# CVEs published 2026-09-10

384 CVEs were published on September 10, 2026: 63 critical, 174 high. Days are UTC.

- [CVE-2026-84941](https://cve.now/CVE-2026-84941.md): Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read (CVSS 6.9, TP-Link Systems Omada Software Controller · TP-Link Syst… +4)
- [CVE-2026-77807](https://cve.now/CVE-2026-77807.md): AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress \<= 11.0.4 - Unauthenticated Arbitrary File Read via 'user\[name\]' Parameter (CVSS 7.5, acyba AcyMailing – An Ultimate Newsletter Plugin and Market…)
- [CVE-2026-81906](https://cve.now/CVE-2026-81906.md): \[UNREVIEWED\] OAuth Callback Login Bypasses Deactivated-Account Checks (CVSS 6.3, Concrete CMS)
- [CVE-2026-81905](https://cve.now/CVE-2026-81905.md): Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another. (CVSS 6.3, Concrete CMS)
- [CVE-2026-17176](https://cve.now/CVE-2026-17176.md): OS Command Injection Vulnerability in Deco Devices (CVSS 7.7, TP-Link Systems Deco BE11000 · TP-Link Systems Deco M9 Plus)
- [CVE-2026-18121](https://cve.now/CVE-2026-18121.md): Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view\_event/{bID}/{occurrence\_id}). (CVSS 6.3, Concrete CMS)
- [CVE-2026-16174](https://cve.now/CVE-2026-16174.md): Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow (CVSS 8.7, Netskope Endpoint DLP)
- [CVE-2026-16172](https://cve.now/CVE-2026-16172.md): Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash (CVSS 6.0, Netskope Endpoint DLP)
- [CVE-2026-2310](https://cve.now/CVE-2026-2310.md): IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data (CVSS 7.8, IBM webMethods Integration Server)
- [CVE-2026-19646](https://cve.now/CVE-2026-19646.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 9.1, IBM Common Licensing)
- [CVE-2026-49838](https://cve.now/CVE-2026-49838.md): GoBGP confederation validation panics on empty AS\_PATH attribute (CVSS 5.9, osrg gobgp · github.com/osrg/gobgp/v4)
- [CVE-2026-49837](https://cve.now/CVE-2026-49837.md): GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (CVSS 5.9, osrg gobgp · github.com/osrg/gobgp/v4)
- [CVE-2026-54054](https://cve.now/CVE-2026-54054.md): Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects (CVSS 6.5, transmute-app transmute)
- [CVE-2026-49836](https://cve.now/CVE-2026-49836.md): psd-tools: arbitrary file write via smart-object filename (CVSS 4.6, psd-tools)
- [CVE-2026-75624](https://cve.now/CVE-2026-75624.md): IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service (CVSS 8.8, IBM App Connect Enterprise)
- [CVE-2026-75777](https://cve.now/CVE-2026-75777.md): Multiple vulnerabilities in IBM Aspera Enterprise Webapps (CVSS 8.8, IBM Aspera Enterprise WebApps)
- [CVE-2026-76059](https://cve.now/CVE-2026-76059.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-78569](https://cve.now/CVE-2026-78569.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-78571](https://cve.now/CVE-2026-78571.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-78573](https://cve.now/CVE-2026-78573.md): IBM ContextForge MCP Gateway is affected by use of default credentials (CVSS 9.8, IBM ContextForge MCP Gateway)
- [CVE-2026-45770](https://cve.now/CVE-2026-45770.md): Suricata lua: excessive flow variable registration can bypass sandbox (CVSS 7.5, OISF suricata)
- [CVE-2026-78575](https://cve.now/CVE-2026-78575.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-79723](https://cve.now/CVE-2026-79723.md): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (CVSS 5.0, IBM Langflow OSS)
- [CVE-2026-79724](https://cve.now/CVE-2026-79724.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-79725](https://cve.now/CVE-2026-79725.md): Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-79742](https://cve.now/CVE-2026-79742.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-80378](https://cve.now/CVE-2026-80378.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.5, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-80380](https://cve.now/CVE-2026-80380.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 7.1, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-45769](https://cve.now/CVE-2026-45769.md): ikev2: unbounded client transform storage can lead to resource exhaustion (CVSS 7.5, OISF suricata)
- [CVE-2026-80434](https://cve.now/CVE-2026-80434.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 7.4, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-80424](https://cve.now/CVE-2026-80424.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 9.1, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-45768](https://cve.now/CVE-2026-45768.md): Suricata ldap: unbounded responses per transaction can lead to resource exhaustion (CVSS 7.5, OISF suricata)
- [CVE-2026-80436](https://cve.now/CVE-2026-80436.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.5, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81204](https://cve.now/CVE-2026-81204.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-81207](https://cve.now/CVE-2026-81207.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.5, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81210](https://cve.now/CVE-2026-81210.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 7.7, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81211](https://cve.now/CVE-2026-81211.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-81941](https://cve.now/CVE-2026-81941.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-81213](https://cve.now/CVE-2026-81213.md): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (CVSS 8.6, IBM Langflow OSS)
- [CVE-2026-81265](https://cve.now/CVE-2026-81265.md): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-81268](https://cve.now/CVE-2026-81268.md): Langflow is vulnerable to authentication bypass and insufficient session expiration (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-45767](https://cve.now/CVE-2026-45767.md): Suricata datasets: save to absolute filename can be bypassed when combined with load command (CVSS 4.4, OISF suricata)
- [CVE-2026-81540](https://cve.now/CVE-2026-81540.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.5, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81550](https://cve.now/CVE-2026-81550.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81551](https://cve.now/CVE-2026-81551.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81554](https://cve.now/CVE-2026-81554.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-81940](https://cve.now/CVE-2026-81940.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-82092](https://cve.now/CVE-2026-82092.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82095](https://cve.now/CVE-2026-82095.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82097](https://cve.now/CVE-2026-82097.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-45766](https://cve.now/CVE-2026-45766.md): Suricata nfs: unbounded stateful structures can lead to resource exhaustion (CVSS 7.5, OISF suricata)
- [CVE-2026-82098](https://cve.now/CVE-2026-82098.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82099](https://cve.now/CVE-2026-82099.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82100](https://cve.now/CVE-2026-82100.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 9.6, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-82107](https://cve.now/CVE-2026-82107.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 9.6, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-45765](https://cve.now/CVE-2026-45765.md): Suricata dnp3: unbounded reassembly can lead to resource exhaustion (CVSS 7.5, OISF suricata)
- [CVE-2026-84889](https://cve.now/CVE-2026-84889.md): A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem (CVSS 8.8, IBM Langflow OSS)
- [CVE-2026-86087](https://cve.now/CVE-2026-86087.md): IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system (CVSS 4.3, IBM Db2)
- [CVE-2026-86093](https://cve.now/CVE-2026-86093.md): IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions (CVSS 7.5, IBM Db2)
- [CVE-2026-87958](https://cve.now/CVE-2026-87958.md): IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions (CVSS 8.1, IBM Db2)
- [CVE-2026-45764](https://cve.now/CVE-2026-45764.md): Suricata http2: protocol-change type confusion can lead to denial of service (CVSS 9.1, OISF suricata)
- [CVE-2026-45762](https://cve.now/CVE-2026-45762.md): Suricata defrag: missing address-family check can lead to remote crash (CVSS 7.5, OISF suricata)
- [CVE-2026-45761](https://cve.now/CVE-2026-45761.md): Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load (CVSS 3.3, OISF suricata)
- [CVE-2026-45759](https://cve.now/CVE-2026-45759.md): Suricata http1: quadratic Content-Disposition processing can lead to denial of service (CVSS 7.5, OISF suricata)
- [CVE-2026-11813](https://cve.now/CVE-2026-11813.md): A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated us (CVSS 8.5, Lenovo FileZ Client · Lenovo FileZ Enterprise)
- [CVE-2026-18994](https://cve.now/CVE-2026-18994.md): A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the (CVSS 8.4, Lenovo File Manager Application)
- [CVE-2026-19136](https://cve.now/CVE-2026-19136.md): A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese marke (CVSS 8.4, Lenovo Tianxi AI Agent PC Application)
- [CVE-2026-63427](https://cve.now/CVE-2026-63427.md): An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrar (CVSS 8.5, Lenovo Software Fix)
- [CVE-2026-75940](https://cve.now/CVE-2026-75940.md): A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attack (CVSS 9.3, Lenovo Health Application)
- [CVE-2026-85025](https://cve.now/CVE-2026-85025.md): Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-9667](https://cve.now/CVE-2026-9667.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2026-9176](https://cve.now/CVE-2026-9176.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.7, IBM WebSphere Application Server)
- [CVE-2026-9225](https://cve.now/CVE-2026-9225.md): Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-9327](https://cve.now/CVE-2026-9327.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.3, IBM WebSphere Application Server)
- [CVE-2026-89094](https://cve.now/CVE-2026-89094.md): Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templat (CVSS 9.9, Forgejo)
- [CVE-2026-3096](https://cve.now/CVE-2026-3096.md): Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft (CVSS 4.7, WSO2 API Control Plane · WSO2 API Manager)
- [CVE-2026-45752](https://cve.now/CVE-2026-45752.md): Suricata detect/transform: use-after-free in decompress transforms (CVSS 5.9, OISF suricata)
- [CVE-2026-89089](https://cve.now/CVE-2026-89089.md): OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE\_FORMAT parameter (ROLE\_USER) (CVSS 6.5, The OpenNMS Group Meridian · The OpenNMS Group Horizon)
- [CVE-2026-45751](https://cve.now/CVE-2026-45751.md): Suricata detect/transform: use-after-free in dotprefix transform (CVSS 5.9, OISF suricata)
- [CVE-2026-76652](https://cve.now/CVE-2026-76652.md): Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600 (CVSS 4.8, TP-Link Systems TL-MR6400 · TP-Link Systems Archer MR600)
- [CVE-2026-76653](https://cve.now/CVE-2026-76653.md): Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600 (CVSS 5.3, TP-Link Systems TL-MR6400 · TP-Link Systems Archer MR600)
- [CVE-2026-19596](https://cve.now/CVE-2026-19596.md): OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host (CVSS 5.9, The OpenNMS Group Meridian · The OpenNMS Group Horizon)
- [CVE-2026-89011](https://cve.now/CVE-2026-89011.md): isomorphic-git \< 1.42.0 Prototype Pollution via getRemoteInfo (CVSS 7.1, isomorphic-git)
- [CVE-2026-89087](https://cve.now/CVE-2026-89087.md): The cstruct package before 6.3.0 for OCaml mishandles indexes. (CVSS 7.3, OCaml cstruct)
- [CVE-2026-89086](https://cve.now/CVE-2026-89086.md): In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and pro (CVSS 9.1, OCaml jose)
- [CVE-2026-89054](https://cve.now/CVE-2026-89054.md): OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes (CVSS 8.2, The OpenNMS Group Horizon)
- [CVE-2026-84432](https://cve.now/CVE-2026-84432.md): Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller (CVSS 5.3, Concrete CMS)
- [CVE-2026-88062](https://cve.now/CVE-2026-88062.md): OmniRoute ACP Custom-Agent Remote Code Execution (RCE) (CVSS 9.5, diegosouzapw OmniRoute · omniroute)
- [CVE-2026-88061](https://cve.now/CVE-2026-88061.md): career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution (CVSS 5.8, santifer career-ops)
- [CVE-2026-88060](https://cve.now/CVE-2026-88060.md): Angular: SSR XSS via Unescaped \<template\> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements (CVSS 8.6, angular · @angular/platform-server)
- [CVE-2026-88059](https://cve.now/CVE-2026-88059.md): Angular: Information Leak via \`HttpTransferCache\` Bypass When Using \`withRequestsMadeViaParent\` (CVSS 4.0, angular · @angular/common)
- [CVE-2026-87993](https://cve.now/CVE-2026-87993.md): Consul-template vulnerable to an information disclosure issue in error handling (CVSS 7.7, HashiCorp Tooling)
- [CVE-2026-88021](https://cve.now/CVE-2026-88021.md): Consul vulnerable to an authorization bypass in the Connect service mesh (CVSS 7.5, HashiCorp Consul)
- [CVE-2026-87107](https://cve.now/CVE-2026-87107.md): Consul vulnerable to an authorization bypass in the catalog deregistration path (CVSS 5.4, HashiCorp Consul)
- [CVE-2026-88058](https://cve.now/CVE-2026-88058.md): Angular: SSR XSS via Unescaped Processing Instruction (\<?...?\>) Nodes in Fallback Raw-Content Elements (CVSS 8.6, angular · @angular/platform-server)
- [CVE-2026-87106](https://cve.now/CVE-2026-87106.md): Consul vulnerable to a denial of service in the native RPC listener (CVSS 6.5, HashiCorp Consul)
- [CVE-2026-87090](https://cve.now/CVE-2026-87090.md): Consul vulnerable to an authorization bypass in the catalog node-write path (CVSS 8.3, HashiCorp Consul)
- [CVE-2026-88057](https://cve.now/CVE-2026-88057.md): Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler (CVSS 5.3, angular · @angular/core +1)
- [CVE-2026-9336](https://cve.now/CVE-2026-9336.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-9338](https://cve.now/CVE-2026-9338.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2026-88056](https://cve.now/CVE-2026-88056.md): Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR (CVSS 8.6, angular · @angular/platform-server)
- [CVE-2026-89049](https://cve.now/CVE-2026-89049.md): Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent (CVSS 9.9, AWS Amazon SSM Agent)
- [CVE-2026-68527](https://cve.now/CVE-2026-68527.md): Concrete CMS 8.3.0 through 9.5.2 is vulnerable to an authorization bypass through user-controlled key (cross-calendar IDOR) in the Calendar event edit dialog (CVSS 5.9, Concrete CMS)
- [CVE-2026-88036](https://cve.now/CVE-2026-88036.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver (CVSS 6.1, MongoDB C Driver)
- [CVE-2026-88035](https://cve.now/CVE-2026-88035.md): Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver (CVSS 5.7, MongoDB C Driver)
- [CVE-2026-88034](https://cve.now/CVE-2026-88034.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver (CVSS 6.1, MongoDB C++ Driver)
- [CVE-2026-88033](https://cve.now/CVE-2026-88033.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver (CVSS 6.1, MongoDB Java Driver)
- [CVE-2026-88032](https://cve.now/CVE-2026-88032.md): Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver (CVSS 8.2, MongoDB Java Driver · org.mongodb:mongodb-crypt Maven pa… +1)
- [CVE-2026-88031](https://cve.now/CVE-2026-88031.md): GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver (CVSS 6.1, MongoDB Go Driver)
- [CVE-2026-88030](https://cve.now/CVE-2026-88030.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver (CVSS 6.1, MongoDB Ruby Driver)
- [CVE-2026-88029](https://cve.now/CVE-2026-88029.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver (CVSS 6.1, MongoDB Python Driver · pymongo)
- [CVE-2026-88028](https://cve.now/CVE-2026-88028.md): Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel (CVSS 7.1, Laravel MongoDB)
- [CVE-2026-88055](https://cve.now/CVE-2026-88055.md): AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator (CVSS 5.5, Mintplex-Labs anything-llm)
- [CVE-2026-88027](https://cve.now/CVE-2026-88027.md): Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel (CVSS 7.1, Laravel MongoDB)
- [CVE-2026-88026](https://cve.now/CVE-2026-88026.md): Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver (CVSS 7.1, MongoDB C# Driver)
- [CVE-2026-88025](https://cve.now/CVE-2026-88025.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver (CVSS 6.1, MongoDB C# Driver)
- [CVE-2026-88024](https://cve.now/CVE-2026-88024.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver (CVSS 6.1, MongoDB Rust Driver)
- [CVE-2026-88023](https://cve.now/CVE-2026-88023.md): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library (CVSS 6.1, MongoDB PHP Library · mongodb/mongodb)
- [CVE-2026-88054](https://cve.now/CVE-2026-88054.md): Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load (CVSS 6.9, tesseract-ocr tesseract)
- [CVE-2026-89046](https://cve.now/CVE-2026-89046.md): zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset (CVSS 8.8, luben zstd-jni)
- [CVE-2026-89045](https://cve.now/CVE-2026-89045.md): zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length (CVSS 5.1, luben zstd-jni)
- [CVE-2026-89044](https://cve.now/CVE-2026-89044.md): Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding (CVSS 6.9, netty)
- [CVE-2026-89043](https://cve.now/CVE-2026-89043.md): passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending (CVSS 9.1, krakenjs passport-saml-encrypted)
- [CVE-2026-89042](https://cve.now/CVE-2026-89042.md): passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification (CVSS 9.3, krakenjs passport-saml-encrypted)
- [CVE-2026-88053](https://cve.now/CVE-2026-88053.md): Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata (CVSS 8.6, tesseract-ocr tesseract)
- [CVE-2026-88052](https://cve.now/CVE-2026-88052.md): Tesseract: Heap out-of-bounds write in UNICHARSET::load\_via\_fgets via count/insert desynchronization (CVSS 7.8, tesseract-ocr tesseract)
- [CVE-2026-88022](https://cve.now/CVE-2026-88022.md): Unauthorized document disclosure and deletion via query-operator injection in explicit equality filters in MongoDB integration for Laravel (CVSS 8.4, Laravel MongoDB)
- [CVE-2026-88051](https://cve.now/CVE-2026-88051.md): Tesseract: Heap out-of-bounds write in GenericVector\<T\>::read due to independent reserved/size\_used\_ fields (CVSS 8.6, tesseract-ocr tesseract)
- [CVE-2026-15419](https://cve.now/CVE-2026-15419.md): CP210x Driver Memory Corruption results in Arbitrary Code Execution (CVSS 7.0, Silicon Labs silabser.sys driver)
- [CVE-2026-15418](https://cve.now/CVE-2026-15418.md): CP210x Memory Leakage (CVSS 2.4, Silicon Labs silabser.sys driver)
- [CVE-2026-15417](https://cve.now/CVE-2026-15417.md): CP210x Denial of Service (CVSS 6.9, Silicon Labs silabser.sys driver)
- [CVE-2026-85228](https://cve.now/CVE-2026-85228.md): Integer overflow in tensor buffer validation in Deep Java Library (CVSS 9.1, Amazon Deep Java Library)
- [CVE-2026-73699](https://cve.now/CVE-2026-73699.md): FileRun \< 2026.3.0 PHP Object Injection via Perms::getPerms() (CVSS 8.6, FileRun)
- [CVE-2026-73698](https://cve.now/CVE-2026-73698.md): FileRun \< 2026.3.0 Authenticated SQL Injection via Groups Add Action (CVSS 8.6, FileRun)
- [CVE-2026-73694](https://cve.now/CVE-2026-73694.md): FileRun \< 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition (CVSS 8.6, FileRun)
- [CVE-2026-73693](https://cve.now/CVE-2026-73693.md): FileRun \< 2026.3.0 OS Command Injection via PhotoProofSheet Handler (CVSS 8.7, FileRun)
- [CVE-2026-65639](https://cve.now/CVE-2026-65639.md): OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allo (CVSS 9.5, WebPros ConfigServer Security & Firewall · ConfigServer Sec…)
- [CVE-2026-68487](https://cve.now/CVE-2026-68487.md): Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. (CVSS 9.9, WebPros Plesk)
- [CVE-2026-65638](https://cve.now/CVE-2026-65638.md): Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary comma (CVSS 9.2, WebPros ConfigServer Security & Firewall · ConfigServer Sec…)
- [CVE-2026-68488](https://cve.now/CVE-2026-68488.md): A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root (CVSS 9.9, WebPros Plesk)
- [CVE-2026-88050](https://cve.now/CVE-2026-88050.md): Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values (CVSS 6.9, tesseract-ocr tesseract)
- [CVE-2026-88049](https://cve.now/CVE-2026-88049.md): Tesseract: Heap out-of-bounds write in LSTM::Forward via na\_/gate-matrix dimension mismatch (CVSS 8.6, tesseract-ocr tesseract)
- [CVE-2026-88048](https://cve.now/CVE-2026-88048.md): Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch (CVSS 8.6, tesseract-ocr tesseract)
- [CVE-2026-88047](https://cve.now/CVE-2026-88047.md): Tesseract: ReadNormProtos stack buffer overflow (CVSS 8.6, tesseract-ocr tesseract)
- [CVE-2026-88046](https://cve.now/CVE-2026-88046.md): rclone: source object names can escape the configured root on upload (CVSS 5.3, rclone · github.com/rclone/rclone)
- [CVE-2026-88045](https://cve.now/CVE-2026-88045.md): rclone: S3 multipart declared-length memory exhaustion (CVSS 7.5, rclone · github.com/rclone/rclone)
- [CVE-2026-88044](https://cve.now/CVE-2026-88044.md): rclone: RC per-server auth-proxy bypass (CVSS 9.1, rclone · github.com/rclone/rclone)
- [CVE-2026-79987](https://cve.now/CVE-2026-79987.md): Low-privilege RCE through element-search eager loading (CVSS 8.7, craftcms cms)
- [CVE-2026-88018](https://cve.now/CVE-2026-88018.md): rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass (CVSS 9.8, rclone · github.com/rclone/rclone)
- [CVE-2026-88017](https://cve.now/CVE-2026-88017.md): rclone: FTP cross-session auth-proxy backend confusion (CVSS 7.3, rclone · github.com/rclone/rclone)
- [CVE-2026-88016](https://cve.now/CVE-2026-88016.md): rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination (CVSS 7.1, rclone · github.com/rclone/rclone)
- [CVE-2026-88015](https://cve.now/CVE-2026-88015.md): rclone local: crafted Range request against a translated symlink panics (DoS) (CVSS 5.3, rclone · github.com/rclone/rclone)
- [CVE-2026-88014](https://cve.now/CVE-2026-88014.md): rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace (CVSS 6.3, rclone · github.com/rclone/rclone)
- [CVE-2026-81046](https://cve.now/CVE-2026-81046.md): Dell ThinOS 10, versions prior to 2605\_10.2616, contain a Protection Mechanism Failure vulnerability. (CVSS 9.4, Dell ThinOS)
- [CVE-2026-88959](https://cve.now/CVE-2026-88959.md): Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints (CVSS 8.8, anchorcms Anchor CMS)
- [CVE-2026-87913](https://cve.now/CVE-2026-87913.md): Missing S3 bucket ownership verification in the AWS Security Agent MCP server (CVSS 5.9, AWS Security Agent MCP server)
- [CVE-2026-81468](https://cve.now/CVE-2026-81468.md): Dell ThinOS 10, versions prior to 2605\_10. (CVSS 9.1, Dell ThinOS)
- [CVE-2026-87912](https://cve.now/CVE-2026-87912.md): Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops (CVSS 5.9, AWS Security Agent plugin)
- [CVE-2026-81467](https://cve.now/CVE-2026-81467.md): Dell ThinOS 10, versions prior to 2605\_10. (CVSS 9.8, Dell ThinOS)
- [CVE-2026-88013](https://cve.now/CVE-2026-88013.md): rclone: http backend forwards custom/auth headers to a different host on redirect (CVSS 3.7, rclone · github.com/rclone/rclone)
- [CVE-2026-81049](https://cve.now/CVE-2026-81049.md): Dell ThinOS 10, versions prior to 2605\_10.2616, contain a Missing Support for Integrity Check vulnerability. (CVSS 4.4, Dell ThinOS)
- [CVE-2026-4130](https://cve.now/CVE-2026-4130.md): Storage of Sensitive Information in Cleartext in NI SystemLink (CVSS 7.1, NI SystemLink)
- [CVE-2026-4129](https://cve.now/CVE-2026-4129.md): Improper Access Controls in NI SystemLink (CVSS 8.1, NI SystemLink)
- [CVE-2026-81051](https://cve.now/CVE-2026-81051.md): Dell ThinOS 10, versions prior to 2605\_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability. (CVSS 6.6, Dell ThinOS)
- [CVE-2026-88012](https://cve.now/CVE-2026-88012.md): Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded (CVSS 5.3, traefik · github.com/traefik/traefik +2)
- [CVE-2026-81048](https://cve.now/CVE-2026-81048.md): Dell ThinOS 10, versions prior to 2605\_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection (CVSS 9.6, Dell ThinOS)
- [CVE-2026-81052](https://cve.now/CVE-2026-81052.md): Dell ThinOS 10, versions prior to 2605\_10.2616, contain a Download of Code Without Integrity Check vulnerability. (CVSS 6.8, Dell ThinOS)
- [CVE-2026-88011](https://cve.now/CVE-2026-88011.md): Traefik: ForwardAuth identity spoofing via dot-form header alias (CVSS 5.3, traefik · github.com/traefik/traefik +2)
- [CVE-2026-88940](https://cve.now/CVE-2026-88940.md): knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint (CVSS 6.9, knowns-dev knowns)
- [CVE-2026-88939](https://cve.now/CVE-2026-88939.md): knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption (CVSS 8.7, knowns-dev knowns)
- [CVE-2026-88938](https://cve.now/CVE-2026-88938.md): knowns through 0.33.0 Path Traversal via code.find MCP tool (CVSS 7.1, knowns-dev knowns)
- [CVE-2026-88937](https://cve.now/CVE-2026-88937.md): knowns through 0.33.0 Path Traversal via Template Engine (CVSS 8.6, knowns-dev knowns)
- [CVE-2026-88899](https://cve.now/CVE-2026-88899.md): knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header (CVSS 9.3, knowns-dev knowns)
- [CVE-2026-88009](https://cve.now/CVE-2026-88009.md): Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging (CVSS 8.8, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-88008](https://cve.now/CVE-2026-88008.md): Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization (CVSS 7.0, traefik · github.com/traefik/traefik/v3 +2)
- [CVE-2026-88007](https://cve.now/CVE-2026-88007.md): Traefik HTTP/3 Backend NTLM Connection Reuse (CVSS 9.1, traefik · github.com/traefik/traefik +2)
- [CVE-2026-88898](https://cve.now/CVE-2026-88898.md): AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint (CVSS 7.1, AppFlowy-IO AppFlowy-Cloud)
- [CVE-2026-88897](https://cve.now/CVE-2026-88897.md): Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String (CVSS 8.2, flextype)
- [CVE-2026-88006](https://cve.now/CVE-2026-88006.md): Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange (CVSS 6.5, open-webui)
- [CVE-2026-88005](https://cve.now/CVE-2026-88005.md): Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange (CVSS 6.5, open-webui)
- [CVE-2026-15461](https://cve.now/CVE-2026-15461.md): Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input (CVSS 5.3, zephyrproject zephyr)
- [CVE-2026-88004](https://cve.now/CVE-2026-88004.md): Traefik entrypoint header-name sanitization bypassed via request trailers (CVSS 7.0, traefik · github.com/traefik/traefik +2)
- [CVE-2026-88924](https://cve.now/CVE-2026-88924.md): Gvfs: gvfs-admin socket ownership race permits local root (CVSS 7.0, GNOME gvfs · Red Hat Enterprise Linux)
- [CVE-2026-84821](https://cve.now/CVE-2026-84821.md): WordPress WP Fast Total Search plugin \<= 1.82.284 - Broken Access Control vulnerability (CVSS 7.5, Epsiloncool WP Fast Total Search)
- [CVE-2026-84819](https://cve.now/CVE-2026-84819.md): WordPress WPAdverts plugin \<= 2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Greg Winiarski WPAdverts)
- [CVE-2026-84816](https://cve.now/CVE-2026-84816.md): WordPress WPCS plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RealMag777 WPCS)
- [CVE-2026-81805](https://cve.now/CVE-2026-81805.md): WordPress SiteSkite plugin \<= 2.1.5 - Privilege Escalation vulnerability (CVSS 8.1, SiteSkite)
- [CVE-2026-81804](https://cve.now/CVE-2026-81804.md): WordPress ZHBackup – Backup, Restore & Migration plugin \<= 2.4.2 - Sensitive Data Exposure vulnerability (CVSS 7.5, Zain Hassan ZHBackup – Backup, Restore &amp; Migration)
- [CVE-2026-81803](https://cve.now/CVE-2026-81803.md): WordPress RepairBuddy plugin \<= 4.1224 - Remote Code Execution (RCE) vulnerability (CVSS 7.5, Ateeq Rafeeq RepairBuddy)
- [CVE-2026-81801](https://cve.now/CVE-2026-81801.md): WordPress WP-Stateless plugin \<= 4.4.1 - Settings Change vulnerability (CVSS 8.1, UDX Usability Dynamics WP-Stateless)
- [CVE-2026-81800](https://cve.now/CVE-2026-81800.md): WordPress Verified Reviews (Avis Vérifiés) plugin \<= 2.4.6 - SQL Injection vulnerability (CVSS 9.3, Par avisverifies Verified Reviews)
- [CVE-2026-81799](https://cve.now/CVE-2026-81799.md): WordPress Return Refund and Exchange For WooCommerce plugin \<= 4.6.4 - Broken Access Control vulnerability (CVSS 7.5, WP Swings Return Refund and Exchange For WooCommerce)
- [CVE-2026-81796](https://cve.now/CVE-2026-81796.md): WordPress WP Travel plugin \<= 12.0.3 - Broken Authentication vulnerability (CVSS 7.3, WEN Solutions WP Travel)
- [CVE-2026-81795](https://cve.now/CVE-2026-81795.md): WordPress Page Visits Counter – Lite plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Denis Botić Page Visits Counter &#8211; Lite)
- [CVE-2026-81794](https://cve.now/CVE-2026-81794.md): WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability (CVSS 7.5, mlfactory Shirt Product Designer for WooCommerce)
- [CVE-2026-81793](https://cve.now/CVE-2026-81793.md): WordPress Salon booking system plugin \<= 10.31.9 - Broken Access Control vulnerability (CVSS 6.5, Dimitri Grassi Salon booking system)
- [CVE-2026-81791](https://cve.now/CVE-2026-81791.md): WordPress EventON plugin \<= 2.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ashan Perera EventON)
- [CVE-2026-81789](https://cve.now/CVE-2026-81789.md): WordPress Advanced Product Fields Extended for WooCommerce plugin \<= 3.1.6 - Arbitrary File Deletion vulnerability (CVSS 8.6, Studio Wombat Advanced Product Fields Extended for WooComme…)
- [CVE-2026-81788](https://cve.now/CVE-2026-81788.md): WordPress IMPress for IDX Broker plugin \<= 3.3.0 - Broken Access Control vulnerability (CVSS 6.3, IMPress for IDX Broker)
- [CVE-2026-81787](https://cve.now/CVE-2026-81787.md): WordPress IMPress for IDX Broker plugin \<= 3.3.0 - Broken Authentication vulnerability (CVSS 6.5, IMPress for IDX Broker)
- [CVE-2026-81786](https://cve.now/CVE-2026-81786.md): WordPress Thank You Page Customizer for WooCommerce plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 7.5, VillaTheme Thank You Page Customizer for WooCommerce)
- [CVE-2026-81785](https://cve.now/CVE-2026-81785.md): WordPress BuddyForms plugin \<= 2.9.0 - Broken Access Control vulnerability (CVSS 6.5, Themekraft BuddyForms)
- [CVE-2026-81784](https://cve.now/CVE-2026-81784.md): WordPress Wise Chat plugin \<= 3.4.2 - PHP Object Injection vulnerability (CVSS 8.1, Marcin Wise Chat)
- [CVE-2026-81783](https://cve.now/CVE-2026-81783.md): WordPress MailMunch – Grow your Email List plugin \<= 3.2.5 - Broken Authentication vulnerability (CVSS 7.1, MailMunch – Grow your Email List)
- [CVE-2026-81782](https://cve.now/CVE-2026-81782.md): WordPress WP Docs plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fahad Mahmood WP Docs)
- [CVE-2026-81275](https://cve.now/CVE-2026-81275.md): WordPress Youzify plugin \<= 1.3.7 - Arbitrary File Download vulnerability (CVSS 6.5, Youzify)
- [CVE-2026-78536](https://cve.now/CVE-2026-78536.md): WordPress Robokassa payment gateway for Woocommerce plugin \<= 1.8.9 - Broken Access Control vulnerability (CVSS 6.5, Robokassa payment gateway for Woocommerce)
- [CVE-2026-66674](https://cve.now/CVE-2026-66674.md): WordPress Simple Cloudflare Turnstile plugin \<= 1.42.1 - Captcha Bypass vulnerability (CVSS 5.6, Elliot Sowers/ RelyWP Simple Cloudflare Turnstile)
- [CVE-2026-66632](https://cve.now/CVE-2026-66632.md): WordPress Simple Cloudflare Turnstile plugin \<= 1.42.1 - Content Injection vulnerability (CVSS 6.5, Elliot Sowers/ RelyWP Simple Cloudflare Turnstile)
- [CVE-2026-85310](https://cve.now/CVE-2026-85310.md): WordPress Groundhogg plugin \<= 4.7.1 - Path Traversal vulnerability (CVSS 6.5, Adrian Tobey Groundhogg)
- [CVE-2026-45747](https://cve.now/CVE-2026-45747.md): Suricata lua/tls: null dereference in TlsGetCertInfo (CVSS 7.5, OISF suricata)
- [CVE-2026-46387](https://cve.now/CVE-2026-46387.md): Suricata http2: decompression bomb can cause denial of service in Suricata (CVSS 7.5, OISF suricata)
- [CVE-2026-88790](https://cve.now/CVE-2026-88790.md): proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal (CVSS 2.4, proma-ai Proma)
- [CVE-2026-75584](https://cve.now/CVE-2026-75584.md): ION-DTN \< 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion (CVSS 8.7, nasa-jpl ION-DTN)
- [CVE-2026-64838](https://cve.now/CVE-2026-64838.md): ICEcoder through 8.1 Path Traversal via oldFileName Parameter (CVSS 8.7, ICEcoder)
- [CVE-2026-64837](https://cve.now/CVE-2026-64837.md): ICEcoder through 8.1 OS Command Injection via lib/properties.php (CVSS 8.7, ICEcoder)
- [CVE-2026-64836](https://cve.now/CVE-2026-64836.md): ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement (CVSS 8.7, ICEcoder)
- [CVE-2026-12682](https://cve.now/CVE-2026-12682.md): Stored XSS in Ankaref's LIBRID/LIBREF (CVSS 5.4, Ankaref Innovation and Technology LIBRID/LIBREF)
- [CVE-2026-88921](https://cve.now/CVE-2026-88921.md): MISP: Unescaped HTML Injection in PDF Report Element Rendering (CVSS 5.1, MISP)
- [CVE-2026-6285](https://cve.now/CVE-2026-6285.md): Improper Authentication in Ankaref's LIBRID/LIBREF (CVSS 7.5, Ankaref Innovation and Technology LIBRID/LIBREF)
- [CVE-2026-85217](https://cve.now/CVE-2026-85217.md): Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop (CVSS 8.6, Autodesk Fusion)
- [CVE-2026-45763](https://cve.now/CVE-2026-45763.md): Suricata lua: sandbox allocation limit not enforced for new allocations (CVSS 5.9, OISF suricata)
- [CVE-2026-12683](https://cve.now/CVE-2026-12683.md): Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF (CVSS 5.4, Ankaref Innovation and Technology LIBRID/LIBREF)
- [CVE-2026-88896](https://cve.now/CVE-2026-88896.md): EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass (CVSS 6.9, espocrm)
- [CVE-2026-88895](https://cve.now/CVE-2026-88895.md): CyberPanel before 3.0.5 Authentication Bypass via API (CVSS 8.6, usmannasir cyberpanel)
- [CVE-2026-88894](https://cve.now/CVE-2026-88894.md): Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout (CVSS 5.3, grokability snipe-it)
- [CVE-2026-88893](https://cve.now/CVE-2026-88893.md): OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure (CVSS 8.7, Openpanel-dev openpanel)
- [CVE-2026-88892](https://cve.now/CVE-2026-88892.md): OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch (CVSS 5.3, Openpanel-dev openpanel)
- [CVE-2026-88891](https://cve.now/CVE-2026-88891.md): OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations (CVSS 7.2, Openpanel-dev openpanel)
- [CVE-2026-88890](https://cve.now/CVE-2026-88890.md): OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier (CVSS 8.4, Openpanel-dev openpanel)
- [CVE-2026-88889](https://cve.now/CVE-2026-88889.md): Renovate before 44.14.7 Command Injection via distributionType (CVSS 8.5, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88888](https://cve.now/CVE-2026-88888.md): Renovate before 44.14.7 Command Injection via Mix organization (CVSS 7.3, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88887](https://cve.now/CVE-2026-88887.md): Renovate before 44.11.2 Credential Exfiltration via Link Header (CVSS 9.2, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88886](https://cve.now/CVE-2026-88886.md): Renovate before 44.14.7 Command Injection via gradle-wrapper (CVSS 8.5, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88885](https://cve.now/CVE-2026-88885.md): Renovate before 44.14.7 Command Injection via depName (CVSS 7.3, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88884](https://cve.now/CVE-2026-88884.md): Renovate before 44.3.1 Authentication Bypass via Digest Updates (CVSS 6.9, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88883](https://cve.now/CVE-2026-88883.md): Renovate before 44.14.4 TLS Private Key Log Sanitisation (CVSS 8.3, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88882](https://cve.now/CVE-2026-88882.md): Renovate before 44.11.2 Credential Exfiltration via Link Header (CVSS 9.2, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88881](https://cve.now/CVE-2026-88881.md): Renovate before 44.11.3 Credential Exfiltration via Link Header (CVSS 9.2, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88880](https://cve.now/CVE-2026-88880.md): Renovate before 44.11.3 Credential Exfiltration via Link Header (CVSS 9.2, renovatebot renovate · mend renovate-ce +4)
- [CVE-2026-88879](https://cve.now/CVE-2026-88879.md): Traefik before v2.11.56 Identity Spoofing via Header Alias (CVSS 5.3, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-88878](https://cve.now/CVE-2026-88878.md): Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass (CVSS 6.9, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2026-88877](https://cve.now/CVE-2026-88877.md): Traefik v3.7.0 Authentication Bypass via from-to-www-redirect (CVSS 9.3, traefik)
- [CVE-2026-88876](https://cve.now/CVE-2026-88876.md): AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD (CVSS 8.7, WWBN AVideo)
- [CVE-2026-88875](https://cve.now/CVE-2026-88875.md): AVideo Incomplete API Sanitization Information Disclosure (CVSS 5.3, WWBN AVideo)
- [CVE-2026-88874](https://cve.now/CVE-2026-88874.md): AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass (CVSS 8.7, WWBN AVideo)
- [CVE-2026-88873](https://cve.now/CVE-2026-88873.md): WWBN AVideo Cross-Site Request Forgery via logArchive.json.php (CVSS 7.1, WWBN AVideo)
- [CVE-2026-88872](https://cve.now/CVE-2026-88872.md): AVideo CustomizeUser setPassword.json.php CSRF (CVSS 7.1, WWBN AVideo)
- [CVE-2026-88871](https://cve.now/CVE-2026-88871.md): WWBN AVideo CustomizeUser setSubscribers CSRF via GET (CVSS 5.3, WWBN AVideo)
- [CVE-2026-88870](https://cve.now/CVE-2026-88870.md): WWBN AVideo LoginControl PGP Key CSRF via GET Request (CVSS 7.1, WWBN AVideo)
- [CVE-2026-88869](https://cve.now/CVE-2026-88869.md): AVideo AD\_Server Stored XSS via log.php label parameter (CVSS 9.3, WWBN AVideo)
- [CVE-2026-88868](https://cve.now/CVE-2026-88868.md): AVideo LiveLinks Stored XSS via title and description fields (CVSS 9.3, WWBN AVideo)
- [CVE-2026-88867](https://cve.now/CVE-2026-88867.md): WWBN AVideo Stored XSS via Category Name and Icon Class (CVSS 9.3, WWBN AVideo)
- [CVE-2026-88866](https://cve.now/CVE-2026-88866.md): WWBN AVideo LoginControl Stored XSS via User-Agent Header (CVSS 9.3, WWBN AVideo)
- [CVE-2026-88865](https://cve.now/CVE-2026-88865.md): AVideo Missing Authorization via getRestream.json.php (CVSS 8.6, WWBN AVideo)
- [CVE-2026-88864](https://cve.now/CVE-2026-88864.md): Capgo SSO Provider Authentication Bypass via PostgREST Direct Write (CVSS 9.3, Cap-go capgo.app)
- [CVE-2026-88863](https://cve.now/CVE-2026-88863.md): capgo.app through 12.207.1 Privilege Escalation via invite\_new\_user\_to\_org (CVSS 8.6, Cap-go capgo.app)
- [CVE-2026-88862](https://cve.now/CVE-2026-88862.md): Capgo API Key Manager Authentication Bypass via x-limited-key-id (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-88861](https://cve.now/CVE-2026-88861.md): Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization (CVSS 8.7, Cap-go capgo.app)
- [CVE-2026-88860](https://cve.now/CVE-2026-88860.md): Capgo Authorization Bypass via Stale Channel Permission Overrides (CVSS 9.3, Cap-go capgo.app)
- [CVE-2026-88915](https://cve.now/CVE-2026-88915.md): MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization (CVSS 7.1, MISP)
- [CVE-2026-85543](https://cve.now/CVE-2026-85543.md): Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users (CVSS 4.3, Hikvision Wi-Fi series camera)
- [CVE-2026-85545](https://cve.now/CVE-2026-85545.md): There is an Vulnerability in some HikCentral Access Control versions. (CVSS 7.1, Hikvision HikCentral Access Control)
- [CVE-2026-85544](https://cve.now/CVE-2026-85544.md): Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with (CVSS 6.1, Hikvision DS-KV9503 · Hikvision DS-KV6113 +11)
- [CVE-2026-9166](https://cve.now/CVE-2026-9166.md): LFI in GIS Informatics' GisLab Laboratory Management System (CVSS 7.5, GIS Informatics GisLab Laboratory Management System)
- [CVE-2026-88038](https://cve.now/CVE-2026-88038.md): cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options (CVSS 4.8, cookies)
- [CVE-2026-9163](https://cve.now/CVE-2026-9163.md): SQLi in GIS Informatics' GisLab Laboratory Management System (CVSS 9.8, GIS Informatics GisLab Laboratory Management System)
- [CVE-2026-9161](https://cve.now/CVE-2026-9161.md): User Enumeration in DernekPlus' Website Template (CVSS 5.3, DernekPlus Website Template)
- [CVE-2026-17038](https://cve.now/CVE-2026-17038.md): Use of Hard-coded Credentials in drEryk Gabinet (CVSS 6.9, drEryk Gabinet)
- [CVE-2026-88859](https://cve.now/CVE-2026-88859.md): Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction (CVSS 6.3, Red Hat Enterprise Linux)
- [CVE-2026-84828](https://cve.now/CVE-2026-84828.md): Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +1)
- [CVE-2026-87962](https://cve.now/CVE-2026-87962.md): t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes (CVSS 8.7, tdunning t-digest)
- [CVE-2026-87961](https://cve.now/CVE-2026-87961.md): ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read\_ID3\_Header (CVSS 7.1, schreibfaul1 ESP32-audioI2S)
- [CVE-2026-78085](https://cve.now/CVE-2026-78085.md): Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property \< 4.1.4 (CVSS 6.9, joomshaper.com SP Property extension for Joomla)
- [CVE-2026-78302](https://cve.now/CVE-2026-78302.md): Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property \< 4.1.4 (CVSS 8.6, joomshaper.com SP Property extension for Joomla)
- [CVE-2026-78374](https://cve.now/CVE-2026-78374.md): Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension \< 2.3.0 (CVSS 6.9, joomlart.com T4 Page Builder extension for Joomla)
- [CVE-2026-78083](https://cve.now/CVE-2026-78083.md): Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property \< 4.1.4 (CVSS 7.1, joomshaper.com SP Property extension for Joomla)
- [CVE-2026-78084](https://cve.now/CVE-2026-78084.md): Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property \< 4.1.4 (CVSS 6.9, joomshaper.com SP Property extension for Joomla)
- [CVE-2026-78082](https://cve.now/CVE-2026-78082.md): Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property \< 4.1.4 (CVSS 9.3, joomshaper.com SP Property extension for Joomla)
- [CVE-2026-78303](https://cve.now/CVE-2026-78303.md): Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property \< 4.1.4 (CVSS 6.9, joomshaper.com SP Property extension for Joomla)
- [CVE-2026-87803](https://cve.now/CVE-2026-87803.md): An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sa (CVSS 7.1, countly-server)
- [CVE-2026-15889](https://cve.now/CVE-2026-15889.md): Aruba HiSpeed Cache \<= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content (CVSS 6.4, arubadev Aruba HiSpeed Cache)
- [CVE-2026-5399](https://cve.now/CVE-2026-5399.md): Redux Framework \<= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-42808](https://cve.now/CVE-2026-42808.md): An issue was discovered in Bosch Sensortec COINES\_SDK versions 2.0 through 2.11. (CVSS 6.8, Bosch Sensortec COINES\_SDK)
- [CVE-2026-42807](https://cve.now/CVE-2026-42807.md): A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES\_SDK (versions 2.10 through 2.12.2) all (CVSS 8.0, Bosch Sensortec COINES\_SDK)
- [CVE-2026-42806](https://cve.now/CVE-2026-42806.md): An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within (CVSS 4.3, Bosch Sensortec BME690 SensorAPI)
- [CVE-2026-42805](https://cve.now/CVE-2026-42805.md): A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser funct (CVSS 8.4, Bosch Sensortec BHI385 SensorAPI)
- [CVE-2026-88265](https://cve.now/CVE-2026-88265.md): Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown (CVSS 5.6, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-42804](https://cve.now/CVE-2026-42804.md): A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit (CVSS 7.6, Bosch Sensortec BHI360\_SensorAPI)
- [CVE-2026-8323](https://cve.now/CVE-2026-8323.md): Open Redirect in Armiya Information Technologies' Access Control System (CVSS 9.3, Armiya Information Technologies Ltd. Access Control System)
- [CVE-2026-88264](https://cve.now/CVE-2026-88264.md): Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs (CVSS 5.6, containers crun · Red Hat Hardened Images +2)
- [CVE-2026-13745](https://cve.now/CVE-2026-13745.md): Arbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI\_CLI\_HOME (CVSS 7.7, Google Cloud Gemini CLI)
- [CVE-2026-88290](https://cve.now/CVE-2026-88290.md): GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exhaustion (CVSS 7.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88289](https://cve.now/CVE-2026-88289.md): GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffer Overflows in VLSVR Request Handlers (CVSS 7.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88288](https://cve.now/CVE-2026-88288.md): GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation (CVSS 6.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88287](https://cve.now/CVE-2026-88287.md): GV-LPC2011/LPC2211 -ONVIF Discovery Probe Scopes Stack-Frame Overflow Denial of Service (CVSS 7.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-84042](https://cve.now/CVE-2026-84042.md): Crun: crun: rootful krun with passt executes container payload as host root (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-88286](https://cve.now/CVE-2026-88286.md): GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of Service (CVSS 7.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88285](https://cve.now/CVE-2026-88285.md): GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service (CVSS 9.4, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88284](https://cve.now/CVE-2026-88284.md): GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Frame Overflow Denial of Service (CVSS 4.9, GeoVision GV-LPC2011/LPC2211 -)
- [CVE-2026-88283](https://cve.now/CVE-2026-88283.md): GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow Denial of Service (CVSS 4.9, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88282](https://cve.now/CVE-2026-88282.md): GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection (CVSS 7.2, GeoVision GV-LPCLPC2011/2211)
- [CVE-2026-88281](https://cve.now/CVE-2026-88281.md): GV-LPC2011/LPC2211 - ONVIF DeleteUsers Repeated-Element Stack Overflow Denial of Service (CVSS 4.9, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88280](https://cve.now/CVE-2026-88280.md): GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service (CVSS 4.9, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88279](https://cve.now/CVE-2026-88279.md): GV-LPC2011/LPC2211 - ONVIF CreateUsers Username/Password Stack-Frame Overflow Denial of Service (CVSS 4.9, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88278](https://cve.now/CVE-2026-88278.md): GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay (CVSS 9.8, GeoVision GV-LPCLPC2011/2211)
- [CVE-2026-88277](https://cve.now/CVE-2026-88277.md): GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection (CVSS 8.8, GeoVision GV-LPCLPC2011/2211)
- [CVE-2026-88276](https://cve.now/CVE-2026-88276.md): GV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command Injection (CVSS 7.2, GeoVision GV-LPCLPC2011/2211)
- [CVE-2026-88275](https://cve.now/CVE-2026-88275.md): GV-LPC2011/LPC2211 - Wireless WPA-PSK Command Injection (CVSS 7.2, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88274](https://cve.now/CVE-2026-88274.md): GV-LPC2011/LPC2211 - Wireless SSID Command Injection (CVSS 7.2, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88273](https://cve.now/CVE-2026-88273.md): GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection (CVSS 7.2, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-44950](https://cve.now/CVE-2026-44950.md): fs\_read\_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2 (CVSS 9.0, Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 · Contai… +71)
- [CVE-2026-88272](https://cve.now/CVE-2026-88272.md): GV-LPC2011/LPC2211 - Stored Administrator-Username Command Injection (CVSS 7.2, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88271](https://cve.now/CVE-2026-88271.md): GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover (CVSS 8.8, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88270](https://cve.now/CVE-2026-88270.md): GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service (CVSS 6.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88269](https://cve.now/CVE-2026-88269.md): GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure (CVSS 6.5, GeoVision GV-LPC2011/LPC2211)
- [CVE-2026-88268](https://cve.now/CVE-2026-88268.md): GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service (CVSS 6.5, GeoVision GV-LPCLPC2011/2211)
- [CVE-2026-59679](https://cve.now/CVE-2026-59679.md): fs\_read\_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2 (CVSS 9.0, Container suse/kiosk/tigervnc-x11vnc:1.14-63.8 · Contai… +71)
- [CVE-2026-7188](https://cve.now/CVE-2026-7188.md): SQLi in Armiya Information Technologies' Access Control System (CVSS 9.8, Armiya Information Technologies Ltd. Access Control System)
- [CVE-2026-80354](https://cve.now/CVE-2026-80354.md): Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace (CVSS 8.1, Apache Software Foundation Apache Camel K)
- [CVE-2026-80351](https://cve.now/CVE-2026-80351.md): Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod (CVSS 9.8, Apache Software Foundation Apache Camel K)
- [CVE-2026-80352](https://cve.now/CVE-2026-80352.md): Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects (CVSS 9.8, Apache Software Foundation Apache Camel K)
- [CVE-2026-88770](https://cve.now/CVE-2026-88770.md): Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts (CVSS 6.5, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-88763](https://cve.now/CVE-2026-88763.md): Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service (CVSS 5.9, Red Hat Service Interconnect 2 for RHEL)
- [CVE-2026-82582](https://cve.now/CVE-2026-82582.md): An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retriev (CVSS 4.3, SHIRASAGI Project SHIRASAGI)
- [CVE-2026-81635](https://cve.now/CVE-2026-81635.md): A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a (CVSS 5.4, SHIRASAGI Project SHIRASAGI)
- [CVE-2026-0302](https://cve.now/CVE-2026-0302.md): Checkov by Prisma Cloud: OS Command Injection Vulnerability (CVSS 1.1, Palo Alto Networks Checkov by Prisma Cloud)
- [CVE-2026-0303](https://cve.now/CVE-2026-0303.md): Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (CVSS 2.4, Palo Alto Networks Checkov by Prisma Cloud)
- [CVE-2026-0304](https://cve.now/CVE-2026-0304.md): Cortex XDR Broker VM: Privilege Escalation Vulnerability (CVSS 4.8, Palo Alto Networks Cortex XDR Broker VM)
- [CVE-2026-82925](https://cve.now/CVE-2026-82925.md): Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature (CVSS 8.1, Site Reviews)
- [CVE-2026-81431](https://cve.now/CVE-2026-81431.md): Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb\_id (CVSS 7.2, Registration Form for WooCommerce)
- [CVE-2026-78361](https://cve.now/CVE-2026-78361.md): zipMoney(Zip Co) Payments Plugin for WooCommerce \< 2.4.0 - Unauthenticated Arbitrary Option Deletion (CVSS 9.1, zipMoney(Zip Co) Payments Plugin for WooCommerce)
- [CVE-2026-77771](https://cve.now/CVE-2026-77771.md): miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout (CVSS 7.5, miniOrange 2FA)
- [CVE-2026-77770](https://cve.now/CVE-2026-77770.md): miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator (CVSS 10.0, miniOrange 2FA)
- [CVE-2026-19840](https://cve.now/CVE-2026-19840.md): Notiqoo \< 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions (CVSS 6.5, Notiqoo)
- [CVE-2026-19439](https://cve.now/CVE-2026-19439.md): Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps\_uwgc\_report\_details (CVSS 7.5, Ultimate Gift Cards for WooCommerce)
- [CVE-2026-19436](https://cve.now/CVE-2026-19436.md): Ultimate Gift Cards For WooCommerce \< 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase (CVSS 7.5, Ultimate Gift Cards for WooCommerce)
- [CVE-2026-0305](https://cve.now/CVE-2026-0305.md): Prisma Access Agent: Information Disclosure Vulnerability on Linux (CVSS 4.3, Palo Alto Networks Prisma Access Agent)
- [CVE-2026-0306](https://cve.now/CVE-2026-0306.md): Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows (CVSS 5.8, Palo Alto Networks Prisma Access Agent)
- [CVE-2026-0307](https://cve.now/CVE-2026-0307.md): GlobalProtect App: Local Privilege Escalation Vulnerabilities (CVSS 5.9, Palo Alto Networks GlobalProtect App)
- [CVE-2026-0308](https://cve.now/CVE-2026-0308.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 1.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-0309](https://cve.now/CVE-2026-0309.md): PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (CVSS 4.0, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-85645](https://cve.now/CVE-2026-85645.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.46 - Reflected Cross-Site Scripting (CVSS 6.1, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-0310](https://cve.now/CVE-2026-0310.md): PAN-OS: Buffer Overflow Vulnerability via XML Processing (CVSS 7.2, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2026-82079](https://cve.now/CVE-2026-82079.md): Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack (CVSS 7.0, Nintendo Switch)
- [CVE-2026-84939](https://cve.now/CVE-2026-84939.md): Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks (CVSS 9.1, Apache Software Foundation Apache FreeMarker · org.freemark…)
- [CVE-2026-49362](https://cve.now/CVE-2026-49362.md): Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation (CVSS 7.5, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-49363](https://cve.now/CVE-2026-49363.md): Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription (CVSS 7.5, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-49364](https://cve.now/CVE-2026-49364.md): Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers (CVSS 9.1, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-57822](https://cve.now/CVE-2026-57822.md): Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-57967](https://cve.now/CVE-2026-57967.md): Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment (CVSS 9.8, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-67593](https://cve.now/CVE-2026-67593.md): Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion (CVSS 9.1, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-75880](https://cve.now/CVE-2026-75880.md): Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service (CVSS 6.5, Apache Software Foundation Apache Artemis · Apache Software…)
- [CVE-2026-15019](https://cve.now/CVE-2026-15019.md): Direct Download for WooCommerce \<= 1.19 - Unauthenticated Arbitrary File Read via 'file\_id' Path Segment (CVSS 7.5, kamalyon Direct Download for WooCommerce)
- [CVE-2026-76562](https://cve.now/CVE-2026-76562.md): Sidebar Manager Light \<= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm\_description' Parameter (CVSS 7.2, otwthemes Sidebar Manager Light)
- [CVE-2026-14873](https://cve.now/CVE-2026-14873.md): Bulk Password Reset \<= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset (CVSS 8.0, rubenw Bulk Password Reset)
- [CVE-2026-4657](https://cve.now/CVE-2026-4657.md): Easy Google Fonts \<= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control\_selectors Meta Field (CVSS 6.4, sunny\_johal Easy Google Fonts)
- [CVE-2026-15820](https://cve.now/CVE-2026-15820.md): Builderall for WordPress \<= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting (CVSS 6.4, Builderall for WordPress)
- [CVE-2026-18594](https://cve.now/CVE-2026-18594.md): Advanced Contact form 7 DB \<= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import\_cf7\_id' (CVSS 4.3, vsourz1td Advanced Contact form 7 DB)
- [CVE-2026-18386](https://cve.now/CVE-2026-18386.md): WP BackItUp Community Edition \<= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup\_file' Parameter (CVSS 4.9, cssimmon WP BackItUp Community Edition)
- [CVE-2026-15823](https://cve.now/CVE-2026-15823.md): Builderall for WordPress \<= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba\_cheetah\_data\[post\_id\]' Parameter (CVSS 4.3, Builderall for WordPress)
- [CVE-2026-15796](https://cve.now/CVE-2026-15796.md): Builderall for WordPress \<= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg\_video\_service\_url' Setting (CVSS 6.4, Builderall for WordPress)
- [CVE-2026-19584](https://cve.now/CVE-2026-19584.md): Velociraptor VQL injection during notebook restore from backup (CVSS 7.7, Rapid7 Velociraptor)
- [CVE-2026-19583](https://cve.now/CVE-2026-19583.md): Velociraptor Required Permissions bypass by using client monitoring queries (CVSS 9.9, Rapid7 Velociraptor)
- [CVE-2026-87870](https://cve.now/CVE-2026-87870.md): Ninja Forms - Scheduled Exports \<= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters (CVSS 6.4, Saturday Drive Ninja Forms - Scheduled Exports)
- [CVE-2026-84063](https://cve.now/CVE-2026-84063.md): BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. (CVSS 6.5, D-ZERO CO. BurgerEditor)
- [CVE-2026-84062](https://cve.now/CVE-2026-84062.md): BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. (CVSS 4.3, D-ZERO CO. BurgerEditor)
- [CVE-2026-18351](https://cve.now/CVE-2026-18351.md): Drag and Drop File Upload for Elementor Forms \<= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter (CVSS 9.8, addonsorg Drag and Drop File Upload for Elementor Forms)
- [CVE-2026-87933](https://cve.now/CVE-2026-87933.md): DaveGamble cJSON cJSON\_Utils.c cJSONUtils\_MergePatch use after free (CVSS 6.9, DaveGamble cJSON)
- [CVE-2022-26962](https://cve.now/CVE-2022-26962.md): Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP\_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announce (CVSS 5.4)
- [CVE-2025-57231](https://cve.now/CVE-2025-57231.md): Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request (CVSS 7.5)
- [CVE-2026-36392](https://cve.now/CVE-2026-36392.md): FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2026-38626](https://cve.now/CVE-2026-38626.md): Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. (CVSS 9.8)
- [CVE-2026-52097](https://cve.now/CVE-2026-52097.md): An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, \_afLaunchLocalUri (url\_launcher.dart), O (CVSS 6.8)
- [CVE-2026-52098](https://cve.now/CVE-2026-52098.md): An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/\<flowId\> endpoint (CVSS 9.8)
- [CVE-2026-68006](https://cve.now/CVE-2026-68006.md): An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma\_http11/http11\_parser.rl file (CVSS 9.1)
- [CVE-2026-71640](https://cve.now/CVE-2026-71640.md): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via (CVSS 9.1)
- [CVE-2026-71642](https://cve.now/CVE-2026-71642.md): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den (CVSS 4.0)
- [CVE-2026-71643](https://cve.now/CVE-2026-71643.md): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den (CVSS 7.5)
- [CVE-2026-71645](https://cve.now/CVE-2026-71645.md): An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial (CVSS 7.5)
- [CVE-2026-71647](https://cve.now/CVE-2026-71647.md): An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of servic (CVSS 7.5)
- [CVE-2026-79590](https://cve.now/CVE-2026-79590.md): A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. (CVSS 6.5)
- [CVE-2026-79591](https://cve.now/CVE-2026-79591.md): A heap-buffer-overflow and use-after-free vulnerability exists in the xls\_getCSS() function of libxls 1.6.3 due to insufficient validation o (CVSS 7.8)
- [CVE-2026-79592](https://cve.now/CVE-2026-79592.md): An out-of-bounds read vulnerability exists in the xls\_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controll (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.