-2025-15663.md): BEAF \< 4.7.19 - Author+ Stored XSS via After Label (CVSS 6.8, Ultimate Before After Image Slider & Gallery)
- [CVE-2026-78657](https://cve.now/CVE-2026-78657.md): SigmaForms Pro \<= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field (CVSS 9.8, bdthemes SigmaForms Pro – AI Generated Forms)
- [CVE-2026-14357](https://cve.now/CVE-2026-14357.md): DevKit Pro \<= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter (CVSS 8.8, dplugins DevKit Pro)
- [CVE-2026-9055](https://cve.now/CVE-2026-9055.md): Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' (CVSS 9.8, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-3851](https://cve.now/CVE-2026-3851.md): Divi \<= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode (CVSS 6.4, Elegant Themes Divi)
- [CVE-2026-19754](https://cve.now/CVE-2026-19754.md): Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction (CVSS 8.6, Baserow)
- [CVE-2026-84442](https://cve.now/CVE-2026-84442.md): MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal (CVSS 4.8, MapQuest Get Directions App)
- [CVE-2026-14982](https://cve.now/CVE-2026-14982.md): WP File Download \<= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter (CVSS 8.1, JoomUnited WP File Download)
- [CVE-2026-14957](https://cve.now/CVE-2026-14957.md): FIPS mode assertion failure via malicious CERT payload (CVSS 7.5, The Libreswan Project libreswan)
- [CVE-2026-84441](https://cve.now/CVE-2026-84441.md): Piwigo Image Derivative i.php path traversal (CVSS 6.9, Piwigo)
- [CVE-2026-84438](https://cve.now/CVE-2026-84438.md): OpenCart Autocomplete Workflow edit.php cross site scripting (CVSS 5.1, OpenCart)
- [CVE-2026-82968](https://cve.now/CVE-2026-82968.md): Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers (CVSS 6.4, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-84437](https://cve.now/CVE-2026-84437.md): OpenCart Autocomplete Workflow address.php cross site scripting (CVSS 5.1, OpenCart)
- [CVE-2026-84715](https://cve.now/CVE-2026-84715.md): FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update (CVSS 8.7, MythicalLTD FeatherPanel)
- [CVE-2026-84485](https://cve.now/CVE-2026-84485.md): APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint (CVSS 8.7, apitable)
- [CVE-2026-84484](https://cve.now/CVE-2026-84484.md): ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv (CVSS 8.7, nasa-jpl ION-DTN)
- [CVE-2026-84431](https://cve.now/CVE-2026-84431.md): AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal (CVSS 4.8, AirAsia MOVE App)
- [CVE-2026-84430](https://cve.now/CVE-2026-84430.md): gouguoa edit\_personal Endpoint Index.php update dynamically-determined object attributes (CVSS 5.3, gouguoa)
- [CVE-2026-84702](https://cve.now/CVE-2026-84702.md): facefusion before 3.7.0 Path Traversal via Job Identifier (CVSS 8.7, facefusion)
- [CVE-2026-84701](https://cve.now/CVE-2026-84701.md): NocoBase Rich Text Field Stored Cross-Site Scripting via API (CVSS 5.1, nocobase)
- [CVE-2026-84700](https://cve.now/CVE-2026-84700.md): Pika Unauthenticated Replication Access via Internal Protobuf Port (CVSS 8.8, OpenAtomFoundation pikiwidb)
- [CVE-2026-84699](https://cve.now/CVE-2026-84699.md): Team Password Manager before 14.184.308 Authentication Bypass in Password Reset (CVSS 9.3, Team Password Manager)
- [CVE-2026-84698](https://cve.now/CVE-2026-84698.md): PX4 Autopilot sd\_bench Heap Buffer Overflow via Block Size (CVSS 7.1, PX4-Autopilot)
- [CVE-2026-84697](https://cve.now/CVE-2026-84697.md): Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix (CVSS 6.9, axllent mailpit)
- [CVE-2026-84696](https://cve.now/CVE-2026-84696.md): Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands (CVSS 9.3, Phison Electronics PS3111-S11 Controller Firmware)
- [CVE-2026-84695](https://cve.now/CVE-2026-84695.md): BookStack before 26.05.4 Stored XSS via Drawing Upload (CVSS 9.3, bookstackapp bookstack)
- [CVE-2026-84694](https://cve.now/CVE-2026-84694.md): Coolify before 4.2.0 Remote Code Execution via Environment Variable Key (CVSS 8.7, coollabsio coolify)
- [CVE-2026-84427](https://cve.now/CVE-2026-84427.md): zhayujie CowAgent Bash Tool bash.py denial of service (CVSS 5.3, zhayujie CowAgent)
- [CVE-2026-84425](https://cve.now/CVE-2026-84425.md): zhayujie CowAgent Browser Tool browser\_tool.py BrowserTool denial of service (CVSS 5.3, zhayujie CowAgent)
- [CVE-2024-35585](https://cve.now/CVE-2024-35585.md): Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. (CVSS 8.6, Oxford Nanopore MinKNOW)
- [CVE-2025-46418](https://cve.now/CVE-2025-46418.md): Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition. (CVSS 7.6, Westermo WeOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.