# CVEs published 2026-09-14

779 CVEs were published on September 14, 2026: 65 critical, 234 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-90842](https://cve.now/CVE-2026-90842.md): PHPGurukul Blood Donor Management System Login\_Model.php cleartext storage in file (CVSS 6.3, PHPGurukul Blood Donor Management System)
- [CVE-2026-90841](https://cve.now/CVE-2026-90841.md): PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection (CVSS 6.9, PHPGurukul Blood Donor Management System)
- [CVE-2026-90840](https://cve.now/CVE-2026-90840.md): PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php \_\_construct improper authentication (CVSS 6.9, PHPGurukul Blood Donor Management System)
- [CVE-2026-90835](https://cve.now/CVE-2026-90835.md): michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting (CVSS 5.1, michaelliao itranswarp)
- [CVE-2026-90831](https://cve.now/CVE-2026-90831.md): GNU Binutils ELF String Table elf-strtab.c \_bfd\_elf\_strtab\_delref memory corruption (CVSS 4.8, GNU Binutils)
- [CVE-2026-90830](https://cve.now/CVE-2026-90830.md): GNU Binutils Section Merge merge.c \_bfd\_write\_merged\_section null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-75945](https://cve.now/CVE-2026-75945.md): A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-75944](https://cve.now/CVE-2026-75944.md): A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-90829](https://cve.now/CVE-2026-90829.md): GNU Binutils SHT\_GROUP Section elf.c bfd\_elf\_set\_group\_contents null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-75943](https://cve.now/CVE-2026-75943.md): A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcem (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-91201](https://cve.now/CVE-2026-91201.md): DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage (CVSS 5.3, arc53 DocsGPT)
- [CVE-2026-91200](https://cve.now/CVE-2026-91200.md): DevSpace through 6.3.21 Path Traversal via tar extraction (CVSS 8.7, devspace)
- [CVE-2026-91199](https://cve.now/CVE-2026-91199.md): Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint (CVSS 5.3, refly-ai refly)
- [CVE-2026-91198](https://cve.now/CVE-2026-91198.md): GrowthBook through 5.0.1 Information Disclosure via Public Endpoints (CVSS 6.9, growthbook)
- [CVE-2026-91197](https://cve.now/CVE-2026-91197.md): Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory (CVSS 7.1, flowable-engine)
- [CVE-2026-81900](https://cve.now/CVE-2026-81900.md): Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight) (CVSS 7.3, Concrete CMS)
- [CVE-2026-14986](https://cve.now/CVE-2026-14986.md): Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction (CVSS 6.8, zephyrproject zephyr)
- [CVE-2026-77191](https://cve.now/CVE-2026-77191.md): All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an (CVSS 2.6, Arista Networks EOS)
- [CVE-2026-18116](https://cve.now/CVE-2026-18116.md): Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications (CVSS 7.3, Concrete CMS)
- [CVE-2026-90828](https://cve.now/CVE-2026-90828.md): GNU Binutils ELF Orphan Section ldelf.c elf\_orphan\_compatible null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-73449](https://cve.now/CVE-2026-73449.md): On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI (CVSS 5.9, Arista Networks EOS)
- [CVE-2026-91146](https://cve.now/CVE-2026-91146.md): Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme (CVSS 5.3, jointakahe takahe)
- [CVE-2026-91145](https://cve.now/CVE-2026-91145.md): Activiti through 7.1.0.M6 Expression Injection via Mail Task (CVSS 7.1, Activiti)
- [CVE-2026-91144](https://cve.now/CVE-2026-91144.md): ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint (CVSS 8.7, zfile-dev zfile)
- [CVE-2026-91143](https://cve.now/CVE-2026-91143.md): goproxy through 15.3 Authentication Bypass via CONNECT (CVSS 6.9, snail007 goproxy)
- [CVE-2026-90827](https://cve.now/CVE-2026-90827.md): GPAC MP4Box base\_scenegraph.c gf\_node\_deactivate\_ex use after free (CVSS 4.8, GPAC)
- [CVE-2026-12944](https://cve.now/CVE-2026-12944.md): Incomplete Security Scanner Blocklist Enables Network-Based Code Execution (CVSS 9.6, IBM Langflow OSS)
- [CVE-2026-76081](https://cve.now/CVE-2026-76081.md): ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions (CVSS 5.5, zitadel · github.com/zitadel/zitadel)
- [CVE-2026-90826](https://cve.now/CVE-2026-90826.md): GPAC MP4Box base\_scenegraph.c gf\_node\_del out-of-bounds (CVSS 2.4, GPAC)
- [CVE-2026-18117](https://cve.now/CVE-2026-18117.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name (CVSS 7.3, Concrete CMS)
- [CVE-2026-91181](https://cve.now/CVE-2026-91181.md): Data Retention Teams Endpoint Leaks Private Team Invite ID (CVSS 6.5, Mattermost)
- [CVE-2026-12756](https://cve.now/CVE-2026-12756.md): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (CVSS 7.1, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-12758](https://cve.now/CVE-2026-12758.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 5.4, IBM Cloud Pak for Business Automation)
- [CVE-2026-90825](https://cve.now/CVE-2026-90825.md): GPAC MP4Box base\_scenegraph.c gf\_node\_unregister use after free (CVSS 4.8, GPAC)
- [CVE-2026-12759](https://cve.now/CVE-2026-12759.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.5, IBM Cloud Pak for Business Automation)
- [CVE-2026-13265](https://cve.now/CVE-2026-13265.md): IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection (CVSS 6.8, IBM MQ)
- [CVE-2026-13275](https://cve.now/CVE-2026-13275.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-13285](https://cve.now/CVE-2026-13285.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-13293](https://cve.now/CVE-2026-13293.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 8.8, IBM MQ)
- [CVE-2026-13287](https://cve.now/CVE-2026-13287.md): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-14275](https://cve.now/CVE-2026-14275.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 6.3, IBM i Access Family)
- [CVE-2026-14276](https://cve.now/CVE-2026-14276.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 6.3, IBM i Access Family)
- [CVE-2026-14277](https://cve.now/CVE-2026-14277.md): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (CVSS 6.3, IBM i Access Family)
- [CVE-2026-18069](https://cve.now/CVE-2026-18069.md): IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine \[\] (CVSS 6.0, IBM i)
- [CVE-2026-19273](https://cve.now/CVE-2026-19273.md): The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-19086](https://cve.now/CVE-2026-19086.md): IBM i is Affected By Multiple Vulnerabilities in PASE \[, \] (CVSS 3.3, IBM i)
- [CVE-2026-90824](https://cve.now/CVE-2026-90824.md): GPAC MP4Box dom\_events.c gf\_sg\_dom\_event\_bubble stack-based overflow (CVSS 4.8, GPAC)
- [CVE-2026-19280](https://cve.now/CVE-2026-19280.md): IBM i is Affected By Multiple Vulnerabilities in PASE \[, \] (CVSS 5.2, IBM i)
- [CVE-2026-90896](https://cve.now/CVE-2026-90896.md): Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII (CVSS 8.2, MarcosCamara01 Ecommerce Template)
- [CVE-2026-19290](https://cve.now/CVE-2026-19290.md): IBM Sterling File Gateway is Vulnerable to Improper Access Control (CVSS 7.5, IBM Sterling File Gateway)
- [CVE-2026-75792](https://cve.now/CVE-2026-75792.md): IBM Sterling Secure Proxy is vulnerable to multiple issues (CVSS 4.3, IBM Sterling Secure Proxy)
- [CVE-2026-78415](https://cve.now/CVE-2026-78415.md): IBM Sterling Secure Proxy is vulnerable to multiple issues (CVSS 5.4, IBM Sterling Secure Proxy)
- [CVE-2026-7884](https://cve.now/CVE-2026-7884.md): IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2026-68489](https://cve.now/CVE-2026-68489.md): Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execut (CVSS 8.7, WebPros Plesk extension "Ruby" · WebPros Plesk extension "N…)
- [CVE-2026-67399](https://cve.now/CVE-2026-67399.md): Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. (CVSS 9.3, WebPros WHMCS)
- [CVE-2026-65409](https://cve.now/CVE-2026-65409.md): A type confusion issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84559](https://cve.now/CVE-2026-84559.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-28960](https://cve.now/CVE-2026-28960.md): A denial-of-service issue was addressed with improved validation. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-43741](https://cve.now/CVE-2026-43741.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-28937](https://cve.now/CVE-2026-28937.md): This issue was addressed through improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-86876](https://cve.now/CVE-2026-86876.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.2, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84518](https://cve.now/CVE-2026-84518.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2026-84631](https://cve.now/CVE-2026-84631.md): This issue was addressed with additional entitlement checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-84563](https://cve.now/CVE-2026-84563.md): A logic issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2026-84534](https://cve.now/CVE-2026-84534.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-43690](https://cve.now/CVE-2026-43690.md): A race condition was addressed with improved locking. (CVSS 4.7, Apple macOS)
- [CVE-2026-84522](https://cve.now/CVE-2026-84522.md): A race condition was addressed with improved state management. (CVSS 5.9, Apple macOS)
- [CVE-2026-86909](https://cve.now/CVE-2026-86909.md): A logic issue was addressed with improved state management. (CVSS 4.4, Apple macOS)
- [CVE-2026-43686](https://cve.now/CVE-2026-43686.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84575](https://cve.now/CVE-2026-84575.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86883](https://cve.now/CVE-2026-86883.md): A privacy issue was addressed with improved handling of files. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-64756](https://cve.now/CVE-2026-64756.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65393](https://cve.now/CVE-2026-65393.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple Xcode · Apple macOS)
- [CVE-2026-65405](https://cve.now/CVE-2026-65405.md): A memory initialization issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-64701](https://cve.now/CVE-2026-64701.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2026-84555](https://cve.now/CVE-2026-84555.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple macOS)
- [CVE-2026-65413](https://cve.now/CVE-2026-65413.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-64717](https://cve.now/CVE-2026-64717.md): A race condition was addressed with improved state handling. (CVSS 6.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84543](https://cve.now/CVE-2026-84543.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.5, Apple macOS)
- [CVE-2026-86895](https://cve.now/CVE-2026-86895.md): An information disclosure issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-84514](https://cve.now/CVE-2026-84514.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-43761](https://cve.now/CVE-2026-43761.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-84580](https://cve.now/CVE-2026-84580.md): The issue was addressed with improved checks. (CVSS 8.4, Apple macOS)
- [CVE-2026-84611](https://cve.now/CVE-2026-84611.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84492](https://cve.now/CVE-2026-84492.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84538](https://cve.now/CVE-2026-84538.md): A denial-of-service issue was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2026-84607](https://cve.now/CVE-2026-84607.md): A race condition was addressed with improved state management. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86905](https://cve.now/CVE-2026-86905.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84596](https://cve.now/CVE-2026-84596.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84578](https://cve.now/CVE-2026-84578.md): A logic issue was addressed with improved checks. (CVSS 8.8, Apple macOS)
- [CVE-2026-84597](https://cve.now/CVE-2026-84597.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86904](https://cve.now/CVE-2026-86904.md): A privacy issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2026-43664](https://cve.now/CVE-2026-43664.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84606](https://cve.now/CVE-2026-84606.md): A privacy issue was addressed with improved handling of identifiers. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-43808](https://cve.now/CVE-2026-43808.md): A use-after-free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-43737](https://cve.now/CVE-2026-43737.md): An authorization issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84581](https://cve.now/CVE-2026-84581.md): A buffer overflow was addressed with improved bounds checking. (CVSS 8.4, Apple macOS)
- [CVE-2026-86894](https://cve.now/CVE-2026-86894.md): A logic issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2026-84515](https://cve.now/CVE-2026-84515.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2026-65412](https://cve.now/CVE-2026-65412.md): A null pointer dereference was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65404](https://cve.now/CVE-2026-65404.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84554](https://cve.now/CVE-2026-84554.md): An integer overflow was addressed with improved input validation. (CVSS 5.9, Apple macOS)
- [CVE-2026-86882](https://cve.now/CVE-2026-86882.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84574](https://cve.now/CVE-2026-84574.md): A permissions issue was addressed with improved state management. (CVSS 4.4, Apple macOS)
- [CVE-2026-43687](https://cve.now/CVE-2026-43687.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84489](https://cve.now/CVE-2026-84489.md): A buffer overflow was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84523](https://cve.now/CVE-2026-84523.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43691](https://cve.now/CVE-2026-43691.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-84535](https://cve.now/CVE-2026-84535.md): An authorization issue was addressed with improved state management. (CVSS 8.2, Apple macOS)
- [CVE-2026-64761](https://cve.now/CVE-2026-64761.md): A privacy issue was addressed with improved handling of user preferences. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-43783](https://cve.now/CVE-2026-43783.md): A race condition was addressed with improved locking. (CVSS 7.8, Apple macOS)
- [CVE-2026-64736](https://cve.now/CVE-2026-64736.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84562](https://cve.now/CVE-2026-84562.md): A race condition was addressed with additional validation. (CVSS 4.7, Apple macOS)
- [CVE-2026-84630](https://cve.now/CVE-2026-84630.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86898](https://cve.now/CVE-2026-86898.md): A logic issue was addressed with improved state management. (CVSS 5.4, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-84519](https://cve.now/CVE-2026-84519.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65371](https://cve.now/CVE-2026-65371.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65408](https://cve.now/CVE-2026-65408.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84558](https://cve.now/CVE-2026-84558.md): A double free issue was addressed with improved memory management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84626](https://cve.now/CVE-2026-84626.md): An information disclosure issue was addressed with improved state management. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86924](https://cve.now/CVE-2026-86924.md): A memory corruption issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86885](https://cve.now/CVE-2026-86885.md): An input validation issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS)
- [CVE-2026-65395](https://cve.now/CVE-2026-65395.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65403](https://cve.now/CVE-2026-65403.md): This issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84553](https://cve.now/CVE-2026-84553.md): A resource exhaustion issue was addressed with improved input validation. (CVSS 7.5, Apple macOS)
- [CVE-2026-65383](https://cve.now/CVE-2026-65383.md): This issue was addressed with improved checks. (CVSS 4.4, Apple macOS)
- [CVE-2026-65415](https://cve.now/CVE-2026-65415.md): A race condition was addressed with additional validation. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86893](https://cve.now/CVE-2026-86893.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-84512](https://cve.now/CVE-2026-84512.md): A buffer overflow was addressed with improved bounds checking. (CVSS 8.8, Apple macOS)
- [CVE-2026-43788](https://cve.now/CVE-2026-43788.md): An integer overflow was addressed with improved input validation. (CVSS 6.6, Apple macOS)
- [CVE-2026-84569](https://cve.now/CVE-2026-84569.md): An access issue was addressed with additional sandbox restrictions on the system pasteboards. (CVSS 5.5, Apple macOS)
- [CVE-2026-84586](https://cve.now/CVE-2026-84586.md): An information disclosure issue was addressed with improved state management. (CVSS 5.5, Apple macOS · Apple watchOS)
- [CVE-2026-84617](https://cve.now/CVE-2026-84617.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84601](https://cve.now/CVE-2026-84601.md): A permissions issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-86903](https://cve.now/CVE-2026-86903.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86889](https://cve.now/CVE-2026-86889.md): A certificate validation issue was addressed with improved certificate validation. (CVSS 4.8, Apple macOS)
- [CVE-2026-84621](https://cve.now/CVE-2026-84621.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65399](https://cve.now/CVE-2026-65399.md): A file quarantine bypass was addressed with additional checks. (CVSS 4.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65376](https://cve.now/CVE-2026-65376.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple macOS)
- [CVE-2026-28966](https://cve.now/CVE-2026-28966.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84549](https://cve.now/CVE-2026-84549.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.5, Apple macOS)
- [CVE-2026-65360](https://cve.now/CVE-2026-65360.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86870](https://cve.now/CVE-2026-86870.md): A heap buffer overflow was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84565](https://cve.now/CVE-2026-84565.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84532](https://cve.now/CVE-2026-84532.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-43696](https://cve.now/CVE-2026-43696.md): An authorization issue was addressed with improved entitlement checks. (CVSS 5.3, Apple macOS)
- [CVE-2026-84524](https://cve.now/CVE-2026-84524.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43815](https://cve.now/CVE-2026-43815.md): A buffer overflow was addressed with improved bounds checking. (CVSS 8.8, Apple macOS)
- [CVE-2026-84573](https://cve.now/CVE-2026-84573.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-84572](https://cve.now/CVE-2026-84572.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84525](https://cve.now/CVE-2026-84525.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple macOS)
- [CVE-2026-43697](https://cve.now/CVE-2026-43697.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 4.3, Apple macOS)
- [CVE-2026-84533](https://cve.now/CVE-2026-84533.md): A cryptographic issue was addressed with improved integrity checks. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-43785](https://cve.now/CVE-2026-43785.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84564](https://cve.now/CVE-2026-84564.md): An uninitialized memory issue was addressed with improved memory initialization. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84636](https://cve.now/CVE-2026-84636.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-65361](https://cve.now/CVE-2026-65361.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-84548](https://cve.now/CVE-2026-84548.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-65398](https://cve.now/CVE-2026-65398.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65377](https://cve.now/CVE-2026-65377.md): A memory corruption issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84620](https://cve.now/CVE-2026-84620.md): An integer overflow was addressed with improved input validation. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86888](https://cve.now/CVE-2026-86888.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84509](https://cve.now/CVE-2026-84509.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-65357](https://cve.now/CVE-2026-65357.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86902](https://cve.now/CVE-2026-86902.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-84600](https://cve.now/CVE-2026-84600.md): An authorization issue was addressed with improved state management. (CVSS 5.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43674](https://cve.now/CVE-2026-43674.md): An authentication issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-84616](https://cve.now/CVE-2026-84616.md): A type confusion issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84568](https://cve.now/CVE-2026-84568.md): A path traversal issue was addressed with improved path validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-84587](https://cve.now/CVE-2026-84587.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2026-43789](https://cve.now/CVE-2026-43789.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2026-86892](https://cve.now/CVE-2026-86892.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-84513](https://cve.now/CVE-2026-84513.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65414](https://cve.now/CVE-2026-65414.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84544](https://cve.now/CVE-2026-84544.md): An integer overflow was addressed with improved input validation. (CVSS 7.5, Apple macOS)
- [CVE-2026-65382](https://cve.now/CVE-2026-65382.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-65402](https://cve.now/CVE-2026-65402.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84552](https://cve.now/CVE-2026-84552.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86884](https://cve.now/CVE-2026-86884.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84505](https://cve.now/CVE-2026-84505.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2026-65354](https://cve.now/CVE-2026-65354.md): A permissions issue was addressed with additional restrictions. (CVSS 8.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86901](https://cve.now/CVE-2026-86901.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84603](https://cve.now/CVE-2026-84603.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS +1)
- [CVE-2026-86917](https://cve.now/CVE-2026-86917.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2026-84615](https://cve.now/CVE-2026-84615.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2026-43677](https://cve.now/CVE-2026-43677.md): An out-of-bounds write issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple macOS)
- [CVE-2026-84584](https://cve.now/CVE-2026-84584.md): This issue was addressed with improved handling of symlinks. (CVSS 8.4, Apple macOS)
- [CVE-2026-65342](https://cve.now/CVE-2026-65342.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-84510](https://cve.now/CVE-2026-84510.md): A heap buffer overflow was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86891](https://cve.now/CVE-2026-86891.md): An authorization issue was addressed with improved state management. (CVSS 3.5, Apple macOS · Apple watchOS)
- [CVE-2026-28968](https://cve.now/CVE-2026-28968.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65381](https://cve.now/CVE-2026-65381.md): A validation issue existed in the entitlement verification. (CVSS 8.8, Apple macOS)
- [CVE-2026-84551](https://cve.now/CVE-2026-84551.md): A logic issue was addressed with improved validation. (CVSS 4.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65401](https://cve.now/CVE-2026-65401.md): A race condition was addressed with improved state handling. (CVSS 5.5, Apple macOS)
- [CVE-2026-65378](https://cve.now/CVE-2026-65378.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84506](https://cve.now/CVE-2026-84506.md): A use after free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS)
- [CVE-2026-64752](https://cve.now/CVE-2026-64752.md): A memory corruption issue was addressed by removing the vulnerable code. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-86887](https://cve.now/CVE-2026-86887.md): A privacy issue was addressed by removing sensitive data. (CVSS 3.3, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-43790](https://cve.now/CVE-2026-43790.md): The issue was addressed with improved memory handling. (CVSS 9.1, Apple macOS)
- [CVE-2026-65358](https://cve.now/CVE-2026-65358.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84571](https://cve.now/CVE-2026-84571.md): A buffer overflow was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84526](https://cve.now/CVE-2026-84526.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84619](https://cve.now/CVE-2026-84619.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.1, Apple macOS)
- [CVE-2026-84530](https://cve.now/CVE-2026-84530.md): An information disclosure issue was addressed with improved memory management. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43786](https://cve.now/CVE-2026-43786.md): This issue was addressed with additional entitlement checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-84588](https://cve.now/CVE-2026-84588.md): A memory corruption issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple macOS)
- [CVE-2026-84567](https://cve.now/CVE-2026-84567.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2026-20683](https://cve.now/CVE-2026-20683.md): An authentication issue was addressed with improved state management. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84635](https://cve.now/CVE-2026-84635.md): A logic issue was addressed with improved state management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-28933](https://cve.now/CVE-2026-28933.md): A use-after-free issue was addressed with improved memory management. (CVSS 5.5, Apple macOS)
- [CVE-2026-28899](https://cve.now/CVE-2026-28899.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-65362](https://cve.now/CVE-2026-65362.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-65374](https://cve.now/CVE-2026-65374.md): A memory corruption issue was addressed with improved validation. (CVSS 8.8, Apple macOS)
- [CVE-2026-84623](https://cve.now/CVE-2026-84623.md): An authorization issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-84622](https://cve.now/CVE-2026-84622.md): A memory initialization issue was addressed with improved memory handling. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-28836](https://cve.now/CVE-2026-28836.md): A correctness issue was addressed with improved checks. (CVSS 6.1, Apple macOS)
- [CVE-2026-65375](https://cve.now/CVE-2026-65375.md): The issue was addressed with improved authentication. (CVSS 7.5, Apple macOS)
- [CVE-2026-84589](https://cve.now/CVE-2026-84589.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2026-84566](https://cve.now/CVE-2026-84566.md): The issue was addressed with improved memory handling. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-43787](https://cve.now/CVE-2026-43787.md): A logic issue was addressed with improved checks. (CVSS 5.9, Apple macOS)
- [CVE-2026-84531](https://cve.now/CVE-2026-84531.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84618](https://cve.now/CVE-2026-84618.md): A permissions issue was addressed with improved validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-43695](https://cve.now/CVE-2026-43695.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84527](https://cve.now/CVE-2026-84527.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43683](https://cve.now/CVE-2026-43683.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS)
- [CVE-2026-84570](https://cve.now/CVE-2026-84570.md): A logic issue was addressed with improved checks. (CVSS 4.4, Apple macOS)
- [CVE-2026-43791](https://cve.now/CVE-2026-43791.md): A validation issue was addressed with improved input sanitization. (CVSS 6.5, Apple macOS)
- [CVE-2026-65359](https://cve.now/CVE-2026-65359.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86869](https://cve.now/CVE-2026-86869.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84507](https://cve.now/CVE-2026-84507.md): A race condition was addressed with improved state handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-64753](https://cve.now/CVE-2026-64753.md): A permissions issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-86886](https://cve.now/CVE-2026-86886.md): A path traversal issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2026-84550](https://cve.now/CVE-2026-84550.md): A race condition was addressed with additional validation. (CVSS 4.7, Apple macOS)
- [CVE-2026-65380](https://cve.now/CVE-2026-65380.md): An issue existed in the handling of snapshots. (CVSS 5.5, Apple macOS)
- [CVE-2026-64712](https://cve.now/CVE-2026-64712.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2026-84546](https://cve.now/CVE-2026-84546.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84511](https://cve.now/CVE-2026-84511.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86890](https://cve.now/CVE-2026-86890.md): A logic issue was addressed with improved checks. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2026-84585](https://cve.now/CVE-2026-84585.md): A permissions issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84497](https://cve.now/CVE-2026-84497.md): A buffer overflow was addressed with improved size validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84602](https://cve.now/CVE-2026-84602.md): A type confusion issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86900](https://cve.now/CVE-2026-86900.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2026-64790](https://cve.now/CVE-2026-64790.md): A path handling issue was addressed with improved validation. (CVSS 7.8, Apple macOS)
- [CVE-2026-65355](https://cve.now/CVE-2026-65355.md): An information disclosure issue was addressed with improved state management. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84593](https://cve.now/CVE-2026-84593.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2026-84598](https://cve.now/CVE-2026-84598.md): A path traversal issue was addressed with improved path validation. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-84577](https://cve.now/CVE-2026-84577.md): An access issue was addressed with additional sandbox restrictions. (CVSS 8.2, Apple macOS)
- [CVE-2026-84609](https://cve.now/CVE-2026-84609.md): A permissions issue was addressed with improved path validation. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43684](https://cve.now/CVE-2026-43684.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84520](https://cve.now/CVE-2026-84520.md): A buffer overflow was addressed with improved size validation. (CVSS 9.8, Apple macOS)
- [CVE-2026-43692](https://cve.now/CVE-2026-43692.md): A validation issue was addressed with improved input sanitization. (CVSS 8.8, Apple macOS)
- [CVE-2026-84536](https://cve.now/CVE-2026-84536.md): An integer underflow was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2026-65348](https://cve.now/CVE-2026-65348.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84561](https://cve.now/CVE-2026-84561.md): A double free issue was addressed with improved memory management. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-28935](https://cve.now/CVE-2026-28935.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65364](https://cve.now/CVE-2026-65364.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.5, Apple macOS)
- [CVE-2026-43702](https://cve.now/CVE-2026-43702.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-84625](https://cve.now/CVE-2026-84625.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65352](https://cve.now/CVE-2026-65352.md): An information disclosure issue was addressed with improved state management. (CVSS 4.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-43688](https://cve.now/CVE-2026-43688.md): A memory corruption issue was addressed with improved input validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-86911](https://cve.now/CVE-2026-86911.md): This issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-65344](https://cve.now/CVE-2026-65344.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-86878](https://cve.now/CVE-2026-86878.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2026-84516](https://cve.now/CVE-2026-84516.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 8.1, Apple macOS)
- [CVE-2026-86897](https://cve.now/CVE-2026-86897.md): This issue was addressed with additional entitlement checks. (CVSS 5.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2026-84541](https://cve.now/CVE-2026-84541.md): An input validation issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-65411](https://cve.now/CVE-2026-65411.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2026-65407](https://cve.now/CVE-2026-65407.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65391](https://cve.now/CVE-2026-65391.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-86881](https://cve.now/CVE-2026-86881.md): A certificate validation issue was addressed with improved certificate validation. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84629](https://cve.now/CVE-2026-84629.md): This issue was addressed with additional entitlement checks. (CVSS 7.5, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2026-84628](https://cve.now/CVE-2026-84628.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65390](https://cve.now/CVE-2026-65390.md): An integer overflow was addressed with improved input validation. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2026-84556](https://cve.now/CVE-2026-84556.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple macOS)
- [CVE-2026-65406](https://cve.now/CVE-2026-65406.md): A logic issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2026-65369](https://cve.now/CVE-2026-65369.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-84540](https://cve.now/CVE-2026-84540.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2026-64714](https://cve.now/CVE-2026-64714.md): A memory corruption issue was addressed with improved bounds checking. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-65410](https://cve.now/CVE-2026-65410.md): The issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43719](https://cve.now/CVE-2026-43719.md): A use-after-free issue was addressed with improved memory management. (CVSS 6.5, Apple macOS)
- [CVE-2026-86879](https://cve.now/CVE-2026-86879.md): A denial-of-service issue was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS)
- [CVE-2026-84517](https://cve.now/CVE-2026-84517.md): An integer overflow was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-28938](https://cve.now/CVE-2026-28938.md): A privacy issue was addressed by moving sensitive data. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2026-43762](https://cve.now/CVE-2026-43762.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-65345](https://cve.now/CVE-2026-65345.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84583](https://cve.now/CVE-2026-84583.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84612](https://cve.now/CVE-2026-84612.md): An authorization issue was addressed with improved access control. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-86910](https://cve.now/CVE-2026-86910.md): A permissions issue was addressed with improved path validation. (CVSS 5.5, Apple macOS)
- [CVE-2026-84491](https://cve.now/CVE-2026-84491.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-43689](https://cve.now/CVE-2026-43689.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84487](https://cve.now/CVE-2026-84487.md): An integer overflow was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-65353](https://cve.now/CVE-2026-65353.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2026-84624](https://cve.now/CVE-2026-84624.md): A permissions issue was addressed with improved path validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-65365](https://cve.now/CVE-2026-65365.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-28934](https://cve.now/CVE-2026-28934.md): A buffer overflow was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2026-84632](https://cve.now/CVE-2026-84632.md): The issue was addressed with improved memory handling. (CVSS 7.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84560](https://cve.now/CVE-2026-84560.md): An authorization issue was addressed with improved state management. (CVSS 6.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2026-84537](https://cve.now/CVE-2026-84537.md): The issue was addressed with improved memory handling. (CVSS 6.6, Apple macOS)
- [CVE-2026-84521](https://cve.now/CVE-2026-84521.md): A use after free issue was addressed with improved memory management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2026-84576](https://cve.now/CVE-2026-84576.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2026-90820](https://cve.now/CVE-2026-90820.md): a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization (CVSS 5.3, a2aproject a2a-java)
- [CVE-2026-81901](https://cve.now/CVE-2026-81901.md): Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the \`PUT /pages/{cID}\` endpoint (CVSS 7.2, Concrete CMS)
- [CVE-2026-81902](https://cve.now/CVE-2026-81902.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup (CVSS 7.1, Concrete CMS)
- [CVE-2026-12763](https://cve.now/CVE-2026-12763.md): Langflow is vulnerable to authentication bypass and insufficient session expiration (CVSS 4.2, IBM Langflow OSS)
- [CVE-2026-12765](https://cve.now/CVE-2026-12765.md): Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-90819](https://cve.now/CVE-2026-90819.md): a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting (CVSS 6.9, a2aproject a2a-java)
- [CVE-2026-12766](https://cve.now/CVE-2026-12766.md): Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-12767](https://cve.now/CVE-2026-12767.md): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-13107](https://cve.now/CVE-2026-13107.md): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (CVSS 7.1, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-53714](https://cve.now/CVE-2026-53714.md): Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode (CVSS 7.4, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-13260](https://cve.now/CVE-2026-13260.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53716](https://cve.now/CVE-2026-53716.md): Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit (CVSS 6.5, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-90818](https://cve.now/CVE-2026-90818.md): netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery (CVSS 5.3, netease-youdao LobsterAI)
- [CVE-2026-53715](https://cve.now/CVE-2026-53715.md): Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock (CVSS 5.3, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-81903](https://cve.now/CVE-2026-81903.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon (CVSS 7.0, Concrete CMS)
- [CVE-2026-53719](https://cve.now/CVE-2026-53719.md): Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization (CVSS 6.5, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-13272](https://cve.now/CVE-2026-13272.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 5.4, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-13276](https://cve.now/CVE-2026-13276.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.1, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53718](https://cve.now/CVE-2026-53718.md): Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass (CVSS 6.4, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-13277](https://cve.now/CVE-2026-13277.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 4.7, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53713](https://cve.now/CVE-2026-53713.md): Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure (CVSS 9.1, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-53717](https://cve.now/CVE-2026-53717.md): Envoy Gateway: OCI layer extraction allocates make(\[\]byte, h.Size) from untrusted tar header (CVSS 6.5, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2026-15396](https://cve.now/CVE-2026-15396.md): IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-15412](https://cve.now/CVE-2026-15412.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-54559](https://cve.now/CVE-2026-54559.md): PocketSphinx: Buffer overflows in language and acoustic model loading code (CVSS 6.9, cmusphinx pocketsphinx · pocketsphinx)
- [CVE-2026-54334](https://cve.now/CVE-2026-54334.md): UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor \`ReadCLen\` (CVSS 9.8, theopolis uefi-firmware-parser · uefi-firmware)
- [CVE-2026-54333](https://cve.now/CVE-2026-54333.md): UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable (CVSS 9.8, theopolis uefi-firmware-parser · uefi-firmware)
- [CVE-2026-19816](https://cve.now/CVE-2026-19816.md): PackageKit: dnf5 backend ignores SIMULATE on RepoRemove (CVSS 7.1, PackageKit · Fedora +1)
- [CVE-2026-54247](https://cve.now/CVE-2026-54247.md): Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS (CVSS 4.3, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-54246](https://cve.now/CVE-2026-54246.md): Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication (CVSS 5.7, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-15634](https://cve.now/CVE-2026-15634.md): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-65838](https://cve.now/CVE-2026-65838.md): Skipper: an oversized declared-\`Content-Length\` body still hands OPA an empty \`parsed\_body\`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream (CVSS 8.2, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-55244](https://cve.now/CVE-2026-55244.md): ASTEVAL: Sandbox Escape via BaseException Subclasses (CVSS 5.0, lmfit asteval · asteval)
- [CVE-2026-90816](https://cve.now/CVE-2026-90816.md): FFmpeg Duration hlsproto.c parse\_playlist denial of service (CVSS 5.3, FFmpeg)
- [CVE-2026-15887](https://cve.now/CVE-2026-15887.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2026-54632](https://cve.now/CVE-2026-54632.md): SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) (CVSS 7.5, sipsorcery-org sipsorcery · SIPSorcery)
- [CVE-2026-15955](https://cve.now/CVE-2026-15955.md): IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths (CVSS 7.5, IBM Db2)
- [CVE-2026-16186](https://cve.now/CVE-2026-16186.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2026-54628](https://cve.now/CVE-2026-54628.md): Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode (CVSS 8.6, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-16185](https://cve.now/CVE-2026-16185.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.4, IBM WebSphere Application Server)
- [CVE-2026-82028](https://cve.now/CVE-2026-82028.md): Magistrala \< 1.0.0 SQL Injection via format Parameter in Reader API (CVSS 8.7, absmach magistrala)
- [CVE-2026-50006](https://cve.now/CVE-2026-50006.md): Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode (CVSS 9.1, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-54629](https://cve.now/CVE-2026-54629.md): Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode (CVSS 7.5, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-47253](https://cve.now/CVE-2026-47253.md): Anyquery: Path Traversal in \`clear\_plugin\_cache\` Allows Arbitrary Directory Deletion (CVSS 7.3, julien040 anyquery · github.com/julien040/anyquery)
- [CVE-2026-16187](https://cve.now/CVE-2026-16187.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2026-18119](https://cve.now/CVE-2026-18119.md): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values (CVSS 7.0, Concrete CMS)
- [CVE-2026-54447](https://cve.now/CVE-2026-54447.md): garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store (CVSS 8.4, cyberjunky python-garminconnect · garminconnect)
- [CVE-2026-16188](https://cve.now/CVE-2026-16188.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2026-55209](https://cve.now/CVE-2026-55209.md): resdata insufficiently validates untrusted GRDECL files (CVSS 9.8, equinor resdata · resdata)
- [CVE-2026-16190](https://cve.now/CVE-2026-16190.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 3.1, IBM WebSphere Application Server)
- [CVE-2026-16189](https://cve.now/CVE-2026-16189.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2026-73497](https://cve.now/CVE-2026-73497.md): MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata (CVSS 6.5, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-16335](https://cve.now/CVE-2026-16335.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.1, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16338](https://cve.now/CVE-2026-16338.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 9.9, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16435](https://cve.now/CVE-2026-16435.md): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2026-73496](https://cve.now/CVE-2026-73496.md): MCP Atlassian: Arbitrary server-side file read via attachment upload (CVSS 7.7, sooperset mcp-atlassian · mcp-atlassian)
- [CVE-2026-16432](https://cve.now/CVE-2026-16432.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 7.7, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16428](https://cve.now/CVE-2026-16428.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-55093](https://cve.now/CVE-2026-55093.md): tract-nnef: integer overflow in NNEF \`.dat\` tensor parser yields an out-of-bounds read on model load (CVSS 6.1, sonos tract · tract-nnef)
- [CVE-2026-90815](https://cve.now/CVE-2026-90815.md): FFmpeg Convolution Filter vf\_convolution.c setup\_3x3 out-of-bounds (CVSS 5.3, FFmpeg)
- [CVE-2026-16466](https://cve.now/CVE-2026-16466.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16673](https://cve.now/CVE-2026-16673.md): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (CVSS 8.8, IBM DataStage on Cloud Pak for Data)
- [CVE-2026-16702](https://cve.now/CVE-2026-16702.md): IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference (CVSS 6.5, IBM Db2)
- [CVE-2026-17047](https://cve.now/CVE-2026-17047.md): IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery \[\] (CVSS 5.4, IBM Db2 Mirror for i)
- [CVE-2026-17133](https://cve.now/CVE-2026-17133.md): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (CVSS 7.8, IBM App Connect Enterprise)
- [CVE-2026-17156](https://cve.now/CVE-2026-17156.md): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (CVSS 7.8, IBM App Connect Enterprise)
- [CVE-2026-17463](https://cve.now/CVE-2026-17463.md): IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption (CVSS 6.5, IBM Db2)
- [CVE-2026-17416](https://cve.now/CVE-2026-17416.md): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (CVSS 7.8, IBM App Connect Enterprise)
- [CVE-2026-17467](https://cve.now/CVE-2026-17467.md): Vulnerabilities exists in IBM Cloud Pak for Data System (CVSS 8.2, IBM Cloud Pak for Data System)
- [CVE-2026-17628](https://cve.now/CVE-2026-17628.md): Langflow is affected by improper authentication due to missing password verification in the password reset endpoint (CVSS 5.4, IBM Langflow OSS)
- [CVE-2026-18065](https://cve.now/CVE-2026-18065.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 5.3, IBM i)
- [CVE-2026-18251](https://cve.now/CVE-2026-18251.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 4.3, IBM i)
- [CVE-2026-16148](https://cve.now/CVE-2026-16148.md): Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-16147](https://cve.now/CVE-2026-16147.md): it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption (CVSS 6.8, zephyrproject zephyr)
- [CVE-2026-15924](https://cve.now/CVE-2026-15924.md): Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-90814](https://cve.now/CVE-2026-90814.md): cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-19624](https://cve.now/CVE-2026-19624.md): NetworkManager-l2tp: local privilege escalation via ipsec.conf injection (CVSS 7.8, NetworkManager-l2tp · Fedora)
- [CVE-2026-90813](https://cve.now/CVE-2026-90813.md): cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-82049](https://cve.now/CVE-2026-82049.md): tarfile extraction filters allow file modification and content disclosure via hard link to symlink (CVSS 8.4, Python Software Foundation CPython · libpython +2)
- [CVE-2026-82519](https://cve.now/CVE-2026-82519.md): Really Simple Security \< 9.8.2 Authorization Bypass via profile-page update handler (CVSS 2.3, reallysimpleplugins Really Simple Security)
- [CVE-2026-90812](https://cve.now/CVE-2026-90812.md): cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-15893](https://cve.now/CVE-2026-15893.md): Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-90811](https://cve.now/CVE-2026-90811.md): cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure (CVSS 4.8, cosmicstack-labs mercury-agent)
- [CVE-2026-18151](https://cve.now/CVE-2026-18151.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 4.2, IBM i)
- [CVE-2026-82035](https://cve.now/CVE-2026-82035.md): PyMuPDF 1.28.2 Path Traversal via extract\_objects() Font Branch (CVSS 7.1, PyMuPDF)
- [CVE-2026-90810](https://cve.now/CVE-2026-90810.md): cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization (CVSS 5.3, cosmicstack-labs mercury-agent)
- [CVE-2026-18515](https://cve.now/CVE-2026-18515.md): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (CVSS 4.3, IBM i)
- [CVE-2026-19543](https://cve.now/CVE-2026-19543.md): Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent (CVSS 6.2, IBM Common Licensing)
- [CVE-2026-89023](https://cve.now/CVE-2026-89023.md): ThemeAtelier Domain For Sale \< 3.5.2 Missing Authorization via REST API (CVSS 8.8, ThemeAtelier Domain For Sale)
- [CVE-2026-90809](https://cve.now/CVE-2026-90809.md): HKUDS nanobot ExecTool shell.py ExecTool.\_spawn argument injection (CVSS 6.9, HKUDS nanobot)
- [CVE-2026-59178](https://cve.now/CVE-2026-59178.md): ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade (CVSS 9.8, esphome device-builder · esphome-device-builder)
- [CVE-2026-89021](https://cve.now/CVE-2026-89021.md): MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction (CVSS 6.9, MikroTik RouterOS)
- [CVE-2026-89020](https://cve.now/CVE-2026-89020.md): MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path (CVSS 5.3, MikroTik RouterOS)
- [CVE-2026-77884](https://cve.now/CVE-2026-77884.md): Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure (CVSS 7.1, Brain Trust Gallery - Private Photo Vault)
- [CVE-2026-86830](https://cve.now/CVE-2026-86830.md): Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center (CVSS 7.2, AWS iam-identity-center-team)
- [CVE-2026-90808](https://cve.now/CVE-2026-90808.md): HKUDS nanobot ExecTool shell.py ExecTool.\_spawn incomplete blacklist (CVSS 5.3, HKUDS nanobot)
- [CVE-2026-55832](https://cve.now/CVE-2026-55832.md): Tract: Arbitrary file read via unsanitized ONNX external\_data \`location\` (path traversal) on model load in tract-onnx (CVSS 6.1, sonos tract · tract-onnx)
- [CVE-2026-54181](https://cve.now/CVE-2026-54181.md): backpack/crud: Stored XSS in the color column — the \`@if($column\['escaped'\])\` branches are inverted (CVSS 5.4, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54177](https://cve.now/CVE-2026-54177.md): backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of \`shell.php\` reach the webserver (CVSS 6.6, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54176](https://cve.now/CVE-2026-54176.md): backpack/crud: MyAccountController allows changing the login email without a current-password check (CVSS 6.5, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54180](https://cve.now/CVE-2026-54180.md): backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) (CVSS 7.6, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-91081](https://cve.now/CVE-2026-91081.md): Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint (CVSS 6.9, suitenumerique docs)
- [CVE-2026-91080](https://cve.now/CVE-2026-91080.md): webhook through 2.8.3 Memory Exhaustion via Oversized Request Body (CVSS 8.7, adnanh webhook)
- [CVE-2026-91079](https://cve.now/CVE-2026-91079.md): Huly Platform through 0.7.426 SSRF via Print Service (CVSS 6.3, hcengineering platform)
- [CVE-2026-90946](https://cve.now/CVE-2026-90946.md): DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket (CVSS 8.7, AsyncFuncAI deepwiki-open)
- [CVE-2026-90945](https://cve.now/CVE-2026-90945.md): Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret (CVSS 9.3, crawlab-team crawlab)
- [CVE-2026-90944](https://cve.now/CVE-2026-90944.md): Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse (CVSS 8.8, krayin laravel-crm)
- [CVE-2026-90942](https://cve.now/CVE-2026-90942.md): Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints (CVSS 9.3, casdoor)
- [CVE-2026-57570](https://cve.now/CVE-2026-57570.md): backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation (CVSS 6.5, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54178](https://cve.now/CVE-2026-54178.md): backpack/crud: Arbitrary file deletion via attacker-controlled clear\_\<attr\>\[\] in HasUploadFields::uploadMultipleFilesToDisk (CVSS 8.1, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54182](https://cve.now/CVE-2026-54182.md): backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) (CVSS 8.1, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-54175](https://cve.now/CVE-2026-54175.md): backpack/crud: Unverified password change in MyAccountController via mass assignment (CVSS 7.6, Laravel-Backpack CRUD · backpack/crud)
- [CVE-2026-44162](https://cve.now/CVE-2026-44162.md): fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in \`in\_s3\` (CVSS 2.7, fluent-plugin-s3)
- [CVE-2026-90807](https://cve.now/CVE-2026-90807.md): nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following (CVSS 5.3, nanocoai NanoClaw)
- [CVE-2026-86836](https://cve.now/CVE-2026-86836.md): In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta (CVSS 8.4, Eclipse Foundation Eclipse Ankaios)
- [CVE-2026-57583](https://cve.now/CVE-2026-57583.md): OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source (CVSS 3.3, OpenZeppelin contracts-wizard · @openzeppelin wizard +7)
- [CVE-2026-54723](https://cve.now/CVE-2026-54723.md): devpi: Database contents leak (CVSS 6.5, devpi · devpi-server)
- [CVE-2026-57578](https://cve.now/CVE-2026-57578.md): DotVVM: Missing authorization in AuthorizeActionFilter (CVSS 9.2, riganti dotvvm)
- [CVE-2026-57577](https://cve.now/CVE-2026-57577.md): DotVVM: ReDOS in routing (CVSS 8.2, riganti dotvvm)
- [CVE-2026-57581](https://cve.now/CVE-2026-57581.md): DotVVM: Unrestricted file upload (CVSS 5.3, riganti dotvvm)
- [CVE-2026-73494](https://cve.now/CVE-2026-73494.md): blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser (CVSS 7.4, http4s blaze · org.http4s blaze-http\_2.13 +5)
- [CVE-2026-53752](https://cve.now/CVE-2026-53752.md): docx4j: Stack Overflow via Cyclic \`w:basedOn\` Style Chain leads to Denial of Service (CVSS 7.5, plutext docx4j · org.docx4j docx4j-core +1)
- [CVE-2026-90806](https://cve.now/CVE-2026-90806.md): DjangoCRM django-crm Bulk Case Update bulk\_views.py BulkUpdateCasesView authorization (CVSS 5.3, DjangoCRM django-crm)
- [CVE-2026-53659](https://cve.now/CVE-2026-53659.md): http4k: Unbounded gzip decompression in \`ServerFilters.GZip\` / \`RequestFilters.GunZip\` allowed memory-exhaustion DoS (CVSS 7.5, http4k · org.http4k:http4k-core)
- [CVE-2026-85892](https://cve.now/CVE-2026-85892.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Edge)
- [CVE-2026-47256](https://cve.now/CVE-2026-47256.md): OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token (CVSS 5.3, open-telemetry opentelemetry-collector-contrib · github.com…)
- [CVE-2026-55091](https://cve.now/CVE-2026-55091.md): flat-to-nested: Prototype pollution in flat-to-nested convert() via \_\_proto\_\_ parent/id key (CVSS 7.5, joaonuno flat-to-nested-js · flat-to-nested)
- [CVE-2026-54150](https://cve.now/CVE-2026-54150.md): next-video: Unauthenticated arbitrary file read via /api/video request handler (CVSS 6.9, muxinc next-video · next-video)
- [CVE-2026-55866](https://cve.now/CVE-2026-55866.md): SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected (CVSS 3.7, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2026-55847](https://cve.now/CVE-2026-55847.md): Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering (CVSS 6.1, allure-framework allure2 · io.qameta.allure allure-gener… +1)
- [CVE-2026-55846](https://cve.now/CVE-2026-55846.md): Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read (CVSS 6.2, allure-framework allure2 · io.qameta.allure:allure-commandl…)
- [CVE-2026-85921](https://cve.now/CVE-2026-85921.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Windows)
- [CVE-2026-19542](https://cve.now/CVE-2026-19542.md): Stack-based out-of-bounds write in tdelete during tree rebalancing (CVSS 5.6, The GNU C Library glibc)
- [CVE-2026-53495](https://cve.now/CVE-2026-53495.md): containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service (CVSS 6.8, containerd · github.com/containerd/containerd/v2 +1)
- [CVE-2026-54567](https://cve.now/CVE-2026-54567.md): Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) (CVSS 7.5, jugmac00 flask-reuploaded · flask-reuploaded)
- [CVE-2026-49400](https://cve.now/CVE-2026-49400.md): October CMS: PHP Object Injection via Backend Widget Session Storage (CVSS 3.3, octobercms october · october/system)
- [CVE-2026-90805](https://cve.now/CVE-2026-90805.md): subhajitkhan online-clinic-management-system doctorlogin.php sql injection (CVSS 6.9, subhajitkhan online-clinic-management-system)
- [CVE-2026-70658](https://cve.now/CVE-2026-70658.md): pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier (CVSS 7.4, pay-rails pay · pay)
- [CVE-2026-49250](https://cve.now/CVE-2026-49250.md): Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields (CVSS 8.7, edmundhung conform · @conform-to/dom)
- [CVE-2026-91021](https://cve.now/CVE-2026-91021.md): CVE-2026-91021 (CVSS 5.4, Trilium Trillium Notes)
- [CVE-2026-54087](https://cve.now/CVE-2026-54087.md): EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField (CVSS 7.6, EasyCorp EasyAdminBundle · easycorp/easyadmin-bundle)
- [CVE-2026-34151](https://cve.now/CVE-2026-34151.md): XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ (CVSS 8.2, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2026-19499](https://cve.now/CVE-2026-19499.md): Buffer overflow in strfmon and strfmon\_l right-justification padding (CVSS 7.7, The GNU C Library glibc)
- [CVE-2026-55253](https://cve.now/CVE-2026-55253.md): LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure (CVSS 7.7, langchain-ai langchain-mongodb · langchain-ai langgraph-… +3)
- [CVE-2026-46696](https://cve.now/CVE-2026-46696.md): October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls (CVSS 3.3, octobercms system · october/system)
- [CVE-2026-50157](https://cve.now/CVE-2026-50157.md): Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK (CVSS 6.5, auth0 symfony · auth0/symfony)
- [CVE-2026-50276](https://cve.now/CVE-2026-50276.md): dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-rb · datadog)
- [CVE-2026-50270](https://cve.now/CVE-2026-50270.md): dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS (CVSS 7.5, DataDog dd-trace-java · com.datadoghq dd-java-agent +1)
- [CVE-2026-90804](https://cve.now/CVE-2026-90804.md): GNU Binutils Eh Frame Section elf-eh-frame.c \_bfd\_elf\_write\_section\_eh\_frame buffer overflow (CVSS 2.4, GNU Binutils)
- [CVE-2026-59960](https://cve.now/CVE-2026-59960.md): Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core (CVSS 7.5, argos-ci argos-javascript · @argos-ci/core)
- [CVE-2026-55102](https://cve.now/CVE-2026-55102.md): hashi-vault-js: Vault token and secret values exposed in thrown errors (CVSS 5.8, kyndryl-open-source hashi-vault-js · hashi-vault-js)
- [CVE-2026-55837](https://cve.now/CVE-2026-55837.md): dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens (CVSS 6.8, dbt-labs dbt-mcp · dbt-mcp)
- [CVE-2026-55073](https://cve.now/CVE-2026-55073.md): WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF (CVSS 6.2, Kozea WeasyPrint · weasyprint)
- [CVE-2026-57579](https://cve.now/CVE-2026-57579.md): Alchemy: Unauthenticated nested page API leaks restricted & unpublished content (CVSS 7.5, AlchemyCMS alchemy\_cms · alchemy\_cms)
- [CVE-2026-55416](https://cve.now/CVE-2026-55416.md): Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization (CVSS 8.8, pimcore · pimcore/pimcore)
- [CVE-2026-55072](https://cve.now/CVE-2026-55072.md): Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name (CVSS 8.5, pimcore · pimcore/pimcore)
- [CVE-2026-55451](https://cve.now/CVE-2026-55451.md): gettext-converter: Prototype pollution in js2i18next() via crafted translation keys (CVSS 8.3, locize gettext-converter · gettext-converter)
- [CVE-2026-90803](https://cve.now/CVE-2026-90803.md): GNU Binutils ld elf64-x86-64.c elf\_x86\_64\_relocate\_section buffer overflow (CVSS 4.8, GNU Binutils)
- [CVE-2026-90802](https://cve.now/CVE-2026-90802.md): GNU Binutils ld libbfd.c bfd\_putl64 null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-90801](https://cve.now/CVE-2026-90801.md): GNU Binutils ld cache.c cache\_bwrite buffer overflow (CVSS 4.8, GNU Binutils)
- [CVE-2026-54452](https://cve.now/CVE-2026-54452.md): safeurl: Missing IPv6 CIDR Ranges in Blocklist (CVSS 6.3, doyensec safeurl · github.com/doyensec/safeurl)
- [CVE-2026-15923](https://cve.now/CVE-2026-15923.md): Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max\_blk\_size (CVSS 4.6, zephyrproject zephyr)
- [CVE-2026-53496](https://cve.now/CVE-2026-53496.md): ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes (CVSS 5.3, mattiasw ExifReader · exifreader)
- [CVE-2026-84445](https://cve.now/CVE-2026-84445.md): gRPC-Go: Denial of Service (DoS) via crash due to missing \`:authority\` and \`Host\` headers in the xDS servers (CVSS 8.7, grpc-go · google.golang.org/grpc)
- [CVE-2026-76442](https://cve.now/CVE-2026-76442.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 7.5, Cisco Secure Email)
- [CVE-2026-76461](https://cve.now/CVE-2026-76461.md): Cisco Secure Email Gateway SQL Injection Vulnerability (CVSS 9.8, KEV, Cisco Secure Email)
- [CVE-2026-54156](https://cve.now/CVE-2026-54156.md): node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS (CVSS 7.5, node-opcua)
- [CVE-2026-76443](https://cve.now/CVE-2026-76443.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email)
- [CVE-2026-76440](https://cve.now/CVE-2026-76440.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email)
- [CVE-2026-20353](https://cve.now/CVE-2026-20353.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email)
- [CVE-2026-76441](https://cve.now/CVE-2026-76441.md): Cisco Secure Email Gateway Security Hardening Release (CVSS 9.8, Cisco Secure Email and Web Manager)
- [CVE-2026-54155](https://cve.now/CVE-2026-54155.md): node-opcua: Missing nonce verification in UserNameIdentityToken authentication (CVSS 7.7, node-opcua)
- [CVE-2026-57497](https://cve.now/CVE-2026-57497.md): webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules (CVSS 5.3, quic-go webtransport-go · github.com/quic-go/webtransport-go)
- [CVE-2026-61701](https://cve.now/CVE-2026-61701.md): Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution (CVSS 8.8, cesargb laravel-magiclink · cesargb/laravel-magiclink)
- [CVE-2026-90796](https://cve.now/CVE-2026-90796.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-53708](https://cve.now/CVE-2026-53708.md): ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (\`/admin/gateways/test\`) (CVSS 6.6, IBM mcp-context-forge · IBM mcp-contextforge-gateway +1)
- [CVE-2026-90996](https://cve.now/CVE-2026-90996.md): Sssd: sssd: denial of service in nss responder via crafted zero-length requests (CVSS 4.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-90995](https://cve.now/CVE-2026-90995.md): Sssd: sssd: local denial of service due to null pointer dereference in pam responder (CVSS 5.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-90994](https://cve.now/CVE-2026-90994.md): Sssd: sssd: denial of service via malformed pam v1 requests (CVSS 4.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-55795](https://cve.now/CVE-2026-55795.md): Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass (CVSS 6.9, craftcms commerce · craftcms/commerce)
- [CVE-2026-4103](https://cve.now/CVE-2026-4103.md): Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution (CVSS 6.4, WSO2 API Control Plane · WSO2 API Manager)
- [CVE-2026-55235](https://cve.now/CVE-2026-55235.md): langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication (CVSS 5.9, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-81301](https://cve.now/CVE-2026-81301.md): Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access (CVSS 8.5, Ekia File Manager)
- [CVE-2026-55236](https://cve.now/CVE-2026-55236.md): langgraph-api: Incomplete assistant authorization in LangGraph Server run creation (CVSS 5.9, langchain-ai langgraph-api · langgraph-api)
- [CVE-2026-90795](https://cve.now/CVE-2026-90795.md): itsourcecode Loan Management System navbar.php cross site scripting (CVSS 5.3, itsourcecode Loan Management System)
- [CVE-2026-54529](https://cve.now/CVE-2026-54529.md): SQLAdmin: Unvalidated sortBy parameter in \`ModelView\` bypasses \`column\_sortable\_list\` (CVSS 5.3, smithyhq sqladmin · sqladmin)
- [CVE-2026-90943](https://cve.now/CVE-2026-90943.md): parallax filament-comments through 3.0.0 Stored XSS via Comment Body (CVSS 8.7, parallax filament-comments)
- [CVE-2026-61534](https://cve.now/CVE-2026-61534.md): Yayson: Prototype pollution in the Store/LegacyStore deserialization (CVSS 9.1, confetti yayson · yayson)
- [CVE-2026-47701](https://cve.now/CVE-2026-47701.md): OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth (CVSS 7.7, open-telemetry opentelemetry-operator · github.com/open-tel…)
- [CVE-2026-88819](https://cve.now/CVE-2026-88819.md): In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. (CVSS 6.3, Eclipse Foundation Eclipse Data Plane Core)
- [CVE-2026-54541](https://cve.now/CVE-2026-54541.md): Nimiq: Panic in TrieProof::verify via child\_index unwrap on equal-length keys (CVSS 3.7, nimiq core-rs-albatross · nimiq-primitives)
- [CVE-2026-90794](https://cve.now/CVE-2026-90794.md): GPAC MP4Box vrml\_tools.c gf\_sg\_script\_load use after free (CVSS 5.3, GPAC)
- [CVE-2026-54542](https://cve.now/CVE-2026-54542.md): Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof (CVSS 3.7, nimiq core-rs-albatross · nimiq-primitives)
- [CVE-2025-24890](https://cve.now/CVE-2025-24890.md): gix-sec safe.directory protections absent for elevated administrators (CVSS 6.8, GitoxideLabs gitoxide · gix-sec)
- [CVE-2026-90463](https://cve.now/CVE-2026-90463.md): Sssd: local oob read in nss service request parsers (\`sss\_nss\_protocol\_parse\_svc\_name\` / \`sss\_nss\_protocol\_parse\_svc\_port\`) (CVSS 4.0, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-90947](https://cve.now/CVE-2026-90947.md): Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-90793](https://cve.now/CVE-2026-90793.md): GPAC MP4Box base\_scenegraph.c gf\_node\_get\_name use after free (CVSS 5.3, GPAC)
- [CVE-2026-57145](https://cve.now/CVE-2026-57145.md): PraisonAI: Arbitrary File Read/Write via \`multiedit\` Tool Without Path Validation (CVSS 9.1, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57132](https://cve.now/CVE-2026-57132.md): PraisonAI: PRAISONAI\_CALL\_AUTH=disabled environment variable unconditionally disables authentication (CVSS 8.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57131](https://cve.now/CVE-2026-57131.md): praisonai: Jobs API exposes agent-execution endpoints with no authentication (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57124](https://cve.now/CVE-2026-57124.md): PraisonAI UI MCP connect endpoint allows unauthenticated local command execution (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57122](https://cve.now/CVE-2026-57122.md): PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) (CVSS 8.6, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57127](https://cve.now/CVE-2026-57127.md): praisonai: recipe serve auth middleware silently disables itself when no secret is set (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-56839](https://cve.now/CVE-2026-56839.md): PraisonAI Code agent tools fail open without a workspace boundary (CVSS 7.3, MervinPraison PraisonAI · praisonai)
- [CVE-2026-90792](https://cve.now/CVE-2026-90792.md): GPAC MP4Box base\_scenegraph.c gf\_node\_list\_get\_child null pointer dereference (CVSS 5.3, GPAC)
- [CVE-2026-57119](https://cve.now/CVE-2026-57119.md): PraisonAI: Unauthenticated Local File Inclusion via agent\_file path in the Jobs API (CVSS 7.5, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57129](https://cve.now/CVE-2026-57129.md): PraisonAI: Arbitrary File Read via \`@file:\` Mention Path Traversal (CVSS 7.5, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-57126](https://cve.now/CVE-2026-57126.md): praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS (CVSS 8.5, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-57120](https://cve.now/CVE-2026-57120.md): PraisonAI: execute\_code sandbox bypass: str.format C-level attribute access reads every blocklisted dunder (CVSS 6.5, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-59570](https://cve.now/CVE-2026-59570.md): Android ZCC denial of service (CVSS 7.5, Zscaler Client Connector)
- [CVE-2026-57123](https://cve.now/CVE-2026-57123.md): PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in (CVSS 9.8, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-90791](https://cve.now/CVE-2026-90791.md): GPAC MP4Box base\_scenegraph.c gf\_node\_unregister use after free (CVSS 5.3, GPAC)
- [CVE-2026-59569](https://cve.now/CVE-2026-59569.md): Android ZCC VPN API method privilege escalation (CVSS 8.1, Zscaler Client Connector)
- [CVE-2026-25687](https://cve.now/CVE-2026-25687.md): ZCC race condition in ZPA tunnel handler (CVSS 8.1, Zscaler Client Connector)
- [CVE-2026-90790](https://cve.now/CVE-2026-90790.md): a2aproject a2a-python Push Notification Sender base\_push\_notification\_sender.py \_dispatch\_notification server-side request forgery (CVSS 5.3, a2aproject a2a-python)
- [CVE-2026-57130](https://cve.now/CVE-2026-57130.md): PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters (CVSS 8.1, MervinPraison praisonaiagents · praisonaiagents)
- [CVE-2026-57128](https://cve.now/CVE-2026-57128.md): PraisonAI: Unauthenticated Event Injection via SSE \`/publish\` Endpoint (CVSS 4.3, MervinPraison PraisonAI · praisonaiagents)
- [CVE-2026-57115](https://cve.now/CVE-2026-57115.md): PraisonAI: SpiderTools redirect-target SSRF protection bypass (CVSS 6.5, MervinPraison PraisonAI · MervinPraison praisonaiagents +1)
- [CVE-2026-57125](https://cve.now/CVE-2026-57125.md): PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonaiagents +2)
- [CVE-2026-82427](https://cve.now/CVE-2026-82427.md): Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name (CVSS 7.8, Apache Software Foundation Apache Storm Nimbus)
- [CVE-2026-82428](https://cve.now/CVE-2026-82428.md): Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys (CVSS 8.8, Apache Software Foundation Apache Storm Client)
- [CVE-2026-82429](https://cve.now/CVE-2026-82429.md): Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher (CVSS 7.8, Apache Software Foundation Apache Storm Worker Launcher)
- [CVE-2026-82430](https://cve.now/CVE-2026-82430.md): Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant (CVSS 7.8, Apache Software Foundation Apache Storm Worker Launcher)
- [CVE-2026-90789](https://cve.now/CVE-2026-90789.md): itsourcecode Leave Management System login.php sql injection (CVSS 6.9, itsourcecode Leave Management System)
- [CVE-2026-82431](https://cve.now/CVE-2026-82431.md): Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users (CVSS 9.8, Apache Software Foundation Apache Storm Client)
- [CVE-2026-82433](https://cve.now/CVE-2026-82433.md): Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI (CVSS 6.5, Apache Software Foundation Apache Storm Nimbus · Apache Sof…)
- [CVE-2026-82432](https://cve.now/CVE-2026-82432.md): Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides (CVSS 8.1, Apache Software Foundation Apache Storm Nimbus)
- [CVE-2026-82019](https://cve.now/CVE-2026-82019.md): TripleLift video-bundle.js DOM-based XSS via postMessage (CVSS 2.3, TripleLift video-bundle.js)
- [CVE-2026-82434](https://cve.now/CVE-2026-82434.md): Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs (CVSS 10.0, Apache Software Foundation Apache Storm Nimbus · Apache Sof…)
- [CVE-2026-12985](https://cve.now/CVE-2026-12985.md): Mattermost DCR redirect URI allowlist bypass via improper URL component validation (CVSS 6.8, Mattermost)
- [CVE-2026-15600](https://cve.now/CVE-2026-15600.md): SQL Injection in Alior Bank raty PrestaShop module (CVSS 8.6, Alior Bank raty)
- [CVE-2026-7848](https://cve.now/CVE-2026-7848.md): SQL Injection in Alior Bank raty PrestaShop module (CVSS 8.6, Alior Bank raty)
- [CVE-2026-82435](https://cve.now/CVE-2026-82435.md): Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder (CVSS 9.8, Apache Software Foundation Apache Storm Worker)
- [CVE-2026-82437](https://cve.now/CVE-2026-82437.md): Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer (CVSS 4.3, Apache Software Foundation Apache Storm Logviewer)
- [CVE-2026-82426](https://cve.now/CVE-2026-82426.md): Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location (CVSS 6.5, Apache Software Foundation Apache Storm Nimbus)
- [CVE-2026-82438](https://cve.now/CVE-2026-82438.md): Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins (CVSS 8.1, Apache Software Foundation Apache Storm Webapp)
- [CVE-2026-90788](https://cve.now/CVE-2026-90788.md): magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection (CVSS 5.1, magicblack MacCMS10)
- [CVE-2026-82439](https://cve.now/CVE-2026-82439.md): Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC (CVSS 9.8, Apache Software Foundation Apache Storm DRPC)
- [CVE-2026-82920](https://cve.now/CVE-2026-82920.md): Mattermost ABAC parent policy bypass via policy update endpoint (CVSS 5.5, Mattermost)
- [CVE-2026-82441](https://cve.now/CVE-2026-82441.md): Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys (CVSS 9.1, Apache Software Foundation Apache Storm Nimbus)
- [CVE-2026-90941](https://cve.now/CVE-2026-90941.md): novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint (CVSS 4.3, 201206030 novel-plus)
- [CVE-2026-90940](https://cve.now/CVE-2026-90940.md): novel-plus through 5.3.3 Default Cache Management Password in the Front Portal (CVSS 5.3, 201206030 novel-plus)
- [CVE-2026-90939](https://cve.now/CVE-2026-90939.md): novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint (CVSS 6.5, 201206030 novel-plus)
- [CVE-2026-84179](https://cve.now/CVE-2026-84179.md): Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page (CVSS 6.5, Apache Software Foundation Apache Storm Nimbus · Apache Sof…)
- [CVE-2026-86348](https://cve.now/CVE-2026-86348.md): MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process (CVSS 4.3, Mattermost)
- [CVE-2026-86349](https://cve.now/CVE-2026-86349.md): Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting (CVSS 4.3, Mattermost)
- [CVE-2026-90787](https://cve.now/CVE-2026-90787.md): Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management (CVSS 6.9, Soarkey StudentManagement)
- [CVE-2026-90786](https://cve.now/CVE-2026-90786.md): Dvidelabs flatcc Duplicate Symbol semantics.c align\_order\_members assertion (CVSS 6.9, Dvidelabs flatcc)
- [CVE-2026-73191](https://cve.now/CVE-2026-73191.md): Apache Syncope: CAS service URL injection via Forwarded HTTP headers (CVSS 6.1, Apache Software Foundation Apache Syncope)
- [CVE-2026-7208](https://cve.now/CVE-2026-7208.md): Yealink SIP-T33G \< 124.87.0.0 Race Condition via Diagnostic File Deletion (CVSS 6.0, Yealink SIP-T33G)
- [CVE-2026-73195](https://cve.now/CVE-2026-73195.md): Apache Syncope: CSV export spreadsheet formula injection (CVSS 7.3, Apache Software Foundation Apache Syncope)
- [CVE-2026-73236](https://cve.now/CVE-2026-73236.md): Apache Syncope: Cross-Realm authorization bypass in delegated administration (CVSS 7.5, Apache Software Foundation Apache Syncope)
- [CVE-2026-90961](https://cve.now/CVE-2026-90961.md): MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials (CVSS 9.3, MISP)
- [CVE-2026-90949](https://cve.now/CVE-2026-90949.md): Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-90948](https://cve.now/CVE-2026-90948.md): Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2026-90785](https://cve.now/CVE-2026-90785.md): Dvidelabs flatcc Struct Analysis semantics.c analyze\_struct assertion (CVSS 6.9, Dvidelabs flatcc)
- [CVE-2026-73370](https://cve.now/CVE-2026-73370.md): Apache Syncope: Cross-Realm boundaries reconciliation bypass (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-73178](https://cve.now/CVE-2026-73178.md): Apache Syncope: JWT Access Token takeover (CVSS 7.5, Apache Software Foundation Apache Syncope)
- [CVE-2026-90957](https://cve.now/CVE-2026-90957.md): MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures (CVSS 5.1, MISP)
- [CVE-2026-90784](https://cve.now/CVE-2026-90784.md): Dvidelabs flatcc semantics.c fb\_clear\_parser memory leak (CVSS 6.9, Dvidelabs flatcc)
- [CVE-2026-78299](https://cve.now/CVE-2026-78299.md): In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract f (CVSS 9.1, Eclipse Foundation Eclipse Embedded CDT)
- [CVE-2026-73470](https://cve.now/CVE-2026-73470.md): Apache Syncope: Delegating users can grant unowned Roles (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-73579](https://cve.now/CVE-2026-73579.md): Apache Syncope: Non-recursive Any search could skip Realms restrictions (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-75015](https://cve.now/CVE-2026-75015.md): Apache Syncope: Nested secrets leak cleartext into audit records readable (CVSS 4.9, Apache Software Foundation Apache Syncope)
- [CVE-2026-75030](https://cve.now/CVE-2026-75030.md): Apache Syncope: Incomplete authorization checks for Group members deprovisioning (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-77051](https://cve.now/CVE-2026-77051.md): Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-73668](https://cve.now/CVE-2026-73668.md): Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-77147](https://cve.now/CVE-2026-77147.md): Apache Syncope: Groovy Sandbox escape for empty CommandArgs (CVSS 6.5, Apache Software Foundation Apache Syncope)
- [CVE-2026-90938](https://cve.now/CVE-2026-90938.md): LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket (CVSS 8.8, langbot-app LangBot)
- [CVE-2026-90937](https://cve.now/CVE-2026-90937.md): froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL (CVSS 9.4, froxlor)
- [CVE-2026-90936](https://cve.now/CVE-2026-90936.md): Froxlor before 2.3.7 Information Disclosure via customer\_email.php (CVSS 5.3, froxlor · froxlor/froxlor)
- [CVE-2026-90935](https://cve.now/CVE-2026-90935.md): Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API (CVSS 5.3, froxlor · froxlor/froxlor)
- [CVE-2026-90934](https://cve.now/CVE-2026-90934.md): EspoCRM before 10.0.4 Field-level Security Bypass via Attendees (CVSS 8.7, espocrm)
- [CVE-2026-90933](https://cve.now/CVE-2026-90933.md): laradashboard through 1.2.2 Missing Authorization via License API (CVSS 7.1, laradashboard)
- [CVE-2026-90932](https://cve.now/CVE-2026-90932.md): LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE (CVSS 8.6, laradashboard)
- [CVE-2026-90931](https://cve.now/CVE-2026-90931.md): LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload (CVSS 5.1, laradashboard)
- [CVE-2026-90930](https://cve.now/CVE-2026-90930.md): File Browser through 2.63.23 Path Traversal via Symlink Alias (CVSS 7.6, filebrowser)
- [CVE-2026-90929](https://cve.now/CVE-2026-90929.md): File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup (CVSS 7.2, filebrowser)
- [CVE-2026-90928](https://cve.now/CVE-2026-90928.md): File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint (CVSS 7.1, filebrowser)
- [CVE-2026-90927](https://cve.now/CVE-2026-90927.md): filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message (CVSS 7.1, filebrowser)
- [CVE-2024-58383](https://cve.now/CVE-2024-58383.md): Froxlor before 2.2.0 Insecure File Permissions mysql.conf (CVSS 8.4, froxlor · froxlor/froxlor)
- [CVE-2026-77181](https://cve.now/CVE-2026-77181.md): Apache Syncope: ClientApp update entitlement not effective (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-90716](https://cve.now/CVE-2026-90716.md): marcobambini Gravity Number gravity\_parser.c parse\_number\_expression out-of-bounds (CVSS 5.1, marcobambini Gravity)
- [CVE-2026-90955](https://cve.now/CVE-2026-90955.md): MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load (CVSS 4.6, MISP)
- [CVE-2026-77883](https://cve.now/CVE-2026-77883.md): Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist (CVSS 4.9, Apache Software Foundation Apache Syncope)
- [CVE-2026-90715](https://cve.now/CVE-2026-90715.md): marcobambini Gravity udp json-parser gravity\_json.c integer overflow (CVSS 6.9, marcobambini Gravity)
- [CVE-2026-78318](https://cve.now/CVE-2026-78318.md): Apache Syncope: Unauthenticated reflected XSS in Console and Enduser (CVSS 6.1, Apache Software Foundation Apache Syncope)
- [CVE-2026-78330](https://cve.now/CVE-2026-78330.md): Apache Syncope: Privilege escalation for admin user via JWT authentication (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-78336](https://cve.now/CVE-2026-78336.md): Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user (CVSS 7.5, Apache Software Foundation Apache Syncope)
- [CVE-2026-90714](https://cve.now/CVE-2026-90714.md): marcobambini Gravity JSON parser gravity\_json.c memory corruption (CVSS 5.3, marcobambini Gravity)
- [CVE-2026-12258](https://cve.now/CVE-2026-12258.md): Inadequate access control in the Hiperdino REST API (CVSS 9.2, Hiperdino REST API)
- [CVE-2026-90713](https://cve.now/CVE-2026-90713.md): vllm-project vLLM tiktoken vocab File mod.rs new denial of service (CVSS 4.8, vllm-project vLLM)
- [CVE-2026-90712](https://cve.now/CVE-2026-90712.md): Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service (CVSS 5.3, Gitlawb openclaude)
- [CVE-2026-90919](https://cve.now/CVE-2026-90919.md): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization (CVSS 9.3, ModelTC LightLLM)
- [CVE-2026-90710](https://cve.now/CVE-2026-90710.md): taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery (CVSS 6.9, taisan tarzan-cms)
- [CVE-2026-21391](https://cve.now/CVE-2026-21391.md): Improper Claim Validation in PingAM OIDC Provider (CVSS 9.5, Ping Identity PingAM)
- [CVE-2026-90709](https://cve.now/CVE-2026-90709.md): Yot CMS Admin Console admin.php eval code injection (CVSS 5.1, Yot CMS)
- [CVE-2026-79701](https://cve.now/CVE-2026-79701.md): Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 (CVSS 6.9, joomshaper.com SP Page Builder (Pro) extension for Joomla)
- [CVE-2026-81566](https://cve.now/CVE-2026-81566.md): Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 5.1, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-90708](https://cve.now/CVE-2026-90708.md): Yot CMS Cookie global.php login sql injection (CVSS 6.9, Yot CMS)
- [CVE-2026-81565](https://cve.now/CVE-2026-81565.md): Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 6.9, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-79700](https://cve.now/CVE-2026-79700.md): Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4 - 6.9.0 (CVSS 6.9, joomshaper.com SP Page Builder (Pro) extension for Joomla)
- [CVE-2026-81564](https://cve.now/CVE-2026-81564.md): Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 (CVSS 7.0, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-78375](https://cve.now/CVE-2026-78375.md): Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 (CVSS 8.6, joomshaper.com SP Page Builder (Free and Pro) extension for…)
- [CVE-2026-10556](https://cve.now/CVE-2026-10556.md): Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. (CVSS 5.3, Mattermost)
- [CVE-2026-82232](https://cve.now/CVE-2026-82232.md): Apache Syncope: SQL injection via sort parameter in Task search (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-90707](https://cve.now/CVE-2026-90707.md): Open5GS Old AMF Discovery Fallback nnrf-handler.c amf\_nnrf\_try\_old\_amf\_discovery\_fallback use after free (CVSS 6.9, Open5GS)
- [CVE-2026-13417](https://cve.now/CVE-2026-13417.md): Boards plugin denial of service via unvalidated block fields.properties (CVSS 4.3, Mattermost)
- [CVE-2026-86460](https://cve.now/CVE-2026-86460.md): Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence (CVSS 9.8, Apache Software Foundation Apache Syncope)
- [CVE-2026-9812](https://cve.now/CVE-2026-9812.md): Missing property field ownership validation in Playbooks run property update endpoint (CVSS 6.5, Mattermost)
- [CVE-2026-20773](https://cve.now/CVE-2026-20773.md): Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint (CVSS 8.5, Ping Identity PingFederate)
- [CVE-2026-87779](https://cve.now/CVE-2026-87779.md): Apache Syncope: AES Secret Key disclosure via log output (CVSS 7.5, Apache Software Foundation Apache Syncope)
- [CVE-2026-8821](https://cve.now/CVE-2026-8821.md): Playbooks run owner channel membership permission bypass (CVSS 7.1, Mattermost)
- [CVE-2026-5132](https://cve.now/CVE-2026-5132.md): Unbounded zlib decompression in Calls SDP WebSocket messages (CVSS 6.5, Mattermost)
- [CVE-2026-15814](https://cve.now/CVE-2026-15814.md): Uploading a crafted image causes excessive memory allocation in the Mattermost Server (CVSS 6.5, Mattermost)
- [CVE-2026-87785](https://cve.now/CVE-2026-87785.md): Apache Syncope: JWT subject spoofing (CVSS 9.1, Apache Software Foundation Apache Syncope)
- [CVE-2026-90891](https://cve.now/CVE-2026-90891.md): ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access Control (CVSS 6.8, ASRock Polychrome SYNC/RGB for MB · ASRock Polychrome SYNC/…)
- [CVE-2026-10542](https://cve.now/CVE-2026-10542.md): Playbooks channel action update validation issue (CVSS 5.0, Mattermost)
- [CVE-2026-90890](https://cve.now/CVE-2026-90890.md): ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference (CVSS 6.8, ASRock Polychrome SYNC/RGB for MB · ASRock Polychrome SYNC/…)
- [CVE-2026-14344](https://cve.now/CVE-2026-14344.md): Inconsistent authorization checks in Mattermost Boards endpoints (CVSS 4.3, Mattermost)
- [CVE-2026-12882](https://cve.now/CVE-2026-12882.md): Mattermost Markdown autolink parsing denial of service (CVSS 4.3, Mattermost)
- [CVE-2026-90706](https://cve.now/CVE-2026-90706.md): D-Link DWR-M921 formWsc os command injection (CVSS 5.1, D-Link DWR-M921)
- [CVE-2026-11993](https://cve.now/CVE-2026-11993.md): Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion (CVSS 4.3, Mattermost)
- [CVE-2026-89180](https://cve.now/CVE-2026-89180.md): Thinking Software Technology｜EFence - SQL Injection (CVSS 8.7, Thinking Software Technology EFence)
- [CVE-2026-14259](https://cve.now/CVE-2026-14259.md): Board archive import bypasses team board creation permissions (CVSS 4.3, Mattermost)
- [CVE-2026-87802](https://cve.now/CVE-2026-87802.md): Apache Syncope: SRA OAuth2 JWT signature verification bypass (CVSS 9.1, Apache Software Foundation Apache Syncope)
- [CVE-2026-90898](https://cve.now/CVE-2026-90898.md): Bifrost unauthenticated remote code execution via MCP stdio client registration (CVSS 9.8, maximhq Bifrost)
- [CVE-2026-90705](https://cve.now/CVE-2026-90705.md): D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection (CVSS 5.1, D-Link DWR-M921)
- [CVE-2026-68570](https://cve.now/CVE-2026-68570.md): Apache Doris: Authorization bypass leading to unauthorized data access (CVSS 6.5, Apache Software Foundation Apache Doris)
- [CVE-2026-90704](https://cve.now/CVE-2026-90704.md): D-Link DWR-M921 formDiskPartition system command injection (CVSS 5.1, D-Link DWR-M921)
- [CVE-2026-72524](https://cve.now/CVE-2026-72524.md): Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables (CVSS 8.8, Apache Software Foundation Apache Doris)
- [CVE-2026-90894](https://cve.now/CVE-2026-90894.md): Parallels Desktop local privilege escalation via appliance extract argument injection (CVSS 7.8, Parallels Desktop for Mac)
- [CVE-2026-90703](https://cve.now/CVE-2026-90703.md): D-Link DWR-M921 formDiskCreateShare system os command injection (CVSS 9.4, D-Link DWR-M921)
- [CVE-2026-90895](https://cve.now/CVE-2026-90895.md): MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection (CVSS 8.4, MISP)
- [CVE-2026-90702](https://cve.now/CVE-2026-90702.md): D-Link DWR-M921 formDiskFormat system os command injection (CVSS 9.4, D-Link DWR-M921)
- [CVE-2026-90701](https://cve.now/CVE-2026-90701.md): subhajitkhan online-clinic-management-system listdoctor.php sql injection (CVSS 6.9, subhajitkhan online-clinic-management-system)
- [CVE-2026-90893](https://cve.now/CVE-2026-90893.md): MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints (CVSS 5.1, MISP)
- [CVE-2026-90700](https://cve.now/CVE-2026-90700.md): itsourcecode Sales and Inventory System pro\_edit1.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-88932](https://cve.now/CVE-2026-88932.md): multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads (CVSS 5.3, multer)
- [CVE-2026-90699](https://cve.now/CVE-2026-90699.md): D-Link DWR-M920 formPinManageSetup sub\_41E60C os command injection (CVSS 9.4, D-Link DWR-M920)
- [CVE-2026-90698](https://cve.now/CVE-2026-90698.md): memcached mcmc Tokenizer proto\_text.c try\_read\_command\_asciiauth out-of-bounds (CVSS 6.9, memcached)
- [CVE-2026-90697](https://cve.now/CVE-2026-90697.md): SourceCodester Inventory Management System invoice.php authorization (CVSS 5.3, SourceCodester Inventory Management System)
- [CVE-2026-89321](https://cve.now/CVE-2026-89321.md): Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry (CVSS 4.3, Eclipse Foundation Eclipse OpenVSX)
- [CVE-2026-90696](https://cve.now/CVE-2026-90696.md): SourceCodester Inventory Management System Product Management products\_handler.php cross site scripting (CVSS 5.1, SourceCodester Inventory Management System)
- [CVE-2026-90695](https://cve.now/CVE-2026-90695.md): SourceCodester Inventory Management System Vendor Management vendors\_handler.php cross site scripting (CVSS 5.1, SourceCodester Inventory Management System)
- [CVE-2026-90694](https://cve.now/CVE-2026-90694.md): SourceCodester Inventory Management System Customer Management customers\_handler.php cross site scripting (CVSS 5.1, SourceCodester Inventory Management System)
- [CVE-2026-12518](https://cve.now/CVE-2026-12518.md): Local privilege escalation in the Logi Options+ updater service on Windows (CVSS 8.5, Logitech Logi Options+)
- [CVE-2026-90693](https://cve.now/CVE-2026-90693.md): D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow (CVSS 9.4, D-Link DIR-878)
- [CVE-2026-90692](https://cve.now/CVE-2026-90692.md): D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow (CVSS 9.4, D-Link DIR-878)
- [CVE-2026-71198](https://cve.now/CVE-2026-71198.md): In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. (CVSS 7.0, OpenStack Glance)
- [CVE-2026-85125](https://cve.now/CVE-2026-85125.md): The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. (CVSS 5.4, YAMAP -Social Trekking GPS App)
- [CVE-2026-82796](https://cve.now/CVE-2026-82796.md): SolarView Compact contains a cross-site scripting vulnerability in Image Management. (CVSS 5.4, Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F)
- [CVE-2026-82795](https://cve.now/CVE-2026-82795.md): SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. (CVSS 5.4, Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F)
- [CVE-2026-82794](https://cve.now/CVE-2026-82794.md): SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. (CVSS 8.8, Contec Co. SV-CPT-MC310 · Contec Co. SV-CPT-MC310F)
- [CVE-2026-82793](https://cve.now/CVE-2026-82793.md): Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. (CVSS 7.2, Contec Co. CAN-2-WF · Contec Co. CAN-2-USB)
- [CVE-2026-82765](https://cve.now/CVE-2026-82765.md): Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. (CVSS 8.1, Contec Co. FXA5000 · Contec Co. FXA5020 +18)
- [CVE-2026-82792](https://cve.now/CVE-2026-82792.md): Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. (CVSS 5.2, Contec Co. CAN-2-WF · Contec Co. CAN-2-USB)
- [CVE-2026-82791](https://cve.now/CVE-2026-82791.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wir (CVSS 8.8, Contec Co. CAN-2-WF · Contec Co. CAN-2-USB)
- [CVE-2026-82790](https://cve.now/CVE-2026-82790.md): Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. (CVSS 5.4, Contec Co. PC-HELPER Wireless I/O DIO-0404RY-LWF · Contec C…)
- [CVE-2026-90691](https://cve.now/CVE-2026-90691.md): 0x4m4 HexStrike AI API Files Endpoint hexstrike\_server.py FileOperationsManager path traversal (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-82789](https://cve.now/CVE-2026-82789.md): An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS). (CVSS 8.8, Contec CONPROSYS HMI System)
- [CVE-2026-82763](https://cve.now/CVE-2026-82763.md): Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. (CVSS 5.4, Contec Co. FXA5000 · Contec Co. FXA5020 +18)
- [CVE-2026-82787](https://cve.now/CVE-2026-82787.md): Missing authentication for critical function vulnerability exists in CPSL-08P1EN. (CVSS 9.8, Contec Co. CPSL-08P1EN)
- [CVE-2026-82788](https://cve.now/CVE-2026-82788.md): Cross-site scripting vulnerability exists in CPSL-08P1EN. (CVSS 6.1, Contec Co. CPSL-08P1EN)
- [CVE-2026-82786](https://cve.now/CVE-2026-82786.md): Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*. (CVSS 6.3, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…)
- [CVE-2026-82785](https://cve.now/CVE-2026-82785.md): Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*. (CVSS 4.3, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…)
- [CVE-2026-82784](https://cve.now/CVE-2026-82784.md): Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\*. (CVSS 6.5, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MCB27…)
- [CVE-2026-82783](https://cve.now/CVE-2026-82783.md): Plaintext storage of a password issue exists in CONPROSYS nano Series . (CVSS 4.2, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1)
- [CVE-2026-82782](https://cve.now/CVE-2026-82782.md): Out-of-bounds write vulnerability exists in CONPROSYS nano Series. (CVSS 4.3, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1)
- [CVE-2026-82781](https://cve.now/CVE-2026-82781.md): Cross-site scripting vulnerability exists in CONPROSYS nano Series. (CVSS 5.4, Contec Co. Remote I/O Coupler Unit (Server Type) CPSN-MC… +1)
- [CVE-2026-82780](https://cve.now/CVE-2026-82780.md): Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. (CVSS 8.8, Contec Co. CPS-TM341G5MB-ADSC1-931 · Contec Co. CPS-TM34… +1)
- [CVE-2026-82779](https://cve.now/CVE-2026-82779.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. (CVSS 8.8, Contec Co. CPS-TM341G5MB-ADSC1-931 · Contec Co. CPS-TM34… +1)
- [CVE-2026-82778](https://cve.now/CVE-2026-82778.md): An exposure of information through directory listing issue exists in CONPROSYS PAC Series. (CVSS 4.3, Contec Co. Integrated Type CPS-PC341\[\]\[\]-\*-9201 · Contec Co…)
- [CVE-2026-82777](https://cve.now/CVE-2026-82777.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. (CVSS 8.8, Contec Co. Integrated Type CPS-PC341\[\]\[\]-\*-9201 · Contec Co…)
- [CVE-2026-82776](https://cve.now/CVE-2026-82776.md): Cross-site scripting vulnerability exists in CONPROSYS PAC Series. (CVSS 6.1, Contec Co. Integrated Type CPS-PC341\[\]\[\]-\*-9201 · Contec Co…)
- [CVE-2026-82775](https://cve.now/CVE-2026-82775.md): An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. (CVSS 4.3, Contec Co. M2M Gateway Integrated Type CPS-MG341\* · Cont… +2)
- [CVE-2026-82774](https://cve.now/CVE-2026-82774.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and (CVSS 8.8, Contec Co. M2M Gateway Integrated Type CPS-MG341\* · Cont… +2)
- [CVE-2026-82773](https://cve.now/CVE-2026-82773.md): Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. (CVSS 6.1, Contec Co. M2M Gateway Integrated Type CPS-MG341\* · Cont… +2)
- [CVE-2026-82772](https://cve.now/CVE-2026-82772.md): Buffer overflow vulnerability exists in Contec EC1000 series. (CVSS 8.8, Contec Co. ECE1000 · Contec Co. ECE1020 +1)
- [CVE-2026-82771](https://cve.now/CVE-2026-82771.md): Cross-site scripting vulnerability exists in Contec EC1000 series. (CVSS 5.4, Contec Co. ECE1000 · Contec Co. ECE1020 +1)
- [CVE-2026-82770](https://cve.now/CVE-2026-82770.md): Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. (CVSS 8.8, Contec Co. RP-WAH-SR1 · Contec Co. RP-WAH-SR2 +2)
- [CVE-2026-82768](https://cve.now/CVE-2026-82768.md): Path traversal vulnerability exists in SGA1000. (CVSS 8.1, Contec Co. SGA1000)
- [CVE-2026-82769](https://cve.now/CVE-2026-82769.md): Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. (CVSS 5.4, Contec Co. RP-WAH-SR1 · Contec Co. RP-WAH-SR2 +2)
- [CVE-2026-82767](https://cve.now/CVE-2026-82767.md): Cross-site scripting vulnerability exists in SGA1000. (CVSS 5.2, Contec Co. SGA1000)
- [CVE-2026-82766](https://cve.now/CVE-2026-82766.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. (CVSS 8.8, Contec Co. SGA1000)
- [CVE-2026-82764](https://cve.now/CVE-2026-82764.md): Cross-site request forgery vulnerability exists in multiple Contec products. (CVSS 4.3, Contec Co. FXA5000 · Contec Co. FXA5020 +31)
- [CVE-2026-82762](https://cve.now/CVE-2026-82762.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 seri (CVSS 8.8, Contec Co. FXA5000 · Contec Co. FXA5020 +18)
- [CVE-2026-68955](https://cve.now/CVE-2026-68955.md): The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. (CVSS 7.8, The installer for Rakuten Kobo Desktop Application)
- [CVE-2026-90690](https://cve.now/CVE-2026-90690.md): 0x4m4 HexStrike AI API Tools Endpoint hexstrike\_server.py subprocess.Popen os command injection (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-85196](https://cve.now/CVE-2026-85196.md): Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla \< 20.0.0, Users Anywhere extension for Joomla \< 2.1.0 (CVSS 5.3, regularlabs.com Articles Anywhere (Pro) extension for Jooml…)
- [CVE-2026-88852](https://cve.now/CVE-2026-88852.md): Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla \< 7.0.0, Snippets Pro extension for Joomla \< 11.0.0 (CVSS 7.5, regularlabs.com Snippets (Free) extension for Joomla · regu…)
- [CVE-2026-85190](https://cve.now/CVE-2026-85190.md): Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla \< 5.0.5 (CVSS 7.5, regularlabs.com Quick Index (Free, Pro) extension for Joomla)
- [CVE-2026-85192](https://cve.now/CVE-2026-85192.md): Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla \< 8.0.0 (CVSS 9.4, regularlabs.com Conditional Content Pro extension for Joomla)
- [CVE-2026-85189](https://cve.now/CVE-2026-85189.md): Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla \< 17.0.0 (CVSS 7.5, regularlabs.com Modals (Free, Pro) extension for Joomla)
- [CVE-2026-90689](https://cve.now/CVE-2026-90689.md): Tenda W20E formDelWebAuthWhiteUser stack-based overflow (CVSS 8.7, Tenda W20E)
- [CVE-2026-85195](https://cve.now/CVE-2026-85195.md): Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla \< 20.0.0 (CVSS 7.5, regularlabs.com Articles Anywhere (Free, Pro) extension for…)
- [CVE-2026-88853](https://cve.now/CVE-2026-88853.md): Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla \< 17.0.0 (CVSS 7.5, regularlabs.com Modals (Pro) extension for Joomla)
- [CVE-2026-85191](https://cve.now/CVE-2026-85191.md): Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla \< 3.1.0 (CVSS 7.5, regularlabs.com Tabs & Accordions (Free, Pro) extension for…)
- [CVE-2026-85188](https://cve.now/CVE-2026-85188.md): Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) \< 12.1.0, Conditional Content (Free, Pro) \< 8.0.0, Content Templater (Pro) \< 14.2.0, ReReplacer (Pro) \< 16.2.0 for Joomla (CVSS 6.9, regularlabs.com Advanced Module Manager (Free, Pro) exte… +2)
- [CVE-2026-90688](https://cve.now/CVE-2026-90688.md): Tenda W20E HTTP formIPMacBindAdd stack-based overflow (CVSS 7.1, Tenda W20E)
- [CVE-2026-16726](https://cve.now/CVE-2026-16726.md): Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows. (CVSS 6.8, panasonic PANATERM · panasonic RTEX LogReader)
- [CVE-2026-90687](https://cve.now/CVE-2026-90687.md): GPAC MP4Box base\_scenegraph.c gf\_node\_changed\_internal use after free (CVSS 5.3, GPAC)
- [CVE-2026-90686](https://cve.now/CVE-2026-90686.md): GPAC MP4Box loader\_bt.c gf\_bt\_report memory corruption (CVSS 6.9, GPAC)
- [CVE-2026-90685](https://cve.now/CVE-2026-90685.md): GPAC MP4Box lsr\_dec.c lsr\_exec\_command\_list assertion (CVSS 2.4, GPAC)
- [CVE-2026-90684](https://cve.now/CVE-2026-90684.md): GPAC MP4Box base\_scenegraph.c gf\_node\_get\_field\_count assertion (CVSS 2.4, GPAC)
- [CVE-2026-90683](https://cve.now/CVE-2026-90683.md): GPAC MP4Box base\_scenegraph.c gf\_node\_unregister assertion (CVSS 4.8, GPAC)
- [CVE-2026-90682](https://cve.now/CVE-2026-90682.md): Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow (CVSS 4.8, Matthias-Wandel jhead)
- [CVE-2026-90681](https://cve.now/CVE-2026-90681.md): Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds (CVSS 4.8, Matthias-Wandel jhead)
- [CVE-2026-90680](https://cve.now/CVE-2026-90680.md): D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow (CVSS 9.4, D-Link DIR-823G)
- [CVE-2026-90623](https://cve.now/CVE-2026-90623.md): andreashappe cochise SSH Host Key ssh\_connection.py asyncssh.connect certificate validation (CVSS 6.3, andreashappe cochise)
- [CVE-2026-90622](https://cve.now/CVE-2026-90622.md): GNU libredwg Layer Encoding dwg.spec DWG\_TABLE null pointer dereference (CVSS 4.8, GNU libredwg)
- [CVE-2026-90621](https://cve.now/CVE-2026-90621.md): ipa-lab HackingBuddyGPT ssh\_run\_command.py ssh\_run\_command os command injection (CVSS 5.3, ipa-lab HackingBuddyGPT)
- [CVE-2026-90620](https://cve.now/CVE-2026-90620.md): 0x4m4 HexStrike AI API Command Endpoint hexstrike\_server.py missing authentication (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-90619](https://cve.now/CVE-2026-90619.md): 0x4m4 HexStrike AI Execute Endpoint hexstrike\_server.py os command injection (CVSS 6.9, 0x4m4 HexStrike AI)
- [CVE-2026-90618](https://cve.now/CVE-2026-90618.md): GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute\_command os command injection (CVSS 6.9, GH05TCREW PentestAgent)
- [CVE-2026-90617](https://cve.now/CVE-2026-90617.md): GH05TCREW PentestAgent MCP HTTP Server main.py run\_task os command injection (CVSS 6.9, GH05TCREW PentestAgent)
- [CVE-2026-90615](https://cve.now/CVE-2026-90615.md): SourceCodester Class and Exam Timetabling System subject1.php cross site scripting (CVSS 5.3, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-90614](https://cve.now/CVE-2026-90614.md): FedML-AI FedML MQTT+S3 Communication Backend remote\_storage.py S3Storage.read\_model deserialization (CVSS 5.3, FedML-AI FedML)
- [CVE-2026-90613](https://cve.now/CVE-2026-90613.md): GPAC MP4Box stbl\_read.c stbl\_GetSampleInfos assertion (CVSS 4.8, GPAC)
- [CVE-2026-90612](https://cve.now/CVE-2026-90612.md): GPAC MP4Box scene\_dump.c gf\_sm\_dump\_command\_list assertion (CVSS 4.8, GPAC)
- [CVE-2026-90611](https://cve.now/CVE-2026-90611.md): GPAC MP4Box loader\_xmt.c xmt\_parse\_element assertion (CVSS 4.8, GPAC)
- [CVE-2026-90610](https://cve.now/CVE-2026-90610.md): GPAC MP4Box svg\_attributes.c gf\_svg\_attributes\_copy buffer over-read (CVSS 4.8, GPAC)
- [CVE-2026-90609](https://cve.now/CVE-2026-90609.md): GPAC MP4Box vrml\_tools.c null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2026-90608](https://cve.now/CVE-2026-90608.md): Totolink A3002MU boa formPortFw buffer overflow (CVSS 9.4, Totolink A3002MU)
- [CVE-2026-90607](https://cve.now/CVE-2026-90607.md): Totolink A3002MU boa formNewSchedule buffer overflow (CVSS 9.4, Totolink A3002MU)
- [CVE-2023-22631](https://cve.now/CVE-2023-22631.md): PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor. (CVSS 2.7, Paessler PRTG Network Monitor)
- [CVE-2023-22632](https://cve.now/CVE-2023-22632.md): PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor. (CVSS 2.7, Paessler PRTG Network Monitor)
- [CVE-2023-24034](https://cve.now/CVE-2023-24034.md): An issue was discovered in twilio\_ajax\_handler.php in Nagios XI before 5.9.3. (CVSS 3.1, Nagios XI)
- [CVE-2023-24035](https://cve.now/CVE-2023-24035.md): An issue was discovered in Nagios XI before 5.9.3. (CVSS 3.5, Nagios XI)
- [CVE-2023-24283](https://cve.now/CVE-2023-24283.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of S (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24284](https://cve.now/CVE-2023-24284.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is\_markable() function. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24285](https://cve.now/CVE-2023-24285.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long mov (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24286](https://cve.now/CVE-2023-24286.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24287](https://cve.now/CVE-2023-24287.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24288](https://cve.now/CVE-2023-24288.md): An issue in Portable Puzzle Collection before 20230116.5782e29 allows attackers to cause a Denial of Service (DoS) via creating an excessive (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-24291](https://cve.now/CVE-2023-24291.md): Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter. (CVSS 2.9, Simon Tatham Portable Puzzle Collection)
- [CVE-2023-28148](https://cve.now/CVE-2023-28148.md): A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. (CVSS 7.2, Paessler PRTG Network Monitor)
- [CVE-2023-29377](https://cve.now/CVE-2023-29377.md): An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. (CVSS 6.6, Softing Secure Integration Server)
- [CVE-2023-32778](https://cve.now/CVE-2023-32778.md): An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. (CVSS 3.3, ILIAS)
- [CVE-2023-32803](https://cve.now/CVE-2023-32803.md): The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root cert (CVSS 7.5, Amazon ca-certificates)
- [CVE-2023-34854](https://cve.now/CVE-2023-34854.md): HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. (CVSS 6.6, digitaldruid HotelDruid)
- [CVE-2023-37252](https://cve.now/CVE-2023-37252.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. (CVSS 3.1, MediaWiki CheckUser)
- [CVE-2023-37253](https://cve.now/CVE-2023-37253.md): An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. (CVSS 3.1, MediaWiki ProofreadPage)
- [CVE-2023-37366](https://cve.now/CVE-2023-37366.md): An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem Exynos 9810, Exynos 9610, Exynos 9820, Exynos 98 (CVSS 2.8, Samsung Exynos 850 firmware)
- [CVE-2023-40772](https://cve.now/CVE-2023-40772.md): A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted requ (CVSS 4.3, DataEase)
- [CVE-2023-45023](https://cve.now/CVE-2023-45023.md): The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component (CVSS 4.2, TYPO3 femanager · in2code/femanager)
- [CVE-2023-45858](https://cve.now/CVE-2023-45858.md): A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files. (CVSS 8.6, Paessler PRTG Network Monitor)
- [CVE-2023-46035](https://cve.now/CVE-2023-46035.md): The svg\_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. (CVSS 5.9, fnando svg\_optimizer · svg\_optimizer)
- [CVE-2023-46273](https://cve.now/CVE-2023-46273.md): Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah\_bgd buffer overflow via ah\_event\_s (CVSS 8.8, extremenetworks IQ Engine)
- [CVE-2023-50459](https://cve.now/CVE-2023-50459.md): An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. (CVSS 5.4, TYPO3 femanager · in2code/femanager)
- [CVE-2023-50460](https://cve.now/CVE-2023-50460.md): An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. (CVSS 5.4, TYPO3 femanager)
- [CVE-2023-50461](https://cve.now/CVE-2023-50461.md): An issue was discovered in the direct\_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. (CVSS 8.8, TYPO3 direct\_mail · directmailteam/direct-mail)
- [CVE-2023-50462](https://cve.now/CVE-2023-50462.md): An issue was discovered in the content\_consent (aka Content Consent) extension through 2.0.1 for TYPO3. (CVSS 5.3, TYPO3 content\_consent · t3s/content-consent)
- [CVE-2023-51769](https://cve.now/CVE-2023-51769.md): Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages. (CVSS 6.1, Frappe)
- [CVE-2024-23176](https://cve.now/CVE-2024-23176.md): An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. (CVSS 5.4, MediaWiki MassMessage)
- [CVE-2025-26790](https://cve.now/CVE-2025-26790.md): Withsecure Atlant with Capricorn engine before 2025-01-20\_02 allows a Remote Denial of Service via an out-of-bounds memory read during proce (CVSS 3.7, WithSecure Atlant)
- [CVE-2025-64031](https://cve.now/CVE-2025-64031.md): libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive\_compress (CVSS 2.5, libarchive)
- [CVE-2025-68624](https://cve.now/CVE-2025-68624.md): N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound ema (CVSS 4.3, N-able Mail Assure)
- [CVE-2026-23786](https://cve.now/CVE-2026-23786.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 2.8, Samsung Exynos 1280 firmware)
- [CVE-2026-23787](https://cve.now/CVE-2026-23787.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23788](https://cve.now/CVE-2026-23788.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, and 1380. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23789](https://cve.now/CVE-2026-23789.md): An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400 (CVSS 7.8, Samsung Exynos 850 firmware)
- [CVE-2026-23790](https://cve.now/CVE-2026-23790.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23791](https://cve.now/CVE-2026-23791.md): An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. (CVSS 4.2, Samsung Exynos 1280 firmware)
- [CVE-2026-23792](https://cve.now/CVE-2026-23792.md): An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W (CVSS 4.0, Samsung Exynos 1080 firmware)
- [CVE-2026-23793](https://cve.now/CVE-2026-23793.md): An issue was discovered in Samsung Mobile Processor Exynos 1330, 1380, 1480, and 2400. (CVSS 3.5, Samsung Exynos 1330 firmware)
- [CVE-2026-25832](https://cve.now/CVE-2026-25832.md): In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. (CVSS 3.7, TrustedFirmware Mbed TLS)
- [CVE-2026-31278](https://cve.now/CVE-2026-31278.md): An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers (CVSS 7.7, supremainc BioStar)
- [CVE-2026-33956](https://cve.now/CVE-2026-33956.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33957](https://cve.now/CVE-2026-33957.md): An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. (CVSS 4.2, Samsung Exynos 1580 firmware)
- [CVE-2026-33960](https://cve.now/CVE-2026-33960.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33962](https://cve.now/CVE-2026-33962.md): An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. (CVSS 2.8, Samsung Exynos 850 firmware)
- [CVE-2026-33963](https://cve.now/CVE-2026-33963.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 7.5, Samsung Exynos 1330 firmware)
- [CVE-2026-33964](https://cve.now/CVE-2026-33964.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. (CVSS 6.4, Samsung Exynos 1580 firmware)
- [CVE-2026-33966](https://cve.now/CVE-2026-33966.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33967](https://cve.now/CVE-2026-33967.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33968](https://cve.now/CVE-2026-33968.md): An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. (CVSS 2.8, Samsung Exynos 1330 firmware)
- [CVE-2026-33970](https://cve.now/CVE-2026-33970.md): An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330 (CVSS 3.5, Samsung Exynos 850 firmware)
- [CVE-2026-38924](https://cve.now/CVE-2026-38924.md): In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. (CVSS 2.9, Oraios AI Serena)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.