# CVEs published 2026-09-04

562 CVEs were published on September 4, 2026: 52 critical, 161 high. Days are UTC.

- [CVE-2026-52777](https://cve.now/CVE-2026-52777.md): YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize (CVSS 9.4, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52775](https://cve.now/CVE-2026-52775.md): YesWiki Authenticated SQL Injection in ReactionManager (CVSS 8.8, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52774](https://cve.now/CVE-2026-52774.md): Reflected XSS via Unescaped \`id\` Parameter in Bazar Widget HTML Attributes in YesWiki (CVSS 6.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52773](https://cve.now/CVE-2026-52773.md): Reflected XSS via Unescaped Archived-Revision \`time\` Parameter in \`handlers/page/show.php\` in YesWiki (CVSS 6.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52772](https://cve.now/CVE-2026-52772.md): YesWiki: Bazar form-field templates still apply \`|raw('html')\` to \`field.label\` / \`field.hint\` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit \`e6b66aa\`) (CVSS 5.5, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52771](https://cve.now/CVE-2026-52771.md): YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (\`ApiController::deletePage\`) (CVSS 8.3, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52770](https://cve.now/CVE-2026-52770.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki (CVSS 7.5, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52769](https://cve.now/CVE-2026-52769.md): YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub \`Signature.keyId\` (CVSS 8.3, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52767](https://cve.now/CVE-2026-52767.md): YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via \`!openssl\_verify(...)\` accepting \`int(-1)\` (CVSS 8.2, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52766](https://cve.now/CVE-2026-52766.md): YesWiki: Unauthenticated arbitrary page deletion via \`{{erasespamedcomments}}\` action (CVSS 9.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52763](https://cve.now/CVE-2026-52763.md): YesWiki: SQL injection via the \`recentchanges\` action \`period\` argument leading to arbitrary DB read (CVSS 6.5, yeswiki · yeswiki/yeswiki)
- [CVE-2026-52762](https://cve.now/CVE-2026-52762.md): YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates (CVSS 7.1, yeswiki · yeswiki/yeswiki)
- [CVE-2026-86100](https://cve.now/CVE-2026-86100.md): Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL (CVSS 5.3, owen2345 CamaleonCMS)
- [CVE-2026-86098](https://cve.now/CVE-2026-86098.md): ntop nDPI before 6.0 Heap Buffer Overflow via ndpi\_json\_string\_escape (CVSS 8.3, ntop nDPI)
- [CVE-2026-86097](https://cve.now/CVE-2026-86097.md): PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select (CVSS 7.1, PX4-Autopilot)
- [CVE-2026-86096](https://cve.now/CVE-2026-86096.md): PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup (CVSS 6.0, PX4-Autopilot)
- [CVE-2026-86095](https://cve.now/CVE-2026-86095.md): Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name (CVSS 8.5, Unidata netcdf-c)
- [CVE-2026-48019](https://cve.now/CVE-2026-48019.md): CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay (CVSS 8.9, laravel framework · laravel/framework)
- [CVE-2026-46636](https://cve.now/CVE-2026-46636.md): Twig: Sandbox method allowlist bypass via \`Markup\` subclass (CVSS 8.7, twigphp Twig)
- [CVE-2026-86091](https://cve.now/CVE-2026-86091.md): ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler (CVSS 7.1, ntopng)
- [CVE-2026-86090](https://cve.now/CVE-2026-86090.md): ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers (CVSS 7.1, ntopng)
- [CVE-2026-75925](https://cve.now/CVE-2026-75925.md): IXON VPN Client CRLF Injection (CVSS 9.6, IXON VPN Client)
- [CVE-2026-77393](https://cve.now/CVE-2026-77393.md): Inductive Automation Ignition Incorrect Default Permissions (CVSS 8.8, Inductive Automation Ignition)
- [CVE-2026-76925](https://cve.now/CVE-2026-76925.md): Flatpak: flatpak: toctou race condition allows symlink redirection (CVSS 5.8, Red Hat Enterprise Linux)
- [CVE-2026-82684](https://cve.now/CVE-2026-82684.md): Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization (CVSS 8.1, Tycon Systems TPDIN-Monitor-WEB3)
- [CVE-2026-85704](https://cve.now/CVE-2026-85704.md): ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition (CVSS 6.3, ramon-victor freegpt-webui)
- [CVE-2026-82712](https://cve.now/CVE-2026-82712.md): Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery (CVSS 8.8, Tycon Systems TPDIN-Monitor-WEB3)
- [CVE-2026-77847](https://cve.now/CVE-2026-77847.md): Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials (CVSS 6.5, Tycon Systems TPDIN-Monitor-WEB3)
- [CVE-2026-85703](https://cve.now/CVE-2026-85703.md): ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources (CVSS 6.9, ramon-victor freegpt-webui)
- [CVE-2026-85702](https://cve.now/CVE-2026-85702.md): ramon-victor freegpt-webui Backend Conversation API backend.py \_conversation missing authentication (CVSS 6.9, ramon-victor freegpt-webui)
- [CVE-2026-85701](https://cve.now/CVE-2026-85701.md): ramon-victor freegpt-webui Authentication Check \_\_init\_\_.py ChatCompletion.create missing authentication (CVSS 6.9, ramon-victor freegpt-webui)
- [CVE-2026-85787](https://cve.now/CVE-2026-85787.md): An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server (CVSS 7.1, Amazon postgres-mcp-server)
- [CVE-2026-53769](https://cve.now/CVE-2026-53769.md): Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy (CVSS 6.5, avo-hq avo · avo)
- [CVE-2026-53932](https://cve.now/CVE-2026-53932.md): wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection') (CVSS 8.0, stefanzweifel laravel-backup-restore · wnx/laravel-backup-r…)
- [CVE-2026-63464](https://cve.now/CVE-2026-63464.md): Nebula-mesh allows non-admin operators to disable webhook SSRF protection via \`allow\_private\` (CVSS 7.7, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh)
- [CVE-2026-61699](https://cve.now/CVE-2026-61699.md): nebula-mesh: Certificate revocation is never enforced at the mesh (CVSS 8.1, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh)
- [CVE-2026-55513](https://cve.now/CVE-2026-55513.md): nebula-mesh: Web UI host creation ignores configured enrollment token TTL and mints 24-hour bearer enrollment tokens (CVSS 5.4, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh +1)
- [CVE-2026-55512](https://cve.now/CVE-2026-55512.md): nebula-mesh: Unauthenticated OIDC login endpoint allocates unbounded in-memory state entries without rate limiting (CVSS 5.3, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh +1)
- [CVE-2026-53604](https://cve.now/CVE-2026-53604.md): nebula-mesh: CA private key not zeroized on web mobile-bundle error paths (CVSS 7.1, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh)
- [CVE-2026-53603](https://cve.now/CVE-2026-53603.md): nebula-mesh: Operator session tokens stored in plaintext in the database (CVSS 7.1, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh)
- [CVE-2026-53602](https://cve.now/CVE-2026-53602.md): nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate (CVSS 6.9, forgekeep nebula-mesh · github.com/forgekeep/nebula-mesh)
- [CVE-2026-85786](https://cve.now/CVE-2026-85786.md): Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java (CVSS 8.7, Amazon ion-java)
- [CVE-2026-85643](https://cve.now/CVE-2026-85643.md): code-projects Online Shopping System adduser.php mysqli\_query sql injection (CVSS 5.1, code-projects Online Shopping System)
- [CVE-2026-85639](https://cve.now/CVE-2026-85639.md): jofpin trape Telemetry Endpoint user.py race condition (CVSS 6.3, jofpin trape)
- [CVE-2026-85781](https://cve.now/CVE-2026-85781.md): Unverified access point ownership in Amazon EFS CSI Driver (CVSS 5.1, aws-efs-csi-driver)
- [CVE-2026-85638](https://cve.now/CVE-2026-85638.md): jofpin trape user.py authorization (CVSS 6.9, jofpin trape)
- [CVE-2026-80119](https://cve.now/CVE-2026-80119.md): PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL (CVSS 8.5, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80118](https://cve.now/CVE-2026-80118.md): PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL (CVSS 8.4, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80117](https://cve.now/CVE-2026-80117.md): PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys (CVSS 6.9, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80116](https://cve.now/CVE-2026-80116.md): PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL (CVSS 8.5, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80115](https://cve.now/CVE-2026-80115.md): PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTL (CVSS 6.9, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80114](https://cve.now/CVE-2026-80114.md): PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys (CVSS 8.5, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80113](https://cve.now/CVE-2026-80113.md): PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL (CVSS 6.9, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-80112](https://cve.now/CVE-2026-80112.md): PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys (CVSS 8.5, PassMark Software PerformanceTest · PassMark Software Bu… +1)
- [CVE-2026-85637](https://cve.now/CVE-2026-85637.md): jofpin trape Admin Endpoint sockets.py join\_room missing authentication (CVSS 6.9, jofpin trape)
- [CVE-2026-81939](https://cve.now/CVE-2026-81939.md): A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an (CVSS 9.1, SonicWall Network Security Manager)
- [CVE-2026-78328](https://cve.now/CVE-2026-78328.md): A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged (CVSS 9.1, SonicWall Network Security Manager)
- [CVE-2026-78327](https://cve.now/CVE-2026-78327.md): An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Securit (CVSS 9.1, SonicWall Network Security Manager)
- [CVE-2026-53761](https://cve.now/CVE-2026-53761.md): Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api (CVSS 8.2, frappe crm)
- [CVE-2026-85636](https://cve.now/CVE-2026-85636.md): jofpin trape Login Endpoint stats.py missing authentication (CVSS 6.9, jofpin trape)
- [CVE-2026-9317](https://cve.now/CVE-2026-9317.md): Nango \< 0.71.6 Missing Authentication RCE via runner tRPC server (CVSS 9.2, NangoHQ nango)
- [CVE-2026-53760](https://cve.now/CVE-2026-53760.md): Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests (CVSS 5.2, admidio · admidio/admidio)
- [CVE-2026-61688](https://cve.now/CVE-2026-61688.md): SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props (CVSS 6.5, SolidInvoice)
- [CVE-2026-61614](https://cve.now/CVE-2026-61614.md): SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history (CVSS 5.9, SolidInvoice)
- [CVE-2026-85769](https://cve.now/CVE-2026-85769.md): Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block\_skip\_read() blocksize (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2026-73848](https://cve.now/CVE-2026-73848.md): Emlog: Stored XSS via Tag Name in Article Editor (CVSS 6.9, emlog)
- [CVE-2026-53757](https://cve.now/CVE-2026-53757.md): Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE (CVSS 6.9, emlog)
- [CVE-2026-53758](https://cve.now/CVE-2026-53758.md): Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized (CVSS 8.7, emlog)
- [CVE-2026-53756](https://cve.now/CVE-2026-53756.md): Emlog Blind SQL Injection via Authentication Cookie (CVSS 4.9, emlog)
- [CVE-2026-61608](https://cve.now/CVE-2026-61608.md): SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links (CVSS 6.8, SolidInvoice)
- [CVE-2026-61686](https://cve.now/CVE-2026-61686.md): SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop (CVSS 7.5, SolidInvoice)
- [CVE-2026-82538](https://cve.now/CVE-2026-82538.md): ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter (CVSS 8.7, ILIAS-eLearning e.V. ILIAS)
- [CVE-2026-85656](https://cve.now/CVE-2026-85656.md): OS command injection in Amazon log4j-cve-2021-44228-hotpatch (CVSS 8.5, Amazon log4j-cve-2021-44228-hotpatch)
- [CVE-2026-50553](https://cve.now/CVE-2026-50553.md): Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p) (CVSS 8.6, enchant97 note-mark · github.com/enchant97/note-mark/backend)
- [CVE-2026-18149](https://cve.now/CVE-2026-18149.md): undici vulnerable to Denial of Service via orphaned RetryHandler response body (CVSS 5.9, undici)
- [CVE-2026-80913](https://cve.now/CVE-2026-80913.md): selinux: require every boolean value to be defined (no CVSS, Linux)
- [CVE-2026-80912](https://cve.now/CVE-2026-80912.md): selinux: reject an unclaimed class value in security\_get\_classes() (no CVSS, Linux)
- [CVE-2026-80911](https://cve.now/CVE-2026-80911.md): ASoC: SOF: sof-audio: Fix error path in sof\_widget\_setup\_unlocked() (no CVSS, Linux)
- [CVE-2026-80910](https://cve.now/CVE-2026-80910.md): ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (no CVSS, Linux)
- [CVE-2026-80909](https://cve.now/CVE-2026-80909.md): drm/amdgpu: Reject UVD message with invalid number of h265 refs (no CVSS, Linux)
- [CVE-2026-80908](https://cve.now/CVE-2026-80908.md): drm/amdgpu: Reject UVD message with dimensions above 4096 (no CVSS, Linux)
- [CVE-2026-80907](https://cve.now/CVE-2026-80907.md): drm/amdgpu: Fix UVD dpb min size calculation for H264 (no CVSS, Linux)
- [CVE-2026-80906](https://cve.now/CVE-2026-80906.md): net: packet: fix wrong transport\_header when sending VLAN-tagged frame (no CVSS, Linux)
- [CVE-2026-80905](https://cve.now/CVE-2026-80905.md): net: tap: fix wrong transport\_header when sending VLAN-tagged frame (no CVSS, Linux)
- [CVE-2026-80904](https://cve.now/CVE-2026-80904.md): net/tls: Fail tls\_sw\_splice\_read() after a failed async decrypt (no CVSS, Linux)
- [CVE-2026-80903](https://cve.now/CVE-2026-80903.md): drm/xe/oa: Fix sync entry leak on OA config emit failure (no CVSS, Linux)
- [CVE-2026-18540](https://cve.now/CVE-2026-18540.md): undici vulnerable to downstream response splitting via retry interceptor (CVSS 3.7, undici)
- [CVE-2026-57166](https://cve.now/CVE-2026-57166.md): PJSIP: Pre-authentication overflow in the telnet CLI error (CVSS 6.3, pjsip pjproject)
- [CVE-2026-57165](https://cve.now/CVE-2026-57165.md): PJSIP: Pre-authentication overflow in the telnet CLI history (CVSS 6.3, pjsip pjproject)
- [CVE-2026-57164](https://cve.now/CVE-2026-57164.md): PJSIP: Heap overflow in the HTTP client (CVSS 8.3, pjsip pjproject)
- [CVE-2026-57163](https://cve.now/CVE-2026-57163.md): PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend (CVSS 8.8, pjsip pjproject)
- [CVE-2026-57162](https://cve.now/CVE-2026-57162.md): PJSIP: Stack overflow parsing SDP a=crypto attributes (CVSS 8.8, pjsip pjproject)
- [CVE-2026-57161](https://cve.now/CVE-2026-57161.md): PJSIP: Stack overflow handling Service-Route headers in a registration response (CVSS 8.8, pjsip pjproject)
- [CVE-2026-57160](https://cve.now/CVE-2026-57160.md): PJSIP: SIP message header buffer overflow (CVSS 6.9, pjsip pjproject)
- [CVE-2026-57159](https://cve.now/CVE-2026-57159.md): PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance (CVSS 8.4, pjsip pjproject)
- [CVE-2026-80902](https://cve.now/CVE-2026-80902.md): dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (no CVSS, Linux)
- [CVE-2026-80901](https://cve.now/CVE-2026-80901.md): ipvs: fix the checksum validations (no CVSS, Linux)
- [CVE-2026-80900](https://cve.now/CVE-2026-80900.md): ASoC: SDCA: Make UMP message size check more robust (no CVSS, Linux)
- [CVE-2026-80899](https://cve.now/CVE-2026-80899.md): erofs: remove fscache backend entirely (no CVSS, Linux)
- [CVE-2026-80898](https://cve.now/CVE-2026-80898.md): netfs: clear PG\_private\_2 on copy-to-cache append failure (no CVSS, Linux)
- [CVE-2026-80897](https://cve.now/CVE-2026-80897.md): netfs: release readahead folios on iterator preparation failure (no CVSS, Linux)
- [CVE-2026-80896](https://cve.now/CVE-2026-80896.md): mshv: Fix race in mshv\_irqfd\_deassign (no CVSS, Linux)
- [CVE-2026-80895](https://cve.now/CVE-2026-80895.md): mshv: Order pt\_vp\_array publish against irqfd assertion path (no CVSS, Linux)
- [CVE-2026-80894](https://cve.now/CVE-2026-80894.md): iommufd: Fix wrong hwpt passed to iommufd\_auto\_response\_faults on replace (no CVSS, Linux)
- [CVE-2026-80893](https://cve.now/CVE-2026-80893.md): mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (no CVSS, Linux)
- [CVE-2026-80892](https://cve.now/CVE-2026-80892.md): erofs: cap LZMA stream pool size (no CVSS, Linux)
- [CVE-2026-80891](https://cve.now/CVE-2026-80891.md): KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (no CVSS, Linux)
- [CVE-2026-80890](https://cve.now/CVE-2026-80890.md): sctp: reject stale cookies with mismatched verification tags (no CVSS, Linux)
- [CVE-2026-80889](https://cve.now/CVE-2026-80889.md): can: isotp: fix timer drain order, wakeup handling and tx\_gen ordering (no CVSS, Linux)
- [CVE-2026-80888](https://cve.now/CVE-2026-80888.md): drm/vmwgfx: drop dma\_buf reference on foreign-fd prime import (no CVSS, Linux)
- [CVE-2026-80887](https://cve.now/CVE-2026-80887.md): drm/vmwgfx: use check\_add\_overflow for shader size+offset bound (no CVSS, Linux)
- [CVE-2026-19534](https://cve.now/CVE-2026-19534.md): undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (CVSS 7.5, undici)
- [CVE-2026-85654](https://cve.now/CVE-2026-85654.md): Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server (CVSS 7.1, Amazon awslabs.dynamodb-mcp-server)
- [CVE-2026-84890](https://cve.now/CVE-2026-84890.md): undici vulnerable to Denial of Service via unbounded decompression of compressed responses (CVSS 5.9, undici)
- [CVE-2026-84933](https://cve.now/CVE-2026-84933.md): undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches (CVSS 6.5, undici)
- [CVE-2026-84947](https://cve.now/CVE-2026-84947.md): undici vulnerable to response truncation via oversized chunked responses in the dump interceptor (CVSS 3.7, undici)
- [CVE-2026-80886](https://cve.now/CVE-2026-80886.md): serial: msm: Disable DMA for kernel console UART (no CVSS, Linux)
- [CVE-2026-80885](https://cve.now/CVE-2026-80885.md): afs: Fix uncancelled rxrpc OOB message handler (no CVSS, Linux)
- [CVE-2026-80884](https://cve.now/CVE-2026-80884.md): ntb: Store original DMA address for future release (no CVSS, Linux)
- [CVE-2026-80883](https://cve.now/CVE-2026-80883.md): drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (no CVSS, Linux)
- [CVE-2026-80882](https://cve.now/CVE-2026-80882.md): crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (no CVSS, Linux)
- [CVE-2026-80881](https://cve.now/CVE-2026-80881.md): ocfs2: fix buffer head management in ocfs2\_read\_blocks() (no CVSS, Linux)
- [CVE-2026-80880](https://cve.now/CVE-2026-80880.md): IB/mlx5: Properly support implicit ODP rereg\_mr (no CVSS, Linux)
- [CVE-2026-80879](https://cve.now/CVE-2026-80879.md): ocfs2: fix circular locking dependency in ocfs2\_dio\_end\_io\_write (no CVSS, Linux)
- [CVE-2026-80878](https://cve.now/CVE-2026-80878.md): afs: Fix leak of ungot volume (no CVSS, Linux)
- [CVE-2026-80877](https://cve.now/CVE-2026-80877.md): afs: Fix vllist leak (no CVSS, Linux)
- [CVE-2026-80876](https://cve.now/CVE-2026-80876.md): ring-buffer: Fix event length with forced 8-byte alignment (no CVSS, Linux)
- [CVE-2026-80875](https://cve.now/CVE-2026-80875.md): ipvs: use parsed transport offset in TCP state lookup (no CVSS, Linux)
- [CVE-2026-80874](https://cve.now/CVE-2026-80874.md): arm64: dts: renesas: ironhide: Describe inline ECC carveouts (no CVSS, Linux)
- [CVE-2026-80873](https://cve.now/CVE-2026-80873.md): KVM: arm64: nv: Write ESR\_EL2 for injected nested SError exceptions (no CVSS, Linux)
- [CVE-2026-80872](https://cve.now/CVE-2026-80872.md): ALSA: hda/tas2781: Cancel async firmware request at unbind (no CVSS, Linux)
- [CVE-2026-80871](https://cve.now/CVE-2026-80871.md): crypto: xilinx-trng - Remove crypto\_rng interface (no CVSS, Linux)
- [CVE-2026-80870](https://cve.now/CVE-2026-80870.md): drm/amdkfd: Validate CRIU-restored IDs before idr\_alloc (no CVSS, Linux)
- [CVE-2026-80869](https://cve.now/CVE-2026-80869.md): ntfs: bound the attribute-list entry in ntfs\_read\_inode\_mount() (no CVSS, Linux)
- [CVE-2026-80868](https://cve.now/CVE-2026-80868.md): ntfs3: Allocate iomap inline\_data using alloc\_page (no CVSS, Linux)
- [CVE-2026-80867](https://cve.now/CVE-2026-80867.md): alpha/PCI: Add security\_locked\_down() check to pci\_mmap\_resource() (no CVSS, Linux)
- [CVE-2026-80866](https://cve.now/CVE-2026-80866.md): tipc: avoid busy looping in tipc\_exit\_net() (no CVSS, Linux)
- [CVE-2026-80865](https://cve.now/CVE-2026-80865.md): bpf: Add missing access\_ok call to copy\_user\_syms (no CVSS, Linux)
- [CVE-2026-84961](https://cve.now/CVE-2026-84961.md): undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool (CVSS 7.4, undici)
- [CVE-2026-13297](https://cve.now/CVE-2026-13297.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-14350](https://cve.now/CVE-2026-14350.md): Vulnerabilities exists in IBM Cloud Pak for Data System (CVSS 5.3, IBM Cloud Pak for Data System)
- [CVE-2026-14470](https://cve.now/CVE-2026-14470.md): Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-16180](https://cve.now/CVE-2026-16180.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 5.7, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-85008](https://cve.now/CVE-2026-85008.md): undici vulnerable to caching and replay of unsafe HTTP method responses (CVSS 3.7, undici)
- [CVE-2026-16660](https://cve.now/CVE-2026-16660.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities \[, , \] (CVSS 5.3, IBM Db2 Mirror for i)
- [CVE-2026-16689](https://cve.now/CVE-2026-16689.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 6.2, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-16693](https://cve.now/CVE-2026-16693.md): IBM i is Affected By Cryptographic Algorithm Weakness in DCM \[\] (CVSS 4.4, IBM i)
- [CVE-2026-16826](https://cve.now/CVE-2026-16826.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 5.3, IBM i)
- [CVE-2026-16892](https://cve.now/CVE-2026-16892.md): IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service \[\] (CVSS 5.4, IBM i)
- [CVE-2026-16941](https://cve.now/CVE-2026-16941.md): IBM i is Affected By An Incorrect Authorization Vulnerability \[\] (CVSS 4.3, IBM i)
- [CVE-2026-17057](https://cve.now/CVE-2026-17057.md): IBM i is Affected By Denial of Service Vulnerabilities in NFS \[, \] (CVSS 6.5, IBM i)
- [CVE-2026-17207](https://cve.now/CVE-2026-17207.md): IBM i is Affected By Denial of Service Vulnerabilities in NFS \[, \] (CVSS 6.5, IBM i)
- [CVE-2026-17255](https://cve.now/CVE-2026-17255.md): IBM i is Affected By Denial of Service Vulnerability \[\] (CVSS 4.3, IBM i)
- [CVE-2026-17259](https://cve.now/CVE-2026-17259.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 4.3, IBM i)
- [CVE-2026-17270](https://cve.now/CVE-2026-17270.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 4.3, IBM i)
- [CVE-2026-17273](https://cve.now/CVE-2026-17273.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 6.5, IBM i)
- [CVE-2026-17274](https://cve.now/CVE-2026-17274.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 5.4, IBM i)
- [CVE-2026-17440](https://cve.now/CVE-2026-17440.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 5.5, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-85152](https://cve.now/CVE-2026-85152.md): undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors (CVSS 7.4, undici)
- [CVE-2026-17442](https://cve.now/CVE-2026-17442.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 5.1, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-17443](https://cve.now/CVE-2026-17443.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 5.3, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-17444](https://cve.now/CVE-2026-17444.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 5.3, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-17469](https://cve.now/CVE-2026-17469.md): IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon \[, \] (CVSS 5.3, IBM i)
- [CVE-2026-17470](https://cve.now/CVE-2026-17470.md): IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon \[, \] (CVSS 5.3, IBM i)
- [CVE-2026-17483](https://cve.now/CVE-2026-17483.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities \[, , \] (CVSS 4.3, IBM Db2 Mirror for i)
- [CVE-2026-17499](https://cve.now/CVE-2026-17499.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 4.4, IBM i)
- [CVE-2026-17627](https://cve.now/CVE-2026-17627.md): Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint (CVSS 4.9, IBM Langflow OSS)
- [CVE-2026-85014](https://cve.now/CVE-2026-85014.md): undici vulnerable to Denial of Service via WebSocketStream unclean close (CVSS 5.9, undici)
- [CVE-2026-17621](https://cve.now/CVE-2026-17621.md): Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-17622](https://cve.now/CVE-2026-17622.md): Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-17631](https://cve.now/CVE-2026-17631.md): Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components (CVSS 5.0, IBM Langflow OSS)
- [CVE-2026-18073](https://cve.now/CVE-2026-18073.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 4.4, IBM i)
- [CVE-2026-18078](https://cve.now/CVE-2026-18078.md): IBM i is Affected By Denial of Service Vulnerability in Save Restore \[\] (CVSS 4.3, IBM i)
- [CVE-2026-18076](https://cve.now/CVE-2026-18076.md): IBM i is Affected By Multiple Vulnerabilities in Debug Server (CVSS 4.3, IBM i)
- [CVE-2026-18175](https://cve.now/CVE-2026-18175.md): IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA \[, \] (CVSS 8.1, IBM i)
- [CVE-2026-18221](https://cve.now/CVE-2026-18221.md): IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA \[, \] (CVSS 8.1, IBM i)
- [CVE-2026-18341](https://cve.now/CVE-2026-18341.md): IBM i is Affected By Buffer Overflow Vulnerability \[\] (CVSS 6.3, IBM i)
- [CVE-2026-18486](https://cve.now/CVE-2026-18486.md): IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution (CVSS 8.8, IBM ContextForge MCP Gateway)
- [CVE-2026-18489](https://cve.now/CVE-2026-18489.md): IBM ContextForge Translate is affected by cross-client credential context confusion (CVSS 7.4, IBM ContextForge MCP Gateway - Translate utility)
- [CVE-2026-85024](https://cve.now/CVE-2026-85024.md): undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression (CVSS 5.9, undici)
- [CVE-2026-18567](https://cve.now/CVE-2026-18567.md): IBM Db2 Mirror for i is affected by multiple vulnerabilities \[, , \] (CVSS 4.4, IBM Db2 Mirror for i)
- [CVE-2026-18658](https://cve.now/CVE-2026-18658.md): IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed (CVSS 9.8, IBM Operational Decision Manager)
- [CVE-2026-18858](https://cve.now/CVE-2026-18858.md): IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH \[\] (CVSS 3.3, IBM i)
- [CVE-2026-18887](https://cve.now/CVE-2026-18887.md): IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE \[\] (CVSS 6.5, IBM i)
- [CVE-2026-19298](https://cve.now/CVE-2026-19298.md): Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-19301](https://cve.now/CVE-2026-19301.md): Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components (CVSS 5.0, IBM Langflow OSS)
- [CVE-2026-19303](https://cve.now/CVE-2026-19303.md): Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-18905](https://cve.now/CVE-2026-18905.md): IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation (CVSS 7.7, IBM ContextForge MCP Gateway)
- [CVE-2026-80864](https://cve.now/CVE-2026-80864.md): RDMA/rxe: Fix responder UAF on IB\_QP\_MAX\_DEST\_RD\_ATOMIC modify\_qp (no CVSS, Linux)
- [CVE-2026-80863](https://cve.now/CVE-2026-80863.md): RDMA/rxe: Fix OOB in free\_rd\_atomic\_resources() (no CVSS, Linux)
- [CVE-2026-80862](https://cve.now/CVE-2026-80862.md): nvme-tcp: fix usage of page\_frag\_cache (no CVSS, Linux)
- [CVE-2026-80861](https://cve.now/CVE-2026-80861.md): usb: xhci: bail out of setup if the controller is inaccessible (no CVSS, Linux)
- [CVE-2026-80860](https://cve.now/CVE-2026-80860.md): fuse: fix race between interrupt and resend (no CVSS, Linux)
- [CVE-2026-80859](https://cve.now/CVE-2026-80859.md): fuse: fix missing barrier when checking io-uring readiness (no CVSS, Linux)
- [CVE-2026-80858](https://cve.now/CVE-2026-80858.md): fuse: publish io-uring queues with release semantics (no CVSS, Linux)
- [CVE-2026-80857](https://cve.now/CVE-2026-80857.md): fuse: wait for FR\_FINISHED on abort\_on\_kill to prevent use-after-free (no CVSS, Linux)
- [CVE-2026-80856](https://cve.now/CVE-2026-80856.md): fuse: fix invalidate lock leak on setattr writeback failure (no CVSS, Linux)
- [CVE-2026-80855](https://cve.now/CVE-2026-80855.md): fuse: fix invalidate lock leak on open O\_TRUNC DAX failure (no CVSS, Linux)
- [CVE-2026-80854](https://cve.now/CVE-2026-80854.md): usb: gadget: f\_tcm: keep port count until LUN teardown completes (no CVSS, Linux)
- [CVE-2026-80853](https://cve.now/CVE-2026-80853.md): KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts (no CVSS, Linux)
- [CVE-2026-80852](https://cve.now/CVE-2026-80852.md): tls: device: fix out-of-bounds write in tls\_append\_frag() (no CVSS, Linux)
- [CVE-2026-80851](https://cve.now/CVE-2026-80851.md): gtp: serialize PDP context updates (no CVSS, Linux)
- [CVE-2026-80850](https://cve.now/CVE-2026-80850.md): tcp: fix AO info use-after-free in tcp\_ao\_connect\_init() (no CVSS, Linux)
- [CVE-2026-80849](https://cve.now/CVE-2026-80849.md): net/tcp-ao: fix use-after-free of current\_key on reconnect to another peer (no CVSS, Linux)
- [CVE-2026-80848](https://cve.now/CVE-2026-80848.md): xfrm: espintcp: fix UAF during close (no CVSS, Linux)
- [CVE-2026-80847](https://cve.now/CVE-2026-80847.md): tcp: clamp route advmss to TCP\_MIN\_MSS (no CVSS, Linux)
- [CVE-2026-80846](https://cve.now/CVE-2026-80846.md): xfrm: drop ESP-in-TCP packets with no ingress device (no CVSS, Linux)
- [CVE-2026-80845](https://cve.now/CVE-2026-80845.md): xfrm: avoid lock inversion in nat keepalive work (no CVSS, Linux)
- [CVE-2026-80844](https://cve.now/CVE-2026-80844.md): xfrm: ah6: validate routing header segments\_left (no CVSS, Linux)
- [CVE-2026-80843](https://cve.now/CVE-2026-80843.md): xfrm: fix xfrm\_state\_construct() auth-trunc leak (no CVSS, Linux)
- [CVE-2026-80842](https://cve.now/CVE-2026-80842.md): net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (no CVSS, Linux)
- [CVE-2026-80841](https://cve.now/CVE-2026-80841.md): net/packet: defer vmalloc TX\_RING free until skbs finish (no CVSS, Linux)
- [CVE-2026-80840](https://cve.now/CVE-2026-80840.md): ipv6: seg6: clear IPv4 control block on IPIP decapsulation (no CVSS, Linux)
- [CVE-2026-80839](https://cve.now/CVE-2026-80839.md): batman-adv: reject unrepresentable multicast TVLV offsets (no CVSS, Linux)
- [CVE-2026-80838](https://cve.now/CVE-2026-80838.md): vxlan: keep the last remote linked during FDB flush (no CVSS, Linux)
- [CVE-2026-80837](https://cve.now/CVE-2026-80837.md): netfilter: nf\_tables: don't queue packet path object notifications (no CVSS, Linux)
- [CVE-2026-80836](https://cve.now/CVE-2026-80836.md): crypto: virtio - bound the akcipher result length (no CVSS, Linux)
- [CVE-2026-80835](https://cve.now/CVE-2026-80835.md): crypto: qcom-rng - Remove crypto\_rng interface (no CVSS, Linux)
- [CVE-2026-80834](https://cve.now/CVE-2026-80834.md): crypto: sun8i-ce - Remove crypto\_rng interface (no CVSS, Linux)
- [CVE-2026-80833](https://cve.now/CVE-2026-80833.md): crypto: sun8i-ss - Remove crypto\_rng interface (no CVSS, Linux)
- [CVE-2026-80832](https://cve.now/CVE-2026-80832.md): crypto: qce - fix CCM AAD buffer underallocation (no CVSS, Linux)
- [CVE-2026-80831](https://cve.now/CVE-2026-80831.md): crypto: mxs-dcp - fix source scatterlist length access (no CVSS, Linux)
- [CVE-2026-80830](https://cve.now/CVE-2026-80830.md): usb: core: Add lock to usb\_wakeup\_notification() (no CVSS, Linux)
- [CVE-2026-80829](https://cve.now/CVE-2026-80829.md): ALSA: usb-audio: fix OOB write in snd\_usbmidi\_novation\_output() (no CVSS, Linux)
- [CVE-2026-80828](https://cve.now/CVE-2026-80828.md): ALSA: usb-audio: Complete cleanup after system-resume errors (no CVSS, Linux)
- [CVE-2026-80827](https://cve.now/CVE-2026-80827.md): USB: serial: option: fix slab OOB read in interrupt URB callback (no CVSS, Linux)
- [CVE-2026-80826](https://cve.now/CVE-2026-80826.md): USB: c67x00: fix use-after-free in c67x00\_add\_iso\_urb() (no CVSS, Linux)
- [CVE-2026-80825](https://cve.now/CVE-2026-80825.md): wifi: mt76: mt7925: ensure tx headroom in usb\_sdio\_tx\_prepare\_skb (no CVSS, Linux)
- [CVE-2026-80824](https://cve.now/CVE-2026-80824.md): usb: usbfs: fix use-after-free of usb\_device in usbdev\_release() (no CVSS, Linux)
- [CVE-2026-19274](https://cve.now/CVE-2026-19274.md): IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image (CVSS 9.6, IBM Observability with Instana)
- [CVE-2026-19283](https://cve.now/CVE-2026-19283.md): IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image (CVSS 7.7, IBM Observability with Instana)
- [CVE-2026-19300](https://cve.now/CVE-2026-19300.md): Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-19299](https://cve.now/CVE-2026-19299.md): Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-19302](https://cve.now/CVE-2026-19302.md): Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-82911](https://cve.now/CVE-2026-82911.md): CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes (CVSS 5.1, Roskus Prospero Flow CRM)
- [CVE-2026-44402](https://cve.now/CVE-2026-44402.md): Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi (CVSS 9.3, Voltronic Power SNMP Web Pro)
- [CVE-2026-19304](https://cve.now/CVE-2026-19304.md): Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components (CVSS 7.7, IBM Langflow OSS)
- [CVE-2026-80823](https://cve.now/CVE-2026-80823.md): nfc: st21nfca: validate ATR\_REQ length against the received frame (no CVSS, Linux)
- [CVE-2026-80822](https://cve.now/CVE-2026-80822.md): mailbox: mchp-ipc-sbi: Add null check for devm\_kasprintf() (no CVSS, Linux)
- [CVE-2026-80821](https://cve.now/CVE-2026-80821.md): nvmet: pci-epf: put CQ ref on create\_cq mapping failure (no CVSS, Linux)
- [CVE-2026-19305](https://cve.now/CVE-2026-19305.md): Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components (CVSS 8.6, IBM Langflow OSS)
- [CVE-2026-85730](https://cve.now/CVE-2026-85730.md): smol-toml: Denial of Service via malformed TOML documents (CVSS 8.2, squirrelchat smol-toml · smol-toml)
- [CVE-2026-19306](https://cve.now/CVE-2026-19306.md): Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components (CVSS 7.7, IBM Langflow OSS)
- [CVE-2026-19645](https://cve.now/CVE-2026-19645.md): Multiple vulnerabilities in IBM MQ Agent images (CVSS 6.5, IBM MQ Agent)
- [CVE-2026-19649](https://cve.now/CVE-2026-19649.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 6.2, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-5522](https://cve.now/CVE-2026-5522.md): QRadar contains hard-coded credentials (CVSS 6.7, IBM QRadar)
- [CVE-2026-77822](https://cve.now/CVE-2026-77822.md): IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint (CVSS 8.2, IBM ContextForge MCP Gateway)
- [CVE-2026-80820](https://cve.now/CVE-2026-80820.md): xfs: don't livelock in scrub on a circular unlinked list (no CVSS, Linux)
- [CVE-2026-80819](https://cve.now/CVE-2026-80819.md): Bluetooth: RFCOMM: take rfcomm\_mutex for the deferred setup accept (no CVSS, Linux)
- [CVE-2026-80818](https://cve.now/CVE-2026-80818.md): iommu/tegra241-cmdqv: Fix CMD\_SYNC use-after-free on teardown (no CVSS, Linux)
- [CVE-2026-80817](https://cve.now/CVE-2026-80817.md): iommu/iommufd: Fix NULL pointer deref in iommufd\_ioas\_change\_process when racing with iopt\_map\_file\_pages (no CVSS, Linux)
- [CVE-2026-80816](https://cve.now/CVE-2026-80816.md): ALSA: FCP: Use a private URB for the notification endpoint (no CVSS, Linux)
- [CVE-2026-80815](https://cve.now/CVE-2026-80815.md): ALSA: scarlett2: Use a private URB for the notification endpoint (no CVSS, Linux)
- [CVE-2026-80814](https://cve.now/CVE-2026-80814.md): rndis\_host: add overflow check in rndis\_rx\_fixup() (no CVSS, Linux)
- [CVE-2026-80813](https://cve.now/CVE-2026-80813.md): nvmet: fix NULL pointer dereference in nvmet\_execute\_identify\_nslist() (no CVSS, Linux)
- [CVE-2026-80812](https://cve.now/CVE-2026-80812.md): ALSA: dummy: Check card index validity at probe (no CVSS, Linux)
- [CVE-2026-80811](https://cve.now/CVE-2026-80811.md): io\_uring/cmd: fix iovec leak when the async cmd is not recycled (no CVSS, Linux)
- [CVE-2026-80810](https://cve.now/CVE-2026-80810.md): io\_uring/rsrc: fix folio size overflow in io\_vec\_fill\_bvec() (no CVSS, Linux)
- [CVE-2026-80809](https://cve.now/CVE-2026-80809.md): ocfs2: fix missing metadata reservation for large xattrs (no CVSS, Linux)
- [CVE-2026-80808](https://cve.now/CVE-2026-80808.md): ext4: stop retrying saturated xattr cache entries (no CVSS, Linux)
- [CVE-2026-80807](https://cve.now/CVE-2026-80807.md): nilfs2: reject invalid block index in GC ioctl (no CVSS, Linux)
- [CVE-2026-80806](https://cve.now/CVE-2026-80806.md): ext4: don't enable DAX on new encrypted files (no CVSS, Linux)
- [CVE-2026-80805](https://cve.now/CVE-2026-80805.md): xfs: validate attr entry pointer before field access (no CVSS, Linux)
- [CVE-2026-80804](https://cve.now/CVE-2026-80804.md): xfs: restore nofs context unconditionally in xfs\_trans\_roll (no CVSS, Linux)
- [CVE-2026-80803](https://cve.now/CVE-2026-80803.md): nfc: digital: clamp SENSF\_RES length to the destination buffer (no CVSS, Linux)
- [CVE-2026-80802](https://cve.now/CVE-2026-80802.md): nfc: fdp: bound the device-reported read length and fix an skb leak (no CVSS, Linux)
- [CVE-2026-80801](https://cve.now/CVE-2026-80801.md): nfc: microread: validate target discovery payload lengths (no CVSS, Linux)
- [CVE-2026-80800](https://cve.now/CVE-2026-80800.md): nfc: llcp: bound the connect\_sn TLV walk to the skb (no CVSS, Linux)
- [CVE-2026-80799](https://cve.now/CVE-2026-80799.md): nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers (no CVSS, Linux)
- [CVE-2026-80798](https://cve.now/CVE-2026-80798.md): nfc: llcp: reject PDUs shorter than the LLCP header (no CVSS, Linux)
- [CVE-2026-80797](https://cve.now/CVE-2026-80797.md): nfc: pn533: purge fragmented skbs during cleanup (no CVSS, Linux)
- [CVE-2026-80796](https://cve.now/CVE-2026-80796.md): nfc: nci: add data\_len bound checks to activation parameter extractors (no CVSS, Linux)
- [CVE-2026-80795](https://cve.now/CVE-2026-80795.md): nfc: nci: fix out-of-bounds write in nci\_target\_auto\_activated() (no CVSS, Linux)
- [CVE-2026-80794](https://cve.now/CVE-2026-80794.md): nfc: nci: fix uninit-value in the RF discover/activated NTF handlers (no CVSS, Linux)
- [CVE-2026-80793](https://cve.now/CVE-2026-80793.md): ipv4: reject undersized MTUs in ip\_do\_fragment() (no CVSS, Linux)
- [CVE-2026-80792](https://cve.now/CVE-2026-80792.md): ipv6: fix use-after-free in ip6\_finish\_output2() (no CVSS, Linux)
- [CVE-2026-80791](https://cve.now/CVE-2026-80791.md): nvmet-auth: zero the AUTH\_RECEIVE response buffer (no CVSS, Linux)
- [CVE-2026-80790](https://cve.now/CVE-2026-80790.md): nvmet-fc: fix invalid free in LS IOD error path (no CVSS, Linux)
- [CVE-2026-80789](https://cve.now/CVE-2026-80789.md): nvmet-tcp: bound SGL data length before allocating command buffers (no CVSS, Linux)
- [CVE-2026-80788](https://cve.now/CVE-2026-80788.md): nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations (no CVSS, Linux)
- [CVE-2026-80787](https://cve.now/CVE-2026-80787.md): nvmet: pci-epf: fix use-after-free in nvmet\_pci\_epf\_exec\_iod\_work() (no CVSS, Linux)
- [CVE-2026-80786](https://cve.now/CVE-2026-80786.md): fbdev: Wrap user-invoked calls to fb\_set\_var() in helper (no CVSS, Linux)
- [CVE-2026-80785](https://cve.now/CVE-2026-80785.md): fbdev: serialize mode sysfs access with lock\_fb\_info() (no CVSS, Linux)
- [CVE-2026-80784](https://cve.now/CVE-2026-80784.md): mptcp: pm: fix memory leak from alloc-during-teardown race (no CVSS, Linux)
- [CVE-2026-80783](https://cve.now/CVE-2026-80783.md): HID: magicmouse: prevent unbounded recursion in magicmouse\_raw\_event() (no CVSS, Linux)
- [CVE-2026-80782](https://cve.now/CVE-2026-80782.md): HID: magicmouse: do not keep a stale msc-\>input if no input is claimed (no CVSS, Linux)
- [CVE-2026-80781](https://cve.now/CVE-2026-80781.md): HID: core: fix OOB read of field-\>usage in hid\_set\_field() (no CVSS, Linux)
- [CVE-2026-80780](https://cve.now/CVE-2026-80780.md): HID: pidff: fix OOB write when hid-\>inputs is empty (no CVSS, Linux)
- [CVE-2026-80779](https://cve.now/CVE-2026-80779.md): net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (no CVSS, Linux)
- [CVE-2026-80778](https://cve.now/CVE-2026-80778.md): futex/pi: Reject cross-mm private futex owners (no CVSS, Linux)
- [CVE-2026-80777](https://cve.now/CVE-2026-80777.md): futex/pi: Plug private futex exec() race (no CVSS, Linux)
- [CVE-2026-80776](https://cve.now/CVE-2026-80776.md): futex: Fix race in futex\_pivot\_pending() during private hash resize (no CVSS, Linux)
- [CVE-2026-80775](https://cve.now/CVE-2026-80775.md): futex: Fix race on the initial mm-\>futex.phash.ref allocation (no CVSS, Linux)
- [CVE-2026-80774](https://cve.now/CVE-2026-80774.md): HID: asus: fix missing hid\_is\_usb() check (no CVSS, Linux)
- [CVE-2026-80773](https://cve.now/CVE-2026-80773.md): HID: huawei: fix missing hid\_is\_usb() check (no CVSS, Linux)
- [CVE-2026-80772](https://cve.now/CVE-2026-80772.md): HID: nintendo: fix out-of-bounds read in joycon\_ctlr\_read\_handler() (no CVSS, Linux)
- [CVE-2026-80771](https://cve.now/CVE-2026-80771.md): HID: nintendo: register input device after capabilities are set (no CVSS, Linux)
- [CVE-2026-80770](https://cve.now/CVE-2026-80770.md): HID: nintendo: stop device IO before hid\_hw\_stop on probe failure (no CVSS, Linux)
- [CVE-2026-80769](https://cve.now/CVE-2026-80769.md): HID: rapoo: fix missing hid\_is\_usb() check (no CVSS, Linux)
- [CVE-2026-80768](https://cve.now/CVE-2026-80768.md): HID: ft260: fix stack-use-after-return write in I2C read race (no CVSS, Linux)
- [CVE-2026-80767](https://cve.now/CVE-2026-80767.md): HID: sensor: custom: Fix use-after-free in enable\_sensor (no CVSS, Linux)
- [CVE-2026-80766](https://cve.now/CVE-2026-80766.md): HID: uclogic: fix use-after-free of inrange\_timer on remove (no CVSS, Linux)
- [CVE-2026-80765](https://cve.now/CVE-2026-80765.md): HID: hyperv: validate initial device info bounds (no CVSS, Linux)
- [CVE-2026-80764](https://cve.now/CVE-2026-80764.md): Bluetooth: hci\_event: fix LE list UAF on reset (no CVSS, Linux)
- [CVE-2026-80763](https://cve.now/CVE-2026-80763.md): Bluetooth: hci\_event: validate LE Set CIG Parameters response (no CVSS, Linux)
- [CVE-2026-80762](https://cve.now/CVE-2026-80762.md): Bluetooth: hci\_sync: Fix accept list UAF during suspend (no CVSS, Linux)
- [CVE-2026-80761](https://cve.now/CVE-2026-80761.md): Bluetooth: ISO: zero the sockaddr before returning it in getname (no CVSS, Linux)
- [CVE-2026-80760](https://cve.now/CVE-2026-80760.md): Bluetooth: MGMT: reject HCI\_CMD\_SYNC params\_len above 255 (no CVSS, Linux)
- [CVE-2026-80759](https://cve.now/CVE-2026-80759.md): Bluetooth: hci\_aml: validate firmware segment lengths (no CVSS, Linux)
- [CVE-2026-80758](https://cve.now/CVE-2026-80758.md): futex: Avoid private hash use-after-free on final put (no CVSS, Linux)
- [CVE-2026-78543](https://cve.now/CVE-2026-78543.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 5.3, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-78658](https://cve.now/CVE-2026-78658.md): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability (CVSS 6.5, UCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy)
- [CVE-2026-81832](https://cve.now/CVE-2026-81832.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (CVSS 7.7, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-6958](https://cve.now/CVE-2026-6958.md): Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe (CVSS 8.5, Invicti Security Acunetix)
- [CVE-2026-81859](https://cve.now/CVE-2026-81859.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.2, IBM Cloud Pak for Business Automation)
- [CVE-2026-85700](https://cve.now/CVE-2026-85700.md): Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints (CVSS 7.1, onyx-dot-app onyx)
- [CVE-2026-85699](https://cve.now/CVE-2026-85699.md): jina-ai reader server-side request forgery via redirect validation bypass (CVSS 8.7, jina-ai reader)
- [CVE-2026-85698](https://cve.now/CVE-2026-85698.md): Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service (CVSS 6.8, tursodatabase turso)
- [CVE-2026-85697](https://cve.now/CVE-2026-85697.md): Documenso 2.17.0 PDF Route Ignores Document Visibility (CVSS 7.1, documenso)
- [CVE-2026-85696](https://cve.now/CVE-2026-85696.md): SadTalker OS Command Injection via Audio Filename (CVSS 9.3, OpenTalker SadTalker)
- [CVE-2026-85695](https://cve.now/CVE-2026-85695.md): FastChat Unauthenticated Worker Registration SSRF and Model Spoofing (CVSS 9.3, lm-sys FastChat)
- [CVE-2026-85694](https://cve.now/CVE-2026-85694.md): LaVague 0.2.35 Remote Code Execution via eval extraction (CVSS 9.2, lavague-ai LaVague)
- [CVE-2026-85693](https://cve.now/CVE-2026-85693.md): Chatbot UI Cross-User Private File Content Disclosure via Retrieval API (CVSS 7.1, mckaywrigley chatbot-ui)
- [CVE-2026-85692](https://cve.now/CVE-2026-85692.md): Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding (CVSS 7.1, ccfos nightingale)
- [CVE-2026-85691](https://cve.now/CVE-2026-85691.md): MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url (CVSS 8.7, The-Vibe-Company megaparse)
- [CVE-2026-85690](https://cve.now/CVE-2026-85690.md): Plandex 2.2.1 Path Traversal via ApplyFiles (CVSS 8.5, plandex-ai plandex)
- [CVE-2026-85689](https://cve.now/CVE-2026-85689.md): llmware 0.4.6 SQL Injection via unescaped filter values (CVSS 7.1, llmware-ai llmware)
- [CVE-2026-85688](https://cve.now/CVE-2026-85688.md): TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer (CVSS 9.3, ten-framework)
- [CVE-2026-85687](https://cve.now/CVE-2026-85687.md): surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server (CVSS 8.7, datalab-to surya)
- [CVE-2026-85686](https://cve.now/CVE-2026-85686.md): ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs (CVSS 8.7, modelscope ms-swift)
- [CVE-2026-85685](https://cve.now/CVE-2026-85685.md): AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add\_skill (CVSS 8.7, agentscope-ai agentscope)
- [CVE-2026-85684](https://cve.now/CVE-2026-85684.md): marker through 2.0.0 Path Traversal via upload filename (CVSS 8.8, datalab-to marker)
- [CVE-2026-85676](https://cve.now/CVE-2026-85676.md): Dub Open Redirect via Unrestricted redir\_url Parameter (CVSS 5.3, dubinc dub)
- [CVE-2026-85675](https://cve.now/CVE-2026-85675.md): OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching (CVSS 8.7, camel-ai owl)
- [CVE-2026-85674](https://cve.now/CVE-2026-85674.md): aider 0.86.2 Remote Code Execution via .aider.conf.yml (CVSS 8.5, Aider-AI aider)
- [CVE-2026-85673](https://cve.now/CVE-2026-85673.md): LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding (CVSS 8.7, hiyouga LlamaFactory)
- [CVE-2026-85672](https://cve.now/CVE-2026-85672.md): zerox 1.1.20 OS Command Injection via Document URL File Extension (CVSS 9.3, getomni-ai zerox)
- [CVE-2026-85671](https://cve.now/CVE-2026-85671.md): QAnything 2.0.0 Unauthenticated Cross-User File Disclosure (CVSS 8.7, netease-youdao QAnything)
- [CVE-2026-85670](https://cve.now/CVE-2026-85670.md): tokenizers BpeBuilder Buffer Overflow via merge token (CVSS 7.1, huggingface tokenizers)
- [CVE-2026-85669](https://cve.now/CVE-2026-85669.md): potpie through 2.0.0 Missing Ownership Check via code-changes sync (CVSS 7.1, potpie-ai potpie)
- [CVE-2026-85668](https://cve.now/CVE-2026-85668.md): Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register (CVSS 8.7, xorbitsai inference)
- [CVE-2026-85667](https://cve.now/CVE-2026-85667.md): xiaobei through 5.5.2 Unauthenticated Webhook Message Injection (CVSS 9.3, TeamWiseFlow xiaobei)
- [CVE-2026-85666](https://cve.now/CVE-2026-85666.md): ogx 1.3.1 Server-Side Request Forgery via MCP tool server\_url (CVSS 8.7, ogx-ai ogx)
- [CVE-2026-85665](https://cve.now/CVE-2026-85665.md): Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path (CVSS 7.1, usebruno bruno)
- [CVE-2026-85664](https://cve.now/CVE-2026-85664.md): Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion (CVSS 8.7, chroma-core chroma)
- [CVE-2026-85663](https://cve.now/CVE-2026-85663.md): Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch (CVSS 9.3, aimhubio aim)
- [CVE-2026-85662](https://cve.now/CVE-2026-85662.md): Marqo 2.26.0 Server-Side Request Forgery via Media URLs (CVSS 6.9, marqo-ai marqo)
- [CVE-2026-85661](https://cve.now/CVE-2026-85661.md): excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode (CVSS 9.3, haris-musa excel-mcp-server)
- [CVE-2026-85660](https://cve.now/CVE-2026-85660.md): cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution (CVSS 9.2, MladenSU cli-mcp-server)
- [CVE-2026-85651](https://cve.now/CVE-2026-85651.md): Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay (CVSS 8.4, triggerdotdev trigger.dev · trigger.dev)
- [CVE-2026-85650](https://cve.now/CVE-2026-85650.md): Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel (CVSS 5.3, triggerdotdev trigger.dev · trigger.dev)
- [CVE-2026-85626](https://cve.now/CVE-2026-85626.md): git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters (CVSS 8.7, cyanheads git-mcp-server)
- [CVE-2026-85625](https://cve.now/CVE-2026-85625.md): sift 17.1.3 Prototype Pollution Remote Code Execution via $where (CVSS 9.2, crcn sift.js)
- [CVE-2026-85624](https://cve.now/CVE-2026-85624.md): Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList (CVSS 7.1, blinkospace blinko)
- [CVE-2026-85623](https://cve.now/CVE-2026-85623.md): goose 1.37.0 Arbitrary Command Execution via Recipe Extensions (CVSS 8.7, aaif-goose goose)
- [CVE-2026-85622](https://cve.now/CVE-2026-85622.md): AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket (CVSS 6.0, AppFlowy-IO AppFlowy-Cloud)
- [CVE-2026-85621](https://cve.now/CVE-2026-85621.md): LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu (CVSS 6.9, lobehub)
- [CVE-2026-85620](https://cve.now/CVE-2026-85620.md): Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function (CVSS 9.2, crystaldba postgres-mcp)
- [CVE-2026-85619](https://cve.now/CVE-2026-85619.md): AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API (CVSS 7.7, AppFlowy-IO AppFlowy-Cloud)
- [CVE-2026-85618](https://cve.now/CVE-2026-85618.md): ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives (CVSS 7.1, C4illin ConvertX)
- [CVE-2026-85608](https://cve.now/CVE-2026-85608.md): Douyin\_TikTok\_Download\_API 4.1.2 SSRF via url parameter (CVSS 8.7, Evil0ctal Douyin\_TikTok\_Download\_API)
- [CVE-2026-85607](https://cve.now/CVE-2026-85607.md): Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router (CVSS 8.7, blinkospace blinko)
- [CVE-2026-85606](https://cve.now/CVE-2026-85606.md): firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath (CVSS 8.7, firecrawl-mcp-server)
- [CVE-2026-85605](https://cve.now/CVE-2026-85605.md): Slink before 1.12.3 Missing Authorization on Image Comment Endpoints (CVSS 6.9, andrii-kryvoviaz slink)
- [CVE-2026-82728](https://cve.now/CVE-2026-82728.md): Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS (CVSS 8.2, elixir-mint mint)
- [CVE-2026-82729](https://cve.now/CVE-2026-82729.md): Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS (CVSS 6.3, elixir-mint mint)
- [CVE-2026-14466](https://cve.now/CVE-2026-14466.md): Possible XSS in the SNS web administration panel (CVSS 4.3, Stormshield Network Security)
- [CVE-2026-9138](https://cve.now/CVE-2026-9138.md): Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-8447](https://cve.now/CVE-2026-8447.md): Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust (CVSS 6.1, IBM Langflow OSS)
- [CVE-2026-9186](https://cve.now/CVE-2026-9186.md): Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-19205](https://cve.now/CVE-2026-19205.md): User Enumeration in GastroMenum's GastroMenum Web Panel (CVSS 7.5, GastroMenum Web Panel)
- [CVE-2026-19727](https://cve.now/CVE-2026-19727.md): HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System (CVSS 6.1, Yordam Information Technology Consulting, Training and Elec…)
- [CVE-2026-19081](https://cve.now/CVE-2026-19081.md): Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System (CVSS 4.3, Gastromenum Ticket and QR Menu System)
- [CVE-2026-19057](https://cve.now/CVE-2026-19057.md): Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System (CVSS 5.4, Gastromenum Ticket and QR Menu System)
- [CVE-2026-85522](https://cve.now/CVE-2026-85522.md): valkey-io valkey Slot Migration cluster\_migrateslots.c createSlotImportJob out-of-bounds (CVSS 6.9, valkey-io valkey)
- [CVE-2026-77818](https://cve.now/CVE-2026-77818.md): Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System (CVSS 6.1, Yordam Information Technology Consulting, Training and Elec…)
- [CVE-2026-52691](https://cve.now/CVE-2026-52691.md): Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module (CVSS 8.8, Apache Software Foundation Apache Griffin Hive Metastore Mo…)
- [CVE-2026-85517](https://cve.now/CVE-2026-85517.md): code-projects Vehicle Management System SQL Database Backup File vehicle\_management.sql information disclosure (CVSS 6.9, code-projects Vehicle Management System)
- [CVE-2026-12483](https://cve.now/CVE-2026-12483.md): LearnDash LMS \<= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler (CVSS 7.5, StellarWP LearnDash LMS)
- [CVE-2026-85516](https://cve.now/CVE-2026-85516.md): code-projects Vehicle Management System busprofile.php sql injection (CVSS 6.9, code-projects Vehicle Management System)
- [CVE-2026-85649](https://cve.now/CVE-2026-85649.md): (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root u (CVSS 7.9, chewkeanho software-actualizer)
- [CVE-2026-85514](https://cve.now/CVE-2026-85514.md): StackStorm st2 API Key auth.py privileges management (CVSS 5.3, StackStorm st2)
- [CVE-2026-85513](https://cve.now/CVE-2026-85513.md): StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management (CVSS 5.3, StackStorm st2)
- [CVE-2026-74237](https://cve.now/CVE-2026-74237.md): GFI Exinda AI / ClearView \< 7.6.5 Argument Injection via Tools Iperf Client (CVSS 7.1, GFI Software GFI Exinda AI · GFI Software GFI ClearView)
- [CVE-2026-74236](https://cve.now/CVE-2026-74236.md): GFI Exinda AI / ClearView \< 7.6.5 Path Traversal via Diagnostic File Deletion Handler (CVSS 7.0, GFI Software GFI Exinda AI · GFI Software GFI ClearView)
- [CVE-2026-74235](https://cve.now/CVE-2026-74235.md): GFI Exinda AI / ClearView \< 7.6.5 Path Traversal via Configuration Download Handler (CVSS 6.9, GFI Software GFI Exinda AI · GFI Software GFI ClearView)
- [CVE-2026-82309](https://cve.now/CVE-2026-82309.md): Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries (CVSS 4.3, Robots-Validate)
- [CVE-2026-18198](https://cve.now/CVE-2026-18198.md): SQL Injection in TAC Information's GoldenHorn (CVSS 8.8, TAC Information Services Internal and External Trade GOLDEN…)
- [CVE-2026-19080](https://cve.now/CVE-2026-19080.md): Username Enumeration in Menulux Software's Menulux Portal (CVSS 7.5, Menulux Software Menulux Portal)
- [CVE-2026-19051](https://cve.now/CVE-2026-19051.md): Plaintext Storage of User Credentials in Menulux Software's Menulux Portal (CVSS 7.1, Menulux Software Menulux Portal)
- [CVE-2026-19043](https://cve.now/CVE-2026-19043.md): Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal (CVSS 4.3, Menulux Software Menulux Portal)
- [CVE-2026-18957](https://cve.now/CVE-2026-18957.md): Stored XSS in Menulux Software's Menulux Portal (CVSS 5.4, Menulux Software Menulux Portal)
- [CVE-2026-85617](https://cve.now/CVE-2026-85617.md): snipe-it before 8.6.3 Authorization Bypass via Bulk Delete (CVSS 8.7, grokability snipe-it)
- [CVE-2026-85616](https://cve.now/CVE-2026-85616.md): Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance (CVSS 8.4, grokability snipe-it)
- [CVE-2026-85615](https://cve.now/CVE-2026-85615.md): Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts (CVSS 5.3, Openpanel-dev openpanel)
- [CVE-2026-85614](https://cve.now/CVE-2026-85614.md): OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker (CVSS 9.2, Openpanel-dev openpanel)
- [CVE-2026-85613](https://cve.now/CVE-2026-85613.md): OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy (CVSS 8.4, Openpanel-dev openpanel)
- [CVE-2026-85612](https://cve.now/CVE-2026-85612.md): OpenPanel before 2.3.0 SSRF via favicon and og endpoints (CVSS 8.7, Openpanel-dev openpanel)
- [CVE-2026-85611](https://cve.now/CVE-2026-85611.md): OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures (CVSS 5.3, Openpanel-dev openpanel)
- [CVE-2026-85610](https://cve.now/CVE-2026-85610.md): OpenPanel before 2.3.0 Remote Code Execution via chart formulas (CVSS 8.7, Openpanel-dev openpanel)
- [CVE-2026-85609](https://cve.now/CVE-2026-85609.md): Openpanel before 2.3.0 SSRF via Site Checker Endpoint (CVSS 6.9, Openpanel-dev openpanel)
- [CVE-2026-85604](https://cve.now/CVE-2026-85604.md): Grav before 2.0.18 Remote Code Execution via sort filter (CVSS 8.7, getgrav grav)
- [CVE-2026-85603](https://cve.now/CVE-2026-85603.md): Grav Admin Plugin Path Traversal via Save As Language Code (CVSS 7.1, getgrav grav)
- [CVE-2026-85602](https://cve.now/CVE-2026-85602.md): Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass (CVSS 9.3, getgrav grav-plugin-form)
- [CVE-2026-85601](https://cve.now/CVE-2026-85601.md): Grav Admin before 2.0.20 Cross-Site Scripting via marked.js (CVSS 5.1, getgrav grav)
- [CVE-2026-85600](https://cve.now/CVE-2026-85600.md): Grav Admin before 2.0.21 Stored XSS via username (CVSS 5.1, getgrav grav-plugin-admin2)
- [CVE-2026-85599](https://cve.now/CVE-2026-85599.md): Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters (CVSS 5.1, getgrav grav-plugin-shortcode-core)
- [CVE-2026-85598](https://cve.now/CVE-2026-85598.md): Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages (CVSS 5.1, getgrav grav)
- [CVE-2026-85597](https://cve.now/CVE-2026-85597.md): Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict (CVSS 8.2, traefik)
- [CVE-2026-85596](https://cve.now/CVE-2026-85596.md): Traefik v3.7 Authentication Bypass via TLS Option Conflict (CVSS 8.2, traefik)
- [CVE-2026-85595](https://cve.now/CVE-2026-85595.md): Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth (CVSS 9.3, traefik)
- [CVE-2026-85594](https://cve.now/CVE-2026-85594.md): Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware (CVSS 7.0, traefik)
- [CVE-2026-85593](https://cve.now/CVE-2026-85593.md): phpMyFAQ before 4.1.8 Stored XSS via html\_entity\_decode (CVSS 5.1, thorsten phpMyFAQ)
- [CVE-2026-85592](https://cve.now/CVE-2026-85592.md): phpMyFAQ before 4.1.8 Authorization Bypass via question/create (CVSS 6.3, thorsten phpMyFAQ)
- [CVE-2026-85591](https://cve.now/CVE-2026-85591.md): phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-85590](https://cve.now/CVE-2026-85590.md): phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-85589](https://cve.now/CVE-2026-85589.md): phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API (CVSS 5.3, thorsten phpMyFAQ)
- [CVE-2026-85588](https://cve.now/CVE-2026-85588.md): phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export (CVSS 5.3, thorsten phpMyFAQ)
- [CVE-2026-85587](https://cve.now/CVE-2026-85587.md): phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages (CVSS 5.3, thorsten phpMyFAQ)
- [CVE-2026-85586](https://cve.now/CVE-2026-85586.md): phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter (CVSS 6.9, thorsten phpMyFAQ)
- [CVE-2026-85585](https://cve.now/CVE-2026-85585.md): SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-85584](https://cve.now/CVE-2026-85584.md): SiYuan before v3.8.2 Denial of Service via Auth Throttle (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-85583](https://cve.now/CVE-2026-85583.md): SiYuan before v3.8.2 Path Traversal via symlink in file API (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-85582](https://cve.now/CVE-2026-85582.md): SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-85581](https://cve.now/CVE-2026-85581.md): SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-85580](https://cve.now/CVE-2026-85580.md): SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-85579](https://cve.now/CVE-2026-85579.md): SiYuan before v3.8.2 Information Disclosure via undoState (CVSS 5.3, siyuan-note siyuan)
- [CVE-2026-85578](https://cve.now/CVE-2026-85578.md): SiYuan through 3.8.1 Authorization Bypass via getFile (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-85577](https://cve.now/CVE-2026-85577.md): AVideo userLogin.php Reflected XSS via error parameter (CVSS 5.3, WWBN AVideo)
- [CVE-2026-27347](https://cve.now/CVE-2026-27347.md): WordPress JetPopup plugin \<= 2.0.20.2 - Broken Access Control vulnerability (CVSS 5.3, Crocoblock JetPopup)
- [CVE-2026-84428](https://cve.now/CVE-2026-84428.md): fastify vulnerable to header validation bypass via incomplete schema case normalization (CVSS 7.5, fastify)
- [CVE-2026-85534](https://cve.now/CVE-2026-85534.md): Libsoup: libsoup: http/2 client crash in on\_data\_source\_read\_callback when settings initial\_window\_size shrinks during deferred body read (CVSS 5.9, Red Hat Enterprise Linux)
- [CVE-2026-4644](https://cve.now/CVE-2026-4644.md): Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover (CVSS 8.5, Google Cloud Integration Connectors)
- [CVE-2026-85512](https://cve.now/CVE-2026-85512.md): SourceCodester Class and Exam Timetabling System session.php authorization (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-79707](https://cve.now/CVE-2026-79707.md): Arbitrary File Read in Google Agent Development Kit (ADK) (CVSS 8.7, Google Cloud Agent Development Kit)
- [CVE-2026-84045](https://cve.now/CVE-2026-84045.md): E-cab Taxi Booking Manager for Woocommerce \< 2.0.5 - Unauthenticated Price Manipulation via mptbm\_add\_to\_cart (CVSS 5.3, E-cab Taxi Booking Manager for Woocommerce)
- [CVE-2026-84044](https://cve.now/CVE-2026-84044.md): Restaurant Menu and Food Ordering \< 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN (CVSS 5.3, Restaurant Menu and Food Ordering)
- [CVE-2026-84043](https://cve.now/CVE-2026-84043.md): ePayco Payment Gateway for WooCommerce \< 8.4.7 - Unauthenticated Payment Confirmation Bypass (CVSS 5.3, ePayco Payment Gateway for WooCommerce)
- [CVE-2026-82923](https://cve.now/CVE-2026-82923.md): AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes (CVSS 9.8, AI Website Builder)
- [CVE-2026-84469](https://cve.now/CVE-2026-84469.md): fastify vulnerable to request validation bypass via skipped boolean false schemas (CVSS 7.5, fastify)
- [CVE-2026-76169](https://cve.now/CVE-2026-76169.md): fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (CVSS 7.5, fastify)
- [CVE-2026-81666](https://cve.now/CVE-2026-81666.md): Corosync: corosync: integer overflow in check\_memb\_commit\_token\_sanity may bypass message length validation on 32-bit systems (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-13148](https://cve.now/CVE-2026-13148.md): Memory leak in scan method (CVSS 6.3, Softing smartLink HW-PN)
- [CVE-2026-85547](https://cve.now/CVE-2026-85547.md): Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP (CVSS 6.2, misp)
- [CVE-2026-84504](https://cve.now/CVE-2026-84504.md): fastify vulnerable to request body replacement via an async validation result collision (CVSS 8.1, fastify)
- [CVE-2026-85541](https://cve.now/CVE-2026-85541.md): Interinfo｜DreamMaker - Reflected Cross-site Scripting (CVSS 4.8, Interinfo DreamMaker)
- [CVE-2026-85540](https://cve.now/CVE-2026-85540.md): Interinfo｜DreamMaker - SQL Injection (CVSS 8.7, Interinfo DreamMaker)
- [CVE-2026-85546](https://cve.now/CVE-2026-85546.md): MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests (CVSS 8.6, misp)
- [CVE-2026-27086](https://cve.now/CVE-2026-27086.md): WordPress WoodMart theme \< 8.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xtemos WoodMart)
- [CVE-2026-85184](https://cve.now/CVE-2026-85184.md): @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target (CVSS 9.1, @fastify/middie)
- [CVE-2026-85538](https://cve.now/CVE-2026-85538.md): MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes (CVSS 8.3, misp)
- [CVE-2026-81665](https://cve.now/CVE-2026-81665.md): Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-81302](https://cve.now/CVE-2026-81302.md): PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code wi (CVSS 7.8, JAL Digital Co. PALLET CONTROL · JAL Digital Co. PalletCont…)
- [CVE-2026-85533](https://cve.now/CVE-2026-85533.md): MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter (CVSS 7.6, misp)
- [CVE-2026-27432](https://cve.now/CVE-2026-27432.md): WordPress WP Rentals theme \< 3.16.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, sc Internet Vivoo WP Rentals)
- [CVE-2026-85528](https://cve.now/CVE-2026-85528.md): Snowflake JDBC Driver auto-configuration account validation permits credential redirection (CVSS 5.3, Snowflake JDBC Driver)
- [CVE-2026-15937](https://cve.now/CVE-2026-15937.md): Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint (CVSS 5.3, Checkmk)
- [CVE-2026-85525](https://cve.now/CVE-2026-85525.md): Improper OCSP response validation in Snowflake drivers (CVSS 7.4, Snowflake Connector for Python · Snowflake Go Driver +2)
- [CVE-2026-57777](https://cve.now/CVE-2026-57777.md): WordPress WooCommerce plugin \< 11.0 - SQL Injection vulnerability (CVSS 7.6, Automattic WooCommerce)
- [CVE-2026-85311](https://cve.now/CVE-2026-85311.md): WordPress MarketKing plugin \<= 2.1.60 - Broken Access Control vulnerability (CVSS 5.3, Kings Plugins MarketKing)
- [CVE-2026-32480](https://cve.now/CVE-2026-32480.md): WordPress WCFM Membership plugin \<= 2.11.11 - Broken Access Control vulnerability (CVSS 5.3, WC Lovers WCFM Membership)
- [CVE-2026-85197](https://cve.now/CVE-2026-85197.md): Libsoup: libsoup: heap use-after-free in libsoup http/2 client on\_data\_read() via goaway during body upload (CVSS 7.6, Red Hat Enterprise Linux)
- [CVE-2026-6217](https://cve.now/CVE-2026-6217.md): Information Disclosure in Pik Online Software's Portal (CVSS 6.3, Pik Online Software Solutions Pik Online Portal)
- [CVE-2026-80190](https://cve.now/CVE-2026-80190.md): Apache Allura: Stored XSS via code repositories (CVSS 6.1, Apache Software Foundation Apache Allura)
- [CVE-2026-85229](https://cve.now/CVE-2026-85229.md): Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057) (CVSS 6.1, Apache Software Foundation Apache SkyWalking)
- [CVE-2026-81270](https://cve.now/CVE-2026-81270.md): Apache Allura: Information exposure via search (CVSS 7.5, Apache Software Foundation Apache Allura)
- [CVE-2026-71216](https://cve.now/CVE-2026-71216.md): Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP (CVSS 5.3, Apache Software Foundation Apache SkyWalking)
- [CVE-2026-80181](https://cve.now/CVE-2026-80181.md): Apache Allura: Server-side request forgery (CVSS 9.1, Apache Software Foundation Apache Allura)
- [CVE-2026-80180](https://cve.now/CVE-2026-80180.md): Apache Allura: Stored XSS via markdown HTML processing (CVSS 6.1, Apache Software Foundation Apache Allura)
- [CVE-2026-70403](https://cve.now/CVE-2026-70403.md): XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). (CVSS 9.8, XING CPTrans-ME-X)
- [CVE-2026-69657](https://cve.now/CVE-2026-69657.md): XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). (CVSS 9.8, XING CPTrans-ME-X)
- [CVE-2026-66840](https://cve.now/CVE-2026-66840.md): XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). (CVSS 7.5, XING CPTrans-ME-X)
- [CVE-2026-62928](https://cve.now/CVE-2026-62928.md): XING CPTrans-ME-X contains an OS Command Injection (CWE-78). (CVSS 9.8, XING CPTrans-ME-X)
- [CVE-2026-85094](https://cve.now/CVE-2026-85094.md): The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. (CVSS 8.8, Canva)
- [CVE-2026-85085](https://cve.now/CVE-2026-85085.md): The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. (CVSS 9.6, Canva)
- [CVE-2026-84146](https://cve.now/CVE-2026-84146.md): Xpro Elementor Addons \< 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View (CVSS 5.3, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-84066](https://cve.now/CVE-2026-84066.md): Directorist \< 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp\_post\_attachment\_upload (CVSS 3.1, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-82194](https://cve.now/CVE-2026-82194.md): WPvivid Backup & Migration \< 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal (CVSS 5.5, WPvivid — Backup, Migration & Staging)
- [CVE-2026-82193](https://cve.now/CVE-2026-82193.md): WPvivid Backup & Migration \< 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal (CVSS 5.5, WPvivid — Backup, Migration & Staging)
- [CVE-2026-82186](https://cve.now/CVE-2026-82186.md): WPLP Cookie Consent \< 4.4.2 - Admin+ SQLi via 'offset' Parameter (CVSS 4.1, WPLP Cookie Consent)
- [CVE-2026-81347](https://cve.now/CVE-2026-81347.md): Frontend Admin by DynamiApps \< 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal (CVSS 5.9, Frontend Admin by DynamiApps)
- [CVE-2026-80438](https://cve.now/CVE-2026-80438.md): Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API (CVSS 5.9, Ninja Forms)
- [CVE-2026-79632](https://cve.now/CVE-2026-79632.md): WPFunnels \< 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl\_shortcode\_optin\_submission (CVSS 5.3, WPFunnels)
- [CVE-2026-79631](https://cve.now/CVE-2026-79631.md): WPFunnels \< 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files (CVSS 5.3, WPFunnels)
- [CVE-2026-79630](https://cve.now/CVE-2026-79630.md): WPFunnels \< 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution (CVSS 5.3, WPFunnels)
- [CVE-2026-74853](https://cve.now/CVE-2026-74853.md): Pods \< 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback (CVSS 6.8, Pods)
- [CVE-2026-19224](https://cve.now/CVE-2026-19224.md): Hummingbird \< 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite (CVSS 7.2, Hummingbird Performance)
- [CVE-2026-17517](https://cve.now/CVE-2026-17517.md): Content Views \< 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter (CVSS 5.3, Content Views)
- [CVE-2026-16281](https://cve.now/CVE-2026-16281.md): Classified Listing \< 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR (CVSS 7.1, Classified Listing)
- [CVE-2025-15691](https://cve.now/CVE-2025-15691.md): WPFunnels \< 3.13.0 - Unauthenticated User Registration via Opt-in Forms (CVSS 5.3, WPFunnels)
- [CVE-2026-85409](https://cve.now/CVE-2026-85409.md): Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal (CVSS 5.3, Eleveo Quality Management)
- [CVE-2026-11613](https://cve.now/CVE-2026-11613.md): Divi Ajax Filter \<= 5.1.2 - Unauthenticated Local File Inclusion via 'custom\_loop\_template' Parameter (CVSS 9.8, Divi Engine Divi Ajax Filter)
- [CVE-2026-85509](https://cve.now/CVE-2026-85509.md): FreeIPMI before 1.6.19 has a stack-based buffer overflow in \_read\_fru\_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than (CVSS 9.8, FreeIPMI)
- [CVE-2026-85508](https://cve.now/CVE-2026-85508.md): ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in \_output\_dell\_system\_info\_cmc\_ipv6\_info in ipmi-oem/ipmi-oem-dell.c ( (CVSS 9.8, FreeIPMI)
- [CVE-2026-85507](https://cve.now/CVE-2026-85507.md): ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in \_output\_dell\_system\_info\_cmc\_info in ipmi-oem/ipmi-oem-dell.c (cmc-i (CVSS 9.8, FreeIPMI)
- [CVE-2026-85506](https://cve.now/CVE-2026-85506.md): ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in \_get\_dell\_system\_info\_idrac\_info in ipmi-oem/ipmi-oem-dell.c (idrac- (CVSS 9.8, FreeIPMI)
- [CVE-2026-85505](https://cve.now/CVE-2026-85505.md): ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi\_oem\_fujitsu\_get\_sel\_entry\_long\_text in ipmi-oem/ipmi-oem-fujit (CVSS 7.5, FreeIPMI)
- [CVE-2026-85408](https://cve.now/CVE-2026-85408.md): Eleveo Quality Management Conversation events dynamically-determined object attributes (CVSS 5.3, Eleveo Quality Management)
- [CVE-2026-85504](https://cve.now/CVE-2026-85504.md): FreeIPMI before 1.6.19 has a stack-based buffer overflow in \_ipmi\_sel\_oem\_fujitsu\_get\_sel\_entry\_long\_text in libfreeipmi/sel/ipmi-sel-string (CVSS 9.8, FreeIPMI)
- [CVE-2026-85407](https://cve.now/CVE-2026-85407.md): Eleveo Quality Management Conversation events denial of service (CVSS 5.3, Eleveo Quality Management)
- [CVE-2026-85406](https://cve.now/CVE-2026-85406.md): Eleveo Quality Management Conversation Review cross site scripting (CVSS 5.1, Eleveo Quality Management)
- [CVE-2026-85405](https://cve.now/CVE-2026-85405.md): Eleveo Call Recording Software roleAddAction.do cross site scripting (CVSS 5.1, Eleveo Call Recording Software)
- [CVE-2026-85403](https://cve.now/CVE-2026-85403.md): code-projects Doctor Appointment System contactus.php sql injection (CVSS 6.9, code-projects Doctor Appointment System)
- [CVE-2026-85402](https://cve.now/CVE-2026-85402.md): code-projects Doctor Appointment System booking.php sql injection (CVSS 6.9, code-projects Doctor Appointment System)
- [CVE-2026-85401](https://cve.now/CVE-2026-85401.md): Dolibarr Legacy File Manager config.inc.php access control (CVSS 5.3, Dolibarr)
- [CVE-2026-85149](https://cve.now/CVE-2026-85149.md): Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials (CVSS 6.9, Lightstar SmartIT Desktop Manager)
- [CVE-2026-85148](https://cve.now/CVE-2026-85148.md): Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials (CVSS 9.3, Lightstar SmartIT Desktop Manager)
- [CVE-2026-85147](https://cve.now/CVE-2026-85147.md): Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials (CVSS 8.7, Lightstar SmartIT Desktop Manager)
- [CVE-2026-85146](https://cve.now/CVE-2026-85146.md): Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials (CVSS 9.3, Lightstar SmartIT Desktop Manager)
- [CVE-2026-85399](https://cve.now/CVE-2026-85399.md): code-projects Hospital Information System PrespController.php getSinglePresp sql injection (CVSS 6.9, code-projects Hospital Information System)
- [CVE-2026-85398](https://cve.now/CVE-2026-85398.md): code-projects Hospital Information System viewReq.php viewReq sql injection (CVSS 6.9, code-projects Hospital Information System)
- [CVE-2026-75754](https://cve.now/CVE-2026-75754.md): Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center a (CVSS 10.0, ASUS Control Center Enterprise)
- [CVE-2026-85397](https://cve.now/CVE-2026-85397.md): code-projects Hospital Information System addReq.php findBySearch sql injection (CVSS 6.9, code-projects Hospital Information System)
- [CVE-2026-45197](https://cve.now/CVE-2026-45197.md): GPU DDK - TOCTOU affecting psFWMemContext-\>uiPageCatBaseRegSet (CVSS 2.5, Imagination Technologies Graphics DDK)
- [CVE-2026-45200](https://cve.now/CVE-2026-45200.md): GPU DDK - Double free in \_FreeOSPages due to incorrect allocation flag set by \_EncodeAllocationFlags (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2026-85383](https://cve.now/CVE-2026-85383.md): itsourcecode Sales and Inventory System inv\_del.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-85382](https://cve.now/CVE-2026-85382.md): light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars\_decode cross site scripting (CVSS 5.3, light0011 cms)
- [CVE-2026-85381](https://cve.now/CVE-2026-85381.md): light0011 cms Chapter Controller ChapterController.class.php authorization (CVSS 6.9, light0011 cms)
- [CVE-2026-85380](https://cve.now/CVE-2026-85380.md): light0011 cms UEditor controller.php catchimage server-side request forgery (CVSS 6.9, light0011 cms)
- [CVE-2026-85379](https://cve.now/CVE-2026-85379.md): light0011 cms Query Builder ChapterController.class.php searchChapter sql injection (CVSS 6.9, light0011 cms)
- [CVE-2021-44319](https://cve.now/CVE-2021-44319.md): Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. (CVSS 7.5)
- [CVE-2021-44320](https://cve.now/CVE-2021-44320.md): Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. (CVSS 7.5)
- [CVE-2022-26961](https://cve.now/CVE-2022-26961.md): Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP\_IBCF-NATUP-01/NMSCI-WebGui/backup\_restore.jsp and NP\_IBCF-MIBER-03/NMS (CVSS 5.4)
- [CVE-2022-35497](https://cve.now/CVE-2022-35497.md): In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via re (CVSS 5.4)
- [CVE-2022-35499](https://cve.now/CVE-2022-35499.md): In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary p (CVSS 7.1)
- [CVE-2025-67066](https://cve.now/CVE-2025-67066.md): SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the / (CVSS 9.8)
- [CVE-2026-31020](https://cve.now/CVE-2026-31020.md): In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot (CVSS 9.8)
- [CVE-2026-38961](https://cve.now/CVE-2026-38961.md): Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) (CVSS 5.4)
- [CVE-2026-50894](https://cve.now/CVE-2026-50894.md): easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows auth (CVSS 9.8)
- [CVE-2026-71620](https://cve.now/CVE-2026-71620.md): File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file (CVSS 8.1)
- [CVE-2026-71622](https://cve.now/CVE-2026-71622.md): SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php compon (CVSS 7.4)
- [CVE-2026-71624](https://cve.now/CVE-2026-71624.md): An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controlle (CVSS 9.8)
- [CVE-2026-71625](https://cve.now/CVE-2026-71625.md): An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component (CVSS 9.8)
- [CVE-2026-71626](https://cve.now/CVE-2026-71626.md): An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRe (CVSS 7.5)
- [CVE-2026-75160](https://cve.now/CVE-2026-75160.md): An issue in X-Serie Gateway Firmware V6\_00\_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi (CVSS 9.1)
- [CVE-2026-75161](https://cve.now/CVE-2026-75161.md): An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6\_00\_05 allows a remote authenticated u (CVSS 8.8)
- [CVE-2026-75162](https://cve.now/CVE-2026-75162.md): An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V (CVSS 6.5)
- [CVE-2026-75163](https://cve.now/CVE-2026-75163.md): An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6\_00\_ (CVSS 6.5)
- [CVE-2026-75164](https://cve.now/CVE-2026-75164.md): An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6\_00\_05 allows a remote authenti (CVSS 6.5)
- [CVE-2026-75165](https://cve.now/CVE-2026-75165.md): An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6\_00\_05 allows a remote authenticated user with the low-privilege (CVSS 6.5)
- [CVE-2026-75166](https://cve.now/CVE-2026-75166.md): Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6\_00\_05 allows the low-privileged service user to execute /usr/ (CVSS 8.8)
- [CVE-2026-75167](https://cve.now/CVE-2026-75167.md): A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6\_00\_05 a (CVSS 4.3)
- [CVE-2026-75168](https://cve.now/CVE-2026-75168.md): An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6\_00\_05 allows a remote authenticated (CVSS 6.3)
- [CVE-2026-75169](https://cve.now/CVE-2026-75169.md): An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6\_00\_05 allows a remote authenti (CVSS 8.8)
- [CVE-2026-75170](https://cve.now/CVE-2026-75170.md): Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote u (CVSS 6.1)
- [CVE-2026-75171](https://cve.now/CVE-2026-75171.md): An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. (CVSS 9.8)
- [CVE-2026-75429](https://cve.now/CVE-2026-75429.md): PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Se (CVSS 9.8)
- [CVE-2026-75430](https://cve.now/CVE-2026-75430.md): PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the (CVSS 9.8)
- [CVE-2026-75431](https://cve.now/CVE-2026-75431.md): PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. (CVSS 9.1)
- [CVE-2026-75438](https://cve.now/CVE-2026-75438.md): Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs\_sbi\_time\_parse() function (CVSS 7.5)
- [CVE-2026-75439](https://cve.now/CVE-2026-75439.md): An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component (CVSS 7.5)
- [CVE-2026-78745](https://cve.now/CVE-2026-78745.md): An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E\_DMO allows a remote attacker to execute arbitrary code via the Android Debug Br (CVSS 9.8)
- [CVE-2026-78839](https://cve.now/CVE-2026-78839.md): An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar fil (CVSS 8.1)
- [CVE-2026-78849](https://cve.now/CVE-2026-78849.md): Cross Site Scripting vulnerability in Netgate pfSense Plus software versions \<= 26.03 pfSense CE software versions \<= 2.8.1 allows a remote (CVSS 5.4)
- [CVE-2026-78970](https://cve.now/CVE-2026-78970.md): JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. (CVSS 6.5)
- [CVE-2026-79389](https://cve.now/CVE-2026-79389.md): Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. (CVSS 7.4)
- [CVE-2026-79390](https://cve.now/CVE-2026-79390.md): Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1 (CVSS 7.5)
- [CVE-2026-79391](https://cve.now/CVE-2026-79391.md): No authentication exists in the MQTT service of Trueview 6.0.23.4. (CVSS 9.8)
- [CVE-2026-79418](https://cve.now/CVE-2026-79418.md): EMX Tecnologia Gestao X version \<= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. (CVSS 8.7)
- [CVE-2026-79419](https://cve.now/CVE-2026-79419.md): A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. (CVSS 8.7)
- [CVE-2026-79423](https://cve.now/CVE-2026-79423.md): An authenticated remote code execution (RCE) vulnerability in the admin\_config.php component of seacms v13.6 allows attackers to execute arb (CVSS 8.8)
- [CVE-2026-79426](https://cve.now/CVE-2026-79426.md): An arbitrary file deletion vulnerability in the /adminapi/file/video\_data\_save component of CRMEB v6.0.0 allows authenticated attackers to d (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.