# CVEs published 2026-09-03

345 CVEs were published on September 3, 2026: 45 critical, 165 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-67397](https://cve.now/CVE-2026-67397.md): Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. (CVSS 8.5, WebPros Plesk)
- [CVE-2026-67402](https://cve.now/CVE-2026-67402.md): An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual ho (CVSS 9.2, WebPros ConfigServer Security & Firewall · ConfigServer Sec…)
- [CVE-2026-67398](https://cve.now/CVE-2026-67398.md): Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9 (CVSS 8.2, WebPros WHMCS)
- [CVE-2026-49509](https://cve.now/CVE-2026-49509.md): Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. (CVSS 4.4, Samsung Opensource rLottie)
- [CVE-2026-85378](https://cve.now/CVE-2026-85378.md): light0011 cms Chapter Controller ChapterController.class.php \_initialize authorization (CVSS 6.9, light0011 cms)
- [CVE-2026-62916](https://cve.now/CVE-2026-62916.md): Microsoft Entra ID Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft Entra)
- [CVE-2026-65818](https://cve.now/CVE-2026-65818.md): Power Automate Elevation of Privilege Vulnerability (CVSS 8.5, Microsoft Power Platform)
- [CVE-2026-69857](https://cve.now/CVE-2026-69857.md): Azure Cosmos DB Spoofing Vulnerability (CVSS 8.5, Microsoft Azure Cosmos DB)
- [CVE-2026-83711](https://cve.now/CVE-2026-83711.md): Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Entra)
- [CVE-2026-80098](https://cve.now/CVE-2026-80098.md): Copilot Studio Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Copilot Studio)
- [CVE-2026-70352](https://cve.now/CVE-2026-70352.md): Azure AI Language Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure AI Language Authoring)
- [CVE-2026-70178](https://cve.now/CVE-2026-70178.md): Microsoft Fabric Elevation of Privilege Vulnerability (CVSS 8.5, Microsoft Fabric)
- [CVE-2026-62906](https://cve.now/CVE-2026-62906.md): Microsoft Discovery Studio Information Disclosure Vulnerability (CVSS 7.4, Microsoft Discovery Studio)
- [CVE-2026-85456](https://cve.now/CVE-2026-85456.md): MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows (CVSS 6.8, moos-ivp)
- [CVE-2026-85455](https://cve.now/CVE-2026-85455.md): MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet (CVSS 8.8, themoos core-moos)
- [CVE-2026-85454](https://cve.now/CVE-2026-85454.md): MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling (CVSS 5.2, themoos core-moos)
- [CVE-2026-85453](https://cve.now/CVE-2026-85453.md): MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting (CVSS 5.3, themoos core-moos)
- [CVE-2026-85452](https://cve.now/CVE-2026-85452.md): MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers (CVSS 8.7, themoos ui-moos)
- [CVE-2026-85451](https://cve.now/CVE-2026-85451.md): MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase (CVSS 7.1, themoos core-moos)
- [CVE-2026-85450](https://cve.now/CVE-2026-85450.md): MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion (CVSS 8.7, themoos core-moos)
- [CVE-2026-85449](https://cve.now/CVE-2026-85449.md): MOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE\_REPORT (CVSS 8.7, moos-ivp)
- [CVE-2026-85448](https://cve.now/CVE-2026-85448.md): MOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State Retention (CVSS 8.7, moos-ivp)
- [CVE-2026-85447](https://cve.now/CVE-2026-85447.md): MOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST\_REQ Subscription Denial of Service (CVSS 8.7, moos-ivp)
- [CVE-2026-85446](https://cve.now/CVE-2026-85446.md): MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service (CVSS 8.7, moos-ivp)
- [CVE-2026-85445](https://cve.now/CVE-2026-85445.md): MOOS-IvP through 24.8.1 BHV\_IPF Demultiplexer Memory Exhaustion via Packet Count (CVSS 8.7, moos-ivp)
- [CVE-2026-85444](https://cve.now/CVE-2026-85444.md): MOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevroned (CVSS 8.7, moos-ivp)
- [CVE-2026-85443](https://cve.now/CVE-2026-85443.md): MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service (CVSS 8.7, themoos core-moos)
- [CVE-2026-85442](https://cve.now/CVE-2026-85442.md): MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation (CVSS 8.7, themoos core-moos)
- [CVE-2026-85441](https://cve.now/CVE-2026-85441.md): MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length (CVSS 8.7, themoos core-moos)
- [CVE-2026-85440](https://cve.now/CVE-2026-85440.md): MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length (CVSS 9.3, themoos core-moos)
- [CVE-2026-85439](https://cve.now/CVE-2026-85439.md): MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname (CVSS 8.5, moos-ivp)
- [CVE-2026-85438](https://cve.now/CVE-2026-85438.md): MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts (CVSS 9.3, moos-ivp)
- [CVE-2026-85437](https://cve.now/CVE-2026-85437.md): MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders (CVSS 9.3, moos-ivp)
- [CVE-2026-85436](https://cve.now/CVE-2026-85436.md): MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length (CVSS 8.7, themoos essential-moos)
- [CVE-2026-85435](https://cve.now/CVE-2026-85435.md): MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment (CVSS 9.3, moos-ivp)
- [CVE-2026-85434](https://cve.now/CVE-2026-85434.md): MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping (CVSS 9.3, moos-ivp)
- [CVE-2026-85433](https://cve.now/CVE-2026-85433.md): MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration (CVSS 9.3, themoos essential-moos)
- [CVE-2026-85432](https://cve.now/CVE-2026-85432.md): MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity (CVSS 8.8, themoos core-moos)
- [CVE-2026-85431](https://cve.now/CVE-2026-85431.md): MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection (CVSS 8.7, themoos essential-moos)
- [CVE-2026-85430](https://cve.now/CVE-2026-85430.md): MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing (CVSS 8.8, themoos essential-moos)
- [CVE-2026-85429](https://cve.now/CVE-2026-85429.md): MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Spoofing (CVSS 8.7, moos-ivp)
- [CVE-2026-85428](https://cve.now/CVE-2026-85428.md): MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write (CVSS 9.3, themoos core-moos)
- [CVE-2026-85427](https://cve.now/CVE-2026-85427.md): MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION\_FILE (CVSS 9.2, themoos essential-moos)
- [CVE-2026-85426](https://cve.now/CVE-2026-85426.md): MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names (CVSS 9.3, moos-ivp)
- [CVE-2026-85425](https://cve.now/CVE-2026-85425.md): MOOS-IvP through 24.8.1 iSay Command Injection via SAY\_MOOS (CVSS 9.3, moos-ivp)
- [CVE-2026-85424](https://cve.now/CVE-2026-85424.md): MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB\_CLEAR (CVSS 9.3, themoos core-moos)
- [CVE-2026-85241](https://cve.now/CVE-2026-85241.md): SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization (CVSS 5.3, SpecterOps BloodHound)
- [CVE-2026-18167](https://cve.now/CVE-2026-18167.md): Stack-based buffer overflow in TP-Link Archer AX55 v4 (CVSS 7.7, TP-Link Systems Archer AX55)
- [CVE-2026-18330](https://cve.now/CVE-2026-18330.md): Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7 (CVSS 6.1, TP-Link Systems RE305 · TP-Link Systems Archer C7)
- [CVE-2026-85225](https://cve.now/CVE-2026-85225.md): code-projects Doctor Appointment System patient\_login.php sql injection (CVSS 6.9, code-projects Doctor Appointment System)
- [CVE-2026-64200](https://cve.now/CVE-2026-64200.md): Out Of Bounds Read in during string conversionwhen parsing a .DSB file in DASYLab (CVSS 8.5, measX DASYLab)
- [CVE-2026-64199](https://cve.now/CVE-2026-64199.md): Out Of Bounds Read outside the bounds of an allocated data structure when parsing a .DSB file in DASYLab (CVSS 8.6, measX DASYLab)
- [CVE-2026-64198](https://cve.now/CVE-2026-64198.md): Out Of Bounds Read in file handling when parsing a .DSB file in DASYLab (CVSS 8.5, measX DASYLab)
- [CVE-2026-64197](https://cve.now/CVE-2026-64197.md): Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structure (CVSS 8.5, measX DASYLab)
- [CVE-2026-64196](https://cve.now/CVE-2026-64196.md): Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap (CVSS 8.5, measX DASYLab)
- [CVE-2026-85224](https://cve.now/CVE-2026-85224.md): D-Link DNS-320 ShareCenter File Sharing file\_sharing.cgi os command injection (CVSS 9.4, D-Link DNS-320 ShareCenter)
- [CVE-2026-64195](https://cve.now/CVE-2026-64195.md): Out Of Bounds Write parsing a .DSB file in DASYLab due to lack of proper validation of user-supplied data (CVSS 8.5, measX DASYLab)
- [CVE-2026-85223](https://cve.now/CVE-2026-85223.md): D-Link DNS-340L CGI dropbox.cgi os command injection (CVSS 9.4, D-Link DNS-340L)
- [CVE-2026-85222](https://cve.now/CVE-2026-85222.md): D-Link DNS-340L Add-On Center addon\_center.cgi os command injection (CVSS 9.4, D-Link DNS-340L)
- [CVE-2026-84185](https://cve.now/CVE-2026-84185.md): Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification (CVSS 5.9, Red Hat Ansible Automation Platform · Red Hat Enterprise… +2)
- [CVE-2026-9744](https://cve.now/CVE-2026-9744.md): Vulnerabilities exists in IBM Netezza Software (CVSS 5.3, IBM Netezza Software)
- [CVE-2026-8862](https://cve.now/CVE-2026-8862.md): Vulnerabilities exists in IBM Netezza Software (CVSS 7.5, IBM Netezza Software)
- [CVE-2026-9736](https://cve.now/CVE-2026-9736.md): Vulnerabilities exists in IBM Netezza Software (CVSS 5.3, IBM Netezza Software)
- [CVE-2026-9036](https://cve.now/CVE-2026-9036.md): Vulnerabilities exists in IBM Netezza Software (CVSS 5.9, IBM Netezza Software)
- [CVE-2026-9745](https://cve.now/CVE-2026-9745.md): Vulnerabilities exists in IBM Netezza Software (CVSS 6.5, IBM Netezza Software)
- [CVE-2026-82521](https://cve.now/CVE-2026-82521.md): parsedmarc 9.0.6 \< 11.0.1 Path Traversal via Forensic Report Subject (CVSS 6.3, domainaware parsedmarc)
- [CVE-2026-82520](https://cve.now/CVE-2026-82520.md): parsedmarc \< 11.0.1 Zip Bomb DoS via Compressed Email Attachments (CVSS 8.7, domainaware parsedmarc)
- [CVE-2026-77465](https://cve.now/CVE-2026-77465.md): toml-node: Uncontrolled Recursion (CVSS 7.5, BinaryMuse toml-node · toml)
- [CVE-2026-63376](https://cve.now/CVE-2026-63376.md): toml-node: Prototype Pollution Leads to \`Object.prototype\` Corruption via \`\_\_proto\_\_\` Key-Path Desynchronization (CVSS 8.2, BinaryMuse toml-node · toml)
- [CVE-2026-85063](https://cve.now/CVE-2026-85063.md): node-csv: Prototype replacement still reachable via columns path (CVSS 6.9, adaltas node-csv · csv-parse)
- [CVE-2026-85062](https://cve.now/CVE-2026-85062.md): Colord: Slow rejection of oversized malformed color strings (CVSS 6.9, omgovich colord · colord)
- [CVE-2026-85458](https://cve.now/CVE-2026-85458.md): Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph (CVSS 2.1, Xpdf)
- [CVE-2026-85061](https://cve.now/CVE-2026-85061.md): MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip (CVSS 10.0, maplibre-gl-js · maplibre-gl)
- [CVE-2026-71429](https://cve.now/CVE-2026-71429.md): stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) (CVSS 6.2, uhop stream-json · stream-json)
- [CVE-2026-85208](https://cve.now/CVE-2026-85208.md): itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-19795](https://cve.now/CVE-2026-19795.md): Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space. (CVSS 6.2, IBM Qiskit SDK)
- [CVE-2026-85044](https://cve.now/CVE-2026-85044.md): Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social enginee (CVSS 6.5, Google Chrome)
- [CVE-2026-85047](https://cve.now/CVE-2026-85047.md): Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentiall (CVSS 9.6, Google Chrome)
- [CVE-2026-85051](https://cve.now/CVE-2026-85051.md): Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-85049](https://cve.now/CVE-2026-85049.md): Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-85042](https://cve.now/CVE-2026-85042.md): Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox v (CVSS 9.6, Google Chrome)
- [CVE-2026-85053](https://cve.now/CVE-2026-85053.md): Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insid (CVSS 8.8, Google Chrome)
- [CVE-2026-85050](https://cve.now/CVE-2026-85050.md): Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outsi (CVSS 9.6, Google Chrome)
- [CVE-2026-85045](https://cve.now/CVE-2026-85045.md): Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 7.5, Google Chrome)
- [CVE-2026-85048](https://cve.now/CVE-2026-85048.md): Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-85043](https://cve.now/CVE-2026-85043.md): Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via cra (CVSS 9.1, Google Chrome)
- [CVE-2026-85052](https://cve.now/CVE-2026-85052.md): Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer proc (CVSS 3.1, Google Chrome)
- [CVE-2026-85046](https://cve.now/CVE-2026-85046.md): Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, KEV, Google Chrome)
- [CVE-2026-82527](https://cve.now/CVE-2026-82527.md): R2R 3.6.6 SQL Injection via Retrieval Search Filter Key (CVSS 8.7, SciPhi-AI R2R)
- [CVE-2026-85207](https://cve.now/CVE-2026-85207.md): itsourcecode Online Medicine Delivery System index.php cross site scripting (CVSS 5.1, itsourcecode Online Medicine Delivery System)
- [CVE-2026-44506](https://cve.now/CVE-2026-44506.md): Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations (CVSS 8.2, medplum)
- [CVE-2026-53728](https://cve.now/CVE-2026-53728.md): Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage (CVSS 7.1, medplum · @medplum/core)
- [CVE-2026-85205](https://cve.now/CVE-2026-85205.md): itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection (CVSS 5.3, itsourcecode Online Medicine Delivery System)
- [CVE-2026-85396](https://cve.now/CVE-2026-85396.md): rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix (CVSS 8.7, rubyzip)
- [CVE-2026-85395](https://cve.now/CVE-2026-85395.md): UnoPim before 2.1.3 Missing Authorization on Integration Management Routes (CVSS 7.1, unopim)
- [CVE-2026-85394](https://cve.now/CVE-2026-85394.md): python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret (CVSS 9.3, mpdavis python-jose · python-jose)
- [CVE-2026-85393](https://cve.now/CVE-2026-85393.md): node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding (CVSS 8.7, digitalbazaar forge · node-forge)
- [CVE-2026-85392](https://cve.now/CVE-2026-85392.md): Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint (CVSS 5.3, Peppermint-Lab peppermint)
- [CVE-2026-85391](https://cve.now/CVE-2026-85391.md): Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml (CVSS 9.3, Peppermint-Lab peppermint)
- [CVE-2026-85390](https://cve.now/CVE-2026-85390.md): Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes (CVSS 7.1, bluewave-labs Checkmate)
- [CVE-2026-85389](https://cve.now/CVE-2026-85389.md): Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints (CVSS 7.1, worklenz)
- [CVE-2026-85388](https://cve.now/CVE-2026-85388.md): Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter (CVSS 8.6, worklenz)
- [CVE-2026-33630](https://cve.now/CVE-2026-33630.md): c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares\_getaddrinfo() over TCP (CVSS 7.5, c-ares)
- [CVE-2026-82302](https://cve.now/CVE-2026-82302.md): Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification (CVSS 8.1, Elastic Kibana)
- [CVE-2026-82299](https://cve.now/CVE-2026-82299.md): Incorrect Authorization in Kibana Leading to Information Disclosure (CVSS 6.5, Elastic Kibana)
- [CVE-2026-82298](https://cve.now/CVE-2026-82298.md): Incorrect Authorization in Kibana Leading to Denial of Service (CVSS 4.3, Elastic Kibana)
- [CVE-2026-78596](https://cve.now/CVE-2026-78596.md): Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations (CVSS 4.3, Elastic Kibana)
- [CVE-2026-78595](https://cve.now/CVE-2026-78595.md): Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure (CVSS 4.3, Elastic Kibana)
- [CVE-2026-78593](https://cve.now/CVE-2026-78593.md): Improper Control of Generation of Code in Kibana Leading to Privilege Escalation (CVSS 4.3, Elastic Kibana)
- [CVE-2026-78583](https://cve.now/CVE-2026-78583.md): Incorrect Authorization in Kibana Leading to Privilege Escalation (CVSS 8.1, Elastic Kibana)
- [CVE-2026-15431](https://cve.now/CVE-2026-15431.md): HP Support Assistant – Potential Escalation of Privilege (CVSS 7.3, HP Support Assistant)
- [CVE-2026-49456](https://cve.now/CVE-2026-49456.md): Waku: Open Redirect via \`unstable\_redirect\` Helper (CVSS 3.1, wakujs waku · waku)
- [CVE-2026-49455](https://cve.now/CVE-2026-49455.md): Waku: Cross-Origin CSRF on RSC Server Action Dispatch (CVSS 6.5, wakujs waku · waku)
- [CVE-2026-82526](https://cve.now/CVE-2026-82526.md): R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint (CVSS 9.3, SciPhi-AI R2R)
- [CVE-2026-85028](https://cve.now/CVE-2026-85028.md): Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit (CVSS 7.8, aws-fpga)
- [CVE-2026-82024](https://cve.now/CVE-2026-82024.md): LearnPress WordPress Plugin \< 4.4.6 Stored XSS via Quiz Question Answer Titles (CVSS 5.1, ThimPress LearnPress)
- [CVE-2026-82023](https://cve.now/CVE-2026-82023.md): LearnPress WordPress Plugin \< 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert (CVSS 5.3, ThimPress LearnPress)
- [CVE-2026-83959](https://cve.now/CVE-2026-83959.md): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance 3D Sampler)
- [CVE-2026-85187](https://cve.now/CVE-2026-85187.md): itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection (CVSS 6.9, itsourcecode Online Medicine Delivery System)
- [CVE-2026-63219](https://cve.now/CVE-2026-63219.md): Unauthenticated file upload via missing authorization on formatter upload endpoint (CVSS 8.6, core-geonetwork)
- [CVE-2026-85012](https://cve.now/CVE-2026-85012.md): OS command injection in the Amazon CodeCatalyst blueprints SDK (CVSS 8.0, AWS @amazon-codecatalyst/blueprints.blueprint)
- [CVE-2026-58400](https://cve.now/CVE-2026-58400.md): GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter (CVSS 9.1, core-geonetwork)
- [CVE-2026-84968](https://cve.now/CVE-2026-84968.md): Heap out-of-bounds read via corrupt nested BSON in field path error message (CVSS 6.9, MongoDB PHP Driver)
- [CVE-2026-85186](https://cve.now/CVE-2026-85186.md): itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload (CVSS 5.3, itsourcecode Online Medicine Delivery System)
- [CVE-2026-85304](https://cve.now/CVE-2026-85304.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.17 - Broken Access Control vulnerability (CVSS 5.3, Unlimited Elements For Elementor)
- [CVE-2026-85309](https://cve.now/CVE-2026-85309.md): WordPress Ultimate Maps by Supsystic plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 5.3, Ultimate Maps by Supsystic)
- [CVE-2026-85308](https://cve.now/CVE-2026-85308.md): WordPress SureForms plugin \<= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Brainstorm Force SureForms)
- [CVE-2026-85307](https://cve.now/CVE-2026-85307.md): WordPress KP Agent Ready plugin \< 1.2.08 - Sensitive Data Exposure vulnerability (CVSS 5.3, Kevin Pirnie KP Agent Ready)
- [CVE-2026-75602](https://cve.now/CVE-2026-75602.md): OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool (CVSS 6.5, OpenListTeam OpenList · github.com/OpenListTeam/OpenList +2)
- [CVE-2026-85306](https://cve.now/CVE-2026-85306.md): WordPress MountDev AI MCP Connector for WordPress plugin \<= 1.6.5 - Broken Access Control vulnerability (CVSS 6.5, Cascadia Web Services MountDev AI MCP Connector for WordPre…)
- [CVE-2026-85305](https://cve.now/CVE-2026-85305.md): WordPress SEOPress plugin \<= 10.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, SEOPress)
- [CVE-2026-85303](https://cve.now/CVE-2026-85303.md): WordPress Booking and Rental Manager plugin \<= 2.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Magepeople Booking and Rental Manager)
- [CVE-2026-85302](https://cve.now/CVE-2026-85302.md): WordPress WPKoi Templates for Elementor plugin \<= 3.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPKoi WordPress Themes WPKoi Templates for Elementor)
- [CVE-2026-84848](https://cve.now/CVE-2026-84848.md): WordPress Quick Event Manager plugin \<= 9.17 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brightvesseldev Quick Event Manager)
- [CVE-2026-84847](https://cve.now/CVE-2026-84847.md): WordPress Quick Event Manager plugin \<= 9.17 - Broken Access Control vulnerability (CVSS 7.5, brightvesseldev Quick Event Manager)
- [CVE-2026-84836](https://cve.now/CVE-2026-84836.md): WordPress WC Ukraine Shipping plugin \<= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.1, kirillbdev WC Ukraine Shipping)
- [CVE-2026-84834](https://cve.now/CVE-2026-84834.md): WordPress JobSearch plugin \<= 3.2.0 - PHP Object Injection vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2026-84814](https://cve.now/CVE-2026-84814.md): WordPress Bricksforge plugin \<= 3.1.8.8 - Privilege Escalation vulnerability (CVSS 9.8, Bricksforge. Bricksforge)
- [CVE-2026-84813](https://cve.now/CVE-2026-84813.md): WordPress GeoDirectory plugin \<= 2.8.174 - SQL Injection vulnerability (CVSS 9.3, Paolo GeoDirectory)
- [CVE-2026-84812](https://cve.now/CVE-2026-84812.md): WordPress BP Better Messages plugin \<= 2.15.27 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wordplus BP Better Messages)
- [CVE-2026-84779](https://cve.now/CVE-2026-84779.md): WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin \<= 1.51.0 - Broken Access Control vulnerability (CVSS 8.1, Sheikh Heera Agentimus – AI SEO, llms.txt &amp; MCP for AI…)
- [CVE-2026-84778](https://cve.now/CVE-2026-84778.md): WordPress Migrate Guru – Site Migration & Cloning plugin \<= 6.65 - Denial of Service Attack vulnerability (CVSS 7.5, migrateguru Migrate Guru – Site Migration &amp; Cloning)
- [CVE-2026-84777](https://cve.now/CVE-2026-84777.md): WordPress Really Simple SSL plugin \<= 9.8.0 - 2FA Bypass vulnerability (CVSS 7.4, Really Simple Plugins Really Simple SSL)
- [CVE-2026-84776](https://cve.now/CVE-2026-84776.md): WordPress MalCare Security plugin \<= 6.69 - Denial of Service Attack vulnerability (CVSS 7.5, MalCare Security)
- [CVE-2026-84774](https://cve.now/CVE-2026-84774.md): WordPress WP Statistics plugin \<= 14.16.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.1, VeronaLabs WP Statistics)
- [CVE-2026-84773](https://cve.now/CVE-2026-84773.md): WordPress EWWW Image Optimizer plugin \<= 8.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.2, 作者: Shane Bishop EWWW Image Optimizer)
- [CVE-2026-84769](https://cve.now/CVE-2026-84769.md): WordPress Business Directory plugin \<= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, Strategy11 Team Business Directory)
- [CVE-2026-84768](https://cve.now/CVE-2026-84768.md): WordPress VikAppointments Services Booking Calendar plugin \<= 1.2.20 - SQL Injection vulnerability (CVSS 9.3, e4jvikwp VikAppointments Services Booking Calendar)
- [CVE-2026-84767](https://cve.now/CVE-2026-84767.md): WordPress BookIt plugin \<= 2.6.0.3 - Bypass Vulnerability vulnerability (CVSS 5.3, Nexcess BookIt)
- [CVE-2026-84766](https://cve.now/CVE-2026-84766.md): WordPress FluentBooking Pro plugin \<= 2.2.1 - Bypass Vulnerability vulnerability (CVSS 5.9, WP Manage Ninja FluentBooking Pro)
- [CVE-2026-84765](https://cve.now/CVE-2026-84765.md): WordPress Breadcrumb NavXT plugin \<= 7.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, John Havlik Breadcrumb NavXT)
- [CVE-2026-84763](https://cve.now/CVE-2026-84763.md): WordPress RTMKit plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rometheme RTMKit)
- [CVE-2026-84762](https://cve.now/CVE-2026-84762.md): WordPress WP EasyPay plugin \<= 4.5.3 - Bypass Vulnerability vulnerability (CVSS 5.3, Saad Iqbal WP EasyPay)
- [CVE-2026-84761](https://cve.now/CVE-2026-84761.md): WordPress LiteSpeed Cache plugin \<= 7.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2026-84758](https://cve.now/CVE-2026-84758.md): WordPress Business Directory plugin \<= 6.4.26 - Broken Access Control vulnerability (CVSS 6.5, Strategy11 Team Business Directory)
- [CVE-2026-84757](https://cve.now/CVE-2026-84757.md): WordPress WP Compress plugin \<= 7.21.28 - Settings Change vulnerability (CVSS 8.2, AresIT WP Compress)
- [CVE-2026-84756](https://cve.now/CVE-2026-84756.md): WordPress WCFM Membership plugin \<= 2.11.11 - Privilege Escalation vulnerability (CVSS 7.1, WC Lovers WCFM Membership)
- [CVE-2026-84755](https://cve.now/CVE-2026-84755.md): WordPress Mail Mint plugin \<= 1.31.0 - Broken Access Control vulnerability (CVSS 6.5, WPFunnels Mail Mint)
- [CVE-2026-84754](https://cve.now/CVE-2026-84754.md): WordPress WPFunnels plugin \<= 3.12.13 - Broken Access Control vulnerability (CVSS 6.5, WPFunnels)
- [CVE-2026-84753](https://cve.now/CVE-2026-84753.md): WordPress Mail Mint plugin \<= 1.31.0 - PHP Object Injection vulnerability (CVSS 9.8, WPFunnels Mail Mint)
- [CVE-2026-84752](https://cve.now/CVE-2026-84752.md): WordPress RTMKit plugin \<= 2.1.5 - PHP Object Injection vulnerability (CVSS 8.8, rometheme RTMKit)
- [CVE-2026-84238](https://cve.now/CVE-2026-84238.md): WordPress YITH Request a Quote for WooCommerce Premium plugin \< 4.46.0 - Broken Access Control vulnerability (CVSS 9.8, YITH Request a Quote for WooCommerce Premium)
- [CVE-2026-84215](https://cve.now/CVE-2026-84215.md): WordPress Timetics plugin \<= 1.0.61 - Broken Access Control vulnerability (CVSS 6.5, Arraytics Timetics)
- [CVE-2026-81776](https://cve.now/CVE-2026-81776.md): WordPress WP QuickLaTeX plugin \<= 3.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, advanpix WP QuickLaTeX)
- [CVE-2026-81773](https://cve.now/CVE-2026-81773.md): WordPress Ninja Forms File Uploads Extension plugin \<= 3.3.26 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saturday Drive Ninja Forms File Uploads Extension)
- [CVE-2026-81300](https://cve.now/CVE-2026-81300.md): WordPress Calculation For Contact Form 7 plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, silverplugins217 Calculation For Contact Form)
- [CVE-2026-81295](https://cve.now/CVE-2026-81295.md): WordPress Under Construction plugin \<= 5.82 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, UnderConstructionPage Under Construction)
- [CVE-2026-81292](https://cve.now/CVE-2026-81292.md): WordPress Simple Payment plugin \<= 2.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ido Kobelkowsky Simple Payment)
- [CVE-2026-81282](https://cve.now/CVE-2026-81282.md): WordPress Product Variations Swatches for WooCommerce plugin \<= 1.1.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VillaTheme Product Variations Swatches for WooCommerce)
- [CVE-2026-81281](https://cve.now/CVE-2026-81281.md): WordPress Graphene theme \<= 2.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, silverks Graphene)
- [CVE-2026-84849](https://cve.now/CVE-2026-84849.md): WordPress Pre-Orders for WooCommerce plugin \<= 2.3 - Bypass Vulnerability vulnerability (CVSS 6.5, brightvesseldev Pre-Orders for WooCommerce)
- [CVE-2026-85242](https://cve.now/CVE-2026-85242.md): Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture (CVSS 6.9, Lookyloo PlaywrightCapture)
- [CVE-2026-84736](https://cve.now/CVE-2026-84736.md): In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables (CVSS 8.3, Eclipse Foundation Eclipse aeriOS)
- [CVE-2026-85138](https://cve.now/CVE-2026-85138.md): SeaCMS WeChat index.php addslashes sql injection (CVSS 6.9, SeaCMS)
- [CVE-2026-85239](https://cve.now/CVE-2026-85239.md): MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service (CVSS 7.1, misp)
- [CVE-2026-85238](https://cve.now/CVE-2026-85238.md): Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking (CVSS 7.6, misp)
- [CVE-2026-53720](https://cve.now/CVE-2026-53720.md): pymonocypher: Potential heap buffer overflow on nb\_blocks in argon2i\_32 when provided buffer is too small (CVSS 5.1, jetperch pymonocypher · pymonocypher)
- [CVE-2026-83961](https://cve.now/CVE-2026-83961.md): ColdFusion | Improper Authentication (CWE-287) (CVSS 7.1, Adobe ColdFusion)
- [CVE-2026-50554](https://cve.now/CVE-2026-50554.md): Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark (CVSS 5.3, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-85237](https://cve.now/CVE-2026-85237.md): Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass (CVSS 8.6, misp)
- [CVE-2026-48486](https://cve.now/CVE-2026-48486.md): Signum Node: Integer overflow in SMART\_FEES fee distribution allows arbitrary miner reward inflation (CVSS 7.5, signum-network signum-node)
- [CVE-2026-71963](https://cve.now/CVE-2026-71963.md): Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection (CVSS 8.6, NousResearch hermes-agent)
- [CVE-2026-84967](https://cve.now/CVE-2026-84967.md): Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal (CVSS 5.1, MongoDB for VS Code)
- [CVE-2026-53924](https://cve.now/CVE-2026-53924.md): Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes (CVSS 8.7, 1Hive gardens-v2)
- [CVE-2026-57445](https://cve.now/CVE-2026-57445.md): Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve (CVSS 8.7, 1Hive gardens-v2)
- [CVE-2026-55658](https://cve.now/CVE-2026-55658.md): Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim() (CVSS 7.7, 1Hive gardens-v2)
- [CVE-2026-82525](https://cve.now/CVE-2026-82525.md): Exterro FTK Imager \< 8.3 XXE via Report.xml XSLT Processing (CVSS 6.8, Exterro FTK Imager)
- [CVE-2026-75036](https://cve.now/CVE-2026-75036.md): Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing (CVSS 5.3, SUSE Fleet)
- [CVE-2026-85137](https://cve.now/CVE-2026-85137.md): SeaCMS Locoy Collector seacms\_locoy\_news.php parseIf code injection (CVSS 6.9, SeaCMS)
- [CVE-2026-85236](https://cve.now/CVE-2026-85236.md): MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request (CVSS 8.8, misp)
- [CVE-2026-75035](https://cve.now/CVE-2026-75035.md): Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass (CVSS 7.7, SUSE Rancher)
- [CVE-2026-84962](https://cve.now/CVE-2026-84962.md): Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (CVSS 5.7, MongoDB libmongocrypt)
- [CVE-2026-84963](https://cve.now/CVE-2026-84963.md): Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (CVSS 6.3, MongoDB C Driver)
- [CVE-2026-84964](https://cve.now/CVE-2026-84964.md): Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (CVSS 8.2, MongoDB C Driver)
- [CVE-2026-84965](https://cve.now/CVE-2026-84965.md): Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (CVSS 5.9, MongoDB C Driver)
- [CVE-2026-75034](https://cve.now/CVE-2026-75034.md): Rancher: SAML Assertion Replay (CVSS 7.4, SUSE Rancher)
- [CVE-2026-84966](https://cve.now/CVE-2026-84966.md): BSON element injection via NUL-embedded document keys in builder append (CVSS 5.9, MongoDB C++ Driver)
- [CVE-2026-84969](https://cve.now/CVE-2026-84969.md): Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output (CVSS 6.3, MongoDB C Driver)
- [CVE-2026-84971](https://cve.now/CVE-2026-84971.md): Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (CVSS 7.1, MongoDB libmongocrypt)
- [CVE-2026-75033](https://cve.now/CVE-2026-75033.md): Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing (CVSS 7.7, SUSE Rancher)
- [CVE-2026-84970](https://cve.now/CVE-2026-84970.md): Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (CVSS 5.9, MongoDB C++ Driver)
- [CVE-2026-71404](https://cve.now/CVE-2026-71404.md): Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole (CVSS 8.7, SUSE Rancher)
- [CVE-2026-85230](https://cve.now/CVE-2026-85230.md): MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection (CVSS 5.3, misp)
- [CVE-2026-84989](https://cve.now/CVE-2026-84989.md): ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags (CVSS 7.1, ntopng)
- [CVE-2026-71403](https://cve.now/CVE-2026-71403.md): Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind (CVSS 6.1, SUSE Rancher)
- [CVE-2026-85227](https://cve.now/CVE-2026-85227.md): Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters (CVSS 6.1, misp)
- [CVE-2026-85226](https://cve.now/CVE-2026-85226.md): MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations (CVSS 5.3, misp)
- [CVE-2026-56128](https://cve.now/CVE-2026-56128.md): pfSense Plus \< 26.07 / CE \< 2.9.0 Stored XSS via firewall\_schedule\_edit.php (CVSS 5.1, Netgate pfSense Plus · Netgate pfSense CE)
- [CVE-2026-63694](https://cve.now/CVE-2026-63694.md): Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Com (CVSS 5.0, Dell SmartFabric OS10)
- [CVE-2026-56127](https://cve.now/CVE-2026-56127.md): pfSense Plus \< 26.07 / CE \< 2.9.0 Stored XSS via firewall\_rules\_edit.php (CVSS 5.1, Netgate pfSense Plus · Netgate pfSense CE)
- [CVE-2026-56126](https://cve.now/CVE-2026-56126.md): pfSense Plus \< 26.07 / CE \< 2.9.0 Stored XSS via status\_monitoring.php (CVSS 5.1, Netgate pfSense Plus · Netgate pfSense CE)
- [CVE-2026-85221](https://cve.now/CVE-2026-85221.md): MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks (CVSS 7.6, misp)
- [CVE-2026-35160](https://cve.now/CVE-2026-35160.md): Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ( (CVSS 5.0, Dell SmartFabric OS10 Software)
- [CVE-2026-85214](https://cve.now/CVE-2026-85214.md): vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite (CVSS 7.2, lenve vhr)
- [CVE-2026-85213](https://cve.now/CVE-2026-85213.md): Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints (CVSS 7.2, killbill)
- [CVE-2026-85212](https://cve.now/CVE-2026-85212.md): CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check (CVSS 8.7, CRMEB)
- [CVE-2026-85211](https://cve.now/CVE-2026-85211.md): Label Studio through 1.23.0 Cross-Organization Storage URI Resolution (CVSS 8.3, HumanSignal label-studio)
- [CVE-2026-85210](https://cve.now/CVE-2026-85210.md): Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET (CVSS 5.3, oppia)
- [CVE-2026-85183](https://cve.now/CVE-2026-85183.md): Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS (CVSS 9.3, Avaiga taipy)
- [CVE-2026-85182](https://cve.now/CVE-2026-85182.md): vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change (CVSS 7.7, lenve vhr)
- [CVE-2026-85181](https://cve.now/CVE-2026-85181.md): CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum (CVSS 9.3, dianping cat)
- [CVE-2026-85180](https://cve.now/CVE-2026-85180.md): Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect (CVSS 8.7, ollama)
- [CVE-2026-85179](https://cve.now/CVE-2026-85179.md): Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL (CVSS 8.4, HumanSignal label-studio)
- [CVE-2026-85178](https://cve.now/CVE-2026-85178.md): Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter (CVSS 8.3, helicone)
- [CVE-2026-85177](https://cve.now/CVE-2026-85177.md): CRMEB through 6.0.0 Unauthorized Message Modification via edit\_message (CVSS 5.3, CRMEB)
- [CVE-2026-85176](https://cve.now/CVE-2026-85176.md): DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid (CVSS 8.7, dbgate)
- [CVE-2026-85199](https://cve.now/CVE-2026-85199.md): Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. (CVSS 8.8, Eclipse Foundation Eclipse aeriOS)
- [CVE-2026-85135](https://cve.now/CVE-2026-85135.md): ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload (CVSS 5.3, ILIAS)
- [CVE-2026-85216](https://cve.now/CVE-2026-85216.md): MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials (CVSS 9.5, misp)
- [CVE-2026-85110](https://cve.now/CVE-2026-85110.md): Tenda HG10 Boa Web Server formWlanSetup buffer overflow (CVSS 8.7, Tenda HG10)
- [CVE-2026-80515](https://cve.now/CVE-2026-80515.md): In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whet (CVSS 8.9, Eclipse Foundation Eclipse Arrowhead)
- [CVE-2026-84815](https://cve.now/CVE-2026-84815.md): WordPress Enfold theme \<= 8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.8, Kriesi Enfold)
- [CVE-2026-85109](https://cve.now/CVE-2026-85109.md): Tenda HG10 Boa Web Server formLogin buffer overflow (CVSS 9.3, Tenda HG10)
- [CVE-2026-82180](https://cve.now/CVE-2026-82180.md): In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFi (CVSS 9.5, Eclipse Foundation Eclipse Arrowhead)
- [CVE-2026-6071](https://cve.now/CVE-2026-6071.md): Code Execution Vulnerability in Arena® (CVSS 7.5, Rockwell Automation Arena)
- [CVE-2025-12737](https://cve.now/CVE-2025-12737.md): Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4, WSO2 Open Banking AM · WSO2 Open Banking IAM +6)
- [CVE-2026-82918](https://cve.now/CVE-2026-82918.md): XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improper (CVSS 5.5, Keyence XG-X VisionTerminal · Keyence XG VisionTerminal +2)
- [CVE-2026-85107](https://cve.now/CVE-2026-85107.md): NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-3416](https://cve.now/CVE-2026-3416.md): Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads (CVSS 5.9, WSO2 API Manager · WSO2 API Control Plane)
- [CVE-2026-78080](https://cve.now/CVE-2026-78080.md): Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite \< 5.1.0 (CVSS 9.3, joodb.feenders.de JooDatabase Lite extension for Joomla)
- [CVE-2026-71224](https://cve.now/CVE-2026-71224.md): Gfs2-utils: gfs2-utils: stack overflow via alloca(i\_height) in metadata walk (CVSS 4.7, Red Hat Enterprise Linux)
- [CVE-2026-71222](https://cve.now/CVE-2026-71222.md): Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea\_num\_ptrs in extended attribute processing (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2026-71221](https://cve.now/CVE-2026-71221.md): Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2026-71220](https://cve.now/CVE-2026-71220.md): Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di\_height in gfs2\_edit (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2026-71219](https://cve.now/CVE-2026-71219.md): Gfs2-utils: gfs2-utils: stack overflow via alloca(1\<\<di\_depth) in hash table traversal (CVSS 4.7, Red Hat Enterprise Linux)
- [CVE-2026-78000](https://cve.now/CVE-2026-78000.md): Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (CVSS 5.3, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-78069](https://cve.now/CVE-2026-78069.md): Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 (CVSS 9.5, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-78065](https://cve.now/CVE-2026-78065.md): Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 (CVSS 7.1, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-77999](https://cve.now/CVE-2026-77999.md): Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 (CVSS 8.7, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-78064](https://cve.now/CVE-2026-78064.md): Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF \`save\` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 (CVSS 8.8, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-85106](https://cve.now/CVE-2026-85106.md): NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery (CVSS 5.3, NousResearch hermes-agent)
- [CVE-2026-79679](https://cve.now/CVE-2026-79679.md): Use of Weak Credentials (CVSS 8.7, B&R Industrial Automation mapp Services)
- [CVE-2026-80465](https://cve.now/CVE-2026-80465.md): A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions \< V4.2.4), Mendix SAML (Mendix 11 compatible) (All v (CVSS 8.7, Siemens Mendix SAML)
- [CVE-2026-85175](https://cve.now/CVE-2026-85175.md): SiYuan before v3.8.2 TLS Private Key Disclosure via getFile (CVSS 8.7, siyuan-note siyuan · github.com/siyuan-note/siyuan/kernel)
- [CVE-2026-85174](https://cve.now/CVE-2026-85174.md): SiYuan before v3.8.2 API Token Exposure via Log File (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-85173](https://cve.now/CVE-2026-85173.md): n8n before 2.36.2 Missing Authorization via Insights API (CVSS 5.3, n8n-io n8n)
- [CVE-2026-85172](https://cve.now/CVE-2026-85172.md): n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass (CVSS 5.3, n8n-io n8n)
- [CVE-2026-85171](https://cve.now/CVE-2026-85171.md): n8n before 1.123.73 Credential Exposure via Error Logging (CVSS 7.1, n8n-io n8n)
- [CVE-2026-85170](https://cve.now/CVE-2026-85170.md): n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes (CVSS 7.1, n8n-io n8n)
- [CVE-2026-85169](https://cve.now/CVE-2026-85169.md): n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak (CVSS 8.7, n8n-io n8n)
- [CVE-2026-85168](https://cve.now/CVE-2026-85168.md): n8n before 1.123.73 Remote Code Execution via Git Node (CVSS 7.7, n8n-io n8n)
- [CVE-2026-85167](https://cve.now/CVE-2026-85167.md): n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes (CVSS 6.3, n8n-io n8n)
- [CVE-2026-85166](https://cve.now/CVE-2026-85166.md): n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node (CVSS 7.2, n8n-io n8n)
- [CVE-2026-85165](https://cve.now/CVE-2026-85165.md): n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement (CVSS 7.2, n8n-io n8n)
- [CVE-2026-85164](https://cve.now/CVE-2026-85164.md): WWBN AVideo Server-Side Request Forgery via set\_api\_userImages (CVSS 7.1, WWBN AVideo)
- [CVE-2026-85163](https://cve.now/CVE-2026-85163.md): AVideo Server-Side Request Forgery via epg\_link parameter (CVSS 7.1, WWBN AVideo)
- [CVE-2026-85162](https://cve.now/CVE-2026-85162.md): AVideo through c91b5975d CSRF via saveLive.php (CVSS 7.1, WWBN AVideo)
- [CVE-2026-85161](https://cve.now/CVE-2026-85161.md): AVideo removePoster.php Cross-Site Request Forgery File Deletion (CVSS 5.3, WWBN AVideo)
- [CVE-2026-85160](https://cve.now/CVE-2026-85160.md): AVideo through c91b5975d CSRF and Path Traversal via stopLive.php (CVSS 7.2, WWBN AVideo)
- [CVE-2026-85159](https://cve.now/CVE-2026-85159.md): AVideo Reflected XSS via cancelUri in userLogin.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-85158](https://cve.now/CVE-2026-85158.md): AVideo Reflected XSS via videoEmbeded.php link parameter (CVSS 5.3, WWBN AVideo)
- [CVE-2026-85157](https://cve.now/CVE-2026-85157.md): WWBN AVideo Broken Access Control via feed/index.php program\_id (CVSS 6.9, WWBN AVideo)
- [CVE-2026-85156](https://cve.now/CVE-2026-85156.md): WWBN AVideo Broken Access Control via Channel Page (CVSS 6.9, WWBN AVideo)
- [CVE-2026-85155](https://cve.now/CVE-2026-85155.md): WWBN AVideo SQL Injection via get.json.php APIName channels (CVSS 8.7, WWBN AVideo)
- [CVE-2026-85154](https://cve.now/CVE-2026-85154.md): WWBN AVideo Authentication Bypass via Non-Expiring video\_id\_hash (CVSS 9.3, WWBN AVideo)
- [CVE-2026-85105](https://cve.now/CVE-2026-85105.md): NousResearch hermes-agent Session Management s71.py \_sess\_nowait authorization (CVSS 6.9, NousResearch hermes-agent)
- [CVE-2026-76642](https://cve.now/CVE-2026-76642.md): util-linux libmount Privilege Escalation via Failed Mount Helper (CVSS 8.5, util-linux)
- [CVE-2026-85124](https://cve.now/CVE-2026-85124.md): @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments (CVSS 7.5, @fastify/http-proxy)
- [CVE-2026-85150](https://cve.now/CVE-2026-85150.md): Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst\_rtsp\_message\_parse\_auth\_credentials() when parsing a crafted digest authorization/www-authenticate header (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2026-76178](https://cve.now/CVE-2026-76178.md): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (CVSS 9.2, OCS Inventory NG Ocsreports)
- [CVE-2026-15933](https://cve.now/CVE-2026-15933.md): Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise) (CVSS 6.9, OptimiDoc Server)
- [CVE-2026-76177](https://cve.now/CVE-2026-76177.md): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (CVSS 7.1, OCS Inventory NG Ocsreports)
- [CVE-2026-76176](https://cve.now/CVE-2026-76176.md): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (CVSS 8.6, OCS Inventory NG Ocsreports)
- [CVE-2026-85100](https://cve.now/CVE-2026-85100.md): 2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption (CVSS 5.3, 2FastLabs agent-squad)
- [CVE-2026-76175](https://cve.now/CVE-2026-76175.md): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (CVSS 8.6, OCS Inventory NG Ocsreports)
- [CVE-2026-76174](https://cve.now/CVE-2026-76174.md): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (CVSS 9.4, OCS Inventory NG Ocsreports)
- [CVE-2026-80253](https://cve.now/CVE-2026-80253.md): An improper physical access control issue exists in ShizenBox2 (dev-conf). (CVSS 6.8, Shizen Connect ShizenBox2)
- [CVE-2026-80254](https://cve.now/CVE-2026-80254.md): Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). (CVSS 6.5, Shizen Connect ShizenBox2)
- [CVE-2026-84830](https://cve.now/CVE-2026-84830.md): OS command injection in privileged configuration handling (CVSS 8.6, SEPPmail AG Secure Email Gateway)
- [CVE-2026-84832](https://cve.now/CVE-2026-84832.md): Unsafe deserialization in the REST interface (CVSS 8.6, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-84831](https://cve.now/CVE-2026-84831.md): Mandatory MFA bypass before enrollment (CVSS 7.7, SEPPmail AG SEPPmail Secure Email Gateway)
- [CVE-2026-3852](https://cve.now/CVE-2026-3852.md): Divi \<= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype\_url' Shortcode Parameter (CVSS 6.4, Elegant Themes Divi)
- [CVE-2026-80757](https://cve.now/CVE-2026-80757.md): selinux: reject a class permission count below its inherited common (no CVSS, Linux)
- [CVE-2026-80756](https://cve.now/CVE-2026-80756.md): selinux: do not cancel a policy conversion that never started (no CVSS, Linux)
- [CVE-2026-80755](https://cve.now/CVE-2026-80755.md): selinux: reject a permission value exceeding the class permission count (no CVSS, Linux)
- [CVE-2026-80754](https://cve.now/CVE-2026-80754.md): Input: synaptics-rmi4 - fix F55 transmitter electrode count typo (CVSS 7.8, Linux)
- [CVE-2026-80753](https://cve.now/CVE-2026-80753.md): ovpn: run deferred work on a module-owned workqueue (CVSS 8.4, Linux)
- [CVE-2026-80752](https://cve.now/CVE-2026-80752.md): Input: psxpad-spi - set driver data before use (CVSS 8.4, Linux)
- [CVE-2026-80751](https://cve.now/CVE-2026-80751.md): pmdomain: mediatek: mfg: initialize prev\_o in mtk\_mfg\_attach\_dev() (CVSS 7.8, Linux)
- [CVE-2026-80750](https://cve.now/CVE-2026-80750.md): pmdomain: mediatek: fix remaining %pOF after of\_node\_put() (CVSS 8.4, Linux)
- [CVE-2026-80749](https://cve.now/CVE-2026-80749.md): drm/connector/hdmi: Fix out of bounds memory read (CVSS 7.1, Linux)
- [CVE-2026-80748](https://cve.now/CVE-2026-80748.md): mmc: loongson2: Fix sg iteration in data reorder functions (CVSS 7.8, Linux)
- [CVE-2026-80747](https://cve.now/CVE-2026-80747.md): drm/amdkfd: Add bounds check for CRAT subtype length (CVSS 8.0, Linux)
- [CVE-2026-80746](https://cve.now/CVE-2026-80746.md): clk: qcom: dispcc-eliza: Fix disp\_cc\_mdss\_mdp\_clk\_src RCG stall on Eliza EVK (no CVSS, Linux)
- [CVE-2026-80745](https://cve.now/CVE-2026-80745.md): regulator: fp9931: Fix VPOS/VNEG voltage selector table (CVSS 8.4, Linux)
- [CVE-2026-80744](https://cve.now/CVE-2026-80744.md): netfilter: nf\_tables\_offload: suppress WARN\_ON\_ONCE for ENOMEM in abort path (no CVSS, Linux)
- [CVE-2026-80743](https://cve.now/CVE-2026-80743.md): ASoC: xilinx: formatter\_pcm: pass aud\_drv\_data to irq handlers (no CVSS, Linux)
- [CVE-2026-80742](https://cve.now/CVE-2026-80742.md): af\_packet: Don't send zero-byte data in tpacket\_snd(). (no CVSS, Linux)
- [CVE-2026-80741](https://cve.now/CVE-2026-80741.md): drm/log: Fix out-of-bounds read on empty message length (CVSS 7.1, Linux)
- [CVE-2026-80740](https://cve.now/CVE-2026-80740.md): drm/log: Fix infinite loop when scale is too large for display (no CVSS, Linux)
- [CVE-2026-80739](https://cve.now/CVE-2026-80739.md): net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock (no CVSS, Linux)
- [CVE-2026-80738](https://cve.now/CVE-2026-80738.md): bpf: Check sk\_state before sk\_protocol in bpf\_tcp\_\*\_syncookie (CVSS 7.3, Linux)
- [CVE-2026-80737](https://cve.now/CVE-2026-80737.md): serial: amba-pl011: synchronize DMA teardown (CVSS 7.8, Linux)
- [CVE-2026-80736](https://cve.now/CVE-2026-80736.md): thunderbolt: Fix bandwidth group reservation indexing (CVSS 7.8, Linux)
- [CVE-2026-80735](https://cve.now/CVE-2026-80735.md): ovpn: ensure socket is owned by ovpn before deref sk\_user\_data (CVSS 7.3, Linux)
- [CVE-2026-80734](https://cve.now/CVE-2026-80734.md): btrfs: initialize inode mapping flags for cached inodes (CVSS 8.8, Linux)
- [CVE-2026-80733](https://cve.now/CVE-2026-80733.md): net: remove WARN\_ON\_ONCE() from sk\_mc\_loop() (no CVSS, Linux)
- [CVE-2026-80732](https://cve.now/CVE-2026-80732.md): ata: pata\_sl82c105: fix bridge revision use-after-free (CVSS 7.8, Linux)
- [CVE-2026-80731](https://cve.now/CVE-2026-80731.md): net: remove CAP\_SYS\_RAWIO zero-padding in dev\_validate\_header (CVSS 7.8, Linux)
- [CVE-2026-80730](https://cve.now/CVE-2026-80730.md): ring-buffer: Fix crash passing ERR\_PTR to kthread\_stop() (no CVSS, Linux)
- [CVE-2026-80729](https://cve.now/CVE-2026-80729.md): mm/huge\_memory: initialise workingset state before folio split (no CVSS, Linux)
- [CVE-2026-80728](https://cve.now/CVE-2026-80728.md): Revert "drm/amdgpu: fix aperture mapping leak" (no CVSS, Linux)
- [CVE-2026-80727](https://cve.now/CVE-2026-80727.md): x86/mce: Set up the polling timer before CMCI discovery (no CVSS, Linux)
- [CVE-2026-73600](https://cve.now/CVE-2026-73600.md): Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. (CVSS 7.8, Dell PowerProtect Data Manager)
- [CVE-2026-68860](https://cve.now/CVE-2026-68860.md): Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. (CVSS 6.8, Dell PowerProtect Data Manager)
- [CVE-2026-74769](https://cve.now/CVE-2026-74769.md): Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. (CVSS 6.5, Dell PowerProtect Data Manager)
- [CVE-2026-74768](https://cve.now/CVE-2026-74768.md): Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. (CVSS 4.1, Dell PowerProtect Data Manager)
- [CVE-2026-17539](https://cve.now/CVE-2026-17539.md): RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference (CVSS 5.9, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2026-9854](https://cve.now/CVE-2026-9854.md): A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to adminis (CVSS 8.5, Hitachi Energy MicroSCADA SYS600)
- [CVE-2026-9853](https://cve.now/CVE-2026-9853.md): A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read a (CVSS 8.5, Hitachi Energy MicroSCADA SYS600)
- [CVE-2026-9852](https://cve.now/CVE-2026-9852.md): A CSV injection vulnerability exists in SYS600. (CVSS 4.6, Hitachi Energy MicroSCADA SYS600)
- [CVE-2026-2573](https://cve.now/CVE-2026-2573.md): GutenKit \<= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss' (CVSS 6.4, ataurr GutenKit – Page Builder Blocks, Patterns, and Templa…)
- [CVE-2026-85040](https://cve.now/CVE-2026-85040.md): ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection (CVSS 5.1, ZhongBangKeJi CRMEB)
- [CVE-2021-38489](https://cve.now/CVE-2021-38489.md): HDD Password Stored In Plaintext (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2021-43614](https://cve.now/CVE-2021-43614.md): VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution (CVSS 6.7, Insyde Software InsydeH2O)
- [CVE-2021-43613](https://cve.now/CVE-2021-43613.md): SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege (CVSS 6.5, Insyde Software InsydeH2O)
- [CVE-2026-85031](https://cve.now/CVE-2026-85031.md): TOTOLINK CP450 cstecgi.cgi buffer overflow (CVSS 9.4, TOTOLINK CP450)
- [CVE-2026-85030](https://cve.now/CVE-2026-85030.md): HKUDS AI-Trader selfRegister API Endpoint routes\_agent.py logic error (CVSS 6.3, HKUDS AI-Trader)
- [CVE-2026-85093](https://cve.now/CVE-2026-85093.md): Cheshire Cat AI Memory Collection Endpoint Information Disclosure (CVSS 7.1, cheshire-cat-ai core)
- [CVE-2026-85092](https://cve.now/CVE-2026-85092.md): LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following (CVSS 5.2, jtsylve LiME)
- [CVE-2026-85091](https://cve.now/CVE-2026-85091.md): zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz\_vacate (CVSS 8.3, zlib)
- [CVE-2026-85090](https://cve.now/CVE-2026-85090.md): FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444 (CVSS 5.3, FreeRDP)
- [CVE-2026-85089](https://cve.now/CVE-2026-85089.md): FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory (CVSS 7.1, FreeRDP)
- [CVE-2026-85022](https://cve.now/CVE-2026-85022.md): langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting (CVSS 5.1, langgenius dify)
- [CVE-2026-85021](https://cve.now/CVE-2026-85021.md): langgenius dify Splash Layout splash.tsx router.replace cross site scripting (CVSS 5.3, langgenius dify)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.