# CVEs published 2026-09-16

871 CVEs were published on September 16, 2026: 97 critical, 396 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-65388](https://cve.now/CVE-2026-65388.md): A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and d (CVSS 7.5, Apple containerization)
- [CVE-2026-61599](https://cve.now/CVE-2026-61599.md): djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path (CVSS 8.8, djust-org djust · djust)
- [CVE-2026-61589](https://cve.now/CVE-2026-61589.md): djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path (CVSS 6.3, djust-org djust · djust)
- [CVE-2026-61596](https://cve.now/CVE-2026-61596.md): djust has broken object-level access control (IDOR) (CVSS 7.1, djust-org djust · djust)
- [CVE-2026-61588](https://cve.now/CVE-2026-61588.md): djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client (CVSS 6.5, djust-org djust · djust)
- [CVE-2026-61594](https://cve.now/CVE-2026-61594.md): djust has an authorization bypass on the WebSocket/SSE mount path (CVSS 9.1, djust-org djust · djust)
- [CVE-2026-61591](https://cve.now/CVE-2026-61591.md): djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) (CVSS 8.1, djust-org djust · djust)
- [CVE-2026-61592](https://cve.now/CVE-2026-61592.md): djust: SSE sessions are not bound to the authenticated user; the client-chosen session\_id is the sole authorization capability (session hijack) (CVSS 7.4, djust-org djust · djust)
- [CVE-2026-61597](https://cve.now/CVE-2026-61597.md): djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags (CVSS 5.1, djust-org djust · djust)
- [CVE-2026-92599](https://cve.now/CVE-2026-92599.md): Joi before 17.13.7 and 18.2.6 ReDoS via isoDate (CVSS 8.7, hapijs joi · joi)
- [CVE-2026-92598](https://cve.now/CVE-2026-92598.md): Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass (CVSS 8.3, nodemailer)
- [CVE-2026-92597](https://cve.now/CVE-2026-92597.md): Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment (CVSS 8.3, nodemailer)
- [CVE-2026-92596](https://cve.now/CVE-2026-92596.md): Nodemailer before 9.1.0 Denial of Service via addressparser (CVSS 8.7, nodemailer)
- [CVE-2026-92595](https://cve.now/CVE-2026-92595.md): Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent (CVSS 6.0, nodemailer)
- [CVE-2026-92594](https://cve.now/CVE-2026-92594.md): Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL (CVSS 8.7, craftcms cms)
- [CVE-2026-92593](https://cve.now/CVE-2026-92593.md): Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution (CVSS 8.7, craftcms cms)
- [CVE-2026-92592](https://cve.now/CVE-2026-92592.md): Craft CMS before 4.18.6 Remote Code Execution via signed cookie (CVSS 8.7, craftcms cms)
- [CVE-2026-92591](https://cve.now/CVE-2026-92591.md): Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer (CVSS 8.2, craftcms cms)
- [CVE-2026-92590](https://cve.now/CVE-2026-92590.md): Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields (CVSS 5.1, craftcms cms)
- [CVE-2026-92589](https://cve.now/CVE-2026-92589.md): Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder (CVSS 5.3, craftcms cms)
- [CVE-2026-92588](https://cve.now/CVE-2026-92588.md): n8n before 1.123.76 Improper Authorization via Source Control Push (CVSS 5.9, n8n-io n8n)
- [CVE-2026-92587](https://cve.now/CVE-2026-92587.md): n8n before 1.123.76 Sandbox Escape via Git Relative URL (CVSS 5.3, n8n-io n8n)
- [CVE-2026-92586](https://cve.now/CVE-2026-92586.md): AVideo through 29.0 Missing Authorization via comment API endpoint (CVSS 5.3, WWBN AVideo)
- [CVE-2026-92585](https://cve.now/CVE-2026-92585.md): AVideo through 29.0 Missing Authorization Check via API Like Endpoint (CVSS 5.3, WWBN AVideo)
- [CVE-2026-92584](https://cve.now/CVE-2026-92584.md): AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header (CVSS 5.3, WWBN AVideo)
- [CVE-2026-92583](https://cve.now/CVE-2026-92583.md): AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment (CVSS 6.9, WWBN AVideo)
- [CVE-2026-92582](https://cve.now/CVE-2026-92582.md): AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass (CVSS 7.1, WWBN AVideo)
- [CVE-2026-92581](https://cve.now/CVE-2026-92581.md): AVideo through 29.0 Like Counter Desynchronization via Array Parameter (CVSS 5.3, WWBN AVideo)
- [CVE-2026-92580](https://cve.now/CVE-2026-92580.md): AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF (CVSS 8.7, WWBN AVideo)
- [CVE-2026-92579](https://cve.now/CVE-2026-92579.md): AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision (CVSS 5.3, WWBN AVideo)
- [CVE-2026-92578](https://cve.now/CVE-2026-92578.md): WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash (CVSS 9.2, WWBN AVideo)
- [CVE-2026-92577](https://cve.now/CVE-2026-92577.md): AVideo through 29.0 API get\_api\_video Broken Access Control via clean\_title (CVSS 8.7, WWBN AVideo)
- [CVE-2026-92576](https://cve.now/CVE-2026-92576.md): HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool (CVSS 9.2, HKUDS nanobot)
- [CVE-2026-89034](https://cve.now/CVE-2026-89034.md): TCH QRing R20\_B006 Unauthenticated BLE Access (CVSS 7.1, TCH QRing)
- [CVE-2026-64684](https://cve.now/CVE-2026-64684.md): RMCP: Custom HTTP headers leak to cross-origin redirect targets (CVSS 6.8, modelcontextprotocol rust-sdk · rmcp)
- [CVE-2026-85469](https://cve.now/CVE-2026-85469.md): Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope (CVSS 8.0, Red Hat Quay)
- [CVE-2026-62997](https://cve.now/CVE-2026-62997.md): Kedro-Datasets: Remote code execution in experimental \`PyTorchDataset\` via unsafe \`torch.load\` (CVSS 7.7, kedro-org kedro-plugins)
- [CVE-2026-75513](https://cve.now/CVE-2026-75513.md): Marten: SQL injection in Marten's LINQ provider via unescaped string literals (CVSS 9.1, JasperFx marten · Marten)
- [CVE-2026-81871](https://cve.now/CVE-2026-81871.md): OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning (CVSS 6.3, open-telemetry opentelemetry-go · go.opentelemetry.io/otel/…)
- [CVE-2026-81872](https://cve.now/CVE-2026-81872.md): OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full (CVSS 6.3, open-telemetry opentelemetry-go · go.opentelemetry.io/otel/…)
- [CVE-2026-81869](https://cve.now/CVE-2026-81869.md): OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation (CVSS 5.1, open-telemetry opentelemetry-go · go.opentelemetry.io/otel/…)
- [CVE-2026-92816](https://cve.now/CVE-2026-92816.md): ComfyUI before 0.30.0 Path Traversal via dataset save nodes (CVSS 8.5, Comfy-Org ComfyUI)
- [CVE-2026-92815](https://cve.now/CVE-2026-92815.md): changedetection.io through 0.60.6 SSRF via browser-step Goto URL (CVSS 8.7, dgtlmoon changedetection.io)
- [CVE-2026-92814](https://cve.now/CVE-2026-92814.md): changedetection.io through 0.60.6 Cross-Site Scripting via watch\_title (CVSS 2.3, dgtlmoon changedetection.io)
- [CVE-2026-92813](https://cve.now/CVE-2026-92813.md): Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass (CVSS 6.9, Metabase)
- [CVE-2026-92812](https://cve.now/CVE-2026-92812.md): Decap CMS \< 3.11.0 Path Traversal via Sibling Directory Prefix Matching (CVSS 9.3, decaporg decap-cms)
- [CVE-2026-92811](https://cve.now/CVE-2026-92811.md): browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass (CVSS 7.1, browserless)
- [CVE-2026-92810](https://cve.now/CVE-2026-92810.md): PrestaShop blockwishlist through 3.0.2 Information Disclosure (CVSS 5.3, PrestaShop blockwishlist)
- [CVE-2026-92809](https://cve.now/CVE-2026-92809.md): PrestaShop psgdpr through 1.4.3 GDPR Log Forgery (CVSS 5.3, PrestaShop psgdpr)
- [CVE-2026-92806](https://cve.now/CVE-2026-92806.md): phpList before 3.6.17 Cross-Site Request Forgery via massremove.php (CVSS 7.2, phpList)
- [CVE-2026-92805](https://cve.now/CVE-2026-92805.md): UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard (CVSS 9.3, uvdesk community-skeleton)
- [CVE-2026-92804](https://cve.now/CVE-2026-92804.md): Nango through 0.70.4 Server-Side Request Forgery via Configuration (CVSS 7.1, NangoHQ Nango)
- [CVE-2026-92803](https://cve.now/CVE-2026-92803.md): LibreTranslate through 1.9.6 Missing Access Check on the download\_file Route (CVSS 6.9, LibreTranslate)
- [CVE-2026-92802](https://cve.now/CVE-2026-92802.md): kan through 0.6.0 Authorization Bypass via GitHub Project Import (CVSS 5.3, kanbn kan)
- [CVE-2026-92801](https://cve.now/CVE-2026-92801.md): cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions (CVSS 8.7, chenhg5 cc-connect)
- [CVE-2026-92800](https://cve.now/CVE-2026-92800.md): Docs before 5.4.1 Stale Collaboration Session After Access Revocation (CVSS 7.6, suitenumerique Docs)
- [CVE-2026-92796](https://cve.now/CVE-2026-92796.md): Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass (CVSS 8.7, manticoresoftware Manticore Search)
- [CVE-2026-92795](https://cve.now/CVE-2026-92795.md): Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin (CVSS 7.1, coze-dev coze-studio)
- [CVE-2026-92794](https://cve.now/CVE-2026-92794.md): OpenSign through 2.41.3 Information Disclosure via getDocument (CVSS 8.7, OpenSignLabs OpenSign)
- [CVE-2026-92793](https://cve.now/CVE-2026-92793.md): GoAdmin through 1.2.26 Authorization Bypass via Query Parameter (CVSS 8.6, GoAdminGroup go-admin)
- [CVE-2026-92792](https://cve.now/CVE-2026-92792.md): OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier (CVSS 8.7, opennhp)
- [CVE-2026-92791](https://cve.now/CVE-2026-92791.md): Uber Kraken through 0.1.29 Path Traversal via tag parameter (CVSS 8.7, uber kraken)
- [CVE-2026-92790](https://cve.now/CVE-2026-92790.md): Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header (CVSS 6.9, higress-group higress)
- [CVE-2026-92789](https://cve.now/CVE-2026-92789.md): Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect (CVSS 7.1, graylog2-server)
- [CVE-2026-92788](https://cve.now/CVE-2026-92788.md): Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node (CVSS 8.7, coze-dev coze-studio)
- [CVE-2026-92787](https://cve.now/CVE-2026-92787.md): Feast through 0.66.0 Authentication Bypass via Unverified Token (CVSS 9.3, feast-dev feast)
- [CVE-2026-92786](https://cve.now/CVE-2026-92786.md): LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model (CVSS 8.5, lightgbm-org LightGBM)
- [CVE-2026-92785](https://cve.now/CVE-2026-92785.md): Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes (CVSS 9.2, Angel-ML angel)
- [CVE-2026-92784](https://cve.now/CVE-2026-92784.md): @refinedev/inferencer through 7.0.0 Code Injection via API Field Names (CVSS 7.7, @refinedev/inferencer)
- [CVE-2026-92783](https://cve.now/CVE-2026-92783.md): Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion (CVSS 7.2, yeti-platform yeti)
- [CVE-2026-92782](https://cve.now/CVE-2026-92782.md): Chroma through 1.5.9 Authorization Bypass via Collection Identifier (CVSS 8.6, chroma-core chroma)
- [CVE-2026-92781](https://cve.now/CVE-2026-92781.md): Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes (CVSS 5.3, BuilderIO @builder.io/sdk-react · BuilderIO @builder.io/… +5)
- [CVE-2026-92780](https://cve.now/CVE-2026-92780.md): KnowStreaming through 3.4.1 Missing Authorization on the REST API (CVSS 8.7, didi KnowStreaming)
- [CVE-2026-92779](https://cve.now/CVE-2026-92779.md): Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings (CVSS 7.2, BuilderIO @builder.io/sdk-react · BuilderIO @builder.io/… +5)
- [CVE-2026-92778](https://cve.now/CVE-2026-92778.md): CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes (CVSS 5.3, yahoo CMAK)
- [CVE-2026-92776](https://cve.now/CVE-2026-92776.md): Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass (CVSS 8.6, requarks Wiki.js)
- [CVE-2026-92775](https://cve.now/CVE-2026-92775.md): Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch (CVSS 7.1, requarks Wiki.js)
- [CVE-2026-92774](https://cve.now/CVE-2026-92774.md): Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission (CVSS 5.3, requarks Wiki.js)
- [CVE-2026-92773](https://cve.now/CVE-2026-92773.md): Trigger.dev before 4.6.0 GitHub App Installation Takeover (CVSS 7.1, triggerdotdev trigger.dev)
- [CVE-2026-92772](https://cve.now/CVE-2026-92772.md): Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX (CVSS 7.1, leantime)
- [CVE-2026-92771](https://cve.now/CVE-2026-92771.md): Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query (CVSS 7.1, twentyhq twenty)
- [CVE-2026-92770](https://cve.now/CVE-2026-92770.md): Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter (CVSS 7.1, goharbor harbor)
- [CVE-2026-92765](https://cve.now/CVE-2026-92765.md): ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList (CVSS 7.1, archerysec)
- [CVE-2026-92764](https://cve.now/CVE-2026-92764.md): OpenCVE 2.4.0 \< 3.1.0 Organization API Ignores Token Scope (CVSS 5.3, opencve)
- [CVE-2026-92763](https://cve.now/CVE-2026-92763.md): Rundeck through 6.2.1 Authorization Bypass via Project Import (CVSS 8.6, rundeck)
- [CVE-2026-92762](https://cve.now/CVE-2026-92762.md): Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup (CVSS 8.7, pelican panel)
- [CVE-2026-92761](https://cve.now/CVE-2026-92761.md): WebVirtCloud Missing Authorization on Instance Control Actions (CVSS 8.7, retspen webvirtcloud)
- [CVE-2026-92760](https://cve.now/CVE-2026-92760.md): Shlink through 5.1.6 Mercure Token Authorization Bypass (CVSS 7.1, shlinkio shlink)
- [CVE-2026-92759](https://cve.now/CVE-2026-92759.md): SecObserve before 1.59.1 Information Disclosure via API Configuration (CVSS 7.1, SecObserve)
- [CVE-2026-92754](https://cve.now/CVE-2026-92754.md): PatrowlManager through 1.8.4 Improper Access Control via users API (CVSS 5.3, PatrowlManager)
- [CVE-2026-92753](https://cve.now/CVE-2026-92753.md): PatrowlManager through 1.8.4 Authorization Bypass via Events API (CVSS 7.1, PatrowlManager)
- [CVE-2026-92752](https://cve.now/CVE-2026-92752.md): metasfresh Unauthorized Access via Document Attachments and Comments Endpoints (CVSS 8.7, metasfresh)
- [CVE-2026-92751](https://cve.now/CVE-2026-92751.md): CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter (CVSS 7.2, yahoo CMAK)
- [CVE-2026-92750](https://cve.now/CVE-2026-92750.md): Harness through 3.3.0 Missing Access Control via infraproviders endpoint (CVSS 7.1, harness)
- [CVE-2026-92749](https://cve.now/CVE-2026-92749.md): SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret (CVSS 9.2, chaitin SafeLine)
- [CVE-2026-92748](https://cve.now/CVE-2026-92748.md): BC Security Empire before 6.7.1 Path Traversal File Upload RCE (CVSS 8.7, BC-SECURITY Empire)
- [CVE-2026-63506](https://cve.now/CVE-2026-63506.md): Tina: \[Broken Access Control\] letting any TinaCloud user authorize against any self-hosted site (CVSS 8.8, tinacms · @tinacms auth +2)
- [CVE-2026-76426](https://cve.now/CVE-2026-76426.md): Cisco ISE REST API SQL Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20121](https://cve.now/CVE-2026-20121.md): CIsco FTD Bypass Access List (CVSS 5.3, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-76431](https://cve.now/CVE-2026-76431.md): Cisco Identity Services Engine Arbitrary File Deletion Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76427](https://cve.now/CVE-2026-76427.md): Cisco ISE XML External Entity Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76447](https://cve.now/CVE-2026-76447.md): Cisco Identity Services Engine Certificate Reload Vulnerability (CVSS 5.3, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20285](https://cve.now/CVE-2026-20285.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20287](https://cve.now/CVE-2026-20287.md): Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities (CVSS 6.5, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20286](https://cve.now/CVE-2026-20286.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2026-76438](https://cve.now/CVE-2026-76438.md): Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability (CVSS 6.5, Cisco BroadWorks)
- [CVE-2026-20072](https://cve.now/CVE-2026-20072.md): ISE information disclosure (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2026-76446](https://cve.now/CVE-2026-76446.md): Cisco Identity Services Engine External Entity Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20071](https://cve.now/CVE-2026-20071.md): ISE 802.1x Session Hijack Vulnerability (CVSS 3.8, Cisco Identity Services Engine Software)
- [CVE-2026-20300](https://cve.now/CVE-2026-20300.md): Cisco Identity Services Engine SQL Injection Vulnerability (CVSS 7.1, Cisco Identity Services Engine Software)
- [CVE-2026-76432](https://cve.now/CVE-2026-76432.md): Cisco Identity Services Engine Arbitrary File Write Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76448](https://cve.now/CVE-2026-76448.md): Cisco Identity Services Engine SQL Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76434](https://cve.now/CVE-2026-76434.md): Cisco Identity Services Engine Arbitrary File Read Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20120](https://cve.now/CVE-2026-20120.md): Cisco FTD ACL bypass vulnerability (CVSS 5.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-76444](https://cve.now/CVE-2026-76444.md): Cisco Identity Services Engine Information Disclosure Vulnerability (CVSS 5.3, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76451](https://cve.now/CVE-2026-76451.md): Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20290](https://cve.now/CVE-2026-20290.md): Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability (CVSS 5.8, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-20235](https://cve.now/CVE-2026-20235.md): Cisco Identity Services Engine Information Disclosure Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2026-76449](https://cve.now/CVE-2026-76449.md): Cisco Identity Services Engine SQL Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76450](https://cve.now/CVE-2026-76450.md): Cisco Identity Services Engine SQL Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20309](https://cve.now/CVE-2026-20309.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2026-76428](https://cve.now/CVE-2026-76428.md): Cisco ISE Profiler SQL Injection Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76433](https://cve.now/CVE-2026-76433.md): Cisco Identity Services Engine Information Disclosure Vulnerability (CVSS 5.3, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20248](https://cve.now/CVE-2026-20248.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software TCP DNS Denial of Service Vulnerability (CVSS 6.8, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-76439](https://cve.now/CVE-2026-76439.md): Cisco Identity Services Engine Event Injection Vulnerability (CVSS 5.3, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20342](https://cve.now/CVE-2026-20342.md): Cisco Secure Firewall Management Center Software Low Privileged Arbitrary File Download Vulnerability (CVSS 7.7, Cisco Secure Firewall Management Center)
- [CVE-2026-20282](https://cve.now/CVE-2026-20282.md): Cisco Identity Services Engine Authenticated Write Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2026-20323](https://cve.now/CVE-2026-20323.md): Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass Vulnerability (CVSS 8.3, Cisco Secure Firewall Management Center · Cisco Secure Fire…)
- [CVE-2026-76412](https://cve.now/CVE-2026-76412.md): Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability (CVSS 8.5, Cisco Secure Firewall Management Center)
- [CVE-2026-20283](https://cve.now/CVE-2026-20283.md): Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2026-92527](https://cve.now/CVE-2026-92527.md): chatwoot Shopify OAuth callbacks\_controller.rb server-side request forgery (CVSS 5.3, chatwoot)
- [CVE-2026-20333](https://cve.now/CVE-2026-20333.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison Vulnerabilities (CVSS 8.8, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-76425](https://cve.now/CVE-2026-76425.md): Cisco ISE SQL Injection Vulnerability (CVSS 7.6, Cisco Identity Services Engine Software)
- [CVE-2026-20334](https://cve.now/CVE-2026-20334.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Coding Standards Vulnerabilities (CVSS 8.4, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-20284](https://cve.now/CVE-2026-20284.md): Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability (CVSS 9.1, Cisco Identity Services Engine Software)
- [CVE-2026-76424](https://cve.now/CVE-2026-76424.md): Cisco ISE Arbitrary File Access Vulnerability (CVSS 7.2, Cisco Identity Services Engine Software)
- [CVE-2026-20332](https://cve.now/CVE-2026-20332.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Access Control Vulnerabilities (CVSS 9.9, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-20344](https://cve.now/CVE-2026-20344.md): Cisco Secure Firewall Management Center Software SQL Injection Vulnerability (CVSS 8.8, Cisco Secure Firewall Management Center)
- [CVE-2026-20154](https://cve.now/CVE-2026-20154.md): Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software Logging Denial of Service (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20360](https://cve.now/CVE-2026-20360.md): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Information Exposure & Insecure Handling (CVSS 8.8, Cisco Nexus Dashboard)
- [CVE-2026-20343](https://cve.now/CVE-2026-20343.md): Cisco Secure Firewall Management Center Software Information Disclosure and Disk Denial of Service Vulnerability (CVSS 7.5, Cisco Secure Firewall Management Center)
- [CVE-2026-20222](https://cve.now/CVE-2026-20222.md): Cisco Secure Adaptive Security Appliance Software and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability (CVSS 7.4, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20247](https://cve.now/CVE-2026-20247.md): Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability (CVSS 7.5, Cisco Identity Services Engine Software)
- [CVE-2026-20135](https://cve.now/CVE-2026-20135.md): Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Threat Defense (FTD) Software)
- [CVE-2026-76460](https://cve.now/CVE-2026-76460.md): Cisco Identity Services Engine Authentication Bypass Vulnerability (CVSS 10.0, KEV, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20352](https://cve.now/CVE-2026-20352.md): Cisco Identity Services Engine RADIUS Denial of Service Vulnerability (CVSS 8.6, Cisco Identity Services Engine Software)
- [CVE-2026-76413](https://cve.now/CVE-2026-76413.md): Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability (CVSS 8.2, Cisco Secure Firewall Management Center)
- [CVE-2026-20336](https://cve.now/CVE-2026-20336.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Resource Lifetime Management Vulnerabilities (CVSS 8.8, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-20249](https://cve.now/CVE-2026-20249.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20350](https://cve.now/CVE-2026-20350.md): Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability (CVSS 4.7, Cisco ThousandEyes Enterprise Agent)
- [CVE-2026-20340](https://cve.now/CVE-2026-20340.md): Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability (CVSS 8.8, Cisco Secure Firewall Management Center)
- [CVE-2026-76409](https://cve.now/CVE-2026-76409.md): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Limitation of a Pathname (CVSS 8.8, Cisco Nexus Dashboard)
- [CVE-2026-20335](https://cve.now/CVE-2026-20335.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Calculation Vulnerabilities (CVSS 8.1, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-20295](https://cve.now/CVE-2026-20295.md): Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Management Center · Cisco Secure Fire…)
- [CVE-2026-20250](https://cve.now/CVE-2026-20250.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2026-20176](https://cve.now/CVE-2026-20176.md): Cisco Identity Services Engine Remote Code Execution Vulnerability (CVSS 9.1, Cisco Identity Services Engine Software)
- [CVE-2026-20341](https://cve.now/CVE-2026-20341.md): Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability (CVSS 9.1, Cisco Secure Firewall Management Center)
- [CVE-2026-20242](https://cve.now/CVE-2026-20242.md): Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability (CVSS 9.8, Cisco Secure Firewall Management Center)
- [CVE-2026-20237](https://cve.now/CVE-2026-20237.md): Cisco Identity Services Engine Hardening Release - Input Validation Vulnerabilities (CVSS 9.1, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-76423](https://cve.now/CVE-2026-76423.md): Cisco ISE API Authentication Bypass Vulnerability (CVSS 10.0, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20130](https://cve.now/CVE-2026-20130.md): Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities (CVSS 10.0, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20361](https://cve.now/CVE-2026-20361.md): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection (CVSS 8.8, Cisco Nexus Dashboard)
- [CVE-2026-20192](https://cve.now/CVE-2026-20192.md): Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities (CVSS 10.0, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20324](https://cve.now/CVE-2026-20324.md): Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability (CVSS 9.9, Cisco Secure Firewall Management Center)
- [CVE-2026-20325](https://cve.now/CVE-2026-20325.md): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command (CVSS 9.9, Cisco Nexus Dashboard)
- [CVE-2026-92808](https://cve.now/CVE-2026-92808.md): Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise (CVSS 10.0, Altium Enterprise Server)
- [CVE-2026-20194](https://cve.now/CVE-2026-20194.md): Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities (CVSS 9.1, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20211](https://cve.now/CVE-2026-20211.md): Cisco Identity Services Engine Remote Code Execution Vulnerability (CVSS 9.1, Cisco Identity Services Engine Software)
- [CVE-2026-81870](https://cve.now/CVE-2026-81870.md): OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs (CVSS 2.0, open-telemetry opentelemetry-go · go.opentelemetry.io/ot… +4)
- [CVE-2026-20330](https://cve.now/CVE-2026-20330.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities (CVSS 9.9, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-20322](https://cve.now/CVE-2026-20322.md): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control (CVSS 9.9, Cisco Nexus Dashboard)
- [CVE-2026-20329](https://cve.now/CVE-2026-20329.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabilities (CVSS 9.9, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-20326](https://cve.now/CVE-2026-20326.md): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function (CVSS 9.8, Cisco Nexus Dashboard)
- [CVE-2026-62949](https://cve.now/CVE-2026-62949.md): AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH\_MSG\_CHANNEL\_OPEN / OPEN\_CONFIRMATION (CVSS 6.5, ronf asyncssh · asyncssh)
- [CVE-2026-92526](https://cve.now/CVE-2026-92526.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-89084](https://cve.now/CVE-2026-89084.md): HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write (CVSS 8.8, HP AC Print & Scan · HP Output Central)
- [CVE-2026-89083](https://cve.now/CVE-2026-89083.md): HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write (CVSS 9.3, HP AC Print & Scan · HP Output Central)
- [CVE-2026-89082](https://cve.now/CVE-2026-89082.md): HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write (CVSS 9.3, HP AC Print & Scan · HP Output Central)
- [CVE-2026-86831](https://cve.now/CVE-2026-86831.md): Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS (CVSS 8.7, aws-network-policy-agent · AWS amazon-vpc-cni-k8s)
- [CVE-2026-92475](https://cve.now/CVE-2026-92475.md): GPAC downloader.c wait\_for\_header\_and\_parse out-of-bounds (CVSS 4.8, GPAC)
- [CVE-2026-87026](https://cve.now/CVE-2026-87026.md): Tanium addressed an improper access controls vulnerability in Threat Response. (CVSS 3.8, Tanium Threat Response)
- [CVE-2026-87113](https://cve.now/CVE-2026-87113.md): Tanium addressed an improper access controls vulnerability in Threat Response. (CVSS 6.3, Tanium Threat Response)
- [CVE-2026-87105](https://cve.now/CVE-2026-87105.md): Tanium addressed a SQL injection vulnerability in Threat Response. (CVSS 8.8, Tanium Threat Response)
- [CVE-2026-87116](https://cve.now/CVE-2026-87116.md): Tanium addressed a server-side request forgery vulnerability in Threat Response. (CVSS 6.5, Tanium Threat Response)
- [CVE-2026-87024](https://cve.now/CVE-2026-87024.md): Tanium addressed a SQL injection vulnerability in Asset. (CVSS 7.2, Tanium Asset)
- [CVE-2026-87076](https://cve.now/CVE-2026-87076.md): Tanium addressed an information disclosure vulnerability in Discover. (CVSS 6.5, Tanium Discover)
- [CVE-2026-86865](https://cve.now/CVE-2026-86865.md): Tanium addressed a SQL injection vulnerability in Asset. (CVSS 7.2, Tanium Asset)
- [CVE-2026-70469](https://cve.now/CVE-2026-70469.md): Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests (CVSS 7.5, Apache Software Foundation Apache NiFi)
- [CVE-2026-81866](https://cve.now/CVE-2026-81866.md): Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration (CVSS 0.5, Apache Software Foundation Apache NiFi)
- [CVE-2026-82561](https://cve.now/CVE-2026-82561.md): Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods (CVSS 5.9, Apache Software Foundation Apache NiFi)
- [CVE-2026-86089](https://cve.now/CVE-2026-86089.md): Apache NiFi: Missing Process Group Authorization for Connector Migration (CVSS 2.3, Apache Software Foundation Apache NiFi)
- [CVE-2026-87976](https://cve.now/CVE-2026-87976.md): Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles (CVSS 7.2, Apache Software Foundation Apache NiFi Registry)
- [CVE-2026-76646](https://cve.now/CVE-2026-76646.md): Apache MyFaces: Denial of Service via Unbounded Request Parsing (CVSS 7.5, Apache Software Foundation Apache MyFaces)
- [CVE-2026-92474](https://cve.now/CVE-2026-92474.md): GPAC Proto Link mpeg4\_inline.c gf\_inline\_get\_proto\_lib use after free (CVSS 4.8, GPAC)
- [CVE-2026-63225](https://cve.now/CVE-2026-63225.md): Redocly CLI: Path traversal when using \`split\` command (CVSS 4.4, redocly-cli · @redocly/cli)
- [CVE-2026-63325](https://cve.now/CVE-2026-63325.md): Redocly CLI: Arbitrary code execution via Arazzo \`$faker\` expression using \`respect\` (CVSS 7.8, redocly-cli)
- [CVE-2026-86071](https://cve.now/CVE-2026-86071.md): Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root (CVSS 3.7, junrar · com.github.junrar:junrar)
- [CVE-2026-73462](https://cve.now/CVE-2026-73462.md): On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-92473](https://cve.now/CVE-2026-92473.md): GPAC BIFS commands.c gf\_sg\_command\_del use after free (CVSS 4.8, GPAC)
- [CVE-2026-73457](https://cve.now/CVE-2026-73457.md): Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users. (CVSS 5.3, Arista Networks EOS)
- [CVE-2026-91106](https://cve.now/CVE-2026-91106.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 9.3, HP Linux Imaging and Printing Software)
- [CVE-2026-73456](https://cve.now/CVE-2026-73456.md): Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch. (CVSS 10.0, Arista Networks EOS)
- [CVE-2026-91105](https://cve.now/CVE-2026-91105.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 8.6, HP Linux Imaging and Printing Software)
- [CVE-2026-91104](https://cve.now/CVE-2026-91104.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 9.3, HP Linux Imaging and Printing Software)
- [CVE-2026-91103](https://cve.now/CVE-2026-91103.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 5.1, HP Linux Imaging and Printing Software)
- [CVE-2026-86043](https://cve.now/CVE-2026-86043.md): Skipper: OPA body-authz bypass: truncated\_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) (CVSS 7.5, zalando skipper · github.com/zalando/skipper)
- [CVE-2026-91102](https://cve.now/CVE-2026-91102.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 8.4, HP Linux Imaging and Printing Software)
- [CVE-2026-73442](https://cve.now/CVE-2026-73442.md): On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for (CVSS 3.0, Arista Networks EOS)
- [CVE-2026-91101](https://cve.now/CVE-2026-91101.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 5.1, HP Linux Imaging and Printing Software)
- [CVE-2026-81876](https://cve.now/CVE-2026-81876.md): HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +2)
- [CVE-2026-91100](https://cve.now/CVE-2026-91100.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 6.8, HP Linux Imaging and Printing Software)
- [CVE-2026-73443](https://cve.now/CVE-2026-73443.md): On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef (CVSS 4.7, Arista Networks EOS)
- [CVE-2026-91099](https://cve.now/CVE-2026-91099.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 5.1, HP Linux Imaging and Printing Software)
- [CVE-2026-92472](https://cve.now/CVE-2026-92472.md): GPAC MP4Box base\_scenegraph.c gf\_node\_deactivate\_ex use after free (CVSS 4.8, GPAC)
- [CVE-2026-81875](https://cve.now/CVE-2026-81875.md): HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service (CVSS 7.5, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +2)
- [CVE-2026-91098](https://cve.now/CVE-2026-91098.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 8.6, HP Linux Imaging and Printing Software)
- [CVE-2026-77360](https://cve.now/CVE-2026-77360.md): oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass (CVSS 6.3, middleapi orpc · @orpc/server)
- [CVE-2026-68536](https://cve.now/CVE-2026-68536.md): Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability (CVSS 9.8, Apache Software Foundation Apache MyFaces)
- [CVE-2026-86003](https://cve.now/CVE-2026-86003.md): CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP (CVSS 7.5, coredns · github.com/coredns/coredns)
- [CVE-2026-91097](https://cve.now/CVE-2026-91097.md): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (CVSS 7.0, HP Linux Imaging and Printing Software)
- [CVE-2026-82399](https://cve.now/CVE-2026-82399.md): CoreDNS: Unauthenticated memory exhaustion in custom transports (CVSS 7.5, coredns · github.com/coredns/coredns)
- [CVE-2026-59823](https://cve.now/CVE-2026-59823.md): LiteLLM: Server-side request forgery via the \`user\_config\` request parameter in LiteLLM Proxy (CVSS 5.3, BerriAI litellm · litellm)
- [CVE-2026-81176](https://cve.now/CVE-2026-81176.md): Svelte devalue: DoS via malformed input (CVSS 5.3, sveltejs devalue · devalue)
- [CVE-2026-92729](https://cve.now/CVE-2026-92729.md): SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints (CVSS 8.8, signoz)
- [CVE-2026-75516](https://cve.now/CVE-2026-75516.md): RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement (CVSS 8.7, rabbitmq-java-client · com.rabbitmq:amqp-client)
- [CVE-2026-46352](https://cve.now/CVE-2026-46352.md): Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock (CVSS 7.5, OISF suricata)
- [CVE-2026-75025](https://cve.now/CVE-2026-75025.md): Mattermost Desktop local network access from server-rendered content (CVSS 4.7, Mattermost)
- [CVE-2026-92418](https://cve.now/CVE-2026-92418.md): ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting (CVSS 5.1, ChangeWeDer crm)
- [CVE-2026-63126](https://cve.now/CVE-2026-63126.md): Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799) (CVSS 7.5, square wire · com.squareup.wire:wire-runtime)
- [CVE-2026-92417](https://cve.now/CVE-2026-92417.md): Open5GS PFCP types.c ogs\_pfcp\_parse\_volume\_measurement null pointer dereference (CVSS 7.1, Open5GS)
- [CVE-2026-69147](https://cve.now/CVE-2026-69147.md): vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-92416](https://cve.now/CVE-2026-92416.md): Open5GS PFCP Session Report Request n4-handler.c smf\_n4\_handle\_session\_report\_request assertion (CVSS 5.3, Open5GS)
- [CVE-2026-47094](https://cve.now/CVE-2026-47094.md): SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id} (CVSS 8.7, SIMAC MyPHR)
- [CVE-2026-92720](https://cve.now/CVE-2026-92720.md): Kubero through 3.1.1 Unauthenticated Notifications API Access (CVSS 9.3, kubero-dev kubero)
- [CVE-2026-92719](https://cve.now/CVE-2026-92719.md): Quickwit through 0.9.0 SSRF via SQS queue\_url Parameter (CVSS 8.7, quickwit-oss quickwit)
- [CVE-2026-92718](https://cve.now/CVE-2026-92718.md): Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache (CVSS 7.0, projectdiscovery nuclei)
- [CVE-2026-92717](https://cve.now/CVE-2026-92717.md): Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub (CVSS 9.3, cobbr Covenant)
- [CVE-2026-92716](https://cve.now/CVE-2026-92716.md): Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation (CVSS 8.6, Shuffle)
- [CVE-2026-92605](https://cve.now/CVE-2026-92605.md): IRIS through 2.4.29 Unauthorized Comment Access via Object ID (CVSS 7.1, dfir-iris iris-web)
- [CVE-2026-92604](https://cve.now/CVE-2026-92604.md): Scirius through 3.8.0 Arbitrary File Write via PCAP Upload (CVSS 7.2, StamusNetworks scirius)
- [CVE-2026-92413](https://cve.now/CVE-2026-92413.md): Artifex MuPDF PDF Xref Loading pdf-stream.c pdf\_open\_filter null pointer dereference (CVSS 5.3, Artifex MuPDF)
- [CVE-2026-84397](https://cve.now/CVE-2026-84397.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1)
- [CVE-2026-18120](https://cve.now/CVE-2026-18120.md): Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data (CVSS 6.3, Concrete CMS)
- [CVE-2026-92406](https://cve.now/CVE-2026-92406.md): SourceCodester Inventory and Monitoring System btn\_functions.php add sql injection (CVSS 6.9, SourceCodester Inventory and Monitoring System)
- [CVE-2026-85387](https://cve.now/CVE-2026-85387.md): Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access (CVSS 2.0, Concrete CMS)
- [CVE-2026-92405](https://cve.now/CVE-2026-92405.md): SourceCodester Inventory and Monitoring System index.php sql injection (CVSS 6.9, SourceCodester Inventory and Monitoring System)
- [CVE-2026-20234](https://cve.now/CVE-2026-20234.md): Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities (CVSS 9.9, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20331](https://cve.now/CVE-2026-20331.md): Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Protection Mechanism Failure Vulnerabilities (CVSS 9.6, Cisco Secure Firewall Adaptive Security Appliance (ASA)… +1)
- [CVE-2026-42784](https://cve.now/CVE-2026-42784.md): Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion (CVSS 7.4, Red Hat Ansible Automation Platform 2.6 for RHEL · Red H… +7)
- [CVE-2026-76420](https://cve.now/CVE-2026-76420.md): Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability (CVSS 9.0, Cisco Secure Firewall Management Center)
- [CVE-2026-20307](https://cve.now/CVE-2026-20307.md): Cisco Identity Services Engine Remote Code Execution Vulnerability (CVSS 9.9, Cisco Identity Services Engine Software)
- [CVE-2026-20305](https://cve.now/CVE-2026-20305.md): Cisco Identity Services Engine Command Injection Vulnerability (CVSS 9.1, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-20306](https://cve.now/CVE-2026-20306.md): Cisco Identity Services Engine Command Injection Vulnerability (CVSS 9.1, Cisco Identity Services Engine Software · Cisco ISE Passive…)
- [CVE-2026-92402](https://cve.now/CVE-2026-92402.md): ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization (CVSS 5.3, ChangeWeDer crm)
- [CVE-2026-87031](https://cve.now/CVE-2026-87031.md): Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation (CVSS 2.1, Concrete CMS)
- [CVE-2026-87028](https://cve.now/CVE-2026-87028.md): Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields (CVSS 5.3, Concrete CMS)
- [CVE-2026-57173](https://cve.now/CVE-2026-57173.md): vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2026-85386](https://cve.now/CVE-2026-85386.md): Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block (CVSS 7.3, Concrete CMS)
- [CVE-2026-85756](https://cve.now/CVE-2026-85756.md): SSH.NET: ScpClient allows server-side RCE via default SCP path handling (CVSS 7.5, sshnet SSH.NET · SSH.NET)
- [CVE-2026-85385](https://cve.now/CVE-2026-85385.md): Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field (CVSS 7.7, Concrete CMS)
- [CVE-2026-92401](https://cve.now/CVE-2026-92401.md): ChangeWeDer crm improper authentication (CVSS 6.9, ChangeWeDer crm)
- [CVE-2026-84993](https://cve.now/CVE-2026-84993.md): MikroORM: SQL injection via unvalidated order direction in orderBy (CVSS 6.5, mikro-orm)
- [CVE-2026-86359](https://cve.now/CVE-2026-86359.md): Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. (CVSS 8.5, Dell Repository Manager)
- [CVE-2026-85731](https://cve.now/CVE-2026-85731.md): oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) (CVSS 8.8, oras-project oras-go · oras.land/oras-go/v2)
- [CVE-2026-86358](https://cve.now/CVE-2026-86358.md): Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. (CVSS 6.5, Dell Update Package Framework)
- [CVE-2026-85732](https://cve.now/CVE-2026-85732.md): oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing (CVSS 4.7, oras-project oras-go · oras.land/oras-go/v2)
- [CVE-2026-71182](https://cve.now/CVE-2026-71182.md): Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulner (CVSS 3.0, Dell Update Package Framework)
- [CVE-2026-68904](https://cve.now/CVE-2026-68904.md): node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion (CVSS 7.0, node-opcua · node-opcua-transport +1)
- [CVE-2026-71181](https://cve.now/CVE-2026-71181.md): Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulner (CVSS 3.0, Dell Update Package Framework)
- [CVE-2026-69200](https://cve.now/CVE-2026-69200.md): node-opcua: Prototype Pollution via internal \`fieldsToJson()\` implementation (Related to CVE-2024-57086) (CVSS 3.7, node-opcua)
- [CVE-2026-92399](https://cve.now/CVE-2026-92399.md): GPAC WebSocket rmt\_ws.c rmt\_client\_handle\_ws\_frame heap-based overflow (CVSS 6.9, GPAC)
- [CVE-2026-71180](https://cve.now/CVE-2026-71180.md): Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. (CVSS 8.2, Dell Update Package Framework)
- [CVE-2026-59974](https://cve.now/CVE-2026-59974.md): Stanza: Zip Slip Path Traversal in Model/Resource Extraction (CVSS 7.8, stanfordnlp stanza)
- [CVE-2026-59944](https://cve.now/CVE-2026-59944.md): Composer: CVE-2026-59946 fix bypass via symlinked package bin path (CVSS 6.1, composer · composer/composer)
- [CVE-2026-71179](https://cve.now/CVE-2026-71179.md): Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('O (CVSS 7.3, Dell Update Package Framework)
- [CVE-2026-92603](https://cve.now/CVE-2026-92603.md): ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController (CVSS 7.1, continew-org continew-admin)
- [CVE-2026-92602](https://cve.now/CVE-2026-92602.md): TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL (CVSS 7.1, TDuckCloud tduck-survey-form)
- [CVE-2026-92601](https://cve.now/CVE-2026-92601.md): Guns through 8.3.5 Improper Access Control via SysNoticeController (CVSS 7.1, stylefeng Guns)
- [CVE-2026-92600](https://cve.now/CVE-2026-92600.md): Guns through 8.3.5 Information Disclosure via Missing Permission Check (CVSS 7.1, stylefeng Guns)
- [CVE-2026-92398](https://cve.now/CVE-2026-92398.md): Ruijie RG-EW3000GX user\_list\_note admin os command injection (CVSS 9.4, Ruijie RG-EW3000GX)
- [CVE-2026-61593](https://cve.now/CVE-2026-61593.md): djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session (CVSS 8.1, djust-org djust · djust)
- [CVE-2026-19607](https://cve.now/CVE-2026-19607.md): Keycloak-services: keycloak-services: broker-originated username collision causes account lockout (CVSS 5.3, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-17526](https://cve.now/CVE-2026-17526.md): Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts (CVSS 7.2, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-90999](https://cve.now/CVE-2026-90999.md): Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment (CVSS 9.8, Functional Software Sentry Seer)
- [CVE-2026-92397](https://cve.now/CVE-2026-92397.md): Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc\_set os command injection (CVSS 9.4, Ruijie RG-EW3000GX)
- [CVE-2025-59953](https://cve.now/CVE-2025-59953.md): LMdeploy has Remote Code Execution by Pickle Deserialization via zmq\_rpc.call\_and\_response() in InterLM/lmdeploy (CVSS 9.8, InternLM lmdeploy · lmdeploy)
- [CVE-2026-61595](https://cve.now/CVE-2026-61595.md): djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data (CVSS 7.7, djust-org djust · djust)
- [CVE-2026-92626](https://cve.now/CVE-2026-92626.md): Control iD iDSecure Unauthenticated Denial of Service (CVSS 7.5, Control iD iDSecure)
- [CVE-2026-92625](https://cve.now/CVE-2026-92625.md): Control iD iDSecure Unauthenticated Denial of Service (CVSS 7.5, Control iD iDSecure)
- [CVE-2026-92615](https://cve.now/CVE-2026-92615.md): Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed (CVSS 6.6, Red Hat Advanced Cluster Management for Kubernetes · Red Ha…)
- [CVE-2026-70416](https://cve.now/CVE-2026-70416.md): Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. (CVSS 10.0, Dell ObjectScale)
- [CVE-2026-92627](https://cve.now/CVE-2026-92627.md): Heap Use-After-Free in H5T\_\_conv\_f\_f (CVSS 4.6, The HDF Group HDF5)
- [CVE-2026-92385](https://cve.now/CVE-2026-92385.md): SourceCodester Online Food Ordering System Category Update update\_category.php cross site scripting (CVSS 4.8, SourceCodester Online Food Ordering System)
- [CVE-2026-76104](https://cve.now/CVE-2026-76104.md): Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. (CVSS 5.5, Dell ObjectScale)
- [CVE-2026-26947](https://cve.now/CVE-2026-26947.md): Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnera (CVSS 6.7, Dell ECS)
- [CVE-2025-43936](https://cve.now/CVE-2025-43936.md): Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. (CVSS 8.1, Dell ObjectScale)
- [CVE-2025-36591](https://cve.now/CVE-2025-36591.md): Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken or Risky Cryptographi (CVSS 4.4, Dell Elastic Cloud Storage)
- [CVE-2026-92383](https://cve.now/CVE-2026-92383.md): PbootCMS User Management UserController.php mod cross-site request forgery (CVSS 5.3, PbootCMS)
- [CVE-2026-82410](https://cve.now/CVE-2026-82410.md): Pocketbase: Unhandled panic in worker goroutines (CVSS 8.7, pocketbase · github.com/pocketbase/pocketbase)
- [CVE-2026-79651](https://cve.now/CVE-2026-79651.md): Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching (CVSS 7.5, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-74909](https://cve.now/CVE-2026-74909.md): Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments (CVSS 8.1, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-18212](https://cve.now/CVE-2026-18212.md): Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state (CVSS 7.5, Red Hat build of Keycloak · Red Hat Data Grid +2)
- [CVE-2026-84860](https://cve.now/CVE-2026-84860.md): Scada-LTS DWR Authorization Bypass - Systemic (CVSS 8.8, Scada-LTS)
- [CVE-2026-84859](https://cve.now/CVE-2026-84859.md): Scada-LTS Authenticated Blind SQL Injection (CVSS 6.5, Scada-LTS)
- [CVE-2026-84858](https://cve.now/CVE-2026-84858.md): Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass (CVSS 8.8, Scada-LTS)
- [CVE-2026-63127](https://cve.now/CVE-2026-63127.md): RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery (CVSS 8.2, modelcontextprotocol rust-sdk · rmcp)
- [CVE-2026-63128](https://cve.now/CVE-2026-63128.md): RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service (CVSS 7.5, modelcontextprotocol rust-sdk · rmcp)
- [CVE-2026-77409](https://cve.now/CVE-2026-77409.md): RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking (CVSS 8.2, rabbitmq amqp091-go)
- [CVE-2026-77411](https://cve.now/CVE-2026-77411.md): RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr (CVSS 9.5, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-92381](https://cve.now/CVE-2026-92381.md): PbootCMS Template Rendering ContentController.php decode\_string cross site scripting (CVSS 5.1, PbootCMS)
- [CVE-2026-77412](https://cve.now/CVE-2026-77412.md): RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client (CVSS 8.9, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-77405](https://cve.now/CVE-2026-77405.md): RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser (CVSS 9.4, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-77404](https://cve.now/CVE-2026-77404.md): RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection (CVSS 8.7, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-92570](https://cve.now/CVE-2026-92570.md): reNgine through 2.2.0 Unauthorized Configuration File Read (CVSS 7.1, yogeshojha rengine)
- [CVE-2026-92569](https://cve.now/CVE-2026-92569.md): Hippo4j through 1.5.0 SSRF via clientAddress Parameter (CVSS 4.3, opengoofy hippo4j)
- [CVE-2026-92568](https://cve.now/CVE-2026-92568.md): MLRun through 1.11.0 Server-Side Request Forgery via Webhook (CVSS 5.3, mlrun)
- [CVE-2026-92567](https://cve.now/CVE-2026-92567.md): TDuck survey form through 5.0 Unauthorized Data Modification (CVSS 7.1, TDuckCloud tduck-survey-form)
- [CVE-2026-92566](https://cve.now/CVE-2026-92566.md): DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview (CVSS 8.2, datageartech datagear)
- [CVE-2026-92565](https://cve.now/CVE-2026-92565.md): Rallly before 4.15.0 Information Disclosure via polls.get (CVSS 5.3, lukevella rallly)
- [CVE-2026-77410](https://cve.now/CVE-2026-77410.md): RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation (CVSS 8.9, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-92616](https://cve.now/CVE-2026-92616.md): FileRise \< 3.28.0 Privilege Escalation via WebDAV Session Inheritance (CVSS 7.6, error311 FileRise)
- [CVE-2026-77406](https://cve.now/CVE-2026-77406.md): RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration (CVSS 8.2, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-77403](https://cve.now/CVE-2026-77403.md): RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation (CVSS 8.9, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-92395](https://cve.now/CVE-2026-92395.md): @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (CVSS 9.1, @fastify/proxy-addr)
- [CVE-2026-77407](https://cve.now/CVE-2026-77407.md): RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields (CVSS 7.0, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-92380](https://cve.now/CVE-2026-92380.md): WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery (CVSS 6.9, WuzhiCMS)
- [CVE-2026-77408](https://cve.now/CVE-2026-77408.md): RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow (CVSS 9.1, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-77401](https://cve.now/CVE-2026-77401.md): Zope AccessControl: Information disclosure through Python string \`format\` and \`format\_map\` functions (CVSS 6.8, zopefoundation AccessControl · accesscontrol)
- [CVE-2026-63671](https://cve.now/CVE-2026-63671.md): @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration (CVSS 8.1, nuxt-content mdc · @nuxtjs/mdc)
- [CVE-2026-92087](https://cve.now/CVE-2026-92087.md): @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth (CVSS 8.1, @fastify/auth)
- [CVE-2026-77119](https://cve.now/CVE-2026-77119.md): NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (CVSS 5.9, ISC BIND)
- [CVE-2026-75029](https://cve.now/CVE-2026-75029.md): Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (CVSS 5.3, ISC BIND)
- [CVE-2026-92366](https://cve.now/CVE-2026-92366.md): code-projects Matrimonial System Regular Search search.php sql injection (CVSS 6.9, code-projects Matrimonial System)
- [CVE-2026-88064](https://cve.now/CVE-2026-88064.md): Backstage: Improper input validation in TechDocs MkDocs configuration (CVSS 8.8, backstage)
- [CVE-2026-19668](https://cve.now/CVE-2026-19668.md): Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (CVSS 5.3, ISC BIND)
- [CVE-2026-88976](https://cve.now/CVE-2026-88976.md): @platejs/core HTML deserialization can trigger browser behavior during parsing (CVSS 6.1, udecode plate · @platejs/core)
- [CVE-2026-19033](https://cve.now/CVE-2026-19033.md): Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (CVSS 6.5, ISC BIND)
- [CVE-2026-76825](https://cve.now/CVE-2026-76825.md): RestrictedPython: Sandbox escape via string.Formatter field resolution (CVSS 8.4, zopefoundation RestrictedPython · restrictedpython)
- [CVE-2026-84997](https://cve.now/CVE-2026-84997.md): react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU (CVSS 7.5, reactphp http · react/http)
- [CVE-2026-80274](https://cve.now/CVE-2026-80274.md): Validating resolver can abort while caching a mismatched NOQNAME proof (CVSS 7.5, ISC BIND)
- [CVE-2026-61709](https://cve.now/CVE-2026-61709.md): OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a \`but not\` exclusion under a type-bound wildcard is intersected (\`and\`) with another relation that also grants that user (CVSS 5.3, openfga · github.com/openfga/openfga)
- [CVE-2026-76163](https://cve.now/CVE-2026-76163.md): named aborts on a TKEY query when the user configuration has no global options statement (CVSS 7.5, ISC BIND)
- [CVE-2026-89031](https://cve.now/CVE-2026-89031.md): Blog2Social WordPress Plugin \< 9.1.0 Broken Access Control via b2s\_calendar\_move\_post (CVSS 5.3, Adenion Blog2Social)
- [CVE-2026-19666](https://cve.now/CVE-2026-19666.md): Use-after-free in query\_addnoqnameproof() via the DNS64 filter64 path (CVSS 7.5, ISC BIND)
- [CVE-2026-82964](https://cve.now/CVE-2026-82964.md): Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys (CVSS 8.8, Gen Digital Avast Free Antivirus, Avast One, Avast Premi… +1)
- [CVE-2026-89030](https://cve.now/CVE-2026-89030.md): Blog2Social WordPress Plugin \< 9.1.0 User Email Disclosure via b2s\_search\_user (CVSS 5.3, Adenion Blog2Social)
- [CVE-2026-92365](https://cve.now/CVE-2026-92365.md): vllm-project vllm thinking\_budget\_state.py algorithmic complexity (CVSS 5.3, vllm-project vllm)
- [CVE-2026-81563](https://cve.now/CVE-2026-81563.md): SVCB AliasMode additional-data error leaks qpcache references (CVSS 7.5, ISC BIND)
- [CVE-2026-89029](https://cve.now/CVE-2026-89029.md): Blog2Social WordPress Plugin \< 9.1.0 User Enumeration via AJAX Handler (CVSS 5.3, Adenion Blog2Social)
- [CVE-2026-61598](https://cve.now/CVE-2026-61598.md): Client mass-assignment of arbitrary view attributes via the default dj-model update\_model handler (CVSS 7.1, djust-org djust · djust)
- [CVE-2026-78301](https://cve.now/CVE-2026-78301.md): Out-of-zone database nodes can become authoritative zone cuts (CVSS 5.8, ISC BIND)
- [CVE-2026-77692](https://cve.now/CVE-2026-77692.md): Unauthenticated remote crash of named via a single DoH SIG(0) request (CVSS 7.5, ISC BIND)
- [CVE-2026-92141](https://cve.now/CVE-2026-92141.md): Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phish (CVSS 4.3, Jenkins Project Jenkins Keycloak Authentication Plugin)
- [CVE-2026-92140](https://cve.now/CVE-2026-92140.md): Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, result (CVSS 6.8, Jenkins Project Jenkins Gitee Plugin)
- [CVE-2026-92139](https://cve.now/CVE-2026-92139.md): Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and (CVSS 6.5, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2026-92138](https://cve.now/CVE-2026-92138.md): The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the \`oauth\_callback\` URL from the su (CVSS 4.2, Jenkins Project Jenkins Bitbucket Server Integration Plugin)
- [CVE-2026-92137](https://cve.now/CVE-2026-92137.md): Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is co (CVSS 8.8, Jenkins Project Jenkins Robot Framework Plugin)
- [CVE-2026-92136](https://cve.now/CVE-2026-92136.md): Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resultin (CVSS 8.0, Jenkins Project Jenkins OWASP Dependency-Check Plugin)
- [CVE-2026-92135](https://cve.now/CVE-2026-92135.md): Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted thr (CVSS 8.0, Jenkins Project Jenkins Coverage Plugin)
- [CVE-2026-92134](https://cve.now/CVE-2026-92134.md): Jenkins Warnings Plugin 13.10258.va\_17d49a\_78c3b\_ and earlier does not validate the analysis results ID when a job configuration is submitte (CVSS 8.0, Jenkins Project Jenkins Warnings Plugin)
- [CVE-2026-92133](https://cve.now/CVE-2026-92133.md): Jenkins GitLab Plugin 1.2149.vcfc32c82b\_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials unde (CVSS 5.4, Jenkins Project Jenkins GitLab Plugin)
- [CVE-2026-92132](https://cve.now/CVE-2026-92132.md): Jenkins Gradle Plugin 2.19.1252.v15196b\_5a\_6e10 and earlier requests build scan data from the build scan link detected in the build log, eve (CVSS 5.4, Jenkins Project Jenkins Gradle Plugin)
- [CVE-2026-92131](https://cve.now/CVE-2026-92131.md): Jenkins Pipeline: Groovy Libraries Plugin 805.va\_fc79344957d and earlier does not restrict the library path provided to the library Pipeline (CVSS 4.2, Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin)
- [CVE-2026-92130](https://cve.now/CVE-2026-92130.md): Jenkins Pipeline: Multibranch Plugin 841.vec5b\_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resol (CVSS 3.1, Jenkins Project Jenkins Pipeline: Multibranch Plugin)
- [CVE-2026-92129](https://cve.now/CVE-2026-92129.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92128](https://cve.now/CVE-2026-92128.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the (CVSS 7.5, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92127](https://cve.now/CVE-2026-92127.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier automatically approves the classpath entries in an item configuration when (CVSS 8.0, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92126](https://cve.now/CVE-2026-92126.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an (CVSS 7.2, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92125](https://cve.now/CVE-2026-92125.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing atta (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92124](https://cve.now/CVE-2026-92124.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier checks the operations Groovy will perform with the elements it reads from a (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92123](https://cve.now/CVE-2026-92123.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not intercept operations performed on a null receiver (method calls, p (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-92122](https://cve.now/CVE-2026-92122.md): Jenkins Script Security Plugin 1415.v9a\_f9b\_3a\_c253d and earlier does not check the method called through the proxy created when a sandboxed (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin)
- [CVE-2026-19941](https://cve.now/CVE-2026-19941.md): checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (CVSS 5.9, ISC BIND)
- [CVE-2026-61590](https://cve.now/CVE-2026-61590.md): djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG (CVSS 7.4, djust-org djust · djust)
- [CVE-2026-19662](https://cve.now/CVE-2026-19662.md): qpcache NOQNAME proof use-after-free crashes recursive resolver (CVSS 5.9, ISC BIND)
- [CVE-2026-19667](https://cve.now/CVE-2026-19667.md): Remote assertion failure via 16-bit length truncation in \`dns\_ncache\_add()\` (CVSS 7.5, ISC BIND)
- [CVE-2026-92364](https://cve.now/CVE-2026-92364.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-81736](https://cve.now/CVE-2026-81736.md): Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (CVSS 7.5, ISC BIND)
- [CVE-2026-85104](https://cve.now/CVE-2026-85104.md): Brain stimulation parameters can be modified via Bluetooth in Sooma (CVSS 5.3, Sooma tDCS Home Therapy)
- [CVE-2026-92363](https://cve.now/CVE-2026-92363.md): ag-ui-protocol ag-ui JSON sse\_parser.cpp resource consumption (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-92469](https://cve.now/CVE-2026-92469.md): microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check (CVSS 7.2, zlt2000 microservices-platform)
- [CVE-2026-92468](https://cve.now/CVE-2026-92468.md): microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center (CVSS 7.1, zlt2000 microservices-platform)
- [CVE-2026-92467](https://cve.now/CVE-2026-92467.md): microservices-platform through 6.0.0 Unverified Password Change via /users/password (CVSS 8.7, zlt2000 microservices-platform)
- [CVE-2026-92466](https://cve.now/CVE-2026-92466.md): microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking (CVSS 8.7, zlt2000 microservices-platform)
- [CVE-2026-92362](https://cve.now/CVE-2026-92362.md): ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption (CVSS 6.9, ag-ui-protocol ag-ui)
- [CVE-2026-89028](https://cve.now/CVE-2026-89028.md): MikroTik RouterOS \< 7.24 Heap Corruption via SMB1 SessionSetupAndX (CVSS 8.2, MikroTik RouterOS)
- [CVE-2026-56719](https://cve.now/CVE-2026-56719.md): MikroTik RouterOS \< 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX (CVSS 6.3, MikroTik RouterOS)
- [CVE-2026-73177](https://cve.now/CVE-2026-73177.md): Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-91843](https://cve.now/CVE-2026-91843.md): Stack overflow in login process to the Security Management and Log Servers (CVSS 9.8, checkpoint Quantum Security Management)
- [CVE-2026-73176](https://cve.now/CVE-2026-73176.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73175](https://cve.now/CVE-2026-73175.md): Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI- (CVSS 7.1, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-92361](https://cve.now/CVE-2026-92361.md): ag-ui-protocol ag-ui SSE Client client.go resource consumption (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-73174](https://cve.now/CVE-2026-73174.md): Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protoco (CVSS 8.7, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73173](https://cve.now/CVE-2026-73173.md): Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol o (CVSS 8.8, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73172](https://cve.now/CVE-2026-73172.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera (CVSS 9.3, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73171](https://cve.now/CVE-2026-73171.md): Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EK (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73170](https://cve.now/CVE-2026-73170.md): Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import w (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73169](https://cve.now/CVE-2026-73169.md): Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability (CVSS 6.3, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73167](https://cve.now/CVE-2026-73167.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73166](https://cve.now/CVE-2026-73166.md): Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management inte (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73165](https://cve.now/CVE-2026-73165.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73164](https://cve.now/CVE-2026-73164.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-73163](https://cve.now/CVE-2026-73163.md): Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-19535](https://cve.now/CVE-2026-19535.md): Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advan (CVSS 8.6, Advantech EKI-1242IEIMS · Advantech EKI-1242EIMS)
- [CVE-2026-92360](https://cve.now/CVE-2026-92360.md): ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-88817](https://cve.now/CVE-2026-88817.md): Privilege escalation via legacy access group creation endpoint (CVSS 8.7, Curiosity Workspace)
- [CVE-2026-92359](https://cve.now/CVE-2026-92359.md): ag-ui-protocol ag-ui CORSMiddleware utils.py create\_strands\_app cross-domain policy (CVSS 2.3, ag-ui-protocol ag-ui)
- [CVE-2026-92465](https://cve.now/CVE-2026-92465.md): WordPress WP Mega Menu plugin \<= 1.4.2 - SQL Injection vulnerability (CVSS 7.6, Themeum WP Mega Menu)
- [CVE-2026-58147](https://cve.now/CVE-2026-58147.md): Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers (CVSS 9.3, WNC T-Mobile 5G Box IDU)
- [CVE-2026-58146](https://cve.now/CVE-2026-58146.md): Unauthorized remote code execution in T-Mobile 5G Box IDU routers (CVSS 9.4, WNC T-Mobile 5G Box IDU)
- [CVE-2026-40857](https://cve.now/CVE-2026-40857.md): CSRF token bypass in T-Mobile 5G Box IDU routers (CVSS 8.4, WNC T-Mobile 5G Box IDU)
- [CVE-2026-40856](https://cve.now/CVE-2026-40856.md): Config disclosure in T-Mobile 5G Box IDU routers (CVSS 7.1, WNC T-Mobile 5G Box IDU)
- [CVE-2026-40855](https://cve.now/CVE-2026-40855.md): Command Injection in T-Mobile 5G Box IDU router via ping functionality (CVSS 9.3, WNC T-Mobile 5G Box IDU)
- [CVE-2026-40854](https://cve.now/CVE-2026-40854.md): Session auth bypass via cookie value in T-Mobile 5G Box IDU routers (CVSS 8.7, WNC T-Mobile 5G Box IDU)
- [CVE-2026-92463](https://cve.now/CVE-2026-92463.md): yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing (CVSS 7.1, guchengwuyue yshop-crm)
- [CVE-2026-92462](https://cve.now/CVE-2026-92462.md): yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep (CVSS 7.1, guchengwuyue yshop-crm)
- [CVE-2026-92461](https://cve.now/CVE-2026-92461.md): yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-92460](https://cve.now/CVE-2026-92460.md): yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing (CVSS 7.1, guchengwuyue yshop-crm)
- [CVE-2026-92459](https://cve.now/CVE-2026-92459.md): yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint (CVSS 7.1, guchengwuyue yshop-crm)
- [CVE-2026-92458](https://cve.now/CVE-2026-92458.md): yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-92457](https://cve.now/CVE-2026-92457.md): yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice (CVSS 7.1, guchengwuyue yshop-crm)
- [CVE-2026-92456](https://cve.now/CVE-2026-92456.md): yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints (CVSS 7.1, guchengwuyue yshop-crm)
- [CVE-2026-92455](https://cve.now/CVE-2026-92455.md): yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints (CVSS 5.3, guchengwuyue yshop-crm)
- [CVE-2026-92357](https://cve.now/CVE-2026-92357.md): a2ui-project a2ui Model Processor model-processor.ts information disclosure (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-86107](https://cve.now/CVE-2026-86107.md): Security Advisory 0180 (CVSS 5.9, Arista Networks VeloCloud)
- [CVE-2026-90049](https://cve.now/CVE-2026-90049.md): net: skbuff: don't skb\_tx\_error() the source skb in skb\_zerocopy() (CVSS 9.3, Linux)
- [CVE-2026-90048](https://cve.now/CVE-2026-90048.md): fs/ntfs3: fix slab-out-of-bounds write in ni\_create\_attr\_list() (CVSS 9.8, Linux)
- [CVE-2026-90047](https://cve.now/CVE-2026-90047.md): drm/xe: Don't hand out the flat CCS storage as usable VRAM (CVSS 7.8, Linux)
- [CVE-2026-90046](https://cve.now/CVE-2026-90046.md): mm/page\_alloc: don't spin\_trylock() in NMI on UP (CVSS 7.8, Linux)
- [CVE-2026-90045](https://cve.now/CVE-2026-90045.md): USB: gadget: ffs: fix mm lifetime handling (CVSS 7.8, Linux)
- [CVE-2026-90044](https://cve.now/CVE-2026-90044.md): usb: gadget: f\_fs: Fix Use-After-Free in AIO error path (CVSS 7.8, Linux)
- [CVE-2026-90043](https://cve.now/CVE-2026-90043.md): zram: fix slot lock bit position on big-endian 64-bit (CVSS 7.8, Linux)
- [CVE-2026-90042](https://cve.now/CVE-2026-90042.md): ceph: properly decrypt filenames in vmalloc() buffers (CVSS 9.8, Linux)
- [CVE-2026-90041](https://cve.now/CVE-2026-90041.md): HID: sony: clean up device list on probe failure (CVSS 8.8, Linux)
- [CVE-2026-90040](https://cve.now/CVE-2026-90040.md): KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped (no CVSS, Linux)
- [CVE-2026-90039](https://cve.now/CVE-2026-90039.md): NFSD: Guard admin state-revocation walks with NFSD\_NET\_UP (no CVSS, Linux)
- [CVE-2026-90038](https://cve.now/CVE-2026-90038.md): NFSD: Prevent client use-after-free during export state revocation (CVSS 9.8, Linux)
- [CVE-2026-90037](https://cve.now/CVE-2026-90037.md): NFSD: Prevent client use-after-free during close\_lru reaping (CVSS 9.8, Linux)
- [CVE-2026-90036](https://cve.now/CVE-2026-90036.md): NFSD: Prevent client use-after-free during blocked-lock reaping (CVSS 9.8, Linux)
- [CVE-2026-90035](https://cve.now/CVE-2026-90035.md): drm/amd/display: fix division by zero in get\_estimated\_bw() (no CVSS, Linux)
- [CVE-2026-90034](https://cve.now/CVE-2026-90034.md): usb: image: mdc800: change kmalloc() to kzalloc() (no CVSS, Linux)
- [CVE-2026-90033](https://cve.now/CVE-2026-90033.md): ALSA: usb-audio: fix OOB write in snd\_usbmidi\_us122l\_output() (no CVSS, Linux)
- [CVE-2026-90032](https://cve.now/CVE-2026-90032.md): media: usbtv: keep device alive while ALSA card exists (CVSS 7.8, Linux)
- [CVE-2026-90031](https://cve.now/CVE-2026-90031.md): usb-storage: ene\_ub6250: fix race between scan work and probe (no CVSS, Linux)
- [CVE-2026-90030](https://cve.now/CVE-2026-90030.md): usb: dwc3: clear forceRM when issuing EndTransfer (CVSS 7.8, Linux)
- [CVE-2026-90029](https://cve.now/CVE-2026-90029.md): usb: storage: realtek\_cr: fix use-after-free on disconnect (no CVSS, Linux)
- [CVE-2026-90028](https://cve.now/CVE-2026-90028.md): usb: typec: hd3ss3220: track VBUS enable state per consumer (no CVSS, Linux)
- [CVE-2026-90027](https://cve.now/CVE-2026-90027.md): usb: typec: qcom-pmic-typec: disable cc\_debounce\_dwork on stop (CVSS 7.8, Linux)
- [CVE-2026-90026](https://cve.now/CVE-2026-90026.md): usb: typec: qcom-pmic: cancel reset\_work on stop (CVSS 7.8, Linux)
- [CVE-2026-90025](https://cve.now/CVE-2026-90025.md): usb: typec: ucsi: displayport: Fix OOB altmode array index (CVSS 7.7, Linux)
- [CVE-2026-90024](https://cve.now/CVE-2026-90024.md): usb: gadget: midi2: Fix null-pointer dereference in f\_midi2\_free\_ep\_reqs (no CVSS, Linux)
- [CVE-2026-90023](https://cve.now/CVE-2026-90023.md): usb: gadget: f\_mass\_storage: fix null pointer dereference in fsg\_common\_set\_num\_buffers() (no CVSS, Linux)
- [CVE-2026-90022](https://cve.now/CVE-2026-90022.md): usb: gadget: f\_midi2: fix use-after-free in string attribute show path (CVSS 7.8, Linux)
- [CVE-2026-90021](https://cve.now/CVE-2026-90021.md): usb: gadget: f\_midi: initialize work in f\_midi\_alloc() (no CVSS, Linux)
- [CVE-2026-90020](https://cve.now/CVE-2026-90020.md): USB: gadget: fix NULL pointer dereference in gadget\_dev\_ioctl() (no CVSS, Linux)
- [CVE-2026-90019](https://cve.now/CVE-2026-90019.md): usb: gadget: fix null pointer dereference in usb\_put\_function\_instance() (no CVSS, Linux)
- [CVE-2026-90018](https://cve.now/CVE-2026-90018.md): staging: rtl8723bs: fix OOB read / stack overflow in rtw\_get\_wps\_attr() (CVSS 8.8, Linux)
- [CVE-2026-90017](https://cve.now/CVE-2026-90017.md): staging: rtl8723bs: fix OOB read in rtw\_action\_frame\_parse() (CVSS 7.1, Linux)
- [CVE-2026-90016](https://cve.now/CVE-2026-90016.md): staging: rtl8723bs: fix OOB read in rtw\_restruct\_wmm\_ie() (CVSS 7.1, Linux)
- [CVE-2026-90015](https://cve.now/CVE-2026-90015.md): xhci: fix lost bounce buffers on TDs spanning several ring segments (no CVSS, Linux)
- [CVE-2026-90014](https://cve.now/CVE-2026-90014.md): tracing: Have show\_event\_filters/triggers files take trace array ref (CVSS 7.8, Linux)
- [CVE-2026-90013](https://cve.now/CVE-2026-90013.md): tracing: Take trace\_array reference when opening options file (CVSS 7.8, Linux)
- [CVE-2026-90012](https://cve.now/CVE-2026-90012.md): spi: Fix DMA mapping ownership on partial map failure (CVSS 9.8, Linux)
- [CVE-2026-90011](https://cve.now/CVE-2026-90011.md): scsi: target: iscsi: Reserve a terminator byte for the login payload (CVSS 9.1, Linux)
- [CVE-2026-90010](https://cve.now/CVE-2026-90010.md): scsi: bsg: Cap io\_uring sense copy to max\_response\_len (CVSS 7.8, Linux)
- [CVE-2026-90009](https://cve.now/CVE-2026-90009.md): scsi: bsg: Fix TOCTOU in io\_uring passthrough command setup (CVSS 7.8, Linux)
- [CVE-2026-90008](https://cve.now/CVE-2026-90008.md): scsi: megaraid\_sas: Limit NVMe request size to the PRP chain frame (CVSS 7.8, Linux)
- [CVE-2026-90007](https://cve.now/CVE-2026-90007.md): scsi: pm8001: Use rollback index when freeing MSI-X vectors (CVSS 7.8, Linux)
- [CVE-2026-90006](https://cve.now/CVE-2026-90006.md): samples/damon/mtier: handle damon\_stop() failure (no CVSS, Linux)
- [CVE-2026-90005](https://cve.now/CVE-2026-90005.md): samples/damon/wsse: handle damon\_start() failure (no CVSS, Linux)
- [CVE-2026-90004](https://cve.now/CVE-2026-90004.md): mm/damon/core: handle region split failure in apply\_min\_nr\_regions() (no CVSS, Linux)
- [CVE-2026-90003](https://cve.now/CVE-2026-90003.md): futex: Prevent rcuwait use-after-free during requeue PI (CVSS 7.8, Linux)
- [CVE-2026-90002](https://cve.now/CVE-2026-90002.md): ftrace: Take trace\_array reference before accessing its ftrace\_ops (CVSS 7.8, Linux)
- [CVE-2026-90001](https://cve.now/CVE-2026-90001.md): HID: bpf: serialize device reference release in struct\_ops destroy path (CVSS 7.8, Linux)
- [CVE-2026-90000](https://cve.now/CVE-2026-90000.md): HID: rmi: fix OOB access with undersized RMI reports (CVSS 8.8, Linux)
- [CVE-2026-89999](https://cve.now/CVE-2026-89999.md): HID: wacom: validate report length in wacom\_intuos\_pro2\_bt\_irq (CVSS 8.1, Linux)
- [CVE-2026-89998](https://cve.now/CVE-2026-89998.md): dm: fix race when loading and unloading a table (CVSS 7.8, Linux)
- [CVE-2026-89997](https://cve.now/CVE-2026-89997.md): dm: fix resume-vs-remove race (CVSS 7.8, Linux)
- [CVE-2026-89996](https://cve.now/CVE-2026-89996.md): dma-buf: dma-heap: don't publish fd before copy\_to\_user() succeeds (no CVSS, Linux)
- [CVE-2026-89995](https://cve.now/CVE-2026-89995.md): dma-direct: return struct page from dma\_direct\_alloc\_from\_pool() (CVSS 8.8, Linux)
- [CVE-2026-89994](https://cve.now/CVE-2026-89994.md): dmaengine: fsl-edma: tracing: no ptr dereference during log output (CVSS 7.8, Linux)
- [CVE-2026-89993](https://cve.now/CVE-2026-89993.md): dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (no CVSS, Linux)
- [CVE-2026-89992](https://cve.now/CVE-2026-89992.md): cpuidle: dt\_idle\_genpd: kfree() the original name allocation (CVSS 8.4, Linux)
- [CVE-2026-89991](https://cve.now/CVE-2026-89991.md): bpf: Fix infinite loop in pcpu\_freelist push with one possible CPU (no CVSS, Linux)
- [CVE-2026-89990](https://cve.now/CVE-2026-89990.md): ceph: lock mutex in ceph\_mds\_check\_access() (CVSS 9.8, Linux)
- [CVE-2026-89989](https://cve.now/CVE-2026-89989.md): ima: Check for ERR\_PTR from dentry\_path() in validate\_hash\_algo() (no CVSS, Linux)
- [CVE-2026-89988](https://cve.now/CVE-2026-89988.md): kprobes: Protect kprobe\_blacklist with RCU (CVSS 7.8, Linux)
- [CVE-2026-89987](https://cve.now/CVE-2026-89987.md): mm/huge\_memory: transfer the pmd dirty bit to the folio on zap (no CVSS, Linux)
- [CVE-2026-89986](https://cve.now/CVE-2026-89986.md): mm/mempolicy: fix sleeping allocation in alloc\_pages\_bulk\_weighted\_interleave() (CVSS 7.8, Linux)
- [CVE-2026-89985](https://cve.now/CVE-2026-89985.md): memcg: keep folio's objcg same as its node (CVSS 7.8, Linux)
- [CVE-2026-89984](https://cve.now/CVE-2026-89984.md): perf/x86/intel: Fix kernel address leakages in LBR stack (no CVSS, Linux)
- [CVE-2026-89983](https://cve.now/CVE-2026-89983.md): i2c: core: fix debugfs UAF on adapter removal (no CVSS, Linux)
- [CVE-2026-89982](https://cve.now/CVE-2026-89982.md): i2c: mux: Fix channel node leak on adapter add failure (no CVSS, Linux)
- [CVE-2026-89981](https://cve.now/CVE-2026-89981.md): arm64: Don't read GMID\_EL1 when MTE is disabled (no CVSS, Linux)
- [CVE-2026-89980](https://cve.now/CVE-2026-89980.md): ALSA: harmony: initialize locks before requesting IRQ (CVSS 8.4, Linux)
- [CVE-2026-89979](https://cve.now/CVE-2026-89979.md): ALSA: pcm: Fix race between non-atomic ops and trigger-start (CVSS 7.8, Linux)
- [CVE-2026-89978](https://cve.now/CVE-2026-89978.md): accel/amdxdna: return early from a zero-length flush (no CVSS, Linux)
- [CVE-2026-89977](https://cve.now/CVE-2026-89977.md): accel/ethosu: check MMIO mapping errors in probe (no CVSS, Linux)
- [CVE-2026-89976](https://cve.now/CVE-2026-89976.md): accel/ethosu: fix job completion fence cleanup (no CVSS, Linux)
- [CVE-2026-89975](https://cve.now/CVE-2026-89975.md): nvme-fabrics: fix DHCHAP secret leak on parse failure (no CVSS, Linux)
- [CVE-2026-89974](https://cve.now/CVE-2026-89974.md): nvme-fc: fix double free of fabrics options when nvme\_add\_ctrl() fails (CVSS 7.5, Linux)
- [CVE-2026-89973](https://cve.now/CVE-2026-89973.md): nvme-tcp: check the data direction of a C2HData PDU (CVSS 8.2, Linux)
- [CVE-2026-89972](https://cve.now/CVE-2026-89972.md): nvme: add missing SRCU grace period in error path (CVSS 9.8, Linux)
- [CVE-2026-89971](https://cve.now/CVE-2026-89971.md): nvme: skip the zoned limits update if the zone info query failed (CVSS 7.5, Linux)
- [CVE-2026-89970](https://cve.now/CVE-2026-89970.md): nvmet-auth: Synchronize timeout work during SQ teardown (CVSS 9.8, Linux)
- [CVE-2026-89969](https://cve.now/CVE-2026-89969.md): nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (CVSS 9.8, Linux)
- [CVE-2026-89968](https://cve.now/CVE-2026-89968.md): nvmet-tcp: reject unsolicited H2CData PDUs (CVSS 7.5, Linux)
- [CVE-2026-89967](https://cve.now/CVE-2026-89967.md): mm/migrate\_device: avoid out-of-bounds writes for compound folios (CVSS 7.8, Linux)
- [CVE-2026-89966](https://cve.now/CVE-2026-89966.md): mm/hugetlb\_cma: fix null nodemask dereference in hugetlb\_cma\_alloc\_frozen\_folio (no CVSS, Linux)
- [CVE-2026-89965](https://cve.now/CVE-2026-89965.md): nvdimm/btt: reject an arena whose nfree is below the lane count (CVSS 7.8, Linux)
- [CVE-2026-89964](https://cve.now/CVE-2026-89964.md): parisc: eisa: Fix infinite loop when parsing invalid IRQ value (no CVSS, Linux)
- [CVE-2026-89963](https://cve.now/CVE-2026-89963.md): powerpc/kexec\_file: Fix null-ptr-def in extra size calculation (no CVSS, Linux)
- [CVE-2026-89962](https://cve.now/CVE-2026-89962.md): powerpc/kexec\_file: Prevent kexec range truncation (no CVSS, Linux)
- [CVE-2026-89961](https://cve.now/CVE-2026-89961.md): powerpc/mm: fix wrong addr\_pfn tracking in compound vmemmap population (CVSS 7.8, Linux)
- [CVE-2026-89960](https://cve.now/CVE-2026-89960.md): s390/vfio-ap: fix stale pqap\_hook pointer on error in vfio\_ap\_mdev\_set\_kvm() (CVSS 8.8, Linux)
- [CVE-2026-89959](https://cve.now/CVE-2026-89959.md): s390/vfio-ap: Fix control domain removal in vfio\_ap\_mdev\_cfg\_remove (CVSS 8.8, Linux)
- [CVE-2026-89958](https://cve.now/CVE-2026-89958.md): s390/vfio-ap: Fix dereference matrix\_mdev-\>kvm without checking for NULL (no CVSS, Linux)
- [CVE-2026-89957](https://cve.now/CVE-2026-89957.md): s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed (CVSS 8.8, Linux)
- [CVE-2026-89956](https://cve.now/CVE-2026-89956.md): s390/vfio-ap: Fix missing lock required to access list of ap\_matrix\_mdev objects (no CVSS, Linux)
- [CVE-2026-89955](https://cve.now/CVE-2026-89955.md): s390/vfio-ap: Fix NULL deref in status\_show() during queue probe (no CVSS, Linux)
- [CVE-2026-89954](https://cve.now/CVE-2026-89954.md): mtd: afs: validate v2 image info bounds (CVSS 8.0, Linux)
- [CVE-2026-89953](https://cve.now/CVE-2026-89953.md): mtd: mtdoops: free page bitmap when the backing MTD is removed (no CVSS, Linux)
- [CVE-2026-89952](https://cve.now/CVE-2026-89952.md): mtd: rawnand: validate ONFI extended parameter page sections (no CVSS, Linux)
- [CVE-2026-89951](https://cve.now/CVE-2026-89951.md): batman-adv: fix stale receive device on merged fragments (CVSS 8.8, Linux)
- [CVE-2026-89950](https://cve.now/CVE-2026-89950.md): batman-adv: mcast: linearize skbuff for packet generation (no CVSS, Linux)
- [CVE-2026-89949](https://cve.now/CVE-2026-89949.md): batman-adv: dat: avoid unaligned fault in IP extraction (no CVSS, Linux)
- [CVE-2026-89948](https://cve.now/CVE-2026-89948.md): batman-adv: bla: fix freeing of claims on meshif deletion (no CVSS, Linux)
- [CVE-2026-89947](https://cve.now/CVE-2026-89947.md): clk: meson: align gxbb\_32k\_clk\_sel number of parents with actual count (CVSS 8.0, Linux)
- [CVE-2026-89946](https://cve.now/CVE-2026-89946.md): ASoC: cs35l33: drain threaded IRQ before runtime suspend (no CVSS, Linux)
- [CVE-2026-89945](https://cve.now/CVE-2026-89945.md): ASoC: cs35l34: drain threaded IRQ before runtime suspend (no CVSS, Linux)
- [CVE-2026-89944](https://cve.now/CVE-2026-89944.md): ASoC: hdac\_hda: Fix hlink refcount leak on component registration failure (no CVSS, Linux)
- [CVE-2026-89943](https://cve.now/CVE-2026-89943.md): ASoC: loongson: Fix error handling in ACPI property parsing (CVSS 8.4, Linux)
- [CVE-2026-89942](https://cve.now/CVE-2026-89942.md): iio: buffer: Fix potential use-after-free in anonymous buffer release (CVSS 7.8, Linux)
- [CVE-2026-89941](https://cve.now/CVE-2026-89941.md): iio: buffer: Make IIO DMA fence release RCU-safe (CVSS 7.8, Linux)
- [CVE-2026-89940](https://cve.now/CVE-2026-89940.md): iio: buffer: Tie IIO dma fence lock lifetime to the fence (CVSS 7.8, Linux)
- [CVE-2026-89939](https://cve.now/CVE-2026-89939.md): iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (no CVSS, Linux)
- [CVE-2026-89938](https://cve.now/CVE-2026-89938.md): iio: chemical: atlas-sensor: use iio\_trigger\_poll\_nested() to fix remove UAF (CVSS 7.8, Linux)
- [CVE-2026-89937](https://cve.now/CVE-2026-89937.md): iio: chemical: sgp30: Handle IAQ thread creation failure (no CVSS, Linux)
- [CVE-2026-89936](https://cve.now/CVE-2026-89936.md): iio: dac: m62332: Fix regulator reference count imbalance (no CVSS, Linux)
- [CVE-2026-89935](https://cve.now/CVE-2026-89935.md): iio: light: apds9306: fix PM reference leak in apds9306\_read\_data() (no CVSS, Linux)
- [CVE-2026-89934](https://cve.now/CVE-2026-89934.md): iio: light: ltrf216a: fix runtime PM reference leak in error path (no CVSS, Linux)
- [CVE-2026-89933](https://cve.now/CVE-2026-89933.md): iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (no CVSS, Linux)
- [CVE-2026-89932](https://cve.now/CVE-2026-89932.md): KVM: nVMX: Always flush vpid02 on first use (CVSS 8.8, Linux)
- [CVE-2026-89931](https://cve.now/CVE-2026-89931.md): KVM: nVMX: Ensure KVM\_REQ\_GET\_NESTED\_STATE\_PAGES is cleared on VM-Exit (no CVSS, Linux)
- [CVE-2026-89930](https://cve.now/CVE-2026-89930.md): KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVSS 9.3, Linux)
- [CVE-2026-89929](https://cve.now/CVE-2026-89929.md): KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (CVSS 8.8, Linux)
- [CVE-2026-89928](https://cve.now/CVE-2026-89928.md): KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk (CVSS 8.8, Linux)
- [CVE-2026-89927](https://cve.now/CVE-2026-89927.md): KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (CVSS 7.1, Linux)
- [CVE-2026-89926](https://cve.now/CVE-2026-89926.md): KVM: s390: Fix length check \_\_import\_wp\_info() (no CVSS, Linux)
- [CVE-2026-89925](https://cve.now/CVE-2026-89925.md): KVM: s390: Fix memory leak in guest debug handling (no CVSS, Linux)
- [CVE-2026-89924](https://cve.now/CVE-2026-89924.md): KVM: s390: Fix old\_data leak in guest debug error path (no CVSS, Linux)
- [CVE-2026-89923](https://cve.now/CVE-2026-89923.md): KVM: s390: Free guest debug data on vcpu destroy (no CVSS, Linux)
- [CVE-2026-89922](https://cve.now/CVE-2026-89922.md): KVM: s390: Take srcu when importing watchpoint data (CVSS 7.8, Linux)
- [CVE-2026-89921](https://cve.now/CVE-2026-89921.md): KVM: s390: Zero initialize data structures for inject\_pfault\_token (no CVSS, Linux)
- [CVE-2026-89920](https://cve.now/CVE-2026-89920.md): KVM: s390: Fix memory corruption by not reinjecting CK machine checks (CVSS 7.8, Linux)
- [CVE-2026-89919](https://cve.now/CVE-2026-89919.md): KVM: s390: keyop: use mmu\_lock to read gmap-\>asce (CVSS 7.8, Linux)
- [CVE-2026-89918](https://cve.now/CVE-2026-89918.md): KVM: arm64: Correctly handle end of VA space TLBI invalidation (CVSS 9.3, Linux)
- [CVE-2026-89917](https://cve.now/CVE-2026-89917.md): KVM: arm64: Handle VNCR TLB invalidation race with vcpu\_put() VNCR unmapping (no CVSS, Linux)
- [CVE-2026-89916](https://cve.now/CVE-2026-89916.md): KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry (CVSS 9.3, Linux)
- [CVE-2026-89915](https://cve.now/CVE-2026-89915.md): KVM: arm64: Remove VM-wide VNCR mapping counter (CVSS 9.3, Linux)
- [CVE-2026-89914](https://cve.now/CVE-2026-89914.md): KVM: arm64: Sign-extend VA for range-based TLBI invalidation (CVSS 9.3, Linux)
- [CVE-2026-89913](https://cve.now/CVE-2026-89913.md): KVM: arm64: vgic-v3: take an LPI reference in vgic\_v3\_save\_pending\_tables (CVSS 8.8, Linux)
- [CVE-2026-89912](https://cve.now/CVE-2026-89912.md): KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (CVSS 7.1, Linux)
- [CVE-2026-89911](https://cve.now/CVE-2026-89911.md): KVM: arm64: Correctly cap TLBI Range to the architural limit (CVSS 7.9, Linux)
- [CVE-2026-89910](https://cve.now/CVE-2026-89910.md): LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc (CVSS 7.3, Linux)
- [CVE-2026-89909](https://cve.now/CVE-2026-89909.md): LoongArch: KVM: Free init resources if kvm\_init() fails (no CVSS, Linux)
- [CVE-2026-89908](https://cve.now/CVE-2026-89908.md): LoongArch: KVM: Preserve memslot arch flags on KVM\_MR\_FLAGS\_ONLY (CVSS 8.8, Linux)
- [CVE-2026-89907](https://cve.now/CVE-2026-89907.md): LoongArch: KVM: Validate MSI data before routing it to EIOINTC (CVSS 8.8, Linux)
- [CVE-2026-89906](https://cve.now/CVE-2026-89906.md): LoongArch: BPF: Refactor jump offset calculation in tail call (CVSS 7.8, Linux)
- [CVE-2026-89905](https://cve.now/CVE-2026-89905.md): LoongArch: BPF: Move arena register slot below TCC context (no CVSS, Linux)
- [CVE-2026-89904](https://cve.now/CVE-2026-89904.md): LoongArch: Fix acpi\_package\_ids\[\] array overflow (CVSS 8.4, Linux)
- [CVE-2026-89903](https://cve.now/CVE-2026-89903.md): LoongArch: Do not save/restore percpu base register in rethook trampoline (CVSS 7.8, Linux)
- [CVE-2026-89902](https://cve.now/CVE-2026-89902.md): LoongArch: Avoid preempt count underflow without probe (CVSS 7.8, Linux)
- [CVE-2026-89901](https://cve.now/CVE-2026-89901.md): media: airspy: use vb2\_video\_unregister\_device() on disconnect to fix NULL deref (no CVSS, Linux)
- [CVE-2026-89900](https://cve.now/CVE-2026-89900.md): media: cec: core: Fix kmemleak due to missed rc\_free\_device() call (no CVSS, Linux)
- [CVE-2026-89899](https://cve.now/CVE-2026-89899.md): media: cec: disable delayed work before freeing an interrupted transmit (CVSS 7.8, Linux)
- [CVE-2026-89898](https://cve.now/CVE-2026-89898.md): media: cec: extron-da-hd-4k-plus: add sanity check (CVSS 8.8, Linux)
- [CVE-2026-89897](https://cve.now/CVE-2026-89897.md): media: cec: Serialize exclusive follower delivery (CVSS 7.5, Linux)
- [CVE-2026-89896](https://cve.now/CVE-2026-89896.md): media: cedrus: fix memory leak in cedrus\_init\_ctrls() (no CVSS, Linux)
- [CVE-2026-89895](https://cve.now/CVE-2026-89895.md): media: cobalt: Avoid freeing ALSA private data twice (no CVSS, Linux)
- [CVE-2026-89894](https://cve.now/CVE-2026-89894.md): media: cx231xx: reject geometry changes while the VBI queue is busy (CVSS 7.8, Linux)
- [CVE-2026-89893](https://cve.now/CVE-2026-89893.md): media: cx23885: cancel NetUP CI work before teardown (CVSS 7.8, Linux)
- [CVE-2026-89892](https://cve.now/CVE-2026-89892.md): media: em28xx: defer audio-only extension registration (no CVSS, Linux)
- [CVE-2026-89891](https://cve.now/CVE-2026-89891.md): media: em28xx: fix use-after-free of dev\_next-\>devlist on disconnect (no CVSS, Linux)
- [CVE-2026-89890](https://cve.now/CVE-2026-89890.md): media: go7007: defer the ALSA v4l2 put until card release (CVSS 7.8, Linux)
- [CVE-2026-89889](https://cve.now/CVE-2026-89889.md): media: i2c: imx415: Release runtime PM reference on VBLANK error (no CVSS, Linux)
- [CVE-2026-89888](https://cve.now/CVE-2026-89888.md): media: i2c: ov02a10: fix endpoint parsing use-after-free (CVSS 7.8, Linux)
- [CVE-2026-89887](https://cve.now/CVE-2026-89887.md): media: i2c: ov7740: fix use-after-destroy in remove (CVSS 7.8, Linux)
- [CVE-2026-89886](https://cve.now/CVE-2026-89886.md): media: intel/ipu6: fix async notifier cleanup leak on parse error (no CVSS, Linux)
- [CVE-2026-89885](https://cve.now/CVE-2026-89885.md): media: platform: mtk-mdp3: Fix SCP device refcounting (CVSS 8.4, Linux)
- [CVE-2026-89884](https://cve.now/CVE-2026-89884.md): media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (no CVSS, Linux)
- [CVE-2026-89883](https://cve.now/CVE-2026-89883.md): media: rc: sunxi-cir: Unregister rc device on probe failure (CVSS 7.8, Linux)
- [CVE-2026-89882](https://cve.now/CVE-2026-89882.md): media: rkvdec: hevc: guard INTER\_REF\_PIC\_SET\_PRED index underflow (CVSS 7.8, Linux)
- [CVE-2026-89881](https://cve.now/CVE-2026-89881.md): media: rtl2832\_sdr: use vb2\_video\_unregister\_device() on remove to fix DMA leak (no CVSS, Linux)
- [CVE-2026-89880](https://cve.now/CVE-2026-89880.md): media: rtl2832\_sdr: release URBs and stream buffers on start\_streaming() failure (CVSS 7.8, Linux)
- [CVE-2026-89879](https://cve.now/CVE-2026-89879.md): media: s2255: bound JPEG frame size before copying into the buffer (no CVSS, Linux)
- [CVE-2026-89878](https://cve.now/CVE-2026-89878.md): media: s2255: check firmware size before reading trailing marker (no CVSS, Linux)
- [CVE-2026-89877](https://cve.now/CVE-2026-89877.md): media: saa7164: fix cleanup on resource allocation failure (CVSS 8.4, Linux)
- [CVE-2026-89876](https://cve.now/CVE-2026-89876.md): media: tda18250: fix possible integer overflow (no CVSS, Linux)
- [CVE-2026-89875](https://cve.now/CVE-2026-89875.md): media: ti: vpe: quiesce overflow recovery before freeing streams (CVSS 7.8, Linux)
- [CVE-2026-89874](https://cve.now/CVE-2026-89874.md): media: v4l2-async: avoid deleting unlinked ASC entry on link error (no CVSS, Linux)
- [CVE-2026-89873](https://cve.now/CVE-2026-89873.md): media: v4l2-ctrls: validate HEVC EXT SPS RPS counts (CVSS 7.8, Linux)
- [CVE-2026-89872](https://cve.now/CVE-2026-89872.md): media: v4l2-fwnode: Fix fwnode leak in v4l2\_fwnode\_parse\_link (no CVSS, Linux)
- [CVE-2026-89871](https://cve.now/CVE-2026-89871.md): media: video-i2c: fix kthread error pointer left in kthread\_vid\_cap on failure (no CVSS, Linux)
- [CVE-2026-89870](https://cve.now/CVE-2026-89870.md): media: zoran: Avoid freeing a registered video\_device twice (CVSS 7.8, Linux)
- [CVE-2026-89869](https://cve.now/CVE-2026-89869.md): media: qcom: iris: use disable\_irq() during power-off (no CVSS, Linux)
- [CVE-2026-89868](https://cve.now/CVE-2026-89868.md): media: chips-media: wave5: Add timeout while stop\_streaming (no CVSS, Linux)
- [CVE-2026-89867](https://cve.now/CVE-2026-89867.md): media: chips-media: wave5: Defer job\_finish() only when a DEC\_PIC was queued (no CVSS, Linux)
- [CVE-2026-89866](https://cve.now/CVE-2026-89866.md): media: chips-media: wave5: Resume device before setting EOS flag (no CVSS, Linux)
- [CVE-2026-89865](https://cve.now/CVE-2026-89865.md): scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (no CVSS, Linux)
- [CVE-2026-89864](https://cve.now/CVE-2026-89864.md): scsi: qla2xxx: Bound i2c-\>length in I2C bsg handlers (no CVSS, Linux)
- [CVE-2026-89863](https://cve.now/CVE-2026-89863.md): scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (CVSS 7.5, Linux)
- [CVE-2026-89862](https://cve.now/CVE-2026-89862.md): scsi: qla2xxx: Fix BSG job leak on validate flash image error path (no CVSS, Linux)
- [CVE-2026-89861](https://cve.now/CVE-2026-89861.md): scsi: qla2xxx: Hold vport reference in qla24xx\_report\_id\_acquisition() (CVSS 8.1, Linux)
- [CVE-2026-89860](https://cve.now/CVE-2026-89860.md): scsi: qla2xxx: Initialize NVMe abort\_work once at submission (CVSS 8.8, Linux)
- [CVE-2026-89859](https://cve.now/CVE-2026-89859.md): scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (no CVSS, Linux)
- [CVE-2026-89858](https://cve.now/CVE-2026-89858.md): scsi: qla2xxx: Bound image count in qla2x00\_update\_fru\_versions() (no CVSS, Linux)
- [CVE-2026-89857](https://cve.now/CVE-2026-89857.md): scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (CVSS 9.8, Linux)
- [CVE-2026-89856](https://cve.now/CVE-2026-89856.md): scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (CVSS 8.4, Linux)
- [CVE-2026-89855](https://cve.now/CVE-2026-89855.md): scsi: qla2xxx: Serialize flash version read in reset handler (no CVSS, Linux)
- [CVE-2026-89854](https://cve.now/CVE-2026-89854.md): scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (CVSS 7.8, Linux)
- [CVE-2026-89853](https://cve.now/CVE-2026-89853.md): scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (no CVSS, Linux)
- [CVE-2026-89852](https://cve.now/CVE-2026-89852.md): scsi: qla2xxx: Zero mailbox struct in qla2x00\_get\_firmware\_state() (no CVSS, Linux)
- [CVE-2026-89851](https://cve.now/CVE-2026-89851.md): scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (no CVSS, Linux)
- [CVE-2026-89850](https://cve.now/CVE-2026-89850.md): scsi: qla2xxx: Don't query firmware state while chip is down (no CVSS, Linux)
- [CVE-2026-89849](https://cve.now/CVE-2026-89849.md): scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (CVSS 8.8, Linux)
- [CVE-2026-89848](https://cve.now/CVE-2026-89848.md): scsi: qla2xxx: Quiesce response IRQ before freeing request queue (CVSS 8.1, Linux)
- [CVE-2026-89847](https://cve.now/CVE-2026-89847.md): scsi: qla2xxx: Avoid double completion in async IOCB timeout (CVSS 9.8, Linux)
- [CVE-2026-89846](https://cve.now/CVE-2026-89846.md): scsi: qla2xxx: Bound rsp\_info\_len to avoid OOB sense-data read (CVSS 9.1, Linux)
- [CVE-2026-89845](https://cve.now/CVE-2026-89845.md): scsi: qla2xxx: Avoid req\_q\_map double-read in qla2x00\_error\_entry() (no CVSS, Linux)
- [CVE-2026-89844](https://cve.now/CVE-2026-89844.md): scsi: qla2xxx: Hold vport\_slock for host map update in report ID acquisition (CVSS 8.8, Linux)
- [CVE-2026-89843](https://cve.now/CVE-2026-89843.md): scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (no CVSS, Linux)
- [CVE-2026-89842](https://cve.now/CVE-2026-89842.md): scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (no CVSS, Linux)
- [CVE-2026-89841](https://cve.now/CVE-2026-89841.md): f2fs: only redirty pinned folios in redirty\_blocks (CVSS 7.8, Linux)
- [CVE-2026-89840](https://cve.now/CVE-2026-89840.md): f2fs: validate MOVE\_RANGE destination size (CVSS 7.1, Linux)
- [CVE-2026-89839](https://cve.now/CVE-2026-89839.md): f2fs: use the mount idmap for the owner check in f2fs\_xattr\_advise\_set() (no CVSS, Linux)
- [CVE-2026-89838](https://cve.now/CVE-2026-89838.md): f2fs: limit recovery filename logging to stored length (CVSS 7.1, Linux)
- [CVE-2026-89837](https://cve.now/CVE-2026-89837.md): f2fs: fix dentry folio leak in find\_in\_level (no CVSS, Linux)
- [CVE-2026-89836](https://cve.now/CVE-2026-89836.md): f2fs: fix folio\_nr\_pages() race after put in large folio invalidate (CVSS 7.8, Linux)
- [CVE-2026-89835](https://cve.now/CVE-2026-89835.md): f2fs: avoid NULL checkpoint thread access in sysfs (no CVSS, Linux)
- [CVE-2026-89834](https://cve.now/CVE-2026-89834.md): f2fs: fix to migrate all curseg types during free\_segment\_range (no CVSS, Linux)
- [CVE-2026-89833](https://cve.now/CVE-2026-89833.md): f2fs: fix to avoid potential deadloop in f2fs\_fsync\_node\_pages() (no CVSS, Linux)
- [CVE-2026-89832](https://cve.now/CVE-2026-89832.md): f2fs: fix to clear dirty flag on folio in error path (CVSS 7.8, Linux)
- [CVE-2026-89831](https://cve.now/CVE-2026-89831.md): f2fs: protect critical\_task\_priority updates with s\_umount (no CVSS, Linux)
- [CVE-2026-89830](https://cve.now/CVE-2026-89830.md): f2fs: fix valid block count leak on data block allocation failure (no CVSS, Linux)
- [CVE-2026-89829](https://cve.now/CVE-2026-89829.md): f2fs: fix to pass folio-\>index to f2fs\_sanity\_check\_node\_footer() (CVSS 7.8, Linux)
- [CVE-2026-89828](https://cve.now/CVE-2026-89828.md): drm/amdgpu: Fix init ordering in amdgpu\_vram\_mgr\_init() (no CVSS, Linux)
- [CVE-2026-89827](https://cve.now/CVE-2026-89827.md): drm/amdgpu: avoid force-completing uninitialized UVD rings (no CVSS, Linux)
- [CVE-2026-89826](https://cve.now/CVE-2026-89826.md): drm/panthor: harden firmware build-info bounds checks (CVSS 7.1, Linux)
- [CVE-2026-89825](https://cve.now/CVE-2026-89825.md): drm/panthor: fix firmware control interface bounds checks (CVSS 7.8, Linux)
- [CVE-2026-89824](https://cve.now/CVE-2026-89824.md): drm/panel-edp: fix i2c adapter leak on probe failure (no CVSS, Linux)
- [CVE-2026-89823](https://cve.now/CVE-2026-89823.md): drm: fix race between partial drm\_dev\_register() failure and ioctl (CVSS 7.8, Linux)
- [CVE-2026-89822](https://cve.now/CVE-2026-89822.md): drm/i915: Guard against NULL driver\_data in i915\_pci\_probe() (no CVSS, Linux)
- [CVE-2026-89821](https://cve.now/CVE-2026-89821.md): drm/amd/display: avoid divide-by-zero in \_\_is\_lut\_linear() (no CVSS, Linux)
- [CVE-2026-89820](https://cve.now/CVE-2026-89820.md): drm/amd/display: fix dc\_lock leak on GPU reset error paths (no CVSS, Linux)
- [CVE-2026-89819](https://cve.now/CVE-2026-89819.md): drm/amd/display: validate plane degamma LUT size for private color prop (CVSS 7.8, Linux)
- [CVE-2026-89818](https://cve.now/CVE-2026-89818.md): drm/amdgpu/vcn: fix integer overflow in dec\_msg buffer count check (CVSS 7.1, Linux)
- [CVE-2026-89817](https://cve.now/CVE-2026-89817.md): drm/gud: NUL-terminate TV mode names read from the device (no CVSS, Linux)
- [CVE-2026-89816](https://cve.now/CVE-2026-89816.md): drm: Fix drm\_crtc\_commit leak if signaled when PAGE\_FLIP\_EVENT is used (no CVSS, Linux)
- [CVE-2026-89815](https://cve.now/CVE-2026-89815.md): drm/ttm: Drop tt-\>restore after successful restore (CVSS 7.8, Linux)
- [CVE-2026-89814](https://cve.now/CVE-2026-89814.md): drm/amdgpu: clamp the isolation index for rings outside a partition (CVSS 7.8, Linux)
- [CVE-2026-89813](https://cve.now/CVE-2026-89813.md): drm/amdgpu: force complete the KIQ ring fences on reset (no CVSS, Linux)
- [CVE-2026-89812](https://cve.now/CVE-2026-89812.md): drm/amdgpu: force complete the MES ring fences on reset (no CVSS, Linux)
- [CVE-2026-89811](https://cve.now/CVE-2026-89811.md): drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVSS 8.8, Linux)
- [CVE-2026-89810](https://cve.now/CVE-2026-89810.md): drm/amdkfd: Fix error path at svm\_migrate\_copy\_to\_ram (CVSS 7.8, Linux)
- [CVE-2026-89809](https://cve.now/CVE-2026-89809.md): drm/amdkfd: fix scope of mqd\_mgr dereference in pqm\_debugfs\_mqds (no CVSS, Linux)
- [CVE-2026-89808](https://cve.now/CVE-2026-89808.md): drm/amdkfd: Fix the case that vm range is hole at svm\_migrate\_copy\_to\_vram (CVSS 7.8, Linux)
- [CVE-2026-89807](https://cve.now/CVE-2026-89807.md): drm/amdkfd: guard against NULL restore\_mqd in CRIU queue restore (no CVSS, Linux)
- [CVE-2026-89806](https://cve.now/CVE-2026-89806.md): drm/sysfb: ofdrm: Fix integer overflow in fb\_size calculation (CVSS 8.4, Linux)
- [CVE-2026-89805](https://cve.now/CVE-2026-89805.md): drm/pagemap: Fix folio allocation fallback and use-after-put (CVSS 7.8, Linux)
- [CVE-2026-89804](https://cve.now/CVE-2026-89804.md): drm/nouveau/dmem: fix mismatched DMA unmap size for large folios (CVSS 8.8, Linux)
- [CVE-2026-89803](https://cve.now/CVE-2026-89803.md): drm/nouveau: unsubscribe the channel-kill event before the fence context (CVSS 7.8, Linux)
- [CVE-2026-89802](https://cve.now/CVE-2026-89802.md): drm/nouveau/uvmm: fix NULL deref unwinding an OP\_MAP\_SPARSE op (no CVSS, Linux)
- [CVE-2026-89801](https://cve.now/CVE-2026-89801.md): drm/nouveau/uvmm: fix premature region free on failed OP\_UNMAP\_SPARSE (CVSS 7.8, Linux)
- [CVE-2026-89800](https://cve.now/CVE-2026-89800.md): drm/nouveau/uvmm: clear the dirty flag when unwinding an OP\_UNMAP\_SPARSE (no CVSS, Linux)
- [CVE-2026-89799](https://cve.now/CVE-2026-89799.md): bpf: Disable preemption in bpf\_get\_stackid (CVSS 7.8, Linux)
- [CVE-2026-89798](https://cve.now/CVE-2026-89798.md): rpcrdma: arm rn\_done before publishing the notification (no CVSS, Linux)
- [CVE-2026-89797](https://cve.now/CVE-2026-89797.md): power: supply: ab8500\_fg: fix use-after-free on remove (no CVSS, Linux)
- [CVE-2026-89796](https://cve.now/CVE-2026-89796.md): mm/damon/core: avoid infinite kdamond\_merge\_regions() internal loop (no CVSS, Linux)
- [CVE-2026-89795](https://cve.now/CVE-2026-89795.md): PCI: Allow per function PCI slots to fix slot reset on s390 (CVSS 8.4, Linux)
- [CVE-2026-89794](https://cve.now/CVE-2026-89794.md): ksmbd: zero pipe read compound padding (no CVSS, Linux)
- [CVE-2026-92356](https://cve.now/CVE-2026-92356.md): a2ui-project a2ui Update Components basic\_functions.ts updateComponents resource consumption (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-8462](https://cve.now/CVE-2026-8462.md): OpenMeter SQL Injection in ClickHouse-backed Meter Definitions (CVSS 8.9, openmeter · github.com/openmeterio/openmeter)
- [CVE-2026-86585](https://cve.now/CVE-2026-86585.md): Improper Verification of the Firmware Signature vulnerability (CVSS 7.7, Fermax Electronica S.A.U. DUOX PLUS monitor firmware)
- [CVE-2026-86106](https://cve.now/CVE-2026-86106.md): Security Advisory 0179 (CVSS 9.6, Arista Networks VeloCloud Edge)
- [CVE-2026-14916](https://cve.now/CVE-2026-14916.md): Kong API Gateway Enterprise: JWT Algorithm-Confusion (CVSS 7.7, Kong Enteprise Gateway)
- [CVE-2026-77190](https://cve.now/CVE-2026-77190.md): Security Advisory 0177 (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-14917](https://cve.now/CVE-2026-14917.md): Kong API Gateway Enterprise: SAML Authentication bypass (CVSS 7.7, Kong Enterprise Gateway)
- [CVE-2026-86474](https://cve.now/CVE-2026-86474.md): Improper Certificate Validation in the Firmware Download vulnerability (CVSS 7.7, Fermax Electronica S.A.U. DUOX PLUS monitor firmware)
- [CVE-2026-76151](https://cve.now/CVE-2026-76151.md): Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module) (CVSS 4.6, qt)
- [CVE-2026-73468](https://cve.now/CVE-2026-73468.md): Security Advisory 0175 (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-73440](https://cve.now/CVE-2026-73440.md): Security Advisory 0178 (CVSS 4.2, Arista Networks EOS)
- [CVE-2026-73469](https://cve.now/CVE-2026-73469.md): Security Advisory 0176 (CVSS 5.8, Arista Networks EOS)
- [CVE-2026-89793](https://cve.now/CVE-2026-89793.md): ublk: clear VM\_MAYWRITE on read-only ublk char device mmap (CVSS 7.8, Linux)
- [CVE-2026-73453](https://cve.now/CVE-2026-73453.md): Security Advisory 0174 (CVSS 10.0, Arista Networks EOS)
- [CVE-2026-73455](https://cve.now/CVE-2026-73455.md): Security Advisory 0173 (CVSS 7.5, Arista Networks EOS)
- [CVE-2026-73438](https://cve.now/CVE-2026-73438.md): Security Advisory 0172 (CVSS 5.3, Arista Networks EOS)
- [CVE-2026-85628](https://cve.now/CVE-2026-85628.md): Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability (CVSS 7.0, Fermax Electronica S.A.U. DuoxMe · Fermax Electronica S.A.U…)
- [CVE-2026-84501](https://cve.now/CVE-2026-84501.md): Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider (CVSS 5.3, Apache Software Foundation Apache ZooKeeper)
- [CVE-2026-84439](https://cve.now/CVE-2026-84439.md): Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources (CVSS 5.3, Apache Software Foundation Apache ZooKeeper)
- [CVE-2026-79993](https://cve.now/CVE-2026-79993.md): Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode (CVSS 7.5, Apache Software Foundation Apache ZooKeeper)
- [CVE-2026-59969](https://cve.now/CVE-2026-59969.md): Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode (CVSS 7.5, Apache Software Foundation Apache ZooKeeper)
- [CVE-2026-59739](https://cve.now/CVE-2026-59739.md): Apache ZooKeeper: Information disclosure via SetWatches reconnect replay (CVSS 7.5, Apache Software Foundation Apache ZooKeeper)
- [CVE-2026-73436](https://cve.now/CVE-2026-73436.md): Security Advisory 0171 (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-73435](https://cve.now/CVE-2026-73435.md): Security Advisory 0171 (CVSS 8.2, Arista Networks EOS)
- [CVE-2026-86466](https://cve.now/CVE-2026-86466.md): Apache Airflow FAB provider: FAB Authentik provider: id\_token issuer/audience not validated (CVSS 8.1, Apache Software Foundation Apache Airflow FAB provider)
- [CVE-2026-86443](https://cve.now/CVE-2026-86443.md): Cleartext Storage of Sensitive Information Vulnerability (CVSS 6.9, Fermax Electronica S.A.U. DuoxMe)
- [CVE-2026-19640](https://cve.now/CVE-2026-19640.md): Security Advisory 0170 (CVSS 4.2, Arista Networks EOS)
- [CVE-2026-76187](https://cve.now/CVE-2026-76187.md): Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT (CVSS 9.8, Apache Software Foundation Apache Airflow Keycloak provider)
- [CVE-2026-76186](https://cve.now/CVE-2026-76186.md): Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity (CVSS 9.1, Apache Software Foundation Apache Airflow Keycloak provider)
- [CVE-2026-82310](https://cve.now/CVE-2026-82310.md): Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access (CVSS 7.2, Apache Software Foundation Apache Airflow FAB provider)
- [CVE-2026-86792](https://cve.now/CVE-2026-86792.md): Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration (CVSS 8.8, Apache Software Foundation Apache Airflow Apache Kafka prov…)
- [CVE-2026-86462](https://cve.now/CVE-2026-86462.md): Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions (CVSS 9.1, Apache Software Foundation Apache Airflow FAB provider)
- [CVE-2026-73463](https://cve.now/CVE-2026-73463.md): Security Advisory 0169 (CVSS 5.3, Arista Networks EOS)
- [CVE-2026-82311](https://cve.now/CVE-2026-82311.md): Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int \_user\_id comparison is always false (CVSS 9.8, Apache Software Foundation Apache Airflow FAB provider)
- [CVE-2026-73445](https://cve.now/CVE-2026-73445.md): Security Advisory 0167 (CVSS 4.9, Arista Networks EOS)
- [CVE-2026-86465](https://cve.now/CVE-2026-86465.md): Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key (CVSS 6.5, Apache Software Foundation Apache Airflow Akeyless provider)
- [CVE-2026-92081](https://cve.now/CVE-2026-92081.md): fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses (CVSS 5.9, fastify)
- [CVE-2026-89792](https://cve.now/CVE-2026-89792.md): ksmbd: prevent out-of-bounds reads in share config responses (CVSS 7.1, Linux)
- [CVE-2026-2380](https://cve.now/CVE-2026-2380.md): Security Advisory 0168 (CVSS 7.4, Arista Networks EOS)
- [CVE-2026-89791](https://cve.now/CVE-2026-89791.md): perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVSS 7.8, Linux)
- [CVE-2026-89790](https://cve.now/CVE-2026-89790.md): ipv6: avoid divide by zero in rt6\_multipath\_rebalance (no CVSS, Linux)
- [CVE-2026-89789](https://cve.now/CVE-2026-89789.md): gtp: add synchronize\_net() in gtp\_newlink() error path to prevent use-after-free (CVSS 7.8, Linux)
- [CVE-2026-89788](https://cve.now/CVE-2026-89788.md): ksmbd: fix tree connection use-after-free in smb2\_tree\_connect() (CVSS 9.8, Linux)
- [CVE-2026-89787](https://cve.now/CVE-2026-89787.md): ext4: check dir entry fits before reading the hash trailer in ext4\_search\_dir() (no CVSS, Linux)
- [CVE-2026-89786](https://cve.now/CVE-2026-89786.md): ext4: fix out-of-bounds read in ext4\_read\_inline\_dir() (CVSS 9.1, Linux)
- [CVE-2026-89785](https://cve.now/CVE-2026-89785.md): fs/ntfs3: fix out-of-bounds read of INDEX\_ROOT in reparse/objid init (no CVSS, Linux)
- [CVE-2026-89784](https://cve.now/CVE-2026-89784.md): SUNRPC: check rpc\_sockaddr2uaddr() return value in rpcb\_register\_inet4/6 (no CVSS, Linux)
- [CVE-2026-89783](https://cve.now/CVE-2026-89783.md): xfrm6: fix out-of-bounds write in xfrm6\_input\_addr() when secpath is full (CVSS 9.8, Linux)
- [CVE-2026-89782](https://cve.now/CVE-2026-89782.md): fs/ntfs3: reject restart table growth beyond U16\_MAX entries (CVSS 8.4, Linux)
- [CVE-2026-89781](https://cve.now/CVE-2026-89781.md): fs/ntfs3: fix out-of-bounds read in read\_log\_rec\_buf() (CVSS 8.4, Linux)
- [CVE-2026-89780](https://cve.now/CVE-2026-89780.md): net: qualcomm: rmnet: restore skb-\>dev on deaggregated frames (no CVSS, Linux)
- [CVE-2026-89779](https://cve.now/CVE-2026-89779.md): fs/ntfs3: validate ef-\>size covers the record's name and value (CVSS 9.1, Linux)
- [CVE-2026-89778](https://cve.now/CVE-2026-89778.md): isofs: fix out-of-bounds page array access on empty zisofs block (CVSS 9.8, Linux)
- [CVE-2026-89777](https://cve.now/CVE-2026-89777.md): vfio/pci: clear vdev-\>msi\_perm after freeing it on init failure (CVSS 8.8, Linux)
- [CVE-2026-89776](https://cve.now/CVE-2026-89776.md): vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (no CVSS, Linux)
- [CVE-2026-89775](https://cve.now/CVE-2026-89775.md): KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVSS 9.3, Linux)
- [CVE-2026-73464](https://cve.now/CVE-2026-73464.md): Security Advisory 0166 (CVSS 8.8, Arista Networks EOS)
- [CVE-2026-85501](https://cve.now/CVE-2026-85501.md): Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC (CVSS 5.3, NLnet Labs Unbound)
- [CVE-2026-82720](https://cve.now/CVE-2026-82720.md): Use-after-free in DoH stream cleanup code path (CVSS 5.9, NLnet Labs Unbound)
- [CVE-2026-82717](https://cve.now/CVE-2026-82717.md): CNAME synthesis could lead to heap corruption (CVSS 8.4, NLnet Labs Unbound)
- [CVE-2026-81642](https://cve.now/CVE-2026-81642.md): Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVSS 9.1, NLnet Labs Unbound)
- [CVE-2026-81634](https://cve.now/CVE-2026-81634.md): Possible heap buffer overflow during DNSSEC canonicalization (CVSS 7.5, NLnet Labs Unbound)
- [CVE-2026-80225](https://cve.now/CVE-2026-80225.md): Possible degradation of service from continuous queries on the same TCP/DoT connection (CVSS 5.3, NLnet Labs Unbound)
- [CVE-2026-78227](https://cve.now/CVE-2026-78227.md): Use-after-free in DoQ stream output buffer on reset re-transmission (CVSS 6.5, NLnet Labs Unbound)
- [CVE-2026-77955](https://cve.now/CVE-2026-77955.md): Possible ZONEMD verification bypass window (CVSS 4.4, NLnet Labs Unbound)
- [CVE-2026-77860](https://cve.now/CVE-2026-77860.md): 'serve-expired' can bypass Unbound 'wait-limit' (CVSS 3.7, NLnet Labs Unbound)
- [CVE-2026-86338](https://cve.now/CVE-2026-86338.md): Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle (CVSS 6.0, ash-project ash)
- [CVE-2026-88255](https://cve.now/CVE-2026-88255.md): mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot (CVSS 6.3, ZenHive mpp)
- [CVE-2026-89774](https://cve.now/CVE-2026-89774.md): Bluetooth: SCO: hold sk properly in sco\_conn\_ready (CVSS 8.8, Linux)
- [CVE-2026-89186](https://cve.now/CVE-2026-89186.md): mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches (CVSS 6.3, ZenHive mpp)
- [CVE-2026-73454](https://cve.now/CVE-2026-73454.md): Security Advisory 0165 (CVSS 8.1, Arista Networks EOS)
- [CVE-2026-73439](https://cve.now/CVE-2026-73439.md): Security Advisory 0164 (CVSS 7.5, Arista Networks EOS)
- [CVE-2026-73461](https://cve.now/CVE-2026-73461.md): Security Advisory 0163 (CVSS 8.0, Arista Networks EOS)
- [CVE-2026-89207](https://cve.now/CVE-2026-89207.md): A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions \< V3.94), WTV776-HB6035 Web Interface (All versions \< V4.17 (CVSS 6.5, Siemens WTV676-HB6035 Web Interface · Siemens WTV776-HB6035…)
- [CVE-2026-86341](https://cve.now/CVE-2026-86341.md): Access Control Check Implemented After Asset is Accessed in GitLab (CVSS 4.4, GitLab)
- [CVE-2026-27565](https://cve.now/CVE-2026-27565.md): Remote code execution via uploading a malicious IODD file (CVSS 9.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27564](https://cve.now/CVE-2026-27564.md): Command Injection via PUT in /api/datastorage/data (CVSS 7.2, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27563](https://cve.now/CVE-2026-27563.md): Command Injection via GET in /api/datastorage/data (CVSS 7.2, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27562](https://cve.now/CVE-2026-27562.md): Command Injection via PUT in /api/iodd/config (CVSS 7.2, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27561](https://cve.now/CVE-2026-27561.md): Command Injection via GET in /api/iodd/config (CVSS 7.2, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27560](https://cve.now/CVE-2026-27560.md): Command Injection via DELETE in /api/status/data (CVSS 7.2, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27559](https://cve.now/CVE-2026-27559.md): Command Injection via GET in /api/status/data (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27558](https://cve.now/CVE-2026-27558.md): Command Injection in /index.php/attached\_devices\_tab/ajax\_remove\_uploaded\_iodd\_files (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27557](https://cve.now/CVE-2026-27557.md): Path Traversal in /index.php/view\_uploaded\_iodd\_file (CVSS 7.5, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27556](https://cve.now/CVE-2026-27556.md): Local File Inclusion in /index.php/ajax/save\_iodd\_parameters (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27555](https://cve.now/CVE-2026-27555.md): Local File Inclusion in /index.php/ajax/get\_iodd\_port\_info (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27554](https://cve.now/CVE-2026-27554.md): Command Injection in /index.php/ajax/save\_iodd\_parameters (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27553](https://cve.now/CVE-2026-27553.md): Information Disclosure via Schema Path Manipulation (CVSS 6.5, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27552](https://cve.now/CVE-2026-27552.md): Unauthorized IODD File Upload due to Improper Authorization (CVSS 8.1, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27551](https://cve.now/CVE-2026-27551.md): Command Injection in /index.php/ajax/parameterManage (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27550](https://cve.now/CVE-2026-27550.md): Command Injection in Field\_Shadow\_Password Class (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27549](https://cve.now/CVE-2026-27549.md): Command Injection in /index.php/attached\_devices\_tab/do\_upload (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27548](https://cve.now/CVE-2026-27548.md): Command Injection in /index.php/ajax/get\_iodd\_port\_info (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27547](https://cve.now/CVE-2026-27547.md): Command Injection in /index.php/ajax/get\_iodd\_menu\_info (CVSS 8.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-27546](https://cve.now/CVE-2026-27546.md): Authentication Bypass in \_account\_log (CVSS 9.8, Pepperl+Fuchs ICE2-8IOL1-G65L-V1D · Pepperl+Fuchs ICE2-… +13)
- [CVE-2026-92091](https://cve.now/CVE-2026-92091.md): Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key\_ops array (CVSS 5.9, Red Hat Ansible Automation Platform · Red Hat Enterprise… +2)
- [CVE-2026-84408](https://cve.now/CVE-2026-84408.md): QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe (CVSS 8.8, QualitySoft QND Premium · QualitySoft QND Standard +1)
- [CVE-2026-81326](https://cve.now/CVE-2026-81326.md): QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's clie (CVSS 5.5, QualitySoft QND Premium · QualitySoft QND Standard +1)
- [CVE-2026-92355](https://cve.now/CVE-2026-92355.md): In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to (CVSS 8.7, Octopus Deploy Octopus Server)
- [CVE-2026-88263](https://cve.now/CVE-2026-88263.md): XikeStor Layer3 switches miss authentication for downloading configuration data. (CVSS 7.5, XikeStor SKS8310-8X · XikeStor SKS8300-8T +1)
- [CVE-2026-19248](https://cve.now/CVE-2026-19248.md): Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt (CVSS 7.1, qt)
- [CVE-2024-11222](https://cve.now/CVE-2024-11222.md): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (CVSS 6.4, GitLab)
- [CVE-2025-14871](https://cve.now/CVE-2025-14871.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-1168](https://cve.now/CVE-2026-1168.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2026-3855](https://cve.now/CVE-2026-3855.md): Improper Control of Resource Identifiers ('Resource Injection') in GitLab (CVSS 3.1, GitLab)
- [CVE-2026-7514](https://cve.now/CVE-2026-7514.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-8030](https://cve.now/CVE-2026-8030.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-16794](https://cve.now/CVE-2026-16794.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-19619](https://cve.now/CVE-2026-19619.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 4.7, GitLab)
- [CVE-2026-78252](https://cve.now/CVE-2026-78252.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.2, GitLab)
- [CVE-2026-79708](https://cve.now/CVE-2026-79708.md): Incorrect Authorization in GitLab (CVSS 8.5, GitLab)
- [CVE-2026-86475](https://cve.now/CVE-2026-86475.md): Appointment Hour Booking \< 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission (CVSS 5.3, Appointment Hour Booking)
- [CVE-2026-84906](https://cve.now/CVE-2026-84906.md): Eventin \< 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay (CVSS 5.3, Eventin)
- [CVE-2026-19857](https://cve.now/CVE-2026-19857.md): Formidable Forms \< 6.35 - Unauthenticated Arbitrary Shortcode Execution via \[entry\_key\] Custom HTML Token (CVSS 4.8, Formidable Forms)
- [CVE-2026-13407](https://cve.now/CVE-2026-13407.md): Royal Elementor Addons \< 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails (CVSS 6.1, Royal Addons for Elementor)
- [CVE-2026-73447](https://cve.now/CVE-2026-73447.md): Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request (CVSS 9.1, Arista Networks EOS)
- [CVE-2026-89328](https://cve.now/CVE-2026-89328.md): FluentBoards \< 2.0.15 - Board Member+ Board Membership and Public Access Modification (CVSS 3.8, FluentBoards)
- [CVE-2026-89327](https://cve.now/CVE-2026-89327.md): FluentBoards \< 2.0.15 - Board Member+ Comment Author Spoofing via 'comment\_by' Parameter (CVSS 3.8, FluentBoards)
- [CVE-2026-88910](https://cve.now/CVE-2026-88910.md): KBoard \< 6.7 - Unauthenticated Board Media Deletion via IDOR (CVSS 5.3, kboard)
- [CVE-2026-87959](https://cve.now/CVE-2026-87959.md): WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update (CVSS 5.4, WPBot)
- [CVE-2026-87907](https://cve.now/CVE-2026-87907.md): Rox Appointment Booking \< 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes (CVSS 5.3, Rox Appointment Booking)
- [CVE-2026-87896](https://cve.now/CVE-2026-87896.md): Rox Appointment Booking \< 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route (CVSS 5.3, Rox Appointment Booking)
- [CVE-2026-87860](https://cve.now/CVE-2026-87860.md): Subscriptions for WooCommerce \< 2.0.3 - Subscription Cancellation via CSRF (CVSS 4.3, Subscriptions for WooCommerce)
- [CVE-2026-87854](https://cve.now/CVE-2026-87854.md): Subscriptions for WooCommerce \< 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass (CVSS 5.3, Subscriptions for WooCommerce)
- [CVE-2026-87828](https://cve.now/CVE-2026-87828.md): Seraphinite Accelerator \< 2.29.24 - Subscriber+ DoS via seraph\_accel\_State Update (CVSS 5.7, Seraphinite Accelerator)
- [CVE-2026-86823](https://cve.now/CVE-2026-86823.md): Newsletter \< 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter (CVSS 5.3, Newsletter)
- [CVE-2026-86784](https://cve.now/CVE-2026-86784.md): Visualizer \< 4.0.8 - Contributor+ Stored XSS via JSON Data Source (CVSS 6.8, Visualizer)
- [CVE-2026-86449](https://cve.now/CVE-2026-86449.md): LearnPress \< 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API (CVSS 5.3, LearnPress)
- [CVE-2026-86448](https://cve.now/CVE-2026-86448.md): LearnPress \< 4.4.7 - Unauthenticated Order Data Disclosure via lp\_download\_order (CVSS 3.7, LearnPress)
- [CVE-2026-86447](https://cve.now/CVE-2026-86447.md): LearnPress \< 4.4.7 - Unauthenticated Student Enrollment Disclosure via load\_content\_via\_ajax (CVSS 5.3, LearnPress)
- [CVE-2026-86445](https://cve.now/CVE-2026-86445.md): LearnPress \< 4.4.7 - Unauthenticated Question Bank Disclosure via load\_content\_via\_ajax (CVSS 5.3, LearnPress)
- [CVE-2026-86444](https://cve.now/CVE-2026-86444.md): LearnPress \< 4.4.7 - Reflected XSS via 'skin' Parameter (CVSS 7.1, LearnPress)
- [CVE-2026-85641](https://cve.now/CVE-2026-85641.md): Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated\_by' Parameter (CVSS 4.3, Formidable Forms)
- [CVE-2026-85572](https://cve.now/CVE-2026-85572.md): Tutor LMS 4.0.0 - \< 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure (CVSS 4.3, Tutor LMS)
- [CVE-2026-85569](https://cve.now/CVE-2026-85569.md): Tutor LMS 2.7.1 - \< 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification (CVSS 7.2, Tutor LMS)
- [CVE-2026-85530](https://cve.now/CVE-2026-85530.md): GiveWP \< 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch (CVSS 8.1, GiveWP)
- [CVE-2026-85349](https://cve.now/CVE-2026-85349.md): FluentBoards \< 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR (CVSS 4.3, FluentBoards)
- [CVE-2026-85131](https://cve.now/CVE-2026-85131.md): WPLP Cookie Consent \< 4.4.4 - Arbitrary Post Deletion via CSRF (CVSS 6.5, WPLP Cookie Consent)
- [CVE-2026-84907](https://cve.now/CVE-2026-84907.md): Eventin \< 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint (CVSS 3.7, Eventin)
- [CVE-2026-84905](https://cve.now/CVE-2026-84905.md): Eventin \< 4.1.24 - Contributor+ User Creation via Speaker Creation (CVSS 2.7, Eventin)
- [CVE-2026-84829](https://cve.now/CVE-2026-84829.md): Optimole \< 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter (CVSS 8.8, Optimole)
- [CVE-2026-84088](https://cve.now/CVE-2026-84088.md): Xpro Elementor Addons \< 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget (CVSS 6.8, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-82126](https://cve.now/CVE-2026-82126.md): Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation (CVSS 2.7, Schema & Structured Data for WP & AMP)
- [CVE-2026-82125](https://cve.now/CVE-2026-82125.md): Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR (CVSS 5.3, Schema & Structured Data for WP & AMP)
- [CVE-2026-82124](https://cve.now/CVE-2026-82124.md): Schema & Structured Data for WP & AMP \< 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output (CVSS 5.3, Schema & Structured Data for WP & AMP)
- [CVE-2026-78474](https://cve.now/CVE-2026-78474.md): Ni WooCommerce Sales Report \< 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn\_print' Parameter (CVSS 5.3, Ni WooCommerce Sales Report)
- [CVE-2026-78472](https://cve.now/CVE-2026-78472.md): Ni WooCommerce Sales Report \< 4.2.0 - Unauthenticated SQLi via 'sort' Parameter (CVSS 8.6, Ni WooCommerce Sales Report)
- [CVE-2026-77702](https://cve.now/CVE-2026-77702.md): Eventin \< 4.1.24 - Unauthenticated Ticket Price Rewrite via order\_token (CVSS 5.3, Eventin)
- [CVE-2026-76559](https://cve.now/CVE-2026-76559.md): WP Import Export Lite \< 3.9.33 - Admin+ SSRF via Import URL Handling (CVSS 4.1, WP Import Export Lite)
- [CVE-2026-76558](https://cve.now/CVE-2026-76558.md): WP Import Export Lite \< 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names (CVSS 6.8, WP Import Export Lite)
- [CVE-2026-76557](https://cve.now/CVE-2026-76557.md): WP Import Export Lite \< 3.9.33 - Authenticated SQLi via Import Options (CVSS 6.8, WP Import Export Lite)
- [CVE-2026-76556](https://cve.now/CVE-2026-76556.md): WP Import Export Lite \< 3.9.33 - Authenticated SQLi via Export Filter Rules (CVSS 6.8, WP Import Export Lite)
- [CVE-2026-76555](https://cve.now/CVE-2026-76555.md): WP Import Export Lite \< 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal (CVSS 6.8, WP Import Export Lite)
- [CVE-2026-76553](https://cve.now/CVE-2026-76553.md): WP Import Export Lite \< 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal (CVSS 6.5, WP Import Export Lite)
- [CVE-2026-76552](https://cve.now/CVE-2026-76552.md): WP Import Export Lite \< 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import (CVSS 8.8, WP Import Export Lite)
- [CVE-2026-76551](https://cve.now/CVE-2026-76551.md): WP Import Export Lite \< 3.9.33 - Authenticated RCE via Export Field PHP Function (CVSS 7.2, WP Import Export Lite)
- [CVE-2026-76550](https://cve.now/CVE-2026-76550.md): WP Import Export Lite \< 3.9.34 - Authenticated RCE via Export Template Path Traversal (CVSS 7.2, WP Import Export Lite)
- [CVE-2026-74926](https://cve.now/CVE-2026-74926.md): MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint (CVSS 7.1, MultiVendorX)
- [CVE-2026-92358](https://cve.now/CVE-2026-92358.md): Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking (CVSS 6.4, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-18555](https://cve.now/CVE-2026-18555.md): Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress \<= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter (CVSS 6.1, wordplus Better Messages – Chat Rooms, Group Chat, Private…)
- [CVE-2026-89063](https://cve.now/CVE-2026-89063.md): Online Scheduling and Appointment Booking System \<= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation\_id' Parameter (CVSS 7.5, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-5920](https://cve.now/CVE-2026-5920.md): Bold Page Builder \<= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode\_content' Parameter (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2026-11996](https://cve.now/CVE-2026-11996.md): Advanced Popups \<= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field (CVSS 6.4, codesupplyco Advanced Popups)
- [CVE-2026-18595](https://cve.now/CVE-2026-18595.md): WP-Lister Lite for eBay \<= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request (CVSS 7.2, wp-lab WP-Lister Lite for eBay)
- [CVE-2026-78088](https://cve.now/CVE-2026-78088.md): Contest Gallery \<= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter (CVSS 8.8, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2026-12793](https://cve.now/CVE-2026-12793.md): JetFormBuilder \<= 3.6.2 - Unauthenticated Privilege Escalation via '\_jet\_engine\_booking\_form\_id' Parameter (CVSS 9.8, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-11984](https://cve.now/CVE-2026-11984.md): Ad Inserter \<= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter (CVSS 5.3, spacetime Ad Inserter – Ad Manager & AdSense Ads)
- [CVE-2026-16588](https://cve.now/CVE-2026-16588.md): WP Directory Kit \<= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order\_by' Parameter (CVSS 6.5, wpdirectorykit WP Directory Kit)
- [CVE-2026-14349](https://cve.now/CVE-2026-14349.md): TrueBooker \<= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin\_addcustomer' AJAX Action (CVSS 9.8, themetechmount TrueBooker – Appointment Booking and Schedul…)
- [CVE-2026-86109](https://cve.now/CVE-2026-86109.md): Security Advisory 0182 (CVSS 6.6, Arista Networks VeloCloud Edge)
- [CVE-2026-86108](https://cve.now/CVE-2026-86108.md): Security Advisory 0181 (CVSS 8.0, Arista Networks VeloCloud Edge)
- [CVE-2026-92247](https://cve.now/CVE-2026-92247.md): synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload (CVSS 5.1, synaptikcms synaptik-cms)
- [CVE-2026-73450](https://cve.now/CVE-2026-73450.md): Security Advisory 0161 (CVSS 6.9, Arista Networks EOS)
- [CVE-2026-92221](https://cve.now/CVE-2026-92221.md): gedelumbung HospitalManagement app\_global\_admin\_model.php generate\_index\_pasien sql injection (CVSS 5.1, gedelumbung HospitalManagement)
- [CVE-2026-92220](https://cve.now/CVE-2026-92220.md): vllm-project vLLM MoRIIO Acknowledgement moriio\_connector.py MoRIIOWrapper.\_handle\_release\_message resource consumption (CVSS 6.9, vllm-project vLLM)
- [CVE-2026-92217](https://cve.now/CVE-2026-92217.md): a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-92299](https://cve.now/CVE-2026-92299.md): @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture (CVSS 7.1, @jitsi/electron-sdk)
- [CVE-2026-92298](https://cve.now/CVE-2026-92298.md): EspoCRM through 10.0.8 Weak Token Generation via rand() (CVSS 4.8, EspoCRM)
- [CVE-2026-92216](https://cve.now/CVE-2026-92216.md): a2ui-project a2ui Binder generic-binder.ts openUrl redirect (CVSS 5.3, a2ui-project a2ui)
- [CVE-2026-92215](https://cve.now/CVE-2026-92215.md): a2ui-project a2ui FileResolver file\_resolver.py httpx.get server-side request forgery (CVSS 6.9, a2ui-project a2ui)
- [CVE-2026-92214](https://cve.now/CVE-2026-92214.md): a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting (CVSS 5.1, a2ui-project a2ui)
- [CVE-2026-92213](https://cve.now/CVE-2026-92213.md): a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection (CVSS 5.1, a2ui-project a2ui)
- [CVE-2025-56563](https://cve.now/CVE-2025-56563.md): A Server-Side Request Forgery vulnerability exists in sat\_proxy.php in Zenith Satellite Tracker 1.0. (CVSS 9.8)
- [CVE-2025-56565](https://cve.now/CVE-2025-56565.md): DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within no (CVSS 7.6)
- [CVE-2025-56566](https://cve.now/CVE-2025-56566.md): MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. (CVSS 4.6)
- [CVE-2026-38999](https://cve.now/CVE-2026-38999.md): A Null Pointer Dereference in the mk\_sched\_event\_close function (mk\_server/mk\_scheduler.c) of Monkey through commit 4fb0c16 allows attackers (CVSS 7.5)
- [CVE-2026-51990](https://cve.now/CVE-2026-51990.md): An issue in Sogou Sogou Input Method \< 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz\_hel (CVSS 9.8)
- [CVE-2026-79298](https://cve.now/CVE-2026-79298.md): An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrar (CVSS 8.4)
- [CVE-2026-88592](https://cve.now/CVE-2026-88592.md): kkFileView \>= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). (CVSS 9.1)
- [CVE-2026-88593](https://cve.now/CVE-2026-88593.md): kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.